diff --git a/Cargo.lock b/Cargo.lock
index 6bceb4b..b5344c9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -142,25 +142,25 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "az-agent"
-version = "0.1.56"
+version = "0.1.57"
 dependencies = [
  "az-core",
 ]
 
 [[package]]
 name = "az-agent-proxy"
-version = "0.1.56"
+version = "0.1.57"
 dependencies = [
  "az-core",
 ]
 
 [[package]]
 name = "az-core"
-version = "0.1.56"
+version = "0.1.57"
 
 [[package]]
 name = "az-gui"
-version = "0.1.56"
+version = "0.1.57"
 dependencies = [
  "agent-abstraction",
  "az-core",
@@ -183,7 +183,7 @@ dependencies = [
 
 [[package]]
 name = "az-mcp-proxy"
-version = "0.1.56"
+version = "0.1.57"
 dependencies = [
  "az-core",
 ]
@@ -5551,7 +5551,7 @@ dependencies = [
 
 [[package]]
 name = "wt-migrate"
-version = "0.1.56"
+version = "0.1.57"
 dependencies = [
  "derive_more 2.1.1",
  "eyre",
@@ -5565,7 +5565,7 @@ dependencies = [
 
 [[package]]
 name = "wt-tools"
-version = "0.1.56"
+version = "0.1.57"
 dependencies = [
  "derive_more 2.1.1",
  "dirs",
diff --git a/Cargo.toml b/Cargo.toml
index d2b7724..2e25aa4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -11,7 +11,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.1.56"
+version = "0.1.57"
 edition = "2024"
 publish = false
 
diff --git a/apps/gui/frontend/src/features/project/ApprovalCard.tsx b/apps/gui/frontend/src/features/project/ApprovalCard.tsx
index 7e2f42b..4774234 100644
--- a/apps/gui/frontend/src/features/project/ApprovalCard.tsx
+++ b/apps/gui/frontend/src/features/project/ApprovalCard.tsx
@@ -17,6 +17,7 @@ import type { PendingApproval } from "~/types";
  */
 export function ApprovalCard(props: { projectId: string; approval: PendingApproval }): JSX.Element {
   const { actions } = useWorkspace();
+  const isPermissionGrant = () => props.approval.tool.toLowerCase() === "permissions";
 
   const answer = (allow: boolean, remember = false): void => {
     void actions
@@ -32,6 +33,16 @@ export function ApprovalCard(props: { projectId: string; approval: PendingApprov
       for (const key of ["command", "file_path", "path", "url"]) {
         if (typeof record[key] === "string") return record[key] as string;
       }
+      const permissions = record.permissions;
+      if (permissions && typeof permissions === "object") {
+        const fileSystem = (permissions as Record<string, unknown>).fileSystem;
+        if (fileSystem && typeof fileSystem === "object") {
+          const write = (fileSystem as Record<string, unknown>).write;
+          if (Array.isArray(write) && write.every((path) => typeof path === "string")) {
+            return write.join(", ");
+          }
+        }
+      }
     }
     return null;
   };
@@ -73,7 +84,7 @@ export function ApprovalCard(props: { projectId: string; approval: PendingApprov
             onClick={() => answer(true)}
             class="rounded-lg bg-primary px-[13px] py-[5px] font-semibold text-[12px] text-primary-content transition-colors hover:bg-az-primary-hover"
           >
-            Allow once
+            {isPermissionGrant() ? "Allow for session" : "Allow once"}
           </button>
           <button
             type="button"
@@ -84,10 +95,14 @@ export function ApprovalCard(props: { projectId: string; approval: PendingApprov
              * parent directory — and answers matching asks itself from now
              * on, each auto-allow audited in the Agent I/O panel.
              */
-            title="Remembers this kind of call for this project — the same command family or the same directory — and allows it automatically from now on"
+            title={
+              isPermissionGrant()
+                ? "Remembers this exact set of writable paths for this project and allows it automatically on later runs"
+                : "Remembers this kind of call for this project — the same command family or the same directory — and allows it automatically from now on"
+            }
             class="rounded-lg border border-primary/50 px-3 py-[5px] font-semibold text-[12px] text-primary transition-colors hover:border-primary hover:bg-primary/10"
           >
-            Always allow similar
+            {isPermissionGrant() ? "Always allow these paths" : "Always allow similar"}
           </button>
           <button
             type="button"
@@ -98,6 +113,11 @@ export function ApprovalCard(props: { projectId: string; approval: PendingApprov
           </button>
           <span class="text-[11.5px] text-az-muted">· the run is paused until you decide</span>
         </div>
+        <Show when={isPermissionGrant()}>
+          <p class="text-[11px] text-az-muted leading-[1.45]">
+            Add a folder to Working directories in Settings to make it writable from the start.
+          </p>
+        </Show>
       </div>
     </div>
   );
diff --git a/apps/gui/frontend/src/features/project/MessageBody.test.tsx b/apps/gui/frontend/src/features/project/MessageBody.test.tsx
index 902bbaa..21837c6 100644
--- a/apps/gui/frontend/src/features/project/MessageBody.test.tsx
+++ b/apps/gui/frontend/src/features/project/MessageBody.test.tsx
@@ -56,6 +56,26 @@ describe("MessageBody", () => {
     const { container } = render(() => <MessageBody body="text" />);
     expect(container.querySelector("[data-selectable]")).toBeTruthy();
   });
+
+  it("visually marks a standalone Prompt Syntax authoring directive", () => {
+    const directive = '<ps @agency:items.state(id: "item-869382d3", status: "active")>';
+    const { container } = render(() => (
+      <MessageBody body={`Working on it.\n${directive}\nContinuing.`} />
+    ));
+
+    const marked = container.querySelector("[data-ps-directive]");
+    expect(marked).toHaveTextContent("Prompt Syntax");
+    expect(marked).toHaveTextContent(directive);
+  });
+
+  it("leaves misframed and quoted Prompt Syntax inert", () => {
+    const directive = '<ps @agency:items.state(id: "item-a", status: "active")>';
+    const body = `Attached to prose: ${directive}\n\n> ${directive}\n\n    ${directive}`;
+    const { container } = render(() => <MessageBody body={body} />);
+
+    expect(container.querySelector("[data-ps-directive]")).toBeNull();
+    expect(container.textContent).toContain(directive);
+  });
 });
 
