diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0108aee1..ef107075 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,8 +2,28 @@
 
 ## 1.0.0-beta.13 — 2026-08-07
 
+### Features
+- Add `failproofai flush` — deliver what is already spooled, now. The collector is unhurried on purpose (a batch is swept once it is older than two minutes, at most 64 per pass, on a 60-second cadence), which is right for a backlog and exactly wrong for somebody standing at a dashboard waiting to see their own events: from there "not delivered yet" and "not working" look identical. The command asks the daemon for a pass with no minimum age and no cap, and `--wait` waits until the spool drains or its timeout expires, so a script can flush and then assert. It re-sends nothing — for history the collector already read past, that is still `backfill`. (#663)
+- Rename the cloud-policy vocabulary: a **generation** is now a **deployment**, and a policy **revision** is a **version**. Both were words the product used nowhere else — a customer reads "deployment 7" and "version 3" without a glossary. The rename goes through the wire format and the on-disk manifest, not just the labels, and lands with the matching AgentEye change: a server and a daemon that disagree on these names means the fleet stops reconciling, silently. (#663)
+- Capture sessions from more than one location per agent CLI. Every source watched exactly the place its own installer puts it — `~/.claude/projects`, `~/.hermes/state.db` — which is right for one machine and wrong for every other arrangement: a second profile, a mounted team share, a container's home beside the host's, an agent an operator relocated. Those hold real sessions and nothing collected them. `failproofai harness add-path <harness> [<label>=]<path>` (plus `list` / `remove-path`) writes `[collector.sources.<harness>] extra_paths` in `config.toml`; `FAILPROOFAI_<HARNESS>_EXTRA_PATHS` overrides it for containers. Covers all twelve harnesses — thirteen sources, since `claude` carries its subagent transcripts, which share a root and would otherwise be silently dropped under an added path. Grammar, folder-name label fallback and `<label>-<agentId>` namespacing match AgentEye's collector (`--openclaw-extra-path`, `--hermes-extra-path`) rather than inventing a second answer to what an extra path is. Three things are structural rather than incidental: **each labelled path is its own task**, because `roots` is walked by one task with one `Params` and the label lives there — sharing would capture both under one id; each gets **its own cursor directory**, because the store writes its whole map atomically and two instances sharing one clobber each other's watermark and both re-read from zero after every restart; and each gets **its own health key**, or they overwrite each other's record and `root_present` alternates, destroying the "absent root versus idle source" distinction that file exists to draw — the exact failure Hermes hit with its per-profile databases. The label is applied in `SpoolWriter::push`, the one point every event from every source passes through (where `machine_id` and `user` are already stamped for the same reason), and **not** in either engine: a SQLite format is handed `params.agent_id` only as a fallback and derives the real id from the row (`devin::agent_id` returns `devin-<project>` and never consults the fallback for a session that has a working directory, which is all of them), so prefixing there would namespace only the sessions that failed to derive an id. A path overlapping one already captured is refused at startup rather than collected twice under two ids, and an unrecognised `[collector.sources.*]` table is reported instead of silently capturing nothing. A machine with nothing configured is unchanged, byte for byte, including its `config.toml`. Adding or removing a path needs no restart and no sudo: the daemon's collector manager already re-reads `config.toml` on an interval and cycles the collector whenever the resolved `CollectorConfig` changes, and `sources` rides that by living inside the compared value — verified live (task count 21 → 23 within one interval, and the first transcript under the new path reached the server) and pinned by an e2e test that drives the real binary against a hand-edited config. (#667)
+
 ### Fixes
+- Make the hook path able to read a `schemaVersion: 1` active manifest it already claimed to accept. The reader listed 1 as supported "for files a pre-rename beta daemon left behind", then read only the post-rename field names — so every genuine v1 file threw `active manifest deployment is invalid` and the acceptance was unreachable. The Rust reader of the same file handles it with `#[serde(alias)]`; this is the TypeScript half of that pair, and it was the half missing. The failure shape is the one this module's own header warns about: the daemon reconciles happily, `active.json` is correct on disk, and the hook path alone refuses — cloud policy stops being enforced while every other signal reports the machine healthy, and recovery needs a successful poll, so an offline machine stays exposed. The fixtures hid it: every `schemaVersion: 1` fixture paired that version with post-rename field names, a shape no writer ever produced. (#PR)
+- Rename the daemon's own contract document (`crates/CLOUD_POLICIES.md`) and the live cross-repo pairing harness, both of which the rename missed. The document's desired-state example was a payload the daemon now rejects, and the harness still read `revision` off a publish response, sent `revision` in two deploy bodies, and asserted an ingested event carried `cloud_generation` — so it would have failed against the renamed server while proving nothing about the new contract. (#PR)
+- Move the cloud-policy desired state to `schemaVersion: 2`, and accept 1 only from disk. The v1 payload named its fields `generation` and `revision`; after the rename it carried neither, at the same version number — same endpoint, same version, different shape, which is the one thing a schema version exists to prevent. AgentEye now emits 2 (FailproofAI/agenteye#559) and this daemon accepts both: 2 from the server, 1 solely so a `desired-state.json` or `active.json` written by an earlier beta daemon still parses off disk, since both structs carry `deny_unknown_fields` and a refusal there would leave the machine unable to read its own persisted state and quietly not enforcing. For the same reason the field aliases stay on the persisted `ActiveDeployment`/`ActivePolicy` and were REMOVED from the wire `DesiredState`/`DesiredPolicy` — no server can emit the old spelling, so tolerating it there would be dead code, and a silently-accepted stale field is how the two sides drift apart again. The TypeScript hook reader accepts the same pair; it previously accepted only 1, which meant the daemon reconciled happily, wrote a correct `active.json`, and the hook path alone refused it — cloud policy silently unenforced while every other signal read healthy. Verified against the real server end to end: publish, deploy, pull, verify, activate, deny. (#663)
+- Stop ← hanging the setup wizard. `BACK` is a symbol the shared prompt handler injects when a prompt opts into back navigation, so it is not a value of any prompt's own result type — and `multiSelect`'s summary calls `values.includes(...)`, which throws `TypeError` on a symbol. It threw *inside* `finish`, before the promise resolved, so pressing ← never settled it and the wizard stopped responding to input entirely; `selectOne` did not throw but rendered the literal text `Symbol(failproofai.back)` as the user's answer. Handled once in `collapse()` rather than in each `summaryFor`, so no prompt has to know about a symbol it never declared. (#663)
+- Keep cloud-policy state written before the deployment/version rename readable across an upgrade. `ActiveDeployment` and `ActivePolicy` carry `deny_unknown_fields`, so an upgraded daemon failed to parse its own `active.json` on three counts at once — `generation` unrecognised, `deployment` missing, and the same again for every policy's `revision`. The machine silently lost the deployment it was enforcing until a poll succeeded, which on a fail-closed machine is precisely the gap this subsystem exists to close. Both spellings are now accepted, on the persisted state and on the desired state the server sends. (#663)
+- Make `failproofai flush` refuse on a platform with no daemon instead of reporting success. It skipped the daemon check, wrote the request file and exited 0 — but nothing reads it there, so the only symptom was data that never arrived. It now refuses before writing anything, which is what `failproofai config` already does on the same platforms. (#663)
+- Stop an upgrade from layout 1 silently emptying the user's policy selection. Layout 1 kept it at `~/.failproofai/policies-config.json` and layout 2 keeps it at `policies/local-policies/policies-config.json` — and BOTH were on the reset list, so moving between them discarded every builtin the user had enabled, every explicit `customPoliciesPaths` entry and every `policyParams` value. The reset runs unattended from `checkLayoutForCli` on the first command after an upgrade, and the machine still read as configured afterwards (`isConfigured()` is a union that sees the agent CLIs' untouched settings files) — so the wizard never re-asked, and hooks kept firing against a policy set that had quietly become the default one. That is the same silent enforcement gap `migrateConventionPolicies()` and `migrateHookActivity()` already exist to close, by a third route. The carry is deliberately narrow, and stays inside the standing wipe-and-re-setup decision: everything derived (cursors, spool, health, audit cache) still goes and is rebuilt, and what moves is only what a person typed and nothing regenerates. It is an ALLOWLIST rather than a copy, because layout 1's file also carried a `collector` block in camelCase and layout 2 moved those settings to `[collector]` in `config.toml` in snake_case — carrying it would put a key into the new file that nothing reads, looking preserved and behaving absent, which is the exact bug `fpai-collect`'s `Settings` documents. It runs in two phases (read before the deletions, write after) because its source AND its destination's parent are both on the reset list; writing first would have the reset delete the carry moments after it happened, which the note on `hookActivityDir()` records happening once already. A reset FROM the current layout no longer clears `local-policies/` at all — that is not a layout migration, and there it would discard a current, valid selection. An existing layout-2 config is never overwritten by the layout-1 file beside it. (#667)
 - Make `failproofai config` refuse setup on an unsupported platform (Windows, today) instead of completing it unenforced. The wizard used to skip the daemon requirement and finish anyway, leaving the machine reading as configured while enforcing in-process with no fail-closed guarantee — now it prints why and exits 1 before drawing a single prompt, writing nothing. (#664)
+- Cut roughly a second of dead wait out of installing the daemon. `waitForDaemonRunning` slept a flat 750ms and then read the service status once, which was wrong in both directions: the socket is up in ~13ms and answers a real hook in ~125ms, so a healthy machine sat there with the answer already in hand — twice, because the repair path uninstalls and reinstalls — while a daemon that died at 100ms went unnoticed until the sleep was over. The window is now polled: leaving `running` fails immediately, and the wait ends as soon as the daemon accepts a connection, which is stronger evidence it did not die at startup than "still active after an arbitrary sleep". (#663)
+- Let the setup wizard go back a step. Cancelling and going back were both `null`, so the only way to change an earlier answer was to abandon setup and start over; `←` on the harness step now re-asks the policy step with the previous selection still ticked. The policy step itself offers no `←` — the step before it is frequently not asked at all (a single scope choice is stated, not prompted), so it would sometimes go nowhere. (#663)
+- List cloud-managed policies in `failproofai policies`. They enforce on the machine exactly like builtins and convention policies, and nothing showed them — so the command answered "what is enforcing here?" with a subset, and the policies an operator pushed to a fleet were precisely the ones invisible to the person standing at the machine. `observe` deployments render as OBS rather than ON, because their verdict is discarded, and the section says outright that these are not switchable with `--uninstall`. (#663)
+- Stop the API-key prompt printing one copy of itself per character typed. `\r\x1b[2K` erases the row the cursor is on and nothing above it, so a line wider than the terminal wrapped, the erase reached only its last row, and every keystroke left the previous rows behind — pasting a 40-character key stacked 40 prompts down the screen. The prompt now truncates to one physical row. (#663)
+- Offer the cloud connection first in the setup wizard, and preselect it. Connecting is what most people running the wizard came to do; staying local is one keystroke away and neither option's copy changed. (#663)
+- Say "harnesses" rather than "AI assistants" throughout setup — the wizard protects agent CLIs, and the word it used for them matched no other surface. (#663)
+- Document the commands and flags that `--help` never mentioned: `backfill` (absent entirely, with `--since` and `--dry-run`), the new `flush`, and the whole `config` cloud surface — `--connect`, `--token`, `--machine-id`, `--machine-label`, `--no-transcripts`, `--disconnect`, `--status`, `--pause`, `--resume`. A flag nobody can discover is a flag that does not exist. (#663)
+- Drop the "safety net" metaphor from the setup wizard's intro, which now names the tool it is setting up. A metaphor tells a first-time user nothing about what the next four steps will do to their machine, and this is the first line they see. (#663)
 
 ## 1.0.0-beta.12 — 2026-08-07
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 7c030f32..140b3a2a 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1152,6 +1152,18 @@ src/hooks/
                               all 11 CLIs, recoverable only by hand-editing
                               ~/.failproofai/policies-config.json
   manager.ts                 policies --install / --uninstall / list
+  harness-cli.ts             `failproofai harness add-path/remove-path/list` —
+                              edits [collector.sources.<harness>] extra_paths in
+                              config.toml and NOTHING else. The grammar, `~`
+                              expansion, overlap rejection and <label>-<agentId>
+                              namespacing all live in the daemon
+                              (crates/fpai-collect/src/extra_paths.rs); this side
+                              validates only the HARNESS NAME, because that is
+                              the one failure with no other detector — a typo'd
+                              table is valid TOML that captures nothing.
+                              HARNESS_KEYS here and in main.rs are two
+                              hand-maintained copies of one list; a test reads
+                              the Rust source to keep them identical
 src/index.ts                 Public API entry point → compiled to dist/index.js
 dist/index.js                CJS bundle (built by `bun run build`; shipped in npm pkg)
 dist/cli.mjs                 Bundled bin/failproofai.mjs (bun run build:cli)
@@ -1159,6 +1171,24 @@ dist/worker.mjs              Bundled bin/failproofai-worker.mjs (bun run build:w
                               plain Node can't resolve raw .ts specifiers, so the warm
                               worker needs this bundle just like the CLI does
 Cargo.toml                   Rust workspace root (resolver "3", shared [workspace.package])
+crates/fpai-collect/src/extra_paths.rs
+                              Per-source extra capture paths: `label=path`
+                              grammar, folder-name label fallback, and the
+                              rejections that each prevent a SILENT failure — a
+                              path overlapping a default root is collected twice
+                              under two agent ids, and two entries sharing a
+                              label share a cursor directory whose whole map is
+                              written atomically, so both re-read from zero after
+                              every restart. Each accepted path becomes its OWN
+                              task (file_source / sqlite_harness in main.rs) with
+                              its own cursor dir and health key — Hermes reached
+                              this shape first, via per-profile databases. The
+                              <label>-<agentId> prefix is applied in
+                              SpoolWriter::push, never in an engine: a SQLite
+                              format derives its real id from the row and takes
+                              params.agent_id only as a fallback, so prefixing
+                              there namespaces just the sessions that failed to
+                              derive one
 crates/fpai-ipc/              Wire protocol shared by the daemon and its tests: length-
                               prefixed JSON framing, protocolVersion envelope, peer-
                               credential checks (see crates/PROTOCOL.md)
diff --git a/__tests__/e2e/layout/cloud-pairing.sh b/__tests__/e2e/layout/cloud-pairing.sh
index fe133bea..0f436ca4 100755
--- a/__tests__/e2e/layout/cloud-pairing.sh
+++ b/__tests__/e2e/layout/cloud-pairing.sh
@@ -139,13 +139,13 @@ customPolicies.add({
 '
 BODY=$(python3 -c "import json,sys;print(json.dumps({'id':'e2e-cloud-guard','description':'e2e','source':sys.stdin.read()}))" <<< "$POLICY_SRC")
 PUB=$(api POST /enforcement/policies "$OPS" "$BODY")
-REV=$(printf '%s' "$PUB" | jqp "['revision']")
-[ -n "$REV" ] && ok "policy published (revision $REV)" || bad "policy published" "$PUB"
+VER=$(printf '%s' "$PUB" | jqp "['version']")
+[ -n "$VER" ] && ok "policy published (version $VER)" || bad "policy published" "$PUB"
 
 DEP=$(api PUT "/enforcement/deployments/$MACHINE" "$OPS" \
-  "{\"policies\":[{\"id\":\"e2e-cloud-guard\",\"revision\":$REV}]}")
-GEN=$(printf '%s' "$DEP" | jqp "['generation']")
-[ -n "$GEN" ] && ok "policy deployed to $MACHINE (generation $GEN)" || bad "policy deployed" "$DEP"
+  "{\"policies\":[{\"id\":\"e2e-cloud-guard\",\"version\":$VER}]}")
+DEPL=$(printf '%s' "$DEP" | jqp "['deployment']")
+[ -n "$DEPL" ] && ok "policy deployed to $MACHINE (deployment $DEPL)" || bad "policy deployed" "$DEP"
 
 DS=$(api GET "/enforcement/v1/desired-state?machineId=$MACHINE" "$OPS")
 eq "desired-state names the policy" "$(printf '%s' "$DS" | jqp "['policies'][0]['id']")" "e2e-cloud-guard"
@@ -179,8 +179,8 @@ hasnt "cloud polling is NOT disabled on an enrolled machine" "$(cat "$LOG")" "cl
 
 ACTIVE="$H/policies/cloud-policies/active.json"
 for _ in 1 2 3 4 5 6 7 8 9 10; do [ -f "$ACTIVE" ] && break; sleep 1; done
-[ -f "$ACTIVE" ] && ok "the pulled generation lands where the CLI reads it" \
-  || bad "the pulled generation lands where the CLI reads it" "no $ACTIVE"
+[ -f "$ACTIVE" ] && ok "the pulled deployment lands where the CLI reads it" \
+  || bad "the pulled deployment lands where the CLI reads it" "no $ACTIVE"
 MAN=$(cat "$ACTIVE" 2>/dev/null)
 has "…naming the deployed policy" "$MAN" "e2e-cloud-guard"
 has "…with its content hash" "$MAN" "sha256"
@@ -200,7 +200,7 @@ hasnt "an unrelated command is not denied" "$OUT" '"permissionDecision":"deny"'
 head1 "PHASE 5 — OBSERVE: evaluated, recorded, never blocking"
 
 api PUT "/enforcement/deployments/$MACHINE" "$OPS" \
-  "{\"policies\":[{\"id\":\"e2e-cloud-guard\",\"revision\":$REV,\"effect\":\"observe\"}]}" >/dev/null
+  "{\"policies\":[{\"id\":\"e2e-cloud-guard\",\"version\":$VER,\"effect\":\"observe\"}]}" >/dev/null
 DS=$(api GET "/enforcement/v1/desired-state?machineId=$MACHINE" "$OPS")
 eq "the same policy is redeployed as observe" "$(printf '%s' "$DS" | jqp "['policies'][0]['effect']")" "observe"
 
@@ -246,7 +246,7 @@ has "…naming the cloud policy" "$PAY" "e2e-cloud-guard"
 has "…the verdict it would have returned" "$PAY" '"decision":"deny"'
 has "…while the action itself was allowed" "$PAY" '"outcome":"allow"'
 has "…stamped with this machine" "$PAY" '"machine_id":"e2e-machine"'
-has "…and the generation it enforced from" "$PAY" '"cloud_generation"'
+has "…and the deployment it enforced from" "$PAY" '"cloud_deployment"'
 
 DENIED=$(ch "select payload from agenteye.events where session_id = 'e2e-sess' and payload like '%\"outcome\":\"deny\"%' limit 1")
 has "the ENFORCE-mode denial also reached the server" "$DENIED" "e2e-cloud-guard"
diff --git a/__tests__/hooks/builtin-policies.test.ts b/__tests__/hooks/builtin-policies.test.ts
index 877b39ea..60d7f574 100644
--- a/__tests__/hooks/builtin-policies.test.ts
+++ b/__tests__/hooks/builtin-policies.test.ts
@@ -2753,7 +2753,7 @@ describe("hooks/builtin-policies", () => {
         }
         // Base branch comparison: log {remote}/{baseBranch}..HEAD
         if (joined.includes("log") && joined.includes(`${remote}/${baseBranch}..HEAD`)) {
-          if (opts.baseRefExists === false) throw new Error("unknown revision");
+          if (opts.baseRefExists === false) throw new Error("fatal: ambiguous argument: unknown revision or path not in the working tree.");
           return opts.commitsAheadOfBase ?? "abc123 some commit\n";
         }
         // Tracking branch comparison: log {remote}/{branch}..HEAD
@@ -3001,11 +3001,11 @@ describe("hooks/builtin-policies", () => {
       vi.mocked(execFileSync).mockImplementation((_cmd: string, args?: readonly string[]) => {
         const joined = args?.join(" ") ?? "";
         if (joined.includes("log") && joined.includes("..HEAD")) {
-          if (opts.baseRefExists === false) throw new Error("unknown revision");
+          if (opts.baseRefExists === false) throw new Error("fatal: ambiguous argument: unknown revision or path not in the working tree.");
           return opts.commitsAhead ?? "abc123 some commit\n";
         }
         if (joined.includes("diff") && joined.includes("--stat")) {
-          if (opts.baseRefExists === false) throw new Error("unknown revision");
+          if (opts.baseRefExists === false) throw new Error("fatal: ambiguous argument: unknown revision or path not in the working tree.");
           return opts.fileDiff ?? " src/index.ts | 2 +-\n 1 file changed\n";
         }
         return "";
@@ -3387,7 +3387,7 @@ describe("hooks/builtin-policies", () => {
       vi.mocked(execFileSync).mockImplementation((_cmd: string, args?: readonly string[]) => {
         const joined = args?.join(" ") ?? "";
         if (joined.includes("rev-parse") && joined.includes("--verify")) {
-          if (opts.baseRefExists === false) throw new Error("unknown revision");
+          if (opts.baseRefExists === false) throw new Error("fatal: ambiguous argument: unknown revision or path not in the working tree.");
           return "";
         }
         if (joined.includes("log") && joined.includes("..HEAD")) {
diff --git a/__tests__/hooks/cloud-connect-permissions.test.ts b/__tests__/hooks/cloud-connect-permissions.test.ts
index 80484b7d..88f2d776 100644
--- a/__tests__/hooks/cloud-connect-permissions.test.ts
+++ b/__tests__/hooks/cloud-connect-permissions.test.ts
@@ -49,7 +49,7 @@ function probes() {
     ran,
     verifyPolicy: async () => {
       ran.policy = true;
-      return { ok: true as const, policyCount: 3, generation: 7 };
+      return { ok: true as const, policyCount: 3, deployment: 7 };
     },
     verifyIngest: async () => {
       ran.ingest = true;
diff --git a/__tests__/hooks/cloud-enrollment-cli.test.ts b/__tests__/hooks/cloud-enrollment-cli.test.ts
index 49beb672..ab4d44f2 100644
--- a/__tests__/hooks/cloud-enrollment-cli.test.ts
+++ b/__tests__/hooks/cloud-enrollment-cli.test.ts
@@ -11,7 +11,7 @@ import { readConfig } from "../../src/hooks/fp-config";
 
 let dir: string;
 let realHome: string | undefined;
-const ok = vi.fn(async () => ({ ok: true as const, policyCount: 3, generation: 12 }));
+const ok = vi.fn(async () => ({ ok: true as const, policyCount: 3, deployment: 12 }));
 const ingestOk = vi.fn(async () => ({ ok: true as const }));
 // A key carrying both permissions, so the capability gating is transparent here
 // and each test exercises whatever `verify`/`verifyIngest` it injected. Reports
@@ -64,7 +64,7 @@ describe("--connect", () => {
     expect(r.exitCode).toBe(0);
     // The label is the human name; the explicit id is shown in parentheses.
     expect(r.lines.join("\n")).toMatch(/Connected to https:\/\/be\.failproof\.ai as lab-1 \(m-1\)/);
-    expect(r.lines.join("\n")).toMatch(/3 policies assigned \(generation 12\)/);
+    expect(r.lines.join("\n")).toMatch(/3 policies assigned \(deployment 12\)/);
     expect(readCloudCredentials()).toEqual({
       url: base.url,
       machineId: "m-1",
@@ -349,13 +349,13 @@ describe("--disconnect means disconnect", () => {
     // Clearing the credential ends polling. Every artifact already on disk
     // stayed referenced by active.json and kept being loaded on every tool
     // call, so a machine that had deliberately left its organisation went on
-    // being governed by whatever generation was current when it left.
+    // being governed by whatever deployment was current when it left.
     await runConnectCommand({ ...base, machineId: "m-1" });
     const managedRoot = resolve(dir, "home", "policies", "cloud-policies");
     mkdirSync(managedRoot, { recursive: true });
     writeFileSync(
       resolve(managedRoot, "active.json"),
-      JSON.stringify({ schemaVersion: 1, generation: 4, policies: [] }),
+      JSON.stringify({ schemaVersion: 1, deployment: 4, policies: [] }),
     );
 
     runDisconnectCommand();
diff --git a/__tests__/hooks/cloud-enrollment.test.ts b/__tests__/hooks/cloud-enrollment.test.ts
index 50a1d040..599b4449 100644
--- a/__tests__/hooks/cloud-enrollment.test.ts
+++ b/__tests__/hooks/cloud-enrollment.test.ts
@@ -170,7 +170,7 @@ describe("verifyCloudCredentials", () => {
   let respond: (path: string) => { status: number; body: string };
 
   beforeEach(async () => {
-    respond = () => ({ status: 200, body: JSON.stringify({ schemaVersion: 1, generation: 4, policies: [] }) });
+    respond = () => ({ status: 200, body: JSON.stringify({ schemaVersion: 1, deployment: 4, policies: [] }) });
     server = createServer((req, res) => {
       lastAuth = req.headers.authorization;
       const { status, body } = respond(req.url ?? "");
@@ -192,10 +192,10 @@ describe("verifyCloudCredentials", () => {
     let seenUrl = "";
     respond = (url) => {
       seenUrl = url;
-      return { status: 200, body: JSON.stringify({ generation: 9, policies: [{ id: "a" }, { id: "b" }] }) };
+      return { status: 200, body: JSON.stringify({ deployment: 9, policies: [{ id: "a" }, { id: "b" }] }) };
     };
     const result = await verifyCloudCredentials(creds());
-    expect(result).toEqual({ ok: true, policyCount: 2, generation: 9 });
+    expect(result).toEqual({ ok: true, policyCount: 2, deployment: 9 });
     expect(lastAuth).toBe("Bearer the-token");
     expect(seenUrl).toContain("/enforcement/v1/desired-state?machineId=m-1");
   });
diff --git a/__tests__/hooks/cloud-managed-policies.test.ts b/__tests__/hooks/cloud-managed-policies.test.ts
index 27289589..accdd7ff 100644
--- a/__tests__/hooks/cloud-managed-policies.test.ts
+++ b/__tests__/hooks/cloud-managed-policies.test.ts
@@ -16,16 +16,16 @@ function fixture(policyBytes = Buffer.from("export default 'managed';\n")) {
   roots.push(root);
   process.env.FAILPROOFAI_CLOUD_POLICY_DIR = root;
   const sha256 = createHash("sha256").update(policyBytes).digest("hex");
-  const generationDir = join(root, "generations", "12");
-  mkdirSync(generationDir, { recursive: true });
-  const policyPath = join(generationDir, "guard.mjs");
+  const deploymentDir = join(root, "deployments", "12");
+  mkdirSync(deploymentDir, { recursive: true });
+  const policyPath = join(deploymentDir, "guard.mjs");
   writeFileSync(policyPath, policyBytes);
   writeFileSync(
     join(root, "active.json"),
     JSON.stringify({
-      schemaVersion: 1,
-      generation: 12,
-      policies: [{ id: "guard", revision: 3, sha256, path: "generations/12/guard.mjs" }],
+      schemaVersion: 2,
+      deployment: 12,
+      policies: [{ id: "guard", version: 3, sha256, path: "deployments/12/guard.mjs" }],
     }),
   );
   return { root, policyPath, sha256 };
@@ -36,17 +36,17 @@ afterEach(() => {
   for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
 });
 
-describe("cloud-managed policy active generation", () => {
+describe("cloud-managed policy active deployment", () => {
   it("returns only hash-verified artifacts from active.json", () => {
     const { policyPath, sha256 } = fixture();
     expect(readActiveCloudManagedPolicies()).toEqual([
       // `effect` defaults to enforce: a manifest written before observe mode
       // existed must not silently downgrade a machine to observation.
-      { id: "guard", revision: 3, sha256, path: policyPath, generation: 12, effect: "enforce" },
+      { id: "guard", version: 3, sha256, path: policyPath, deployment: 12, effect: "enforce" },
     ]);
   });
 
-  it("returns an empty set when no cloud generation is active", () => {
+  it("returns an empty set when no cloud deployment is active", () => {
     const root = mkdtempSync(join(tmpdir(), "fpai-cloud-managed-empty-"));
     roots.push(root);
     process.env.FAILPROOFAI_CLOUD_POLICY_DIR = root;
@@ -63,14 +63,14 @@ describe("cloud-managed policy active generation", () => {
     const { root, sha256 } = fixture();
     const outside = join(tmpdir(), `fpai-cloud-managed-outside-${process.pid}.mjs`);
     writeFileSync(outside, "export default 'managed';\n");
-    const link = join(root, "generations", "12", "escape.mjs");
+    const link = join(root, "deployments", "12", "escape.mjs");
     symlinkSync(outside, link);
     writeFileSync(
       join(root, "active.json"),
       JSON.stringify({
         schemaVersion: 1,
-        generation: 12,
-        policies: [{ id: "guard", revision: 3, sha256, path: "generations/12/escape.mjs" }],
+        deployment: 12,
+        policies: [{ id: "guard", version: 3, sha256, path: "deployments/12/escape.mjs" }],
       }),
     );
     try {
@@ -88,8 +88,8 @@ describe("policy effect", () => {
       join(root, "active.json"),
       JSON.stringify({
         schemaVersion: 1,
-        generation: 12,
-        policies: [{ id: "guard", revision: 3, sha256, path: "generations/12/guard.mjs", effect: "observe" }],
+        deployment: 12,
+        policies: [{ id: "guard", version: 3, sha256, path: "deployments/12/guard.mjs", effect: "observe" }],
       }),
     );
     expect(readActiveCloudManagedPolicies()[0]).toMatchObject({ path: policyPath, effect: "observe" });
@@ -103,8 +103,8 @@ describe("policy effect", () => {
       join(root, "active.json"),
       JSON.stringify({
         schemaVersion: 1,
-        generation: 12,
-        policies: [{ id: "guard", revision: 3, sha256, path: "generations/12/guard.mjs", effect: "sometimes" }],
+        deployment: 12,
+        policies: [{ id: "guard", version: 3, sha256, path: "deployments/12/guard.mjs", effect: "sometimes" }],
       }),
     );
     expect(() => readActiveCloudManagedPolicies()).toThrow(/unknown effect/);
@@ -116,7 +116,7 @@ describe("clearActiveCloudManagedPolicies", () => {
     // `--disconnect` cleared the credential, which ends POLLING. Every artifact
     // already on disk stayed referenced by active.json and kept being loaded on
     // every tool call — so a machine that had deliberately left its
-    // organisation went on being governed by whatever generation was current
+    // organisation went on being governed by whatever deployment was current
     // when it left, indefinitely, while `--status` called it unconnected.
     const { policyPath } = fixture();
     expect(readActiveCloudManagedPolicies()).toHaveLength(1);
@@ -129,10 +129,73 @@ describe("clearActiveCloudManagedPolicies", () => {
     expect(existsSync(policyPath)).toBe(true);
   });
 
-  it("reports nothing removed when no generation was active", () => {
+  it("reports nothing removed when no deployment was active", () => {
     const root = mkdtempSync(join(tmpdir(), "fpai-cloud-managed-clear-"));
     roots.push(root);
     process.env.FAILPROOFAI_CLOUD_POLICY_DIR = root;
     expect(clearActiveCloudManagedPolicies()).toBe(false);
   });
 });
+
+
+describe("a manifest written BEFORE the rename", () => {
+  // The reader accepts schemaVersion 1 so a pre-rename beta daemon's active.json
+  // still parses. That acceptance was unreachable: it read only the v2 field
+  // names, so every genuine v1 file threw "active manifest deployment is
+  // invalid" — the daemon reconciling happily while the hook path alone refused,
+  // which is the exact drift this module's header warns about.
+  //
+  // These bytes are the real v1 spelling, matching the fixture the Rust test
+  // `active_json_written_before_the_rename_still_parses` uses.
+  const seedV1 = () => {
+    const root = mkdtempSync(join(tmpdir(), "fpai-cloud-v1-"));
+    roots.push(root);
+    process.env.FAILPROOFAI_CLOUD_POLICY_DIR = root;
+    const bytes = "export default {};\n";
+    const sha256 = createHash("sha256").update(bytes).digest("hex");
+    const dir = join(root, "generations", "1");
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, "guard.mjs"), bytes);
+    writeFileSync(
+      join(root, "active.json"),
+      JSON.stringify({
+        schemaVersion: 1,
+        generation: 7,
+        policies: [{ id: "guard", revision: 3, sha256, path: "generations/1/guard.mjs" }],
+      }),
+    );
+    return sha256;
+  };
+
+  it("parses, instead of throwing on the field names it was accepted for", () => {
+    seedV1();
+    const active = readActiveCloudManagedPolicies();
+    expect(active).toHaveLength(1);
+    expect(active[0].deployment).toBe(7);
+    expect(active[0].version).toBe(3);
+  });
+
+  it("prefers the new names when a manifest carries both", () => {
+    const root = mkdtempSync(join(tmpdir(), "fpai-cloud-both-"));
+    roots.push(root);
+    process.env.FAILPROOFAI_CLOUD_POLICY_DIR = root;
+    const bytes = "export default {};\n";
+    const sha256 = createHash("sha256").update(bytes).digest("hex");
+    mkdirSync(join(root, "deployments", "9"), { recursive: true });
+    writeFileSync(join(root, "deployments", "9", "guard.mjs"), bytes);
+    writeFileSync(
+      join(root, "active.json"),
+      JSON.stringify({
+        schemaVersion: 2,
+        generation: 1,
+        deployment: 9,
+        policies: [
+          { id: "guard", revision: 1, version: 4, sha256, path: "deployments/9/guard.mjs" },
+        ],
+      }),
+    );
+    const active = readActiveCloudManagedPolicies();
+    expect(active[0].deployment).toBe(9);
+    expect(active[0].version).toBe(4);
+  });
+});
diff --git a/__tests__/hooks/configure-wizard.test.ts b/__tests__/hooks/configure-wizard.test.ts
index cf34d52a..5285e0d1 100644
--- a/__tests__/hooks/configure-wizard.test.ts
+++ b/__tests__/hooks/configure-wizard.test.ts
@@ -1,6 +1,8 @@
 import { describe, it, expect, vi, beforeEach, afterEach, beforeAll, afterAll } from "vitest";
 import { mkdtempSync, rmSync, existsSync, mkdirSync, writeFileSync, readFileSync } from "node:fs";
-import { summarize } from "../../src/hooks/tui";
+import { summarize,
+  BACK,
+} from "../../src/hooks/tui";
 import { tmpdir } from "node:os";
 import { resolve } from "node:path";
 
@@ -99,7 +101,7 @@ vi.mock("../../src/hooks/cloud-connection", async (importOriginal) => {
   return {
     ...actual,
     connectToCloud: vi.fn(async () => ({
-      policy: { ok: true, policyCount: 2, generation: 7 },
+      policy: { ok: true, policyCount: 2, deployment: 7 },
       ingest: { ok: true },
       anyConfigured: true,
     })),
@@ -368,7 +370,7 @@ describe("configure-wizard pure builders", () => {
 
   it("omits every optional note when nothing is present", () => {
     const message = buildCompletionSummary(2, 1, undefined, false, false);
-    expect(message).toBe("Setup complete — 2 policies · 1 assistant");
+    expect(message).toBe("Setup complete — 2 policies · 1 harness");
   });
 });
 
@@ -611,7 +613,7 @@ describe("scope-aware assistant selection", () => {
     expect(message).toContain("Setup complete");
     // 3 columns of gutter ("└  ") sit in front of it when rendered.
     expect(message.length + 3).toBeLessThanOrEqual(80);
-    expect(message).toContain("assistants"); // the tail survived
+    expect(message).toContain("harnesses"); // the tail survived
   });
 
   it("applies to only the scope-supported CLIs when Everything available is ticked", async () => {
@@ -1258,3 +1260,43 @@ describe("connect step", () => {
     expect(connectToCloud).not.toHaveBeenCalled();
   });
 });
+
+describe("wizard back-navigation", () => {
+  it("← on the harness step re-asks the policy step, and carries the answer back in", async () => {
+    const one = vi.mocked(selectOne);
+    const many = vi.mocked(multiSelect);
+    one.mockResolvedValueOnce("user" as never); // scope
+    many.mockResolvedValueOnce(["secrets", "git"] as never); // policies, 1st pass
+    many.mockResolvedValueOnce(BACK as never); // harnesses -> ←
+    many.mockResolvedValueOnce(["secrets"] as never); // policies, re-asked
+    many.mockResolvedValueOnce(["claude"] as never); // harnesses, 2nd pass
+    one.mockResolvedValueOnce("local" as never); // connect
+    one.mockResolvedValueOnce("apply" as never); // review
+
+    await runConfigureWizard(ttyIO());
+
+    // Four multiSelect calls: policies, harnesses, policies again, harnesses.
+    expect(many.mock.calls.length).toBe(4);
+
+    // The re-asked policy step must arrive pre-checked with the first answer,
+    // or a ← silently discards what the user already chose.
+    const reasked = many.mock.calls[2]![0];
+    const checked = reasked.choices.filter((c) => c.checked);
+    expect(checked.map((c) => String(c.value)).sort()).toEqual(["git", "secrets"]);
+  });
+
+  it("the policy step itself offers no ←, because the step before it is often not asked", async () => {
+    const one = vi.mocked(selectOne);
+    const many = vi.mocked(multiSelect);
+    one.mockResolvedValueOnce("user" as never);
+    many.mockResolvedValueOnce(["git"] as never);
+    many.mockResolvedValueOnce(["claude"] as never);
+    one.mockResolvedValueOnce("local" as never);
+    one.mockResolvedValueOnce("apply" as never);
+
+    await runConfigureWizard(ttyIO());
+
+    expect(many.mock.calls[0]![0].allowBack).toBeFalsy();
+    expect(many.mock.calls[1]![0].allowBack).toBe(true);
+  });
+});
diff --git a/__tests__/hooks/daemon-service.test.ts b/__tests__/hooks/daemon-service.test.ts
index f8386fb3..5209ec51 100644
--- a/__tests__/hooks/daemon-service.test.ts
+++ b/__tests__/hooks/daemon-service.test.ts
@@ -5,6 +5,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { tmpdir, userInfo } from "node:os";
 import { resolve } from "node:path";
 import { binDir } from "../../src/hooks/fp-home";
+import { waitForDaemonRunning } from "../../src/hooks/daemon-service";
 
 vi.mock("../../src/hooks/hook-logger", () => ({
   hookLogWarn: vi.fn(),
@@ -874,3 +875,76 @@ describe("hooks/daemon-service", () => {
     },
   );
 });
+
+describe("hooks/daemon-service waitForDaemonRunning", () => {
+  // A virtual clock: `sleep` advances it, so these assert the SHAPE of the wait
+  // without spending the wall-clock time being asserted about.
+  const clock = () => {
+    let t = 0;
+    return {
+      now: () => t,
+      sleep: async (ms: number) => {
+        t += ms;
+      },
+      elapsed: () => t,
+    };
+  };
+
+  it("returns as soon as the socket answers, instead of sitting out the settle window", async () => {
+    const c = clock();
+    let calls = 0;
+    const ok = await waitForDaemonRunning({
+      now: c.now,
+      sleep: c.sleep,
+      status: () => "running",
+      // Answers on the second look — the real machine binds its socket in ~13ms.
+      accepts: async () => ++calls >= 2,
+    });
+    expect(ok).toBe(true);
+    // The old code slept a flat 750ms here regardless. Anything near that means
+    // the early exit is gone.
+    expect(c.elapsed()).toBeLessThan(300);
+  });
+
+  it("fails the moment the unit leaves running, rather than waiting the window out", async () => {
+    const c = clock();
+    let looks = 0;
+    const ok = await waitForDaemonRunning({
+      now: c.now,
+      sleep: c.sleep,
+      // Active on the first read, dead on the next — the startup-death case the
+      // settle window exists to catch.
+      status: () => (++looks <= 1 ? "running" : "stopped"),
+      accepts: async () => false,
+    });
+    expect(ok).toBe(false);
+    // Detected on the first poll, not after a 750ms sleep.
+    expect(c.elapsed()).toBeLessThan(300);
+  });
+
+  it("still holds the full window when the socket never answers but the unit stays up", async () => {
+    const c = clock();
+    const ok = await waitForDaemonRunning({
+      now: c.now,
+      sleep: c.sleep,
+      status: () => "running",
+      accepts: async () => false,
+    });
+    // Held rather than failed: a unit that stayed active for the whole window
+    // did not die at startup, which is all the settle ever established.
+    expect(ok).toBe(true);
+    expect(c.elapsed()).toBeGreaterThanOrEqual(750);
+  });
+
+  it("gives up when the unit never reaches running at all", async () => {
+    const c = clock();
+    const ok = await waitForDaemonRunning({
+      now: c.now,
+      sleep: c.sleep,
+      status: () => "stopped",
+      accepts: async () => false,
+    });
+    expect(ok).toBe(false);
+    expect(c.elapsed()).toBeGreaterThanOrEqual(5000);
+  });
+});
diff --git a/__tests__/hooks/fail-closed-force-decision.test.ts b/__tests__/hooks/fail-closed-force-decision.test.ts
index f6173e13..efcfe66c 100644
--- a/__tests__/hooks/fail-closed-force-decision.test.ts
+++ b/__tests__/hooks/fail-closed-force-decision.test.ts
@@ -273,7 +273,7 @@ describe("hooks/handler with a corrupt cloud-managed manifest", () => {
     // look protected and be enforcing only its local set.
     writeFileSync(
       join(policyRoot, "active.json"),
-      JSON.stringify({ schemaVersion: 999, generation: 1, policies: [] }),
+      JSON.stringify({ schemaVersion: 999, deployment: 1, policies: [] }),
     );
 
