diff --git a/TUI/catalog.zig b/TUI/catalog.zig
index 3ed02ab6..0e045055 100644
--- a/TUI/catalog.zig
+++ b/TUI/catalog.zig
@@ -31,6 +31,8 @@ pub const items = [_]Item{
     .{ .name = "/plan", .desc = "Toggle plan mode" },
     .{ .name = "/theme", .desc = "Switch color theme", .aliases = &.{"/t"} },
     .{ .name = "/goal", .desc = "Set a standing objective" },
+    .{ .name = "/schedule", .desc = "Fire a prompt later (30s/5m/2h)" },
+    .{ .name = "/adapter", .desc = "Channel-worker send / inbox" },
     .{ .name = "/thinking", .desc = "Show live reasoning" },
     .{ .name = "/fast", .desc = "Priority service tier" },
     .{ .name = "/ultracode", .desc = "Persistent workflow mode", .aliases = &.{"/ult"} },
@@ -41,6 +43,8 @@ pub const items = [_]Item{
     .{ .name = "/jump", .desc = "Jump to a previous turn" },
     .{ .name = "/copy", .desc = "Copy the last reply to the clipboard" },
     .{ .name = "/btw", .desc = "Queue an aside without interrupting" },
+    .{ .name = "/tell", .desc = "Message a running graff (/tell all broadcasts)" },
+    .{ .name = "/peek", .desc = "See what a live session is doing" },
     .{ .name = "/vim-mode", .desc = "Vim keys in the scrollback", .aliases = &.{"/vim"} },
     .{ .name = "/help", .desc = "List commands" },
     .{ .name = "/doctor", .desc = "Health check" },
@@ -99,6 +103,8 @@ test "filter: slash prefix and alias" {
     try std.testing.expect(lookup("/debug") != null);
     try std.testing.expect(lookup("/cache") != null);
     try std.testing.expect(lookup("/cost") != null);
+    try std.testing.expect(lookup("/tell") != null);
+    try std.testing.expect(lookup("/peek") != null);
     try std.testing.expect(lookup("/not-a-cmd") == null);
 }
 
diff --git a/TUI/dispatch.zig b/TUI/dispatch.zig
index 43754dd9..e7ddb2c2 100644
--- a/TUI/dispatch.zig
+++ b/TUI/dispatch.zig
@@ -7,6 +7,7 @@ const app = @import("app.zig");
 const bgop = @import("bgop.zig");
 const catalog = @import("catalog.zig");
 const engine = @import("engine.zig");
+const peer_cmd = @import("peer_cmd.zig");
 const meters = @import("meters.zig");
 const theme_mod = @import("theme.zig");
 const turn = @import("turn.zig");
@@ -188,6 +189,8 @@ pub fn runCommand(self: *Model, line: []const u8) Effect {
         self.pushFmt(.system, "vim scrollback: {s}", .{onOff(self.vim_mode)}) catch {};
     } else if (std.mem.eql(u8, canon, "/copy")) {
         copyLastReply(self);
+    } else if (std.mem.eql(u8, canon, "/tell") or std.mem.eql(u8, canon, "/peek")) {
+        peer_cmd.run(self, canon, arg);
     } else if (std.mem.eql(u8, canon, "/btw")) {
         if (arg.len == 0) {
             self.push(.system, "usage: /btw <aside> — queue a note without interrupting") catch {};
diff --git a/TUI/engine.zig b/TUI/engine.zig
index c8f0b253..efa90405 100644
--- a/TUI/engine.zig
+++ b/TUI/engine.zig
@@ -176,6 +176,12 @@ pub var g_raw: ?*StreamBuf = null;
 pub const IdleWakeFn = *const fn (turn_ctx: ?*anyopaque, buf: []u8) ?[]const u8;
 pub var g_idle_wake_fn: ?IdleWakeFn = null;
 
+/// Run a peer-talk slash (`/tell`, `/peek`) on the live agent. The TUI does
+/// not post to the room itself — the host implements this with the existing
+/// mailbox (`tellCommand` / `peekCommand`). Caller frees the returned text.
+pub const PeerFn = *const fn (turn_ctx: ?*anyopaque, gpa: std.mem.Allocator, line: []const u8) ?[]const u8;
+pub var g_peer_fn: ?PeerFn = null;
+
 /// A background engine op: `/compact`, `!cmd`, or the @-file list. Same
 /// thread + done-flag contract as Job, so the render+input loop keeps painting
 /// and Esc keeps reaching keys.handle while the engine works (#533). Every
@@ -244,6 +250,7 @@ pub const RunOpts = struct {
     compact_fn: ?CompactFn = null,
     history_fn: ?HistoryFn = null,
     idle_wake_fn: ?IdleWakeFn = null,
+    peer_fn: ?PeerFn = null,
 };
 
 pub var g_turn_fn: ?TurnFn = null;
diff --git a/TUI/overlaypane.zig b/TUI/overlaypane.zig
index acb4cb14..77e8e393 100644
--- a/TUI/overlaypane.zig
+++ b/TUI/overlaypane.zig
@@ -256,6 +256,8 @@ const help_body =
     \\  /jump             jump to a previous turn
     \\  /copy             copy the last reply
     \\  /btw              queue an aside mid-turn
+    \\  /tell             message a live graff (/tell all broadcasts)
+    \\  /peek             see what a live session is doing
     \\  /vim-mode         vim keys in the scrollback
 ;
 
@@ -270,11 +272,11 @@ test "help overlay names the advertised pager commands" {
     defer arena.deinit();
     const text = try overlay(&m, arena.allocator(), 80);
     for ([_][]const u8{
-        "/quit",     "/help", "/new", "/home", "/model", "/settings", "/usage", "/debug", "/cache", "/plan", "/always-approve",
-        "Shift+Tab", "PgUp",  "PgDn",
+        "/quit", "/help", "/new",      "/home", "/model", "/settings", "/usage", "/debug", "/cache", "/plan", "/always-approve",
+        "/tell", "/peek", "Shift+Tab", "PgUp",  "PgDn",
         "←",
         "→",
-        "Tab",       "Enter", "Esc",
+        "Tab",   "Enter", "Esc",
     }) |name| {
         try testing.expect(std.mem.indexOf(u8, text, name) != null);
     }
diff --git a/TUI/peer_cmd.zig b/TUI/peer_cmd.zig
new file mode 100644
index 00000000..32eed0d3
--- /dev/null
+++ b/TUI/peer_cmd.zig
@@ -0,0 +1,30 @@
+//! TUI `/tell` and `/peek`: thin client of the engine mailbox.
+//! Posting lives in `src/peer_channel.zig`; this file only routes the slash.
+
+const std = @import("std");
+
+const app = @import("app.zig");
+const engine = @import("engine.zig");
+const Model = app.Model;
+
+pub const tell_usage = "usage: /tell <session|all> <text> — all reaches every live session on this device, any folder";
+pub const peek_usage = "usage: /peek <session> — what a live session is doing right now";
+pub const offline_note = "peer talk needs a live session (offline)";
+
+pub fn run(self: *Model, canon: []const u8, arg: []const u8) void {
+    if (engine.g_peer_fn) |f| {
+        var buf: [2048]u8 = undefined;
+        const line = if (arg.len == 0) canon else (std.fmt.bufPrint(&buf, "{s} {s}", .{ canon, arg }) catch canon);
+        if (f(engine.g_turn_ctx, self.alloc, line)) |text| {
+            defer self.alloc.free(text);
+            const trimmed = std.mem.trimEnd(u8, text, " \t\r\n");
+            if (trimmed.len > 0) self.push(.system, trimmed) catch {};
+        }
+        return;
+    }
+    if (arg.len == 0) {
+        self.push(.system, if (std.mem.eql(u8, canon, "/peek")) peek_usage else tell_usage) catch {};
+    } else {
+        self.push(.system, offline_note) catch {};
+    }
+}
diff --git a/TUI/peer_tests.zig b/TUI/peer_tests.zig
new file mode 100644
index 00000000..4aeab5e3
--- /dev/null
+++ b/TUI/peer_tests.zig
@@ -0,0 +1,101 @@
+//! #563 Slice B: TUI `/tell` / `/peek` are catalogued and route through the
+//! engine. Drive the pager with `sim.Term` — no PTY, no Ghostty window.
+
+const std = @import("std");
+
+const app = @import("app.zig");
+const catalog = @import("catalog.zig");
+const dispatch = @import("dispatch.zig");
+const engine = @import("engine.zig");
+const peer_cmd = @import("peer_cmd.zig");
+const sim = @import("sim.zig");
+
+test "catalog lists /tell and /peek" {
+    try std.testing.expect(catalog.lookup("/tell") != null);
+    try std.testing.expect(catalog.lookup("/peek") != null);
+    try std.testing.expectEqualStrings("/tell", catalog.lookup("/tell").?.name);
+    try std.testing.expectEqualStrings("/peek", catalog.lookup("/peek").?.name);
+}
+
+test "bare /tell and /peek print usage when the engine is offline" {
+    var m: app.Model = undefined;
+    m.setup(std.testing.allocator);
+    defer m.deinit();
+    _ = dispatch.applyLine(&m, "/tell");
+    try std.testing.expect(std.mem.indexOf(u8, m.history.items[m.history.items.len - 1].text, "usage: /tell") != null);
+    _ = dispatch.applyLine(&m, "/peek");
+    try std.testing.expect(std.mem.indexOf(u8, m.history.items[m.history.items.len - 1].text, "usage: /peek") != null);
+}
+
+test "/tell from the pager reaches the engine and shows the posted line" {
+    const Seen = struct {
+        var line: []u8 = &.{};
+        var room: std.ArrayList(u8) = .empty;
+        fn f(_: ?*anyopaque, gpa: std.mem.Allocator, raw: []const u8) ?[]const u8 {
+            if (line.len > 0) gpa.free(line);
+            line = gpa.dupe(u8, raw) catch return null;
+            room.appendSlice(gpa, raw) catch {};
+            room.append(gpa, '\n') catch {};
+            return gpa.dupe(u8, "⇢ posted to the device-wide room") catch null;
+        }
+    };
+    Seen.line = &.{};
+    Seen.room = .empty;
+    engine.g_peer_fn = Seen.f;
+    defer {
+        engine.g_peer_fn = null;
+        if (Seen.line.len > 0) std.testing.allocator.free(Seen.line);
+        Seen.room.deinit(std.testing.allocator);
+    }
+
+    var term: sim.Term = undefined;
+    term.init(std.testing.allocator, 80, 24);
+    defer term.deinit();
+    _ = term.typeText("/tell all hold the tree");
+    _ = term.enter();
+
+    try std.testing.expectEqualStrings("/tell all hold the tree", Seen.line);
+    try std.testing.expect(std.mem.indexOf(u8, Seen.room.items, "hold the tree") != null);
+    try std.testing.expect(term.model.history.items.len > 0);
+    const last = term.model.history.items[term.model.history.items.len - 1].text;
+    try std.testing.expect(std.mem.indexOf(u8, last, "posted to the device-wide room") != null);
+
+    const vis = try term.screen();
+    defer std.testing.allocator.free(vis);
+    try std.testing.expect(std.mem.indexOf(u8, vis, "posted to the device-wide room") != null);
+}
+
+test "/peek from the pager reaches the engine" {
+    const Seen = struct {
+        var line: []u8 = &.{};
+        fn f(_: ?*anyopaque, gpa: std.mem.Allocator, raw: []const u8) ?[]const u8 {
+            if (line.len > 0) gpa.free(line);
+            line = gpa.dupe(u8, raw) catch return null;
+            return gpa.dupe(u8, "⚡ other · pid 9 · goal: refactor") catch null;
+        }
+    };
+    Seen.line = &.{};
+    engine.g_peer_fn = Seen.f;
+    defer {
+        engine.g_peer_fn = null;
+        if (Seen.line.len > 0) std.testing.allocator.free(Seen.line);
+    }
+
+    var term: sim.Term = undefined;
+    term.init(std.testing.allocator, 80, 24);
+    defer term.deinit();
+    _ = term.typeText("/peek other");
+    _ = term.enter();
+    try std.testing.expectEqualStrings("/peek other", Seen.line);
+    const last = term.model.history.items[term.model.history.items.len - 1].text;
+    try std.testing.expect(std.mem.indexOf(u8, last, "goal: refactor") != null);
+}
+
+test "offline /tell with a payload explains instead of posting" {
+    engine.g_peer_fn = null;
+    var m: app.Model = undefined;
+    m.setup(std.testing.allocator);
+    defer m.deinit();
+    _ = dispatch.applyLine(&m, "/tell all hi");
+    try std.testing.expectEqualStrings(peer_cmd.offline_note, m.history.items[m.history.items.len - 1].text);
+}
diff --git a/TUI/root.zig b/TUI/root.zig
index b23307e2..6e36582a 100644
--- a/TUI/root.zig
+++ b/TUI/root.zig
@@ -35,6 +35,7 @@ pub const CompactOut = engine.CompactOut;
 pub const CompactFn = engine.CompactFn;
 pub const HistoryOp = engine.HistoryOp;
 pub const HistoryFn = engine.HistoryFn;
+pub const PeerFn = engine.PeerFn;
 pub const RunOpts = run_mod.RunOpts;
 pub const run = run_mod.run;
 pub const restore = @import("restore.zig");
@@ -54,6 +55,8 @@ test {
     _ = app;
     _ = @import("app_tests.zig");
     _ = @import("dispatch.zig");
+    _ = @import("peer_cmd.zig");
+    _ = @import("peer_tests.zig");
     _ = @import("prompt_history.zig");
     _ = @import("meters.zig");
     _ = @import("key.zig");
diff --git a/TUI/run.zig b/TUI/run.zig
index f50c3977..5f19f0c6 100644
--- a/TUI/run.zig
+++ b/TUI/run.zig
@@ -56,6 +56,7 @@ pub fn run(
     engine.g_compact_fn = opts.compact_fn;
     engine.g_history_fn = opts.history_fn;
     engine.g_idle_wake_fn = opts.idle_wake_fn;
+    engine.g_peer_fn = opts.peer_fn;
     engine.g_model_name = opts.model_name;
     engine.g_model_provider = opts.model_provider;
     engine.g_model_entries = opts.model_entries;
@@ -298,13 +299,7 @@ pub fn run(
             continue;
         }
         esc_stall = 0;
-        if (pending_len == inbuf.len) {
-            // A stuck head has filled the whole buffer: that is a parser
-            // wedge, not a dead tty. Drop it rather than letting the
-            // zero-length read below masquerade as a hangup and kill the
-            // TUI mid-session (#517).
-            pending_len = 0;
-        }
+        pending_len = stall.clearFullWedge(pending_len, inbuf.len);
         var filled = pending_len;
         const got = tty.readStdin(inbuf[filled..]);
         pacing.reads += 1;
@@ -505,9 +500,6 @@ test "run loop enables click+hover tracking and bracketed paste" {
     try std.testing.expect(std.mem.indexOf(u8, src, &kitty_on) != null);
     try std.testing.expect(std.mem.indexOf(u8, src, &wrap_off) != null);
     try std.testing.expect(std.mem.indexOf(u8, src, "a=d,d=A") != null);
-    // #517: a buffer-filling parser wedge must be cleared before the read,
-    // or the zero-length read reads as a hangup and kills the TUI.
-    try std.testing.expect(std.mem.indexOf(u8, src, "pending_len == inbuf.len") != null);
     // The idle paste sweep must DISCARD whatever was stuck mid-sequence before
     // the stall path below can see it. Leaving it there let a lone pending ESC
     // become the Escape KEY the instant `in_paste` cleared, cancelling a live
diff --git a/TUI/run_stall.zig b/TUI/run_stall.zig
index 1a89a02b..3839be68 100644
--- a/TUI/run_stall.zig
+++ b/TUI/run_stall.zig
@@ -86,6 +86,12 @@ pub fn armExpired(now_ms: u64, arm_ms: u64) bool {
     return now_ms -| arm_ms > arm_window_ms;
 }
 
+/// A stuck CSI/OSC head that filled the read buffer is a parser wedge, not a
+/// hangup. Drop it so the next `read` is not a zero-length "TTY gone" (#517).
+pub fn clearFullWedge(pending_len: usize, buf_len: usize) usize {
+    return if (pending_len == buf_len) 0 else pending_len;
+}
+
 /// Is this read nothing but complete SGR mouse reports?
 ///
 /// ?1003h is on by default for image-chip hover, and a pointer merely RESTING
@@ -202,3 +208,10 @@ test "a lone ESC inside a latched paste is the escape hatch, not a 2s wait" {
     // Outside a paste nothing moved: #94's 2-stall Escape still fires.
     try std.testing.expectEqual(StallVerdict.escape_key, stallVerdict("\x1b", 2, .{}));
 }
+
+test "a buffer-filling parser wedge is dropped, not treated as hangup (#517)" {
+    try std.testing.expectEqual(@as(usize, 0), clearFullWedge(4096, 4096));
+    try std.testing.expectEqual(@as(usize, 12), clearFullWedge(12, 4096));
+    try std.testing.expectEqual(@as(usize, 0), clearFullWedge(0, 4096));
+    try std.testing.expectEqual(@as(usize, 1), clearFullWedge(1, 2));
+}
diff --git a/TUI/tty.zig b/TUI/tty.zig
index eed0b08f..87211763 100644
--- a/TUI/tty.zig
+++ b/TUI/tty.zig
@@ -46,6 +46,16 @@ pub const RawState = if (is_windows) struct {
     input_cp: u32 = 0,
 } else std.posix.termios;
 
+/// Clear the line-discipline bits that steal keys the TUI owns (#523).
+/// Extracted so tests can mutate a termios-shaped value without a real tty.
+pub fn surrenderLineDiscipline(raw: anytype) void {
+    raw.lflag.ICANON = false;
+    raw.lflag.ECHO = false;
+    raw.lflag.ISIG = false;
+    raw.lflag.IEXTEN = false; // ^V (0x16) reaches us, not the tty's lnext
+    raw.iflag.IXON = false; // ^S/^Q are keys, not XOFF/XON flow control
+}
+
 pub fn enterRaw() ?RawState {
     if (is_windows) {
         const h = w.GetStdHandle(w.STD_OUTPUT_HANDLE);
@@ -67,11 +77,7 @@ pub fn enterRaw() ?RawState {
     const fd = std.posix.STDIN_FILENO;
     const orig = std.posix.tcgetattr(fd) catch return null;
     var raw = orig;
-    raw.lflag.ICANON = false;
-    raw.lflag.ECHO = false;
-    raw.lflag.ISIG = false;
-    raw.lflag.IEXTEN = false; // ^V (0x16) reaches us, not the tty's lnext (#523)
-    raw.iflag.IXON = false; // ^S/^Q are keys, not XOFF/XON flow control (#523)
+    surrenderLineDiscipline(&raw);
     raw.cc[@intFromEnum(std.posix.V.MIN)] = 0;
     raw.cc[@intFromEnum(std.posix.V.TIME)] = 0;
     std.posix.tcsetattr(fd, .NOW, raw) catch return null;
@@ -100,9 +106,16 @@ pub fn readStdin(buf: []u8) usize {
 }
 
 test "raw mode surrenders ^V and ^S to the app, not the line discipline (#523)" {
-    const src = @embedFile("tty.zig");
-    try std.testing.expect(std.mem.indexOf(u8, src, "IEXTEN = false") != null);
-    try std.testing.expect(std.mem.indexOf(u8, src, "IXON = false") != null);
+    var raw = struct {
+        lflag: struct { ICANON: bool = true, ECHO: bool = true, ISIG: bool = true, IEXTEN: bool = true } = .{},
+        iflag: struct { IXON: bool = true } = .{},
+    }{};
+    surrenderLineDiscipline(&raw);
+    try std.testing.expect(!raw.lflag.IEXTEN);
+    try std.testing.expect(!raw.iflag.IXON);
+    try std.testing.expect(!raw.lflag.ICANON);
+    try std.testing.expect(!raw.lflag.ECHO);
+    try std.testing.expect(!raw.lflag.ISIG);
 }
 
 test "Windows enterRaw switches the console to UTF-8 and restore puts the CPs back (#607)" {
diff --git a/docs/acp-registry.md b/docs/acp-registry.md
index 76c1a2b8..0c43c5f5 100644
--- a/docs/acp-registry.md
+++ b/docs/acp-registry.md
@@ -18,7 +18,7 @@ and the host recipe stays [embedding.md](embedding.md). Replace those with
 | `graff acp` stdio agent | Shipped. Protocol version 1. |
 | Mid-turn `session/update` (thought / tool / text) | Shipped (ADR [0032](adr/0032-acp-streams-mid-turn.md), #612). |
 | Provider login | `graff login` / keychain / env keys. Not ACP `authenticate`. |
-| `initialize.authMethods` | **Missing.** Registry CI requires at least one method with `type: "agent"` or `type: "terminal"`. |
+| `initialize.authMethods` | **Shipped.** `graff-login` / `type: "terminal"` / `args: ["login"]`. `authenticate` stays unused — the client re-spawns `graff login`. |
 | `session/load`, `session/request_permission` | Not implemented. Unattended + `--yolo` is the host path. |
 
 A stale comment on #613 said #612 was still open. It is not: streaming is on
@@ -33,8 +33,8 @@ accepts only:
 - **Terminal Auth** — the client re-spawns the binary with setup args (a TUI
   login), then runs the normal ACP command.