 /*
@@ -140,6 +160,18 @@ describe("fenced blocks", () => {
     // And its own inline code still reads as code.
     expect([...container.querySelectorAll("code")].map((c) => c.textContent)).toContain("ask");
   });
+
+  it("keeps Prompt Syntax inert inside either Markdown fence marker", () => {
+    const directive = '<ps @agency:items.retire(id: "item-a")>';
+    const body = `\`\`\`\`text\n${directive}\n\`\`\`\n\`\`\`\`\n~~~~\n${directive}\n~~~~`;
+    const { container } = render(() => <MessageBody body={body} />);
+
+    expect(container.querySelector("[data-ps-directive]")).toBeNull();
+    expect([...container.querySelectorAll("pre code")].map((node) => node.textContent)).toEqual([
+      `${directive}\n\`\`\``,
+      directive,
+    ]);
+  });
 });
 
 describe("InlineText", () => {
diff --git a/apps/gui/frontend/src/features/project/MessageBody.tsx b/apps/gui/frontend/src/features/project/MessageBody.tsx
index 86fdc18..7f34175 100644
--- a/apps/gui/frontend/src/features/project/MessageBody.tsx
+++ b/apps/gui/frontend/src/features/project/MessageBody.tsx
@@ -67,7 +67,19 @@ export async function copyText(text: string): Promise<boolean> {
  * the difference: everything outside one is wrapped prose, and everything inside
  * one is text whose line breaks are the content.
  */
-type Block = { kind: "code"; text: string; lang: string } | { kind: "prose"; text: string };
+type Block =
+  | { kind: "code"; text: string; lang: string }
+  | { kind: "directive"; text: string }
+  | { kind: "prose"; text: string };
+
+/** The same explicit authoring-line boundary Rust promotes. */
+export function isPromptSyntaxDirectiveLine(line: string): boolean {
+  if (line.startsWith("    ") || line.startsWith("\t")) return false;
+  const trimmed = line.trim();
+  if (trimmed.startsWith(">")) return false;
+  const afterTag = trimmed.slice(3);
+  return trimmed.startsWith("<ps") && /^\s/.test(afterTag) && trimmed.endsWith(">");
+}
 
 /**
  * Split a body into fenced blocks and the prose between them.
@@ -89,6 +101,7 @@ export function splitBlocks(body: string): Block[] {
   let code: string[] | null = null;
   let lang = "";
   let indent = "";
+  let marker = "";
 
   const flushProse = () => {
     const text = prose.join("\n");
@@ -111,22 +124,36 @@ export function splitBlocks(body: string): Block[] {
   };
 
   for (const line of body.split("\n")) {
-    const fence = /^(\s*)```(.*)$/.exec(line);
+    const fence = /^(\s*)(`{3,}|~{3,})(.*)$/.exec(line);
     if (!fence) {
-      if (code === null) prose.push(line);
-      else code.push(deindent(line));
+      if (code !== null) {
+        code.push(deindent(line));
+      } else if (isPromptSyntaxDirectiveLine(line)) {
+        flushProse();
+        blocks.push({ kind: "directive", text: line.trim() });
+      } else {
+        prose.push(line);
+      }
       continue;
     }
     if (code === null) {
       flushProse();
       code = [];
       indent = fence[1];
-      lang = fence[2].trim();
-    } else {
+      marker = fence[2];
+      lang = fence[3].trim();
+    } else if (
+      fence[2][0] === marker[0] &&
+      fence[2].length >= marker.length &&
+      fence[3].trim().length === 0
+    ) {
       blocks.push({ kind: "code", text: code.join("\n"), lang });
       code = null;
       lang = "";
       indent = "";
+      marker = "";
+    } else {
+      code.push(deindent(line));
     }
   }
 