     const result = await evaluateHookEvent("PreToolUse", "claude", stdin({
diff --git a/__tests__/hooks/flush-cli.test.ts b/__tests__/hooks/flush-cli.test.ts
new file mode 100644
index 00000000..ba4628b5
--- /dev/null
+++ b/__tests__/hooks/flush-cli.test.ts
@@ -0,0 +1,140 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+vi.mock("../../src/hooks/fp-config", () => ({
+  readConfig: vi.fn(() => ({ collector: { hooks: true, sessions: true } })),
+}));
+vi.mock("../../src/hooks/collector-config", () => ({
+  readIngestCredential: vi.fn(() => ({ url: "http://localhost:3000/v1/events", key: "k" })),
+}));
+vi.mock("../../src/hooks/daemon-service", () => ({
+  daemonServiceStatus: vi.fn(() => "running"),
+  isDaemonSupportedPlatform: vi.fn(() => true),
+}));
+
+import { runFlushCommand, pendingBatches, flushRequestPath } from "../../src/hooks/flush-cli";
+import { readConfig } from "../../src/hooks/fp-config";
+import { readIngestCredential } from "../../src/hooks/collector-config";
+import { daemonServiceStatus } from "../../src/hooks/daemon-service";
+
+let home: string;
+
+const spool = (name: string, files: string[]) => {
+  // `home` is the HOME dir; the failproofai home is `<home>/.failproofai`.
+  const dir = join(home, ".failproofai", "state", "spool", name);
+  mkdirSync(dir, { recursive: true });
+  for (const f of files) writeFileSync(join(dir, f), "{}\n");
+};
+
+beforeEach(() => {
+  home = mkdtempSync(join(tmpdir(), "fpai-flush-"));
+  vi.mocked(readConfig).mockReturnValue({ collector: { hooks: true, sessions: true } } as never);
+  vi.mocked(readIngestCredential).mockReturnValue({ url: "u", key: "k" } as never);
+  vi.mocked(daemonServiceStatus).mockReturnValue("running" as never);
+});
+afterEach(() => rmSync(home, { recursive: true, force: true }));
+
+describe("pendingBatches", () => {
+  it("counts .jsonl across every source dir and ignores half-written .tmp", () => {
+    spool("claude", ["a.jsonl", "b.jsonl", "c.tmp"]);
+    spool("hooks", ["d.jsonl"]);
+    expect(pendingBatches(home)).toBe(3);
+  });
+
+  it("skips failed/, which is the parked-batch retry lane, not pending delivery", () => {
+    spool("claude", ["a.jsonl"]);
+    spool("failed", ["parked.jsonl", "parked2.jsonl"]);
+    expect(pendingBatches(home)).toBe(1);
+  });
+
+  it("is zero when nothing has ever spooled", () => {
+    expect(pendingBatches(home)).toBe(0);
+  });
+});
+
+describe("runFlushCommand preconditions", () => {
+  it("refuses when collection is off, and does not write a request", async () => {
+    vi.mocked(readConfig).mockReturnValue({ collector: { hooks: false, sessions: false } } as never);
+    const r = await runFlushCommand({ home });
+    expect(r.exitCode).toBe(1);
+    expect(r.lines[0]).toContain("Collection is off");
+    expect(existsSync(flushRequestPath(home))).toBe(false);
+  });
+
+  it("refuses when the machine is not connected", async () => {
+    vi.mocked(readIngestCredential).mockReturnValue(null as never);
+    const r = await runFlushCommand({ home });
+    expect(r.exitCode).toBe(1);
+    expect(r.lines[0]).toContain("not connected");
+    expect(existsSync(flushRequestPath(home))).toBe(false);
+  });
+
+  it("refuses when the daemon is not running — it is what delivers", async () => {
+    spool("claude", ["a.jsonl"]);
+    vi.mocked(daemonServiceStatus).mockReturnValue("stopped" as never);
+    const r = await runFlushCommand({ home });
+    expect(r.exitCode).toBe(1);
+    expect(r.lines[0]).toContain("stopped");
+    // A request the daemon will never read is worse than no request: it sits
+    // on disk and fires whenever the daemon next starts, long after the ask.
+    expect(existsSync(flushRequestPath(home))).toBe(false);
+  });
+
+  it("succeeds without writing a request when nothing is spooled", async () => {
+    const r = await runFlushCommand({ home });
+    expect(r.exitCode).toBe(0);
+    expect(r.lines[0]).toContain("Nothing spooled");
+    expect(existsSync(flushRequestPath(home))).toBe(false);
+  });
+});
+
+describe("runFlushCommand request", () => {
+  it("writes the request when batches are pending", async () => {
+    spool("claude", ["a.jsonl", "b.jsonl"]);
+    const r = await runFlushCommand({ home });
+    expect(r.exitCode).toBe(0);
+    expect(r.pending).toBe(2);
+    expect(r.lines[0]).toContain("2 batches spooled");
+    expect(existsSync(flushRequestPath(home))).toBe(true);
+  });
+
+  it("says 'batch' not 'batches' for one", async () => {
+    spool("claude", ["a.jsonl"]);
+    const r = await runFlushCommand({ home });
+    expect(r.lines[0]).toContain("1 batch spooled");
+    expect(r.lines[0]).not.toContain("batches");
+  });
+
+  it("--wait returns 0 once the spool drains", async () => {
+    spool("claude", ["a.jsonl"]);
+    let ticks = 0;
+    const sleep = async () => {
+      // Simulate the daemon delivering on the second poll.
+      if (++ticks === 2)
+        rmSync(join(home, ".failproofai", "state", "spool", "claude"), { recursive: true });
+    };
+    const r = await runFlushCommand({ home, wait: true, timeoutSecs: 10, sleep });
+    expect(r.exitCode).toBe(0);
+    expect(r.pending).toBe(0);
+    expect(r.lines.at(-1)).toBe("Spool drained.");
+  });
+
+  it("--wait times out non-zero, and says delivery continues rather than calling it broken", async () => {
+    spool("claude", ["a.jsonl"]);
+    // Never drains. Advance the clock so the deadline passes without real waiting.
+    const realNow = Date.now;
+    let t = realNow();
+    vi.spyOn(Date, "now").mockImplementation(() => t);
+    const sleep = async () => {
+      t += 1000;
+    };
+    const r = await runFlushCommand({ home, wait: true, timeoutSecs: 3, sleep });
+    vi.mocked(Date.now).mockRestore();
+    expect(r.exitCode).toBe(1);
+    expect(r.pending).toBe(1);
+    expect(r.lines.join(" ")).toContain("Delivery continues in the background");
+  });
+});
diff --git a/__tests__/hooks/fp-reset.test.ts b/__tests__/hooks/fp-reset.test.ts
index 7ed9efd4..44004134 100644
--- a/__tests__/hooks/fp-reset.test.ts
+++ b/__tests__/hooks/fp-reset.test.ts
@@ -313,3 +313,132 @@ describe("daemon flag self-heal", () => {
     spyStat.mockRestore();
   });
 });
+
+// ── the policy selection a person typed ──────────────────────────────────
+//
+// Layout 1 kept the user policy config at `~/.failproofai/policies-config.json`;
+// layout 2 keeps it at `policies/local-policies/policies-config.json`. BOTH were
+// on the reset list, so an upgrade silently emptied `enabledPolicies` — and the
+// machine still read as configured afterwards (`isConfigured()` is a union that
+// sees the agent CLIs' untouched settings files), so hooks kept firing against a
+// policy set that had quietly become the default one.
+describe("resetHome carries the layout-1 policy selection", () => {
+  const layoutOneConfig = {
+    enabledPolicies: ["block-sudo", "block-env-files", "require-tests-before-stop"],
+    customPoliciesPaths: ["/home/u/team/policies.mjs"],
+    disabledCustomPolicies: ["team/noisy-rule"],
+    policyParams: { "block-sudo": { allowlist: ["sudo -n true"] } },
+    llm: { baseUrl: "https://llm.internal/v1", model: "gpt-4o-mini" },
+    // Layout 1 also kept collector settings HERE, in camelCase. Layout 2 moved
+    // them to config.toml in snake_case, where `fpai-collect`'s `Settings`
+    // deserializes them — so carrying this block forward would put a key into
+    // the new file that nothing reads, looking preserved and behaving absent.
+    collector: { hooksVerbosity: "all", machineId: "m-legacy" },
+  };
+
+  function seedLayoutOnePolicyConfig() {
+    writeFileSync(legacy.policyConfig(), JSON.stringify(layoutOneConfig, null, 2));
+  }
+
+  it("carries the fields layout 2 still means", () => {
+    seedLayoutOne();
+    seedLayoutOnePolicyConfig();
+
+    const out = resetHome(1);
+
+    const carried = JSON.parse(
+      readFileSync(resolve(localPoliciesDir(), "policies-config.json"), "utf8"),
+    );
+    expect(carried.enabledPolicies).toEqual([
+      "block-sudo",
+      "block-env-files",
+      "require-tests-before-stop",
+    ]);
+    expect(carried.customPoliciesPaths).toEqual(["/home/u/team/policies.mjs"]);
+    expect(carried.disabledCustomPolicies).toEqual(["team/noisy-rule"]);
+    expect(carried.policyParams).toEqual({ "block-sudo": { allowlist: ["sudo -n true"] } });
+    expect(carried.llm).toEqual({ baseUrl: "https://llm.internal/v1", model: "gpt-4o-mini" });
+    expect(out.policyConfig).toContain("enabledPolicies");
+  });
+
+  // The one exclusion, and the reason the carry is an allowlist rather than a
+  // copy. A camelCase `collector` block in the new file reads as a preserved
+  // setting and does nothing.
+  it("does NOT carry the collector block, which moved to config.toml", () => {
+    seedLayoutOne();
+    seedLayoutOnePolicyConfig();
+
+    const out = resetHome(1);
+
+    const carried = JSON.parse(
+      readFileSync(resolve(localPoliciesDir(), "policies-config.json"), "utf8"),
+    );
+    expect(carried.collector).toBeUndefined();
+    expect(out.policyConfig).not.toContain("collector");
+  });
+
+  // A home already set up on layout 2 has a NEWER answer than the layout-1 file
+  // beside it, and a stale file winning would UNDO configuration rather than
+  // preserve it. The reset still CLEARS that layout-2 config on a layout
+  // migration (see "still clears the machine-owned children of policies/") —
+  // what must never happen is layout 1's values taking its place.
+  it("never lets the layout-1 file overwrite an existing layout-2 config", () => {
+    seedLayoutOne();
+    seedLayoutOnePolicyConfig();
+    mkdirSync(localPoliciesDir(), { recursive: true });
+    writeFileSync(
+      resolve(localPoliciesDir(), "policies-config.json"),
+      JSON.stringify({ enabledPolicies: ["current-choice"] }),
+    );
+
+    const out = resetHome(1);
+
+    expect(out.policyConfig).toEqual([]);
+    const path = resolve(localPoliciesDir(), "policies-config.json");
+    if (existsSync(path)) {
+      const after = JSON.parse(readFileSync(path, "utf8"));
+      expect(after.enabledPolicies).not.toContain("block-sudo");
+    }
+  });
+
+  it("is a no-op when there is no layout-1 config", () => {
+    seedLayoutOne();
+    // `seedLayoutOne()` writes one; this case is the home that never had it.
+    rmSync(legacy.policyConfig(), { force: true });
+    const out = resetHome(1);
+    expect(out.policyConfig).toEqual([]);
+    expect(existsSync(resolve(localPoliciesDir(), "policies-config.json"))).toBe(false);
+  });
+
+  // Unparseable is not worth aborting a reset over, and there is nothing to
+  // carry — which is exactly what happened before this function existed.
+  it("survives an unparseable layout-1 config without aborting the reset", () => {
+    seedLayoutOne();
+    writeFileSync(legacy.policyConfig(), "{ this is not json");
+    const out = resetHome(1);
+    expect(out.policyConfig).toEqual([]);
+    expect(readVersionFile()?.layout).toBe(LAYOUT_VERSION);
+  });
+
+  // A file carrying only a collector block has nothing to carry, and must not
+  // produce an empty layout-2 file that looks like a real one.
+  it("writes nothing when only excluded fields are present", () => {
+    seedLayoutOne();
+    writeFileSync(legacy.policyConfig(), JSON.stringify({ collector: { hooksVerbosity: "all" } }));
+    const out = resetHome(1);
+    expect(out.policyConfig).toEqual([]);
+    expect(existsSync(resolve(localPoliciesDir(), "policies-config.json"))).toBe(false);
+  });
+
+  // The whole point: after the reset, the carried file is what the loader reads.
+  it("leaves the carried config where the layout-2 reader looks", () => {
+    seedLayoutOne();
+    seedLayoutOnePolicyConfig();
+    resetHome(1);
+    // The layout-1 original is gone...
+    expect(existsSync(legacy.policyConfig())).toBe(false);
+    // ...and the layout-2 path, which `globalPolicyConfigFile()` resolves to,
+    // holds the selection.
+    expect(existsSync(resolve(localPoliciesDir(), "policies-config.json"))).toBe(true);
+  });
+});
diff --git a/__tests__/hooks/handler.test.ts b/__tests__/hooks/handler.test.ts
index 70776c15..08d6bdca 100644
--- a/__tests__/hooks/handler.test.ts
+++ b/__tests__/hooks/handler.test.ts
@@ -7,7 +7,7 @@
 // policies off disk (`readActiveCloudManagedPolicies`), so a developer with a
 // real deployment saw its artifacts arrive as arguments the assertions never
 // expected — one failure read
-// `["/home/…/cloud-policies/generations/4/block-curl-simple.mjs"]` where the
+// `["/home/…/cloud-policies/deployments/4/block-curl-simple.mjs"]` where the
 // test wanted `undefined`. Nothing was broken; the test was reading their
 // laptop.
 //
diff --git a/__tests__/hooks/harness-extra-paths.test.ts b/__tests__/hooks/harness-extra-paths.test.ts
new file mode 100644
index 00000000..fcf9ffc5
--- /dev/null
+++ b/__tests__/hooks/harness-extra-paths.test.ts
@@ -0,0 +1,273 @@
+// @vitest-environment node
+//
+// `failproofai harness` and the `[collector.sources.*]` config it writes.
+//
+// The round trip through a real config.toml is the point of most of these:
+// `writeConfig` regenerates the file wholesale, so the failure mode worth
+// testing is not "did it write the key" but "did writing it drop something
+// else", and "does what it wrote parse back to what it meant".
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, rmSync, readFileSync, existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+
+import { readConfig, writeConfig, DEFAULT_CONFIG } from "@/src/hooks/fp-config";
+import { configFile } from "@/src/hooks/fp-home";
+import { HARNESS_KEYS, addPath, removePath, listPaths, runHarnessCommand } from "@/src/hooks/harness-cli";
+
+describe("harness extra paths", () => {
+  let home: string;
+  let prevHome: string | undefined;
+
+  beforeEach(() => {
+    prevHome = process.env.FAILPROOFAI_HOME;
+    home = mkdtempSync(join(tmpdir(), "fpai-hx-"));
+    process.env.FAILPROOFAI_HOME = home;
+  });
+
+  afterEach(() => {
+    if (prevHome === undefined) delete process.env.FAILPROOFAI_HOME;
+    else process.env.FAILPROOFAI_HOME = prevHome;
+    rmSync(home, { recursive: true, force: true });
+  });
+
+  // ── the list that cannot be allowed to drift ───────────────────────────
+
+  // Two hand-maintained copies of one list, in two languages, with nothing
+  // generating either. A name here the daemon does not know writes a table
+  // nothing reads; a name the daemon knows and this omits is a path the user
+  // cannot add. Both parse cleanly and neither is mentioned anywhere else.
+  it("matches HARNESS_KEYS in the daemon, which is the side that registers tasks", () => {
+    const rust = readFileSync(
+      resolve(__dirname, "../../crates/failproofaid/src/main.rs"),
+      "utf8",
+    );
+    const block = /const HARNESS_KEYS: &\[&str\] = &\[([\s\S]*?)\];/.exec(rust);
+    expect(block, "HARNESS_KEYS not found in main.rs — did it move or get renamed?").toBeTruthy();
+    const rustKeys = [...block![1].matchAll(/"([a-z-]+)"/g)].map((m) => m[1]);
+    expect(rustKeys.length).toBeGreaterThan(0);
+    expect([...rustKeys].sort()).toEqual([...HARNESS_KEYS].sort());
+  });
+
+  // ── the default-path-only regression ───────────────────────────────────
+
+  it("writes no [collector.sources] table when nothing is configured", () => {
+    writeConfig(DEFAULT_CONFIG);
+    const text = readFileSync(configFile(), "utf8");
+    expect(text).not.toContain("[collector.sources");
+    expect(readConfig().collector.sources).toBeUndefined();
+  });
+
+  it("adding then removing the last path leaves no empty table behind", () => {
+    writeConfig(DEFAULT_CONFIG);
+    const before = readFileSync(configFile(), "utf8");
+
+    addPath("claude", "work=/srv/team/projects");
+    expect(readFileSync(configFile(), "utf8")).toContain("[collector.sources.claude]");
+
+    removePath("claude", "work");
+    expect(readFileSync(configFile(), "utf8")).not.toContain("[collector.sources");
+    // Byte-identical to before: a user who adds and removes gets their file back.
+    expect(readFileSync(configFile(), "utf8")).toBe(before);
+  });
+
+  // ── round trips ────────────────────────────────────────────────────────
+
+  it("round-trips a labelled path through real TOML", () => {
+    addPath("claude", "work=/srv/team/.claude/projects");
+    expect(readConfig().collector.sources).toEqual({
+      claude: { extraPaths: ["work=/srv/team/.claude/projects"] },
+    });
+  });
+
+  it("keeps several paths for one harness, in the order they were added", () => {
+    addPath("claude", "a=/srv/a");
+    addPath("claude", "b=/srv/b");
+    addPath("claude", "/srv/c");
+    expect(readConfig().collector.sources?.claude.extraPaths).toEqual([
+      "a=/srv/a",
+      "b=/srv/b",
+      "/srv/c",
+    ]);
+  });
+
+  it("keeps paths for several harnesses independently", () => {
+    addPath("claude", "w=/srv/claude");
+    addPath("hermes", "p=/srv/hermes/state.db");
+    const s = readConfig().collector.sources!;
+    expect(s.claude.extraPaths).toEqual(["w=/srv/claude"]);
+    expect(s.hermes.extraPaths).toEqual(["p=/srv/hermes/state.db"]);
+  });
+
+  // The regression that motivates writing sub-tables AFTER every scalar of
+  // `[collector]`: get the order wrong and TOML reads `[telemetry]`/`[audit]`,
+  // or worse a later `[collector]` scalar, as belonging to the sub-table.
+  it("does not corrupt the rest of the config", () => {
+    writeConfig({
+      ...DEFAULT_CONFIG,
+      mode: "cloud",
+      daemon: { configured: true },
+      collector: {
+        ...DEFAULT_CONFIG.collector,
+        sessions: true,
+        environment: "prod",
+        machineId: "m-123",
+        redact: "off",
+      },
+      telemetry: { enabled: false },
+      audit: { auto: true, intervalDays: 14 },
+    });
+    addPath("codex", "alt=/mnt/other/.codex/sessions");
+
+    const cfg = readConfig();
+    expect(cfg.mode).toBe("cloud");
+    expect(cfg.daemon.configured).toBe(true);
+    expect(cfg.collector.sessions).toBe(true);
+    expect(cfg.collector.environment).toBe("prod");
+    expect(cfg.collector.machineId).toBe("m-123");
+    expect(cfg.collector.redact).toBe("off");
+    expect(cfg.telemetry.enabled).toBe(false);
+    expect(cfg.audit).toEqual({ auto: true, intervalDays: 14 });
+    expect(cfg.collector.sources?.codex.extraPaths).toEqual(["alt=/mnt/other/.codex/sessions"]);
+  });
+
+  it("a path containing an equals sign survives the round trip", () => {
+    addPath("claude", "k=/srv/a=b/projects");
+    expect(readConfig().collector.sources?.claude.extraPaths).toEqual(["k=/srv/a=b/projects"]);
+  });
+
+  // ── rejections ─────────────────────────────────────────────────────────
+
+  it("refuses an unknown harness and names the real ones", () => {
+    const r = addPath("claud", "/srv/x");
+    expect(r.exitCode).toBe(1);
+    expect(r.lines.join("\n")).toContain("Unknown harness: claud");
+    expect(r.lines.join("\n")).toContain("claude");
+    expect(existsSync(configFile())).toBe(false);
+  });
+
+  // Adding twice from a provisioning script must not fail the second time.
+  it("is idempotent for an exact duplicate", () => {
+    expect(addPath("claude", "w=/srv/x").exitCode).toBe(0);
+    const r = addPath("claude", "w=/srv/x");
+    expect(r.exitCode).toBe(0);
+    expect(readConfig().collector.sources?.claude.extraPaths).toEqual(["w=/srv/x"]);
+  });
+
+  // Both of these are dropped by the daemon at startup. Caught here so the CLI
+  // does not report success for a path that is never captured.
+  it("refuses the same path under a second label", () => {
+    addPath("claude", "a=/srv/x");
+    const r = addPath("claude", "b=/srv/x");
+    expect(r.exitCode).toBe(1);
+    expect(r.lines.join("\n")).toContain("already captures /srv/x");
+    expect(readConfig().collector.sources?.claude.extraPaths).toEqual(["a=/srv/x"]);
+  });
+
+  it("refuses a second path under the same label", () => {
+    addPath("claude", "a=/srv/x");
+    const r = addPath("claude", "a=/srv/y");
+    expect(r.exitCode).toBe(1);
+    expect(r.lines.join("\n")).toContain('already uses the label "a"');
+    expect(readConfig().collector.sources?.claude.extraPaths).toEqual(["a=/srv/x"]);
+  });
+
+  it("refuses an entry with no path", () => {
+    expect(addPath("claude", "").exitCode).toBe(1);
+    expect(addPath("claude", "label=").exitCode).toBe(1);
+  });
+
+  // ── removal ────────────────────────────────────────────────────────────
+
+  it("removes by label, by path, or by the whole entry", () => {
+    for (const target of ["w", "/srv/x", "w=/srv/x"]) {
+      addPath("claude", "w=/srv/x");
+      const r = removePath("claude", target);
+      expect(r.exitCode, `removing by ${target}`).toBe(0);
+      expect(readConfig().collector.sources).toBeUndefined();
+    }
+  });
+
+  it("removing something absent fails rather than silently succeeding", () => {
+    addPath("claude", "w=/srv/x");
+    const r = removePath("claude", "nope");
+    expect(r.exitCode).toBe(1);
+    expect(readConfig().collector.sources?.claude.extraPaths).toEqual(["w=/srv/x"]);
+  });
+
+  it("removing one of several keeps the rest", () => {
+    addPath("claude", "a=/srv/a");
+    addPath("claude", "b=/srv/b");
+    removePath("claude", "a");
+    expect(readConfig().collector.sources?.claude.extraPaths).toEqual(["b=/srv/b"]);
+  });
+
+  // ── list ───────────────────────────────────────────────────────────────
+
+  it("says so plainly when nothing is configured", () => {
+    const r = listPaths();
+    expect(r.exitCode).toBe(0);
+    expect(r.lines.join("\n")).toContain("No extra capture paths configured");
+  });
+
+  it("shows the namespace each path will produce", () => {
+    addPath("claude", "work=/srv/team");
+    addPath("hermes", "/srv/hermes-prod/state.db");
+    const out = listPaths().lines.join("\n");
+    expect(out).toContain("claude:");
+    expect(out).toContain("/srv/team");
+    expect(out).toContain("work-*");
+    expect(out).toContain("hermes:");
+    expect(out).toContain("derived from the folder name");
+  });
+
+  // A user who hand-edits config.toml runs `list` to check it, which is the
+  // cheapest moment to find the typo. The daemon also reports this at startup.
+  it("warns about an unknown harness table written by hand", () => {
+    writeConfig({
+      ...DEFAULT_CONFIG,
+      collector: {
+        ...DEFAULT_CONFIG.collector,
+        sources: { claud: { extraPaths: ["/srv/x"] } },
+      },
+    });
+    const out = listPaths().lines.join("\n");
+    expect(out).toContain("unknown harness");
+    expect(out).toContain("claud");
+  });
+
+  // ── dispatch ───────────────────────────────────────────────────────────
+
+  it("rejects an unknown subcommand and prints usage", () => {
+    const r = runHarnessCommand(["frobnicate"]);
+    expect(r.exitCode).toBe(1);
+    expect(r.lines.join("\n")).toContain("add-path");
+  });
+
+  it("requires both arguments for add-path", () => {
+    expect(runHarnessCommand(["add-path"]).exitCode).toBe(1);
+    expect(runHarnessCommand(["add-path", "claude"]).exitCode).toBe(1);
+  });
+
+  it("dispatches add-path, list and remove-path", () => {
+    expect(runHarnessCommand(["add-path", "claude", "w=/srv/x"]).exitCode).toBe(0);
+    expect(runHarnessCommand(["list"]).lines.join("\n")).toContain("/srv/x");
+    expect(runHarnessCommand(["remove-path", "claude", "w"]).exitCode).toBe(0);
+  });
+
+  // ── malformed config on disk ───────────────────────────────────────────
+
+  it("ignores a sources table that is not shaped like one", () => {
+    writeConfig(DEFAULT_CONFIG);
+    const path = configFile();
+    const text = readFileSync(path, "utf8");
+    require("node:fs").writeFileSync(
+      path,
+      text +
+        '\n[collector.sources.claude]\nextra_paths = "not-an-array"\n' +
+        "\n[collector.sources.codex]\nextra_paths = [1, 2]\n",
+    );
+    // Neither becomes a phantom entry, and reading does not throw.
+    expect(readConfig().collector.sources).toBeUndefined();
+  });
+});
diff --git a/__tests__/hooks/manager-cloud-listing.test.ts b/__tests__/hooks/manager-cloud-listing.test.ts
new file mode 100644
index 00000000..a3b36be9
--- /dev/null
+++ b/__tests__/hooks/manager-cloud-listing.test.ts
@@ -0,0 +1,70 @@
+// @vitest-environment node
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+vi.mock("../../src/hooks/cloud-managed-policies", () => ({
+  readActiveCloudManagedPolicies: vi.fn(),
+}));
+
+import { listHooks } from "../../src/hooks/manager";
+import { readActiveCloudManagedPolicies } from "../../src/hooks/cloud-managed-policies";
+
+const readActive = vi.mocked(readActiveCloudManagedPolicies);
+
+describe("failproofai policies — cloud-managed section", () => {
+  let out: string[];
+  let spy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    out = [];
+    spy = vi.spyOn(console, "log").mockImplementation((...a: unknown[]) => {
+      out.push(a.map(String).join(" "));
+    });
+  });
+  afterEach(() => spy.mockRestore());
+
+  const text = () => out.join("\n").replace(/\x1B\[[0-9;]*m/g, "");
+
+  it("lists a deployed policy, with its version and the deployment number", async () => {
+    readActive.mockReturnValue([
+      { id: "org-guard", version: 3, effect: "enforce", sha256: "a", path: "p", deployment: 7 },
+    ]);
+    await listHooks();
+    expect(text()).toContain("Cloud-managed — deployment 7");
+    expect(text()).toContain("org-guard");
+    expect(text()).toContain("v3");
+  });
+
+  it("marks an observe policy as OBS, never ON — its verdict is discarded", async () => {
+    readActive.mockReturnValue([
+      { id: "watch-only", version: 1, effect: "observe", sha256: "a", path: "p", deployment: 2 },
+    ]);
+    await listHooks();
+    const line = text().split("\n").find((l) => l.includes("watch-only")) ?? "";
+    expect(line).toContain("OBS");
+    expect(line).not.toContain("✓ ON");
+  });
+
+  it("says these are not switchable locally, because --uninstall cannot touch them", async () => {
+    readActive.mockReturnValue([
+      { id: "org-guard", version: 1, effect: "enforce", sha256: "a", path: "p", deployment: 1 },
+    ]);
+    await listHooks();
+    expect(text()).toContain("Managed from the dashboard");
+  });
+
+  it("prints no section at all on a machine with no deployment", async () => {
+    readActive.mockReturnValue([]);
+    await listHooks();
+    expect(text()).not.toContain("Cloud-managed");
+  });
+
+  it("survives an unreadable manifest rather than breaking the whole listing", async () => {
+    readActive.mockImplementation(() => {
+      throw new Error("corrupt manifest");
+    });
+    await expect(listHooks()).resolves.not.toThrow();
+    expect(text()).not.toContain("Cloud-managed");
+    // The builtin listing above it must still have printed.
+    expect(text()).toContain("Failproof AI Hook Policies");
+  });
+});
diff --git a/__tests__/hooks/policy-attribution.test.ts b/__tests__/hooks/policy-attribution.test.ts
index dd2767b4..a31621f3 100644
--- a/__tests__/hooks/policy-attribution.test.ts
+++ b/__tests__/hooks/policy-attribution.test.ts
@@ -3,7 +3,7 @@
  * Attribution on the activity row.
  *
  * The design doc's requirement is that Failproof Cloud can tie a decision to
- * the exact rollout that produced it. Until now the only trace of a revision
+ * the exact rollout that produced it. Until now the only trace of a version
  * was a substring of a display name ("cloud/org-guard@7/…"), which nothing can
  * query and which re-parsing our own label would be the only way to read.
  */
@@ -44,7 +44,7 @@ const hook = (name: string, extra: Record<string, unknown> = {}) =>
     extra,
   );
 
-const CLOUD = { id: "org-guard", revision: 7, sha256: "a".repeat(64), path: "/x.mjs", generation: 184 };
+const CLOUD = { id: "org-guard", version: 7, sha256: "a".repeat(64), path: "/x.mjs", deployment: 184 };
 
 function decidedBy(policyName: string | null, decision: "allow" | "deny" = "deny") {
   vi.mocked(evaluatePolicies).mockReturnValue({
@@ -88,7 +88,7 @@ describe("policy attribution", () => {
     expect(row().policySource).toBe("convention");
   });
 
-  it("attributes a cloud decision to its exact policy id and revision", async () => {
+  it("attributes a cloud decision to its exact policy id and version", async () => {
     vi.mocked(readActiveCloudManagedPolicies).mockReturnValue([CLOUD] as never);
     vi.mocked(loadAllCustomHooks).mockResolvedValue({
       hooks: [hook("org-guard", { __cloudManaged: CLOUD })], conventionSources: [],
@@ -97,11 +97,11 @@ describe("policy attribution", () => {
     await evaluateHookEvent("PreToolUse", "claude", stdin);
     expect(row().policySource).toBe("cloud");
     expect(row().cloudPolicyId).toBe("org-guard");
-    expect(row().cloudRevision).toBe(7);
-    expect(row().cloudGeneration).toBe(184);
+    expect(row().cloudVersion).toBe(7);
+    expect(row().cloudDeployment).toBe(184);
   });
 
-  it("records the active generation even when a LOCAL policy decided", async () => {
+  it("records the active deployment even when a LOCAL policy decided", async () => {
     // "What was deployed here" is a different question from "what decided" —
     // and only the former separates a rollout that changed no outcomes from
     // one that never reached the machine.
@@ -112,22 +112,22 @@ describe("policy attribution", () => {
     decidedBy("custom/local");
     await evaluateHookEvent("PreToolUse", "claude", stdin);
     expect(row().policySource).toBe("custom");
-    expect(row().cloudGeneration).toBe(184);
+    expect(row().cloudDeployment).toBe(184);
     expect(row().cloudPolicyId).toBeUndefined();
   });
 
   it("leaves attribution off entirely on a plain allow, where nothing decided", async () => {
     await evaluateHookEvent("PreToolUse", "claude", stdin);
     expect(row().policySource).toBeUndefined();
-    expect(row().cloudRevision).toBeUndefined();
+    expect(row().cloudVersion).toBeUndefined();
   });
 
-  it("omits the generation on an unmanaged machine rather than writing 0", async () => {
-    // A literal 0 would read as "generation zero is deployed"; absent reads as
+  it("omits the deployment on an unmanaged machine rather than writing 0", async () => {
+    // A literal 0 would read as "deployment zero is deployed"; absent reads as
     // "not managed", which is the truth.
     decidedBy("block-sudo");
     await evaluateHookEvent("PreToolUse", "claude", stdin);
-    expect(row().cloudGeneration).toBeUndefined();
+    expect(row().cloudDeployment).toBeUndefined();
   });
 });
 
diff --git a/__tests__/hooks/session-pause-enforcement.test.ts b/__tests__/hooks/session-pause-enforcement.test.ts
index 990afa04..954acd01 100644
--- a/__tests__/hooks/session-pause-enforcement.test.ts
+++ b/__tests__/hooks/session-pause-enforcement.test.ts
@@ -67,7 +67,7 @@ function twoHooks() {
         { name: "org-guard", description: "", match: {}, fn: async () => ({ decision: "allow" }) },
         {
           __policyId: "cloud:org-guard@7:org-guard",
-          __cloudManaged: { id: "org-guard", revision: 7, sha256: "a".repeat(64), path: "/x.mjs", generation: 4 },
+          __cloudManaged: { id: "org-guard", version: 7, sha256: "a".repeat(64), path: "/x.mjs", deployment: 4 },
         },
       ),
     ],
diff --git a/__tests__/hooks/tui.test.ts b/__tests__/hooks/tui.test.ts
index b58d8389..47479d73 100644
--- a/__tests__/hooks/tui.test.ts
+++ b/__tests__/hooks/tui.test.ts
@@ -5,6 +5,7 @@ import {
   ellipsize,
   summarize,
   renderBrandLogo,
+  promptText,
   type TTYIn,
   type TTYOut,
 } from "../../src/hooks/tui";
@@ -139,3 +140,223 @@ describe("brand logomark", () => {
     expect(lines).toHaveLength(1);
   });
 });
+
+describe("promptText redraw stays on one physical row", () => {
+  // Regression: `\r\x1b[2K` erases only the row the cursor is on. A composed
+  // line wider than the terminal WRAPS, so the erase misses the earlier rows
+  // and every keystroke leaves one behind — pasting a 40-character API key
+  // printed 40 stacked copies of the prompt.
+  const drawnRows = (cols: number, message: string, hint: string, typed: number) => {
+    const writes: string[] = [];
+    const stdout = {
+      isTTY: true,
+      columns: cols,
+      write: vi.fn((s: string) => { writes.push(s); return true; }),
+    } as unknown as TTYOut;
+    let onKey: ((s: string | undefined, k: unknown) => void) | undefined;
+    const stdin = {
+      isTTY: true,
+      setRawMode: vi.fn(),
+      resume: vi.fn(),
+      pause: vi.fn(),
+      on: vi.fn((ev: string, fn: never) => { if (ev === "keypress") onKey = fn; }),
+      removeListener: vi.fn(),
+      // `readline.emitKeypressEvents` calls these on the stream it is given.
+      // Without them the promise rejects, and because this test deliberately
+      // does not await it (`void promptText(...)`), the rejection surfaces as an
+      // UNHANDLED error — tests all green, job red, which is exactly how it
+      // reached CI.
+      listenerCount: vi.fn(() => 0),
+      once: vi.fn(),
+      off: vi.fn(),
+      emit: vi.fn(),
+      addListener: vi.fn(),
+    } as unknown as TTYIn;
+
+    void promptText({ message, hint, mask: true, stdin, stdout });
+    for (let i = 0; i < typed; i++) onKey?.("x", { name: "x" });
+
+    // Widest single write, measured without ANSI, is the widest row rendered.
+    const widest = Math.max(
+      ...writes.map((w) => w.replace(/\x1b\[[0-9;]*[A-Za-z]/g, "").replace(/\r/g, "").length),
+    );
+    return widest;
+  };
+
+  it("never renders wider than the terminal, even with a long hint and a long value", () => {
+    const widest = drawnRows(
+      80,
+      "API key for localhost:3000",
+      "needs events:add · policies:pull enables managed policy too",
+      40,
+    );
+    expect(widest).toBeLessThanOrEqual(80);
+  });
+
+  it("holds at a narrow width too", () => {
+    expect(drawnRows(40, "API key for localhost:3000", "needs events:add", 40)).toBeLessThanOrEqual(40);
+  });
+});
+
+// ── back navigation, and the two ways it was broken ──────────────────────────
+//
+// `BACK` is a symbol the shared key handler injects when ← is pressed on a
+// prompt that opted into `allowBack`. It is NOT a value of the prompt's own
+// result type, so every `summaryFor` callback received something it was never
+// written to handle — and the two existing callers failed differently:
+//
+//   multiSelect  `values.includes(BACK)` → TypeError, thrown INSIDE `finish`
+//                before `resolve()`, so the promise never settled and the
+//                wizard stopped responding to input entirely.
+//   selectOne    fell through to `String(value)` and rendered the literal
+//                text `Symbol(failproofai.back)` as the user's answer.
+describe("back navigation", () => {
+  const harness = () => {
+    const writes: string[] = [];
+    const stdout = {
+      isTTY: true,
+      columns: 80,
+      write: vi.fn((s: string) => { writes.push(s); return true; }),
+    } as unknown as TTYOut;
+    let onKey: ((s: string | undefined, k: unknown) => void) | undefined;
+    const stdin = {
+      isTTY: true,
+      isRaw: false,
+      setRawMode: vi.fn(),
+      resume: vi.fn(),
+      pause: vi.fn(),
+      on: vi.fn((ev: string, fn: never) => { if (ev === "keypress") onKey = fn; }),
+      removeListener: vi.fn(),
+      listenerCount: vi.fn(() => 0),
+      once: vi.fn(),
+      off: vi.fn(),
+      emit: vi.fn(),
+      addListener: vi.fn(),
+    } as unknown as TTYIn;
+    return { stdin, stdout, writes, press: (name: string) => onKey?.(undefined, { name }) };
+  };
+
+  const rendered = (writes: string[]) =>
+    writes.join("").replace(/\x1b\[[0-9;]*[A-Za-z]/g, "");
+
+  // The hang. Without the fix this test does not fail — it never finishes.
+  it("multiSelect resolves when ← is pressed instead of throwing", async () => {
+    const h = harness();
+    const p = multiSelect({
+      message: "pick",
+      choices: [
+        { label: "A", value: "a" },
+        { label: "B", value: "b" },
+      ],
+      allowBack: true,
+      stdin: h.stdin,
+      stdout: h.stdout,
+    });
+    h.press("left");
+    const result = await Promise.race([
+      p,
+      new Promise((_, rej) => setTimeout(() => rej(new Error("← never settled the promise")), 2000)),
+    ]);
+    expect(typeof result).toBe("symbol");
+    expect(rendered(h.writes)).not.toContain("Symbol(");
+    expect(rendered(h.writes)).toContain("back");
+  });
+
+  it("selectOne renders 'back' rather than the raw symbol", async () => {
+    const h = harness();
+    const p = selectOne({
+      message: "pick",
+      choices: [
+        { label: "A", value: "a" },
+        { label: "B", value: "b" },
+      ],
+      allowBack: true,
+      stdin: h.stdin,
+      stdout: h.stdout,
+    });
+    h.press("left");
+    const result = await p;
+    expect(typeof result).toBe("symbol");
+    expect(rendered(h.writes)).not.toContain("Symbol(failproofai.back)");
+    expect(rendered(h.writes)).toContain("back");
+  });
+
+  // A prompt that did not opt in must not appear to offer back navigation.
+  it("← is inert when allowBack was not requested", async () => {
+    const h = harness();
+    const p = selectOne({
+      message: "pick",
+      choices: [{ label: "A", value: "a" }],
+      stdin: h.stdin,
+      stdout: h.stdout,
+    });
+    h.press("left");
+    h.press("return");
+    await expect(p).resolves.toBe("a");
+  });
+});
+
+// The validation-error row was never measured. `draw()` emits the prompt and
+// the error as ONE write containing a newline (`${line}${err}`), so a helper
+// that measures each write whole sees `prompt + "\n  error"` as a single long
+// string — it overstates every row and, more importantly, never checks the
+// error row against the terminal width at all. Rows are split here.
+describe("promptText validation errors stay within the terminal", () => {
+  const rowsFor = (cols: number, message: string, error: string) => {
+    const writes: string[] = [];
+    const stdout = {
+      isTTY: true,
+      columns: cols,
+      write: vi.fn((s: string) => { writes.push(s); return true; }),
+    } as unknown as TTYOut;
+    let onKey: ((s: string | undefined, k: unknown) => void) | undefined;
+    const stdin = {
+      isTTY: true,
+      isRaw: false,
+      setRawMode: vi.fn(),
+      resume: vi.fn(),
+      pause: vi.fn(),
+      on: vi.fn((ev: string, fn: never) => { if (ev === "keypress") onKey = fn; }),
+      removeListener: vi.fn(),
+      listenerCount: vi.fn(() => 0),
+      once: vi.fn(),
+      off: vi.fn(),
+      emit: vi.fn(),
+      addListener: vi.fn(),
+    } as unknown as TTYIn;
+
+    void promptText({ message, mask: true, validate: () => error, stdin, stdout });
+    for (let i = 0; i < 40; i++) onKey?.("x", { name: "x" });
+    onKey?.(undefined, { name: "return" }); // fails validation -> draws the error
+
+    // Each WRITE is one redraw (it begins with `\r\x1b[2K`, which returns to
+    // column 0 and erases), and a single redraw may itself contain a newline
+    // when an error row is appended. So rows are per-write AND per-newline —
+    // joining the writes first would concatenate 40 independent redraws into
+    // one 2000-character "row" and measure nothing real.
+    return writes.flatMap((w) =>
+      w
+        .split("\n")
+        .map((row) => row.replace(/\x1b\[[0-9;]*[A-Za-z]/g, "").replace(/\r/g, "").length),
+    );
+  };
+
+  it("wraps neither the prompt nor a long error at 80 columns", () => {
+    const rows = rowsFor(
+      80,
+      "API key for localhost:3000",
+      "that key is not valid for this organisation — check you copied the whole value, including the prefix",
+    );
+    expect(Math.max(...rows)).toBeLessThanOrEqual(80);
+  });
+
+  it("holds at a narrow width, where the error has least room", () => {
+    const rows = rowsFor(40, "API key for localhost:3000", "invalid key, please check and try again");
+    expect(Math.max(...rows)).toBeLessThanOrEqual(40);
+  });
+
+  it("actually rendered an error row (the test would pass vacuously otherwise)", () => {
+    const rows = rowsFor(80, "API key", "nope");
+    expect(rows.length).toBeGreaterThan(1);
+  });
+});
diff --git a/__tests__/hooks/worker-server.test.ts b/__tests__/hooks/worker-server.test.ts
index 6fa24e9d..ac5d9f1e 100644
--- a/__tests__/hooks/worker-server.test.ts
+++ b/__tests__/hooks/worker-server.test.ts
@@ -244,7 +244,7 @@ customPolicies.add({
 