 
-`graff login` is already Terminal Auth in product terms. Listing still fails
-until `initialize` advertises it, for example:
+`graff login` is already Terminal Auth in product terms. `initialize` now
+advertises it:
 
 ```json
 {
@@ -121,11 +121,11 @@ Pin `sha256` from that release's `SHA256SUMS` before the PR. Archive layout
 is sometimes flat (`graff` at the tarball root) and sometimes nested
 (`graff-<target>/graff`); `cmd` must match what the installer extracts.
 
-Until `authMethods` is on the wire, this draft is documentation, not a
-submission.
+`authMethods` is on the wire. Pin `sha256` from a real release, then open the
+registry PR in the other repo. This repo still does not fetch the catalog.
 
 ## Not this repo
 
 - No `graff registry` command.
 - No fetch of `cdn.agentclientprotocol.com`.
-- No change to `src/acp.zig` on this continuation cut for listing.
+- No `authenticate` implementation (Terminal Auth is out of band).
diff --git a/docs/adr/0037-experiment-pool-is-opt-in.md b/docs/adr/0037-experiment-pool-is-opt-in.md
index ea28ca79..b1641137 100644
--- a/docs/adr/0037-experiment-pool-is-opt-in.md
+++ b/docs/adr/0037-experiment-pool-is-opt-in.md
@@ -7,15 +7,17 @@ Status: accepted 2026-08-26
 #629: default isolation is `shared_cwd`, so "run 3 approaches" stays on one
 agent. Per-spawn `isolation: worktree` pays `git worktree add` mid-turn.
 
-This record lives on `release/v0.0.279` after the v0.0.279 tag. It is **not**
-on `main` until a later cut.
+On `main` as of the 279 continuation.
 
 ## Decision
 
 `--experiment N` / `/experiment N` mints N trees under
 `.graff/worktrees/exp-{id}/` **before** the first child. Each spawn claims
-the next seat and sets `agent_cwd`. The root stays on the caller tree.
-Default sessions are unchanged. Pool trees are not auto-deleted.
+the next seat and sets `agent_cwd`. The root stays on the caller tree and
+is told it **must** spawn (system-prompt mandate), not edit. Default
+sessions are unchanged. Pool trees are not auto-deleted: finish reports
+path, branch, keep-reason, and diffstat. `graff worktree list` tags them
+`(experiment pool)`.
 
 ## Consequences
 
diff --git a/docs/adr/0039-local-tools-are-project-scripts.md b/docs/adr/0039-local-tools-are-project-scripts.md
new file mode 100644
index 00000000..d5c35eb2
--- /dev/null
+++ b/docs/adr/0039-local-tools-are-project-scripts.md
@@ -0,0 +1,34 @@
+# 0039. Agent-authored local tools are project scripts, not skills
+
+Status: accepted 2026-08-27
+
+## Context
+
+#555 asked for exo's `install_agent_tool` loop: the agent writes a tool at
+runtime, the harness validates it, and later sessions see it as a first-class
+tool. Graff already has skills (instruction playbooks) and MCP (out-of-process
+servers). A third thing that is "just a skill with a shebang" would blur both.
+
+`schema.zig` is at the 600-line cap and feeds the 64-cell
+`spec/kernels/tool_catalog.json` cube. Putting every installed name into
+`effectiveRootSpecs` would force an SDK regen on every project script.
+
+## Decision
+
+- A local tool lives at `.graff/tools/<name>/` with `manifest.json` plus a
+  script. Runners are `python3`, `bun`, or `sh`.
+- `install_agent_tool` validates the manifest, dry-runs `argv --dry-run`
+  (exit 0 required), then registers `local__<name>`. Live calls pass the
+  JSON args as argv[2] — `process_runner.runCapped` has no stdin.
+- Skills stay instructions. MCP stays consent-gated servers. This is the
+  executable, project-local half.
+- Catalog extras are concatenated in `agent_catalog.ensureRootTools`, not
+  added to `schema.effectiveRootSpecs`. `--no-local-tools` / `--lean` hide
+  them. Subagents do not see them. Plan mode refuses install and live calls.
+
+## Consequences
+
+- A script that ignores `--dry-run` fails install. A script that reads stdin
+  for args will see nothing.
+- Do not grow `schema.meta_names` or the SDK cube for these names.
+- Revisit if a project needs MCP-shaped stdin JSON or a fourth runner.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index fcc12358..d896b7ed 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -47,8 +47,9 @@ record only when you need the evidence or the edge cases.
 | [0034](0034-remote-images-stay-native.md) | JSON/serve image inputs are a typed URL/base64 union, validated atomically and preserved as native provider vision blocks; never flatten pixels into prompt text. |
 | [0035](0035-first-turn-skips-deferred-mcp-join.md) | First model call after a deferred MCP boot does not wait for the handshake; native tools run now, MCP catalogs merge on the next request. |
 | [0036](0036-computer-use-keeps-the-signed-codex-bridge.md) | Codex Computer Use keeps its authenticated node_repl process chain: Graff launches it through the signed Codex sandbox wrapper, never embeds V8 or spoofs the service. |
-| [0037](0037-experiment-pool-is-opt-in.md) | `--experiment N` / `/experiment N` pre-mints a child worktree pool; default isolation stays `shared_cwd`. 279 continuation — not on main until a later cut. |
+| [0037](0037-experiment-pool-is-opt-in.md) | `--experiment N` / `/experiment N` pre-mints a child worktree pool; the root must spawn; pool trees are listed and delivered back, never auto-deleted. |
 | [0038](0038-in-process-acp-core.md) | Same-process embed is `libgraff` + `graff-core.wasm` + `createGraffAgent()` (ACP core, echo turn). Live coding stays `graff acp`. 279 continuation — not on main until a later cut. |
+| [0039](0039-local-tools-are-project-scripts.md) | Agent-authored local tools are project scripts under `.graff/tools/`; skills stay instructions. Runtime catalog extras, not `schema.effectiveRootSpecs`. |
 
 ## When to write one
 
diff --git a/docs/releases/v0.0.279-continuation.md b/docs/releases/v0.0.279-continuation.md
index f87f7616..afe27ccd 100644
--- a/docs/releases/v0.0.279-continuation.md
+++ b/docs/releases/v0.0.279-continuation.md
@@ -1,13 +1,19 @@
 # v0.0.279 continuation (not on main)
 
-The tagged cut is `v0.0.279` on `main` (`70a5228`). Further work on
-`release/v0.0.279` stays **off main** until you ask to cut again.
-This branch is **not** a retag and is **not** merged back.
+The tagged cut is `v0.0.279` on `main` (`70a5228`). The first continuation
+already merged back via #645 (`899af62`). This second continuation lives on
+`release/v0.0.279` and stays **off main** until you ask to cut again.
+This branch is **not** a retag.
 
 | Item | Status on this branch |
 | --- | --- |
-| #629 experiment worktree pool | **Started.** `--experiment N`, `/experiment [N\|off\|status]`, children `claim()` a seat and set `agent_cwd` before `git worktree add` (ADR 0037). `/help` and `graff --help` list it. Mint/reuse of real trees, forced fan-out, and deliver-back are still open — do not close #629 yet. |
-| #613 ACP Registry | **Docs only.** Submit recipe in [acp-registry.md](../acp-registry.md). Listing + auth check live in `agentclientprotocol/registry`. #612 streaming already shipped. Blocker: `initialize` has no `authMethods`. No registry client here. |
-| yxlyx doctor / cube / governed / localhost | **Inventory.** [yxlyx-leftovers.md](../yxlyx-leftovers.md). `/doctor` goal/todo slice and `--max-model-calls` already exist. Lease/job/listener doctor, idle localhost supervisor, cube NDJSON ingress, protected verifiers, review-cycle caps: parked. No new product mode. |
-| WASM / libgraff / in-process embed | **Started (ADR 0038).** `graff-core.wasm` + `libgraff` + `@codegraff/sdk/embed` `createGraffAgent()`. ACP handshake in-process; first-slice turn is `echo:`. Live tools stay `graff acp`. |
-| Tab title | **Fixed.** Title uses the live session provider/model (no extra chat remap). Failures stay off the `thinking…` row. Responses-kind errors name the provider, not "codex". |
+| #549 TUI leftovers + #550 Anthropic `output_config` | **Landed (#646).** Stall HUD, TTY resize, MCP config polish, native Anthropic structured-output path. |
+| #629 experiment worktree pool | **Finished the first-slice leftovers (#647).** Forced fan-out, `graff worktree list` tags, deliver-back of pool trees. Still opt-in (`--experiment N` / `/experiment`). Do not close #629 if later pool work remains. |
+| #563 peer mailbox leftovers | **Landed (#648).** TUI `/tell` and `/peek` use the existing peer mailbox (`tui_peer`), not a second channel. |
+| #613 ACP Registry | **`authMethods` shipped (#649).** `initialize` advertises `graff-login` / `type: "terminal"` / `args: ["login"]`. `authenticate` stays unused — the client re-spawns `graff login`. Listing still needs a PR on `agentclientprotocol/registry`. No `graff registry` client. Leave #613 open. |
+| #555 local tools | **Landed (#649).** `install_agent_tool` writes `.graff/tools/<name>/`, dry-run `--dry-run`, register `local__<name>`. Skills stay instructions (ADR 0039). |
+| #556 schedule | **Landed (#649).** `.graff/schedule/<id>.json`, `schedule_task` / `/schedule 5m …`, due-claim + TUI idle wake. `/loop` stays standing-goal. |
+| #558 channel workers | **Landed (#649).** JSONL protocol + outbox + wake only. Inbound `{"type":"message","text"}`; `/adapter send` → `{"type":"send","text"}`. No Discord/Slack. |
+| yxlyx doctor / cube / governed / localhost | **Inventory.** [yxlyx-leftovers.md](../yxlyx-leftovers.md). Parked. No new product mode. |
+| WASM / libgraff / in-process embed | **On main via #645 (ADR 0038).** Echo turn; live tools stay `graff acp`. |
+| Tab title | **On main via #645.** Live session provider/model. |
diff --git a/lean-proofs/Graff/StructuredOutput.lean b/lean-proofs/Graff/StructuredOutput.lean
index 2e7b5274..70ace06d 100644
--- a/lean-proofs/Graff/StructuredOutput.lean
+++ b/lean-proofs/Graff/StructuredOutput.lean
@@ -1,23 +1,30 @@
 /-
-  Structured-output carrier ladder (#543): which server-visible carrier a
-  set --output-schema rides, per wire format, learned degrade state (sox),
-  and whether real tools occupy the request.
+  Structured-output carrier ladder (#543 / #550): which server-visible
+  carrier a set --output-schema rides, per wire format, learned degrade
+  state (sox), and whether real tools occupy the request.
 
   openai chat: json_schema until the provider rejects it (sox learned via
   the request() quirk ladder); degraded, the tools-off formatting turn
   carries the schema as a structured_output TOOL (dsh's pattern, forced by
   instruction, never tool_choice — thinking modes reject forcing), while a
-  turn with real tools falls back to json_object. anthropic: no
-  response_format exists at all — the tool is the only server carrier and
-  the prompt always embeds the schema. responses: native text.format.
+  turn with real tools falls back to json_object.
 
-  The invariant of record is never_silent: before 9e2da0a the anthropic
-  wire dropped a set schema with no error — the exact bug class this
-  kernel now makes unrepresentable.
+  anthropic: provider id `anthropic` tries native output_config.format
+  json_schema on the tools-off formatting turn (#550, kimi-code prior art).
+  A learned sox flag (output_config rejected) falls back to the
+  structured_output tool. minimax / kimi-anthropic stay on the tool
+  (modelled here as sox). Real tools never carry a grammar (ADR 0001).
+
+  responses: native text.format.
+
+  The invariant of record is never_silent on the formatting turn: before
+  9e2da0a the anthropic wire dropped a set schema with no error. An
+  anthropic tools turn may be silent — the two-phase split holds the
+  schema for the formatting call.
 
   Executable port: spec/ref/structured_output.py. Impl:
   src/agent_request_body.zig + agent_request_body_responses.zig
-  (schemaAwarePrompt / writeStructuredOutputTool / writeAnthropicStructuredTool).
+  (schemaAwarePrompt / writeAnthropicSchema / writeAnthropicOutputConfig).
 -/
 
 namespace Graff.StructuredOutput
@@ -27,11 +34,11 @@ inductive Wire
 deriving DecidableEq, Repr
 
 inductive Carrier
-  | none | jsonSchema | jsonObject | toolOpenai | toolAnthropic | textFormat
+  | none | jsonSchema | jsonObject | toolOpenai | toolAnthropic | textFormat | outputConfig
 deriving DecidableEq, Repr
 
 /-- The server-visible carrier of the schema for one request.
-    Args: wire, schema present, sox (json_schema was rejected), real tools present. -/
+    Args: wire, schema present, sox (native schema was rejected), real tools present. -/
 def carrier : Wire → Bool → Bool → Bool → Carrier
   | _, false, _, _ => .none
   | .responses, true, _, _ => .textFormat
@@ -39,30 +46,46 @@ def carrier : Wire → Bool → Bool → Bool → Carrier
   | .openai, true, true, true => .jsonObject
   | .openai, true, true, false => .toolOpenai
   | .anthropic, true, _, true => .none
-  | .anthropic, true, _, false => .toolAnthropic
+  | .anthropic, true, false, false => .outputConfig
+  | .anthropic, true, true, false => .toolAnthropic
 
-/-- Whether the system prompt embeds the schema text (schemaAwarePrompt's
-    embedded-schema branch). Tools presence never changes the prompt. -/
+/-- Whether the system prompt embeds the schema JSON (schemaAwarePrompt's
+    cannot-enforce / tool-mode branch). Native Anthropic uses the light
+    prompt; sox (fallback) embeds. Tools presence never changes the prompt. -/
 def promptSchema : Wire → Bool → Bool → Bool
   | _, false, _ => false
-  | .anthropic, true, _ => true
+  | .anthropic, true, sox => sox
   | .openai, true, sox => sox
   | .responses, true, _ => false
 
-/-- #543's invariant of record: a set schema is NEVER silent — some
-    server-visible carrier exists, or the prompt itself embeds the schema. -/
+/-- A set schema is never silent on the formatting turn. An anthropic
+    tools turn may be — ADR 0001 forbids a grammar there; the two-phase
+    split holds the schema for the next call. -/
 theorem never_silent (w : Wire) (sox tools : Bool) :
-    carrier w true sox tools ≠ .none ∨ promptSchema w true sox = true := by
+    carrier w true sox tools ≠ .none ∨ promptSchema w true sox = true ∨
+      (w = .anthropic ∧ tools = true) := by
   cases w <;> cases sox <;> cases tools <;> decide
 
-/-- The learned degrade is a chat-wire quirk: sox changes nothing elsewhere. -/
-theorem sox_only_on_chat (w : Wire) (tools : Bool) (h : w ≠ .openai) :
-    carrier w true true tools = carrier w true false tools := by
-  cases w <;> cases tools <;> first | decide | exact absurd rfl h
+/-- The learned degrade does not touch the Responses wire. -/
+theorem sox_leaves_responses_alone (tools : Bool) :
+    carrier .responses true true tools = carrier .responses true false tools := by
+  cases tools <;> decide
 
-/-- Once a provider rejected json_schema, it is never sent again. -/
+/-- #550: native Anthropic formatting uses output_config; sox falls back to the tool. -/
+theorem sox_degrades_anthropic_native :
+    carrier .anthropic true false false = .outputConfig ∧
+      carrier .anthropic true true false = .toolAnthropic := by
+  decide
+
+/-- ADR 0001: no schema grammar on an anthropic tools turn. -/
+theorem no_grammar_on_anthropic_tools (sox : Bool) :
+    carrier .anthropic true sox true = .none := by
+  cases sox <;> decide
+
+/-- Once a provider rejected json_schema / output_config, it is never sent again. -/
 theorem no_json_schema_after_rejection (w : Wire) (tools : Bool) :
-    carrier w true true tools ≠ .jsonSchema := by
+    carrier w true true tools ≠ .jsonSchema ∧
+      carrier w true true tools ≠ .outputConfig := by
   cases w <;> cases tools <;> decide
 
 /-- No schema, no artifacts: the axis is byte-silent when unused. -/
@@ -70,10 +93,15 @@ theorem absent_schema_is_silent (w : Wire) (sox tools : Bool) :
     carrier w false sox tools = .none ∧ promptSchema w false sox = false := by
   cases w <;> cases sox <;> cases tools <;> decide
 
-/-- The anthropic wire embeds the schema in the prompt unconditionally —
-    even when real tools displace the structured_output tool, nothing is lost. -/
-theorem anthropic_always_teaches (sox : Bool) :
-    promptSchema .anthropic true sox = true := by
-  cases sox <;> decide
+/-- Tool-mode fallback still embeds the schema so a rejected output_config
+    cannot go silent. -/
+theorem anthropic_fallback_teaches :
+    promptSchema .anthropic true true = true := by
+  decide
+
+/-- Native Anthropic uses the light prompt (server enforces on the formatting turn). -/
+theorem anthropic_native_prompt_is_light :
+    promptSchema .anthropic true false = false := by
+  decide
 
 end Graff.StructuredOutput
diff --git a/scripts/eval/tier1-manifest.json b/scripts/eval/tier1-manifest.json
index 6b7f49a6..cd4c2181 100644
--- a/scripts/eval/tier1-manifest.json
+++ b/scripts/eval/tier1-manifest.json
@@ -15,7 +15,7 @@
     "src/repl.zig",
     "TUI/root.zig"
   ],
-  "test_count_baseline": 1715,
+  "test_count_baseline": 1745,
   "test_count_slack": 25,
   "required_invariants": [
     {
diff --git a/spec/kernels/structured_output.json b/spec/kernels/structured_output.json
index 36589510..82388756 100644
--- a/spec/kernels/structured_output.json
+++ b/spec/kernels/structured_output.json
@@ -38,8 +38,8 @@
       "schema": true,
       "sox": false,
       "tools": false,
-      "carrier": "toolAnthropic",
-      "prompt_schema": true
+      "carrier": "outputConfig",
+      "prompt_schema": false
     },
     {
       "wire": "anthropic",
@@ -47,7 +47,7 @@
       "sox": false,
       "tools": true,
       "carrier": "none",
-      "prompt_schema": true
+      "prompt_schema": false
     },
     {
       "wire": "anthropic",
diff --git a/spec/ref/structured_output.py b/spec/ref/structured_output.py
index 351066fd..d1f11cba 100644
--- a/spec/ref/structured_output.py
+++ b/spec/ref/structured_output.py
@@ -1,4 +1,4 @@
-"""Executable port of lean-proofs/Graff/StructuredOutput.lean (#543)."""
+"""Executable port of lean-proofs/Graff/StructuredOutput.lean (#543 / #550)."""
 
 from __future__ import annotations
 
@@ -15,16 +15,18 @@ def carrier(wire: str, schema: bool, sox: bool, tools: bool) -> str:
         if not sox:
             return "jsonSchema"
         return "jsonObject" if tools else "toolOpenai"
-    # anthropic: no response_format exists on this wire at all
-    return "none" if tools else "toolAnthropic"
+    # anthropic: native output_config.format on the formatting turn (#550);
+    # sox (rejected) falls back to the structured_output tool. Tools turns
+    # never carry a grammar (ADR 0001).
+    if tools:
+        return "none"
+    return "toolAnthropic" if sox else "outputConfig"
 
 
 def prompt_schema(wire: str, schema: bool, sox: bool) -> bool:
     if not schema:
         return False
-    if wire == "anthropic":
-        return True
-    if wire == "openai":
+    if wire in ("anthropic", "openai"):
         return sox
     return False
 
@@ -51,18 +53,28 @@ def check_properties() -> int:
     for row in cells():
         n += 1
         w, s, x, t = row["wire"], row["schema"], row["sox"], row["tools"]
-        # never_silent: a set schema always reaches the provider somewhere.
+        # never_silent: a set schema always reaches the provider, except an
+        # anthropic tools turn (ADR 0001; the two-phase split holds it).
         if s and row["carrier"] == "none" and not row["prompt_schema"]:
-            raise ValueError(f"never_silent violated: {row}")
-        # sox_only_on_chat: the learned degrade changes nothing off the chat wire.
-        if w != "openai" and carrier(w, s, True, t) != carrier(w, s, False, t):
-            raise ValueError(f"sox_only_on_chat violated: {row}")
-        # no_json_schema_after_rejection.
-        if x and row["carrier"] == "jsonSchema":
+            if not (w == "anthropic" and t):
+                raise ValueError(f"never_silent violated: {row}")
+        # sox_leaves_responses_alone
+        if w == "responses" and carrier(w, s, True, t) != carrier(w, s, False, t):
+            raise ValueError(f"sox_leaves_responses_alone violated: {row}")
+        # sox_degrades_anthropic_native
+        if w == "anthropic" and s and not t:
+            want = "toolAnthropic" if x else "outputConfig"
+            if row["carrier"] != want:
+                raise ValueError(f"sox_degrades_anthropic_native violated: {row}")
+        # no_json_schema_after_rejection / no leftover output_config
+        if x and row["carrier"] in ("jsonSchema", "outputConfig"):
             raise ValueError(f"no_json_schema_after_rejection violated: {row}")
-        # absent_schema_is_silent.
+        # absent_schema_is_silent
         if not s and (row["carrier"] != "none" or row["prompt_schema"]):
             raise ValueError(f"absent_schema_is_silent violated: {row}")
+        # no_grammar_on_anthropic_tools
+        if w == "anthropic" and s and t and row["carrier"] != "none":
+            raise ValueError(f"no_grammar_on_anthropic_tools violated: {row}")
     return n
 
 
diff --git a/src/acp.zig b/src/acp.zig
index 97fa02fc..5458b6b2 100644
--- a/src/acp.zig
+++ b/src/acp.zig
@@ -279,6 +279,8 @@ test "handleLine: initialize, session/new, then a prompt turn" {
     try testing.expect(std.mem.indexOf(u8, init_line, "\"embeddedContext\":true") != null);
     try testing.expect(std.mem.indexOf(u8, init_line, "\"name\":\"graff\"") != null);
     try testing.expect(std.mem.indexOf(u8, init_line, "\"loadSession\":false") != null);
+    try testing.expect(std.mem.indexOf(u8, init_line, "graff-login") != null);
+    try testing.expect(std.mem.indexOf(u8, init_line, "\"type\":\"terminal\"") != null);
 
     w = .fixed(&buf);
     try handleLine(&d, a, &w, "{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"session/new\",\"params\":{\"cwd\":\"/tmp\"}}");
diff --git a/src/acp_auth.zig b/src/acp_auth.zig
new file mode 100644
index 00000000..d5841177
--- /dev/null
+++ b/src/acp_auth.zig
@@ -0,0 +1,66 @@
+//! ACP v1 Terminal Auth descriptor (#613). `graff login` is already that
+//! flow; this module is the wire shape `initialize` advertises so registry
+//! CI (and Zed) can see it.
+//!
+//! Do not invent Agent Auth. Do not accept a terminal method on
+//! `authenticate` — the client re-spawns the binary (ACP RFD).
+
+const std = @import("std");
+const Value = std.json.Value;
+
+pub const AuthMethod = struct {
+    id: []const u8,
+    name: []const u8,
+    description: []const u8,
+    type: []const u8,
+    args: []const []const u8,
+};
+
+pub const terminal_login = AuthMethod{
+    .id = "graff-login",
+    .name = "graff login",
+    .description = "Interactive terminal login (codegraff / Codex / Kimi)",
+    .type = "terminal",
+    .args = &.{"login"},
+};
+
+pub const advertised = [_]AuthMethod{terminal_login};
+
+/// v1 clients that can open an interactive terminal set
+/// `clientCapabilities.auth.terminal = true`. Missing keys default false;
+/// we still advertise (registry CI must see a method) because `graff login`
+/// exists whether the client sent the capability or not.
+pub fn clientAllowsTerminal(params: ?Value) bool {
+    const p = params orelse return false;
+    if (p != .object) return false;
+    const caps = p.object.get("clientCapabilities") orelse return false;
+    if (caps != .object) return false;
+    const auth = caps.object.get("auth") orelse return false;
+    if (auth != .object) return false;
+    const terminal = auth.object.get("terminal") orelse return false;
+    return switch (terminal) {
+        .bool => |b| b,
+        else => false,
+    };
+}
+
+test "terminal_login is the registry Terminal Auth shape" {
+    try std.testing.expectEqualStrings("graff-login", terminal_login.id);
+    try std.testing.expectEqualStrings("terminal", terminal_login.type);
+    try std.testing.expectEqualStrings("login", terminal_login.args[0]);
+}
+
+test "clientAllowsTerminal reads the v1 capability" {
+    var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena.deinit();
+    const a = arena.allocator();
+    const yes = try std.json.parseFromSliceLeaky(Value, a,
+        \\{"clientCapabilities":{"auth":{"terminal":true}}}
+    , .{});
+    const no = try std.json.parseFromSliceLeaky(Value, a,
+        \\{"clientCapabilities":{"fs":{}}}
+    , .{});
+    try std.testing.expect(clientAllowsTerminal(yes));
+    try std.testing.expect(!clientAllowsTerminal(no));
+    try std.testing.expect(!clientAllowsTerminal(null));
+}
diff --git a/src/acp_engine.zig b/src/acp_engine.zig
index e656c638..ede34dda 100644
--- a/src/acp_engine.zig
+++ b/src/acp_engine.zig
@@ -8,6 +8,7 @@ const Allocator = std.mem.Allocator;
 
 const proto = @import("acp_protocol.zig");
 const util = @import("util.zig");
+const acp_auth = @import("acp_auth.zig");
 
 pub const parseRequest = proto.parseRequest;
 pub const negotiateVersion = proto.negotiateVersion;
@@ -103,7 +104,10 @@ pub fn handleLine(d: *Dispatch, arena: Allocator, w: *Io.Writer, line: []const u
             .promptCapabilities = proto.PromptCapabilities{},
         },
         .agentImplementation = proto.AgentImplementation{ .version = implementation_version },
+        .authMethods = acp_auth.advertised,
     });
+    if (std.mem.eql(u8, req.method, "authenticate"))
+        return respondError(w, req, err_method_not_found, "terminal auth is out of band: re-spawn graff login");
     if (std.mem.eql(u8, req.method, "session/new")) {
         d.created += 1;
         d.session_id = try std.fmt.allocPrint(arena, "acp-{x}-{d}", .{ d.seed, d.created });
@@ -140,6 +144,9 @@ test "in-process handleLine speaks the same initialize / new / prompt envelopes"
     try std.testing.expect(std.mem.indexOf(u8, w.buffered(), "\"protocolVersion\":1") != null);
     try std.testing.expect(std.mem.indexOf(u8, w.buffered(), "\"name\":\"graff\"") != null);
     try std.testing.expect(std.mem.indexOf(u8, w.buffered(), "embed-test") != null);
+    try std.testing.expect(std.mem.indexOf(u8, w.buffered(), "\"authMethods\"") != null);
+    try std.testing.expect(std.mem.indexOf(u8, w.buffered(), "graff-login") != null);
+    try std.testing.expect(std.mem.indexOf(u8, w.buffered(), "\"type\":\"terminal\"") != null);
 
     w = .fixed(&buf);
     try handleLine(&d, a, &w, "{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"session/new\"}");
@@ -152,6 +159,17 @@ test "in-process handleLine speaks the same initialize / new / prompt envelopes"
     try std.testing.expect(std.mem.indexOf(u8, w.buffered(), "\"stopReason\":\"end_turn\"") != null);
 }
 
+test "authenticate names the out-of-band terminal login" {
+    var state = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer state.deinit();
+    var buf: [512]u8 = undefined;
+    var w: Io.Writer = .fixed(&buf);
+    var d: Dispatch = .{ .turn = echoTurn, .ctx = undefined };
+    try handleLine(&d, state.allocator(), &w, "{\"jsonrpc\":\"2.0\",\"id\":9,\"method\":\"authenticate\",\"params\":{\"methodId\":\"graff-login\"}}");
+    try std.testing.expect(std.mem.indexOf(u8, w.buffered(), "\"code\":-32601") != null);
+    try std.testing.expect(std.mem.indexOf(u8, w.buffered(), "graff login") != null);
+}
+
 test "stripSgr drops CSI sequences" {
     var state = std.heap.ArenaAllocator.init(std.testing.allocator);
     defer state.deinit();
diff --git a/src/agent.zig b/src/agent.zig
index 031b8eca..7f3ad6ac 100644
--- a/src/agent.zig
+++ b/src/agent.zig
@@ -36,6 +36,8 @@ const empty_completion = @import("agent_empty_completion.zig");
 const goal_state = @import("goal_state.zig");
 const peer_channel = @import("peer_channel.zig"); // #469: turn-boundary peer message delivery
 const job_notify = @import("job_notify.zig");
+const schedule = @import("schedule.zig");
+const channel_worker = @import("channel_worker.zig");
 
 pub const TodoItem = struct {
     content: []const u8,
@@ -225,7 +227,7 @@ pub const Agent = struct {
     streamed_args: ArgTool = .none, // which meta tool's prose streamed live this request
     streamed_args_len: usize = 0, // raw bytes emitted for it (gates re-print suppression)
     cap_new: bool = false, // provider rejected max_tokens → use max_completion_tokens
-    sox_json_object: bool = false, // #543: provider rejected response_format json_schema → json_object + schema-in-prompt
+    sox_json_object: bool = false, // #543/#550: rejected json_schema / output_config → tool or json_object + schema-in-prompt
     effort_rejected: bool = false, // model rejected reasoning_effort → drop it (e.g. gpt-5.5 on chat/completions wants /v1/responses)
     output_schema: ?[]const u8 = null, // --output-schema: JSON schema the final answer must satisfy (response_format / text.format, #502)
     next_ask_id: u64 = 1,
@@ -339,6 +341,8 @@ pub const Agent = struct {
             // an empty channel costs one small stat per step.
             peer_channel.deliverInbound(self);
             job_notify.deliver(self);
+            schedule.deliver(self);
+            channel_worker.deliver(self);
             // #193: pre-send overflow gate. A single turn's tool-output burst can
             // push the input past the model's wall before the between-turns 80%
             // meter (last_context_tokens, server-reported) catches up. Estimate the
diff --git a/src/agent_catalog.zig b/src/agent_catalog.zig
index 0504f3b7..fe7343ca 100644
--- a/src/agent_catalog.zig
+++ b/src/agent_catalog.zig
@@ -1,5 +1,7 @@
 //! Root/worker tool-catalog materialization. Split out of agent.zig (600-line ceiling).
 
+const std = @import("std");
+const Allocator = std.mem.Allocator;
 const main_mod = @import("main.zig");
 const schema = @import("schema.zig");
 const no_local_tools = @import("no_local_tools.zig");
@@ -7,6 +9,19 @@ const surface = @import("tool_surface.zig");
 const mcp = @import("mcp.zig");
 const Provider = @import("provider.zig").Provider;
 const Agent = @import("agent.zig").Agent;
+const local_tools = @import("local_tools.zig");
+const schedule = @import("schedule.zig");
+
+fn withExtras(arena: Allocator, base: []const schema.ToolSpec) ![]const schema.ToolSpec {
+    const a = local_tools.catalogExtras(arena);
+    const b = schedule.catalogExtras(arena);
+    if (a.len == 0 and b.len == 0) return base;
+    const out = try arena.alloc(schema.ToolSpec, base.len + a.len + b.len);
+    @memcpy(out[0..base.len], base);
+    @memcpy(out[base.len..][0..a.len], a);
+    @memcpy(out[base.len + a.len ..], b);
+    return out;
+}
 
 pub fn toolsJson(self: *const Agent) []const u8 {
     if (self.sub) {
@@ -35,7 +50,7 @@ pub fn ensureRootTools(self: *Agent, kind: Provider.Kind) !void {
     const specs = if (self.sub)
         try surface.filterSpecs(@TypeOf(schema.base_specs[0]), self.arena, schema.base_specs[0..])
     else
-        try schema.effectiveRootSpecs(self.arena);
+        try withExtras(self.arena, try schema.effectiveRootSpecs(self.arena));
     const connected: []const mcp.Tool = if (self.registry) |registry|
         (if (self.sub) try surface.filterWorkerMcp(self.arena, registry.tools) else registry.tools)
     else
diff --git a/src/agent_request.zig b/src/agent_request.zig
index 7cd03bf2..3cbf5ae0 100644
--- a/src/agent_request.zig
+++ b/src/agent_request.zig
@@ -537,7 +537,10 @@ pub fn request(self: *Agent, tools_in: ?[]const u8) !std.json.ObjectMap {
             // "This response_format type is unavailable now") must not lose the
             // --output-schema contract — retry in json_object mode with the
             // schema moved into the prompt, on the same ladder as cap_new.
-            if (self.output_schema != null and !self.sox_json_object and std.mem.indexOf(u8, msg, "response_format") != null) {
+            if (self.output_schema != null and !self.sox_json_object and
+                (std.mem.indexOf(u8, msg, "response_format") != null or
+                    std.mem.indexOf(u8, msg, "output_config") != null))
+            {
                 self.sox_json_object = true;
                 continue;
             }
diff --git a/src/agent_request_body.zig b/src/agent_request_body.zig
index f8755edd..04377d38 100644
--- a/src/agent_request_body.zig
+++ b/src/agent_request_body.zig
@@ -96,10 +96,8 @@ pub fn buildBody(self: *Agent, tools: ?[]const u8, force_tool: bool, stream: boo
                     try s.objectField("tool_choice");
                     try s.print("{s}", .{"{\"type\":\"any\"}"});
                 }
-            } else if (self.output_schema != null) {
-                // #543: this wire has no response_format at all — the schema is
-                // ALWAYS delivered as the structured_output tool (dsh pattern).
-                try @import("agent_request_body_responses.zig").writeAnthropicStructuredTool(&s, self.output_schema.?);
+            } else if (self.output_schema) |schema_json| {
+                try @import("agent_request_body_responses.zig").writeAnthropicSchema(&s, self, schema_json);
             }
             try s.objectField("messages");
             // Cache the conversation prefix too (not just system) on the real
diff --git a/src/agent_request_body_responses.zig b/src/agent_request_body_responses.zig
index b76b962e..3c91f448 100644
--- a/src/agent_request_body_responses.zig
+++ b/src/agent_request_body_responses.zig
@@ -134,13 +134,19 @@ pub fn schemaAwarePrompt(self: *Agent) ![]const u8 {
     const base = self.systemPrompt();
     if (self.output_schema == null) return base;
     // #543 degrade: this provider cannot enforce json_schema server-side —
-    // learned on the chat wire (sox), structural on the anthropic wire (no
-    // response_format exists) — so the schema itself must reach the model:
-    // through the structured_output tool when offered (the tools-off
-    // formatting turn), else as the entire final message.
+    // learned on the chat wire (sox), or structural on minimax / kimi-anthropic
+    // (tool mode) — so the schema itself must reach the model through the
+    // structured_output tool when offered (the tools-off formatting turn),
+    // else as the entire final message.
     // Chat-wire only for sox: a stale learned flag must not perturb the
     // responses wire's bytes (native text.format needs no prompt embed).
-    if ((self.provider.kind == .openai and self.sox_json_object) or self.provider.kind == .anthropic) return std.mem.concat(self.scratchAlloc(), u8, &.{
+    // Full-schema embed is the tool-mode / learned-fallback path. Native
+    // Anthropic `output_config.format` (provider id `anthropic`, no sox)
+    // enforces server-side on the formatting turn — same light prompt as
+    // Responses. minimax / kimi-anthropic stay on the tool.
+    const anthropic_tool_mode = self.provider.kind == .anthropic and
+        (self.sox_json_object or !std.mem.eql(u8, self.provider.id, "anthropic"));
+    if ((self.provider.kind == .openai and self.sox_json_object) or anthropic_tool_mode) return std.mem.concat(self.scratchAlloc(), u8, &.{
         base,
         "\n\nA JSON output schema is enforced on your final answer. Use tools first to gather every fact you need — never guess values. This provider cannot enforce the schema server-side, so satisfy it yourself: call the structured_output tool when it is offered, otherwise reply with a single JSON object, matching exactly this schema: ",
         self.output_schema.?,
@@ -206,11 +212,35 @@ pub fn writeStructuredOutputTool(s: *std.json.Stringify, schema_json: []const u8
     try s.endArray();
 }
 
-/// #543, anthropic wire: same tool, Anthropic tool shape (input_schema). This
-/// wire has no response_format at all, so the tool is not a degrade — it is
-/// the only server-visible carrier the schema has (Anthropic's own canonical
-/// structured-output pattern). Unforced, as everywhere: forced tool_choice
-/// conflicts with thinking on this wire too.
+/// #550: native Anthropic structured outputs on the tools-off formatting
+/// turn. Provider id `anthropic` only — minimax / kimi-anthropic keep the
+/// structured_output tool, and a learned sox flag falls back to it too.
+pub fn writeAnthropicSchema(s: *std.json.Stringify, self: *const Agent, schema_json: []const u8) !void {
+    if (std.mem.eql(u8, self.provider.id, "anthropic") and !self.sox_json_object) {
+        try writeAnthropicOutputConfig(s, schema_json);
+        return;
+    }
+    try writeAnthropicStructuredTool(s, schema_json);
+}
+
+/// kimi-code's anthropic adapter: `output_config.format = {type, schema}`.
+/// Formatting turn only (ADR 0001): never attach this to a tools turn.
+pub fn writeAnthropicOutputConfig(s: *std.json.Stringify, schema_json: []const u8) !void {
+    try s.objectField("output_config");
+    try s.beginObject();
+    try s.objectField("format");
+    try s.beginObject();
+    try s.objectField("type");
+    try s.write("json_schema");
+    try s.objectField("schema");
+    try s.print("{s}", .{schema_json});
+    try s.endObject();
+    try s.endObject();
+}
+
+/// #543, anthropic wire: same tool, Anthropic tool shape (input_schema).
+/// Fallback for minimax / kimi-anthropic and for a rejected output_config.
+/// Unforced: forced tool_choice conflicts with thinking on this wire too.
 pub fn writeAnthropicStructuredTool(s: *std.json.Stringify, schema_json: []const u8) !void {
     try s.objectField("tools");
     try s.beginArray();
@@ -424,35 +454,54 @@ test "#543: json_schema rejection degrades dsh-style — forced structured_outpu
     try std.testing.expect(std.mem.indexOf(u8, body2, "json_schema") == null);
 }
 
-test "#543: the anthropic wire always carries the schema as a structured_output tool (no response_format exists there)" {
+test "#550: anthropic id uses output_config.format on the formatting turn; tool-mode is the fallback" {
     var arena_state = std.heap.ArenaAllocator.init(std.testing.allocator);
     defer arena_state.deinit();
     const schema = "{\"type\":\"object\",\"properties\":{\"answer\":{\"type\":\"string\"}},\"required\":[\"answer\"],\"additionalProperties\":false}";
     var agent = try testAgentFor(arena_state.allocator(), "anthropic", .anthropic, "claude-sonnet-5");
-    agent.output_schema = schema; // no sox learning needed — structural on this wire
+    agent.output_schema = schema;
 
-    // Tools-off formatting turn: anthropic tool shape, schema as input_schema, unforced.
+    // Tools-off formatting turn: native json_schema (ADR 0001 — not on tools turns).
     const body = try agent.buildBody(null, false, true, true);
     defer std.testing.allocator.free(body);
-    try std.testing.expect(std.mem.indexOf(u8, body, "\"tools\":[{\"name\":\"structured_output\"") != null);
-    try std.testing.expect(std.mem.indexOf(u8, body, "\"input_schema\":{\"type\":\"object\",\"properties\":{\"answer\"") != null);
-    try std.testing.expect(std.mem.indexOf(u8, body, "tool_choice") == null);
+    try std.testing.expect(std.mem.indexOf(u8, body, "\"output_config\":{\"format\":{\"type\":\"json_schema\",\"schema\":{\"type\":\"object\"") != null);
+    try std.testing.expect(std.mem.indexOf(u8, body, "structured_output") == null);
     try std.testing.expect(std.mem.indexOf(u8, body, "response_format") == null);
-    // The cached system block carries the schema-aware suffix (was self.systemPrompt() before — the schema never reached this wire at all).