   it("loads a hash-verified active cloud policy with a cloud-qualified identity", async () => {
     const managedRoot = join(projectDir, "cloud-managed");
-    const generationDir = join(managedRoot, "generations", "42");
+    const generationDir = join(managedRoot, "deployments", "42");
     mkdirSync(generationDir, { recursive: true });
     const policyPath = join(generationDir, "org-guard.mjs");
     const policyBytes = `import { customPolicies, deny } from "failproofai";
@@ -260,13 +260,13 @@ customPolicies.add({
       join(managedRoot, "active.json"),
       JSON.stringify({
         schemaVersion: 1,
-        generation: 42,
+        deployment: 42,
         policies: [
           {
             id: "org-guard",
-            revision: 8,
+            version: 8,
             sha256,
-            path: "generations/42/org-guard.mjs",
+            path: "deployments/42/org-guard.mjs",
           },
         ],
       }),
diff --git a/__tests__/integration-suite/is-error.test.ts b/__tests__/integration-suite/is-error.test.ts
index 58a124d9..82bc0a49 100644
--- a/__tests__/integration-suite/is-error.test.ts
+++ b/__tests__/integration-suite/is-error.test.ts
@@ -8,7 +8,7 @@
  * Its input is the agent's ENTIRE transcript, which is why the negative fixtures matter as
  * much as the positive ones: patterns loose enough to match ordinary model prose ("400
  * tests passed", "that flag is not supported") turn a chatty refusal into a fake vendor
- * outage, inverting exactly what the function exists to signal. An earlier revision of
+ * outage, inverting exactly what the function exists to signal. An earlier version of
  * this regex did precisely that with a bare `\b400\b` and a bare `not supported`.
  *
  * The function is read out of the shell script and executed by bash, so this test tracks
diff --git a/app/policies/hooks-client.tsx b/app/policies/hooks-client.tsx
index e6d2e0ea..0a310202 100644
--- a/app/policies/hooks-client.tsx
+++ b/app/policies/hooks-client.tsx
@@ -396,18 +396,18 @@ function DetailPanel({
                 <span className="text-muted-foreground">Decided by: </span>
                 <span className="font-mono text-foreground">
                   {item.policySource === "cloud" && item.cloudPolicyId
-                    ? `cloud · ${item.cloudPolicyId} rev ${item.cloudRevision}`
+                    ? `cloud · ${item.cloudPolicyId} version ${item.cloudVersion}`
                     : item.policySource}
                 </span>
               </div>
             )}
-            {item.cloudGeneration !== undefined && (
+            {item.cloudDeployment !== undefined && (
               <div>
                 {/* Present on every row of a managed machine, not just cloud
                     decisions — it is what separates a rollout that changed no
                     outcomes from one that never arrived. */}
-                <span className="text-muted-foreground">Cloud generation: </span>
-                <span className="font-mono text-foreground">{item.cloudGeneration}</span>
+                <span className="text-muted-foreground">Cloud deployment: </span>
+                <span className="font-mono text-foreground">{item.cloudDeployment}</span>
               </div>
             )}
             <div>
diff --git a/bin/failproofai.mjs b/bin/failproofai.mjs
index 6c70e835..18394f39 100755
--- a/bin/failproofai.mjs
+++ b/bin/failproofai.mjs
@@ -271,7 +271,7 @@ if (hookIdx >= 0) {
  */
 async function runCli() {
   // --help / -h  (only when not inside a subcommand that handles its own --help)
-  const SUBCOMMANDS = ["policies", "policy", "audit", "config", "uninstall", "backfill"];
+  const SUBCOMMANDS = ["policies", "policy", "audit", "config", "uninstall", "backfill", "flush", "harness"];
   if ((args.includes("--help") || args.includes("-h")) && !SUBCOMMANDS.includes(args[0])) {
     const extraArgs = args.filter((a) => a !== "--help" && a !== "-h");
     if (extraArgs.length > 0) {
@@ -286,6 +286,13 @@ USAGE
 COMMANDS
   (no args)                      Launch the policy dashboard
   config                         Interactive setup — pick scope, agents & policies
+    --connect <url> --token <key>  Connect to Failproof Cloud non-interactively
+    --machine-id <id>              Stable id for this machine
+    --machine-label <name>         Human-readable name in the dashboard
+    --no-transcripts               Report decisions only, never transcripts
+    --disconnect                   Stop pulling policy and sending activity
+    --status                       Show connection, daemon and pause state
+    --pause / --resume             Pause or resume enforcement
 
   policy add <name>              Enable a single policy (see \`policy --help\`)
   policy remove <name>           Disable a single policy
@@ -312,10 +319,30 @@ COMMANDS
 
   policies --help, -h            Show this help for the policies command
 
+  harness list                   Show extra capture paths per agent CLI
+  harness add-path <h> <path>    Also capture sessions from <path> for harness
+                                 <h>. Accepts \`<label>=<path>\`; the label
+                                 namespaces agent ids so two copies of one
+                                 project stay distinct.
+  harness remove-path <h> <p>    Stop capturing that path
+  harness --help, -h             Show this help for the harness command
+
   audit                          Audit your agent's behavior, then open the
                                  dashboard at http://localhost:8020/audit
   audit --help, -h               Show this help for the audit command
 
+  backfill                       Re-send history the collector already read past
+                                 — after clearing the dashboard, re-enrolling a
+                                 machine, or connecting later than the work
+    --since <when>                 How far back: 30d, 6m, or YYYY-MM-DD
+                                   (default: 30 days)
+    --dry-run                      Report what would be re-read, change nothing
+
+  flush                          Deliver everything already spooled, now,
+                                 instead of waiting for the next sweep
+    --wait                         Block until the spool drains (or --timeout)
+    --timeout <secs>               How long to wait with --wait (default: 60)
+
   uninstall                      Remove failproofai from this machine: hook
                                  entries from every agent CLI, and the daemon
                                  service. Run this BEFORE \`npm rm -g failproofai\`
@@ -355,6 +382,10 @@ EXAMPLES
   failproofai policies --uninstall --cli opencode
   failproofai policies --uninstall --cli pi
   failproofai policies --uninstall --custom
+  failproofai backfill --since 6m
+  failproofai backfill --dry-run
+  failproofai flush --wait
+  failproofai config --status
 
 LINKS
   ⭐ Star us:      https://github.com/failproofai/failproofai
@@ -487,6 +518,72 @@ LINKS
   // over. Every precondition a person can get wrong is still checked HERE,
   // synchronously, because reporting success and leaving the real failure in the
   // journal is what already cost twenty minutes on a live machine.
+  if (args[0] === "flush") {
+    const subArgs = args.slice(1);
+    if (subArgs.includes("--help") || subArgs.includes("-h")) {
+      console.log(`
+failproofai flush — deliver what is already spooled, now
+
+USAGE
+  failproofai flush [--wait] [--timeout <secs>]
+
+WHY
+  The collector is unhurried on purpose: a batch is swept once it is older than
+  two minutes, at most 64 per pass, on a 60-second cadence. That pacing keeps a
+  backlog from stampeding the server, and it is exactly wrong when you are
+  standing at a dashboard waiting to see your own events — "not delivered yet"
+  and "not working" look identical from there.
+
+  This asks the daemon to make a pass right now, with no minimum age and no
+  per-pass cap. It re-sends nothing: only batches already spooled and not yet
+  delivered. For history the collector has already read past, use \`backfill\`.
+
+OPTIONS
+  --wait             Block until the spool drains, or --timeout elapses.
+  --timeout <secs>   How long --wait waits. Default: 60.
+`);
+      process.exit(0);
+    }
+
+    const KNOWN = new Set(["--wait", "--timeout"]);
+    const unknown = subArgs.find(
+      (a, i) => a.startsWith("-") && !KNOWN.has(a) && subArgs[i - 1] !== "--timeout",
+    );
+    if (unknown) {
+      throw new CliError(`Unexpected argument: ${unknown}\nRun \`failproofai flush --help\` for usage.`);
+    }
+
+    let timeoutSecs;
+    const tIdx = subArgs.indexOf("--timeout");
+    if (tIdx >= 0) {
+      const raw = subArgs[tIdx + 1];
+      if (!raw || raw.startsWith("-")) throw new CliError("Missing value after --timeout.");
+      const n = Number(raw);
+      // Rejected rather than coerced: NaN would silently become "wait forever
+      // or not at all" depending on the comparison, and neither is what was asked.
+      if (!Number.isFinite(n) || n <= 0) {
+        throw new CliError(`Could not read --timeout ${raw}. Give a number of seconds.`);
+      }
+      timeoutSecs = n;
+    }
+
+    lastSubcommand = "flush";
+    const { runFlushCommand } = await import("../src/hooks/flush-cli");
+    const result = await runFlushCommand({ wait: subArgs.includes("--wait"), timeoutSecs });
+    for (const line of result.lines) {
+      if (result.exitCode === 0) console.log(line);
+      else console.error(line);
+    }
+    await track("cli_flush", {
+      ok: result.exitCode === 0,
+      waited: subArgs.includes("--wait"),
+      pending: result.pending,
+    });
+    lastSubcommand = null;
+    await exitAfterFlush(result.exitCode);
+    return;
+  }
+
   if (args[0] === "backfill") {
     const subArgs = args.slice(1);
     if (subArgs.includes("--help") || subArgs.includes("-h")) {
@@ -557,6 +654,80 @@ OPTIONS
     return;
   }
 
+  // harness list | add-path | remove-path
+  //
+  // Extra capture paths per harness. Writes ~/.failproofai/config.toml and
+  // nothing else — no root, no daemon call — so it works on a machine whose
+  // daemon is stopped, which is when someone is most likely to be fixing what
+  // it captures.
+  if (args[0] === "harness") {
+    const subArgs = args.slice(1);
+    if (subArgs.length === 0 || subArgs.includes("--help") || subArgs.includes("-h")) {
+      console.log(`
+failproofai harness — capture sessions from more than one location per agent CLI
+
+USAGE
+  failproofai harness list [<harness>]
+  failproofai harness add-path <harness> [<label>=]<path>
+  failproofai harness remove-path <harness> <path|label>
+
+WHY
+  Each agent CLI is watched wherever its own installer put it — ~/.claude/projects,
+  ~/.hermes/state.db, and so on. That misses every other arrangement: a second
+  profile, a mounted team share, a container's home beside the host's, an agent
+  an operator moved. Those hold real sessions and nothing collects them.
+
+THE LABEL
+  An entry is \`<path>\` or \`<label>=<path>\`. The label namespaces agent ids as
+  <label>-<agentId>, and it matters: two locations holding the same project
+  derive the SAME id (it comes from the cwd inside the transcript, identical in
+  both copies), so without a label they merge into one agent whose sessions
+  interleave from two machines' worth of history. Omit it and one is derived
+  from the folder name.
+
+HARNESSES
+  claude, codex, copilot, openclaw, pi, factory, antigravity, cursor,
+  goose, opencode, devin, hermes
+
+  \`claude\` covers subagent transcripts too — they live under the same root.
+
+NOTES
+  • Session collection must be on for any of this to be read; extra paths follow
+    [collector] in ~/.failproofai/config.toml like the default ones do.
+  • A path overlapping one already captured is REFUSED by the daemon at startup
+    rather than collected twice under two ids. It says so in the journal.
+  • Takes effect within seconds — the daemon re-reads config.toml on an interval
+    and cycles its collector. No restart, no sudo.
+
+EXAMPLES
+  failproofai harness add-path claude work=/srv/team/.claude/projects
+  failproofai harness add-path hermes prod=/srv/hermes-prod/state.db
+  failproofai harness add-path codex /mnt/other-home/.codex/sessions
+  failproofai harness list
+  failproofai harness remove-path claude work
+`.trimStart());
+      process.exit(0);
+    }
+
+    lastSubcommand = "harness";
+    const { runHarnessCommand } = await import("../src/hooks/harness-cli");
+    const result = runHarnessCommand(subArgs);
+    for (const line of result.lines) {
+      if (result.exitCode === 0) console.log(line);
+      else console.error(line);
+    }
+    await track("cli_harness", {
+      ok: result.exitCode === 0,
+      // The subcommand only — never the harness name, the label or the path.
+      // A path is a value the user typed, and `enterprise-docs/product-analytics.md`
+      // promises we send shape, never value.
+      sub: ["list", "add-path", "remove-path"].includes(subArgs[0]) ? subArgs[0] : "unknown",
+    });
+    lastSubcommand = null;
+    await exitAfterFlush(result.exitCode);
+    return;
+  }
+
   // uninstall [--purge] [--dry-run] [--yes|-y]
   //
   // Top-level, and deliberately NOT a flag on `policies`. `policies --uninstall`
@@ -1115,7 +1286,7 @@ USAGE
 WHAT IT DOES
   Walks you through 4 quick steps and writes everything for you:
     1. Where      — global (all projects) or just this project
-    2. Assistants — which agent CLIs to protect (Claude, Codex, ...)
+    2. Harnesses  — which agent CLIs to protect (Claude, Codex, ...)
     3. Policies   — presets (combine any), Everything, or a custom pick
     4. Review     — confirms the exact files it will change, then applies
 
@@ -1124,7 +1295,13 @@ FAILPROOF CLOUD
                                     Connect this machine to Failproof Cloud
                                     [--no-transcripts] decisions only, no transcripts
   failproofai config --disconnect   Stop pulling policy and sending activity
-  failproofai config --status       Show connection and pause state
+  failproofai config --status       Show connection, daemon and pause state
+  failproofai config --pause [--session <id>]
+                                    Pause enforcement, time-boxed
+  failproofai config --resume [--all]
+                                    Resume enforcement
+
+    --machine-label <name>          Human-readable name in the dashboard
 
   One connection, two capabilities: this machine PULLS centrally-managed
   policies and SENDS what its hooks decided, so the dashboard shows the fleet
diff --git a/crates/CLOUD_POLICIES.md b/crates/CLOUD_POLICIES.md
index 486d0621..da650e58 100644
--- a/crates/CLOUD_POLICIES.md
+++ b/crates/CLOUD_POLICIES.md
@@ -1,8 +1,8 @@
-# Cloud-managed policy generations
+# Cloud-managed policy deployments
 
 This is the contract between the Failproof Cloud HTTP transport and the
 `failproofaid` policy worker. Polling and integrity maintenance run outside the
-hook path; hooks evaluate only the last verified local generation.
+hook path; hooks evaluate only the last verified local deployment.
 
 ## Layout
 
@@ -12,8 +12,8 @@ hook path; hooks evaluate only the last verified local generation.
 ├── active.json
 ├── artifacts/
 │   └── <sha256>.mjs
-└── generations/
-    └── <generation>/
+└── deployments/
+    └── <deployment>/
         ├── manifest.json
         └── <policy-id>.mjs
 ```
@@ -22,9 +22,9 @@ hook path; hooks evaluate only the last verified local generation.
   from cloud. A later slice must authenticate it with a publisher signature;
   SHA-256 alone proves byte identity, not publisher identity.
 - `artifacts/` is a content-addressed cache.
-- `generations/` contains complete materialized policy sets. New generations
+- `deployments/` contains complete materialized policy sets. New deployments
   are built without modifying the active one.
-- `active.json` is an atomically replaced pointer to one complete generation.
+- `active.json` is an atomically replaced pointer to one complete deployment.
   It is derived state and is reconstructed when it is deleted, malformed, or
   disagrees with `desired-state.json`.
 
@@ -32,12 +32,12 @@ hook path; hooks evaluate only the last verified local generation.
 
 ```json
 {
-  "schemaVersion": 1,
-  "generation": 184,
+  "schemaVersion": 2,
+  "deployment": 184,
   "policies": [
     {
       "id": "block-secret-exfiltration",
-      "revision": 7,
+      "version": 7,
       "sha256": "<64 lowercase hex characters>",
       "artifactUrl": "https://..."
     }
@@ -92,26 +92,26 @@ resolved against the configured base URL; cross-origin locators are rejected
 before the token is sent.
 
 An HTTP failure, invalid desired-state response, bad digest, or incomplete
-generation leaves the previous generation active.
+deployment leaves the previous deployment active.
 
 ## Activation transaction
 
-1. Validate schema, policy IDs, unique IDs, digests, and monotonic generation.
-2. Reuse a verified cache/generation copy or fetch missing bytes.
+1. Validate schema, policy IDs, unique IDs, digests, and monotonic deployment.
+2. Reuse a verified cache/deployment copy or fetch missing bytes.
 3. Verify every artifact digest.
-4. Materialize the complete generation and `fsync` its files/directories.
+4. Materialize the complete deployment and `fsync` its files/directories.
 5. Persist `desired-state.json`.
 6. Atomically replace `active.json`.
 
-Any failure before step 6 leaves the previous generation active. The worker
+Any failure before step 6 leaves the previous deployment active. The worker
 loads only paths named by `active.json` and independently verifies every digest
 immediately before importing JavaScript.
 
 ## Integrity maintenance
 
 `failproofaid` runs a maintenance thread outside the hook path. It hashes the
-active generation periodically (30 seconds by default) and repairs either a
-modified generation copy or a modified content-addressed artifact from the
+active deployment periodically (30 seconds by default) and repairs either a
+modified deployment copy or a modified content-addressed artifact from the
 other verified copy. If both are gone, it retains the active manifest and
 reports that a cloud re-fetch is required.
 
diff --git a/crates/failproofaid/src/cloud_client.rs b/crates/failproofaid/src/cloud_client.rs
index 29fb22b3..7d8795fe 100644
--- a/crates/failproofaid/src/cloud_client.rs
+++ b/crates/failproofaid/src/cloud_client.rs
@@ -300,7 +300,7 @@ impl CloudClient {
 /// `--disconnect` take effect within one interval, with nothing to restart.
 ///
 /// Resolution failures degrade to integrity-only rather than killing the lane:
-/// a machine that was pulling policy keeps its last known-good generation and
+/// a machine that was pulling policy keeps its last known-good deployment and
 /// keeps repairing tampering while its credentials are broken.
 ///
 /// Two intervals, chosen per tick, so both documented knobs keep their meaning
@@ -339,7 +339,7 @@ pub fn spawn_maintenance(
             }
 
             // Runs whether or not cloud is reachable: poll failures never
-            // discard the last known-good generation, and local tampering is
+            // discard the last known-good deployment, and local tampering is
             // still repaired while the cloud is offline or unconfigured.
             if let Err(err) = store.repair_active_from_cache() {
                 eprintln!("[failproofaid] cloud policy integrity error: {err}");
@@ -364,8 +364,8 @@ fn poll_once(store: &PolicyStore, cloud: &CloudClient) {
                     if outcome.activated || outcome.downloaded > 0 || outcome.repaired > 0 =>
                 {
                     eprintln!(
-                        "[failproofaid] cloud policy generation {} active (downloaded {}, repaired {})",
-                        outcome.generation, outcome.downloaded, outcome.repaired
+                        "[failproofaid] cloud policy deployment {} active (downloaded {}, repaired {})",
+                        outcome.deployment, outcome.downloaded, outcome.repaired
                     );
                 }
                 Ok(_) => {}
@@ -562,7 +562,7 @@ mod tests {
                 let body = if request
                     .starts_with("GET /enforcement/v1/desired-state?machineId=machine-1")
                 {
-                    format!(r#"{{"schemaVersion":1,"generation":7,"policies":[{{"id":"guard","revision":2,"sha256":"{expected_sha}","artifactUrl":"/enforcement/v1/artifacts/{expected_sha}"}}]}}"#).into_bytes()
+                    format!(r#"{{"schemaVersion":1,"deployment":7,"policies":[{{"id":"guard","version":2,"sha256":"{expected_sha}","artifactUrl":"/enforcement/v1/artifacts/{expected_sha}"}}]}}"#).into_bytes()
                 } else {
                     expected_artifact.clone()
                 };
@@ -590,10 +590,10 @@ mod tests {
         let outcome = store
             .reconcile(&desired, &|policy: &DesiredPolicy| cloud.artifact(policy))
             .unwrap();
-        assert_eq!(outcome.generation, 7);
+        assert_eq!(outcome.deployment, 7);
         assert_eq!(outcome.downloaded, 1);
         assert_eq!(
-            fs::read(root.join("generations/7/guard.mjs")).unwrap(),
+            fs::read(root.join("deployments/7/guard.mjs")).unwrap(),
             artifact
         );
         server.join().unwrap();
@@ -606,7 +606,7 @@ mod tests {
             CloudClient::new("https://cloud.example", "secret".into(), "machine".into()).unwrap();
         let policy = DesiredPolicy {
             id: "guard".into(),
-            revision: 1,
+            version: 1,
             sha256: "0".repeat(64),
             artifact_url: "https://evil.example/artifact".into(),
             effect: PolicyEffect::Enforce,
diff --git a/crates/failproofaid/src/cloud_policies.rs b/crates/failproofaid/src/cloud_policies.rs
index d117297c..a6a32387 100644
--- a/crates/failproofaid/src/cloud_policies.rs
+++ b/crates/failproofaid/src/cloud_policies.rs
@@ -3,7 +3,7 @@
 //! Cloud transport deliberately does not live here. A caller supplies an
 //! [`ArtifactFetcher`], while this module owns the security-sensitive local
 //! transaction: validate the manifest, verify SHA-256, write immutable cache
-//! objects, materialize a complete generation, then switch `active.json`
+//! objects, materialize a complete deployment, then switch `active.json`
 //! atomically. The hook hot path never downloads or partially activates policy.
 
 use serde::{Deserialize, Serialize};
@@ -19,7 +19,24 @@ use std::sync::atomic::{AtomicU64, Ordering};
 use std::thread::JoinHandle;
 use std::time::{Duration, Instant};
 
-pub const DESIRED_STATE_SCHEMA_VERSION: u32 = 1;
+/// What this daemon WRITES, and what the server emits today.
+///
+/// 2, because the v1 payload named these fields `generation` and `revision`
+/// and neither appears any more. Same endpoint, same version number, different
+/// shape is precisely what a schema version exists to prevent — see the note at
+/// the emit site in AgentEye's `enforcement.rs`.
+pub const DESIRED_STATE_SCHEMA_VERSION: u32 = 2;
+
+/// What this daemon ACCEPTS when reading.
+///
+/// 1 is here for files on DISK, never for a server: a machine that ran an
+/// earlier beta has a `desired-state.json` and an `active.json` written at
+/// version 1, and both structs carry `deny_unknown_fields`, so refusing the
+/// version would make the daemon unable to read its own persisted state — it
+/// would silently stop enforcing cloud policy until a poll re-materialised
+/// everything. The field aliases on `ActiveDeployment` exist for the same
+/// files and the same reason.
+pub const SUPPORTED_SCHEMA_VERSIONS: &[u32] = &[1, DESIRED_STATE_SCHEMA_VERSION];
 const MANAGED_FILE_MODE: u32 = 0o600;
 static TEMP_COUNTER: AtomicU64 = AtomicU64::new(0);
 
@@ -27,13 +44,13 @@ static TEMP_COUNTER: AtomicU64 = AtomicU64::new(0);
 /// manifest below. This is parsed from a SERVER response, and daemons update on
 /// their own schedule — so strictness here means the first field cloud adds
 /// makes every older daemon reject desired-state and silently stop pulling,
-/// stranding fleets on whatever generation they happened to hold. Strictness
+/// stranding fleets on whatever deployment they happened to hold. Strictness
 /// belongs on files we write ourselves, not on a remote payload.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase")]
 pub struct DesiredState {
     pub schema_version: u32,
-    pub generation: u64,
+    pub deployment: u64,
     pub policies: Vec<DesiredPolicy>,
 }
 
@@ -41,7 +58,7 @@ pub struct DesiredState {
 #[serde(rename_all = "camelCase")]
 pub struct DesiredPolicy {
     pub id: String,
-    pub revision: u64,
+    pub version: u64,
     pub sha256: String,
     /// Opaque locator interpreted only by the cloud transport implementation.
     pub artifact_url: String,
@@ -68,9 +85,19 @@ pub enum PolicyEffect {
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
-pub struct ActiveGeneration {
+pub struct ActiveDeployment {
     pub schema_version: u32,
-    pub generation: u64,
+    /// `generation` is what every daemon before the rename wrote here.
+    ///
+    /// The alias is load-bearing rather than tidy: this struct carries
+    /// `deny_unknown_fields`, so without it an upgraded daemon fails to parse
+    /// its OWN `active.json` on three counts at once — `generation` unrecognised,
+    /// `deployment` missing, and the same again for every policy's `revision`.
+    /// A machine would silently lose the deployment it was enforcing until a
+    /// poll succeeded, which on a fail-closed machine is the gap this whole
+    /// subsystem exists to prevent.
+    #[serde(alias = "generation")]
+    pub deployment: u64,
     pub policies: Vec<ActivePolicy>,
 }
 
@@ -78,7 +105,9 @@ pub struct ActiveGeneration {
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct ActivePolicy {
     pub id: String,
-    pub revision: u64,
+    /// `revision` is the pre-rename spelling. See `ActiveDeployment::deployment`.
+    #[serde(alias = "revision")]
+    pub version: u64,
     pub sha256: String,
     /// Relative to the cloud-managed root. Never supplied by the server.
     pub path: String,
@@ -90,7 +119,7 @@ pub struct ActivePolicy {
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ReconcileOutcome {
-    pub generation: u64,
+    pub deployment: u64,
     pub downloaded: usize,
     pub repaired: usize,
     pub activated: bool,
@@ -136,7 +165,7 @@ impl std::fmt::Display for ReconcileError {
             }
             Self::NoVerifiedCopy { policy_id } => write!(
                 f,
-                "cloud policy {policy_id} has no verified artifact or generation copy"
+                "cloud policy {policy_id} has no verified artifact or deployment copy"
             ),
         }
     }
@@ -174,9 +203,9 @@ where
 #[derive(Debug, Clone)]
 pub struct PolicyStore {
     root: PathBuf,
-    /// Highest generation this process has seen the SERVER offer.
+    /// Highest deployment this process has seen the SERVER offer.
     ///
-    /// The rollback guard used to compare against `active.json`'s generation.
+    /// The rollback guard used to compare against `active.json`'s deployment.
     /// That file is a derived local pointer owned by the user — which this
     /// module's own comment says — so on the product's stated threat model (a
     /// rogue agent running as the user) it was an attacker-controlled veto over
@@ -220,7 +249,7 @@ impl PolicyStore {
         self.root.join("desired-state.json")
     }
 
-    pub fn read_active(&self) -> Result<Option<ActiveGeneration>, ReconcileError> {
+    pub fn read_active(&self) -> Result<Option<ActiveDeployment>, ReconcileError> {
         let path = self.active_manifest_path();
         if !path.exists() {
             return Ok(None);
@@ -240,8 +269,8 @@ impl PolicyStore {
         Ok(Some(desired))
     }
 
-    /// Installs a complete desired generation. Any error before the final
-    /// `active.json` rename leaves the previous generation authoritative.
+    /// Installs a complete desired deployment. Any error before the final
+    /// `active.json` rename leaves the previous deployment authoritative.
     pub fn reconcile(
         &self,
         desired: &DesiredState,
@@ -260,36 +289,36 @@ impl PolicyStore {
         // Rollback guard, anchored on what the SERVER has said this session —
         // never on the local pointer. See `server_high_water`.
         let floor = self.server_high_water.load(Ordering::Relaxed);
-        if desired.generation < floor {
+        if desired.deployment < floor {
             return Err(ReconcileError::InvalidDesiredState(format!(
-                "generation rollback from {} to {} is not allowed",
-                floor, desired.generation
+                "deployment rollback from {} to {} is not allowed",
+                floor, desired.deployment
             )));
         }
         // Recorded before the work below so a mid-reconcile failure cannot let
-        // an immediately-following lower generation through.
+        // an immediately-following lower deployment through.
         self.server_high_water
-            .fetch_max(desired.generation, Ordering::Relaxed);
+            .fetch_max(desired.deployment, Ordering::Relaxed);
 
         // A local pointer AHEAD of the server is not authority, but it is worth
         // saying out loud: it means either a restored/re-registered control
         // plane, or that something edited this machine's state.
         if let Some(active) = &previous
-            && active.generation > desired.generation
+            && active.deployment > desired.deployment
         {
             eprintln!(
-                "[failproofaid] local active generation {} is ahead of the server's {}; \
+                "[failproofaid] local active deployment {} is ahead of the server's {}; \
                  taking the server's state (the local pointer is not authority)",
-                active.generation, desired.generation
+                active.deployment, desired.deployment
             );
         }
 
         fs::create_dir_all(self.root.join("artifacts"))?;
-        let generation_dir = self
+        let deployment_dir = self
             .root
-            .join("generations")
-            .join(desired.generation.to_string());
-        fs::create_dir_all(&generation_dir)?;
+            .join("deployments")
+            .join(desired.deployment.to_string());
+        fs::create_dir_all(&deployment_dir)?;
 
         let mut downloaded = 0;
         let mut repaired = 0;
@@ -297,15 +326,15 @@ impl PolicyStore {
 
         for policy in &desired.policies {
             let artifact_path = self.artifact_path(&policy.sha256);
-            let generation_path = generation_dir.join(format!("{}.mjs", policy.id));
+            let deployment_path = deployment_dir.join(format!("{}.mjs", policy.id));
 
             let artifact_valid = file_matches_hash(&artifact_path, &policy.sha256)?;
-            let generation_valid = file_matches_hash(&generation_path, &policy.sha256)?;
+            let deployment_valid = file_matches_hash(&deployment_path, &policy.sha256)?;
 
             let bytes = if artifact_valid {
                 fs::read(&artifact_path)?
-            } else if generation_valid {
-                let bytes = fs::read(&generation_path)?;
+            } else if deployment_valid {
+                let bytes = fs::read(&deployment_path)?;
                 write_atomic(&artifact_path, &bytes)?;
                 repaired += 1;
                 bytes
@@ -322,42 +351,42 @@ impl PolicyStore {
                 bytes
             };
 
-            if !generation_valid {
-                write_atomic(&generation_path, &bytes)?;
+            if !deployment_valid {
+                write_atomic(&deployment_path, &bytes)?;
                 if artifact_valid {
                     repaired += 1;
                 }
             }
 
-            let relative_path = generation_path
+            let relative_path = deployment_path
                 .strip_prefix(&self.root)
                 .map_err(|_| {
                     ReconcileError::InvalidDesiredState(
-                        "generation path escaped policy root".into(),
+                        "deployment path escaped policy root".into(),
                     )
                 })?
                 .to_string_lossy()
                 .into_owned();
             active_policies.push(ActivePolicy {
                 id: policy.id.clone(),
-                revision: policy.revision,
+                version: policy.version,
                 effect: policy.effect,
                 sha256: policy.sha256.clone(),
                 path: relative_path,
             });
         }
 
-        let active = ActiveGeneration {
+        let active = ActiveDeployment {
             schema_version: DESIRED_STATE_SCHEMA_VERSION,
-            generation: desired.generation,
+            deployment: desired.deployment,
             policies: active_policies,
         };
         let manifest_bytes = serde_json::to_vec_pretty(&active)?;
-        write_atomic(&generation_dir.join("manifest.json"), &manifest_bytes)?;
+        write_atomic(&deployment_dir.join("manifest.json"), &manifest_bytes)?;
 
         // Persist the cloud snapshot before switching active.json. A crash in
         // between is recoverable: the maintenance loop reconstructs the active
-        // pointer from this snapshot and the fully staged generation.
+        // pointer from this snapshot and the fully staged deployment.
         write_atomic(
             &self.desired_state_path(),
             &serde_json::to_vec_pretty(desired)?,
@@ -369,26 +398,26 @@ impl PolicyStore {
         }
 
         Ok(ReconcileOutcome {
-            generation: desired.generation,
+            deployment: desired.deployment,
             downloaded,
             repaired,
             activated,
         })
     }
 
-    /// Verifies the active generation and repairs one bad copy from the other
+    /// Verifies the active deployment and repairs one bad copy from the other
     /// verified local copy. If both copies are missing/corrupt, the cloud
     /// transport must re-fetch; active.json remains unchanged and the worker's
-    /// already-loaded generation remains the last known good decision set.
+    /// already-loaded deployment remains the last known good decision set.
     pub fn repair_active_from_cache(&self) -> Result<usize, ReconcileError> {
         // A corrupted `desired-state.json` must not disable repair.
         //
         // `self.read_desired()?` propagated any parse error straight out,
         // short-circuiting before the `active.json`-driven branch below — the
-        // one that rebuilds a tampered `generations/<n>/<id>.mjs` from the
+        // one that rebuilds a tampered `deployments/<n>/<id>.mjs` from the
         // still-valid, content-addressed `artifacts/<sha>.mjs` copy. So one bad
         // byte in a file this branch does not even need permanently disabled
-        // generation-copy self-healing, and per `CLOUD_POLICIES.md` the only
+        // deployment-copy self-healing, and per `CLOUD_POLICIES.md` the only
         // thing that rewrites it is a successful cloud poll — which never
         // happens on an unenrolled or unreachable machine.
         //
@@ -418,10 +447,10 @@ impl PolicyStore {
         let Some(active) = self.read_active()? else {
             return Ok(0);
         };
-        if active.schema_version != DESIRED_STATE_SCHEMA_VERSION {
+        if !SUPPORTED_SCHEMA_VERSIONS.contains(&active.schema_version) {
             return Err(ReconcileError::InvalidDesiredState(format!(
-                "unsupported active schema version {}",
-                active.schema_version
+                "unsupported active schema version {} (supported: {:?})",
+                active.schema_version, SUPPORTED_SCHEMA_VERSIONS
             )));
         }
 
@@ -429,19 +458,19 @@ impl PolicyStore {
         for policy in &active.policies {
             validate_policy_identity(&policy.id)?;
             validate_sha256(&policy.sha256)?;
-            let generation_path = safe_join_relative(&self.root, &policy.path)?;
+            let deployment_path = safe_join_relative(&self.root, &policy.path)?;
             let artifact_path = self.artifact_path(&policy.sha256);
             let artifact_valid = file_matches_hash(&artifact_path, &policy.sha256)?;
-            let generation_valid = file_matches_hash(&generation_path, &policy.sha256)?;
+            let deployment_valid = file_matches_hash(&deployment_path, &policy.sha256)?;
 
-            match (artifact_valid, generation_valid) {
+            match (artifact_valid, deployment_valid) {
                 (true, true) => {}
                 (true, false) => {
-                    write_atomic(&generation_path, &fs::read(&artifact_path)?)?;
+                    write_atomic(&deployment_path, &fs::read(&artifact_path)?)?;
                     repaired += 1;
                 }
                 (false, true) => {
-                    write_atomic(&artifact_path, &fs::read(&generation_path)?)?;
+                    write_atomic(&artifact_path, &fs::read(&deployment_path)?)?;
                     repaired += 1;
                 }
                 (false, false) => {
@@ -487,10 +516,10 @@ pub fn spawn_integrity_monitor(
 }
 
 fn validate_desired_state(desired: &DesiredState) -> Result<(), ReconcileError> {
-    if desired.schema_version != DESIRED_STATE_SCHEMA_VERSION {
+    if !SUPPORTED_SCHEMA_VERSIONS.contains(&desired.schema_version) {
         return Err(ReconcileError::InvalidDesiredState(format!(
-            "unsupported schema version {}",
-            desired.schema_version
+            "unsupported schema version {} (supported: {:?})",
+            desired.schema_version, SUPPORTED_SCHEMA_VERSIONS
         )));
     }
     let mut ids = HashSet::new();
@@ -624,14 +653,14 @@ mod tests {
         // Daemons update on their own schedule. If this struct rejected unknown
         // fields, the first thing cloud added would make every older daemon
         // fail to parse desired-state and silently stop pulling — a fleet
-        // stranded on whatever generation it happened to hold, with no error
+        // stranded on whatever deployment it happened to hold, with no error
         // anyone would look for.
-        let json = r#"{"schemaVersion":1,"generation":4,"policies":[
-            {"id":"guard","revision":2,"sha256":"aa","artifactUrl":"/a","effect":"observe",
+        let json = r#"{"schemaVersion":1,"deployment":4,"policies":[
+            {"id":"guard","version":2,"sha256":"aa","artifactUrl":"/a","effect":"observe",
              "someFutureField":{"nested":true}}
         ],"anotherFutureField":42}"#;
         let parsed: DesiredState = serde_json::from_str(json).expect("must parse");
-        assert_eq!(parsed.generation, 4);
+        assert_eq!(parsed.deployment, 4);
         assert_eq!(parsed.policies[0].effect, PolicyEffect::Observe);
     }
 
@@ -640,8 +669,8 @@ mod tests {
         // The default has to be the one that keeps enforcing: a server that
         // predates observe mode must not silently downgrade a fleet to
         // observation.
-        let json = r#"{"schemaVersion":1,"generation":1,"policies":[
-            {"id":"g","revision":1,"sha256":"aa","artifactUrl":"/a"}]}"#;
+        let json = r#"{"schemaVersion":1,"deployment":1,"policies":[
+            {"id":"g","version":1,"sha256":"aa","artifactUrl":"/a"}]}"#;
         let parsed: DesiredState = serde_json::from_str(json).unwrap();
         assert_eq!(parsed.policies[0].effect, PolicyEffect::Enforce);
     }
@@ -650,9 +679,9 @@ mod tests {
     fn an_unreadable_effect_is_rejected_rather_than_guessed() {
         // Guessing would mean choosing between enforcing something cloud did
         // not ask to enforce, or observing something it wanted enforced. Both
-        // are worse than refusing the generation.
-        let json = r#"{"schemaVersion":1,"generation":1,"policies":[
-            {"id":"g","revision":1,"sha256":"aa","artifactUrl":"/a","effect":"maybe"}]}"#;
+        // are worse than refusing the deployment.
+        let json = r#"{"schemaVersion":1,"deployment":1,"policies":[
+            {"id":"g","version":1,"sha256":"aa","artifactUrl":"/a","effect":"maybe"}]}"#;
         assert!(serde_json::from_str::<DesiredState>(json).is_err());
     }
 
@@ -661,18 +690,18 @@ mod tests {
         // active.json is what the evaluator reads. If the effect were not
         // carried here, an observe-mode policy would enforce the moment the
         // daemon restarted and re-read its own manifest.
-        let manifest = ActiveGeneration {
+        let manifest = ActiveDeployment {
             schema_version: 1,
-            generation: 9,
+            deployment: 9,
             policies: vec![ActivePolicy {
                 id: "g".into(),
-                revision: 1,
+                version: 1,
                 sha256: "aa".into(),
-                path: "generations/9/g.mjs".into(),
+                path: "deployments/9/g.mjs".into(),
                 effect: PolicyEffect::Observe,
             }],
         };
-        let round_tripped: ActiveGeneration =
+        let round_tripped: ActiveDeployment =
             serde_json::from_str(&serde_json::to_string(&manifest).unwrap()).unwrap();
         assert_eq!(round_tripped.policies[0].effect, PolicyEffect::Observe);
         assert!(
@@ -692,22 +721,22 @@ mod tests {
         PolicyStore::new(root)
     }
 
-    fn desired(generation: u64, id: &str, bytes: &[u8]) -> DesiredState {
+    fn desired(deployment: u64, id: &str, bytes: &[u8]) -> DesiredState {
         DesiredState {
             schema_version: DESIRED_STATE_SCHEMA_VERSION,
-            generation,
+            deployment,
             policies: vec![DesiredPolicy {
                 id: id.to_string(),
-                revision: generation,
+                version: deployment,
                 sha256: sha256_hex(bytes),
-                artifact_url: format!("https://cloud.invalid/{id}/{generation}"),
+                artifact_url: format!("https://cloud.invalid/{id}/{deployment}"),
                 effect: PolicyEffect::Enforce,
             }],
         }
     }
 