-    try std.testing.expect(std.mem.indexOf(u8, body, "cannot enforce the schema server-side") != null);
+    try std.testing.expect(std.mem.indexOf(u8, body, "cannot enforce the schema server-side") == null);
 
-    // Agentic turn with real tools: no synthetic tool, but the suffix still teaches the contract.
+    // Agentic turn: no grammar (ADR 0001), light prompt, no synthetic tool.
     const tools = "[{\"name\":\"bash\",\"description\":\"\",\"input_schema\":{\"type\":\"object\"}}]";
     const body2 = try agent.buildBody(tools, false, true, true);
     defer std.testing.allocator.free(body2);
     try std.testing.expect(std.mem.indexOf(u8, body2, "\"name\":\"structured_output\"") == null);
-    try std.testing.expect(std.mem.indexOf(u8, body2, "cannot enforce the schema server-side") != null);
-
-    // No schema → byte-identical prompt path (base), no tools field at all when tools==null.
+    try std.testing.expect(std.mem.indexOf(u8, body2, "output_config") == null);
+    try std.testing.expect(std.mem.indexOf(u8, body2, "cannot enforce the schema server-side") == null);
+    try std.testing.expect(std.mem.indexOf(u8, body2, "only the final message must match the schema") != null);
+
+    // Learned rejection: same quirk flag as sox_json_object → tool mode.
+    agent.sox_json_object = true;
+    const body3 = try agent.buildBody(null, false, true, true);
+    defer std.testing.allocator.free(body3);
+    try std.testing.expect(std.mem.indexOf(u8, body3, "\"tools\":[{\"name\":\"structured_output\"") != null);
+    try std.testing.expect(std.mem.indexOf(u8, body3, "\"input_schema\":{\"type\":\"object\",\"properties\":{\"answer\"") != null);
+    try std.testing.expect(std.mem.indexOf(u8, body3, "output_config") == null);
+    try std.testing.expect(std.mem.indexOf(u8, body3, "cannot enforce the schema server-side") != null);
+
+    // minimax keeps the tool even without sox (no native output_config).
+    var mm = try testAgentFor(arena_state.allocator(), "minimax", .anthropic, "MiniMax-M2.5");
+    mm.output_schema = schema;
+    const mm_body = try mm.buildBody(null, false, true, true);
+    defer std.testing.allocator.free(mm_body);
+    try std.testing.expect(std.mem.indexOf(u8, mm_body, "\"tools\":[{\"name\":\"structured_output\"") != null);
+    try std.testing.expect(std.mem.indexOf(u8, mm_body, "output_config") == null);
+
+    // No schema → byte-identical prompt path (base), no tools / output_config.
+    agent.sox_json_object = false;
     agent.output_schema = null;
     const plain = try agent.buildBody(null, false, true, true);
     defer std.testing.allocator.free(plain);
     try std.testing.expect(std.mem.indexOf(u8, plain, "structured_output") == null);
+    try std.testing.expect(std.mem.indexOf(u8, plain, "output_config") == null);
     try std.testing.expect(std.mem.indexOf(u8, plain, "\"tools\"") == null);
 }
 
diff --git a/src/agent_tools.zig b/src/agent_tools.zig
index a91bb4ff..dcb1a8c1 100644
--- a/src/agent_tools.zig
+++ b/src/agent_tools.zig
@@ -49,6 +49,8 @@ const brief_diversity = @import("brief_diversity.zig"); // #382: N sibling spawn
 const playbook_glue = @import("playbook_glue.zig"); // #381: the note_constraint meta arm
 const mcp_schema_gate = @import("mcp_schema_gate.zig"); // #416: the load_tool_schemas meta arm
 const native_fold = @import("native_fold.zig"); // folded native power tools: load_tool_schemas's native half
+const local_tools = @import("local_tools.zig");
+const schedule = @import("schedule.zig");
 const util = @import("util.zig"); // #225: unixMs, for the clock_sleep interrupted-elapsed measurement
 
 // #440: the ONE size contract for a tool result — preview + durable handle +
@@ -102,7 +104,7 @@ pub fn runTools(self: *Agent, calls: []const ToolCall) ![]ExecResult {
         try self.sayToolUse(call);
         if (self.output_schema != null and std.mem.eql(u8, call.name, "structured_output")) {
             results[i] = @import("agent_request_body_responses.zig").handleStructuredOutput(self, call.input); // #543 tool-mode capture
-        } else if (isMetaName(call.name)) {
+        } else if (isMetaName(call.name) or local_tools.isInstall(call.name) or schedule.isName(call.name)) {
             results[i] = try self.handleMeta(call);
         } else if (try self.gateTool(call)) |denied| {
             results[i] = denied;
@@ -312,6 +314,14 @@ pub fn handleMeta(self: *Agent, call: ToolCall) !ExecResult {
     // #469: sideways coordination between co-resident root sessions.
     if (std.mem.eql(u8, call.name, peer_channel.tool_name)) return peer_channel.handleMessage(self, call);
     if (std.mem.eql(u8, call.name, workspace_switch.tool_name)) return workspace_switch.handle(self, call);
+    if (local_tools.isInstall(call.name)) {
+        if (main_mod.plan_mode) return .{ .text = "plan mode is on — install_agent_tool writes .graff/tools; switch to act first.", .is_error = true };
+        return local_tools.handleInstall(self, call);
+    }
+    if (schedule.isName(call.name)) {
+        if (main_mod.plan_mode) return .{ .text = "plan mode is on — schedule_task writes .graff/schedule; switch to act first.", .is_error = true };
+        return schedule.handleTool(self, call);
+    }
     if (std.mem.eql(u8, call.name, "attempt_completion")) {
         if (!self.review_mode and self.eval_cmd != null and (!self.eval_verified or self.eval_repair_pending)) {
             const message = if (self.eval_repair_pending)
diff --git a/src/channel_worker.zig b/src/channel_worker.zig
new file mode 100644
index 00000000..17e204db
--- /dev/null
+++ b/src/channel_worker.zig
@@ -0,0 +1,196 @@
+//! Host-managed channel workers (#558). JSONL over stdin/stdout: inbound
+//! `{"type":"message","text":"..."}` wakes the session; outbound
+//! `{"type":"send","text":"..."}` is the outbox. Discord/Slack fronts come
+//! later; this is the protocol + wake seam.
+
+const std = @import("std");
+const Io = std.Io;
+const Allocator = std.mem.Allocator;
+const Value = std.json.Value;
+
+const session_wake = @import("session_wake.zig");
+const agent_mod = @import("agent.zig");
+const Agent = agent_mod.Agent;
+
+pub const inbound_type = "message";
+pub const outbound_type = "send";
+
+const cap: usize = 16;
+var mu: Io.Mutex = .init;
+var ring: [cap][]u8 = undefined;
+var count: usize = 0;
+var gpa_hold: ?Allocator = null;
+
+pub fn parseInbound(arena: Allocator, line: []const u8) ?[]const u8 {
+    const v = std.json.parseFromSliceLeaky(Value, arena, std.mem.trim(u8, line, " \t\r\n"), .{}) catch return null;
+    if (v != .object) return null;
+    const ty = if (v.object.get("type")) |x| (if (x == .string) x.string else "") else "";
+    if (!std.mem.eql(u8, ty, inbound_type)) return null;
+    const text = if (v.object.get("text")) |x| (if (x == .string) x.string else "") else "";
+    return if (text.len == 0) null else text;
+}
+
+pub fn formatOutbound(arena: Allocator, text: []const u8) ![]const u8 {
+    var aw: std.Io.Writer.Allocating = .init(arena);
+    var s: std.json.Stringify = .{ .writer = &aw.writer };
+    try s.write(.{ .type = outbound_type, .text = text });
+    try aw.writer.writeByte('\n');
+    return aw.writer.buffered();
+}
+
+/// Queue an inbound worker line (host thread). `gpa` owns the copy.
+pub fn record(io: Io, gpa: Allocator, text: []const u8) void {
+    const owned = gpa.dupe(u8, text) catch return;
+    mu.lockUncancelable(io);
+    defer mu.unlock(io);
+    gpa_hold = gpa;
+    if (count == cap) {
+        gpa.free(ring[0]);
+        std.mem.copyForwards([]u8, ring[0 .. cap - 1], ring[1..cap]);
+        count = cap - 1;
+    }
+    ring[count] = owned;
+    count += 1;
+}
+
+pub fn takeAll(io: Io, arena: Allocator) []const []const u8 {
+    mu.lockUncancelable(io);
+    defer mu.unlock(io);
+    if (count == 0) return &.{};
+    const out = arena.alloc([]const u8, count) catch return &.{};
+    var i: usize = 0;
+    while (i < count) : (i += 1) {
+        out[i] = arena.dupe(u8, ring[i]) catch "";
+        if (gpa_hold) |g| g.free(ring[i]);
+    }
+    count = 0;
+    return out;
+}
+
+pub fn deliver(root: *Agent) void {
+    if (root.sub) return;
+    const lines = takeAll(root.io, root.arena);
+    for (lines) |text| {
+        const wake = std.fmt.allocPrint(root.arena, "[adapter] {s}", .{text}) catch continue;
+        session_wake.inject(root, wake);
+    }
+}
+
+/// `/adapter send <text>` posts to the outbox (tests + a later live worker).
+pub fn slashCommand(root: *Agent, arena: Allocator, line: []const u8, out: *Io.Writer) !bool {
+    const rest = std.mem.trim(u8, line["/adapter".len..], " \t");
+    if (std.mem.startsWith(u8, rest, "send ") or std.mem.startsWith(u8, rest, "send\t")) {
+        const text = std.mem.trim(u8, rest["send".len..], " \t");
+        if (text.len == 0) {
+            try out.writeAll("usage: /adapter send <text>\n");
+            try out.flush();
+            return true;
+        }
+        const wire = try formatOutbound(arena, text);
+        try out.writeAll(wire);
+        try out.flush();
+        return true;
+    }
+    if (std.mem.eql(u8, rest, "inbox")) {
+        const lines = takeAll(root.io, arena);
+        if (lines.len == 0) try out.writeAll("(adapter inbox empty)\n") else {
+            for (lines) |t| try out.print("{s}\n", .{t});
+        }
+        try out.flush();
+        return true;
+    }
+    try out.writeAll("usage: /adapter send <text> | /adapter inbox\n");
+    try out.flush();
+    return true;
+}
+
+test "parseInbound accepts message lines and drops the rest" {
+    var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena.deinit();
+    const a = arena.allocator();
+    try std.testing.expectEqualStrings("hi", parseInbound(a, "{\"type\":\"message\",\"text\":\"hi\"}").?);
+    try std.testing.expect(parseInbound(a, "{\"type\":\"send\",\"text\":\"hi\"}") == null);
+    try std.testing.expect(parseInbound(a, "not-json") == null);
+}
+
+test "formatOutbound is a send line" {
+    var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena.deinit();
+    const wire = try formatOutbound(arena.allocator(), "pong");
+    try std.testing.expect(std.mem.indexOf(u8, wire, "\"type\":\"send\"") != null);
+    try std.testing.expect(std.mem.indexOf(u8, wire, "pong") != null);
+    try std.testing.expect(std.mem.endsWith(u8, wire, "\n"));
+}
+
+/// Idle TUI auto-turn: drain the inbox into a buffer without an Agent.
+pub fn takeWake(io: Io, buf: []u8) ?[]const u8 {
+    var scratch: [16 * 1024]u8 = undefined;
+    var fba = std.heap.FixedBufferAllocator.init(&scratch);
+    const lines = takeAll(io, fba.allocator());
+    if (lines.len == 0) return null;
+    var used: usize = 0;
+    for (lines) |text| {
+        const piece = if (used == 0)
+            std.fmt.bufPrint(buf[used..], "[adapter] {s}", .{text}) catch break
+        else
+            std.fmt.bufPrint(buf[used..], "\n[adapter] {s}", .{text}) catch break;
+        used += piece.len;
+    }
+    return if (used == 0) null else buf[0..used];
+}
+
+test "slashCommand send is a send line; inbox drains takeWake" {
+    const io = std.testing.io;
+    const gpa = std.testing.allocator;
+    var arena = std.heap.ArenaAllocator.init(gpa);
+    defer arena.deinit();
+    _ = takeAll(io, arena.allocator());
+    var root: Agent = undefined;
+    root.io = io;
+    var aw: std.Io.Writer.Allocating = .init(gpa);
+    defer aw.deinit();
+    try std.testing.expect(try slashCommand(&root, arena.allocator(), "/adapter send pong", &aw.writer));
+    try std.testing.expect(std.mem.indexOf(u8, aw.writer.buffered(), "\"type\":\"send\"") != null);
+    record(io, gpa, "hello");
+    var buf: [128]u8 = undefined;
+    const wake = takeWake(io, &buf) orelse return error.Empty;
+    try std.testing.expectEqualStrings("[adapter] hello", wake);
+    try std.testing.expect(takeWake(io, &buf) == null);
+}
+
+test "deliver injects recorded inbound as a user line" {
+    const io = std.testing.io;
+    const gpa = std.testing.allocator;
+    var arena = std.heap.ArenaAllocator.init(gpa);
+    defer arena.deinit();
+    _ = takeAll(io, arena.allocator());
+    record(io, gpa, "from irc");
+    const drop = struct {
+        fn emit(_: *anyopaque, _: @import("engine_sink.zig").Stamped) void {}
+    };
+    const vt = @import("engine_sink.zig").VTable{ .emit = drop.emit, .durable = false };
+    var root: Agent = undefined;
+    root.sub = false;
+    root.io = io;
+    root.arena = arena.allocator();
+    root.messages = std.json.Array.init(arena.allocator());
+    root.sink = .{ .ctx = undefined, .vt = &vt };
+    deliver(&root);
+    try std.testing.expectEqual(@as(usize, 1), root.messages.items.len);
+    try std.testing.expectEqualStrings("user", root.messages.items[0].object.get("role").?.string);
+    try std.testing.expect(std.mem.indexOf(u8, root.messages.items[0].object.get("content").?.string, "from irc") != null);
+}
+
+test "record then takeAll drains once" {
+    const io = std.testing.io;
+    const gpa = std.testing.allocator;
+    var arena = std.heap.ArenaAllocator.init(gpa);
+    defer arena.deinit();
+    _ = takeAll(io, arena.allocator());
+    record(io, gpa, "one");
+    record(io, gpa, "two");
+    const got = takeAll(io, arena.allocator());
+    try std.testing.expectEqual(@as(usize, 2), got.len);
+    try std.testing.expectEqualStrings("one", got[0]);
+    try std.testing.expectEqual(@as(usize, 0), takeAll(io, arena.allocator()).len);
+}
diff --git a/src/cli.zig b/src/cli.zig
index c65e2dcb..5b245092 100644
--- a/src/cli.zig
+++ b/src/cli.zig
@@ -170,7 +170,7 @@ pub const changelog_text =
     \\
     \\0.0.244
     \\  • Co-resident graff sessions now see each other: a startup warning names any live session already in your worktree, and the first git mutation, file write, or shell move against a peer's tree pauses once for a deliberate re-issue — two agents can no longer silently tear one tree
-    \\  • Sessions can message each other: the peer_message tool and /tell post to a shared channel every co-resident session hears (address one by name, "all" reaches every session on the device), delivered mid-task at step boundaries with the sender's current goal attached
+    \\  • Sessions can message each other: peer_message posts to this folder's room, or names one session as a DM (not "all" — retired for the model). /tell <session> is a human DM; /tell all is the user's device-wide broadcast. Delivery is at the receiver's next step boundary, with the sender's current goal attached
     \\  • The model is told up front who else is live and what they're working on, so it coordinates — or picks disjoint work — before any collision
     \\  • /peek <session> shows what a live co-resident session is doing right now — its last prompt, last action, last tool
     \\  • Session recaps ride the event stream: settled turns carry a Completed or Needs-input status with a one-line recap for the GUI agent overview
@@ -240,7 +240,7 @@ pub const usage_text =
     \\  graff mcp                         list configured MCP servers
     \\  graff plugins [load <name>]       list Claude/Cursor/Grok/Codex plugin trees (in place)
     \\  graff learn [help]                local mutate/evaluate/promote/rollback engine
-    \\  graff worktree list              list the per-tab worktrees created by -w
+    \\  graff worktree list              list -w tabs and experiment-pool trees (tagged)
     \\  graff worktree merge <name>      squash-land worktree-<name> onto the current branch + clean up
     \\  graff worktree remove <name>     discard worktree-<name> (drops its scratch work) + delete the branch
     \\  graff worktree prune             drop git registrations for worktrees whose dirs were deleted
diff --git a/src/command_catalog.zig b/src/command_catalog.zig
index 2d894fc4..fcdac633 100644
--- a/src/command_catalog.zig
+++ b/src/command_catalog.zig
@@ -28,6 +28,8 @@ pub const commands = [_]Item{
     .{ .name = "/rename", .usage = "/rename <title>", .desc = "set the current session title" },
     .{ .name = "/goal", .usage = "/goal [30m] [text|pause|resume|status|clear]", .desc = "set a standing objective and work it autonomously; an optional 30s/30m/2h budget paces the run; pause/resume steering, status shows state, clear removes it" },
     .{ .name = "/loop", .usage = "/loop [30m] <prompt>", .desc = "the same autonomous run as /goal, without adopting a standing objective" },
+    .{ .name = "/schedule", .usage = "/schedule <30s|5m|2h> <prompt>", .desc = "fire a prompt later; delay tokens match /loop (not a standing goal)" },
+    .{ .name = "/adapter", .usage = "/adapter send <text>|inbox", .desc = "channel-worker outbox / inbox (JSONL protocol; Discord/Slack fronts later)" },
     .{ .name = "/review", .usage = "/review <target or instructions>", .desc = "run one isolated read-only review pass; no edits, delegation, or workflows" },
     .{ .name = "/never", .usage = "/never [<text>|rm <id-or-text>]", .desc = "standing constraints that ride every brief; bare opens a searchable picker (TTY) or lists them, rm <id-or-text> retires one (alias /constraint)" },
     .{ .name = "/tell", .usage = "/tell <session|all> <text>", .desc = "message a running graff: <session> is a DM (only it hears, any folder); all broadcasts to every graff on this device; /sessions lists who's around" },
diff --git a/src/commands_experiment.zig b/src/commands_experiment.zig
index 27c77822..a15e7397 100644
--- a/src/commands_experiment.zig
+++ b/src/commands_experiment.zig
@@ -38,6 +38,12 @@ pub fn tryHandle(root: *Agent, arena: Allocator, line: []const u8, out: *Io.Writ
         try out.flush();
         return true;
     };
+    if (pool.directive()) |d| {
+        if (root.sys_base.len > 0 and std.mem.indexOf(u8, root.sys_base, pool.directive_marker) == null) {
+            const next = std.fmt.allocPrint(arena, "{s}\n\n{s}", .{ root.sys_base, d }) catch root.sys_base;
+            @import("prompts.zig").setSystemPrompts(root, next, arena) catch {};
+        }
+    }
     try out.print("  {s}experiment {s}: {d} trees under .graff/worktrees/exp-{s}/ — spawn, do not edit here{s}\n", .{
         style.dim, id, minted, id, style.reset,
     });
diff --git a/src/commands_misc.zig b/src/commands_misc.zig
index ebae797f..aad656ec 100644
--- a/src/commands_misc.zig
+++ b/src/commands_misc.zig
@@ -163,6 +163,8 @@ pub fn tryHandle(root: *Agent, keys: *Keys, arena: Allocator, line: []const u8,
     if (try @import("adopt.zig").trySlash(root.io, arena, root.home, line, out)) return true;
     if (try commands_privacy.tryHandle(root, line, out)) return true;
     if (try playbook_glue.command(root, arena, line, out)) return true; // #381 /never | /constraint
+    if (std.mem.startsWith(u8, line, "/schedule") and (line.len == 9 or line[9] == ' ' or line[9] == '\t')) return @import("schedule.zig").slashCommand(root, arena, line, out);
+    if (std.mem.startsWith(u8, line, "/adapter") and (line.len == 8 or line[8] == ' ' or line[8] == '\t')) return @import("channel_worker.zig").slashCommand(root, arena, line, out);
     if (try side_question.command(root, arena, line, out)) return true; // #415 /btw
     // #321: doctor.zig shipped with a catalog entry but no dispatch, so /doctor
     // was advertised in /help and the `/` menu while answering "unknown command".
diff --git a/src/exec.zig b/src/exec.zig
index 308fee86..c58ce575 100644
--- a/src/exec.zig
+++ b/src/exec.zig
@@ -67,6 +67,7 @@ const native_fold = @import("native_fold.zig"); // folded native power tools: la
 const vision = @import("vision.zig"); // read_file stages images like MCP image results (#249)
 const input_util = @import("input_util.zig");
 const imagegen = @import("imagegen.zig"); // #352: the codex-gated image tool (advertising lives in schema.zig/tool_gates.zig)
+const local_tools = @import("local_tools.zig");
 
 fn learningArgv(argv: *[10][]const u8, exe_path: []const u8, contribute: bool) usize {
     var argc: usize = 0;
@@ -163,6 +164,10 @@ pub fn execTool(ctx: ToolCtx, call: ToolCall) ToolOutput {
 /// one that was never advertised (layer 1 is schema.zig). FIRST in the guard
 /// chain; an `mcp__*` name never matches, so the sandbox proxy keeps working.
 fn noLocalToolsGate(ctx: ToolCtx, call: ToolCall) ?ToolOutput {
+    if (no_local_tools.enabled and local_tools.isLocal(call.name)) {
+        const text = ctx.gpa.dupe(u8, no_local_tools.refusal_text) catch return .{ .text = &.{}, .is_error = true };
+        return .{ .text = text, .is_error = true };
+    }
     if (!no_local_tools.blocks(call.name)) return null;
     const text = ctx.gpa.dupe(u8, no_local_tools.refusal_text) catch return .{ .text = &.{}, .is_error = true };
     return .{ .text = text, .is_error = true };
@@ -175,7 +180,7 @@ fn execToolInner(ctx: ToolCtx, call: ToolCall) !ToolOutput {
     // Plan mode backstop: the root gate already denies these with a nicer
     // message; this catches subagents (which skip the gate entirely).
     if (main_mod.plan_mode) {
-        if (std.mem.eql(u8, call.name, "learn_candidate") or std.mem.eql(u8, call.name, "write_file") or std.mem.eql(u8, call.name, "edit_file") or std.mem.eql(u8, call.name, imagegen.tool_name) or mcp.Registry.isMcp(call.name)) return .{
+        if (local_tools.isLocal(call.name) or std.mem.eql(u8, call.name, "learn_candidate") or std.mem.eql(u8, call.name, "write_file") or std.mem.eql(u8, call.name, "edit_file") or std.mem.eql(u8, call.name, imagegen.tool_name) or mcp.Registry.isMcp(call.name)) return .{
             .text = try gpa.dupe(u8, "plan mode is on — read-only; describe the change instead of making it"),
             .is_error = true,
         };
@@ -408,6 +413,7 @@ fn execToolInner(ctx: ToolCtx, call: ToolCall) !ToolOutput {
     if (std.mem.eql(u8, call.name, "subagent")) return execSubagent(ctx, input);
     if (std.mem.eql(u8, call.name, "workflow")) return execWorkflow(ctx, input);
     if (std.mem.eql(u8, call.name, @import("rlm.zig").tool_name)) return @import("rlm.zig").exec(ctx, input);
+    if (local_tools.isLocal(call.name)) return local_tools.exec(gpa, io, call.name, input);
     if (std.mem.eql(u8, call.name, "agent_output")) {
         const id = intField(input, "id") orelse return missingArg(gpa, "id");
         const wait_ms = intField(input, "wait_ms") orelse 0;
diff --git a/src/experiment_pool.zig b/src/experiment_pool.zig
index 44621aa1..cf968fea 100644
--- a/src/experiment_pool.zig
+++ b/src/experiment_pool.zig
@@ -1,8 +1,8 @@
-//! #629 first slice: a pre-minted worktree pool for one experiment.
-//! Lives on `release/v0.0.279` only (not merged to main). Fan-out seats
-//! children in already-created trees so the first tool is not `git worktree add`.
+//! #629 experiment worktree pool: mint N trees first, seat children in them,
+//! force the root to spawn, list/deliver-back without deleting the pool.
 
 const std = @import("std");
+const builtin = @import("builtin");
 const Io = std.Io;
 const Allocator = std.mem.Allocator;
 
@@ -12,12 +12,16 @@ const ranOk = process_runner.ranOk;
 
 pub const cap: u8 = 16;
 
-const Slot = struct { path: []const u8, branch: []const u8 };
+pub const Seat = struct { path: []const u8 = "", branch: []const u8 = "", base: []const u8 = "" };
+
+/// Standing line injected into the root system prompt while a pool is armed.
+pub const directive_marker = "Experiment pool `";
 
 var g_n: u8 = 0;
 var g_next: u8 = 0;
 var g_id: []const u8 = "";
-var g_slots: [cap]Slot = @splat(.{ .path = "", .branch = "" });
+var g_directive: []const u8 = "";
+var g_slots: [cap]Seat = @splat(.{});
 
 pub fn enabled() bool {
     return g_n > 0;
@@ -36,7 +40,8 @@ pub fn reset() void {
     g_n = 0;
     g_next = 0;
     g_id = "";
-    g_slots = @splat(.{ .path = "", .branch = "" });
+    g_directive = "";
+    g_slots = @splat(.{});
 }
 
 pub fn sanitizeId(buf: []u8, id: []const u8) []const u8 {
@@ -57,10 +62,30 @@ pub fn slotBranch(buf: []u8, id: []const u8, i: u8) []const u8 {
 
 /// Next unused seat, or null when the pool is empty/exhausted.
 pub fn claim() ?[]const u8 {
+    const seat = claimSeat() orelse return null;
+    return seat.path;
+}
+
+/// Path + branch + creation HEAD so finish can report keep-reason without
+/// deleting the tree (ADR 0037: pool trees are not auto-deleted).
+pub fn claimSeat() ?Seat {
     if (g_next >= g_n) return null;
     const i = g_next;
     g_next += 1;
-    return g_slots[i].path;
+    return g_slots[i];
+}
+
+/// Root must spawn, not edit. Null when the pool is off.
+pub fn directive() ?[]const u8 {
+    if (g_n == 0 or g_directive.len == 0) return null;
+    return g_directive;
+}
+
+/// `graff worktree list` tag: minted pool trees, even after this process resets.
+pub fn isExperimentTree(path: []const u8, branch: []const u8) bool {
+    if (std.mem.indexOf(u8, path, ".graff/worktrees/exp-") != null) return true;
+    const b = if (std.mem.startsWith(u8, branch, "refs/heads/")) branch["refs/heads/".len..] else branch;
+    return std.mem.startsWith(u8, b, "graff/exp/");
 }
 
 pub fn statusLine(buf: []u8) []const u8 {
@@ -78,19 +103,31 @@ fn absOrRel(io: Io, arena: Allocator, path: []const u8) ![]const u8 {
     return arena.dupe(u8, buf[0..n]);
 }
 
-fn mintOne(gpa: Allocator, io: Io, arena: Allocator, id: []const u8, i: u8) !Slot {
+fn readHead(gpa: Allocator, io: Io, arena: Allocator, path: []const u8) []const u8 {
+    const r = runCapped(gpa, io, &.{ "git", "-C", path, "rev-parse", "HEAD" }, 4096, 4096, 15_000) catch return "";
+    defer {
+        gpa.free(r.stdout);
+        gpa.free(r.stderr);
+    }
+    if (!ranOk(r)) return "";
+    return arena.dupe(u8, std.mem.trim(u8, r.stdout, " \t\r\n")) catch "";
+}
+
+fn mintOne(gpa: Allocator, io: Io, arena: Allocator, id: []const u8, i: u8) !Seat {
     var pbuf: [256]u8 = undefined;
     var bbuf: [256]u8 = undefined;
     const rel = slotPath(&pbuf, id, i);
     const branch = try arena.dupe(u8, slotBranch(&bbuf, id, i));
-    if (dirExists(io, rel)) return .{ .path = try absOrRel(io, arena, rel), .branch = branch };
-    const add = runCapped(gpa, io, &.{ "git", "worktree", "add", rel, "-b", branch }, 8192, 8192, 60_000) catch return error.CreateFailed;
-    defer {
-        gpa.free(add.stdout);
-        gpa.free(add.stderr);
+    if (!dirExists(io, rel)) {
+        const add = runCapped(gpa, io, &.{ "git", "worktree", "add", rel, "-b", branch }, 8192, 8192, 60_000) catch return error.CreateFailed;
+        defer {
+            gpa.free(add.stdout);
+            gpa.free(add.stderr);
+        }
+        if (!ranOk(add) and !dirExists(io, rel)) return error.CreateFailed;
     }
-    if (!ranOk(add) and !dirExists(io, rel)) return error.CreateFailed;
-    return .{ .path = try absOrRel(io, arena, rel), .branch = branch };
+    const path = try absOrRel(io, arena, rel);
+    return .{ .path = path, .branch = branch, .base = readHead(gpa, io, arena, path) };
 }
 
 /// Create or reuse N trees under `.graff/worktrees/exp-{id}/`. Idempotent
@@ -113,9 +150,55 @@ pub fn arm(gpa: Allocator, io: Io, arena: Allocator, id: []const u8, n: u8) !u8
     }
     g_n = n;
     g_next = 0;
+    g_directive = try std.fmt.allocPrint(arena, "{s}{s}` is armed with {d} pre-minted worktrees under `.graff/worktrees/exp-{s}/` (branches `graff/exp/{s}/0` …). You MUST call the subagent tool once per independent task or A/B arm so each child claims a seat. Do not edit files in this caller tree. After children return, synthesize — do not redo their work here.", .{
+        directive_marker, g_id, n, g_id, g_id,
+    });
     return n;
 }
 
+/// Report path / branch / keep-reason / diffstat. Never removes the tree.
+pub fn deliverNote(gpa: Allocator, io: Io, seat: Seat) []const u8 {
+    const keep = @import("agent_worktree.zig");
+    const st = runCapped(gpa, io, &.{ "git", "-C", seat.path, "status", "--porcelain" }, 1 << 16, 8192, 30_000) catch
+        return std.fmt.allocPrint(gpa, "\n\n[experiment seat kept (could not verify) — path: {s}, branch: {s}]", .{ seat.path, seat.branch }) catch "";
+    defer {
+        gpa.free(st.stdout);
+        gpa.free(st.stderr);
+    }
+    var head_buf: [64]u8 = undefined;
+    const head = blk: {
+        const r = runCapped(gpa, io, &.{ "git", "-C", seat.path, "rev-parse", "HEAD" }, 4096, 4096, 15_000) catch break :blk "";
+        defer {
+            gpa.free(r.stdout);
+            gpa.free(r.stderr);
+        }
+        if (!ranOk(r)) break :blk "";
+        const trimmed = std.mem.trim(u8, r.stdout, " \t\r\n");
+        const n = @min(trimmed.len, head_buf.len);
+        @memcpy(head_buf[0..n], trimmed[0..n]);
+        break :blk head_buf[0..n];
+    };
+    const reason = keep.worktreeKeepReason(ranOk(st), st.stdout, seat.base, head);
+    const why: []const u8 = if (reason == .removed) "clean, left in the pool" else keep.keepReasonText(reason);
+    var stat: []const u8 = "";
+    if (seat.base.len > 0) {
+        if (runCapped(gpa, io, &.{ "git", "-C", seat.path, "diff", "--stat", seat.base }, 4096, 2048, 15_000)) |r| {
+            defer {
+                gpa.free(r.stdout);
+                gpa.free(r.stderr);
+            }
+            if (ranOk(r)) {
+                const trimmed = std.mem.trim(u8, r.stdout, " \t\r\n");
+                if (trimmed.len > 0) stat = std.fmt.allocPrint(gpa, "; {s}", .{trimmed}) catch "";
+            }
+        } else |_| {}
+    }
+    defer if (stat.len > 0) gpa.free(stat);
+    return std.fmt.allocPrint(gpa, "\n\n[experiment seat kept ({s}) — path: {s}, branch: {s}{s}]", .{
+        why, seat.path, seat.branch, stat,
+    }) catch "";
+}
+
 test "slot names are stable and claim walks the pool" {
     var pbuf: [64]u8 = undefined;
     var bbuf: [64]u8 = undefined;
@@ -153,3 +236,67 @@ test "arm rejects empty and oversized pools before git" {
     try std.testing.expectError(error.BadPoolSize, arm(std.testing.allocator, std.testing.io, a, "live", 0));
     try std.testing.expectError(error.BadPoolSize, arm(std.testing.allocator, std.testing.io, a, "live", 17));
 }
+
+test "isExperimentTree matches pool paths and graff/exp branches" {
+    try std.testing.expect(isExperimentTree("/tmp/repo/.graff/worktrees/exp-live/0", "refs/heads/graff/exp/live/0"));
+    try std.testing.expect(isExperimentTree("/other", "graff/exp/q/1"));
+    try std.testing.expect(!isExperimentTree("/tmp/repo/.graff/worktrees/agent-sa-1", "refs/heads/graff/agents/sa-1"));
+    try std.testing.expect(!isExperimentTree("/tmp/repo", "main"));
+}
+
+test "directive is off until arm writes the spawn mandate" {
+    reset();
+    defer reset();
+    try std.testing.expect(directive() == null);
+}
+
+fn fixtureGit(gpa: Allocator, io: Io, argv: []const []const u8) !void {
+    const r = runCapped(gpa, io, argv, 1 << 16, 1 << 16, 60_000) catch return error.SkipZigTest;
+    defer gpa.free(r.stdout);
+    defer gpa.free(r.stderr);
+    if (!ranOk(r)) return error.FixtureCommandFailed;
+}
+
+test "arm mints then reuses real git worktrees; deliver-back never deletes (#629)" {
+    if (builtin.os.tag == .windows) return;
+    const gpa = std.testing.allocator;
+    const io = std.testing.io;
+    var tmp = std.testing.tmpDir(.{});
+    defer tmp.cleanup();
+    var orig_dir = try Io.Dir.cwd().openDir(io, ".", .{});
+    defer orig_dir.close(io);
+    defer _ = std.posix.system.fchdir(orig_dir.handle);
+    if (std.posix.system.fchdir(tmp.dir.handle) != 0) return error.ChdirFailed;
+
+    try Io.Dir.cwd().writeFile(io, .{ .sub_path = "work.txt", .data = "one\n" });
+    try fixtureGit(gpa, io, &.{ "git", "init", "-q" });
+    try fixtureGit(gpa, io, &.{ "git", "add", "-A" });
+    try fixtureGit(gpa, io, &.{ "git", "-c", "user.email=t@example.com", "-c", "user.name=t", "-c", "commit.gpgsign=false", "commit", "-q", "--no-verify", "-m", "fixture" });
+
+    var arena_state = std.heap.ArenaAllocator.init(gpa);
+    defer arena_state.deinit();
+    const arena = arena_state.allocator();
+    reset();
+    defer reset();
+
+    try std.testing.expectEqual(@as(u8, 2), try arm(gpa, io, arena, "live", 2));
+    try std.testing.expect(dirExists(io, ".graff/worktrees/exp-live/0"));
+    try std.testing.expect(dirExists(io, ".graff/worktrees/exp-live/1"));
+    try std.testing.expect(std.mem.indexOf(u8, directive().?, "MUST") != null);
+    try std.testing.expect(std.mem.indexOf(u8, directive().?, "Do not edit files in this caller tree") != null);
+
+    const first0 = g_slots[0].path;
+    try std.testing.expectEqual(@as(u8, 2), try arm(gpa, io, arena, "live", 2));
+    try std.testing.expectEqualStrings(first0, g_slots[0].path);
+    try std.testing.expect(g_slots[0].base.len > 0);
+
+    const seat = claimSeat().?;
+    try Io.Dir.cwd().writeFile(io, .{ .sub_path = ".graff/worktrees/exp-live/0/dirty.txt", .data = "edit\n" });
+
+    const note = deliverNote(gpa, io, seat);
+    defer if (note.len > 0) gpa.free(note);
+    try std.testing.expect(std.mem.indexOf(u8, note, "experiment seat kept") != null);
+    try std.testing.expect(std.mem.indexOf(u8, note, seat.branch) != null);
+    try std.testing.expect(std.mem.indexOf(u8, note, "has changes") != null);
+    try std.testing.expect(dirExists(io, ".graff/worktrees/exp-live/0"));
+}
diff --git a/src/help.zig b/src/help.zig
index af61f8f7..75dd6d0f 100644
--- a/src/help.zig
+++ b/src/help.zig
@@ -30,8 +30,8 @@ const peers_blurb =
 pub const sections = [_]Section{
     .{ .title = "getting around", .names = &.{ "/new", "/clear", "/resume", "/save", "/sessions", "/workspace", "/experiment", "/rename", "/rewind", "/snapshot" } },
     .{ .title = "the model", .names = &.{ "/model", "/models", "/effort", "/reasoning", "/fast", "/thinking", "/keepcontext", "/fallback", "/routes" } },
-    .{ .title = "working autonomously", .names = &.{ "/goal", "/loop", "/review", "/plan", "/todo", "/jobs", "/ultracode", "/strict", "/yolo", "/never" } },
-    .{ .title = "talking to other graffs", .names = &.{ "/tell", "/peek" }, .blurb = peers_blurb },
+    .{ .title = "working autonomously", .names = &.{ "/goal", "/loop", "/schedule", "/review", "/plan", "/todo", "/jobs", "/ultracode", "/strict", "/yolo", "/never" } },
+    .{ .title = "talking to other graffs", .names = &.{ "/tell", "/peek", "/adapter" }, .blurb = peers_blurb },
     .{ .title = "your setup", .names = &.{ "/login", "/key", "/cost", "/usage", "/privacy", "/mcp", "/import-claude", "/skills", "/plugins", "/agents", "/hooks", "/tools", "/fleet" } },
     .{ .title = "context & history", .names = &.{ "/compact", "/btw", "/doctor", "/debug", "/cache", "/trace", "/trajectory" } },
     .{ .title = "shell & images", .names = &.{ "/bash", "/image", "/images", "/paste" } },
diff --git a/src/libgraff.zig b/src/libgraff.zig
index 0abc696b..28ffebee 100644
--- a/src/libgraff.zig
+++ b/src/libgraff.zig
@@ -99,6 +99,8 @@ test "C ABI create / feed speaks ACP without a child process" {
     const init_out = graff_acp_out_ptr()[0..graff_acp_out_len()];
     try std.testing.expect(std.mem.indexOf(u8, init_out, "\"protocolVersion\":1") != null);
     try std.testing.expect(std.mem.indexOf(u8, init_out, "\"name\":\"graff\"") != null);
+    try std.testing.expect(std.mem.indexOf(u8, init_out, "graff-login") != null);
+    try std.testing.expect(std.mem.indexOf(u8, init_out, "\"type\":\"terminal\"") != null);
     graff_acp_out_consume();
 
     const new_line = "{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"session/new\"}";
diff --git a/src/local_tools.zig b/src/local_tools.zig
new file mode 100644
index 00000000..dbb83f4a
--- /dev/null
+++ b/src/local_tools.zig
@@ -0,0 +1,310 @@
+//! Agent-authored project-local tools (#555). Skills stay instructions;
+//! this is the executable half: `.graff/tools/<name>/` with a manifest +
+//! script, validated at install, registered on every later session.
+//!
+//! Runner is a subprocess speaking a one-shot JSON contract (JSON args as
+//! argv, stdout text or `{"text","is_error"}`). Not MCP, not a skill.