     #[test]
-    fn activates_a_complete_verified_generation() {
+    fn activates_a_complete_verified_deployment() {
         let store = temp_store("activate");
         let bytes = b"export default 'cloud policy';\n";
         let state = desired(7, "block-secrets", bytes);
@@ -723,7 +752,7 @@ mod tests {
         assert!(outcome.activated);
         assert_eq!(fetches.load(Ordering::Relaxed), 1);
         let active = store.read_active().unwrap().unwrap();
-        assert_eq!(active.generation, 7);
+        assert_eq!(active.deployment, 7);
         assert_eq!(active.policies[0].id, "block-secrets");
         let active_path = store.root().join(&active.policies[0].path);
         assert_eq!(fs::read(active_path).unwrap(), bytes);
@@ -750,13 +779,13 @@ mod tests {
             .unwrap_err();
         assert!(matches!(err, ReconcileError::HashMismatch { .. }));
         assert_eq!(fs::read(store.active_manifest_path()).unwrap(), before);
-        assert_eq!(store.read_active().unwrap().unwrap().generation, 1);
+        assert_eq!(store.read_active().unwrap().unwrap().deployment, 1);
         fs::remove_dir_all(store.root()).ok();
     }
 
     #[test]
-    fn repairs_a_tampered_generation_copy_from_the_verified_artifact() {
-        let store = temp_store("repair-generation");
+    fn repairs_a_tampered_deployment_copy_from_the_verified_artifact() {
+        let store = temp_store("repair-deployment");
         let bytes = b"export default 'verified';\n";
         store
             .reconcile(&desired(3, "guard", bytes), &|_: &DesiredPolicy| {
@@ -764,16 +793,16 @@ mod tests {
             })
             .unwrap();
         let active = store.read_active().unwrap().unwrap();
-        let generation_path = store.root().join(&active.policies[0].path);
-        fs::write(&generation_path, b"tampered").unwrap();
+        let deployment_path = store.root().join(&active.policies[0].path);
+        fs::write(&deployment_path, b"tampered").unwrap();
 
         assert_eq!(store.repair_active_from_cache().unwrap(), 1);
-        assert_eq!(fs::read(generation_path).unwrap(), bytes);
+        assert_eq!(fs::read(deployment_path).unwrap(), bytes);
         fs::remove_dir_all(store.root()).ok();
     }
 
     #[test]
-    fn repairs_a_tampered_artifact_from_the_verified_generation_copy() {
+    fn repairs_a_tampered_artifact_from_the_verified_deployment_copy() {
         let store = temp_store("repair-artifact");
         let bytes = b"export default 'verified';\n";
         let state = desired(4, "guard", bytes);
@@ -804,7 +833,7 @@ mod tests {
             store.repair_active_from_cache(),
             Err(ReconcileError::Fetch { .. })
         ));
-        assert_eq!(store.read_active().unwrap().unwrap().generation, 5);
+        assert_eq!(store.read_active().unwrap().unwrap().deployment, 5);
         fs::remove_dir_all(store.root()).ok();
     }
 
@@ -820,7 +849,7 @@ mod tests {
 
         fs::write(
             store.active_manifest_path(),
-            br#"{"schemaVersion":1,"generation":11,"policies":[]}"#,
+            br#"{"schemaVersion":1,"deployment":11,"policies":[]}"#,
         )
         .unwrap();
         assert_eq!(store.repair_active_from_cache().unwrap(), 1);
@@ -836,7 +865,7 @@ mod tests {
     }
 
     #[test]
-    fn rejects_traversal_duplicate_ids_and_generation_rollback() {
+    fn rejects_traversal_duplicate_ids_and_deployment_rollback() {
         let store = temp_store("validation");
         let bytes = b"policy";
         let mut traversal = desired(1, "../escape", bytes);
@@ -866,7 +895,7 @@ mod tests {
         fs::remove_dir_all(store.root()).ok();
     }
 
-    /// A tampered local generation must not be able to veto the control plane.
+    /// A tampered local deployment must not be able to veto the control plane.
     ///
     /// The guard used to compare against `active.json`, a 0600 file owned by
     /// the very user the product's threat model treats as compromised. Writing
@@ -876,8 +905,8 @@ mod tests {
     /// closed on every tool call. A permanent denial of service for one file
     /// write.
     #[test]
-    fn a_tampered_local_generation_cannot_permanently_veto_the_server() {
-        let store = temp_store("tampered-generation");
+    fn a_tampered_local_deployment_cannot_permanently_veto_the_server() {
+        let store = temp_store("tampered-deployment");
         let bytes = b"policy";
 
         store
@@ -890,7 +919,7 @@ mod tests {
         let manifest = store.active_manifest_path();
         let raw = fs::read_to_string(&manifest).unwrap();
         let mut active: serde_json::Value = serde_json::from_str(&raw).unwrap();
-        active["generation"] = serde_json::json!(u64::MAX);
+        active["deployment"] = serde_json::json!(u64::MAX);
         fs::write(&manifest, serde_json::to_vec(&active).unwrap()).unwrap();
 
         // A fresh process, as after any restart. It must take the server's
@@ -902,7 +931,7 @@ mod tests {
             })
             .expect("the server's state must win over a local pointer");
         assert!(outcome.activated);
-        assert_eq!(restarted.read_active().unwrap().unwrap().generation, 6);
+        assert_eq!(restarted.read_active().unwrap().unwrap().deployment, 6);
 
         // And replay protection still holds WITHIN the session, which is the
         // transport failure the guard actually exists for.
@@ -926,20 +955,151 @@ mod tests {
             })
             .unwrap();
         let active = store.read_active().unwrap().unwrap();
-        let generation_path = store.root().join(&active.policies[0].path);
-        fs::write(&generation_path, b"tampered").unwrap();
+        let deployment_path = store.root().join(&active.policies[0].path);
+        fs::write(&deployment_path, b"tampered").unwrap();
 
         let shutdown = Arc::new(AtomicBool::new(false));
         let handle =
             spawn_integrity_monitor(store.clone(), shutdown.clone(), Duration::from_millis(10));
         let deadline = Instant::now() + Duration::from_secs(1);
-        while fs::read(&generation_path).unwrap() != bytes && Instant::now() < deadline {
+        while fs::read(&deployment_path).unwrap() != bytes && Instant::now() < deadline {
             std::thread::sleep(Duration::from_millis(5));
         }
         shutdown.store(true, Ordering::Relaxed);
         handle.join().unwrap();
 
-        assert_eq!(fs::read(generation_path).unwrap(), bytes);
+        assert_eq!(fs::read(deployment_path).unwrap(), bytes);
         fs::remove_dir_all(store.root()).ok();
     }
 }
+
+#[cfg(test)]
+mod pre_rename_state_tests {
+    use super::*;
+
+    /// Byte-exact `active.json` written by a daemon before the
+    /// generation→deployment / revision→version rename, captured from a live
+    /// machine rather than hand-written.
+    const PRE_RENAME_ACTIVE: &str = r#"{
+  "schemaVersion": 1,
+  "generation": 1,
+  "policies": [
+    {
+      "id": "e2e-block-curl",
+      "revision": 1,
+      "sha256": "732c6e780e183a15259688d858e4ec0db20c7dd13352601c73db5540122e2c30",
+      "path": "generations/1/e2e-block-curl.mjs",
+      "effect": "enforce"
+    }
+  ]
+}"#;
+
+    /// The upgrade case. `ActiveDeployment` carries `deny_unknown_fields`, so
+    /// without the aliases this fails on three counts at once: `generation`
+    /// unrecognised, `deployment` missing, and `revision`/`version` likewise per
+    /// policy. The machine would lose the deployment it was already enforcing
+    /// until a poll succeeded — on a fail-closed machine, exactly the gap this
+    /// subsystem exists to close.
+    #[test]
+    fn active_json_written_before_the_rename_still_parses() {
+        let parsed: ActiveDeployment = serde_json::from_str(PRE_RENAME_ACTIVE)
+            .expect("a pre-rename active.json must still be readable after an upgrade");
+        assert_eq!(parsed.schema_version, 1);
+        assert_eq!(parsed.deployment, 1);
+        assert_eq!(parsed.policies.len(), 1);
+        assert_eq!(parsed.policies[0].version, 1);
+        assert_eq!(parsed.policies[0].id, "e2e-block-curl");
+        assert_eq!(parsed.policies[0].effect, PolicyEffect::Enforce);
+    }
+
+    /// The WIRE deliberately does NOT accept the old spelling.
+    ///
+    /// The alias was there and was removed on purpose: AgentEye#559 emits only
+    /// the new names and bumped the payload to `schemaVersion: 2`, so an alias
+    /// here would be dead code guarding a case no server can produce — and a
+    /// silently-tolerated old field is how two sides drift back apart. If a
+    /// payload ever arrives with `generation`/`revision`, it is either a stale
+    /// server or something forged, and both should fail loudly.
+    ///
+    /// This is the exact opposite choice from `ActiveDeployment` above, and the
+    /// difference is *who wrote the bytes*: the wire comes from a server we
+    /// version in lockstep, `active.json` comes from a daemon that may be older
+    /// than the one now reading it.
+    #[test]
+    fn the_wire_does_not_accept_the_pre_rename_spelling() {
+        let err = serde_json::from_str::<DesiredState>(
+            r#"{"schemaVersion":1,"generation":184,
+                "policies":[{"id":"p","revision":7,"sha256":"a",
+                             "artifactUrl":"/enforcement/v1/artifacts/a"}]}"#,
+        )
+        .expect_err("the old wire spelling must be refused, not silently accepted");
+        assert!(
+            err.to_string().contains("missing field"),
+            "expected a missing-field error, got: {err}"
+        );
+    }
+
+    /// Both schema versions are readable, and only from disk does 1 arise.
+    #[test]
+    fn both_schema_versions_are_accepted() {
+        assert!(
+            SUPPORTED_SCHEMA_VERSIONS.contains(&1),
+            "a beta daemon's files are v1"
+        );
+        assert!(
+            SUPPORTED_SCHEMA_VERSIONS.contains(&DESIRED_STATE_SCHEMA_VERSION),
+            "what we write must be readable"
+        );
+        assert_eq!(DESIRED_STATE_SCHEMA_VERSION, 2, "the server emits 2");
+
+        // The version the server actually sends must validate.
+        let desired: DesiredState = serde_json::from_str(
+            r#"{"schemaVersion":2,"deployment":1,
+                "policies":[{"id":"p","version":1,
+                  "sha256":"439735423d5d532041bccbbc62cafefacd2253d3a7c71ff99d6473b38acda0ee",
+                  "artifactUrl":"/enforcement/v1/artifacts/x","effect":"enforce"}]}"#,
+        )
+        .expect("schemaVersion 2 is what AgentEye emits");
+        validate_desired_state(&desired).expect("v2 desired state must validate");
+
+        // ...and an unknown one is still refused.
+        let bad = DesiredState {
+            schema_version: 99,
+            ..desired
+        };
+        assert!(
+            validate_desired_state(&bad).is_err(),
+            "an unknown version must be refused"
+        );
+    }
+
+    /// The new spelling is what we WRITE, and must keep round-tripping — an
+    /// alias that quietly became the canonical name would be its own bug.
+    #[test]
+    fn the_current_spelling_round_trips() {
+        let state = ActiveDeployment {
+            schema_version: 1,
+            deployment: 9,
+            policies: vec![ActivePolicy {
+                id: "p".into(),
+                version: 3,
+                sha256: "a".into(),
+                path: "deployments/9/p.mjs".into(),
+                effect: PolicyEffect::Observe,
+            }],
+        };
+        let text = serde_json::to_string(&state).unwrap();
+        assert!(
+            text.contains("\"deployment\":9"),
+            "must serialize the NEW name: {text}"
+        );
+        assert!(
+            text.contains("\"version\":3"),
+            "must serialize the NEW name: {text}"
+        );
+        assert_eq!(
+            serde_json::from_str::<ActiveDeployment>(&text).unwrap(),
+            state
+        );
+    }
+}
diff --git a/crates/failproofaid/src/main.rs b/crates/failproofaid/src/main.rs
index ed080590..af793381 100644
--- a/crates/failproofaid/src/main.rs
+++ b/crates/failproofaid/src/main.rs
@@ -90,7 +90,7 @@ fn run() -> Result<(), Box<dyn std::error::Error>> {
 
     // Cloud policy integrity is a maintenance-lane responsibility, never a
     // hook-path operation. The monitor is useful before cloud transport lands:
-    // it keeps the active generation and content-addressed artifact cache in
+    // it keeps the active deployment and content-addressed artifact cache in
     // agreement and reports when both verified copies have been lost.
     let cloud_policy_store = cloud_policies::PolicyStore::new(paths::cloud_managed_policy_dir()?);
     // One lane, resolving enrolment per tick rather than once at startup.
@@ -290,10 +290,10 @@ fn spawn_collector_manager(
             // machine.
             telemetry::set_collector_metrics(collector.metrics());
             // `Option` because `join_with_flush` CONSUMES the handle: the loop
-            // has to be able to give a generation away and hold nothing until it
+            // has to be able to give a deployment away and hold nothing until it
             // has a replacement.
             let mut collector = Some(collector);
-            // The config this generation was built from. Comparing the whole
+            // The config this deployment was built from. Comparing the whole
             // `CollectorConfig` rather than just the credential is deliberate:
             // it also covers a stream being switched off, a verbosity change and
             // a redaction change, all of which are baked into the tasks at build
@@ -354,6 +354,14 @@ fn spawn_collector_manager(
                     continue;
                 }
 
+                // Cheap by comparison with a backfill: nothing is rewound and
+                // the collector keeps running. Just tell the sweeper to stop
+                // waiting out its interval.
+                if take_flush_request() {
+                    flush_flag().store(true, Ordering::SeqCst);
+                    tracing::info!("flush requested; delivering spooled batches now");
+                }
+
                 let next = current_collector_config();
                 // `None` means unreadable, not "disabled". A half-written file
                 // caught mid-save would otherwise tear down a healthy collector
@@ -366,7 +374,7 @@ fn spawn_collector_manager(
                     continue;
                 }
 
-                // Drain what the old generation already spooled BEFORE starting
+                // Drain what the old deployment already spooled BEFORE starting
                 // the new one. Two collectors sharing a spool directory would
                 // both claim the same batch files.
                 tracing::info!("collector configuration changed; cycling the collector");
@@ -390,7 +398,7 @@ fn spawn_collector_manager(
                     }
                     // Control falls through to the spawn below. `next_cfg` is
                     // refreshed to whatever re-enabled collection, because THAT
-                    // is what the new generation will be built from.
+                    // is what the new deployment will be built from.
                 }
                 let next_cfg = current_collector_config().unwrap_or(next_cfg);
 
@@ -403,10 +411,10 @@ fn spawn_collector_manager(
                     running_cfg = Some(next_cfg);
                     continue;
                 };
-                // Replaces the previous generation's counters. The registry is a
+                // Replaces the previous deployment's counters. The registry is a
                 // RwLock rather than a OnceLock for exactly this — a set-once
                 // slot left telemetry polling a collector that had been joined,
-                // reporting a dead generation's totals as current.
+                // reporting a dead deployment's totals as current.
                 telemetry::set_collector_metrics(next_collector.metrics());
                 collector = Some(next_collector);
                 // What was BUILT FROM, not a fresh read. Re-reading here loses
@@ -488,6 +496,34 @@ fn file_source_since_days() -> Option<u64> {
 /// CLI is the only writer, and it writes this file atomically, so a malformed
 /// one means a hand-edit or a truncated disk rather than a race worth waiting
 /// out.
+/// Set by the maintenance tick when a `failproofai flush` request lands, and
+/// swapped back to false by the spool sweeper when it has done the pass.
+///
+/// A flag rather than a channel because the sweeper is rebuilt whenever the
+/// collector cycles (a config change, a backfill) and a channel receiver would
+/// go with it — dropping a request that had already been taken off disk.
+static FLUSH_NOW: std::sync::OnceLock<Arc<std::sync::atomic::AtomicBool>> =
+    std::sync::OnceLock::new();
+
+fn flush_flag() -> Arc<std::sync::atomic::AtomicBool> {
+    FLUSH_NOW
+        .get_or_init(|| Arc::new(std::sync::atomic::AtomicBool::new(false)))
+        .clone()
+}
+
+/// True when a flush was requested. Removed before acting, like the backfill
+/// request, so a panic mid-pass cannot re-trigger it forever.
+fn take_flush_request() -> bool {
+    let Ok(path) = paths::flush_request_path() else {
+        return false;
+    };
+    if !path.exists() {
+        return false;
+    }
+    let _ = std::fs::remove_file(&path);
+    true
+}
+
 fn take_backfill_request() -> Option<std::time::SystemTime> {
     let path = paths::backfill_request_path().ok()?;
     let raw = std::fs::read_to_string(&path).ok()?;
@@ -577,6 +613,32 @@ fn collector_config_poll_interval() -> Duration {
     Duration::from_millis(ms.max(MINIMUM_MS))
 }
 
+/// Harness keys accepted under `[collector.sources.<key>]` in `config.toml`.
+///
+/// Twelve keys for thirteen sources: `claude` covers both the main and the
+/// subagent format, which share a root. Anything else configured is reported at
+/// startup rather than ignored — a typo'd table parses cleanly, captures
+/// nothing, and is mentioned nowhere else in the pipeline.
+///
+/// Kept beside the registrations below rather than derived from them because
+/// `claude-subagent` is a source and not a harness, so the two lists are
+/// genuinely different and deriving one from the other would reintroduce the
+/// key nobody should configure.
+const HARNESS_KEYS: &[&str] = &[
+    "claude",
+    "codex",
+    "copilot",
+    "openclaw",
+    "pi",
+    "factory",
+    "antigravity",
+    "cursor",
+    "goose",
+    "opencode",
+    "devin",
+    "hermes",
+];
+
 fn collector_tasks() -> Vec<fpai_collect::TaskSpec> {
     let home = match paths::failproofai_home() {
         Ok(home) => home,
@@ -703,14 +765,69 @@ fn collector_tasks() -> Vec<fpai_collect::TaskSpec> {
         let machine = cfg.settings.machine_id.clone();
         let cursors = cursors_root.clone();
 
+        // `~` in a configured path expands against this, not against whatever
+        // HOME the service unit happened to inherit at spawn time — a
+        // system-scope unit's environment carries essentially nothing (see
+        // `resolveWorkerCommand` in daemon-service.ts for the same hazard).
+        let home_dir = std::env::var_os("HOME").map(std::path::PathBuf::from);
+        let settings = &cfg.settings;
+
+        // A configured table naming no real source captures nothing and is
+        // mentioned nowhere else in the pipeline, so say so once at startup.
+        for unknown in settings.unknown_sources(HARNESS_KEYS) {
+            eprintln!(
+                "[failproofaid] config.toml has [collector.sources.{unknown}], which is not a \
+                 known harness; nothing will be captured from it. Known: {}",
+                HARNESS_KEYS.join(", ")
+            );
+        }
+
+        // Resolve one harness's configured extra paths against the roots it
+        // already watches, logging every rejection — each one is a path the
+        // operator asked for and is not getting.
+        let extras = |harness: &str,
+                      defaults: &[std::path::PathBuf]|
+         -> Vec<fpai_collect::ExtraPath> {
+            let entries = settings.extra_paths_for(harness);
+            if entries.is_empty() {
+                return Vec::new();
+            }
+            let resolved =
+                fpai_collect::extra_paths::resolve(&entries, defaults, home_dir.as_deref());
+            for bad in &resolved.rejected {
+                eprintln!(
+                    "[failproofaid] ignoring extra path {:?} for {harness}: {}",
+                    bad.entry, bad.reason
+                );
+            }
+            for ok in &resolved.accepted {
+                eprintln!(
+                    "[failproofaid] {harness}: also capturing {} as {:?} (agent ids namespaced {}-*)",
+                    ok.path.display(),
+                    ok.label,
+                    ok.label
+                );
+            }
+            resolved.accepted
+        };
+
         use fpai_collect::sources::{
             antigravity, claude, codex, copilot, cursor, factory, openclaw, pi,
         };
+
+        // Claude's two formats share one root and therefore one harness key:
+        // an extra path holding Claude transcripts holds their subagents too,
+        // and asking the operator to configure `claude` and `claude-subagent`
+        // separately would mean a natural-looking config that silently drops
+        // every subagent under the added path.
+        let claude_roots = vec![claude_projects_root()];
+        let claude_extra = extras("claude", &claude_roots);
         file_source(
             &mut tasks,
             "claude",
             claude::FORMAT,
-            vec![claude_projects_root()],
+            claude_roots.clone(),
+            &claude_extra,
             claude::DEFAULT_AGENT_ID,
             &spool,
             &cursors,
@@ -728,7 +845,8 @@ fn collector_tasks() -> Vec<fpai_collect::TaskSpec> {
             &mut tasks,
             "claude-subagent",
             claude::SUBAGENT_FORMAT,
-            vec![claude_projects_root()],
+            claude_roots,
+            &claude_extra,
             claude::SUBAGENT_DEFAULT_AGENT_ID,
             &spool,
             &cursors,
@@ -737,11 +855,14 @@ fn collector_tasks() -> Vec<fpai_collect::TaskSpec> {
             os_user.as_deref(),
             redact,
         );
+
+        let codex_roots = vec![codex_sessions_root()];
         file_source(
             &mut tasks,
             "codex",
             codex::FORMAT,
-            vec![codex_sessions_root()],
+            codex_roots.clone(),
+            &extras("codex", &codex_roots),
             codex::DEFAULT_AGENT_ID,
             &spool,
             &cursors,
@@ -750,11 +871,14 @@ fn collector_tasks() -> Vec<fpai_collect::TaskSpec> {
             os_user.as_deref(),
             redact,
         );
+
+        let copilot_roots = vec![copilot::session_state_root()];
         file_source(
             &mut tasks,
             "copilot",
             copilot::FORMAT,
-            vec![copilot::session_state_root()],
+            copilot_roots.clone(),
+            &extras("copilot", &copilot_roots),
             copilot::DEFAULT_AGENT_ID,
             &spool,
             &cursors,
@@ -763,11 +887,14 @@ fn collector_tasks() -> Vec<fpai_collect::TaskSpec> {
             os_user.as_deref(),
             redact,
         );
+
+        let openclaw_roots = openclaw::default_roots();
         file_source(
             &mut tasks,
             "openclaw",
             openclaw::FORMAT,
-            openclaw::default_roots(),
+            openclaw_roots.clone(),
+            &extras("openclaw", &openclaw_roots),
             openclaw::DEFAULT_AGENT_ID,
             &spool,
             &cursors,
@@ -776,11 +903,14 @@ fn collector_tasks() -> Vec<fpai_collect::TaskSpec> {
             os_user.as_deref(),
             redact,
         );
+
+        let pi_roots = vec![pi::sessions_root()];
         file_source(
             &mut tasks,
             "pi",
             pi::FORMAT,
-            vec![pi::sessions_root()],
+            pi_roots.clone(),
+            &extras("pi", &pi_roots),
             pi::DEFAULT_AGENT_ID,
             &spool,
             &cursors,
@@ -789,11 +919,14 @@ fn collector_tasks() -> Vec<fpai_collect::TaskSpec> {
             os_user.as_deref(),
             redact,
         );
+
+        let factory_roots = vec![factory_sessions_root()];
         file_source(
             &mut tasks,
             "factory",
             factory::FORMAT,
-            vec![factory_sessions_root()],
+            factory_roots.clone(),
+            &extras("factory", &factory_roots),
             factory::DEFAULT_AGENT_ID,
             &spool,
             &cursors,
@@ -802,11 +935,14 @@ fn collector_tasks() -> Vec<fpai_collect::TaskSpec> {
             os_user.as_deref(),
             redact,
         );
+
+        let antigravity_roots = vec![antigravity_brain_root()];
         file_source(
             &mut tasks,
             "antigravity",
             antigravity::FORMAT,
-            vec![antigravity_brain_root()],
+            antigravity_roots.clone(),
+            &extras("antigravity", &antigravity_roots),
             antigravity::DEFAULT_AGENT_ID,
             &spool,
             &cursors,
@@ -815,11 +951,14 @@ fn collector_tasks() -> Vec<fpai_collect::TaskSpec> {
             os_user.as_deref(),
             redact,
         );
+
+        let cursor_roots = vec![cursor_projects_root()];
         file_source(
             &mut tasks,
             "cursor",
             cursor::FORMAT,
-            vec![cursor_projects_root()],
+            cursor_roots.clone(),
+            &extras("cursor", &cursor_roots),
             cursor::DEFAULT_AGENT_ID,
             &spool,
             &cursors,
@@ -830,55 +969,60 @@ fn collector_tasks() -> Vec<fpai_collect::TaskSpec> {
         );
 
         use fpai_collect::sources::{devin, goose, hermes, opencode};
-        sqlite_source(
+        sqlite_harness(
             &mut tasks,
             "goose",
             goose::FORMAT,
             goose::db_path(),
+            &extras("goose", &[goose::db_path()]),
             goose::DEFAULT_AGENT_ID,
             &spool,
-            cursors.join("goose"),
+            &cursors,
             &env,
             machine.as_deref(),
             os_user.as_deref(),
             redact,
-            None,
         );
-        sqlite_source(
+        sqlite_harness(
             &mut tasks,
             "opencode",
             opencode::FORMAT,
             opencode::default_db_path(),
+            &extras("opencode", &[opencode::default_db_path()]),
             opencode::DEFAULT_AGENT_ID,
             &spool,
-            cursors.join("opencode"),
+            &cursors,
             &env,
             machine.as_deref(),
             os_user.as_deref(),
             redact,
-            None,
         );
-        sqlite_source(
+        sqlite_harness(
             &mut tasks,
             "devin",
             devin::FORMAT,
             devin::db_path(),
+            &extras("devin", &[devin::db_path()]),
             devin::DEFAULT_AGENT_ID,
             &spool,
-            cursors.join("devin"),
+            &cursors,
             &env,
             machine.as_deref(),
             os_user.as_deref(),
             redact,
-            None,
         );
 
         // Hermes profiles are SEPARATE databases, and the SQLite poller keys its
         // cursor on a fixed synthetic id — so two profiles sharing one state
         // directory would clobber each other's watermark and each would re-read
         // from zero after every restart. Each database gets its own.
-        for (i, db) in hermes::default_db_paths().into_iter().enumerate() {
-            let profile = profile_dir_name(&db, i);
+        //
+        // This is the shape every other source now takes for its extra paths;
+        // Hermes reached it first, by having several default databases rather
+        // than several configured ones.
+        let hermes_dbs = hermes::default_db_paths();
+        for (i, db) in hermes_dbs.iter().enumerate() {
+            let profile = profile_dir_name(db, i);
             let state = cursors.join("hermes").join(&profile);
             // ...and its own health key, for the same reason it gets its own
             // cursor directory. Every profile reporting under the bare string
@@ -890,7 +1034,7 @@ fn collector_tasks() -> Vec<fpai_collect::TaskSpec> {
                 &mut tasks,
                 "hermes",
                 hermes::FORMAT,
-                db,
+                db.clone(),
                 hermes::DEFAULT_AGENT_ID,
                 &spool,
                 state,
@@ -899,6 +1043,30 @@ fn collector_tasks() -> Vec<fpai_collect::TaskSpec> {
                 os_user.as_deref(),
                 redact,
                 Some(format!("hermes:{profile}")),
+                // No label: a default profile is not an extra path, and
+                // namespacing it would rename every agent id on every machine
+                // that already has one.
+                None,
+            );
+        }
+        // Configured extras are resolved against EVERY default profile database,
+        // so pointing one at a profile Hermes already exposes is rejected rather
+        // than collected twice under two ids.
+        for ep in extras("hermes", &hermes_dbs) {
+            sqlite_source(
+                &mut tasks,
+                "hermes",
+                hermes::FORMAT,
+                ep.path.clone(),
+                hermes::DEFAULT_AGENT_ID,
+                &spool,
+                cursors.join("hermes").join(&ep.label),
+                &env,
+                machine.as_deref(),
+                os_user.as_deref(),
+                redact,
+                Some(format!("hermes:{}", ep.label)),
+                Some(ep.label.clone()),
             );
         }
     }
@@ -917,6 +1085,7 @@ fn collector_tasks() -> Vec<fpai_collect::TaskSpec> {
                 sweep_dirs.clone(),
                 failed_dir.clone(),
                 sd,
+                flush_flag(),
             )
         }),
     ]);
@@ -939,13 +1108,24 @@ fn claude_projects_root() -> std::path::PathBuf {
     home.join(".claude").join("projects")
 }
 
-/// Register one file-tailing source.
+/// Register one file-tailing source: its default roots, plus one further
+/// instance per configured extra path.
+///
+/// Each extra path is a SEPARATE task rather than another entry in `roots`, and
+/// that is the whole design. `roots` is walked by one task with one cursor store
+/// and one `Params`, so a second root added there would be captured under the
+/// same agent id as the default — and two copies of one project derive the same
+/// id (from the `cwd` inside the transcript, identical in both copies). The
+/// label that separates them lives in `Params`, so a distinct label demands a
+/// distinct task, which then also needs its own cursor directory and its own
+/// health key for the reasons documented on each.
 #[allow(clippy::too_many_arguments)]
 fn file_source(
     tasks: &mut Vec<fpai_collect::TaskSpec>,
     name: &'static str,
     format: fpai_collect::filetail::Format,
     roots: Vec<std::path::PathBuf>,
+    extra: &[fpai_collect::ExtraPath],
     default_agent_id: &'static str,
     spool_dir: &std::path::Path,
     cursor_root: &std::path::Path,
@@ -953,16 +1133,77 @@ fn file_source(
     machine_id: Option<&str>,
     user: Option<&str>,
     redact: fpai_collect::Redact,
+) {
+    // The default instance: every root the source ships with, no label.
+    file_source_instance(
+        tasks,
+        name,
+        format,
+        roots,
+        None,
+        cursor_root.join(name),
+        None,
+        default_agent_id,
+        spool_dir,
+        environment,
+        machine_id,
+        user,
+        redact,
+    );
+
+    for ep in extra {
+        file_source_instance(
+            tasks,
+            name,
+            format,
+            vec![ep.path.clone()],
+            Some(ep.label.clone()),
+            // Its own cursor store. The store writes its whole map atomically,
+            // so sharing one with the default instance would have them clobber
+            // each other's watermarks and both re-read from zero after every
+            // restart.
+            cursor_root.join(name).join(&ep.label),
+            // ...and its own health key, or the instances overwrite each other's
+            // record and `root_present` alternates as they take turns.
+            Some(format!("{name}:{}", ep.label)),
+            default_agent_id,
+            spool_dir,
+            environment,
+            machine_id,
+            user,
+            redact,
+        );
+    }
+}
+
+/// One live instance of a file-tailing source.
+#[allow(clippy::too_many_arguments)]
+fn file_source_instance(
+    tasks: &mut Vec<fpai_collect::TaskSpec>,
+    name: &'static str,
+    format: fpai_collect::filetail::Format,
+    roots: Vec<std::path::PathBuf>,
+    label: Option<String>,
+    state_dir: std::path::PathBuf,
+    health_key: Option<String>,
+    default_agent_id: &'static str,
+    spool_dir: &std::path::Path,
+    environment: &str,
+    machine_id: Option<&str>,
+    user: Option<&str>,
+    redact: fpai_collect::Redact,
 ) {
     let spool_dir = spool_dir.to_path_buf();
-    // One cursor store per source, never shared: the store writes its whole map
-    // atomically, so two sources sharing a file would clobber each other and the
-    // loser would re-read from zero after every restart.
-    let state_dir = cursor_root.join(name);
     let environment = environment.to_string();
     let machine_id = machine_id.map(str::to_string);
     let user = user.map(str::to_string);
-    tasks.push(fpai_collect::TaskSpec::new(name, move |sd| {
+    // The task name carries the label so `/workflows`-style task listings and
+    // the supervisor's own logs name the instance, not just the source.
+    let task_name: String = match &label {
+        Some(l) => format!("{name}:{l}"),
+        None => name.to_string(),
+    };
+    tasks.push(fpai_collect::TaskSpec::new(task_name, move |sd| {
         fpai_collect::filetail::run(
             fpai_collect::filetail::Spec {
                 format,
@@ -970,11 +1211,13 @@ fn file_source(
                 spool_dir: spool_dir.clone(),
                 state_dir: state_dir.clone(),
                 poll_interval: std::time::Duration::from_secs(2),
+                health_key: health_key.clone(),
                 params: fpai_collect::filetail::Params {
                     agent_id: default_agent_id.to_string(),
                     environment: environment.clone(),
                     machine_id: machine_id.clone(),
                     user: user.clone(),
+                    label: label.clone(),
                     end_idle_mins: 10,
                     redact,
                     max_read_bytes: 32 * 1024 * 1024,
@@ -985,6 +1228,10 @@ fn file_source(
                     // widens this for its own rebuild — see BACKFILL_SINCE_DAYS,
                     // without which rewinding cursors delivers only 7 days no
                     // matter what was asked for.
+                    //
+                    // A newly added extra path needs no special case: it has no
+                    // cursor, so every file under it is a first discovery and is
+                    // read from the start of this same window.
                     since_days: file_source_since_days(),
                 },
             },
@@ -993,6 +1240,63 @@ fn file_source(
     }));
 }
 
+/// Register one SQLite-polling source: its default database, plus one further
+/// instance per configured extra path.
+///
+/// The file-tailing counterpart of this is `file_source`; both expand a harness
+/// into `1 + N` tasks for the same reason, and give each instance its own
+/// cursor directory and health key. Hermes does not use this wrapper because it
+/// already has several DEFAULT databases (one per profile) and so drives the
+/// per-instance registration itself.
+#[allow(clippy::too_many_arguments)]
+fn sqlite_harness(
+    tasks: &mut Vec<fpai_collect::TaskSpec>,
+    name: &'static str,
+    format: fpai_collect::sqlitepoll::SqliteFormat,
+    db_path: std::path::PathBuf,
+    extra: &[fpai_collect::ExtraPath],
+    default_agent_id: &'static str,
+    spool_dir: &std::path::Path,
+    cursor_root: &std::path::Path,
+    environment: &str,
+    machine_id: Option<&str>,
+    user: Option<&str>,
+    redact: fpai_collect::Redact,
+) {
+    sqlite_source(
+        tasks,
+        name,
+        format,
+        db_path,
+        default_agent_id,
+        spool_dir,
+        cursor_root.join(name),
+        environment,
+        machine_id,
+        user,
+        redact,
+        None,
+        None,
+    );
+    for ep in extra {
+        sqlite_source(
+            tasks,
+            name,
+            format,
+            ep.path.clone(),
+            default_agent_id,
+            spool_dir,
+            cursor_root.join(name).join(&ep.label),
+            environment,
+            machine_id,
+            user,
+            redact,
+            Some(format!("{name}:{}", ep.label)),
+            Some(ep.label.clone()),
+        );
+    }
+}
+
 /// Register one SQLite-polling source.
 #[allow(clippy::too_many_arguments)]
 fn sqlite_source(
@@ -1008,14 +1312,21 @@ fn sqlite_source(
     user: Option<&str>,
     redact: fpai_collect::Redact,
     // Distinct health key when one format has several live instances (Hermes,
-    // one database per profile). `None` reports under the format's own kind.
+    // one database per profile; and now any source with an extra path
+    // configured). `None` reports under the format's own kind.
     health_key: Option<String>,
+    // Agent-id namespace for an extra database. `None` for the default one.
+    label: Option<String>,
 ) {
     let spool_dir = spool_dir.to_path_buf();
     let environment = environment.to_string();
     let machine_id = machine_id.map(str::to_string);
     let user = user.map(str::to_string);
-    tasks.push(fpai_collect::TaskSpec::new(name, move |sd| {
+    let task_name: String = match &label {
+        Some(l) => format!("{name}:{l}"),
+        None => name.to_string(),
+    };
+    tasks.push(fpai_collect::TaskSpec::new(task_name, move |sd| {
         fpai_collect::sqlitepoll::run(
             fpai_collect::sqlitepoll::Spec {
                 format,
@@ -1028,6 +1339,7 @@ fn sqlite_source(
                     environment: environment.clone(),
                     machine_id: machine_id.clone(),
                     user: user.clone(),
+                    label: label.clone(),
                     redact,
                     max_rows_per_poll: 2000,
                     max_batch_bytes: fpai_collect::spool::DEFAULT_MAX_BATCH_BYTES,
diff --git a/crates/failproofaid/src/paths.rs b/crates/failproofaid/src/paths.rs
index c79bbafa..81767c6c 100644
--- a/crates/failproofaid/src/paths.rs
+++ b/crates/failproofaid/src/paths.rs
@@ -55,14 +55,14 @@ pub fn worker_socket_path() -> io::Result<PathBuf> {
     Ok(run_dir()?.join("worker.sock"))
 }
 
-/// `~/.failproofai/policies/cloud-policies` — where pulled generations land.
+/// `~/.failproofai/policies/cloud-policies` — where pulled deployments land.
 /// The override keeps tests and development runs away from a user's real
 /// policy directory.
 ///
 /// The directory name is `cloud-policies`, matching `fp-home.ts`'s
 /// `cloudPoliciesDir`, which is what the hook path actually reads. Layout 2
 /// renamed it from `cloud-managed` and this function kept writing the old
-/// name — so the daemon downloaded every generation, verified it, wrote it to
+/// name — so the daemon downloaded every deployment, verified it, wrote it to
 /// disk, and the CLI read an empty directory and enforced nothing. Both halves
 /// looked healthy; only the combination was broken.
 pub fn cloud_managed_policy_dir() -> io::Result<PathBuf> {
@@ -123,6 +123,15 @@ pub fn backfill_request_path() -> io::Result<PathBuf> {
         .join("backfill-request.json"))
 }
 
+/// Where `failproofai flush` leaves its request. Same hand-off shape as the
+/// backfill request: the CLI cannot deliver spooled batches itself (the
+/// uploader's concurrency limiter and in-flight set live in the running
+/// daemon, and a second uploader would POST the same files twice), so it
+/// writes a request the daemon drains on its next tick.
+pub fn flush_request_path() -> io::Result<PathBuf> {
+    Ok(failproofai_home()?.join("state").join("flush-request.json"))
+}
+
 pub fn audit_schedule_path() -> io::Result<PathBuf> {
     Ok(failproofai_home()?
         .join("state")
@@ -276,7 +285,7 @@ mod tests {
     fn pulled_policies_land_where_the_cli_reads_them() {
         // `fp-home.ts`: `cloudPoliciesDir = policies/cloud-policies`. This
         // wrote layout 1's `policies/cloud-managed`, so the daemon downloaded
-        // every generation, verified its hashes, wrote it to disk — and the CLI
+        // every deployment, verified its hashes, wrote it to disk — and the CLI
         // read an empty directory and enforced nothing. Both halves logged
         // success; only the combination was broken.
         let _guard = ENV_LOCK.lock().unwrap();
@@ -430,7 +439,7 @@ mod tests {
     /// were live bugs at once: `run_dir` read `$HOME` while the CLI honoured
     /// `FAILPROOFAI_HOME` (so a healthy daemon denied every tool call on a
     /// fail-closed machine), `cloud_managed_policy_dir` still wrote layout 1's
-    /// `cloud-managed` (so every verified generation landed in a directory
+    /// `cloud-managed` (so every verified deployment landed in a directory
     /// nothing opened), and the credential moved to `credentials.toml` on one
     /// side only (so `--connect` wrote a token the daemon never read). Each was
     /// fixed by hand; nothing stopped the next one, and BOTH files cited a test
diff --git a/crates/failproofaid/src/telemetry.rs b/crates/failproofaid/src/telemetry.rs
index c6316157..69e01711 100644
--- a/crates/failproofaid/src/telemetry.rs
+++ b/crates/failproofaid/src/telemetry.rs
@@ -148,7 +148,7 @@ static LANE: OnceLock<Arc<Lane>> = OnceLock::new();
 /// REPLACEABLE, not set-once. The collector is cycled whenever its configuration
 /// changes, and a `OnceLock` silently dropped every set after the first — so
 /// after a credential rotation this lane went on polling the counters of a
-/// collector that had already been joined, reporting a dead generation's totals
+/// collector that had already been joined, reporting a dead deployment's totals
 /// as if they were current. Nothing errored; the numbers simply stopped moving,
 /// which is indistinguishable from a healthy idle machine.
 static COLLECTOR_METRICS: RwLock<Option<Arc<fpai_collect::SupervisorMetrics>>> = RwLock::new(None);
@@ -812,7 +812,7 @@ impl Runner {
     fn poll_collector(&mut self) {
         // Cloned out of the lock rather than read through it: `poll_collector`
         // does real work below, and holding a read guard across it would block
-        // the manager thread mid-cycle when it swaps in a new generation.
+        // the manager thread mid-cycle when it swaps in a new deployment.
         let Some(metrics) = COLLECTOR_METRICS
             .read()
             .unwrap_or_else(|e| e.into_inner())
@@ -1411,8 +1411,8 @@ mod tests {
             "failures",
             "panics",
             "restarts",
-            "generation",
-            "generation_changed",
+            "deployment",
+            "deployment_changed",
             "downloaded",
             "repaired",
         ];
diff --git a/crates/failproofaid/tests/collector_reload_e2e.rs b/crates/failproofaid/tests/collector_reload_e2e.rs
index acdcc686..1f0fbec0 100644
--- a/crates/failproofaid/tests/collector_reload_e2e.rs
+++ b/crates/failproofaid/tests/collector_reload_e2e.rs
@@ -176,9 +176,9 @@ fn it_keeps_noticing_changes_rather_than_reloading_once() {
     // A one-shot reload would pass the test above and still strand the second
     // rotation, so the loop is asserted rather than the first iteration.
     //
-    // Each edit waits for the previous generation to be RUNNING, not merely for
+    // Each edit waits for the previous deployment to be RUNNING, not merely for
     // the cycle to be announced. "cycling the collector" is logged before
-    // `join_with_flush` drains the old generation, so an edit made on that log
+    // `join_with_flush` drains the old deployment, so an edit made on that log
     // line lands mid-cycle and is picked up by the same rebuild — the daemon
     // coalesces to the latest config, correctly, and no second cycle is ever
     // logged. Asserting the count without this sync tests the timing of the
@@ -202,7 +202,7 @@ fn it_keeps_noticing_changes_rather_than_reloading_once() {
 fn an_unchanged_config_does_not_cycle_anything() {
     // Re-reading the file every tick must not look like a change, or the
     // collector would be torn down and rebuilt twice a second — losing the
-    // in-flight batches of every generation.
+    // in-flight batches of every deployment.
     let home = unique_home("stable");
     make_home(&home, "a-stable-key");
     let daemon = spawn_daemon(&home);
@@ -271,3 +271,61 @@ fn disabling_collection_stops_it_and_re_enabling_starts_it_again() {
     daemon.wait_for("collector enabled", 2, Duration::from_secs(20));
     let _ = std::fs::remove_dir_all(&home);
 }
+
+/// An extra capture path added by hand is picked up without a restart.
+///
+/// `failproofai harness add-path` writes `[collector.sources.<harness>]
+/// extra_paths` and tells the user the daemon will notice on its own. That
+/// promise rests entirely on `sources` living inside the `CollectorConfig` the
+/// manager compares each tick — nothing registers the field explicitly, and
+/// moving it anywhere resolved later would break the promise silently: the CLI
+/// keeps reporting success, the config keeps parsing, and the running daemon
+/// simply never captures the path until it is restarted for some unrelated
+/// reason.
+///
+/// Asserted on the REAL binary against a hand-edited file, like the cases above
+/// and for the same reason — the property is "an edit somebody else made is
+/// noticed", and a fleet tool or a `sed` is a legitimate way to make it.
+///
+/// The task-count line is what proves the path was actually REGISTERED rather
+/// than merely triggering a cycle: `sessions = true` turns the session sources
+/// on, and each labelled path adds its own task on top (claude's extra path
+/// adds two — the main and subagent formats share a root).
+#[test]
+fn an_extra_capture_path_added_by_hand_is_registered_without_a_restart() {
+    let home = unique_home("extra-path");
+    make_home(&home, "a-key");
+    // Session capture on: extra paths are a session-source feature, and the
+    // default config `make_home` writes has it off.
+    let cfg = home.join("config.toml");
+    let base = std::fs::read_to_string(&cfg)
+        .unwrap()
+        .replace("sessions = false", "sessions = true");
+    std::fs::write(&cfg, &base).unwrap();
+
+    let daemon = spawn_daemon(&home);
+    daemon.wait_for("collector enabled", 1, Duration::from_secs(20));
+    daemon.wait_for("collector started", 1, Duration::from_secs(20));
+
+    let extra = home.join("extra-claude-projects");
+    std::fs::create_dir_all(&extra).unwrap();
+    std::fs::write(
+        &cfg,
+        format!(
+            "{base}\n[collector.sources.claude]\nextra_paths = [\"late={}\"]\n",
+            extra.display()
+        ),
+    )
+    .unwrap();
+
+    daemon.wait_for(
+        "collector configuration changed; cycling the collector",
+        1,
+        Duration::from_secs(20),
+    );
+    // The daemon names every extra path it accepts, so this is the line that
+    // says the entry was parsed and not rejected.
+    daemon.wait_for("also capturing", 1, Duration::from_secs(20));
+    daemon.wait_for("collector started", 2, Duration::from_secs(20));
+    let _ = std::fs::remove_dir_all(&home);
+}
diff --git a/crates/fpai-collect/src/config.rs b/crates/fpai-collect/src/config.rs
index 311ae113..b3f67b7e 100644
--- a/crates/fpai-collect/src/config.rs
+++ b/crates/fpai-collect/src/config.rs
@@ -23,6 +23,7 @@
 //! transcripts carry prompts, file contents and whatever the user pasted into
 //! a terminal — configuring a key must not silently start shipping those.
 
+use std::collections::BTreeMap;
 use std::fs;
 use std::io;
 use std::path::{Path, PathBuf};
@@ -150,6 +151,28 @@ pub struct Settings {
     /// this field existed; such events carry no machine.
     #[serde(default)]
     pub machine_id: Option<String>,
+    /// Per-source extra capture paths, keyed by source name (`claude`,
+    /// `hermes`, …) — `[collector.sources.<name>]` in `config.toml`.
+    ///
+    /// A map rather than a struct with 13 fields: the source list is data, not
+    /// schema, and a struct would mean a newly added source silently ignoring
+    /// its own config key until somebody remembered to add the field. An
+    /// unrecognised key here is caught by the caller, which knows the real
+    /// source list, and reported rather than dropped — a typo'd `[collector.
+    /// sources.claud]` that parsed cleanly and captured nothing is exactly the
+    /// silent failure this project exists to remove.
+    #[serde(default)]
+    pub sources: BTreeMap<String, SourceSettings>,
+}
+
+/// The `[collector.sources.<name>]` table.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize)]
+pub struct SourceSettings {
+    /// Extra locations to capture, each `label=path` or bare `path`. Resolved
+    /// by [`crate::extra_paths::resolve`]; see that module for the grammar and
+    /// for what each rejection prevents.
+    #[serde(default)]
+    pub extra_paths: Vec<String>,
 }
 
 fn default_true() -> bool {
@@ -169,7 +192,55 @@ impl Default for Settings {
             redact: Redact::default(),
             environment: default_environment(),
             machine_id: None,
+            sources: BTreeMap::new(),
+        }
+    }
+}
+
+impl Settings {
+    /// Raw `extra_paths` entries for one source, env override winning whole.
+    ///
+    /// `FAILPROOFAI_<SOURCE>_EXTRA_PATHS`, comma-separated — the same
+    /// env → file → default precedence as every other knob here, and the same
+    /// env name shape AgentEye's collector uses (`AGENTEYE_HERMES_EXTRA_PATHS`).
+    /// It REPLACES the file's list rather than appending to it: a container that
+    /// sets the variable is describing that container's whole layout, and
+    /// silently inheriting a host path from a mounted config would capture a
+    /// directory the operator never asked for.
+    ///
+    /// The source name is upper-cased with `-` mapped to `_`, so
+    /// `claude-subagent` reads `FAILPROOFAI_CLAUDE_SUBAGENT_EXTRA_PATHS`.
+    pub fn extra_paths_for(&self, source: &str) -> Vec<String> {
+        let var = format!(
+            "FAILPROOFAI_{}_EXTRA_PATHS",
+            source.to_ascii_uppercase().replace('-', "_")
+        );
+        if let Some(raw) = env_nonempty(&var) {
+            return raw
+                .split(',')
+                .map(str::trim)
+                .filter(|s| !s.is_empty())
+                .map(str::to_string)
+                .collect();
         }
+        self.sources
+            .get(source)
+            .map(|s| s.extra_paths.clone())
+            .unwrap_or_default()
+    }
+
+    /// Configured source names that are not in `known`.
+    ///
+    /// Returned rather than warned about here so the caller — which owns the
+    /// real source list — decides how loud to be. A typo'd table parses fine
+    /// and captures nothing, and nothing else in the pipeline would ever
+    /// mention it.
+    pub fn unknown_sources(&self, known: &[&str]) -> Vec<String> {
+        self.sources
+            .keys()
+            .filter(|k| !known.contains(&k.as_str()))
+            .cloned()
+            .collect()
     }
 }
 
@@ -492,3 +563,216 @@ fn tighten_home(home: &Path) {
 
 #[cfg(not(unix))]
 fn tighten_home(_home: &Path) {}
+
+#[cfg(test)]
+mod extra_path_settings_tests {
+    use super::*;
+
+    /// The exact bytes `writeConfig` in `src/hooks/fp-config.ts` produces after
+    /// two `failproofai harness add-path` runs, captured from a live CLI
+    /// invocation rather than hand-written.
+    ///
+    /// This is the seam with nothing holding it together: the TypeScript CLI
+    /// writes this file and the Rust daemon reads it, and neither is generated
+    /// from the other. Both halves parse cleanly on their own while disagreeing
+    /// — which is how `[collector]` came to be snake_case at all (it was
+    /// camelCase under `policies-config.json`, and carrying that over would have
+    /// meant every field silently falling back to its default).
+    ///
+    /// The sub-table placement is load-bearing and is the other reason this is
+    /// verbatim: TOML requires `[collector.sources.*]` AFTER every scalar of
+    /// `[collector]`, and a writer that emitted them earlier would produce a
+    /// file where `environment` and `redact` silently belong to a sub-table.
+    const WRITTEN_BY_THE_CLI: &str = r#"# failproofai configuration. Safe to edit by hand.
+# Credentials are NOT here — see credentials.toml (owner-only).
+
+[mode]
+kind = "oss"
+
+[daemon]
+configured = false
+
+[collector]
+# Session transcripts carry prompts, file contents and command output.
+sessions = true
+# Hook decisions: which policy fired and what it decided. No file contents.
+hooks = true
+hooks_verbosity = "decisions"
+redact = "minimal"
+environment = "local"
+machine_id = "m-123"
+
+[collector.sources.claude]
+# Extra locations to capture for this harness, beyond its default one.
+extra_paths = ["work=/srv/team/.claude/projects"]
+
+[collector.sources.hermes]
+extra_paths = ["/srv/hermes-prod/state.db", "b=/srv/other.db"]
+
+[audit]
+auto = false
+interval_days = 7
+"#;
+
+    fn home_with(text: &str) -> tempdir::Dir {
+        let d = tempdir::Dir::new();
+        fs::write(d.path().join(CONFIG_FILE), text).unwrap();
+        d
+    }
+
+    /// A minimal scratch directory; the crate has no dev-dep on `tempfile`.
+    mod tempdir {
+        use std::path::{Path, PathBuf};
+        pub struct Dir(PathBuf);
+        impl Dir {
+            pub fn new() -> Self {
+                let p = std::env::temp_dir().join(format!(
+                    "fpai-cfg-{}-{}",
+                    std::process::id(),
+                    std::time::SystemTime::now()
+                        .duration_since(std::time::UNIX_EPOCH)
+                        .unwrap()
+                        .as_nanos()
+                ));
+                std::fs::create_dir_all(&p).unwrap();
+                Dir(p)
+            }
+            pub fn path(&self) -> &Path {
+                &self.0
+            }
+        }
+        impl Drop for Dir {
+            fn drop(&mut self) {
+                let _ = std::fs::remove_dir_all(&self.0);
+            }
+        }
+    }
+
+    #[test]
+    fn reads_the_sources_tables_the_typescript_cli_writes() {
+        let d = home_with(WRITTEN_BY_THE_CLI);
+        let s = load_settings(d.path()).unwrap();
+
+        // The scalars after which the sub-tables appear must NOT have been
+        // swallowed into one.
+        assert!(s.sessions, "sessions was lost to a sub-table");
+        assert_eq!(s.environment, "local");
+        assert_eq!(s.machine_id.as_deref(), Some("m-123"));
+
+        assert_eq!(
+            s.extra_paths_for("claude"),
+            vec!["work=/srv/team/.claude/projects".to_string()]
+        );
+        assert_eq!(
+            s.extra_paths_for("hermes"),
+            vec![
+                "/srv/hermes-prod/state.db".to_string(),
+                "b=/srv/other.db".to_string()
+            ]
+        );
+        assert!(s.extra_paths_for("codex").is_empty());
+        assert!(s.unknown_sources(&["claude", "hermes"]).is_empty());
+    }
+
+    #[test]
+    fn a_config_with_no_sources_table_reads_as_none_configured() {
+        let d = home_with("[collector]\nsessions = true\n");
+        let s = load_settings(d.path()).unwrap();
+        assert!(s.sources.is_empty());
+        for h in ["claude", "hermes", "codex"] {
+            assert!(s.extra_paths_for(h).is_empty());
+        }
+    }
+
+    #[test]
+    fn an_unrecognised_source_table_is_reported_rather_than_ignored() {
+        let d = home_with("[collector]\n[collector.sources.claud]\nextra_paths = [\"/srv/x\"]\n");
+        let s = load_settings(d.path()).unwrap();
+        assert_eq!(s.unknown_sources(&["claude"]), vec!["claud".to_string()]);
+    }
+
+    /// The env override REPLACES the file's list. A container setting it is
+    /// describing that container's whole layout; inheriting a host path from a
+    /// mounted config would capture a directory nobody asked for.
+    #[test]
+    fn the_env_override_replaces_the_file_and_splits_on_commas() {
+        let d = home_with(WRITTEN_BY_THE_CLI);
+        let s = load_settings(d.path()).unwrap();
+        // SAFETY: single-threaded test; restored before returning.
+        unsafe {
+            std::env::set_var("FAILPROOFAI_CLAUDE_EXTRA_PATHS", " a=/one , b=/two ,, ");
+        }
+        assert_eq!(
+            s.extra_paths_for("claude"),
+            vec!["a=/one".to_string(), "b=/two".to_string()]
+        );
+        unsafe {
+            std::env::remove_var("FAILPROOFAI_CLAUDE_EXTRA_PATHS");
+        }
+        // ...and falls back to the file once it is gone.
+        assert_eq!(
+            s.extra_paths_for("claude"),
+            vec!["work=/srv/team/.claude/projects".to_string()]
+        );
+    }
+
+    /// Adding an extra path must change the resolved `CollectorConfig`.
+    ///
+    /// This is what makes `failproofai harness add-path` take effect on a
+    /// RUNNING daemon with no restart and no sudo. `spawn_collector_manager` in
+    /// failproofaid re-reads this config on an interval and cycles the collector
+    /// whenever the whole value differs from the one the live generation was
+    /// built from — it does not know or care which field moved.
+    ///
+    /// So the mechanism rests entirely on `sources` being INSIDE the compared
+    /// value. Move it out — to its own file, a lazily-read side table, anything
+    /// resolved after this struct — and nothing breaks loudly: the CLI keeps
+    /// reporting success, the config keeps parsing, and the running daemon
+    /// simply never picks the path up until it is restarted for some other
+    /// reason. Verified live at the time of writing: task count 21 -> 23 within
+    /// one poll interval, and the first transcript under the new path reached
+    /// the server.
+    #[test]
+    fn collector_config_change_cycles_the_collector() {
+        let d = home_with("[collector]\nsessions = true\n");
+        let before = load(d.path()).unwrap();
+
+        fs::write(
+            d.path().join(CONFIG_FILE),
+            "[collector]\nsessions = true\n\n[collector.sources.claude]\nextra_paths = [\"late=/srv/x\"]\n",
+        )
+        .unwrap();
+        let after = load(d.path()).unwrap();
+
+        assert_ne!(
+            before, after,
+            "adding an extra path did not change CollectorConfig, so a running \
+             daemon would never cycle and the path would be captured only after \
+             an unrelated restart"
+        );
+        assert_eq!(
+            after.settings.extra_paths_for("claude"),
+            vec!["late=/srv/x".to_string()]
+        );
+
+        // ...and removing it changes back, so `remove-path` also takes effect.
+        fs::write(d.path().join(CONFIG_FILE), "[collector]\nsessions = true\n").unwrap();
+        assert_eq!(load(d.path()).unwrap(), before);
+    }
+
+    /// A source whose name contains `-` must map to a legal env var name.
+    #[test]
+    fn a_hyphenated_source_name_maps_to_an_underscored_env_var() {
+        let s = Settings::default();
+        unsafe {
+            std::env::set_var("FAILPROOFAI_CLAUDE_SUBAGENT_EXTRA_PATHS", "/srv/sub");
+        }
+        assert_eq!(
+            s.extra_paths_for("claude-subagent"),
+            vec!["/srv/sub".to_string()]
+        );
+        unsafe {
+            std::env::remove_var("FAILPROOFAI_CLAUDE_SUBAGENT_EXTRA_PATHS");
+        }
+    }
+}
diff --git a/crates/fpai-collect/src/delivery.rs b/crates/fpai-collect/src/delivery.rs
index 0cbf040c..8027cb54 100644
--- a/crates/fpai-collect/src/delivery.rs
+++ b/crates/fpai-collect/src/delivery.rs
@@ -29,6 +29,7 @@
 
 use std::collections::HashSet;
 use std::path::{Path, PathBuf};
+use std::sync::atomic::Ordering;
 use std::sync::{Arc, Mutex};
 use std::time::{Duration, SystemTime};
 
@@ -48,6 +49,11 @@ const MAX_CONCURRENT_UPLOADS: usize = 8;
 
 /// How often the sweeper scans the spool directories.
 const SWEEP_INTERVAL: Duration = Duration::from_secs(60);
+
+/// How often the sweeper looks for a `failproofai flush` request while it is
+/// otherwise idle. Short enough that a flush feels immediate, long enough that
+/// an idle daemon is not spinning.
+const FLUSH_POLL_INTERVAL: Duration = Duration::from_secs(1);
 /// How old a batch must be before the sweeper claims it.
 ///
 /// Not politeness — it is what keeps the two paths from racing on a file the
@@ -219,6 +225,7 @@ pub async fn sweep(
     dirs: Vec<PathBuf>,
     failed_dir: PathBuf,
     sd: Shutdown,
+    flush_now: Arc<std::sync::atomic::AtomicBool>,
 ) -> Result<(), TaskError> {
     // Run one pass immediately. A cold start must not wait a full interval to
     // deliver what accumulated while the daemon was stopped, and a filesystem
@@ -241,8 +248,33 @@ pub async fn sweep(
             next_failed_pass = SystemTime::now() + FAILED_RETRY_INTERVAL;
         }
 
-        if !sd.sleep(SWEEP_INTERVAL).await {
-            return Ok(());
+        // Poll for a flush request rather than sleeping the whole interval in
+        // one go. `failproofai flush` exists because the guarantees that make
+        // the sweeper safe in steady state — only touch batches older than
+        // SWEEP_MIN_AGE, at most SWEEP_MAX_FILES per pass — are exactly wrong
+        // for someone standing at a dashboard waiting for their own events.
+        let deadline = SystemTime::now() + SWEEP_INTERVAL;
+        loop {
+            if flush_now.swap(false, Ordering::SeqCst) {
+                // A flush pass: no minimum age, no per-pass cap. This is the
+                // one caller that has explicitly asked to trade the backlog
+                // pacing for latency.
+                for dir in &dirs {
+                    for path in stale_batches(dir, Duration::ZERO, usize::MAX).await {
+                        if sd.is_set() {
+                            return Ok(());
+                        }
+                        delivery.deliver(path).await;
+                    }
+                }
+                break;
+            }
+            if SystemTime::now() >= deadline {
+                break;
+            }
+            if !sd.sleep(FLUSH_POLL_INTERVAL).await {
+                return Ok(());
+            }
         }
     }
 }
diff --git a/crates/fpai-collect/src/extra_paths.rs b/crates/fpai-collect/src/extra_paths.rs
new file mode 100644
index 00000000..04ba8046
--- /dev/null
+++ b/crates/fpai-collect/src/extra_paths.rs
@@ -0,0 +1,370 @@
+//! User-supplied extra capture paths, one set per source.
+//!
+//! Every source watches one default location — `~/.claude/projects`,
+//! `~/.hermes/state.db`, and so on. That is right for the machine the agent was
+//! installed on by its own installer, and wrong for every arrangement that puts
+//! a second copy somewhere else: a second profile, a bind-mounted team share, a
+//! container's home mapped in beside the host's, an agent relocated by an
+//! operator. Those paths hold real sessions and nothing collected them.
+//!
+//! # A labelled path, not just a path
+//!
+//! Each entry is `label=path` or bare `path`, and the label becomes an agent-id
+//! namespace — `<label>-<agentId>`. Without it two paths holding the same
+//! project produce the same derived agent id (`claude-myrepo` from the `cwd`
+//! inside the transcript, which is identical in both copies) and the product
+//! shows one agent whose sessions interleave from two machines' worth of
+//! history. The label is the only thing that keeps them apart, so it is part of
+//! the grammar rather than an option.
+//!
+//! This matches the shape AgentEye's collector already ships for its own two
+//! multi-path sources (`--openclaw-extra-path`, `--hermes-extra-path`): same
+//! `label=path` grammar, same folder-name fallback, same `<label>-<agentId>`
+//! namespacing. Diverging would have meant one product with two answers for
+//! what an extra path is.
+//!
+//! # What is rejected, and why each one is silent otherwise
+//!
+//! Validation is deliberately loud, because every failure here is invisible at
+//! runtime:
+//!
+//! * **A path that overlaps a default root** would be walked by two tasks with
+//!   two cursor stores. Both ship every line, under two different agent ids,
+//!   forever — and it looks like the feature working.
+//! * **Two entries with the same label** collapse into one cursor directory,
+//!   whose whole map is written atomically, so the two tasks clobber each
+//!   other's watermark and each re-reads from zero after every restart.
+//! * **An empty label** produces `-<agentId>`, which reads as a typo in the
+//!   product and groups nothing.
+
+use std::collections::BTreeSet;
+use std::path::{Path, PathBuf};
+
+/// One resolved extra path.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ExtraPath {
+    /// Agent-id namespace. Non-empty, `[a-z0-9-]`, unique within its source.
+    pub label: String,
+    /// Where to capture from. A directory for file-tailing sources, a database
+    /// file for SQLite ones — this module does not know or care which, and
+    /// deliberately does NOT require it to exist: an entry for a share that is
+    /// mounted later must survive a daemon start, exactly like the default
+    /// roots, which are also allowed to be absent.
+    pub path: PathBuf,
+}
+
+/// A rejected entry, kept rather than dropped so the caller can log it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Rejected {
+    pub entry: String,
+    pub reason: String,
+}
+
+/// Everything one source's `extra_paths` resolved to.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct Resolved {
+    pub accepted: Vec<ExtraPath>,
+    pub rejected: Vec<Rejected>,
+}
+
+/// Reduce a raw label to the alphabet agent ids use.
+///
+/// Mirrors the sanitising the transforms already apply to derived id parts, so
+/// a label cannot introduce a character the rest of the pipeline would have
+/// stripped anyway — which would make the configured label and the label in the
+/// product differ.
+fn sanitize_label(raw: &str) -> String {
+    let mut out = String::with_capacity(raw.len());
+    let mut last_dash = true; // leading dashes are trimmed by starting true
+    for ch in raw.chars() {
+        let c = ch.to_ascii_lowercase();
+        if c.is_ascii_alphanumeric() {
+            out.push(c);
+            last_dash = false;
+        } else if !last_dash {
+            out.push('-');
+            last_dash = true;
+        }
+    }
+    while out.ends_with('-') {
+        out.pop();
+    }
+    out
+}
+
+/// Label for an entry that did not name one: the final path component.
+///
+/// Leading dots are stripped first so `/srv/.hermes-1` derives `hermes-1`
+/// rather than `-hermes-1`. A path whose last component sanitises to nothing
+/// (`/`, `/...`) yields `None` and the entry is rejected — guessing a label for
+/// it would silently group unrelated captures together.
+fn derive_label(path: &Path) -> Option<String> {
+    let name = path.file_name()?.to_str()?;
+    let label = sanitize_label(name.trim_start_matches('.'));
+    (!label.is_empty()).then_some(label)
+}
+
+/// Split one entry into its label and path halves.
+///
+/// Splits on the FIRST `=`, so a path containing `=` still works when a label
+/// is given. A bare path containing `=` is ambiguous and resolves as
+/// `label=path`; that is the documented grammar and the reason `list` prints
+/// the resolved pair back.
+fn split_entry(entry: &str) -> (Option<&str>, &str) {
+    match entry.split_once('=') {
+        Some((label, path)) if !label.trim().is_empty() => (Some(label.trim()), path.trim()),
+        _ => (None, entry.trim()),
+    }
+}
+
+/// True when `a` and `b` are the same path or one contains the other.
+///
+/// Both are compared after `clean`, which is lexical — no symlink resolution
+/// and no `canonicalize`, because a path is allowed to be absent and
+/// `canonicalize` fails on those. So a symlinked duplicate is NOT caught here;
+/// it is caught at runtime by the cursor store, which keys on `(dev, inode)`.
+fn overlaps(a: &Path, b: &Path) -> bool {
+    a.starts_with(b) || b.starts_with(a)
+}
+
+/// Expand `~` and drop a trailing separator so comparisons are stable.
+fn clean(raw: &str, home: Option<&Path>) -> PathBuf {
+    let expanded = match (raw.strip_prefix("~/"), home) {
+        (Some(rest), Some(home)) => home.join(rest),
+        _ if raw == "~" => home
+            .map(Path::to_path_buf)
+            .unwrap_or_else(|| PathBuf::from(raw)),
+        _ => PathBuf::from(raw),
+    };
+    // `PathBuf::from("/a/b/")` keeps the trailing slash in its OsString, which
+    // `starts_with` handles but `==` does not.
+    PathBuf::from(expanded.to_string_lossy().trim_end_matches('/').to_string())
+}
+
+/// Resolve one source's configured entries against its default roots.
+///
+/// `defaults` are the roots the source already watches. An entry overlapping
+/// any of them is rejected rather than silently double-collected.
+pub fn resolve(entries: &[String], defaults: &[PathBuf], home: Option<&Path>) -> Resolved {
+    let mut out = Resolved::default();
+    let mut seen_labels: BTreeSet<String> = BTreeSet::new();
+    let mut seen_paths: Vec<PathBuf> = Vec::new();
+
+    let defaults: Vec<PathBuf> = defaults
+        .iter()
+        .map(|d| clean(&d.to_string_lossy(), home))
+        .collect();
+
+    for entry in entries {
+        let raw = entry.trim();
+        if raw.is_empty() {
+            continue;
+        }
+        let (label_raw, path_raw) = split_entry(raw);
+        if path_raw.is_empty() {
+            out.rejected.push(Rejected {
+                entry: raw.to_string(),
+                reason: "no path".into(),
+            });
+            continue;
+        }
+        let path = clean(path_raw, home);
+
+        let label = match label_raw {
+            Some(l) => {
+                let s = sanitize_label(l);
+                if s.is_empty() {
+                    out.rejected.push(Rejected {
+                        entry: raw.to_string(),
+                        reason: format!("label {l:?} contains no usable characters"),
+                    });
+                    continue;
+                }
+                s
+            }
+            None => match derive_label(&path) {
+                Some(l) => l,
+                None => {
+                    out.rejected.push(Rejected {
+                        entry: raw.to_string(),
+                        reason: "no label given and none could be derived from the path".into(),
+                    });
+                    continue;
+                }
+            },
+        };
+
+        if let Some(clash) = defaults.iter().find(|d| overlaps(&path, d)) {
+            out.rejected.push(Rejected {
+                entry: raw.to_string(),
+                reason: format!(
+                    "overlaps the default root {}; it is already captured, and capturing it \
+                     twice ships every session under two agent ids",
+                    clash.display()
+                ),
+            });
+            continue;
+        }
+
+        if !seen_labels.insert(label.clone()) {
+            out.rejected.push(Rejected {
+                entry: raw.to_string(),
+                reason: format!(
+                    "label {label:?} is already used by another extra path for this source"
+                ),
+            });
+            continue;
+        }
+
+        if let Some(clash) = seen_paths.iter().find(|p| overlaps(&path, p)) {
+            out.rejected.push(Rejected {
+                entry: raw.to_string(),
+                reason: format!("overlaps another extra path, {}", clash.display()),
+            });
+            continue;
+        }
+
+        seen_paths.push(path.clone());
+        out.accepted.push(ExtraPath { label, path });
+    }
+
+    out
+}
+
+/// Prefix an agent id with a label. The one place the `<label>-<agentId>`
+/// convention is spelled out.
+pub fn namespaced(label: &str, agent_id: &str) -> String {
+    format!("{label}-{agent_id}")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn e(items: &[&str]) -> Vec<String> {
+        items.iter().map(|s| s.to_string()).collect()
+    }
+
+    #[test]
+    fn bare_path_derives_its_label_from_the_final_component() {
+        let r = resolve(&e(["/srv/claude-work"].as_slice()), &[], None);
+        assert!(r.rejected.is_empty(), "{:?}", r.rejected);
+        assert_eq!(r.accepted[0].label, "claude-work");
+        assert_eq!(r.accepted[0].path, PathBuf::from("/srv/claude-work"));
+    }
+
+    #[test]
+    fn leading_dots_are_stripped_before_deriving() {
+        let r = resolve(&e(["/srv/.hermes-1"].as_slice()), &[], None);
+        assert_eq!(r.accepted[0].label, "hermes-1");
+    }
+
+    #[test]
+    fn explicit_label_wins_and_is_sanitized() {
+        let r = resolve(&e(["Team Share=/mnt/x"].as_slice()), &[], None);
+        assert_eq!(r.accepted[0].label, "team-share");
+        assert_eq!(r.accepted[0].path, PathBuf::from("/mnt/x"));
+    }
+
+    #[test]
+    fn a_path_containing_equals_still_works_with_an_explicit_label() {
+        let r = resolve(&e(["a=/mnt/k=v/x"].as_slice()), &[], None);
+        assert_eq!(r.accepted[0].path, PathBuf::from("/mnt/k=v/x"));
+    }
+
+    #[test]
+    fn tilde_expands_against_the_supplied_home() {
+        let home = PathBuf::from("/home/u");
+        let r = resolve(&e(["x=~/alt/projects"].as_slice()), &[], Some(&home));
+        assert_eq!(r.accepted[0].path, PathBuf::from("/home/u/alt/projects"));
+    }
+
+    #[test]
+    fn trailing_slash_does_not_defeat_the_overlap_check() {
+        let defaults = vec![PathBuf::from("/home/u/.claude/projects")];
+        let r = resolve(
+            &e(["a=/home/u/.claude/projects/"].as_slice()),
+            &defaults,
+            None,
+        );
+        assert!(r.accepted.is_empty());
+        assert!(r.rejected[0].reason.contains("overlaps the default root"));
+    }
+
+    /// The bug this exists to prevent: a path inside a default root is walked
+    /// by both tasks, so every line ships twice under two agent ids.
+    #[test]
+    fn a_path_nested_under_a_default_root_is_rejected() {
+        let defaults = vec![PathBuf::from("/home/u/.claude/projects")];
+        let r = resolve(
+            &e(["a=/home/u/.claude/projects/sub"].as_slice()),
+            &defaults,
+            None,
+        );
+        assert!(r.accepted.is_empty());
+        assert!(r.rejected[0].reason.contains("overlaps the default root"));
+    }
+
+    /// ...and the reverse: a default root nested under the extra path.
+    #[test]
+    fn a_path_containing_a_default_root_is_rejected() {
+        let defaults = vec![PathBuf::from("/home/u/.claude/projects")];
+        let r = resolve(&e(["a=/home/u/.claude"].as_slice()), &defaults, None);
+        assert!(r.accepted.is_empty());
+        assert!(r.rejected[0].reason.contains("overlaps the default root"));
+    }
+
+    #[test]
+    fn duplicate_labels_are_rejected_not_merged() {
+        let r = resolve(&e(["a=/srv/one", "a=/srv/two"].as_slice()), &[], None);
+        assert_eq!(r.accepted.len(), 1);
+        assert_eq!(r.accepted[0].path, PathBuf::from("/srv/one"));
+        assert!(r.rejected[0].reason.contains("already used"));
+    }
+
+    #[test]
+    fn two_extra_paths_that_overlap_each_other_are_rejected() {
+        let r = resolve(&e(["a=/srv/one", "b=/srv/one/two"].as_slice()), &[], None);
+        assert_eq!(r.accepted.len(), 1);
+        assert!(r.rejected[0].reason.contains("overlaps another extra path"));
+    }
+
+    #[test]
+    fn an_unusable_label_is_rejected_rather_than_emptied() {
+        let r = resolve(&e(["===/srv/x", "!!!=/srv/y"].as_slice()), &[], None);
+        // `===/srv/x` splits into label "" (falsy) -> bare path "==/srv/x".
+        // `!!!=/srv/y` has a label that sanitizes away.
+        assert!(
+            r.rejected
+                .iter()
+                .any(|x| x.reason.contains("no usable characters"))
+        );
+    }
+
+    #[test]
+    fn a_path_with_no_derivable_label_is_rejected() {
+        let r = resolve(&e(["/"].as_slice()), &[], None);
+        assert!(r.accepted.is_empty());
+        assert!(r.rejected[0].reason.contains("none could be derived"));
+    }
+
+    #[test]
+    fn blank_entries_are_skipped_silently() {
+        let r = resolve(&e(["", "   "].as_slice()), &[], None);
+        assert!(r.accepted.is_empty());
+        assert!(r.rejected.is_empty());
+    }
+
+    #[test]
+    fn a_missing_path_is_still_accepted() {
+        // Deliberate: a share mounted after the daemon starts must not be
+        // dropped at config-resolution time.
+        let r = resolve(&e(["a=/definitely/not/here"].as_slice()), &[], None);
+        assert_eq!(r.accepted.len(), 1);
+    }
+
+    #[test]
+    fn namespacing_is_label_dash_agent() {
+        assert_eq!(namespaced("work", "claude-myrepo"), "work-claude-myrepo");
+    }
+}
diff --git a/crates/fpai-collect/src/filetail.rs b/crates/fpai-collect/src/filetail.rs
index 2276c5e9..cf82fcbe 100644
--- a/crates/fpai-collect/src/filetail.rs
+++ b/crates/fpai-collect/src/filetail.rs
@@ -158,6 +158,13 @@ pub struct Params {
     /// Skip files older than this many days on first discovery. `None` reads
     /// everything, which on a normal machine is gigabytes of history.
     pub since_days: Option<u64>,
+    /// Agent-id namespace when this instance watches an EXTRA path rather than
+    /// the source's default root. `None` for the default instance.
+    ///
+    /// Threaded to `SpoolWriter::with_label`; see the field there for why the
+    /// prefix is applied at that choke point rather than where this engine
+    /// resolves the id.
+    pub label: Option<String>,
 }
 
 pub struct Spec {
@@ -167,10 +174,24 @@ pub struct Spec {
     pub state_dir: PathBuf,
     pub poll_interval: std::time::Duration,
     pub params: Params,
+    /// Key this instance reports health under. `None` uses `format.kind`.
+    ///
+    /// The same field `sqlitepoll::Spec` carries, added for the same reason and
+    /// with the same failure behind it: one format can now have several live
+    /// instances (a default root plus one per extra path), and every one of them
+    /// reporting under the bare kind makes `collector-health.json` alternate
+    /// `root_present` true/false as they overwrite each other — destroying the
+    /// "absent root versus idle source" distinction the record exists to draw.
+    /// Hermes hit exactly this with its per-profile databases.
+    pub health_key: Option<String>,
 }
 
 /// Tail every discovered file until shutdown.
 pub async fn run(spec: Spec, sd: Shutdown) -> Result<(), TaskError> {
+    let health_key = spec
+        .health_key
+        .clone()
+        .unwrap_or_else(|| spec.format.kind.to_string());
     let mut cursors = CursorStore::load(spec.state_dir.clone());
 
     // Log which roots actually exist. Without this an absent root is
@@ -194,7 +215,7 @@ pub async fn run(spec: Spec, sd: Shutdown) -> Result<(), TaskError> {
         match poll_once(&spec, &mut cursors).await {
             Ok(outcome) => {
                 crate::health::report_poll(
-                    spec.format.kind,
+                    &health_key,
                     spec.roots.iter().any(|r| r.exists()),
                     outcome.events,
                     cursors.len() as u64,
@@ -203,7 +224,7 @@ pub async fn run(spec: Spec, sd: Shutdown) -> Result<(), TaskError> {
                 // every file failed must not read as a clean one.
                 if let Some(err) = outcome.first_error {
                     crate::health::report_error(
-                        spec.format.kind,
+                        &health_key,
                         &format!(
                             "{} file(s) could not be processed; first: {err}",
                             outcome.failed
@@ -213,7 +234,7 @@ pub async fn run(spec: Spec, sd: Shutdown) -> Result<(), TaskError> {
             }
             Err(err) => {
                 tracing::warn!(source = spec.format.kind, %err, "poll failed; retrying next tick");
-                crate::health::report_error(spec.format.kind, &err.to_string());
+                crate::health::report_error(&health_key, &err.to_string());
             }
         }
         if !sd.sleep(spec.poll_interval).await {
@@ -366,6 +387,7 @@ async fn process_file(
         spec.format.kind,
         &ctx.session_id,
     )
+    .with_label(spec.params.label.clone())
     .with_machine_id(spec.params.machine_id.clone())
     .with_user(spec.params.user.clone())
     .with_redact(spec.params.redact);
diff --git a/crates/fpai-collect/src/health.rs b/crates/fpai-collect/src/health.rs
index 1b45bc9d..28129933 100644
--- a/crates/fpai-collect/src/health.rs
+++ b/crates/fpai-collect/src/health.rs
@@ -153,11 +153,11 @@ impl Health {
 /// `COLLECTOR_METRICS`, for the same reason and with the same consequence.
 ///
 /// This was a `OnceLock`, so only the FIRST `install()` in a process took
-/// effect. That was true for exactly one generation of the collector: it is now
+/// effect. That was true for exactly one deployment of the collector: it is now
 /// cycled whenever its configuration changes (a rotated credential, a stream
 /// switched off) and rebuilt by `failproofai backfill`, and `collector_tasks()`
 /// installs a fresh `Health` each time. Every later install was silently
-/// dropped, so sources reported into the ORPHANED first-generation registry
+/// dropped, so sources reported into the ORPHANED first-deployment registry
 /// while the live `writer_task` published the one nobody was writing to.
 /// `collector-health.json` kept being rewritten every 30s with frozen numbers,
 /// and a source that had gone completely dark read exactly like a healthy one —
@@ -167,7 +167,7 @@ static GLOBAL: std::sync::RwLock<Option<std::sync::Arc<Health>>> = std::sync::Rw
 /// Install the process health registry, replacing any previous one.
 ///
 /// The caller installs before starting any source, so no poll ever reports into
-/// a registry that does not exist yet, and the generation being replaced is one
+/// a registry that does not exist yet, and the deployment being replaced is one
 /// whose tasks have already been joined.
 pub fn install(health: std::sync::Arc<Health>) {
     // A poisoned lock is not a reason to stop recording health: recover the
@@ -388,7 +388,7 @@ mod tests {
     /// `GLOBAL` was a `OnceLock`, so the second `install()` — which happens on
     /// every credential rotation, every `[collector]` config change and every
     /// `failproofai backfill` — was silently dropped. Sources then reported
-    /// through the free functions into the first generation, which had already
+    /// through the free functions into the first deployment, which had already
     /// been joined, while the live `writer_task` published the second one.
     /// `collector-health.json` froze, and a dead source became
     /// indistinguishable from an idle one.
@@ -415,17 +415,17 @@ mod tests {
         assert_eq!(entry.events, 7);
         assert_eq!(entry.errors, 1);
 
-        // And the replaced generation must go quiet rather than keep absorbing
+        // And the replaced deployment must go quiet rather than keep absorbing
         // them — that silent absorption is what made the file freeze.
         let gen1 = first.snapshot();
         assert!(
             !gen1.sources.contains_key("cycle-test-gen2"),
-            "reports leaked into the orphaned generation: {:?}",
+            "reports leaked into the orphaned deployment: {:?}",
             gen1.sources.keys().collect::<Vec<_>>()
         );
         assert!(
             gen1.sources.contains_key("cycle-test-gen1"),
-            "the first generation should still hold what it recorded while it was live"
+            "the first deployment should still hold what it recorded while it was live"
         );
     }
 
diff --git a/crates/fpai-collect/src/lib.rs b/crates/fpai-collect/src/lib.rs
index 47347016..019cdd94 100644
--- a/crates/fpai-collect/src/lib.rs
+++ b/crates/fpai-collect/src/lib.rs
@@ -14,6 +14,7 @@
 pub mod config;
 pub mod cursor;
 pub mod delivery;
+pub mod extra_paths;
 pub mod filetail;
 pub mod health;
 pub mod redact;
@@ -23,8 +24,11 @@ pub mod sqlitepoll;
 pub mod supervisor;
 pub mod uploader;
 