+
+const std = @import("std");
+const builtin = @import("builtin");
+const Io = std.Io;
+const Allocator = std.mem.Allocator;
+const Value = std.json.Value;
+
+const schema = @import("schema.zig");
+const no_local_tools = @import("no_local_tools.zig");
+const process_runner = @import("process_runner.zig");
+const agent_mod = @import("agent.zig");
+const tools_mod = @import("tools.zig");
+
+const Agent = agent_mod.Agent;
+const ToolCall = tools_mod.ToolCall;
+const ExecResult = tools_mod.ExecResult;
+const ToolSpec = schema.ToolSpec;
+
+pub const install_name = "install_agent_tool";
+pub const install_desc = "Install a project-local tool under .graff/tools/<name>/. Validates the manifest, dry-runs the script, and registers it as local__<name> for later turns. Skills stay instructions; this is the executable half.";
+pub const install_schema =
+    \\{"type": "object", "properties": {"name": {"type": "string", "description": "tool name (letters, digits, _-)"}, "description": {"type": "string"}, "schema": {"type": "string", "description": "JSON Schema object for the tool input"}, "runner": {"type": "string", "enum": ["python3", "bun", "sh"]}, "entry": {"type": "string", "description": "script filename inside the tool dir (no path separators)"}, "source": {"type": "string", "description": "script body"}}, "required": ["name", "description", "schema", "runner", "entry", "source"]}
+;
+
+pub const prefix = "local__";
+pub const store_rel = ".graff/tools";
+
+const install_spec = ToolSpec{ .name = install_name, .desc = install_desc, .schema = install_schema };
+
+pub const Installed = struct {
+    spec: ToolSpec,
+    runner: []const u8,
+    entry_path: []const u8,
+};
+
+var g_loaded: []Installed = &.{};
+
+pub fn isInstall(name: []const u8) bool {
+    return std.mem.eql(u8, name, install_name);
+}
+
+pub fn isLocal(name: []const u8) bool {
+    return std.mem.startsWith(u8, name, prefix);
+}
+
+pub fn nameOk(name: []const u8) bool {
+    if (name.len == 0 or name.len > 40) return false;
+    for (name) |c| {
+        const ok = std.ascii.isAlphanumeric(c) or c == '_' or c == '-';
+        if (!ok) return false;
+    }
+    return true;
+}
+
+pub fn runnerOk(runner: []const u8) bool {
+    return std.mem.eql(u8, runner, "python3") or std.mem.eql(u8, runner, "bun") or std.mem.eql(u8, runner, "sh");
+}
+
+pub fn entryOk(entry: []const u8) bool {
+    if (entry.len == 0 or std.mem.indexOfAny(u8, entry, "/\\") != null) return false;
+    if (std.mem.eql(u8, entry, "..") or std.mem.indexOf(u8, entry, "..") != null) return false;
+    return true;
+}
+
+pub fn schemaOk(raw: []const u8) bool {
+    var parsed = std.json.parseFromSlice(Value, std.heap.page_allocator, raw, .{}) catch return false;
+    defer parsed.deinit();
+    if (parsed.value != .object) return false;
+    const ty = parsed.value.object.get("type") orelse return false;
+    return ty == .string and std.mem.eql(u8, ty.string, "object");
+}
+
+pub fn qualified(arena: Allocator, name: []const u8) []const u8 {
+    return std.fmt.allocPrint(arena, "{s}{s}", .{ prefix, name }) catch name;
+}
+
+/// Scan `.graff/tools/` into the process-local table (session arena).
+pub fn load(io: Io, arena: Allocator) void {
+    g_loaded = &.{};
+    if (no_local_tools.enabled or no_local_tools.lean) return;
+    var dir = Io.Dir.cwd().openDir(io, store_rel, .{ .iterate = true }) catch return;
+    defer dir.close(io);
+    var it = dir.iterate();
+    var list: std.ArrayList(Installed) = .empty;
+    while (it.next(io) catch null) |ent| {
+        if (ent.kind != .directory) continue;
+        if (!nameOk(ent.name)) continue;
+        const one = readOne(io, arena, ent.name) orelse continue;
+        list.append(arena, one) catch break;
+    }
+    g_loaded = list.items;
+}
+
+fn readOne(io: Io, arena: Allocator, name: []const u8) ?Installed {
+    const man_path = std.fmt.allocPrint(arena, "{s}/{s}/manifest.json", .{ store_rel, name }) catch return null;
+    const raw = Io.Dir.cwd().readFileAlloc(io, man_path, arena, .limited(64 * 1024)) catch return null;
+    const obj = std.json.parseFromSliceLeaky(Value, arena, raw, .{}) catch return null;
+    if (obj != .object) return null;
+    const desc = if (obj.object.get("description")) |v| (if (v == .string) v.string else "") else "";
+    const schema_s = if (obj.object.get("schema")) |v| (if (v == .string) v.string else "") else "";
+    const runner = if (obj.object.get("runner")) |v| (if (v == .string) v.string else "") else "";
+    const entry = if (obj.object.get("entry")) |v| (if (v == .string) v.string else "") else "";
+    if (desc.len == 0 or !schemaOk(schema_s) or !runnerOk(runner) or !entryOk(entry)) return null;
+    const entry_rel = std.fmt.allocPrint(arena, "{s}/{s}/{s}", .{ store_rel, name, entry }) catch return null;
+    Io.Dir.cwd().access(io, entry_rel, .{}) catch return null;
+    const entry_path = absUnderCwd(io, arena, entry_rel) orelse entry_rel;
+    return .{
+        .spec = .{ .name = qualified(arena, name), .desc = desc, .schema = schema_s },
+        .runner = runner,
+        .entry_path = entry_path,
+    };
+}
+
+/// Catalog extras for this session: the install meta-tool plus every loaded local.
+pub fn catalogExtras(arena: Allocator) []const ToolSpec {
+    if (no_local_tools.enabled or no_local_tools.lean) return &.{};
+    const n = 1 + g_loaded.len;
+    const out = arena.alloc(ToolSpec, n) catch return &.{};
+    out[0] = install_spec;
+    for (g_loaded, 0..) |it, i| out[i + 1] = it.spec;
+    return out;
+}
+
+pub fn handleInstall(self: *Agent, call: ToolCall) !ExecResult {
+    if (self.sub) return .{ .text = "install_agent_tool is root-only", .is_error = true };
+    if (no_local_tools.enabled or no_local_tools.lean) return .{ .text = "local tools are disabled under --no-local-tools / --lean", .is_error = true };
+    const obj = tools_mod.json_args.object(call.input) orelse return .{ .text = "install_agent_tool needs an object", .is_error = true };
+    const name = tools_mod.json_args.str(obj, "name") orelse "";
+    const description = tools_mod.json_args.str(obj, "description") orelse "";
+    const schema_s = tools_mod.json_args.str(obj, "schema") orelse "";
+    const runner = tools_mod.json_args.str(obj, "runner") orelse "";
+    const entry = tools_mod.json_args.str(obj, "entry") orelse "";
+    const source = tools_mod.json_args.str(obj, "source") orelse "";
+    if (!nameOk(name)) return .{ .text = "name must be 1-40 letters, digits, _ or -", .is_error = true };
+    if (description.len == 0) return .{ .text = "description is required", .is_error = true };
+    if (!schemaOk(schema_s)) return .{ .text = "schema must be a JSON object schema", .is_error = true };
+    if (!runnerOk(runner)) return .{ .text = "runner must be python3, bun, or sh", .is_error = true };
+    if (!entryOk(entry)) return .{ .text = "entry must be a filename in the tool dir", .is_error = true };
+    if (source.len == 0) return .{ .text = "source is required", .is_error = true };
+
+    const dir_rel = try std.fmt.allocPrint(self.arena, "{s}/{s}", .{ store_rel, name });
+    Io.Dir.cwd().createDirPath(self.io, dir_rel) catch return .{ .text = "could not create .graff/tools dir", .is_error = true };
+    const entry_rel = try std.fmt.allocPrint(self.arena, "{s}/{s}", .{ dir_rel, entry });
+    Io.Dir.cwd().writeFile(self.io, .{ .sub_path = entry_rel, .data = source }) catch return .{ .text = "could not write the script", .is_error = true };
+    const man = try std.fmt.allocPrint(self.arena,
+        \\{{"name":{s},"description":{s},"schema":{s},"runner":{s},"entry":{s}}}
+    , .{
+        try jsonString(self.arena, name),
+        try jsonString(self.arena, description),
+        try jsonString(self.arena, schema_s),
+        try jsonString(self.arena, runner),
+        try jsonString(self.arena, entry),
+    });
+    const man_rel = try std.fmt.allocPrint(self.arena, "{s}/manifest.json", .{dir_rel});
+    Io.Dir.cwd().writeFile(self.io, .{ .sub_path = man_rel, .data = man }) catch return .{ .text = "could not write the manifest", .is_error = true };
+
+    const entry_abs = absUnderCwd(self.io, self.arena, entry_rel) orelse entry_rel;
+    if (!dryRun(self.io, self.gpa, runner, entry_abs)) {
+        return .{ .text = "dry-run failed — the script must exit 0 on --dry-run", .is_error = true };
+    }
+    load(self.io, self.arena);
+    self.invalidateRootTools();
+    return .{ .text = try std.fmt.allocPrint(self.arena, "installed {s}{s} — registered for the next model call", .{ prefix, name }), .is_error = false };
+}
+
+fn absUnderCwd(io: Io, arena: Allocator, rel: []const u8) ?[]const u8 {
+    var buf: [std.fs.max_path_bytes]u8 = undefined;
+    const n = Io.Dir.cwd().realPath(io, &buf) catch return null;
+    return std.fmt.allocPrint(arena, "{s}/{s}", .{ buf[0..n], rel }) catch null;
+}
+
+fn jsonString(arena: Allocator, s: []const u8) ![]const u8 {
+    var aw: std.Io.Writer.Allocating = .init(arena);
+    var st: std.json.Stringify = .{ .writer = &aw.writer };
+    try st.write(s);
+    return aw.writer.buffered();
+}
+
+fn dryRun(io: Io, gpa: Allocator, runner: []const u8, entry_rel: []const u8) bool {
+    const argv = [_][]const u8{ runner, entry_rel, "--dry-run" };
+    const run_res = process_runner.runCapped(gpa, io, &argv, 32 * 1024, 4 * 1024, 8_000) catch return false;
+    defer gpa.free(run_res.stdout);
+    defer gpa.free(run_res.stderr);
+    return run_res.term == .exited and run_res.term.exited == 0;
+}
+
+pub fn exec(gpa: Allocator, io: Io, name: []const u8, input: Value) !tools_mod.ToolOutput {
+    if (!isLocal(name)) return .{ .text = try gpa.dupe(u8, "not a local tool"), .is_error = true };
+    const inst = find(name) orelse return .{ .text = try gpa.dupe(u8, "local tool is not installed in this session"), .is_error = true };
+    var aw: std.Io.Writer.Allocating = .init(gpa);
+    defer aw.deinit();
+    var st: std.json.Stringify = .{ .writer = &aw.writer };
+    st.write(input) catch return .{ .text = try gpa.dupe(u8, "could not encode args"), .is_error = true };
+    aw.writer.flush() catch {};
+    const payload = if (aw.writer.buffered().len == 0) "{}" else aw.writer.buffered();
+    const argv = [_][]const u8{ inst.runner, inst.entry_path, payload };
+    const run_res = process_runner.runCapped(gpa, io, &argv, 256 * 1024, 16 * 1024, 30_000) catch |err| {
+        return .{ .text = try std.fmt.allocPrint(gpa, "local tool failed: {s}", .{@errorName(err)}), .is_error = true };
+    };
+    defer gpa.free(run_res.stdout);
+    defer gpa.free(run_res.stderr);
+    const raw_out = std.mem.trim(u8, run_res.stdout, " \t\r\n");
+    if (std.json.parseFromSlice(Value, gpa, raw_out, .{})) |parsed| {
+        defer parsed.deinit();
+        if (parsed.value == .object) {
+            const text = if (parsed.value.object.get("text")) |v| (if (v == .string) v.string else raw_out) else raw_out;
+            const err = if (parsed.value.object.get("is_error")) |v| (v == .bool and v.bool) else false;
+            return .{ .text = try gpa.dupe(u8, text), .is_error = err };
+        }
+    } else |_| {}
+    const failed = run_res.term != .exited or run_res.term.exited != 0;
+    return .{ .text = try gpa.dupe(u8, if (raw_out.len > 0) raw_out else run_res.stderr), .is_error = failed };
+}
+
+fn find(name: []const u8) ?Installed {
+    for (g_loaded) |it| if (std.mem.eql(u8, it.spec.name, name)) return it;
+    return null;
+}
+
+test "nameOk / runnerOk / entryOk / schemaOk" {
+    try std.testing.expect(nameOk("digest"));
+    try std.testing.expect(!nameOk("../x"));
+    try std.testing.expect(!nameOk(""));
+    try std.testing.expect(runnerOk("python3") and runnerOk("sh") and !runnerOk("node"));
+    try std.testing.expect(entryOk("run.py") and !entryOk("../run.py") and !entryOk("a/b"));
+    try std.testing.expect(schemaOk("{\"type\":\"object\",\"properties\":{}}"));
+    try std.testing.expect(!schemaOk("[]"));
+    try std.testing.expect(!schemaOk("{"));
+}
+
+test "install then load registers local__name" {
+    if (builtin.os.tag == .windows) return error.SkipZigTest;
+    const io = std.testing.io;
+    const gpa = std.testing.allocator;
+    var tmp = std.testing.tmpDir(.{});
+    defer tmp.cleanup();
+    var orig = try Io.Dir.cwd().openDir(io, ".", .{});
+    defer orig.close(io);
+    defer _ = std.posix.system.fchdir(orig.handle);
+    if (std.posix.system.fchdir(tmp.dir.handle) != 0) return error.ChdirFailed;
+
+    var arena_state = std.heap.ArenaAllocator.init(gpa);
+    defer arena_state.deinit();
+    defer {
+        g_loaded = &.{};
+    }
+    const arena = arena_state.allocator();
+    var dummy_client: std.http.Client = .{ .allocator = gpa, .io = io };
+    var root: Agent = undefined;
+    root.io = io;
+    root.arena = arena;
+    root.gpa = gpa;
+    root.sub = false;
+    root.client = &dummy_client;
+    root.tools_anthropic = "keep";
+    root.tools_openai = "keep";
+    root.tools_responses = "keep";
+
+    const input = try std.json.parseFromSliceLeaky(Value, arena,
+        \\{"name":"echo","description":"echo args","schema":"{\"type\":\"object\",\"properties\":{}}","runner":"sh","entry":"run.sh","source":"if [ \"$1\" = --dry-run ]; then exit 0; fi\nprintf '%s' \"$1\"\n"}
+    , .{});
+    const call: ToolCall = .{ .id = "t1", .name = install_name, .input = input };
+    const r = try handleInstall(&root, call);
+    try std.testing.expect(!r.is_error);
+    try std.testing.expect(std.mem.indexOf(u8, r.text, "local__echo") != null);
+    try std.testing.expectEqualStrings("", root.tools_anthropic);
+    try std.testing.expect(g_loaded.len == 1);
+    try std.testing.expectEqualStrings("local__echo", g_loaded[0].spec.name);
+    const extras = catalogExtras(arena);
+    try std.testing.expectEqualStrings(install_name, extras[0].name);
+    try std.testing.expect(g_loaded[0].entry_path.len > 0);
+    g_loaded = &.{};
+}
+
+test "exec runs the script and returns stdout" {
+    if (builtin.os.tag == .windows) return error.SkipZigTest;
+    const io = std.testing.io;
+    const gpa = std.testing.allocator;
+    var tmp = std.testing.tmpDir(.{});
+    defer tmp.cleanup();
+    try tmp.dir.writeFile(io, .{ .sub_path = "run.sh", .data = "printf '%s' \"$1\"\n" });
+    var path_buf: [std.fs.max_path_bytes]u8 = undefined;
+    const n = try tmp.dir.realPath(io, &path_buf);
+    const script = try std.fmt.allocPrint(gpa, "{s}/run.sh", .{path_buf[0..n]});
+    defer gpa.free(script);
+    var arena_state = std.heap.ArenaAllocator.init(gpa);
+    defer arena_state.deinit();
+    const arena = arena_state.allocator();
+    const one = try arena.alloc(Installed, 1);
+    one[0] = .{
+        .spec = .{ .name = "local__ping", .desc = "ping", .schema = "{\"type\":\"object\"}" },
+        .runner = "sh",
+        .entry_path = script,
+    };
+    g_loaded = one;
+    defer {
+        g_loaded = &.{};
+    }
+    const input = try std.json.parseFromSliceLeaky(Value, arena, "{\"k\":1}", .{});
+    const out = try exec(gpa, io, "local__ping", input);
+    defer gpa.free(out.text);
+    try std.testing.expect(!out.is_error);
+    try std.testing.expect(std.mem.indexOf(u8, out.text, "k") != null);
+}
diff --git a/src/mcp.zig b/src/mcp.zig
index d4db26d6..a1442473 100644
--- a/src/mcp.zig
+++ b/src/mcp.zig
@@ -85,6 +85,9 @@ pub const Registry = struct {
     /// registry came from `empty*` and `init` never ran, so session_start sets
     /// this field either way.
     global_config_path: ?[]const u8 = null,
+    /// True when `global_config_path` came from `GRAFF_MCP_CONFIG`. `/mcp trust`
+    /// re-reads through the same wholesale-off rule `init` used (#549).
+    global_is_override: bool = false,
     /// Per-server arenas from mcp_boot's parallel connect fan-out (the
     /// registry arena is not thread-safe, so each task allocated its own).
     /// Freed in deinit AFTER the transports referencing them are torn down.
@@ -183,7 +186,7 @@ pub const Registry = struct {
     /// (no tool calls in flight).
     pub fn trustWorkspace(reg: *Registry, config_path: []const u8) !usize {
         const a = reg.arena();
-        const merged = mcp_config.load(reg.io, a, Io.Dir.cwd(), config_path, reg.global_config_path, reg.home);
+        const merged = mcp_config.load(reg.io, a, Io.Dir.cwd(), config_path, reg.global_config_path, reg.home, reg.global_is_override);
 
         var servers: std.ArrayList(*Server) = .empty;
         try servers.appendSlice(a, reg.servers);
@@ -217,7 +220,7 @@ pub const Registry = struct {
     /// best-effort (any read/parse failure contributes nothing).
     pub fn pendingWorkspace(reg: *Registry, config_path: []const u8) usize {
         const a = reg.arena();
-        const merged = mcp_config.load(reg.io, a, Io.Dir.cwd(), config_path, reg.global_config_path, reg.home);
+        const merged = mcp_config.load(reg.io, a, Io.Dir.cwd(), config_path, reg.global_config_path, reg.home, reg.global_is_override);
         var n: usize = 0;
         var it = merged.servers.iterator();
         while (it.next()) |entry| {
diff --git a/src/mcp_boot.zig b/src/mcp_boot.zig
index a80160ca..ceafed78 100644
--- a/src/mcp_boot.zig
+++ b/src/mcp_boot.zig
@@ -83,13 +83,14 @@ pub fn init(gpa: Allocator, io: Io, config_path: []const u8, global_path: ?[]con
         .stdio_probe = if (environ_map.get("GRAFF_MCP_PROBE")) |v| !std.mem.eql(u8, v, "0") else true,
         .show_diagnostics = show_diagnostics,
         .global_config_path = global_path,
+        .global_is_override = mcp_config.isEnvOverride(environ_map),
     };
     mcp_rpc.applyHandshakeTimeoutEnv(environ_map); // #275 GRAFF_MCP_HANDSHAKE_SECS + #327 GRAFF_MCP_PROBE_MS, on the same pass as the probe flag
 
     errdefer reg.deinit();
     const a = reg.arena();
 
-    const merged = mcp_config.load(io, a, Io.Dir.cwd(), config_path, global_path, home);
+    const merged = mcp_config.load(io, a, Io.Dir.cwd(), config_path, global_path, home, reg.global_is_override);
     if (!merged.found) {
         reg.arena_state.deinit(); // nothing was started; no transports to tear down
         return null;
diff --git a/src/mcp_cli.zig b/src/mcp_cli.zig
index b20b24a1..e86c52d4 100644
--- a/src/mcp_cli.zig
+++ b/src/mcp_cli.zig
@@ -173,7 +173,7 @@ pub fn mcpCommand(io: Io, gpa: Allocator, arena: Allocator, home: []const u8, en
     }
 
     if (args.len == 0 or std.mem.eql(u8, args[0], "list")) {
-        const merged = mcp_config.load(io, arena, Io.Dir.cwd(), mcp_config_path, global_path, home);
+        const merged = mcp_config.load(io, arena, Io.Dir.cwd(), mcp_config_path, global_path, home, mcp_config.isEnvOverride(environ_map));
         try mcp_config.reportInvalid(merged, &out.interface, mcp_config_path, global_path, "", "");
         if (merged.servers.count() == 0) {
             try out.interface.writeAll("no MCP servers configured. Add one with `graff mcp add <name> -- <command> [args...]`,\nor list servers for every project in ~/" ++ mcp_config.global_rel_path ++ ".\n");
@@ -217,7 +217,7 @@ pub fn mcpCommand(io: Io, gpa: Allocator, arena: Allocator, home: []const u8, en
         const name = args[1];
         // Global servers are loginable too — the merged set is the same one
         // the session connects from.