-pub use config::{CollectorConfig, DEFAULT_INGEST_URL, HooksVerbosity, Ingest, Redact, Settings};
+pub use config::{
+    CollectorConfig, DEFAULT_INGEST_URL, HooksVerbosity, Ingest, Redact, Settings, SourceSettings,
+};
 pub use delivery::Delivery;
+pub use extra_paths::{ExtraPath, Resolved as ResolvedExtraPaths};
 pub use health::{Health, HealthFile, SourceHealth, health_path};
 pub use spool::SpoolWriter;
 pub use supervisor::{
diff --git a/crates/fpai-collect/src/sources/hooks/transform.rs b/crates/fpai-collect/src/sources/hooks/transform.rs
index 03fceb1c..de4566d3 100644
--- a/crates/fpai-collect/src/sources/hooks/transform.rs
+++ b/crates/fpai-collect/src/sources/hooks/transform.rs
@@ -70,14 +70,14 @@ pub struct HookRow {
     pub policy_source: Option<String>,
     #[serde(rename = "cloudPolicyId")]
     pub cloud_policy_id: Option<String>,
-    #[serde(rename = "cloudRevision")]
-    pub cloud_revision: Option<i64>,
+    #[serde(rename = "cloudVersion")]
+    pub cloud_version: Option<i64>,
     /// Present on EVERY row of a managed machine, not just cloud-decided ones:
     /// "what was deployed here" is a different question from "what decided",
     /// and only the former separates a rollout that changed no outcomes from
     /// one that never reached the machine.
-    #[serde(rename = "cloudGeneration")]
-    pub cloud_generation: Option<i64>,
+    #[serde(rename = "cloudDeployment")]
+    pub cloud_deployment: Option<i64>,
 
     // ---- Suspension ------------------------------------------------------
     /// Set while `failproofai config --pause` is in effect. An `allow` on such
@@ -103,8 +103,8 @@ pub struct HookRow {
 pub struct Attribution {
     pub policy_source: Option<String>,
     pub cloud_policy_id: Option<String>,
-    pub cloud_revision: Option<i64>,
-    pub cloud_generation: Option<i64>,
+    pub cloud_version: Option<i64>,
+    pub cloud_deployment: Option<i64>,
     pub paused: bool,
 }
 
@@ -113,8 +113,8 @@ impl Attribution {
         Self {
             policy_source: row.policy_source.clone(),
             cloud_policy_id: row.cloud_policy_id.clone(),
-            cloud_revision: row.cloud_revision,
-            cloud_generation: row.cloud_generation,
+            cloud_version: row.cloud_version,
+            cloud_deployment: row.cloud_deployment,
             paused: row.paused_by.is_some(),
         }
     }
@@ -131,11 +131,11 @@ impl Attribution {
         if let Some(id) = &self.cloud_policy_id {
             m.insert("cloud_policy_id".into(), json!(id));
         }
-        if let Some(r) = self.cloud_revision {
-            m.insert("cloud_revision".into(), json!(r));
+        if let Some(r) = self.cloud_version {
+            m.insert("cloud_version".into(), json!(r));
         }
-        if let Some(g) = self.cloud_generation {
-            m.insert("cloud_generation".into(), json!(g));
+        if let Some(g) = self.cloud_deployment {
+            m.insert("cloud_deployment".into(), json!(g));
         }
         // Always emitted, never conditionally: an absent key and `false` must
         // not be distinguishable to a reader counting unenforced calls.
@@ -320,7 +320,7 @@ pub fn to_events(row: &HookRow, offset: u64, environment: &str) -> Vec<Value> {
     }
     if row.has_observation() {
         // Carried whole rather than flattened: a row can observe several
-        // policies at once, and the id/revision/decision only mean anything
+        // policies at once, and the id/version/decision only mean anything
         // together.
         end.insert(
             "failproofai_observed".into(),
@@ -427,8 +427,8 @@ impl AllowBucket {
         // dedups on `hook_id`, so the split was undone downstream and the two
         // rows collapsed back into one. That happened in exactly the two cases
         // the split was built for: the minute a pause starts, and the minute a
-        // cloud generation flips during a rollout, which is the measurement
-        // `cloud_generation` exists to enable.
+        // cloud deployment flips during a rollout, which is the measurement
+        // `cloud_deployment` exists to enable.
         let a = &self.attribution;
         m.insert(
             "hook_id".into(),
@@ -440,10 +440,10 @@ impl AllowBucket {
                 self.tool_name.as_deref().unwrap_or("-"),
                 a.policy_source.as_deref().unwrap_or("-"),
                 a.cloud_policy_id.as_deref().unwrap_or("-"),
-                a.cloud_revision
+                a.cloud_version
                     .map(|v| v.to_string())
                     .unwrap_or_else(|| "-".into()),
-                a.cloud_generation
+                a.cloud_deployment
                     .map(|v| v.to_string())
                     .unwrap_or_else(|| "-".into()),
                 if a.paused { "paused" } else { "-" },
diff --git a/crates/fpai-collect/src/spool.rs b/crates/fpai-collect/src/spool.rs
index 4a854d61..562774ac 100644
--- a/crates/fpai-collect/src/spool.rs
+++ b/crates/fpai-collect/src/spool.rs
@@ -70,6 +70,18 @@ pub struct SpoolWriter {
     /// same name on two machines never merges. `None` when it could not be
     /// resolved; such events simply carry no user.
     user: Option<String>,
+    /// Agent-id namespace for an extra capture path. `None` for a source
+    /// watching its default location, which is the overwhelming majority.
+    ///
+    /// Applied HERE rather than in each engine because the two engines resolve
+    /// agent ids in different places — `filetail` per discovered file, from the
+    /// path and header; `sqlitepoll` by handing `params.agent_id` to the
+    /// format, which may derive its own from a row (Hermes does). Prefixing
+    /// either one alone would namespace some events and not others from the
+    /// same path, which reads as two unrelated agents. This is the one point
+    /// every event from every source passes through, which is why `machine_id`
+    /// and `user` are stamped here too.
+    label: Option<String>,
 }
 
 impl SpoolWriter {
@@ -100,6 +112,7 @@ impl SpoolWriter {
             redacted: 0,
             machine_id: None,
             user: None,
+            label: None,
         }
     }
 
@@ -126,6 +139,16 @@ impl SpoolWriter {
         self
     }
 
+    /// Namespace every event's `agent_id` as `<label>-<agentId>`.
+    ///
+    /// An empty string is treated as absent, like the machine id and user
+    /// above: a blank label would produce `-claude-myrepo`, which groups
+    /// nothing and reads as a typo in the product.
+    pub fn with_label(mut self, label: Option<String>) -> Self {
+        self.label = label.filter(|s| !s.is_empty());
+        self
+    }
+
     /// How many string leaves have been scrubbed. Reported without ever
     /// logging what was removed.
     pub fn redacted_count(&self) -> u64 {
@@ -169,6 +192,26 @@ impl SpoolWriter {
                 .or_insert_with(|| Value::String(user.clone()));
         }
 
+        // Namespace the agent id for an extra capture path, at the same choke
+        // point and for the same reason. Unlike `machine_id` and `user` this
+        // REWRITES rather than filling a gap: the id is already present, set by
+        // the format from the path or the row, and two copies of one project in
+        // two locations derive the SAME id — which is precisely what the label
+        // exists to separate.
+        //
+        // Idempotent by construction is not available here (a project legitimately
+        // named `work-claude` would be indistinguishable from an already-prefixed
+        // id), so this must run exactly once per event. It does: every event
+        // reaches `push` once, and a re-shipped batch is re-read from the spool
+        // file rather than pushed again.
+        if let Some(label) = &self.label
+            && let Some(obj) = event.as_object_mut()
+            && let Some(id) = obj.get("agent_id").and_then(|v| v.as_str())
+        {
+            let namespaced = crate::extra_paths::namespaced(label, id);
+            obj.insert("agent_id".into(), Value::String(namespaced));
+        }
+
         let mut line = serialize(&event)?;
 
         if line.len() as u64 > self.max_batch_bytes {
diff --git a/crates/fpai-collect/src/sqlitepoll.rs b/crates/fpai-collect/src/sqlitepoll.rs
index cdff3fcb..782edc83 100644
--- a/crates/fpai-collect/src/sqlitepoll.rs
+++ b/crates/fpai-collect/src/sqlitepoll.rs
@@ -126,6 +126,14 @@ pub struct Params {
     /// Poll passes before yielding to the shutdown check. Bounds how long a
     /// backlog drain can ignore a stop request.
     pub max_drain_passes: u32,
+    /// Agent-id namespace when this instance polls an EXTRA database rather
+    /// than the source's default one. `None` for the default instance.
+    ///
+    /// Threaded to `SpoolWriter::with_label`. It must be applied there and not
+    /// by rewriting `agent_id` above, because a format's `poll` may derive its
+    /// own per-row ids from that value (Hermes does, via `SessionMeta`) — so a
+    /// prefix here would reach the fallback and miss every derived one.
+    pub label: Option<String>,
 }
 
 pub struct Spec {
@@ -238,12 +246,22 @@ async fn poll_once(spec: &Spec, cursors: &mut CursorStore) -> Result<(u64, bool)
         return Ok((0, outcome.more));
     }
 
+    // The tag carries the label so batches from a source's several instances
+    // are told apart in the shared spool directory, which is what the tag is
+    // for. Two instances would otherwise write `hermes-hermes-*` alike and only
+    // `run_id` would separate them — enough for correctness, useless for anyone
+    // reading the directory.
+    let tag = match &spec.params.label {
+        Some(label) => format!("{}-{label}", spec.format.kind),
+        None => spec.format.kind.to_string(),
+    };
     let mut writer = SpoolWriter::new(
         spec.spool_dir.clone(),
         spec.params.max_batch_bytes,
         spec.format.kind,
-        spec.format.kind,
+        &tag,
     )
+    .with_label(spec.params.label.clone())
     .with_machine_id(spec.params.machine_id.clone())
     .with_user(spec.params.user.clone())
     .with_redact(spec.params.redact);
diff --git a/crates/fpai-collect/src/supervisor.rs b/crates/fpai-collect/src/supervisor.rs
index c099ce4e..20314868 100644
--- a/crates/fpai-collect/src/supervisor.rs
+++ b/crates/fpai-collect/src/supervisor.rs
@@ -155,18 +155,24 @@ impl From<&str> for TaskError {
 /// future that already failed cannot be polled again, and reusing one would
 /// silently make "restart" mean "give up".
 pub struct TaskSpec {
-    pub name: &'static str,
+    /// Owned rather than `&'static str` because one source can now have several
+    /// live instances — a default root plus one task per configured extra path —
+    /// and their names are built at runtime (`claude:work`). Only ever used for
+    /// logging, never as a key, so duplicates would not have been a correctness
+    /// bug; they would just have made two instances indistinguishable in the
+    /// journal, which is where a multi-path problem is diagnosed.
+    pub name: String,
     factory: TaskFactory,
 }
 
 impl TaskSpec {
-    pub fn new<F, Fut>(name: &'static str, factory: F) -> Self
+    pub fn new<F, Fut>(name: impl Into<String>, factory: F) -> Self
     where
         F: Fn(Shutdown) -> Fut + Send + Sync + 'static,
         Fut: Future<Output = Result<(), TaskError>> + Send + 'static,
     {
         TaskSpec {
-            name,
+            name: name.into(),
             factory: Box::new(move |sd| Box::pin(factory(sd))),
         }
     }
@@ -348,13 +354,13 @@ async fn supervise_one(
             Ok(Ok(())) => {
                 // Finished its work. Not a failure, so no backoff — but also
                 // nothing to restart, so stop supervising it.
-                tracing::debug!(task = spec.name, "collector task completed");
+                tracing::debug!(task = %spec.name, "collector task completed");
                 return;
             }
             Ok(Err(err)) => {
                 metrics.failures.fetch_add(1, Ordering::Relaxed);
                 tracing::warn!(
-                    task = spec.name,
+                    task = %spec.name,
                     %err,
                     retry_in_ms = backoff.as_millis() as u64,
                     "collector task failed; restarting"
@@ -365,7 +371,7 @@ async fn supervise_one(
                 // Logged at error, not warn: an Err is usually the
                 // environment, a panic is always a bug worth chasing.
                 tracing::error!(
-                    task = spec.name,
+                    task = %spec.name,
                     panic = %panic_msg,
                     retry_in_ms = backoff.as_millis() as u64,
                     "collector task PANICKED; contained and restarting. Enforcement is unaffected"
diff --git a/crates/fpai-collect/tests/antigravity_source.rs b/crates/fpai-collect/tests/antigravity_source.rs
index bf0c9bc3..5defe58c 100644
--- a/crates/fpai-collect/tests/antigravity_source.rs
+++ b/crates/fpai-collect/tests/antigravity_source.rs
@@ -296,6 +296,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
         spool_dir: spool,
         state_dir: state,
         poll_interval: Duration::from_millis(200),
+        health_key: None,
         params: Params {
             redact: fpai_collect::Redact::Minimal,
             agent_id: antigravity::DEFAULT_AGENT_ID.into(),
@@ -306,6 +307,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
             max_read_bytes: 8 * 1024 * 1024,
             max_batch_bytes: 8 * 1024 * 1024,
             since_days: None,
+            label: None,
         },
     }
 }
diff --git a/crates/fpai-collect/tests/claude_source.rs b/crates/fpai-collect/tests/claude_source.rs
index e496bd1e..fbaa8d75 100644
--- a/crates/fpai-collect/tests/claude_source.rs
+++ b/crates/fpai-collect/tests/claude_source.rs
@@ -504,6 +504,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
         spool_dir: spool,
         state_dir: state,
         poll_interval: Duration::from_millis(200),
+        health_key: None,
         params: Params {
             redact: fpai_collect::Redact::Minimal,
             agent_id: claude::DEFAULT_AGENT_ID.into(),
@@ -514,6 +515,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
             max_read_bytes: 8 * 1024 * 1024,
             max_batch_bytes: 8 * 1024 * 1024,
             since_days: None,
+            label: None,
         },
     }
 }
diff --git a/crates/fpai-collect/tests/claude_subagents.rs b/crates/fpai-collect/tests/claude_subagents.rs
index 5449999a..d9357276 100644
--- a/crates/fpai-collect/tests/claude_subagents.rs
+++ b/crates/fpai-collect/tests/claude_subagents.rs
@@ -269,6 +269,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
         spool_dir: spool,
         state_dir: state,
         poll_interval: Duration::from_millis(200),
+        health_key: None,
         params: Params {
             redact: fpai_collect::Redact::Minimal,
             agent_id: claude::SUBAGENT_DEFAULT_AGENT_ID.into(),
@@ -279,6 +280,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
             max_read_bytes: 8 * 1024 * 1024,
             max_batch_bytes: 8 * 1024 * 1024,
             since_days: None,
+            label: None,
         },
     }
 }
diff --git a/crates/fpai-collect/tests/codex_source.rs b/crates/fpai-collect/tests/codex_source.rs
index 189bb16d..ffa78db1 100644
--- a/crates/fpai-collect/tests/codex_source.rs
+++ b/crates/fpai-collect/tests/codex_source.rs
@@ -724,6 +724,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
         spool_dir: spool,
         state_dir: state,
         poll_interval: Duration::from_millis(200),
+        health_key: None,
         params: Params {
             redact: fpai_collect::Redact::Minimal,
             agent_id: codex::DEFAULT_AGENT_ID.into(),
@@ -734,6 +735,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
             max_read_bytes: 8 * 1024 * 1024,
             max_batch_bytes: 8 * 1024 * 1024,
             since_days: None,
+            label: None,
         },
     }
 }
diff --git a/crates/fpai-collect/tests/copilot_source.rs b/crates/fpai-collect/tests/copilot_source.rs
index d88f2f73..e584bc61 100644
--- a/crates/fpai-collect/tests/copilot_source.rs
+++ b/crates/fpai-collect/tests/copilot_source.rs
@@ -770,6 +770,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
         spool_dir: spool,
         state_dir: state,
         poll_interval: Duration::from_millis(200),
+        health_key: None,
         params: Params {
             redact: fpai_collect::Redact::Minimal,
             agent_id: copilot::DEFAULT_AGENT_ID.into(),
@@ -780,6 +781,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
             max_read_bytes: 8 * 1024 * 1024,
             max_batch_bytes: 8 * 1024 * 1024,
             since_days: None,
+            label: None,
         },
     }
 }
diff --git a/crates/fpai-collect/tests/cursor_source.rs b/crates/fpai-collect/tests/cursor_source.rs
index 3ccef45f..e57b1770 100644
--- a/crates/fpai-collect/tests/cursor_source.rs
+++ b/crates/fpai-collect/tests/cursor_source.rs
@@ -173,6 +173,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
         spool_dir: spool,
         state_dir: state,
         poll_interval: Duration::from_millis(200),
+        health_key: None,
         params: Params {
             redact: fpai_collect::Redact::Minimal,
             agent_id: cursor::DEFAULT_AGENT_ID.into(),
@@ -183,6 +184,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
             max_read_bytes: 8 * 1024 * 1024,
             max_batch_bytes: 8 * 1024 * 1024,
             since_days: None,
+            label: None,
         },
     }
 }
diff --git a/crates/fpai-collect/tests/delivery.rs b/crates/fpai-collect/tests/delivery.rs
index d7ac5b0f..a4c56d91 100644
--- a/crates/fpai-collect/tests/delivery.rs
+++ b/crates/fpai-collect/tests/delivery.rs
@@ -250,7 +250,13 @@ async fn watcher_and_sweeper_run_under_the_supervisor_and_stop_on_shutdown() {
                 fpai_collect::delivery::watch(dw.clone(), vec![sw.clone()], sd)
             }),
             TaskSpec::new("spool-sweeper", move |sd| {
-                fpai_collect::delivery::sweep(ds.clone(), vec![ss.clone()], fs_dir.clone(), sd)
+                fpai_collect::delivery::sweep(
+                    ds.clone(),
+                    vec![ss.clone()],
+                    fs_dir.clone(),
+                    sd,
+                    std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false)),
+                )
             }),
         ],
         shutdown.clone(),
diff --git a/crates/fpai-collect/tests/devin_source.rs b/crates/fpai-collect/tests/devin_source.rs
index ee7ccc46..1d5ff7b0 100644
--- a/crates/fpai-collect/tests/devin_source.rs
+++ b/crates/fpai-collect/tests/devin_source.rs
@@ -678,6 +678,7 @@ fn spec(db: &Path, spool: PathBuf, state: PathBuf) -> Spec {
             max_rows_per_poll: 500,
             max_batch_bytes: 8 * 1024 * 1024,
             max_drain_passes: 8,
+            label: None,
         },
     }
 }
diff --git a/crates/fpai-collect/tests/extra_paths_engine.rs b/crates/fpai-collect/tests/extra_paths_engine.rs
new file mode 100644
index 00000000..72892fc8
--- /dev/null
+++ b/crates/fpai-collect/tests/extra_paths_engine.rs
@@ -0,0 +1,570 @@
+//! Extra capture paths, end to end through the real engines.
+//!
+//! The unit tests in `extra_paths.rs` cover the grammar. These cover the thing
+//! the grammar exists for: that a second location is captured with the same
+//! fidelity as the default one, that the two do not contaminate each other, and
+//! that a machine with no extra path configured behaves exactly as it did
+//! before this feature existed.
+//!
+//! Every assertion here failed before the feature landed, and the interesting
+//! ones fail for a DIFFERENT reason than "the field does not exist": with the
+//! label threaded only into `filetail`'s own agent-id resolution rather than
+//! into `SpoolWriter`, `two_paths_holding_the_same_project_do_not_merge` still
+//! passes for the file engine and `a_sqlite_extra_path_namespaces_derived_ids`
+//! silently does not — which is exactly the split the choke-point placement
+//! exists to prevent.
+
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::sync::atomic::AtomicBool;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+use fpai_collect::filetail::{self, Params, Spec};
+use fpai_collect::sources::claude;
+use fpai_collect::supervisor::Shutdown;
+use serde_json::Value;
+
+const UUID_A: &str = "fb9f0d4f-f739-4069-ac16-9add45fd2506";
+const UUID_B: &str = "aa9f0d4f-f739-4069-ac16-9add45fd2507";
+
+fn tmpdir(name: &str) -> PathBuf {
+    let d = std::env::temp_dir().join(format!(
+        "fpai-xp-{}-{}-{}",
+        name,
+        std::process::id(),
+        SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_nanos()
+    ));
+    fs::create_dir_all(&d).unwrap();
+    d
+}
+
+fn spec(roots: Vec<PathBuf>, spool: PathBuf, state: PathBuf, label: Option<&str>) -> Spec {
+    Spec {
+        format: claude::FORMAT,
+        roots,
+        spool_dir: spool,
+        state_dir: state,
+        poll_interval: Duration::from_millis(150),
+        health_key: label.map(|l| format!("claude:{l}")),
+        params: Params {
+            redact: fpai_collect::Redact::Minimal,
+            agent_id: claude::DEFAULT_AGENT_ID.into(),
+            environment: "local".into(),
+            machine_id: None,
+            user: None,
+            end_idle_mins: 0,
+            max_read_bytes: 8 * 1024 * 1024,
+            max_batch_bytes: 8 * 1024 * 1024,
+            since_days: None,
+            label: label.map(str::to_string),
+        },
+    }
+}
+
+async fn run_briefly(s: Spec, ms: u64) {
+    let sd = Shutdown::for_test(Arc::new(AtomicBool::new(false)));
+    let _ = tokio::time::timeout(Duration::from_millis(ms), filetail::run(s, sd)).await;
+}
+
+fn spooled(dir: &Path) -> Vec<Value> {
+    let mut out = Vec::new();
+    let Ok(rd) = fs::read_dir(dir) else {
+        return out;
+    };
+    for e in rd.filter_map(|e| e.ok()) {
+        let p = e.path();
+        if p.extension().and_then(|x| x.to_str()) != Some("jsonl") {
+            continue;
+        }
+        for l in fs::read_to_string(&p).unwrap().lines() {
+            if !l.trim().is_empty() {
+                out.push(serde_json::from_str(l).unwrap());
+            }
+        }
+    }
+    out
+}
+
+/// A real Claude transcript, with `cwd` controlling the derived agent id.
+fn write_session(root: &Path, project_cwd: &str, uuid: &str, prompts: &[&str]) -> PathBuf {
+    let slug = project_cwd.replace('/', "-");
+    let proj = root.join(slug);
+    fs::create_dir_all(&proj).unwrap();
+    let mut lines = Vec::new();
+    for (i, p) in prompts.iter().enumerate() {
+        lines.push(
+            serde_json::json!({
+                "type": "user",
+                "timestamp": format!("2026-07-18T09:4{}:04.058Z", i.min(9)),
+                "cwd": project_cwd,
+                "message": {"role": "user", "content": p},
+            })
+            .to_string(),
+        );
+    }
+    let f = proj.join(format!("{uuid}.jsonl"));
+    fs::write(&f, lines.join("\n") + "\n").unwrap();
+    f
+}
+
+fn agent_ids(events: &[Value]) -> Vec<String> {
+    let mut v: Vec<String> = events
+        .iter()
+        .filter_map(|e| e["agent_id"].as_str().map(str::to_string))
+        .collect();
+    v.sort();
+    v.dedup();
+    v
+}
+
+// ── the regression that matters most ─────────────────────────────────────
+
+/// A machine with nothing configured must be byte-for-byte what it was.
+///
+/// `label: None` is the overwhelmingly common case, and the whole feature is
+/// worthless if it costs anything there.
+#[tokio::test(flavor = "multi_thread")]
+async fn default_path_only_is_unchanged_by_the_feature_existing() {
+    let root = tmpdir("def-root");
+    let spool = tmpdir("def-spool");
+    let state = tmpdir("def-state");
+    write_session(&root, "/home/u/myrepo", UUID_A, &["hello"]);
+
+    run_briefly(
+        spec(vec![root.clone()], spool.clone(), state.clone(), None),
+        900,
+    )
+    .await;
+
+    let ev = spooled(&spool);
+    assert!(!ev.is_empty(), "default root produced nothing");
+    assert_eq!(
+        agent_ids(&ev),
+        vec!["claude-myrepo".to_string()],
+        "an unlabelled instance must not namespace anything"
+    );
+    for e in &ev {
+        assert_eq!(e["session_id"], UUID_A);
+    }
+
+    fs::remove_dir_all(&root).ok();
+    fs::remove_dir_all(&spool).ok();
+    fs::remove_dir_all(&state).ok();
+}
+
+// ── the feature ──────────────────────────────────────────────────────────
+
+/// The core claim: an extra path is captured, and its ids are namespaced.
+#[tokio::test(flavor = "multi_thread")]
+async fn an_extra_path_is_captured_and_namespaced() {
+    let extra = tmpdir("x1-root");
+    let spool = tmpdir("x1-spool");
+    let state = tmpdir("x1-state");
+    write_session(&extra, "/srv/team/myrepo", UUID_A, &["from the share"]);
+
+    run_briefly(
+        spec(
+            vec![extra.clone()],
+            spool.clone(),
+            state.clone(),
+            Some("work"),
+        ),
+        900,
+    )
+    .await;
+
+    let ev = spooled(&spool);
+    assert!(!ev.is_empty(), "extra path produced nothing");
+    assert_eq!(agent_ids(&ev), vec!["work-claude-myrepo".to_string()]);
+
+    // Namespacing must not corrupt anything else on the event.
+    let types: Vec<&str> = ev.iter().filter_map(|e| e["type"].as_str()).collect();
+    assert!(types.contains(&"agent_start"), "got {types:?}");
+    for e in &ev {
+        assert_eq!(e["session_id"], UUID_A);
+    }
+
+    fs::remove_dir_all(&extra).ok();
+    fs::remove_dir_all(&spool).ok();
+    fs::remove_dir_all(&state).ok();
+}
+
+/// The reason the label is part of the grammar rather than optional.
+///
+/// Two locations holding the same project derive the SAME agent id, because it
+/// comes from the `cwd` recorded inside the transcript and both copies say the
+/// same thing. Without the label they merge into one agent whose sessions
+/// interleave from two unrelated machines' worth of history.
+#[tokio::test(flavor = "multi_thread")]
+async fn two_paths_holding_the_same_project_do_not_merge() {
+    let default_root = tmpdir("m-default");
+    let extra_root = tmpdir("m-extra");
+    let spool = tmpdir("m-spool");
+    let state_a = tmpdir("m-state-a");
+    let state_b = tmpdir("m-state-b");
+
+    // Same cwd in both, different session ids — exactly a laptop and a share
+    // holding checkouts of one repo.
+    write_session(&default_root, "/home/u/myrepo", UUID_A, &["local work"]);
+    write_session(&extra_root, "/home/u/myrepo", UUID_B, &["share work"]);
+
+    run_briefly(
+        spec(
+            vec![default_root.clone()],
+            spool.clone(),
+            state_a.clone(),
+            None,
+        ),
+        900,
+    )
+    .await;
+    run_briefly(
+        spec(
+            vec![extra_root.clone()],
+            spool.clone(),
+            state_b.clone(),
+            Some("share"),
+        ),
+        900,
+    )
+    .await;
+
+    let ev = spooled(&spool);
+    let ids = agent_ids(&ev);
+    assert_eq!(
+        ids,
+        vec![
+            "claude-myrepo".to_string(),
+            "share-claude-myrepo".to_string()
+        ],
+        "the two locations must stay distinct agents; got {ids:?}"
+    );
+
+    // And each id carries only its own session.
+    for e in &ev {
+        let id = e["agent_id"].as_str().unwrap();
+        let sid = e["session_id"].as_str().unwrap();
+        if id.starts_with("share-") {
+            assert_eq!(sid, UUID_B, "share events carried the local session");
+        } else {
+            assert_eq!(sid, UUID_A, "local events carried the share session");
+        }
+    }
+
+    for d in [&default_root, &extra_root, &spool, &state_a, &state_b] {
+        fs::remove_dir_all(d).ok();
+    }
+}
+
+/// Steady-state: several paths for one harness, tailed at the same time, with
+/// content appended while both are live.
+#[tokio::test(flavor = "multi_thread")]
+async fn three_simultaneous_paths_for_one_harness_all_tail() {
+    let a = tmpdir("s-a");
+    let b = tmpdir("s-b");
+    let c = tmpdir("s-c");
+    let spool = tmpdir("s-spool");
+    let (sa, sb, sc) = (tmpdir("s-st-a"), tmpdir("s-st-b"), tmpdir("s-st-c"));
+
+    write_session(&a, "/home/u/alpha", UUID_A, &["one"]);
+    write_session(&b, "/home/u/beta", UUID_B, &["two"]);
+    write_session(&c, "/home/u/gamma", UUID_A, &["three"]);
+
+    let sd = Shutdown::for_test(Arc::new(AtomicBool::new(false)));
+    let h1 = tokio::spawn(filetail::run(
+        spec(vec![a.clone()], spool.clone(), sa.clone(), None),
+        sd.clone(),
+    ));
+    let h2 = tokio::spawn(filetail::run(
+        spec(vec![b.clone()], spool.clone(), sb.clone(), Some("two")),
+        sd.clone(),
+    ));
+    let h3 = tokio::spawn(filetail::run(
+        spec(vec![c.clone()], spool.clone(), sc.clone(), Some("three")),
+        sd.clone(),
+    ));
+
+    tokio::time::sleep(Duration::from_millis(1100)).await;
+    for h in [h1, h2, h3] {
+        h.abort();
+    }
+
+    let ev = spooled(&spool);
+    let ids = agent_ids(&ev);
+    assert!(ids.contains(&"claude-alpha".to_string()), "got {ids:?}");
+    assert!(ids.contains(&"two-claude-beta".to_string()), "got {ids:?}");
+    assert!(
+        ids.contains(&"three-claude-gamma".to_string()),
+        "got {ids:?}"
+    );
+
+    // Each instance kept its own cursor store, so none is empty and none was
+    // clobbered by another. This is the failure the per-instance state dir
+    // exists to prevent: a shared store writes its whole map atomically, so the
+    // loser re-reads from zero after every restart.
+    for (d, who) in [(&sa, "default"), (&sb, "two"), (&sc, "three")] {
+        let has = fs::read_dir(d).map(|r| r.count() > 0).unwrap_or(false);
+        assert!(has, "{who} instance persisted no cursor of its own");
+    }
+
+    for d in [&a, &b, &c, &spool, &sa, &sb, &sc] {
+        fs::remove_dir_all(d).ok();
+    }
+}
+
+/// A path added to an ALREADY-RUNNING configuration backfills its history.
+///
+/// The mechanism is that the new instance has no cursor, so every file under it
+/// is a first discovery and is read from the start of the backfill window. This
+/// asserts the outcome rather than the mechanism: history written long before
+/// the path was registered still arrives.
+#[tokio::test(flavor = "multi_thread")]
+async fn a_newly_added_path_backfills_history_written_before_it_was_added() {
+    let default_root = tmpdir("bf-default");
+    let extra_root = tmpdir("bf-extra");
+    let spool = tmpdir("bf-spool");
+    let state_a = tmpdir("bf-state-a");
+    let state_b = tmpdir("bf-state-b");
+
+    // History that already existed on the share, with several turns so a
+    // partial read would be visible.
+    write_session(
+        &extra_root,
+        "/srv/archive/oldrepo",
+        UUID_B,
+        &["turn one", "turn two", "turn three"],
+    );
+    write_session(&default_root, "/home/u/myrepo", UUID_A, &["current"]);
+
+    // The machine as it was: default path only. The share is not captured.
+    run_briefly(
+        spec(
+            vec![default_root.clone()],
+            spool.clone(),
+            state_a.clone(),
+            None,
+        ),
+        900,
+    )
+    .await;
+    let before = agent_ids(&spooled(&spool));
+    assert_eq!(
+        before,
+        vec!["claude-myrepo".to_string()],
+        "the share must not be captured before it is registered"
+    );
+
+    // ...and now the operator registers it. A fresh instance, fresh cursor.
+    run_briefly(
+        spec(
+            vec![extra_root.clone()],
+            spool.clone(),
+            state_b.clone(),
+            Some("archive"),
+        ),
+        900,
+    )
+    .await;
+
+    let ev = spooled(&spool);
+    let after = agent_ids(&ev);
+    assert!(
+        after.contains(&"archive-claude-oldrepo".to_string()),
+        "history under the newly added path was not backfilled; got {after:?}"
+    );
+
+    // The pre-existing turns, not just an agent_start.
+    let prompts = ev
+        .iter()
+        .filter(|e| e["agent_id"] == "archive-claude-oldrepo")
+        .filter(|e| e["type"] == "model_request")
+        .count();
+    assert!(
+        prompts >= 3,
+        "only {prompts} of 3 historical turns backfilled"
+    );
+
+    for d in [&default_root, &extra_root, &spool, &state_a, &state_b] {
+        fs::remove_dir_all(d).ok();
+    }
+}
+
+/// Re-running an instance ships nothing new — the label must not defeat the
+/// cursor, which would re-ship the whole path on every poll forever.
+#[tokio::test(flavor = "multi_thread")]
+async fn a_labelled_instance_resumes_from_its_cursor() {
+    let extra = tmpdir("r-root");
+    let spool = tmpdir("r-spool");
+    let state = tmpdir("r-state");
+    write_session(&extra, "/srv/x/repo", UUID_A, &["hi"]);
+
+    run_briefly(
+        spec(vec![extra.clone()], spool.clone(), state.clone(), Some("w")),
+        900,
+    )
+    .await;
+    let first = spooled(&spool).len();
+    assert!(first > 0);
+
+    let spool2 = tmpdir("r-spool2");
+    run_briefly(
+        spec(
+            vec![extra.clone()],
+            spool2.clone(),
+            state.clone(),
+            Some("w"),
+        ),
+        900,
+    )
+    .await;
+    let second = spooled(&spool2);
+    let non_end: Vec<&Value> = second.iter().filter(|e| e["type"] != "agent_end").collect();
+    assert!(
+        non_end.is_empty(),
+        "a resumed labelled instance re-shipped {} events",
+        non_end.len()
+    );
+
+    for d in [&extra, &spool, &spool2, &state] {
+        fs::remove_dir_all(d).ok();
+    }
+}
+
+// ── the SQLite half ──────────────────────────────────────────────────────
+//
+// This is why the label is applied in `SpoolWriter::push` and not in either
+// engine. A SQLite format is handed `params.agent_id` as a FALLBACK and derives
+// the real id from the row — `devin::agent_id(working_directory, fallback)`
+// returns `devin-<project>` and never looks at the fallback for a session that
+// has a working directory, which is all of them. So prefixing `params.agent_id`
+// would namespace only the sessions that failed to derive an id: the rare ones,
+// and none of the ones anybody looks at.
+
+mod sqlite_half {
+    use super::{spooled, tmpdir};
+    use fpai_collect::sources::devin;
+    use fpai_collect::sqlitepoll::{self, Params, Spec};
+    use fpai_collect::supervisor::Shutdown;
+    use rusqlite::{Connection, params};
+    use std::path::{Path, PathBuf};
+    use std::sync::Arc;
+    use std::sync::atomic::AtomicBool;
+    use std::time::Duration;
+
+    const SCHEMA: &str = r#"
+CREATE TABLE sessions (
+    id TEXT PRIMARY KEY, working_directory TEXT NOT NULL, backend_type TEXT NOT NULL,
+    model TEXT NOT NULL, agent_mode TEXT NOT NULL, created_at INTEGER NOT NULL,
+    last_activity_at INTEGER NOT NULL, title TEXT, main_chain_id INTEGER,
+    shell_last_seen_index INTEGER DEFAULT 0, cogs_json TEXT, workspace_dirs TEXT,
+    hidden INTEGER NOT NULL DEFAULT 0, metadata TEXT);
+CREATE TABLE message_nodes (
+    row_id INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL,
+    node_id INTEGER NOT NULL, parent_node_id INTEGER, chat_message TEXT NOT NULL,
+    created_at INTEGER NOT NULL, metadata TEXT,
+    FOREIGN KEY (session_id) REFERENCES sessions(id), UNIQUE(session_id, node_id));
+"#;
+
+    const T0: i64 = 1_785_396_633;
+    const ISO0: &str = "2026-07-30T07:30:33.500577515Z";
+
+    /// A Devin database holding one session in `working_dir`.
+    fn db_with(name: &str, working_dir: &str) -> (PathBuf, PathBuf) {
+        let dir = tmpdir(name);
+        let path = dir.join("sessions.db");
+        let conn = Connection::open(&path).unwrap();
+        conn.pragma_update(None, "journal_mode", "WAL").unwrap();
+        conn.execute_batch(SCHEMA).unwrap();
+        conn.execute(
+            "INSERT INTO sessions(id, working_directory, backend_type, model, agent_mode,
+                                  created_at, last_activity_at, hidden)
+             VALUES ('s1', ?1, 'anthropic', 'claude-sonnet-4-6', 'auto', ?2, ?2, 0)",
+            params![working_dir, T0],
+        )
+        .unwrap();
+        let msg = serde_json::json!({"role": "user", "content": "hello"}).to_string();
+        let meta = serde_json::json!({"created_at": ISO0}).to_string();
+        conn.execute(
+            "INSERT INTO message_nodes(session_id, node_id, chat_message, created_at, metadata)
+             VALUES ('s1', 1, ?1, ?2, ?3)",
+            params![msg, T0, meta],
+        )
+        .unwrap();
+        (dir, path)
+    }
+
+    fn spec(db: &Path, spool: PathBuf, state: PathBuf, label: Option<&str>) -> Spec {
+        Spec {
+            format: devin::FORMAT,
+            db_path: db.to_path_buf(),
+            spool_dir: spool,
+            state_dir: state,
+            poll_interval: Duration::from_millis(150),
+            health_key: label.map(|l| format!("devin:{l}")),
+            params: Params {
+                redact: fpai_collect::Redact::Minimal,
+                agent_id: devin::DEFAULT_AGENT_ID.into(),
+                environment: "local".into(),
+                machine_id: None,
+                user: None,
+                max_rows_per_poll: 500,
+                max_batch_bytes: 8 * 1024 * 1024,
+                max_drain_passes: 8,
+                label: label.map(str::to_string),
+            },
+        }
+    }
+
+    async fn run_briefly(s: Spec, ms: u64) {
+        let sd = Shutdown::for_test(Arc::new(AtomicBool::new(false)));
+        let _ = tokio::time::timeout(Duration::from_millis(ms), sqlitepoll::run(s, sd)).await;
+    }
+
+    /// The id the format DERIVES from the row is namespaced, not just the
+    /// fallback. Prefixing `params.agent_id` passes nothing here.
+    #[tokio::test(flavor = "multi_thread")]
+    async fn a_sqlite_extra_path_namespaces_derived_ids() {
+        let (dir, db) = db_with("sq-x", "/srv/team/checkout");
+        let spool = tmpdir("sq-x-spool");
+        let state = tmpdir("sq-x-state");
+
+        run_briefly(spec(&db, spool.clone(), state.clone(), Some("team")), 900).await;
+
+        let ev = spooled(&spool);
+        assert!(!ev.is_empty(), "sqlite extra path produced nothing");
+        for e in &ev {
+            assert_eq!(
+                e["agent_id"], "team-devin-checkout",
+                "the DERIVED id must be namespaced, not just the fallback"
+            );
+        }
+
+        std::fs::remove_dir_all(&dir).ok();
+        std::fs::remove_dir_all(&spool).ok();
+        std::fs::remove_dir_all(&state).ok();
+    }
+
+    /// ...and an unlabelled SQLite instance is untouched.
+    #[tokio::test(flavor = "multi_thread")]
+    async fn a_default_sqlite_instance_is_not_namespaced() {
+        let (dir, db) = db_with("sq-d", "/home/u/checkout");
+        let spool = tmpdir("sq-d-spool");
+        let state = tmpdir("sq-d-state");
+
+        run_briefly(spec(&db, spool.clone(), state.clone(), None), 900).await;
+
+        let ev = spooled(&spool);
+        assert!(!ev.is_empty());
+        for e in &ev {
+            assert_eq!(e["agent_id"], "devin-checkout");
+        }
+
+        std::fs::remove_dir_all(&dir).ok();
+        std::fs::remove_dir_all(&spool).ok();
+        std::fs::remove_dir_all(&state).ok();
+    }
+}
diff --git a/crates/fpai-collect/tests/factory_source.rs b/crates/fpai-collect/tests/factory_source.rs
index dd1b1914..a20351b0 100644
--- a/crates/fpai-collect/tests/factory_source.rs
+++ b/crates/fpai-collect/tests/factory_source.rs
@@ -201,6 +201,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
         spool_dir: spool,
         state_dir: state,
         poll_interval: Duration::from_millis(200),
+        health_key: None,
         params: Params {
             redact: fpai_collect::Redact::Minimal,
             agent_id: factory::DEFAULT_AGENT_ID.into(),
@@ -211,6 +212,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
             max_read_bytes: 8 * 1024 * 1024,
             max_batch_bytes: 8 * 1024 * 1024,
             since_days: None,
+            label: None,
         },
     }
 }
diff --git a/crates/fpai-collect/tests/goose_source.rs b/crates/fpai-collect/tests/goose_source.rs
index ff2db33f..0a6e089a 100644
--- a/crates/fpai-collect/tests/goose_source.rs
+++ b/crates/fpai-collect/tests/goose_source.rs
@@ -878,6 +878,7 @@ fn spec(db: &Path, spool: PathBuf, state: PathBuf) -> Spec {
             max_rows_per_poll: 500,
             max_batch_bytes: 8 * 1024 * 1024,
             max_drain_passes: 8,
+            label: None,
         },
     }
 }
diff --git a/crates/fpai-collect/tests/hermes_source.rs b/crates/fpai-collect/tests/hermes_source.rs
index 0e987e4f..e76b3293 100644
--- a/crates/fpai-collect/tests/hermes_source.rs
+++ b/crates/fpai-collect/tests/hermes_source.rs
@@ -1000,6 +1000,7 @@ fn spec(db: PathBuf, spool: PathBuf, state: PathBuf) -> sqlitepoll::Spec {
             max_rows_per_poll: 500,
             max_batch_bytes: 8 * 1024 * 1024,
             max_drain_passes: 8,
+            label: None,
         },
     }
 }
diff --git a/crates/fpai-collect/tests/hooks_source.rs b/crates/fpai-collect/tests/hooks_source.rs
index abe5c293..5c94ab06 100644
--- a/crates/fpai-collect/tests/hooks_source.rs
+++ b/crates/fpai-collect/tests/hooks_source.rs
@@ -454,8 +454,8 @@ fn attributed_deny_row() -> String {
         "cwd": "/home/sidd/work/failproofai",
         "policySource": "cloud",
         "cloudPolicyId": "org-blocks-curl",
-        "cloudRevision": 3,
-        "cloudGeneration": 8,
+        "cloudVersion": 3,
+        "cloudDeployment": 8,
         "pausedBy": "session",
         "pauseExpiresAt": 1785742712184i64
     })
@@ -480,8 +480,8 @@ async fn a_decision_carries_its_attribution_to_the_server() {
     // Exactly the keys the server's queries extract.
     assert_eq!(end["policy_source"], "cloud");
     assert_eq!(end["cloud_policy_id"], "org-blocks-curl");
-    assert_eq!(end["cloud_revision"], 3);
-    assert_eq!(end["cloud_generation"], 8);
+    assert_eq!(end["cloud_version"], 3);
+    assert_eq!(end["cloud_deployment"], 8);
     assert_eq!(end["paused"], true, "must be a bool, not a string");
     assert_eq!(end["paused_by"], "session");
 