-        const merged = mcp_config.load(io, arena, Io.Dir.cwd(), mcp_config_path, global_path, home);
+        const merged = mcp_config.load(io, arena, Io.Dir.cwd(), mcp_config_path, global_path, home, mcp_config.isEnvOverride(environ_map));
         // Say which file is broken before claiming the server is missing:
         // "not configured" for a server that IS configured, in a file that
         // does not parse, sends the user looking in the wrong place.
diff --git a/src/mcp_config.zig b/src/mcp_config.zig
index 63ec590e..cfb7d655 100644
--- a/src/mcp_config.zig
+++ b/src/mcp_config.zig
@@ -67,6 +67,14 @@ pub fn globalPath(arena: Allocator, home: []const u8, environ_map: anytype) ?[]c
     return std.fmt.allocPrint(arena, "{s}/" ++ global_rel_path, .{home}) catch null;
 }
 
+/// Whether `GRAFF_MCP_CONFIG` points at a real path. An existing, valid, empty
+/// override is a wholesale MCP off-switch (#549); the default global file is
+/// never that — relocating `~/.codegraff/mcp.json` still merges the project.
+pub fn isEnvOverride(environ_map: anytype) bool {
+    if (environ_map.get(path_env)) |override| return override.len > 0;
+    return false;
+}
+
 /// Read `path` and return its `mcpServers` object. Best-effort throughout:
 /// only "no such file" reads as absent, everything else reads as invalid (and
 /// empty) so a caller can say which file it could not use.
@@ -105,12 +113,24 @@ fn readServers(io: Io, arena: Allocator, dir: Io.Dir, path: []const u8, found: *
 /// handle it is opened through. Never fails: a missing or malformed file simply
 /// contributes nothing. Values stay arena-allocated, like the rest of the MCP
 /// config handling.
-pub fn load(io: Io, arena: Allocator, dir: Io.Dir, project_path: []const u8, global_path: ?[]const u8, home: []const u8) Merged {
+///
+/// `global_is_override` is true only when `GRAFF_MCP_CONFIG` selected the
+/// path. A file that exists, parses, and lists no servers is then a wholesale
+/// off-switch (pty/harness): the project `.mcp.json` and plugin trees do not
+/// merge in. A *populated* override still merges, so relocating the global
+/// file is unchanged. A missing or invalid override is not an off-switch.
+pub fn load(io: Io, arena: Allocator, dir: Io.Dir, project_path: []const u8, global_path: ?[]const u8, home: []const u8, global_is_override: bool) Merged {
     var merged: Merged = .{};
     const global = if (global_path) |p|
         readServers(io, arena, dir, p, &merged.found, &merged.invalid_global)
     else
         std.json.ObjectMap.empty;
+    // #549: existing + valid + empty override → MCP stays off. `found` is
+    // already true (the file existed), so Registry.init does not treat this
+    // as "no config" and then pick up a project file on a later read.
+    if (global_is_override and merged.found and !merged.invalid_global and global.count() == 0)
+        return merged;
+
     merged.project = readServers(io, arena, dir, project_path, &merged.found, &merged.invalid_project);
 
     // Global first, project second: the later `put` for a name overwrites, so
@@ -163,7 +183,11 @@ const TestEnv = struct {
 /// Both halves are read through the tmp dir handle, so no test touches `$HOME`
 /// or the real workspace.
 fn loadTmp(arena: Allocator, dir: Io.Dir) Merged {
-    return load(testing.io, arena, dir, ".mcp.json", "global.json", "");
+    return load(testing.io, arena, dir, ".mcp.json", "global.json", "", false);
+}
+
+fn loadTmpOverride(arena: Allocator, dir: Io.Dir) Merged {
+    return load(testing.io, arena, dir, ".mcp.json", "global.json", "", true);
 }
 
 test "global MCP path prefers the env override and otherwise lives under ~/.codegraff" {
@@ -174,6 +198,9 @@ test "global MCP path prefers the env override and otherwise lives under ~/.code
     try testing.expectEqualStrings("/tmp/mcp.json", globalPath(arena, "/home/alice", TestEnv{ .override = "/tmp/mcp.json" }).?);
     // An empty override falls back rather than resolving to the file "".
     try testing.expectEqualStrings("/home/alice/.codegraff/mcp.json", globalPath(arena, "/home/alice", TestEnv{ .override = "" }).?);
+    try testing.expect(isEnvOverride(TestEnv{ .override = "/tmp/mcp.json" }));
+    try testing.expect(!isEnvOverride(TestEnv{ .override = "" }));
+    try testing.expect(!isEnvOverride(TestEnv{}));
     // No HOME and no override is "no global config", not a crash.
     try testing.expect(globalPath(arena, "", TestEnv{}) == null);
 }
@@ -262,3 +289,58 @@ test "an unreadable MCP config is invalid, not absent" {
     try testing.expect(!merged.invalid_project);
     try testing.expectEqual(@as(usize, 0), merged.servers.count());
 }
+
+test "a valid empty GRAFF_MCP_CONFIG override is a wholesale MCP off-switch (#549)" {
+    var arena_state = std.heap.ArenaAllocator.init(testing.allocator);
+    defer arena_state.deinit();
+    var tmp = testing.tmpDir(.{});
+    defer tmp.cleanup();
+    try tmp.dir.writeFile(testing.io, .{ .sub_path = "global.json", .data = "{\"mcpServers\":{}}" });
+    try tmp.dir.writeFile(testing.io, .{ .sub_path = ".mcp.json", .data = "{\"mcpServers\":{\"local\":{\"command\":\"./srv\"}}}" });
+
+    const off = loadTmpOverride(arena_state.allocator(), tmp.dir);
+    try testing.expect(off.found);
+    try testing.expect(!off.invalid_global and !off.invalid_project);
+    try testing.expectEqual(@as(usize, 0), off.servers.count());
+    try testing.expectEqual(@as(usize, 0), off.project.count());
+
+    // The default global file is never that switch: an empty ~/.codegraff/mcp.json
+    // still merges the project (relocating the global file stays a merge).
+    const merged = loadTmp(arena_state.allocator(), tmp.dir);
+    try testing.expectEqual(@as(usize, 1), merged.servers.count());
+    try testing.expect(merged.servers.get("local") != null);
+}
+
+test "a populated GRAFF_MCP_CONFIG override still merges the project file (#549)" {
+    var arena_state = std.heap.ArenaAllocator.init(testing.allocator);
+    defer arena_state.deinit();
+    var tmp = testing.tmpDir(.{});
+    defer tmp.cleanup();
+    try tmp.dir.writeFile(testing.io, .{ .sub_path = "global.json", .data = "{\"mcpServers\":{\"deepwiki\":{\"url\":\"https://mcp.deepwiki.com/mcp\"}}}" });
+    try tmp.dir.writeFile(testing.io, .{ .sub_path = ".mcp.json", .data = "{\"mcpServers\":{\"local\":{\"command\":\"./srv\"}}}" });
+
+    const merged = loadTmpOverride(arena_state.allocator(), tmp.dir);
+    try testing.expectEqual(@as(usize, 2), merged.servers.count());
+    try testing.expect(merged.isGlobalOnly("deepwiki"));
+    try testing.expect(!merged.isGlobalOnly("local"));
+}
+
+test "a missing or invalid GRAFF_MCP_CONFIG override is not an off-switch (#549)" {
+    var arena_state = std.heap.ArenaAllocator.init(testing.allocator);
+    defer arena_state.deinit();
+    const arena = arena_state.allocator();
+
+    var missing = testing.tmpDir(.{});
+    defer missing.cleanup();
+    try missing.dir.writeFile(testing.io, .{ .sub_path = ".mcp.json", .data = "{\"mcpServers\":{\"local\":{\"command\":\"./srv\"}}}" });
+    const no_file = loadTmpOverride(arena, missing.dir);
+    try testing.expect(no_file.servers.get("local") != null);
+
+    var broken = testing.tmpDir(.{});
+    defer broken.cleanup();
+    try broken.dir.writeFile(testing.io, .{ .sub_path = "global.json", .data = "{ not json" });
+    try broken.dir.writeFile(testing.io, .{ .sub_path = ".mcp.json", .data = "{\"mcpServers\":{\"local\":{\"command\":\"./srv\"}}}" });
+    const bad = loadTmpOverride(arena, broken.dir);
+    try testing.expect(bad.invalid_global);
+    try testing.expect(bad.servers.get("local") != null);
+}
diff --git a/src/presence.zig b/src/presence.zig
index fa8d946c..7362f298 100644
--- a/src/presence.zig
+++ b/src/presence.zig
@@ -428,6 +428,24 @@ pub fn resetRoomCursorForTest() void {
     g_tail_seeked = false;
 }
 
+/// Tests only. `announce` is a no-op under `is_test`; this wires the same
+/// process-local handle so `postTo` / `postToDevice` can write a tmp registry.
+/// Caller owns the slices — do not `deinit` after this; call `unbindForTest`.
+pub fn bindForTest(dir_path: []const u8, identity: []const u8, session: []const u8, self: proc_identity.Record) void {
+    g_dir = dir_path;
+    g_identity = identity;
+    g_session = session;
+    g_self = self;
+}
+
+pub fn unbindForTest() void {
+    g_dir = null;
+    g_identity = "";
+    g_session = "";
+    g_self = .{};
+    resetRoomCursorForTest();
+}
+
 /// Every live session on this device, any worktree (self excluded) — the
 /// /tell target list. Like liveTreePeers but identity-blind.
 pub fn liveAllPeers(io: Io, arena: Allocator) []const Owner {
diff --git a/src/repl_glue.zig b/src/repl_glue.zig
index bd61a86b..4b6473ad 100644
--- a/src/repl_glue.zig
+++ b/src/repl_glue.zig
@@ -61,6 +61,9 @@ pub const ReplCtx = struct {
     last_context_tokens: u64 = 0,
     context_local_tokens: u64 = 0,
     last_cache_read: u64 = 0,
+    /// Live root session, when the host has one. TUI `/tell` / `/peek` reach
+    /// the real mailbox through this; the line REPL already holds `root`.
+    root: ?*Agent = null,
 };
 
 /// The engine-owned conversation, in repl_convo.zig (move+alias, #123).
diff --git a/src/schedule.zig b/src/schedule.zig
new file mode 100644
index 00000000..f6cb7dcc
--- /dev/null
+++ b/src/schedule.zig
@@ -0,0 +1,227 @@
+//! Time-triggered tasks that wake a session (#556). Store is
+//! `.graff/schedule/<id>.json`. Due-claim runs at the same step boundary as
+//! job_notify. `/loop` stays the standing-goal controller; this is cron.
+
+const std = @import("std");
+const builtin = @import("builtin");
+const Io = std.Io;
+const Allocator = std.mem.Allocator;
+const Value = std.json.Value;
+
+const schema = @import("schema.zig");
+const no_local_tools = @import("no_local_tools.zig");
+const goal_pacing = @import("goal_pacing.zig");
+const session_wake = @import("session_wake.zig");
+const agent_mod = @import("agent.zig");
+const tools_mod = @import("tools.zig");
+const util = @import("util.zig");
+
+const Agent = agent_mod.Agent;
+const ToolCall = tools_mod.ToolCall;
+const ExecResult = tools_mod.ExecResult;
+const ToolSpec = schema.ToolSpec;
+
+pub const tool_name = "schedule_task";
+pub const tool_desc = "Schedule a prompt to wake this session later. delay is 30s/5m/2h (same tokens as /loop). At the due time the prompt is injected as a user turn.";
+pub const tool_schema =
+    \\{"type": "object", "properties": {"delay": {"type": "string", "description": "30s, 5m, or 2h"}, "prompt": {"type": "string", "description": "what to do when it fires"}}, "required": ["delay", "prompt"]}
+;
+
+pub const store_rel = ".graff/schedule";
+
+const tool_spec = ToolSpec{ .name = tool_name, .desc = tool_desc, .schema = tool_schema };
+
+pub const Record = struct {
+    id: []const u8,
+    at_ms: i64,
+    prompt: []const u8,
+    claimed_ms: i64 = 0,
+};
+
+pub fn isName(name: []const u8) bool {
+    return std.mem.eql(u8, name, tool_name);
+}
+
+pub fn catalogExtras(arena: Allocator) []const ToolSpec {
+    _ = arena;
+    if (no_local_tools.enabled or no_local_tools.lean) return &.{};
+    return &.{tool_spec};
+}
+
+pub fn add(io: Io, arena: Allocator, at_ms: i64, prompt: []const u8) !Record {
+    Io.Dir.cwd().createDirPath(io, store_rel) catch return error.StoreUnavailable;
+    const id = try std.fmt.allocPrint(arena, "{d}", .{at_ms});
+    const rec = Record{ .id = id, .at_ms = at_ms, .prompt = prompt };
+    const text = try encode(arena, rec);
+    const path = try std.fmt.allocPrint(arena, "{s}/{s}.json", .{ store_rel, id });
+    Io.Dir.cwd().writeFile(io, .{ .sub_path = path, .data = text }) catch return error.StoreUnavailable;
+    return rec;
+}
+
+fn encode(arena: Allocator, rec: Record) ![]const u8 {
+    var aw: std.Io.Writer.Allocating = .init(arena);
+    var s: std.json.Stringify = .{ .writer = &aw.writer };
+    try s.write(.{ .id = rec.id, .at_ms = rec.at_ms, .prompt = rec.prompt, .claimed_ms = rec.claimed_ms });
+    return aw.writer.buffered();
+}
+
+pub fn claimDue(io: Io, arena: Allocator, now_ms: i64) []const Record {
+    var dir = Io.Dir.cwd().openDir(io, store_rel, .{ .iterate = true }) catch return &.{};
+    defer dir.close(io);
+    var it = dir.iterate();
+    var out: std.ArrayList(Record) = .empty;
+    while (it.next(io) catch null) |ent| {
+        if (ent.kind != .file) continue;
+        if (!std.mem.endsWith(u8, ent.name, ".json")) continue;
+        const raw = dir.readFileAlloc(io, ent.name, arena, .limited(16 * 1024)) catch continue;
+        const rec = parse(arena, raw) orelse continue;
+        if (rec.claimed_ms != 0 or rec.at_ms > now_ms) continue;
+        var claimed = rec;
+        claimed.claimed_ms = now_ms;
+        const text = encode(arena, claimed) catch continue;
+        dir.writeFile(io, .{ .sub_path = ent.name, .data = text }) catch continue;
+        out.append(arena, claimed) catch break;
+    }
+    return out.items;
+}
+
+fn parse(arena: Allocator, raw: []const u8) ?Record {
+    const v = std.json.parseFromSliceLeaky(Value, arena, raw, .{}) catch return null;
+    if (v != .object) return null;
+    const id = if (v.object.get("id")) |x| (if (x == .string) x.string else "") else "";
+    const prompt = if (v.object.get("prompt")) |x| (if (x == .string) x.string else "") else "";
+    const at = if (v.object.get("at_ms")) |x| switch (x) {
+        .integer => |n| n,
+        else => return null,
+    } else return null;
+    const claimed = if (v.object.get("claimed_ms")) |x| switch (x) {
+        .integer => |n| n,
+        else => 0,
+    } else 0;
+    if (id.len == 0 or prompt.len == 0) return null;
+    return .{ .id = id, .at_ms = at, .prompt = prompt, .claimed_ms = claimed };
+}
+
+pub fn deliver(root: *Agent) void {
+    if (root.sub) return;
+    const due = claimDue(root.io, root.arena, util.unixMs(root.io));
+    for (due) |rec| {
+        const line = std.fmt.allocPrint(root.arena, "[schedule {s}] {s}", .{ rec.id, rec.prompt }) catch continue;
+        session_wake.inject(root, line);
+    }
+}
+
+pub fn handleTool(self: *Agent, call: ToolCall) !ExecResult {
+    if (self.sub) return .{ .text = "schedule_task is root-only", .is_error = true };
+    if (no_local_tools.enabled or no_local_tools.lean) return .{ .text = "schedule_task is disabled under --no-local-tools / --lean", .is_error = true };
+    const obj = tools_mod.json_args.object(call.input) orelse return .{ .text = "schedule_task needs an object", .is_error = true };
+    const delay = tools_mod.json_args.str(obj, "delay") orelse "";
+    const prompt = tools_mod.json_args.str(obj, "prompt") orelse "";
+    if (delay.len == 0 or prompt.len == 0) return .{ .text = "usage: delay (30s|5m|2h) and prompt", .is_error = true };
+    const padded = try std.fmt.allocPrint(self.arena, "{s} {s}", .{ delay, prompt });
+    const budget = goal_pacing.parseLoopBudget(padded);
+    const delta = budget.deadline_ms_delta orelse return .{ .text = "delay must be 30s, 5m, or 2h", .is_error = true };
+    const at = util.unixMs(self.io) + delta;
+    const rec = add(self.io, self.arena, at, prompt) catch return .{ .text = "could not write .graff/schedule", .is_error = true };
+    return .{ .text = try std.fmt.allocPrint(self.arena, "scheduled {s} at {d}", .{ rec.id, rec.at_ms }), .is_error = false };
+}
+
+/// `/schedule 5m check the deploy`
+pub fn slashCommand(root: *Agent, arena: Allocator, line: []const u8, out: *Io.Writer) !bool {
+    const rest = std.mem.trim(u8, line["/schedule".len..], " \t");
+    if (rest.len == 0) {
+        try out.writeAll("usage: /schedule <30s|5m|2h> <prompt>\n");
+        try out.flush();
+        return true;
+    }
+    const budget = goal_pacing.parseLoopBudget(rest);
+    const delta = budget.deadline_ms_delta orelse {
+        try out.writeAll("usage: /schedule <30s|5m|2h> <prompt>\n");
+        try out.flush();
+        return true;
+    };
+    if (budget.prompt.len == 0) {
+        try out.writeAll("usage: /schedule <30s|5m|2h> <prompt>\n");
+        try out.flush();
+        return true;
+    }
+    const at = util.unixMs(root.io) + delta;
+    const rec = add(root.io, arena, at, budget.prompt) catch {
+        try out.writeAll("could not write .graff/schedule\n");
+        try out.flush();
+        return true;
+    };
+    try out.print("scheduled {s} — fires in {s}\n", .{ rec.id, rest[0 .. rest.len - budget.prompt.len] });
+    try out.flush();
+    return true;
+}
+
+test "add then claimDue only yields past-due unclaimed records" {
+    if (builtin.os.tag == .windows) return error.SkipZigTest;
+    const io = std.testing.io;
+    const gpa = std.testing.allocator;
+    var tmp = std.testing.tmpDir(.{});
+    defer tmp.cleanup();
+    var orig = try Io.Dir.cwd().openDir(io, ".", .{});
+    defer orig.close(io);
+    defer _ = std.posix.system.fchdir(orig.handle);
+    if (std.posix.system.fchdir(tmp.dir.handle) != 0) return error.ChdirFailed;
+
+    var arena_state = std.heap.ArenaAllocator.init(gpa);
+    defer arena_state.deinit();
+    const arena = arena_state.allocator();
+    const rec = try add(io, arena, 10, "check the deploy");
+    try std.testing.expectEqualStrings("10", rec.id);
+    try std.testing.expectEqual(@as(usize, 0), claimDue(io, arena, 9).len);
+    const due = claimDue(io, arena, 11);
+    try std.testing.expectEqual(@as(usize, 1), due.len);
+    try std.testing.expectEqualStrings("check the deploy", due[0].prompt);
+    try std.testing.expect(due[0].claimed_ms == 11);
+    try std.testing.expectEqual(@as(usize, 0), claimDue(io, arena, 12).len);
+}
+
+/// Idle TUI auto-turn: claim due tasks into a buffer without an Agent.