@@ -532,7 +532,7 @@ async fn an_allow_rollup_never_mixes_two_policy_sources() {
         "timestamp": 1785740912000i64, "eventType": "PreToolUse", "integration": "claude",
         "toolName": "Bash", "decision": "allow", "durationMs": 2,
         "sessionId": "s1", "cwd": "/w", "policySource": "cloud",
-        "cloudPolicyId": "org-guard", "cloudRevision": 2, "cloudGeneration": 8
+        "cloudPolicyId": "org-guard", "cloudVersion": 2, "cloudDeployment": 8
     })
     .to_string();
     let plain_allow = serde_json::json!({
@@ -571,7 +571,7 @@ async fn an_allow_rollup_never_mixes_two_policy_sources() {
     // so two events carrying the SAME id collapse back into one row in the
     // product — undoing this split downstream, silently, in exactly the two
     // cases it exists for: the minute a pause starts, and the minute a cloud
-    // generation flips during a rollout. The aggregate id was built from
+    // deployment flips during a rollout. The aggregate id was built from
     // session/minute/event/tool only, all four of which are identical here by
     // construction, so both events shipped with byte-identical ids and this
     // test passed anyway.
@@ -597,14 +597,14 @@ async fn an_observed_verdict_survives_the_allow_rollup() {
     let observed = serde_json::json!({
         "timestamp": 1785740912000i64, "eventType": "PreToolUse", "integration": "claude",
         "toolName": "Bash", "decision": "allow", "durationMs": 3,
-        "sessionId": "s1", "cwd": "/w", "cloudGeneration": 8,
-        "observed": [{"policyId": "org-trials-git-push", "revision": 1, "decision": "deny"}]
+        "sessionId": "s1", "cwd": "/w", "cloudDeployment": 8,
+        "observed": [{"policyId": "org-trials-git-push", "version": 1, "decision": "deny"}]
     })
     .to_string();
     let ordinary = serde_json::json!({
         "timestamp": 1785740912100i64, "eventType": "PreToolUse", "integration": "claude",
         "toolName": "Bash", "decision": "allow", "durationMs": 1,
-        "sessionId": "s1", "cwd": "/w", "cloudGeneration": 8
+        "sessionId": "s1", "cwd": "/w", "cloudDeployment": 8
     })
     .to_string();
 
diff --git a/crates/fpai-collect/tests/openclaw_source.rs b/crates/fpai-collect/tests/openclaw_source.rs
index 23c337b6..39f51ec0 100644
--- a/crates/fpai-collect/tests/openclaw_source.rs
+++ b/crates/fpai-collect/tests/openclaw_source.rs
@@ -572,6 +572,7 @@ fn spec(base: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
         spool_dir: spool,
         state_dir: state,
         poll_interval: Duration::from_millis(200),
+        health_key: None,
         params: Params {
             redact: fpai_collect::Redact::Minimal,
             agent_id: openclaw::DEFAULT_AGENT_ID.into(),
@@ -582,6 +583,7 @@ fn spec(base: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
             max_read_bytes: 8 * 1024 * 1024,
             max_batch_bytes: 8 * 1024 * 1024,
             since_days: None,
+            label: None,
         },
     }
 }
diff --git a/crates/fpai-collect/tests/pi_source.rs b/crates/fpai-collect/tests/pi_source.rs
index 45d3c6b7..b7bda69d 100644
--- a/crates/fpai-collect/tests/pi_source.rs
+++ b/crates/fpai-collect/tests/pi_source.rs
@@ -779,6 +779,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
         spool_dir: spool,
         state_dir: state,
         poll_interval: Duration::from_millis(200),
+        health_key: None,
         params: Params {
             redact: fpai_collect::Redact::Minimal,
             agent_id: pi::DEFAULT_AGENT_ID.into(),
@@ -789,6 +790,7 @@ fn spec(root: PathBuf, spool: PathBuf, state: PathBuf) -> Spec {
             max_read_bytes: 8 * 1024 * 1024,
             max_batch_bytes: 8 * 1024 * 1024,
             since_days: None,
+            label: None,
         },
     }
 }
diff --git a/src/hooks/cloud-connection.ts b/src/hooks/cloud-connection.ts
index 8a945a0e..52fedbde 100644
--- a/src/hooks/cloud-connection.ts
+++ b/src/hooks/cloud-connection.ts
@@ -137,7 +137,7 @@ export interface CapabilityOutcome {
 }
 
 export interface ConnectOutcome {
-  policy: CapabilityOutcome & { policyCount?: number; generation?: number };
+  policy: CapabilityOutcome & { policyCount?: number; deployment?: number };
   ingest: CapabilityOutcome;
   /** Which organisation the key belongs to. Absent on a pre-introspect server. */
   org?: { id?: string; slug?: string; name?: string };
@@ -232,7 +232,7 @@ export async function connectToCloud(input: ConnectInput): Promise<ConnectOutcom
 
   const outcome: ConnectOutcome = {
     policy: policyResult.ok
-      ? { ok: true, policyCount: policyResult.policyCount, generation: policyResult.generation }
+      ? { ok: true, policyCount: policyResult.policyCount, deployment: policyResult.deployment }
       : { ok: false, reason: policyResult.reason },
     ingest: ingestResult.ok ? { ok: true } : { ok: false, reason: ingestResult.reason },
     anyConfigured: false,
@@ -309,7 +309,7 @@ export function describeOutcome(outcome: ConnectOutcome, machineId: string, url:
   if (outcome.policy.ok && outcome.ingest.ok) {
     lines.push(`Connected to ${url} as ${machineId}${into}.`);
     const n = outcome.policy.policyCount ?? 0;
-    lines.push(`  Policy    ${n} polic${n === 1 ? "y" : "ies"} assigned (generation ${outcome.policy.generation ?? 0}).`);
+    lines.push(`  Policy    ${n} polic${n === 1 ? "y" : "ies"} assigned (deployment ${outcome.policy.deployment ?? 0}).`);
     lines.push(`  Dashboard hook activity will be sent to ${ingestUrlFor(url)}.`);
     return lines;
   }
@@ -317,7 +317,7 @@ export function describeOutcome(outcome: ConnectOutcome, machineId: string, url:
   if (outcome.policy.ok && !outcome.ingest.ok) {
     const n = outcome.policy.policyCount ?? 0;
     lines.push(`Connected to ${url} as ${machineId}${into}, for policy only.`);
-    lines.push(`  Policy    ${n} polic${n === 1 ? "y" : "ies"} assigned (generation ${outcome.policy.generation ?? 0}).`);
+    lines.push(`  Policy    ${n} polic${n === 1 ? "y" : "ies"} assigned (deployment ${outcome.policy.deployment ?? 0}).`);
     lines.push(`  Dashboard NOT configured: ${outcome.ingest.reason}`);
     lines.push("");
     lines.push("  Enforcement works. Nothing will appear in the dashboard until this");
diff --git a/src/hooks/cloud-enrollment-cli.ts b/src/hooks/cloud-enrollment-cli.ts
index 61e941eb..34a77d7f 100644
--- a/src/hooks/cloud-enrollment-cli.ts
+++ b/src/hooks/cloud-enrollment-cli.ts
@@ -214,7 +214,7 @@ export function runDisconnectCommand(): CommandResult {
   // credential ends the daemon's polling; every artifact already on disk stayed
   // referenced by `active.json` and kept being loaded on every tool call — so a
   // machine that had deliberately left its organisation went on being governed
-  // by whatever generation was current when it left, indefinitely, while
+  // by whatever deployment was current when it left, indefinitely, while
   // `--status` reported it as unconnected.
   const stoppedManaged = clearActiveCloudManagedPolicies();
   // Back to OSS. Leaving mode = "cloud" with no credentials would describe a
diff --git a/src/hooks/cloud-enrollment.ts b/src/hooks/cloud-enrollment.ts
index 649a7641..08ecf402 100644
--- a/src/hooks/cloud-enrollment.ts
+++ b/src/hooks/cloud-enrollment.ts
@@ -182,7 +182,7 @@ export function clearCloudCredentials(): boolean {
 }
 
 export type VerifyResult =
-  | { ok: true; policyCount: number; generation: number }
+  | { ok: true; policyCount: number; deployment: number }
   | { ok: false; reason: string };
 
 /**
@@ -228,11 +228,11 @@ export async function verifyCloudCredentials(creds: CloudCredentials): Promise<V
   }
 
   try {
-    const body = (await response.json()) as { policies?: unknown[]; generation?: number };
+    const body = (await response.json()) as { policies?: unknown[]; deployment?: number };
     return {
       ok: true,
       policyCount: Array.isArray(body.policies) ? body.policies.length : 0,
-      generation: typeof body.generation === "number" ? body.generation : 0,
+      deployment: typeof body.deployment === "number" ? body.deployment : 0,
     };
   } catch {
     return {
diff --git a/src/hooks/cloud-managed-policies.ts b/src/hooks/cloud-managed-policies.ts
index 40ccfdfd..e4dce4e5 100644
--- a/src/hooks/cloud-managed-policies.ts
+++ b/src/hooks/cloud-managed-policies.ts
@@ -1,5 +1,5 @@
 /**
- * Reads the daemon-owned active cloud policy generation for the TypeScript
+ * Reads the daemon-owned active cloud policy deployment for the TypeScript
  * evaluator. The Rust reconciler is responsible for downloading and repairing
  * artifacts; this boundary independently verifies the digest immediately
  * before import so the worker never knowingly executes modified bytes.
@@ -10,7 +10,21 @@ import { homedir } from "node:os";
 import { isAbsolute, relative, resolve } from "node:path";
 import { cloudPoliciesDir } from "./fp-home";
 
-const ACTIVE_SCHEMA_VERSION = 1;
+/**
+ * Active-manifest schema versions this reader accepts.
+ *
+ * MUST stay in step with `SUPPORTED_SCHEMA_VERSIONS` in `cloud_policies.rs`,
+ * which is what WRITES the file this parses. They are two hand-maintained
+ * copies of one contract in two languages, and the failure is silent in the
+ * worst direction: the daemon reconciles happily, `active.json` is correct on
+ * disk, and only the hook path refuses it — so cloud policy stops being
+ * enforced while every other signal says the machine is healthy. Reproduced
+ * exactly that way while syncing this with AgentEye#559.
+ *
+ * 1 is accepted for files a pre-rename beta daemon left behind; 2 is what is
+ * written now.
+ */
+const ACCEPTED_ACTIVE_SCHEMA_VERSIONS: readonly number[] = [1, 2];
 const SHA256_RE = /^[a-f0-9]{64}$/;
 const POLICY_ID_RE = /^[A-Za-z0-9._-]{1,128}$/;
 
@@ -19,7 +33,7 @@ export type PolicyEffect = "enforce" | "observe";
 
 export interface CloudManagedPolicyArtifact {
   id: string;
-  revision: number;
+  version: number;
   /**
    * `observe` policies are evaluated exactly like any other and then have their
    * verdict discarded, so a rollout can be measured against real traffic before
@@ -30,15 +44,15 @@ export interface CloudManagedPolicyArtifact {
   effect: PolicyEffect;
   sha256: string;
   path: string;
-  generation: number;
+  deployment: number;
 }
 
 interface ActiveManifest {
   schemaVersion: number;
-  generation: number;
+  deployment: number;
   policies: Array<{
     id: string;
-    revision: number;
+    version: number;
     effect?: string;
     sha256: string;
     path: string;
@@ -52,17 +66,41 @@ export function cloudManagedPolicyRoot(): string {
   );
 }
 
+/**
+ * A version-1 manifest, in the spelling a pre-rename daemon actually wrote.
+ *
+ * Accepting schema 1 while reading only the version-2 FIELD NAMES made the
+ * acceptance unreachable: every genuine v1 file threw "active manifest
+ * deployment is invalid". The Rust reader of this same file handles it with
+ * `#[serde(alias = "generation")]` / `#[serde(alias = "revision")]`; this is the
+ * TypeScript half of that pair, and it was missing.
+ */
+interface LegacyActiveManifest {
+  generation?: number;
+  policies?: Array<{ revision?: number }>;
+}
+
 function parseManifest(value: unknown): ActiveManifest {
   if (!value || typeof value !== "object") throw new Error("active manifest is not an object");
-  const manifest = value as Partial<ActiveManifest>;
-  if (manifest.schemaVersion !== ACTIVE_SCHEMA_VERSION) {
-    throw new Error(`unsupported active manifest schema ${String(manifest.schemaVersion)}`);
+  const raw = value as Partial<ActiveManifest> & LegacyActiveManifest;
+  if (!ACCEPTED_ACTIVE_SCHEMA_VERSIONS.includes(raw.schemaVersion as number)) {
+    throw new Error(
+      `unsupported active manifest schema ${String(raw.schemaVersion)} ` +
+        `(supported: ${ACCEPTED_ACTIVE_SCHEMA_VERSIONS.join(", ")})`,
+    );
   }
-  if (!Number.isSafeInteger(manifest.generation) || (manifest.generation ?? -1) < 0) {
-    throw new Error("active manifest generation is invalid");
+  // New name wins; the old one is a fallback, not an equal. A file carrying both
+  // (written by a mixed-version machine) must resolve to the current field.
+  const deployment = raw.deployment ?? raw.generation;
+  if (!Number.isSafeInteger(deployment) || (deployment ?? -1) < 0) {
+    throw new Error("active manifest deployment is invalid");
   }
-  if (!Array.isArray(manifest.policies)) throw new Error("active manifest policies is not an array");
-  return manifest as ActiveManifest;
+  if (!Array.isArray(raw.policies)) throw new Error("active manifest policies is not an array");
+  const policies = raw.policies.map((p) => {
+    const entry = p as ActiveManifest["policies"][number] & { revision?: number };
+    return { ...entry, version: entry.version ?? entry.revision } as ActiveManifest["policies"][number];
+  });
+  return { schemaVersion: raw.schemaVersion as number, deployment: deployment as number, policies };
 }
 
 function resolveManagedPath(root: string, candidate: string): string {
@@ -73,7 +111,7 @@ function resolveManagedPath(root: string, candidate: string): string {
     throw new Error(`managed policy path escapes its root: ${JSON.stringify(candidate)}`);
   }
 
-  // Reject a symlinked artifact or generation directory escaping the managed
+  // Reject a symlinked artifact or deployment directory escaping the managed
   // root. The current daemon is same-user, but following an arbitrary path is
   // still unnecessary ambient authority and becomes dangerous if its service
   // identity is hardened later.
@@ -89,8 +127,8 @@ function resolveManagedPath(root: string, candidate: string): string {
 /**
  * Stop enforcing cloud-managed policies on this machine.
  *
- * Removes `active.json` only — the manifest that says which generation is
- * live. The generation directories and content-addressed artifacts are left
+ * Removes `active.json` only — the manifest that says which deployment is
+ * live. The deployment directories and content-addressed artifacts are left
  * alone: they are large, hash-verified on use, and inert once nothing points
  * at them, so keeping them makes a reconnect cheap and offline-safe.
  *
@@ -98,7 +136,7 @@ function resolveManagedPath(root: string, candidate: string): string {
  * credential stops the daemon REFRESHING policy; every artifact already on disk
  * kept being loaded and enforced on every tool call, so a user who had
  * deliberately left their organisation's cloud went on being governed by
- * whatever generation happened to be current when they left — indefinitely,
+ * whatever deployment happened to be current when they left — indefinitely,
  * with `--status` reporting the machine as unconnected.
  *
  * Returns true when a manifest was actually removed.
@@ -134,8 +172,8 @@ export function readActiveCloudManagedPolicies(): CloudManagedPolicyArtifact[] {
     if (!POLICY_ID_RE.test(policy.id) || policy.id === "." || policy.id === "..") {
       throw new Error(`unsafe cloud-managed policy id ${JSON.stringify(policy.id)}`);
     }
-    if (!Number.isSafeInteger(policy.revision) || policy.revision < 0) {
-      throw new Error(`invalid revision for cloud-managed policy ${policy.id}`);
+    if (!Number.isSafeInteger(policy.version) || policy.version < 0) {
+      throw new Error(`invalid version for cloud-managed policy ${policy.id}`);
     }
     if (!SHA256_RE.test(policy.sha256)) {
       throw new Error(`invalid SHA-256 for cloud-managed policy ${policy.id}`);
@@ -154,16 +192,16 @@ export function readActiveCloudManagedPolicies(): CloudManagedPolicyArtifact[] {
     if (policy.effect !== undefined && policy.effect !== "enforce" && policy.effect !== "observe") {
       // Guessing would mean either enforcing something cloud did not ask to
       // enforce, or observing something it wanted enforced. Both are worse than
-      // refusing the generation.
+      // refusing the deployment.
       throw new Error(`unknown effect ${JSON.stringify(policy.effect)} for cloud-managed policy ${policy.id}`);
     }
     return {
       id: policy.id,
-      revision: policy.revision,
+      version: policy.version,
       effect: (policy.effect as PolicyEffect | undefined) ?? "enforce",
       sha256: policy.sha256,
       path,
-      generation: manifest.generation,
+      deployment: manifest.deployment,
     };
   });
 }
diff --git a/src/hooks/configure-wizard.ts b/src/hooks/configure-wizard.ts
index eeae2357..e1099e6a 100644
--- a/src/hooks/configure-wizard.ts
+++ b/src/hooks/configure-wizard.ts
@@ -33,6 +33,7 @@ import { dirname, resolve, sep } from "node:path";
 import {
   selectOne,
   multiSelect,
+  BACK,
   promptText,
   intro,
   outro,
@@ -432,7 +433,7 @@ export function describeCustomPolicies(cwd: string): {
  */
 export function buildCompletionSummary(
   policiesCount: number,
-  assistantsCount: number,
+  harnessesCount: number,
   customEnabled: boolean | undefined,
   daemonInstalled: boolean,
   connected: boolean,
@@ -443,8 +444,8 @@ export function buildCompletionSummary(
   if (daemonInstalled) extras.push("daemon");
   if (connected) extras.push("reporting");
   const extrasNote = extras.length > 0 ? ` · ${extras.join(", ")}` : "";
-  const assistants = `${assistantsCount} assistant${assistantsCount === 1 ? "" : "s"}`;
-  return `Setup complete — ${policiesCount} policies · ${assistants}${extrasNote}`;
+  const harnesses = `${harnessesCount} harness${harnessesCount === 1 ? "" : "es"}`;
+  return `Setup complete — ${policiesCount} policies · ${harnesses}${extrasNote}`;
 }
 
 export function reviewLines(state: {
@@ -473,9 +474,9 @@ export function reviewLines(state: {
         ? `This project (${homeify(cwd)})`
         : "Everywhere (global)";
   const lines: string[] = [];
-  const assistantNames = clis.map((c) => getIntegration(c).displayName);
+  const harnessNames = clis.map((c) => getIntegration(c).displayName);
   lines.push(`  Where      : ${where}`);
-  lines.push(`  Assistants : ${assistantNames.length ? summarize(assistantNames, "assistants") : "(none)"}`);
+  lines.push(`  Harnesses  : ${harnessNames.length ? summarize(harnessNames, "harnesses") : "(none)"}`);
   // Zero is a deliberate answer, not a failed step — say so, and say where to
   // change it, so the review screen doesn't read like the wizard lost the
   // selection. Hooks still install; only the builtin set is empty.
@@ -763,7 +764,7 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
     return { applied: false, abort: "unsupported_platform" };
   }
 
-  intro("let's set up your safety net", stdout);
+  intro("let's set up failproofai", stdout);
 
   const cancel = (): WizardResult => {
     outro("Cancelled — nothing was changed.", { ok: false }, stdout);
@@ -960,24 +961,38 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
   // The assistants step below keeps its minimum deliberately: an empty CLI list
   // does NOT mean "no assistants" there — `installHooksImpl` falls back to
   // ["claude"], so letting it through would silently install for Claude.
-  const presets = await multiSelect<string>({
-    message: "What should we guard against?",
-    choices: presetChoices,
-    summaryNoun: "bundles",
-    hint: "space toggles · combine presets · ↵ confirm · none is fine",
-    stdin,
-    stdout,
-  });
-  if (presets === null) return cancel();
-  const policies = resolvePresetSelection(presets);
-  // Only meaningful when there are files to switch off; with none, the row is
-  // locked-unchecked and must not write a disabling flag.
-  const customEnabled = hasCustomFiles ? presets.includes(CUSTOM) : undefined;
+  // Steps 2 and 3 are navigable: ← on the harness step returns to the policy
+  // step with the previous answer still selected. Before this, changing an
+  // earlier answer meant abandoning setup and starting over, because a prompt
+  // had exactly one way out and it was `null`.
+  //
+  // The policy step itself takes no `allowBack`: the only thing before it is
+  // the scope question, which is frequently not asked at all (a single choice
+  // is stated, not prompted), so ← there would sometimes go nowhere.
+  let presets: string[] | null = null;
+  let clisSel: string[] | null = null;
+  while (clisSel === null) {
+    // Re-entering after a ← must show what was picked, not a blank slate.
+    // Selection state lives on each choice, so carry it back in.
+    // Loop-carried: narrowed to `null` on the first pass, repopulated on a ←.
+    const priorPresets = presets as string[] | null;
+    presets = await multiSelect<string>({
+      message: "What should we guard against?",
+      choices: priorPresets
+        ? presetChoices.map((c) => ({ ...c, checked: priorPresets.includes(c.value) }))
+        : presetChoices,
+      summaryNoun: "bundles",
+      hint: "space toggles · combine presets · ↵ confirm · none is fine",
+      stdin,
+      stdout,
+    });
+    if (presets === null) return cancel();
 
-  // 3 — Which assistants? An "Everything available" row protects every supported
-  // CLI (detected + set-up-ahead); when ticked it wins over the individual boxes.
-  const clisSel = await multiSelect<string>({
-    message: "Which AI assistants should it protect?",
+    // 3 — Which harnesses? An "Everything available" row protects every supported
+    // CLI (detected + set-up-ahead); when ticked it wins over the individual boxes.
+    const priorClis = clisSel as string[] | null;
+    const picked: string[] | typeof BACK | null = await multiSelect<string>({
+    message: "Which harnesses should it protect?",
     choices: [
       {
         label: "Everything available",
@@ -985,19 +1000,30 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
         // Counts only what this scope can actually take — expanding to all 12
         // under project scope is what crashed the apply on Hermes.
         hint: `protect all ${clisSupportingScope(primaryScope).length} CLIs configurable here`,
-        // A selector, not an assistant. Counting it gave "13 assistants" for
+        // A selector, not a harness. Counting it gave "13 harnesses" for
         // the 12 supported CLIs, and listed "Everything available" among them.
         summaryExclude: true,
       },
       ...buildAgentChoices(primaryScope, cwd),
-    ],
-    minSelected: 1,
-    summaryNoun: "assistants",
-    hint: "detected CLIs are pre-selected · space toggles · ctrl+a all · ↵ confirm",
-    stdin,
-    stdout,
-  });
-  if (clisSel === null) return cancel();
+    ].map((c) => (priorClis ? { ...c, checked: priorClis.includes(c.value) } : c)),
+      minSelected: 1,
+      summaryNoun: "harnesses",
+      hint: "detected CLIs are pre-selected · space toggles · ctrl+a all · ← back · ↵ confirm",
+      allowBack: true as const,
+      stdin,
+      stdout,
+    });
+    if (picked === null) return cancel();
+    // ← re-runs the loop, which re-asks the policy step with its answer intact.
+    if (picked === BACK) continue;
+    clisSel = picked;
+  }
+  // Non-null by construction: the loop only exits once both are assigned.
+  const chosenPresets: string[] = presets ?? [];
+  const policies = resolvePresetSelection(chosenPresets);
+  // Only meaningful when there are files to switch off; with none, the row is
+  // locked-unchecked and must not write a disabling flag.
+  const customEnabled = hasCustomFiles ? chosenPresets.includes(CUSTOM) : undefined;
   // Filter to what the chosen scopes support in BOTH branches: "Everything
   // available" must not expand to CLIs that cannot take any selected scope,
   // and a locked row can't be ticked but belt-and-braces keeps the invariant
@@ -1038,17 +1064,21 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
         "  transcripts — prompts, file contents and command output — to your",
         "  dashboard. Staying local sends nothing, anywhere, ever.",
       ],
+      // Cloud first, and therefore preselected: connecting is what most people
+      // running this wizard came to do, and the local path stays one keystroke
+      // away. Reversing these two is the whole change — neither option's copy
+      // moved, so "stay local" is still stated as plainly as it was.
       choices: [
-        {
-          label: "Not now — stay local",
-          value: "local",
-          hint: "policies still enforce · connect later with failproofai config --connect",
-        },
         {
           label: "Paste an API key",
           value: "key",
           hint: "reports decisions and transcripts to your dashboard",
         },
+        {
+          label: "Not now — stay local",
+          value: "local",
+          hint: "policies still enforce · connect later with failproofai config --connect",
+        },
       ],
       stdin,
       stdout,
@@ -1370,7 +1400,7 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
     cli: clis,
     cli_count: clis.length,
     policy_count: policies.length,
-    source: presets.join("+"),
+    source: chosenPresets.join("+"),
     connected: connect !== null,
   });
 
diff --git a/src/hooks/custom-hooks-loader.ts b/src/hooks/custom-hooks-loader.ts
index 2dd79baf..7a883a39 100644
--- a/src/hooks/custom-hooks-loader.ts
+++ b/src/hooks/custom-hooks-loader.ts
@@ -387,7 +387,7 @@ export async function loadAllCustomHooks(
           };
           if (cloudManaged) {
             tagged.__cloudManaged = cloudManaged;
-            tagged.__policyId = `cloud:${cloudManaged.id}@${cloudManaged.revision}:${hook.name}`;
+            tagged.__policyId = `cloud:${cloudManaged.id}@${cloudManaged.version}:${hook.name}`;
           } else {
             tagged.__policyId = customPolicyId(absPath, hook.name);
           }
diff --git a/src/hooks/daemon-service.ts b/src/hooks/daemon-service.ts
index ddf198cf..30ef32d0 100644
--- a/src/hooks/daemon-service.ts
+++ b/src/hooks/daemon-service.ts
@@ -1036,25 +1036,80 @@ export async function probeDaemon(): Promise<DaemonProbe> {
   }
 }
 
+/**
+ * "Is anything listening on the daemon socket?" — never throws.
+ *
+ * Split out because `waitForDaemonRunning` needs the connect check WITHOUT the
+ * hook evaluation: it runs inside a settle loop, and a failed import or a
+ * transient refusal there must read as "not yet", never as an error.
+ */
+async function daemonAcceptsConnectionsQuietly(): Promise<boolean> {
+  try {
+    const { daemonAcceptsConnections } = await import("./daemon-client");
+    return await daemonAcceptsConnections();
+  } catch {
+    return false;
+  }
+}
+
 /** Boolean form, for callers that only branch on healthy/not. */
 export async function probeDaemonEndToEnd(): Promise<boolean> {
   return (await probeDaemon()).ok;
 }
 
 /**
- * Waits for the service to report running, then re-checks after a settle
- * window (see `SERVICE_SETTLE_MS`) so a daemon that dies at startup doesn't
- * pass on the strength of one optimistic reading.
+ * Waits for the service to report running and to HOLD it — a `Type=simple` unit
+ * is active the moment it forks, so one optimistic reading passes a daemon that
+ * died at startup.
+ *
+ * WATCHED, not slept through. This used to sleep `SERVICE_SETTLE_MS` blind and
+ * read the status once at the end, which was wrong in both directions on a
+ * healthy machine and a broken one:
+ *
+ *   • Healthy: the socket is up in ~13ms and answers a real hook in ~125ms, and
+ *     setup still sat there for the remaining ~600ms with the answer already in
+ *     hand. Setup runs this twice on the repair path (uninstall, reinstall), so
+ *     it was over a second of dead wait every time.
+ *   • Broken: a daemon that died at 100ms was not noticed until 750ms, because
+ *     nothing looked until the sleep was over.
+ *
+ * Now the window is polled. Leaving `running` at any point fails immediately,
+ * and the wait ends early once the daemon has answered a real hook — a reply is
+ * strictly stronger evidence of "did not die at startup" than "still active
+ * after an arbitrary sleep", which is all the settle ever established.
  */
-async function waitForDaemonRunning(): Promise<boolean> {
-  const deadline = Date.now() + SERVICE_START_TIMEOUT_MS;
+export interface WaitForDaemonDeps {
+  status?: () => DaemonServiceStatus;
+  accepts?: () => Promise<boolean>;
+  sleep?: (ms: number) => Promise<void>;
+  now?: () => number;
+}
+
+export async function waitForDaemonRunning(deps: WaitForDaemonDeps = {}): Promise<boolean> {
+  const status = deps.status ?? daemonServiceStatus;
+  const accepts = deps.accepts ?? daemonAcceptsConnectionsQuietly;
+  const sleep = deps.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
+  const now = deps.now ?? Date.now;
+
+  const deadline = now() + SERVICE_START_TIMEOUT_MS;
+  for (;;) {
+    if (status() === "running") break;
+    if (now() >= deadline) return false;
+    await sleep(SERVICE_START_POLL_MS);
+  }
+
+  const settleUntil = now() + SERVICE_SETTLE_MS;
   for (;;) {
-    if (daemonServiceStatus() === "running") break;
-    if (Date.now() >= deadline) return false;
-    await new Promise((r) => setTimeout(r, SERVICE_START_POLL_MS));
+    // A unit that has left `running` is dead now; there is nothing to wait out.
+    if (status() !== "running") return false;
+    // A daemon that accepted a connection is a daemon that got past startup and
+    // bound its socket. Deliberately the CHEAP check, not a full hook
+    // evaluation: `probeDaemon` runs the end-to-end one moments later, and
+    // paying for it twice is what this rewrite exists to stop.
+    if (await accepts()) return true;
+    if (now() >= settleUntil) return true;
+    await sleep(SERVICE_START_POLL_MS);
   }
-  await new Promise((r) => setTimeout(r, SERVICE_SETTLE_MS));
-  return daemonServiceStatus() === "running";
 }
 
 // ── Upgrading a service definition that predates a variable ──────────────────
@@ -1125,7 +1180,7 @@ function installedExecStart(definition: string): string | null {
  * True when a service IS installed but its definition predates
  * `FAILPROOFAI_CLI_CMD`.
  *
- * Deliberately a content check against the definition on disk, not a revision
+ * Deliberately a content check against the definition on disk, not a version
  * number mirrored into `config.toml`. The mirror is the tempting shape — it is
  * how `daemon.installed_version` is modelled — but that field is declared,
  * read and cleared and has never once been WRITTEN (both `setDaemonConfigured`
diff --git a/src/hooks/flush-cli.ts b/src/hooks/flush-cli.ts
new file mode 100644
index 00000000..1c413bcd
--- /dev/null
+++ b/src/hooks/flush-cli.ts
@@ -0,0 +1,180 @@
+/**
+ * `failproofai flush` — deliver what is already spooled, now.
+ *
+ * The collector is built to be unhurried on purpose. A batch is swept only once
+ * it is older than two minutes, at most 64 per pass, on a 60-second cadence —
+ * pacing that keeps a backlog from stampeding a server and is exactly wrong for
+ * one case: somebody standing at a dashboard waiting to see their own events.
+ * They have no way to tell "not delivered yet" from "not working", and the
+ * honest answer is usually the first one.
+ *
+ * WHY A REQUEST FILE, not the work itself. The uploader's concurrency limiter
+ * and in-flight set live in the running daemon. A second uploader started by
+ * the CLI would share neither, so both would POST the same batch — the exact
+ * double-delivery `delivery.rs` keeps one shared `Delivery` to prevent. So this
+ * writes a request the daemon drains on its next tick.
+ *
+ * What it does NOT hand off is the checking — same rule as `backfill-cli.ts`.
+ * Every precondition a person can get wrong is verified here, synchronously,
+ * before returning success. A CLI that prints "requested" while the daemon is
+ * stopped has told the user the opposite of what happened.
+ */
+import { existsSync, mkdirSync, writeFileSync, readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { failproofaiHome, spoolDir } from "./fp-home";
+import { readConfig } from "./fp-config";
+import { readIngestCredential } from "./collector-config";
+import { daemonServiceStatus, isDaemonSupportedPlatform } from "./daemon-service";
+
+/** How long `--wait` blocks by default. */
+export const DEFAULT_FLUSH_TIMEOUT_SECS = 60;
+
+export interface FlushOptions {
+  wait?: boolean;
+  timeoutSecs?: number;
+  home?: string;
+  /** Injected in tests so the wait loop does not really sleep. */
+  sleep?: (ms: number) => Promise<void>;
+}
+
+export interface FlushResult {
+  exitCode: number;
+  lines: string[];
+  /** Batches still spooled when we stopped looking. */
+  pending: number;
+}
+
+/** Mirrored from the daemon's `paths::flush_request_path()`. */
+export function flushRequestPath(home?: string): string {
+  return join(failproofaiHome(home), "state", "flush-request.json");
+}
+
+/** Every directory the collector spools batches into. */
+function spoolDirs(home?: string): string[] {
+  const root = spoolDir(home);
+  if (!existsSync(root)) return [];
+  try {
+    return readdirSync(root, { withFileTypes: true })
+      .filter((e) => e.isDirectory() && e.name !== "failed")
+      .map((e) => join(root, e.name));
+  } catch {
+    return [];
+  }
+}
+
+/** Batches awaiting delivery. `.tmp` files are half-written and not counted. */
+export function pendingBatches(home?: string): number {
+  let n = 0;
+  for (const dir of spoolDirs(home)) {
+    try {
+      n += readdirSync(dir).filter((f) => f.endsWith(".jsonl")).length;
+    } catch {
+      // A directory that vanished mid-scan is one the collector just drained.
+    }
+  }
+  return n;
+}
+
+export async function runFlushCommand(opts: FlushOptions = {}): Promise<FlushResult> {
+  const { home, wait = false } = opts;
+  const timeoutSecs = opts.timeoutSecs ?? DEFAULT_FLUSH_TIMEOUT_SECS;
+  const sleep = opts.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
+  const lines: string[] = [];
+
+  // Preconditions, in the order that produces the most useful message. Each of
+  // these makes a flush a no-op, and each has a different remedy.
+  const cfg = readConfig();
+  if (!cfg.collector?.hooks && !cfg.collector?.sessions) {
+    return {
+      exitCode: 1,
+      pending: 0,
+      lines: [
+        "Collection is off, so nothing is spooled to flush.",
+        "Turn it on with `failproofai config`.",
+      ],
+    };
+  }
+
+  if (!readIngestCredential()) {
+    return {
+      exitCode: 1,
+      pending: 0,
+      lines: [
+        "This machine is not connected, so there is nowhere to flush to.",
+        "Connect it with `failproofai config`.",
+      ],
+    };
+  }
+
+  // Nothing on an unsupported platform will ever read the request file, so
+  // writing one and reporting success is a lie the user cannot detect: the
+  // command exits 0, the batches stay exactly where they were, and the only
+  // symptom is data that never arrives.
+  //
+  // Refusing here matches what `failproofai config` now does on the same
+  // platforms rather than completing unenforced — the two commands should not
+  // disagree about whether this machine has a daemon.
+  if (!isDaemonSupportedPlatform()) {
+    return {
+      exitCode: 1,
+      pending: pendingBatches(home),
+      lines: [
+        `failproofaid does not run on ${process.platform}, and it is what delivers batches.`,
+        "Nothing would pick this request up, so nothing was written.",
+      ],
+    };
+  }
+
+  const status = daemonServiceStatus();
+  if (status !== "running") {
+    return {
+      exitCode: 1,
+      pending: pendingBatches(home),
+      lines: [
+        `failproofaid is ${status}, and it is what delivers batches.`,
+        "Start it with `failproofai config`.",
+      ],
+    };
+  }
+
+  const before = pendingBatches(home);
+  if (before === 0) {
+    return { exitCode: 0, pending: 0, lines: ["Nothing spooled — everything already delivered."] };
+  }
+
+  const path = flushRequestPath(home);
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify({ requestedAtMs: Date.now() }, null, 2)}\n`, {
+    mode: 0o600,
+  });
+
+  lines.push(`${before} batch${before === 1 ? "" : "es"} spooled. Requested delivery.`);
+
+  if (!wait) {
+    lines.push("The daemon picks this up within a few seconds.");
+    return { exitCode: 0, pending: before, lines };
+  }
+
+  // `--wait` exists so a script can flush and then assert. Poll the spool
+  // rather than the server: the question is whether THIS machine still holds
+  // events, and the spool is the only place that can answer it locally.
+  const deadline = Date.now() + timeoutSecs * 1000;
+  let pending = before;
+  while (Date.now() < deadline) {
+    await sleep(1000);
+    pending = pendingBatches(home);
+    if (pending === 0) {
+      lines.push("Spool drained.");
+      return { exitCode: 0, pending: 0, lines };
+    }
+  }
+
+  // A timeout is not necessarily a failure — a large backlog legitimately takes
+  // longer than the budget — so say what is still outstanding rather than
+  // calling it broken.
+  lines.push(
+    `Still ${pending} batch${pending === 1 ? "" : "es"} spooled after ${timeoutSecs}s.`,
+    "Delivery continues in the background; re-run with a longer --timeout to keep watching.",
+  );
+  return { exitCode: 1, pending, lines };
+}
diff --git a/src/hooks/fp-config.ts b/src/hooks/fp-config.ts
index d220002f..504e5778 100644
--- a/src/hooks/fp-config.ts
+++ b/src/hooks/fp-config.ts
@@ -159,6 +159,25 @@ export interface FpConfig {
     redact: "minimal" | "off";
     environment: string;
     machineId?: string;
+    /**
+     * Extra locations to capture per harness, beyond the one each source ships
+     * with — `[collector.sources.<harness>] extra_paths` in `config.toml`.
+     *
+     * Each entry is `label=path` or a bare `path`; the label becomes an agent-id
+     * namespace (`<label>-<agentId>`), which is what keeps two copies of one
+     * project from merging into a single agent. The daemon is the authority on
+     * the grammar and on which harness names are real — see
+     * `crates/fpai-collect/src/extra_paths.rs` and `HARNESS_KEYS` in
+     * `crates/failproofaid/src/main.rs`. This side stores and edits the strings;
+     * it deliberately does not re-implement the parser, because two parsers is
+     * how the CLI comes to accept a path the daemon then silently drops.
+     *
+     * Absent for every machine that has not configured one, which is almost all
+     * of them — so `writeConfig` emits nothing at all in that case and a config
+     * file is byte-identical to what this version wrote before the field
+     * existed.
+     */
+    sources?: Record<string, { extraPaths: string[] }>;
   };
   telemetry: {
     /**
@@ -234,6 +253,32 @@ export const DEFAULT_CONFIG: FpConfig = {
   audit: { auto: false, intervalDays: DEFAULT_AUDIT_INTERVAL_DAYS },
 };
 