+pub fn takeWake(io: Io, buf: []u8) ?[]const u8 {
+    var scratch: [32 * 1024]u8 = undefined;
+    var fba = std.heap.FixedBufferAllocator.init(&scratch);
+    const due = claimDue(io, fba.allocator(), util.unixMs(io));
+    if (due.len == 0) return null;
+    var used: usize = 0;
+    for (due) |rec| {
+        const piece = if (used == 0)
+            std.fmt.bufPrint(buf[used..], "[schedule {s}] {s}", .{ rec.id, rec.prompt }) catch break
+        else
+            std.fmt.bufPrint(buf[used..], "\n[schedule {s}] {s}", .{ rec.id, rec.prompt }) catch break;
+        used += piece.len;
+    }
+    return if (used == 0) null else buf[0..used];
+}
+
+test "slashCommand and takeWake share the due-claim store" {
+    if (builtin.os.tag == .windows) return error.SkipZigTest;
+    const io = std.testing.io;
+    const gpa = std.testing.allocator;
+    var tmp = std.testing.tmpDir(.{});
+    defer tmp.cleanup();
+    var orig = try Io.Dir.cwd().openDir(io, ".", .{});
+    defer orig.close(io);
+    defer _ = std.posix.system.fchdir(orig.handle);
+    if (std.posix.system.fchdir(tmp.dir.handle) != 0) return error.ChdirFailed;
+
+    var arena_state = std.heap.ArenaAllocator.init(gpa);
+    defer arena_state.deinit();
+    const arena = arena_state.allocator();
+    var root: Agent = undefined;
+    root.io = io;
+    var aw: std.Io.Writer.Allocating = .init(gpa);
+    defer aw.deinit();
+    try std.testing.expect(try slashCommand(&root, arena, "/schedule 30s check the deploy", &aw.writer));
+    try std.testing.expect(std.mem.indexOf(u8, aw.writer.buffered(), "scheduled") != null);
+    const rec = try add(io, arena, 1, "already due");
+    try std.testing.expectEqualStrings("1", rec.id);
+    var buf: [256]u8 = undefined;
+    const wake = takeWake(io, &buf) orelse return error.Empty;
+    try std.testing.expect(std.mem.indexOf(u8, wake, "[schedule 1]") != null);
+    try std.testing.expect(std.mem.indexOf(u8, wake, "already due") != null);
+    try std.testing.expect(takeWake(io, &buf) == null);
+}
diff --git a/src/session_run.zig b/src/session_run.zig
index 32635c38..bb7bbf17 100644
--- a/src/session_run.zig
+++ b/src/session_run.zig
@@ -64,6 +64,7 @@ const run_budget_mod = @import("run_budget.zig");
 const learning_privacy = @import("learning_privacy.zig");
 const commands_privacy = @import("commands_privacy.zig");
 const prompts = @import("prompts.zig");
+const local_tools = @import("local_tools.zig");
 
 /// `graff repl`: interactive chat on the Grok-style TUI (same as `graff tui`).
 /// Piped/non-TTY stdin still drives the old scripted zigzag Model so CI
@@ -309,6 +310,7 @@ pub fn buildRootAgent(
     const fresh_session_name = try std.fmt.allocPrint(arena, "session-{d}-{d}", .{ util.unixMs(io), proc_identity.selfPid() });
     root.session_name = if (flags.resume_flag) |name| (if (!flags.new_session_flag and !flags.no_resume_flag) name else fresh_session_name) else fresh_session_name;
     try prompts.setRootSystemPrompts(&root, sys_normal, arena); // #381: same funnel + the live .graff/playbook.jsonl constraint block
+    local_tools.load(io, arena);
     // Startup pays for one provider format, not all three. Other formats are
     // rendered on first switch with the same built-in + live MCP inputs.
     try root.ensureRootTools(default_provider.kind);
diff --git a/src/session_start.zig b/src/session_start.zig
index ed194136..233686a8 100644
--- a/src/session_start.zig
+++ b/src/session_start.zig
@@ -422,7 +422,7 @@ pub fn initRegistryConsent(io: Io, gpa: Allocator, arena: Allocator, out: *Io.Wr
     // can carry chatter. With a global config `mcp_count > 0` in every project,
     // so an unguarded line here would corrupt the head of every --json run.
     const quiet = json_mode or flags.oneshot_prompt != null or environ_map.get("GRAFF_REPL_DEBUG") == null;
-    const merged = mcp_config.load(io, arena, Io.Dir.cwd(), mcp_config_path, global_path, home);
+    const merged = mcp_config.load(io, arena, Io.Dir.cwd(), mcp_config_path, global_path, home, mcp_config.isEnvOverride(environ_map));
     // Interactive only: json/one-shot stdout cannot carry chatter. A slow
     // Cursor/Claude tree used to look like a hung boot; this line is the clock.
     if (!json_mode and flags.oneshot_prompt == null) {
@@ -472,6 +472,7 @@ pub fn initRegistryConsent(io: Io, gpa: Allocator, arena: Allocator, out: *Io.Wr
     // file precisely when consent was declined and no `init` ever ran. `arena`
     // is the session arena, so the path outlives the registry.
     registry.global_config_path = global_path;
+    registry.global_is_override = mcp_config.isEnvOverride(environ_map);
     registry.show_diagnostics = json_mode or flags.oneshot_prompt != null or environ_map.get("GRAFF_REPL_DEBUG") != null;
     return registry;
 }
diff --git a/src/session_wake.zig b/src/session_wake.zig
new file mode 100644
index 00000000..79bc3d83
--- /dev/null
+++ b/src/session_wake.zig
@@ -0,0 +1,44 @@
+//! One-line user-role inject used by job_notify, schedule, and channel
+//! workers. Same shape as a finished-job wake: history + session_notice.
+
+const std = @import("std");
+
+const agent_mod = @import("agent.zig");
+const engine_sink = @import("engine_sink.zig");
+const Agent = agent_mod.Agent;
+
+pub fn inject(root: *Agent, text: []const u8) void {
+    if (root.sub or text.len == 0) return;
+    const owned = root.arena.dupe(u8, text) catch return;
+    var obj: std.json.ObjectMap = .empty;
+    obj.put(root.arena, "role", .{ .string = "user" }) catch return;
+    obj.put(root.arena, "content", .{ .string = owned }) catch return;
+    root.messages.append(.{ .object = obj }) catch {};
+    engine_sink.forAgent(root).emit(root.io, .{ .session_notice = .{ .text = owned, .tone = .dim } });
+}
+
+test "inject is a no-op on subagents" {
+    var root: Agent = undefined;
+    root.sub = true;
+    root.messages = std.json.Array.init(std.testing.allocator);
+    inject(&root, "hi");
+    try std.testing.expectEqual(@as(usize, 0), root.messages.items.len);
+}
+
+test "inject appends a user-role line on the root" {
+    var arena_state = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena_state.deinit();
+    const drop = struct {
+        fn emit(_: *anyopaque, _: engine_sink.Stamped) void {}
+    };
+    const vt = engine_sink.VTable{ .emit = drop.emit, .durable = false };
+    var root: Agent = undefined;
+    root.sub = false;
+    root.arena = arena_state.allocator();
+    root.messages = std.json.Array.init(arena_state.allocator());
+    root.sink = .{ .ctx = undefined, .vt = &vt };
+    inject(&root, "wake up");
+    try std.testing.expectEqual(@as(usize, 1), root.messages.items.len);
+    try std.testing.expectEqualStrings("user", root.messages.items[0].object.get("role").?.string);
+    try std.testing.expectEqualStrings("wake up", root.messages.items[0].object.get("content").?.string);
+}
diff --git a/src/spec_structured_output_conformance.zig b/src/spec_structured_output_conformance.zig
index 2f03637f..7f1f4d8d 100644
--- a/src/spec_structured_output_conformance.zig
+++ b/src/spec_structured_output_conformance.zig
@@ -53,6 +53,8 @@ fn toolsFor(wire: []const u8) []const u8 {
 
 fn classify(body: []const u8, wire: []const u8) []const u8 {
     if (std.mem.indexOf(u8, body, "\"text\":{\"format\":{\"type\":\"json_schema\"") != null) return "textFormat";
+    if (std.mem.indexOf(u8, body, "\"format\":{\"type\":\"json_schema\"") != null and
+        std.mem.indexOf(u8, body, "\"output_config\"") != null) return "outputConfig";
     if (std.mem.indexOf(u8, body, "\"response_format\":{\"type\":\"json_schema\"") != null) return "jsonSchema";
     if (std.mem.indexOf(u8, body, "\"response_format\":{\"type\":\"json_object\"}") != null) return "jsonObject";
     if (std.mem.indexOf(u8, body, "\"name\":\"structured_output\"") != null)
@@ -90,7 +92,10 @@ test "spec/structured_output: buildBody's carrier matches the model on every cel
             );
             return error.CatalogMismatch;
         }
-        // never_silent, on the live bytes: a set schema always reaches the wire.
-        if (schema and std.mem.eql(u8, got, "none") and !prompt_got) return error.SchemaSilentlyDropped;
+        // never_silent: a set schema reaches the wire, except an anthropic
+        // tools turn (ADR 0001 — the two-phase split holds it for formatting).
+        if (schema and std.mem.eql(u8, got, "none") and !prompt_got) {
+            if (!(std.mem.eql(u8, wire, "anthropic") and tools)) return error.SchemaSilentlyDropped;
+        }
     }
 }
diff --git a/src/startup.zig b/src/startup.zig
index 1e425e06..f851ae2d 100644
--- a/src/startup.zig
+++ b/src/startup.zig
@@ -173,6 +173,10 @@ pub fn buildSystemPrompt(
     // sys_normal/sys_strict/sys_ultra/sys_ultra_strict from it — the single
     // funnel every later mutation (repl, set_agent, set_system_prompt) must
     // also go through, so none of the four ever go stale independently.
+    // #629: --experiment is armed before this runs; the spawn mandate rides
+    // sys_base so a later playbook refresh cannot drop it.
+    if (@import("experiment_pool.zig").directive()) |d|
+        sys_normal = try std.fmt.allocPrint(arena, "{s}\n\n{s}", .{ sys_normal, d });
     return sys_normal;
 }
 
diff --git a/src/subagent_run.zig b/src/subagent_run.zig
index 1850df6b..60ba8976 100644
--- a/src/subagent_run.zig
+++ b/src/subagent_run.zig
@@ -319,8 +319,11 @@ pub fn runSub(ctx: ToolCtx, kind: []const u8, label: []const u8, prompt: []const
 
     var wt: ?jobs.AgentWorktree = null;
     var isolation_note: []const u8 = "";
-    if (@import("experiment_pool.zig").claim()) |seat| {
-        agent.agent_cwd = seat;
+    var pool_seat = false;
+    if (@import("experiment_pool.zig").claimSeat()) |seat| {
+        agent.agent_cwd = seat.path;
+        wt = .{ .path = seat.path, .branch = seat.branch, .base = seat.base };
+        pool_seat = true;
     } else if (isolation == .worktree) {
         if (jobs.agentWorktreeCreate(gpa, ctx.io, arena, sub_id)) |created| {
             wt = created;
@@ -419,9 +422,16 @@ pub fn runSub(ctx: ToolCtx, kind: []const u8, label: []const u8, prompt: []const
     const text = report catch |err| {
         var out = subagentFailure(gpa, sub_id, err, agent.last_api_error, attempts);
         if (wt) |w| {
-            const combined = std.fmt.allocPrint(gpa, "{s}\n\n[worktree left in place after failure — path: {s}, branch: {s}]", .{ out.text, w.path, w.branch }) catch return .{ .output = out, .usage = usage };
-            gpa.free(out.text);
-            out.text = combined;
+            const tail = if (pool_seat)
+                @import("experiment_pool.zig").deliverNote(gpa, ctx.io, .{ .path = w.path, .branch = w.branch, .base = w.base })
+            else
+                (std.fmt.allocPrint(gpa, "\n\n[worktree left in place after failure — path: {s}, branch: {s}]", .{ w.path, w.branch }) catch "");
+            if (tail.len > 0) {
+                const combined = std.fmt.allocPrint(gpa, "{s}{s}", .{ out.text, tail }) catch return .{ .output = out, .usage = usage };
+                gpa.free(out.text);
+                gpa.free(tail);
+                out.text = combined;
+            }
         }
         return .{ .output = out, .usage = usage };
     };
@@ -437,10 +447,15 @@ pub fn runSub(ctx: ToolCtx, kind: []const u8, label: []const u8, prompt: []const
     var extra: []const u8 = isolation_note;
     var extra_owned = false;
     if (wt) |w| {
-        const outcome = jobs.agentWorktreeFinish(gpa, ctx.io, w);
-        if (outcome.kept) {
-            extra = std.fmt.allocPrint(gpa, "\n\n[worktree kept ({s}) — path: {s}, branch: {s}]", .{ jobs.keepReasonText(outcome.reason), w.path, w.branch }) catch "";
+        if (pool_seat) {
+            extra = @import("experiment_pool.zig").deliverNote(gpa, ctx.io, .{ .path = w.path, .branch = w.branch, .base = w.base });
             extra_owned = extra.len > 0;
+        } else {
+            const outcome = jobs.agentWorktreeFinish(gpa, ctx.io, w);
+            if (outcome.kept) {
+                extra = std.fmt.allocPrint(gpa, "\n\n[worktree kept ({s}) — path: {s}, branch: {s}]", .{ jobs.keepReasonText(outcome.reason), w.path, w.branch }) catch "";
+                extra_owned = extra.len > 0;
+            }
         }
     }
     defer if (extra_owned) gpa.free(extra);
diff --git a/src/test_hooks.zig b/src/test_hooks.zig
index a112a9e1..13428a0b 100644
--- a/src/test_hooks.zig
+++ b/src/test_hooks.zig
@@ -334,4 +334,10 @@ test {
     _ = @import("commands_experiment.zig");
     _ = @import("acp_engine.zig");
     _ = @import("libgraff.zig");
+    _ = @import("tui_peer.zig");
+    _ = @import("acp_auth.zig");
+    _ = @import("local_tools.zig");
+    _ = @import("schedule.zig");
+    _ = @import("channel_worker.zig");
+    _ = @import("session_wake.zig");
 }
diff --git a/src/tui_launch.zig b/src/tui_launch.zig
index 321d38e8..c0d5440e 100644
--- a/src/tui_launch.zig
+++ b/src/tui_launch.zig
@@ -16,9 +16,12 @@ const repl = @import("repl.zig");
 const repl_bash = @import("repl_bash.zig");
 const repl_glue = @import("repl_glue.zig");
 const tui = @import("tui");
+const tui_peer = @import("tui_peer.zig");
 const engine_sink = @import("engine_sink.zig");
 const tui_sink = @import("tui_sink.zig");
 const job_notify = @import("job_notify.zig");
+const schedule = @import("schedule.zig");
+const channel_worker = @import("channel_worker.zig");
 const obs = @import("obs.zig");
 const telemetry = @import("telemetry.zig");
 const vision = @import("vision.zig");
@@ -88,6 +91,7 @@ pub fn run(
         .tools_anthropic = root.tools_anthropic,
         .tools_openai = root.tools_openai,
         .tools_responses = root.tools_responses,
+        .root = root,
     };
     // #551: the session's conversation belongs to the engine and outlives every
     // turn, so tool_use/tool_result blocks accumulate the way mainloop's root
@@ -118,6 +122,7 @@ pub fn run(
         .compact_fn = compactCb,
         .history_fn = historyCb,
         .idle_wake_fn = idleWakeCb,
+        .peer_fn = tui_peer.peerCb,
     });
 }
 
@@ -139,7 +144,9 @@ fn historyCb(ctx: ?*anyopaque, op: tui.HistoryOp) void {
 
 fn idleWakeCb(ctx: ?*anyopaque, buf: []u8) ?[]const u8 {
     const c: *repl_glue.ReplCtx = @ptrCast(@alignCast(ctx orelse return null));
-    return job_notify.takeWake(c.io, buf);
+    if (job_notify.takeWake(c.io, buf)) |t| return t;
+    if (schedule.takeWake(c.io, buf)) |t| return t;
+    return channel_worker.takeWake(c.io, buf);
 }
 
 /// Overlay the TUI preview buffer as a repl.StreamBuf so replTurnCb's
@@ -382,6 +389,7 @@ test {
     _ = tui;
     _ = tui_sink;
     _ = repl_bash;
+    _ = tui_peer;
 }
 
 test "hudCb usage/debug use the cost-tally renderer, not chars" {
diff --git a/src/tui_peer.zig b/src/tui_peer.zig
new file mode 100644
index 00000000..6e3d69df
--- /dev/null
+++ b/src/tui_peer.zig
@@ -0,0 +1,69 @@
+//! Host side of TUI `/tell` / `/peek`: the pager is a thin client; this
+//! calls the existing mailbox (`tellCommand` / `peekCommand`) on the live
+//! agent. Wired from `tui_launch` as `engine.PeerFn`.
+
+const std = @import("std");
+const Io = std.Io;
+const Allocator = std.mem.Allocator;
+
+const agent_mod = @import("agent.zig");
+const peer_channel = @import("peer_channel.zig");
+const presence = @import("presence.zig");
+const proc_identity = @import("proc_identity.zig");
+const repl_glue = @import("repl_glue.zig");
+
+const Agent = agent_mod.Agent;
+
+/// Run a `/tell` or `/peek` line against `root`. Caller frees the returned
+/// text. Null only when the line is not a peer slash or allocation failed.
+pub fn runSlash(root: *Agent, gpa: Allocator, line: []const u8) ?[]const u8 {
+    const trimmed = std.mem.trim(u8, line, " \t\r\n");
+    const is_tell = std.mem.startsWith(u8, trimmed, "/tell") and
+        (trimmed.len == 5 or trimmed[5] == ' ' or trimmed[5] == '\t');
+    const is_peek = std.mem.startsWith(u8, trimmed, "/peek") and
+        (trimmed.len == 5 or trimmed[5] == ' ' or trimmed[5] == '\t');
+    if (!is_tell and !is_peek) return null;
+
+    var arena_state = std.heap.ArenaAllocator.init(gpa);
+    defer arena_state.deinit();
+    var buf: [8192]u8 = undefined;
+    var w: Io.Writer = .fixed(&buf);
+    const ok = if (is_tell)
+        peer_channel.tellCommand(root, arena_state.allocator(), trimmed, &w)
+    else
+        peer_channel.peekCommand(root, arena_state.allocator(), trimmed, &w);
+    _ = ok catch return gpa.dupe(u8, "peer talk failed") catch null;
+    return gpa.dupe(u8, w.buffered()) catch null;
+}
+
+/// `engine.PeerFn` — reads the live agent off `ReplCtx.root`.
+pub fn peerCb(ctx: ?*anyopaque, gpa: Allocator, line: []const u8) ?[]const u8 {
+    const c: *repl_glue.ReplCtx = @ptrCast(@alignCast(ctx orelse return null));
+    const root = c.root orelse return gpa.dupe(u8, "peer talk needs a live session") catch null;
+    return runSlash(root, gpa, line);
+}
+
+test "TUI /tell all appends a device-room line the other session would hear" {
+    const io = std.testing.io;
+    const gpa = std.testing.allocator;
+    var tmp = std.testing.tmpDir(.{});
+    defer tmp.cleanup();
+    const dir_path = try std.fmt.allocPrint(gpa, ".zig-cache/tmp/{s}", .{std.mem.sliceTo(&tmp.sub_path, 0)});
+    defer gpa.free(dir_path);
+
+    presence.bindForTest(dir_path, "/repo/.git", "s-tui", proc_identity.selfRecord(io));
+    defer presence.unbindForTest();
+
+    var root: Agent = undefined;
+    root.io = io;
+    const text = runSlash(&root, gpa, "/tell all hold the tree from the pager") orelse
+        return error.ExpectedPosted;
+    defer gpa.free(text);
+    try std.testing.expect(std.mem.indexOf(u8, text, "posted") != null);
+
+    const room = tmp.dir.readFileAlloc(io, presence.device_room, gpa, .limited(4096)) catch
+        return error.ExpectedRoomFile;
+    defer gpa.free(room);
+    try std.testing.expect(std.mem.indexOf(u8, room, "hold the tree from the pager") != null);
+    try std.testing.expect(std.mem.indexOf(u8, room, "\"from_user\":true") != null);
+}
diff --git a/src/worktree_prune.zig b/src/worktree_prune.zig
index 9757c5df..a74669c4 100644
--- a/src/worktree_prune.zig
+++ b/src/worktree_prune.zig
@@ -258,7 +258,13 @@ pub fn listWithAge(gpa: Allocator, io: Io, arena: Allocator, out: *Io.Writer) !v
         const age = formatAge(&abuf, worktreeAgeMs(io, now_ms, e.path));
         const label = if (e.branch.len > 0) shortBranch(e.branch) else if (e.detached) "(detached)" else if (e.bare) "(bare)" else "";
         const is_main = i == 0 or (main_path.len > 0 and std.mem.eql(u8, e.path, main_path));
-        try out.print("{s: <5} {s}  [{s}]{s}\n", .{ age, e.path, label, if (is_main) "  (main checkout)" else "" });
+        const tag: []const u8 = if (is_main)
+            "  (main checkout)"
+        else if (@import("experiment_pool.zig").isExperimentTree(e.path, e.branch))
+            "  (experiment pool)"
+        else
+            "";
+        try out.print("{s: <5} {s}  [{s}]{s}\n", .{ age, e.path, label, tag });
     }
 }