+/**
+ * `[collector.sources.*]` → the in-memory shape, dropping anything unusable.
+ *
+ * Entries are kept as written rather than normalised. The daemon parses them
+ * (label derivation, overlap rejection, `~` expansion) and reports what it
+ * rejected at startup; normalising here would give the two sides two answers
+ * and hide the daemon's rejection behind a value the CLI had already rewritten.
+ * The only things dropped are shapes that could not survive a round trip at
+ * all — a non-array, or a non-string element.
+ *
+ * `undefined` rather than `{}` when nothing is configured, so `writeConfig`
+ * emits no table and an untouched config file keeps its exact previous bytes.
+ */
+function readSources(raw: unknown): FpConfig["collector"]["sources"] {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return undefined;
+  const out: Record<string, { extraPaths: string[] }> = {};
+  for (const [name, table] of Object.entries(raw as Record<string, unknown>)) {
+    if (!table || typeof table !== "object" || Array.isArray(table)) continue;
+    const entries = (table as Record<string, unknown>).extra_paths;
+    if (!Array.isArray(entries)) continue;
+    const paths = entries.filter((e): e is string => typeof e === "string" && e.trim() !== "");
+    if (paths.length > 0) out[name] = { extraPaths: paths };
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}
+
 export function readConfig(): FpConfig {
   try {
     const parsed = parseToml(readFileSync(configFile(), "utf8")) as Record<string, unknown>;
@@ -258,6 +303,7 @@ export function readConfig(): FpConfig {
         environment:
           typeof collector.environment === "string" ? collector.environment : "local",
         machineId: typeof collector.machine_id === "string" ? collector.machine_id : undefined,
+        sources: readSources(collector.sources),
       },
       // Only an explicit `false` switches it off. Absent, or any other value,
       // reads as on — the shipped default, and what a config with no
@@ -308,6 +354,22 @@ export function writeConfig(config: FpConfig): void {
     `environment = ${JSON.stringify(c.environment)}`,
   );
   if (c.machineId) lines.push(`machine_id = ${JSON.stringify(c.machineId)}`);
+  // Sub-tables MUST come after every scalar of `[collector]`, or TOML reads the
+  // scalars that follow as belonging to the last sub-table opened. They are also
+  // emitted only when non-empty, so a machine that never configured one gets a
+  // file byte-identical to what this function produced before the field existed
+  // — the same reasoning as `[telemetry]` below.
+  for (const [name, src] of Object.entries(c.sources ?? {})) {
+    if (!src.extraPaths?.length) continue;
+    lines.push(
+      "",
+      `[collector.sources.${name}]`,
+      "# Extra locations to capture for this harness, beyond its default one.",
+      "# Each entry is \"label=path\" or a bare \"path\"; the label namespaces agent",
+      "# ids as <label>-<agentId> so two copies of one project stay distinct.",
+      `extra_paths = [${src.extraPaths.map((p) => JSON.stringify(p)).join(", ")}]`,
+    );
+  }
   // Written ONLY when switched off. A default install therefore carries no
   // [telemetry] block at all, but an operator who added one by hand keeps it:
   // writeConfig regenerates this file wholesale, so emitting the key only when
diff --git a/src/hooks/fp-home.ts b/src/hooks/fp-home.ts
index 73c87f18..6ccb5fe9 100644
--- a/src/hooks/fp-home.ts
+++ b/src/hooks/fp-home.ts
@@ -32,7 +32,7 @@
  *   bin/                     downloaded daemon binaries, one per version
  *   policies/
  *     local-policies/        the builtin enable/disable set
- *     cloud-policies/        content-addressed artifacts + active generation
+ *     cloud-policies/        content-addressed artifacts + active deployment
  *     custom-policies/       user convention policies (*.mjs)
  *   cursors/<source>/        per-source collector watermarks
  *   audit/                   audit report + per-session cache
@@ -135,7 +135,7 @@ export const localPoliciesDir = (home?: string) => atHome(home, "policies", "loc
 export const globalPolicyConfigFile = (home?: string) =>
   resolve(localPoliciesDir(home), "policies-config.json");
 
-/** Cloud-managed generations: `active.json` plus content-addressed artifacts. */
+/** Cloud-managed deployments: `active.json` plus content-addressed artifacts. */
 export const cloudPoliciesDir = (home?: string) => resolve(policiesDir(home), "cloud-policies");
 
 /** User convention policies (`*.mjs`) that load without any flag. */
@@ -341,6 +341,12 @@ export function resettablePaths(): string[] {
     // `custom-policies/` is deliberately absent from this list for the same
     // reason. Both directories below are re-derived: `local-policies/` by
     // setup, `cloud-policies/` by the next daemon poll.
+    //
+    // `local-policies/` holds ONE file — the user's enabled-policy selection —
+    // and clearing it on a layout migration is deliberate and tested. But it is
+    // also the destination `migratePolicyConfig()` carries layout 1's selection
+    // into, so the carry is written AFTER this list runs, and `resetHome` skips
+    // this entry when the reset is not a layout migration at all. See both.
     localPoliciesDir(),
     cloudPoliciesDir(),
     // `at("cursors")` is deliberately NOT here, and it is load-bearing for the
diff --git a/src/hooks/fp-reset.ts b/src/hooks/fp-reset.ts
index 57652826..c12ad567 100644
--- a/src/hooks/fp-reset.ts
+++ b/src/hooks/fp-reset.ts
@@ -29,14 +29,25 @@
  * user out of their agent entirely, with no way back except hand-editing JSON.
  * A loud warning that survives until setup runs is the proportionate answer.
  */
-import { copyFileSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync } from "node:fs";
-import { resolve } from "node:path";
+import {
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, resolve } from "node:path";
 import {
   LAYOUT_VERSION,
   customPoliciesDir,
   failproofaiHome,
+  globalPolicyConfigFile,
   hookActivityDir,
   legacy,
+  localPoliciesDir,
   policiesDir,
   resettablePaths,
 } from "./fp-home";
@@ -56,6 +67,8 @@ export interface ResetOutcome {
   migrated: string[];
   /** Basenames of decision-log pages carried into layout 2's `hook-activity/`. */
   activity: string[];
+  /** Keys of the layout-1 policy config carried into layout 2's. */
+  policyConfig: string[];
   /** The layout that was found before the reset. */
   from: number;
 }
@@ -202,6 +215,118 @@ export function migrateHookActivity(): string[] {
   return moved.sort((a, b) => a.localeCompare(b));
 }
 
+/**
+ * Fields of layout 1's `policies-config.json` that layout 2's still means.
+ *
+ * An allowlist, not a copy, and the exclusion is the point: layout 1's file
+ * ALSO carried a `collector` block, and layout 2 moved collector settings to
+ * `[collector]` in `config.toml` — in snake_case, deliberately, because
+ * `fpai-collect`'s `Settings` deserializes them and camelCase keys would make
+ * every field silently fall back to its default (see the note on `Settings` in
+ * `crates/fpai-collect/src/config.rs`, which records that exact bug). Carrying
+ * `collector` forward would put a block into the new file that nothing reads,
+ * where it would look like a preserved setting and behave like an absent one.
+ *
+ * The `llm` block moves because the loader still reads it from here, and its
+ * value is an endpoint and a model name a person configured by hand.
+ */
+const CARRIED_POLICY_CONFIG_KEYS = [
+  "enabledPolicies",
+  "customPoliciesPaths",
+  "customPoliciesPath",
+  "disabledCustomPolicies",
+  "conventionPolicies",
+  "disabledConventionPolicies",
+  "policyParams",
+  "llm",
+] as const;
+
+/**
+ * Carry the user's policy SELECTION across the layout-1 → layout-2 move.
+ *
+ * Layout 1 kept it at `~/.failproofai/policies-config.json`; layout 2 keeps it
+ * at `policies/local-policies/policies-config.json`, and both were on the reset
+ * list. So an upgrade silently emptied `enabledPolicies` — every builtin the
+ * user had turned on, every explicit `customPoliciesPaths` entry, and every
+ * per-policy parameter. The machine still read as configured afterwards
+ * (`isConfigured()` is a union that sees the agent CLIs' untouched settings
+ * files), so hooks kept firing against a policy set that had quietly become
+ * the default one. That is the same silent enforcement gap
+ * `migrateConventionPolicies()` exists to close, by a different route.
+ *
+ * This is deliberately NARROW. The standing decision for layout 1 is
+ * wipe-and-re-setup rather than migrate, because a half-migrated home that
+ * reads "no data" is worse than one that says so — see `legacy` in
+ * `fp-home.ts`. Everything derived (cursors, spool, health, audit cache) still
+ * goes and is rebuilt. What is carried is only what a person typed and nothing
+ * regenerates, which is the same test `migrateHookActivity()` applies to the
+ * decision log.
+ *
+ * # Two phases, because the source and the destination are BOTH on the list
+ *
+ * Unlike the two migrations above, this one cannot run entirely before the
+ * deletions. Its source (`legacy.policyConfig()`) is removed by them, and so is
+ * its destination's parent (`localPoliciesDir()`) — rightly, since clearing a
+ * stale selection on a layout migration is the documented behaviour. Writing
+ * first would have the reset delete the carry moments after it happened, which
+ * is exactly what the note on `hookActivityDir()` in `resettablePaths()` records
+ * happening once already.
+ *
+ * So: READ before, WRITE after.
+ */
+export function readCarriedPolicyConfig(): Record<string, unknown> | null {
+  const from = legacy.policyConfig();
+  // Checked HERE rather than at write time: by then the destination has been
+  // deleted along with its parent, so every home would look empty. A home
+  // already set up on layout 2 has a newer answer than the layout-1 file beside
+  // it, and a stale file winning would UNDO configuration, not preserve it.
+  if (!existsSync(from) || existsSync(globalPolicyConfigFile())) return null;
+
+  let parsed: Record<string, unknown>;
+  try {
+    parsed = JSON.parse(readFileSync(from, "utf8")) as Record<string, unknown>;
+  } catch {
+    // Unparseable is not worth aborting a reset over, and there is nothing to
+    // carry. The file is removed with the rest of layout 1, which is also what
+    // would have happened before this function existed.
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+
+  const carried: Record<string, unknown> = {};
+  let found = false;
+  for (const key of CARRIED_POLICY_CONFIG_KEYS) {
+    if (parsed[key] !== undefined) {
+      carried[key] = parsed[key];
+      found = true;
+    }
+  }
+  // Nothing worth carrying — a file holding only excluded fields must not
+  // produce an empty layout-2 config that looks like a real one.
+  if (!found) return null;
+
+  // `enabledPolicies` is required by the type and by every reader. A layout-1
+  // file that somehow lacked it would otherwise produce a layout-2 file that
+  // throws on read — worse than the empty default it replaces.
+  if (carried.enabledPolicies === undefined) carried.enabledPolicies = [];
+  return carried;
+}
+
+/** Second phase of {@link readCarriedPolicyConfig}; runs AFTER the deletions. */
+export function writeCarriedPolicyConfig(carried: Record<string, unknown> | null): string[] {
+  if (!carried) return [];
+  const to = globalPolicyConfigFile();
+  try {
+    mkdirSync(dirname(to), { recursive: true });
+    writeFileSync(to, JSON.stringify(carried, null, 2) + "\n", "utf8");
+  } catch {
+    // A destination we cannot write is not worth aborting the reset over; the
+    // user re-runs setup, which is the pre-existing behaviour.
+    return [];
+  }
+  return Object.keys(carried).sort((a, b) => a.localeCompare(b));
+}
+
 /**
  * Delete every path layout 1 or layout 2 could have written, then stamp
  * VERSION so the next run reads as current.
@@ -217,8 +342,17 @@ export function resetHome(from: number): ResetOutcome {
   // then walks over.
   const migrated = migrateConventionPolicies();
   const activity = migrateHookActivity();
+  const pendingPolicyConfig = readCarriedPolicyConfig();
   const removed: string[] = [];
   for (const path of resettablePaths()) {
+    // A reset FROM the current layout is not a layout migration, and the only
+    // thing under `local-policies/` is the user's enabled-policy selection.
+    // Clearing it is right when moving off an old layout (setup re-asks) and
+    // wrong when nothing is being migrated — there it would silently discard a
+    // current, valid selection, including one this function had just carried.
+    // The single production caller always passes a DETECTED stale layout, so
+    // this only ever changes the forced same-layout case.
+    if (from === LAYOUT_VERSION && path === localPoliciesDir()) continue;
     if (!existsSync(path)) continue;
     try {
       rmSync(path, { recursive: true, force: true });
@@ -229,8 +363,9 @@ export function resetHome(from: number): ResetOutcome {
       // directory from an old layout is inert once nothing reads it.
     }
   }
+  const policyConfig = writeCarriedPolicyConfig(pendingPolicyConfig);
   writeVersionFile();
-  return { removed, migrated, activity, from };
+  return { removed, migrated, activity, policyConfig, from };
 }
 
 export interface LayoutCheck {
diff --git a/src/hooks/handler.ts b/src/hooks/handler.ts
index c9afc5ce..c093afd5 100644
--- a/src/hooks/handler.ts
+++ b/src/hooks/handler.ts
@@ -254,13 +254,13 @@ export async function evaluateHookEvent(
     /** Registered policy name → where it came from. See the set() below. */
     const policyAttribution = new Map<
       string,
-      { source: "custom" | "convention" | "cloud"; cloudPolicyId?: string; cloudRevision?: number }
+      { source: "custom" | "convention" | "cloud"; cloudPolicyId?: string; cloudVersion?: number }
     >();
-    let cloudGeneration: number | undefined;
+    let cloudDeployment: number | undefined;
     /** What observe-mode policies WOULD have done, had they been enforcing. */
     const observedResults: Array<{
       policyId: string;
-      revision: number;
+      version: number;
       decision: "deny" | "instruct";
       reason: string | null;
     }> = [];
@@ -293,7 +293,7 @@ export async function evaluateHookEvent(
 
       // Cloud-managed policies are daemon-reconciled artifacts, but they use
       // the same public JS policy API as local custom policies. Verify and add
-      // only the paths referenced by the atomically active generation.
+      // only the paths referenced by the atomically active deployment.
       //
       // Wrapped, like `readConfigAt` and `readActivePause` above it. This call
       // has fourteen throw sites — a malformed manifest, an unsafe id, an
@@ -332,7 +332,7 @@ export async function evaluateHookEvent(
       // policy decided this event: "what was deployed here at the time" is a
       // separate question from "what decided", and only the former can tell a
       // rollout that changed nothing from one that never reached the machine.
-      cloudGeneration = cloudManagedPolicies[0]?.generation;
+      cloudDeployment = cloudManagedPolicies[0]?.deployment;
       const configuredCustomPaths = config.customPoliciesPaths ?? config.customPoliciesPath;
       const allExplicitPaths =
         cloudManagedPolicies.length === 0
@@ -368,7 +368,7 @@ export async function evaluateHookEvent(
         const conventionScope = (hook as CustomHook & { __conventionScope?: string }).__conventionScope;
         const isConvention = !!conventionScope;
         const prefix = cloudManaged
-          ? `cloud/${cloudManaged.id}@${cloudManaged.revision}`
+          ? `cloud/${cloudManaged.id}@${cloudManaged.version}`
           : isConvention
             ? `.failproofai-${conventionScope}`
             : "custom";
@@ -383,7 +383,7 @@ export async function evaluateHookEvent(
             if (shadow.decision !== "allow") {
               observedResults.push({
                 policyId: cloudManaged!.id,
-                revision: cloudManaged!.revision,
+                version: cloudManaged!.version,
                 decision: shadow.decision,
                 reason: shadow.reason ?? null,
               });
@@ -419,7 +419,7 @@ export async function evaluateHookEvent(
         // this decision", could only be answered by re-parsing our own label.
         policyAttribution.set(registeredName, {
           source: cloudManaged ? "cloud" : isConvention ? "convention" : "custom",
-          ...(cloudManaged ? { cloudPolicyId: cloudManaged.id, cloudRevision: cloudManaged.revision } : {}),
+          ...(cloudManaged ? { cloudPolicyId: cloudManaged.id, cloudVersion: cloudManaged.version } : {}),
         });
         registerPolicy(
           registeredName,
@@ -497,13 +497,13 @@ export async function evaluateHookEvent(
             return {
               policySource: attribution?.source ?? ("builtin" as const),
               ...(attribution?.cloudPolicyId ? { cloudPolicyId: attribution.cloudPolicyId } : {}),
-              ...(attribution?.cloudRevision !== undefined
-                ? { cloudRevision: attribution.cloudRevision }
+              ...(attribution?.cloudVersion !== undefined
+                ? { cloudVersion: attribution.cloudVersion }
                 : {}),
             };
           })()
         : {}),
-      ...(cloudGeneration !== undefined ? { cloudGeneration } : {}),
+      ...(cloudDeployment !== undefined ? { cloudDeployment } : {}),
       // The point of observe mode is this record. Without it the rollout is
       // unmeasurable and the row is indistinguishable from one where the policy
       // never matched at all.
diff --git a/src/hooks/harness-cli.ts b/src/hooks/harness-cli.ts
new file mode 100644
index 00000000..8f1318d7
--- /dev/null
+++ b/src/hooks/harness-cli.ts
@@ -0,0 +1,309 @@
+/**
+ * `failproofai harness` — manage extra capture paths per harness.
+ *
+ * Each supported agent CLI has one location its own installer put it in, and
+ * the collector watches that. This command adds others: a second profile, a
+ * bind-mounted team share, a container's home mapped in beside the host's, an
+ * agent an operator relocated. Those hold real sessions and nothing collected
+ * them.
+ *
+ * # This file edits config; the daemon decides what the config means
+ *
+ * Entries are stored as written. The grammar (`label=path`, folder-name
+ * fallback), `~` expansion, overlap rejection and the `<label>-<agentId>`
+ * namespacing all live in `crates/fpai-collect/src/extra_paths.rs`, and the
+ * daemon reports what it rejected at startup. Re-implementing any of that here
+ * would give one product two parsers, and the way that fails is the CLI
+ * accepting a path the daemon then silently drops — which is indistinguishable
+ * from the feature working.
+ *
+ * The one thing validated here is the HARNESS NAME, because that failure has no
+ * other detector: `[collector.sources.claud]` is valid TOML, parses cleanly,
+ * captures nothing, and is mentioned nowhere else a user would look.
+ *
+ * # No restart, and no sudo
+ *
+ * This writes one file in the user's own home and nothing else. The daemon's
+ * collector manager re-reads `config.toml` on an interval and cycles the
+ * collector whenever the resolved `CollectorConfig` changes — the same path
+ * that already picks up `--connect`, a stream being switched off, and a
+ * verbosity change. `extra_paths` rides it for free by living inside
+ * `Settings`, which is part of the value being compared. That is load-bearing
+ * rather than incidental, and `collector_config_change_cycles_the_collector`
+ * in `crates/fpai-collect/src/config.rs` pins it: move `sources` out of
+ * `CollectorConfig` and the CLI would keep reporting success for paths the
+ * running daemon never picks up.
+ */
+
+import { readConfig, updateConfig } from "./fp-config";
+import { configFile } from "./fp-home";
+
+/**
+ * Harness keys `[collector.sources.<key>]` accepts.
+ *
+ * MUST stay in step with `HARNESS_KEYS` in `crates/failproofaid/src/main.rs`,
+ * which is the side that actually registers the tasks. A name here that the
+ * daemon does not know configures a table nothing reads; a name the daemon
+ * knows and this list omits is a path the user cannot add. `__tests__` asserts
+ * the two lists are identical by reading the Rust source, because nothing else
+ * connects them.
+ *
+ * Twelve keys, thirteen sources: `claude` covers both the main and the subagent
+ * transcript formats, which share a root — an extra path holding Claude
+ * transcripts holds their subagents too.
+ */
+export const HARNESS_KEYS = [
+  "claude",
+  "codex",
+  "copilot",
+  "openclaw",
+  "pi",
+  "factory",
+  "antigravity",
+  "cursor",
+  "goose",
+  "opencode",
+  "devin",
+  "hermes",
+] as const;
+
+export type HarnessKey = (typeof HARNESS_KEYS)[number];
+
+export interface HarnessResult {
+  lines: string[];
+  exitCode: number;
+}
+
+const ok = (lines: string[]): HarnessResult => ({ lines, exitCode: 0 });
+const fail = (lines: string[]): HarnessResult => ({ lines, exitCode: 1 });
+
+function unknownHarness(name: string): HarnessResult {
+  return fail([
+    `Unknown harness: ${name}`,
+    "",
+    `Known harnesses: ${HARNESS_KEYS.join(", ")}`,
+  ]);
+}
+
+/** The path half of an entry, for comparing against what a user typed. */
+function pathOf(entry: string): string {
+  const eq = entry.indexOf("=");
+  if (eq <= 0) return entry.trim();
+  const label = entry.slice(0, eq).trim();
+  return label === "" ? entry.trim() : entry.slice(eq + 1).trim();
+}
+
+/** The label half, or `null` when the entry did not name one. */
+function labelOf(entry: string): string | null {
+  const eq = entry.indexOf("=");
+  if (eq <= 0) return null;
+  const label = entry.slice(0, eq).trim();
+  return label === "" ? null : label;
+}
+
+function currentPaths(harness: string): string[] {
+  return readConfig().collector.sources?.[harness]?.extraPaths ?? [];
+}
+
+function writePaths(harness: string, paths: string[]): void {
+  const cfg = readConfig();
+  const sources = { ...(cfg.collector.sources ?? {}) };
+  if (paths.length > 0) sources[harness] = { extraPaths: paths };
+  else delete sources[harness];
+  updateConfig({
+    collector: {
+      ...cfg.collector,
+      // `undefined` rather than `{}` when the last entry goes, so removing what
+      // you added leaves the file as it was rather than carrying an empty table
+      // forever.
+      sources: Object.keys(sources).length > 0 ? sources : undefined,
+    },
+  });
+}
+
+/**
+ * No restart, and deliberately no instruction to perform one.
+ *
+ * The daemon's collector manager re-reads `config.toml` on an interval and
+ * cycles the collector whenever the resolved `CollectorConfig` changes — the
+ * same path that already picks up `--connect`, a stream being switched off and
+ * a verbosity change. `extra_paths` rides that for free because it lives inside
+ * `Settings`, which lives inside the value being compared.
+ *
+ * Verified live: adding a path to a running daemon logged "collector
+ * configuration changed; cycling the collector", took the task count from 21 to
+ * 23, and the first transcript written under the new path reached the server.
+ *
+ * This said "run `sudo systemctl restart failproofaid@$USER`" first. That was
+ * wrong twice over: the restart is unnecessary, and it asks for root from a
+ * command that writes one file in the user's own home and needs none.
+ */
+const TAKES_EFFECT_HINT = [
+  "",
+  "The daemon picks this up on its own within a few seconds — no restart, no sudo.",
+];
+
+export function addPath(harness: string, entry: string): HarnessResult {
+  if (!(HARNESS_KEYS as readonly string[]).includes(harness)) return unknownHarness(harness);
+  const trimmed = entry.trim();
+  if (trimmed === "") return fail(["A path is required."]);
+  if (pathOf(trimmed) === "") {
+    return fail([`Could not read a path out of ${JSON.stringify(entry)}.`, "", "Use `<path>` or `<label>=<path>`."]);
+  }
+
+  const existing = currentPaths(harness);
+
+  // Exact duplicate: succeed rather than error. `add-path` run twice from a
+  // provisioning script must not fail the second time.
+  if (existing.includes(trimmed)) {
+    return ok([`${harness}: ${trimmed} is already configured.`]);
+  }
+
+  // Same path under a different label, or the same label on a different path.
+  // Both are rejected HERE rather than left to the daemon, because the daemon
+  // resolves them at startup and drops one — so the CLI would report success
+  // for a path that is never captured.
+  const samePath = existing.find((e) => pathOf(e) === pathOf(trimmed));
+  if (samePath) {
+    return fail([
+      `${harness} already captures ${pathOf(trimmed)} as ${JSON.stringify(samePath)}.`,
+      "",
+      "Remove it first if you meant to relabel it:",
+      `  failproofai harness remove-path ${harness} ${pathOf(trimmed)}`,
+    ]);
+  }
+  const wanted = labelOf(trimmed);
+  if (wanted) {
+    const sameLabel = existing.find((e) => labelOf(e) === wanted);
+    if (sameLabel) {
+      return fail([
+        `${harness} already uses the label ${JSON.stringify(wanted)} for ${pathOf(sameLabel)}.`,
+        "",
+        "Labels namespace agent ids, so two paths cannot share one.",
+      ]);
+    }
+  }
+
+  writePaths(harness, [...existing, trimmed]);
+  return ok([
+    `${harness}: now also capturing ${pathOf(trimmed)}`,
+    wanted
+      ? `  agent ids will be namespaced ${wanted}-*`
+      : "  a label will be derived from the folder name; `failproofai harness list` shows it",
+    `  written to ${configFile()}`,
+    ...TAKES_EFFECT_HINT,
+  ]);
+}
+
+export function removePath(harness: string, target: string): HarnessResult {
+  if (!(HARNESS_KEYS as readonly string[]).includes(harness)) return unknownHarness(harness);
+  const existing = currentPaths(harness);
+  const t = target.trim();
+  // Match on the whole entry, on its path, or on its label — a user removing
+  // something is working from what `list` printed, which shows all three.
+  const kept = existing.filter((e) => e !== t && pathOf(e) !== t && labelOf(e) !== t);
+  if (kept.length === existing.length) {
+    return fail([
+      `${harness} has no extra path matching ${JSON.stringify(t)}.`,
+      "",
+      existing.length > 0
+        ? `Configured: ${existing.join(", ")}`
+        : `${harness} has no extra paths configured.`,
+    ]);
+  }
+  writePaths(harness, kept);
+  return ok([
+    `${harness}: no longer capturing ${t}`,
+    "",
+    "Already-collected sessions from that path are NOT removed — they are on the",
+    "server. This only stops new ones.",
+    ...TAKES_EFFECT_HINT,
+  ]);
+}
+
+export function listPaths(harness?: string): HarnessResult {
+  if (harness && !(HARNESS_KEYS as readonly string[]).includes(harness)) return unknownHarness(harness);
+  const sources = readConfig().collector.sources ?? {};
+  const names: string[] = harness
+    ? [harness]
+    : HARNESS_KEYS.filter((k) => sources[k]?.extraPaths?.length);
+
+  // Computed BEFORE the empty-state return, not after. A config whose only
+  // tables are typos has no known harness configured, so the early return fired
+  // and the warning below was unreachable in precisely the case it exists for —
+  // the user sees "No extra capture paths configured" while their file plainly
+  // contains one, which is the most confusing possible answer.
+  const unknown = Object.keys(sources).filter(
+    (k) => !(HARNESS_KEYS as readonly string[]).includes(k),
+  );
+
+  if (names.length === 0 && unknown.length === 0) {
+    return ok([
+      "No extra capture paths configured.",
+      "",
+      "Every harness is watching only its default location. Add one with:",
+      "  failproofai harness add-path <harness> [<label>=]<path>",
+      "",
+      `Harnesses: ${HARNESS_KEYS.join(", ")}`,
+    ]);
+  }
+
+  const lines: string[] = [];
+  for (const name of names) {
+    const entries = sources[name]?.extraPaths ?? [];
+    if (entries.length === 0) {
+      if (harness) lines.push(`${name}: no extra paths configured (default location only)`);
+      continue;
+    }
+    lines.push(`${name}:`);
+    for (const e of entries) {
+      const label = labelOf(e);
+      lines.push(
+        label
+          ? `  ${pathOf(e)}   → agent ids ${label}-*`
+          : `  ${pathOf(e)}   → label derived from the folder name`,
+      );
+    }
+  }
+  // Unknown tables are surfaced here as well as by the daemon: a user who
+  // hand-edited config.toml runs `list` to check it, and that is the moment the
+  // typo is cheapest to find.
+  if (unknown.length > 0) {
+    if (lines.length === 0) lines.push("No extra capture paths configured for any known harness.");
+    lines.push(
+      "",
+      `⚠ config.toml configures ${unknown.length} unknown harness(es): ${unknown.join(", ")}`,
+      "  Nothing is captured from them.",
+      `  Known: ${HARNESS_KEYS.join(", ")}`,
+    );
+  }
+  return ok(lines);
+}
+
+/** Dispatch for `failproofai harness <sub> ...`. */
+export function runHarnessCommand(argv: string[]): HarnessResult {
+  const [sub, ...rest] = argv;
+  switch (sub) {
+    case "add-path":
+      if (rest.length < 2) {
+        return fail(["Usage: failproofai harness add-path <harness> [<label>=]<path>"]);
+      }
+      return addPath(rest[0], rest.slice(1).join(" "));
+    case "remove-path":
+      if (rest.length < 2) {
+        return fail(["Usage: failproofai harness remove-path <harness> <path|label>"]);
+      }
+      return removePath(rest[0], rest.slice(1).join(" "));
+    case "list":
+      return listPaths(rest[0]);
+    default:
+      return fail([
+        sub ? `Unknown subcommand: ${sub}` : "A subcommand is required.",
+        "",
+        "Usage:",
+        "  failproofai harness list [<harness>]",
+        "  failproofai harness add-path <harness> [<label>=]<path>",
+        "  failproofai harness remove-path <harness> <path|label>",
+      ]);
+  }
+}
diff --git a/src/hooks/hook-activity-store.ts b/src/hooks/hook-activity-store.ts
index 2a958726..07c875fa 100644
--- a/src/hooks/hook-activity-store.ts
+++ b/src/hooks/hook-activity-store.ts
@@ -99,16 +99,16 @@ export interface HookActivityEntry {
   policySource?: "builtin" | "custom" | "convention" | "cloud";
   /** Cloud policy id of the decider. Present only when `policySource` is "cloud". */
   cloudPolicyId?: string;
-  /** Immutable revision of that policy — the half of attribution that identifies WHICH version ran. */
-  cloudRevision?: number;
+  /** Immutable version of that policy — the half of attribution that identifies WHICH version ran. */
+  cloudVersion?: number;
   /**
-   * The cloud generation active when this event was evaluated, recorded on
+   * The cloud deployment active when this event was evaluated, recorded on
    * every row of a managed machine regardless of what decided. "What was
    * deployed here" is a different question from "what decided", and only this
    * distinguishes a rollout that changed no outcomes from one that never
    * arrived.
    */
-  cloudGeneration?: number;
+  cloudDeployment?: number;
   /**
    * What observe-mode policies WOULD have done, had they been enforcing. This
    * record is the entire point of observe mode: without it the row is
@@ -117,7 +117,7 @@ export interface HookActivityEntry {
    */
   observed?: Array<{
     policyId: string;
-    revision: number;
+    version: number;
     decision: "deny" | "instruct";
     reason: string | null;
   }>;
diff --git a/src/hooks/manager.ts b/src/hooks/manager.ts
index 1202f6ee..96abc3c2 100644
--- a/src/hooks/manager.ts
+++ b/src/hooks/manager.ts
@@ -25,6 +25,7 @@ import { getInstanceId, hashToId } from "../../lib/telemetry-id";
 import { CliError } from "../cli-error";
 import { hookLogWarn } from "./hook-logger";
 import { customPoliciesDir, globalPolicyConfigFile } from "./fp-home";
+import { readActiveCloudManagedPolicies } from "./cloud-managed-policies";
 
 const VALID_POLICY_NAMES = new Set(BUILTIN_POLICIES.map((p) => p.name));
 
@@ -839,6 +840,40 @@ export async function listHooks(cwd?: string): Promise<void> {
     console.log();
   }
 
+  // Cloud-managed policies. These enforce on this machine exactly like the two
+  // sections above, but nothing here listed them — so `failproofai policies`
+  // answered "what is enforcing?" with a subset, and the policies an operator
+  // pushed to a fleet were the ones invisible to the person running the
+  // command on it.
+  //
+  // Read-only on purpose: these are owned by the deployment, not by local
+  // config. `--uninstall <name>` cannot switch one off, and printing them
+  // beside toggleable rows without saying so would imply it can.
+  try {
+    const cloud = readActiveCloudManagedPolicies();
+    if (cloud.length > 0) {
+      const gen = cloud[0].deployment;
+      console.log(
+        `\n  \u2500\u2500 Cloud-managed \u2014 deployment ${gen} \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`,
+      );
+      const colWidth = Math.max(nameColWidth, ...cloud.map((c) => c.id.length + 2));
+      for (const artifact of cloud) {
+        // `observe` is evaluated and then has its verdict discarded, so a row
+        // that read "ON" would claim enforcement this policy deliberately is
+        // not doing.
+        const status =
+          artifact.effect === "observe" ? "\x1B[33m\u25D0 OBS\x1B[0m" : "\x1B[32m\u2713 ON\x1B[0m";
+        console.log(`  ${status}    ${artifact.id.padEnd(colWidth)}v${artifact.version}`);
+      }
+      console.log("\n  Managed from the dashboard \u2014 not switchable with `failproofai policies`.");
+      console.log();
+    }
+  } catch {
+    // A machine with no deployment, or an unreadable manifest, simply has no
+    // section. The hook path reports its own failures; a listing must not be
+    // the thing that turns a bad manifest into a broken command.
+  }
+
   // Mirror what was just listed into the USER config. Safe here because
   // `failproofai policies` is a one-shot command — never do this on the hook
   // path (see the HooksConfig.conventionPolicies doc comment).
diff --git a/src/hooks/tui.ts b/src/hooks/tui.ts
index 5758d92f..4e4ee709 100644
--- a/src/hooks/tui.ts
+++ b/src/hooks/tui.ts
@@ -34,6 +34,8 @@ export interface SelectChoice<T> {
 }
 
 export interface SelectOneOptions<T> {
+  /** Offer ← to go back a step. The caller must handle `BACK`. */
+  allowBack?: boolean;
   message: string;
   choices: SelectChoice<T>[];
   /** Static info lines rendered under the question (e.g. a review summary). */
@@ -64,6 +66,8 @@ export interface MultiChoice<T> {
 }
 
 export interface MultiSelectOptions<T> {
+  /** Offer ← to go back a step. The caller must handle `BACK`. */
+  allowBack?: boolean;
   message: string;
   choices: MultiChoice<T>[];
   minSelected?: number;
@@ -423,6 +427,8 @@ interface PromptSpec<R> {
   renderRow: (index: number, active: boolean, budget: number) => string;
   /** Extra line(s) above the footer (e.g. a min-selected warning). */
   warnLine?: () => string | null;
+  /** When set, ← resolves `BACK` so the caller can step backwards. */
+  allowBack?: boolean;
   footer: string;
   /** Handle non-navigation keys. `{done}` finishes, `"redraw"` repaints. */
   onKey: (key: readline.Key, cursor: number) => { done: R } | "redraw" | undefined;
@@ -469,10 +475,21 @@ function runPrompt<R>(p: PromptSpec<R>): Promise<R | null> {
   };
 
   const collapse = (result: R | null): void => {
+    // BACK is handled HERE, not in each `summaryFor`, because it is not a value
+    // of `R` at all — it is a sentinel the shared key handler injects, so every
+    // prompt would otherwise have to know about a symbol it never declared.
+    //
+    // Both existing callers got it wrong in different ways, and one of them
+    // hung: `multiSelect`'s summary calls `values.includes(...)`, which throws
+    // `TypeError` on a symbol — and it throws INSIDE `finish`, before
+    // `resolve(result)`, so pressing ← never settled the promise and the wizard
+    // stopped responding entirely. `selectOne` fell through to `String(value)`
+    // and rendered the literal text `Symbol(failproofai.back)`.
+    const summary = (result as unknown) === BACK ? "back" : p.summaryFor(result);
     repaint(stdout, region, [
       c.dim(BAR),
       `${c.dim(STEP_DONE)}  ${p.message}`,
-      `${c.dim(BAR)}  ${c.dim(p.summaryFor(result))}`,
+      `${c.dim(BAR)}  ${c.dim(summary)}`,
     ]);
   };
 
@@ -500,6 +517,10 @@ function runPrompt<R>(p: PromptSpec<R>): Promise<R | null> {
       if (!key) return;
       if ((key.ctrl && (key.name === "c" || key.name === "d")) || key.name === "escape") {
         finish(null);
+      } else if (key.name === "left" && p.allowBack) {
+        // Only when the caller opted in. A prompt with nowhere to go back TO
+        // must not appear to offer it.
+        finish(BACK as unknown as never);
       } else if (key.name === "up") {
         cursor = cursor > 0 ? cursor - 1 : choices.length - 1;
         repaint(stdout, region, build());
@@ -519,7 +540,24 @@ function runPrompt<R>(p: PromptSpec<R>): Promise<R | null> {
 
 // ── selectOne (radio) ─────────────────────────────────────────────────────────
 
-export function selectOne<T>(opts: SelectOneOptions<T>): Promise<T | null> {
+/**
+ * Returned by a prompt when the user asked to go BACK a step, as distinct from
+ * cancelling. Both used to be `null`, which made "I picked the wrong scope" and
+ * "I want out" the same keystroke — so the only way to change an earlier answer
+ * was to abandon setup and start over.
+ *
+ * A symbol rather than a sentinel string because a caller's value type is its
+ * own: `selectOne<string>` could legitimately have "back" as a real choice.
+ */
+export const BACK: unique symbol = Symbol("failproofai.back");
+export type Back = typeof BACK;
+
+// Overloaded so `BACK` appears in the return type ONLY where it was asked for.
+// Widening every caller to `T | Back | null` would make dozens of call sites
+// handle a value they can never receive.
+export function selectOne<T>(opts: SelectOneOptions<T> & { allowBack: true }): Promise<T | Back | null>;
+export function selectOne<T>(opts: SelectOneOptions<T>): Promise<T | null>;
+export function selectOne<T>(opts: SelectOneOptions<T>): Promise<T | Back | null> {
   const stdin: TTYIn = opts.stdin ?? process.stdin;
   const stdout: TTYOut = opts.stdout ?? process.stdout;
   const choices = opts.choices;
@@ -550,7 +588,10 @@ export function selectOne<T>(opts: SelectOneOptions<T>): Promise<T | null> {
       const hint = choice.hint ? `  ${c.dim(ellipsize(choice.hint, budget))}` : "";
       return `${dot} ${label}${hint}`;
     },
-    footer: "↑/↓ navigate · enter to select · esc to cancel",
+    allowBack: opts.allowBack,
+    footer: opts.allowBack
+      ? "↑/↓ navigate · enter to select · ← back · esc to cancel"
+      : "↑/↓ navigate · enter to select · esc to cancel",
     onKey: (key, cursor) =>
       key.name === "return" ? { done: choices[cursor].value } : undefined,
     summaryFor: (value) =>
@@ -562,7 +603,9 @@ export function selectOne<T>(opts: SelectOneOptions<T>): Promise<T | null> {
 
 // ── multiSelect (checklist) ────────────────────────────────────────────────────
 
-export function multiSelect<T>(opts: MultiSelectOptions<T>): Promise<T[] | null> {
+export function multiSelect<T>(opts: MultiSelectOptions<T> & { allowBack: true }): Promise<T[] | null | Back>;
+export function multiSelect<T>(opts: MultiSelectOptions<T>): Promise<T[] | null>;
+export function multiSelect<T>(opts: MultiSelectOptions<T>): Promise<T[] | null | Back> {
   const stdin: TTYIn = opts.stdin ?? process.stdin;
   const stdout: TTYOut = opts.stdout ?? process.stdout;
   const choices = opts.choices;
@@ -604,7 +647,12 @@ export function multiSelect<T>(opts: MultiSelectOptions<T>): Promise<T[] | null>
       return `${caret} ${box} ${label}${hint}`;
     },
     warnLine: () => (warn ? c.warn(`Select at least ${minSelected}.`) : null),
-    footer: opts.hint ?? "↑/↓ move · space select · ctrl+a all · enter confirm",
+    allowBack: opts.allowBack,
+    footer:
+      opts.hint ??
+      (opts.allowBack
+        ? "↑/↓ move · space select · ctrl+a all · ← back · enter confirm"
+        : "↑/↓ move · space select · ctrl+a all · enter confirm"),
     onKey: (key, cursor) => {
       if (key.name === "space") {
         if (choices[cursor]?.locked) return "redraw"; // always on — not a choice
@@ -705,10 +753,19 @@ export function promptText(opts: PromptTextOptions): Promise<string | null> {
   return new Promise((resolve) => {
     let value = "";
     const draw = (error?: string) => {
+      const cols = stdout.columns || 80;
       const shown = opts.mask ? "•".repeat(value.length) : value;
       const hint = opts.hint ? `  ${c.dim(opts.hint)}` : "";
-      const err = error ? `\n  ${c.warn(error)}` : "";
-      stdout.write(`\r\x1b[2K${c.bold(opts.message)} ${shown}${hint}${err}`);
+      // Truncate to ONE physical row. `\r\x1b[2K` erases the row the cursor is
+      // on and nothing above it — so a line wider than the terminal wraps, the
+      // erase reaches only its last row, and every keystroke leaves the earlier
+      // rows behind. That is why pasting a 40-character API key printed 40
+      // stacked copies of the prompt: `API key for <host>` plus the masked
+      // value plus the `needs events:add · policies:pull …` hint is past 80
+      // columns before the key is even half typed.
+      const line = truncate(`${c.bold(opts.message)} ${shown}${hint}`, cols - 1);
+      const err = error ? `\n  ${truncate(c.warn(error), cols - 3)}` : "";
+      stdout.write(`\r\x1b[2K${line}${err}`);
       if (err) stdout.write("\x1b[1A");
     };
     draw();