@@ -146,6 +173,8 @@ export function MessageBody(props: { body: string; class?: string }): JSX.Elemen
         {(block) =>
           block.kind === "code" ? (
             <CodeBlock text={block.text} lang={block.lang} />
+          ) : block.kind === "directive" ? (
+            <PromptSyntaxDirective text={block.text} />
           ) : (
             <For
               each={block.text
@@ -165,6 +194,21 @@ export function MessageBody(props: { body: string; class?: string }): JSX.Elemen
   );
 }
 
+/** A promoted reverse-channel action, visibly distinct from ordinary prose. */
+function PromptSyntaxDirective(props: { text: string }): JSX.Element {
+  return (
+    <div
+      data-ps-directive
+      class="flex min-w-0 items-center gap-2 overflow-x-auto rounded-lg border border-primary/25 bg-primary/6 px-2.5 py-2"
+    >
+      <span class="shrink-0 rounded bg-primary/12 px-1.5 py-0.5 font-semibold text-[10px] text-primary uppercase tracking-[.05em]">
+        Prompt Syntax
+      </span>
+      <code class="whitespace-pre font-mono text-[11.5px] text-az-body">{props.text}</code>
+    </div>
+  );
+}
+
 /**
  * A fenced block: line breaks preserved, and copyable without a drag.
  *
diff --git a/apps/gui/frontend/src/features/project/TranscriptPane.tsx b/apps/gui/frontend/src/features/project/TranscriptPane.tsx
index 57206a4..adafa8b 100644
--- a/apps/gui/frontend/src/features/project/TranscriptPane.tsx
+++ b/apps/gui/frontend/src/features/project/TranscriptPane.tsx
@@ -138,7 +138,7 @@ export function TranscriptPane(props: {
               <span class="text-[11px] text-az-muted">
                 {AGENT_LABELS[streamingAgent()]} · writing…
               </span>
-              <p class={`whitespace-pre-wrap ${AGENT_TEXT}`}>{text()}</p>
+              <MessageBody body={text()} class={AGENT_TEXT} />
             </div>
           )}
         </Show>
diff --git a/apps/gui/src/directives.rs b/apps/gui/src/directives.rs
index 24f4cf5..9d8b1a7 100644
--- a/apps/gui/src/directives.rs
+++ b/apps/gui/src/directives.rs
@@ -41,7 +41,7 @@ pub struct Surface {
     pub delimiter: &'static str,
     /// 13.2.2. The vendor-extension namespace whose references are live.
     pub namespace: &'static str,
-    /// 13.2.2. Closed and declared. An unlisted verb parses to nothing.
+    /// 13.2.2. Closed and declared. An unlisted authored verb is refused.
     pub verbs: &'static [&'static str],
     /// 13.2.2. Verbs and values reserved to principals above the agent.
     pub reserved: &'static [&'static str],
@@ -129,6 +129,19 @@ pub enum Outcome {
     Refused { what: String, code: String },
 }
 
+/// What a standalone `<ps …>` authoring segment resolved to.
+///
+/// Ordinary prose is not represented here at all. Once a line explicitly
+/// enters the declared surface, however, it must become either a directive or
+/// a typed refusal. Treating an unknown or malformed reference as ordinary
+/// text would violate the reverse-channel fill contract and leave the agent
+/// unable to correct it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Authored {
+    Directive(Directive),
+    Refused(Outcome),
+}
+
 impl Outcome {
     /// One line for the receipt.
     #[must_use]
@@ -258,6 +271,50 @@ pub fn parse(line: &str) -> Option<Directive> {
     None
 }
 
+/// Resolve one explicit authoring segment, including its failure path.
+///
+/// `None` means the line never designated itself as this surface. A line that
+/// does start with the declared `<ps ` delimiter always returns an outcome:
+/// unknown references fail binding, while a known verb with an invalid shape
+/// fails syntax validation. Both are receipts rather than silent raw text.
+#[must_use]
+pub fn parse_authored(line: &str) -> Option<Authored> {
+    let trimmed = line.trim();
+    let after_tag = trimmed.strip_prefix("<ps")?;
+    if !after_tag.chars().next().is_some_and(char::is_whitespace) {
+        return None;
+    }
+    if let Some(directive) = parse(trimmed) {
+        return Some(Authored::Directive(directive));
+    }
+
+    let has_bidi = trimmed.chars().any(|char| {
+        matches!(
+            char,
+            '\u{061c}' | '\u{200e}' | '\u{200f}' | '\u{202a}'..='\u{202e}' | '\u{2066}'..='\u{2069}'
+        )
+    });
+    let inner = after_tag.strip_suffix('>').unwrap_or(after_tag).trim();
+    let verb = inner.split_once('(').map_or(inner, |(verb, _)| verb).trim();
+    let named = if verb.is_empty() {
+        "authored Prompt Syntax segment".to_string()
+    } else {
+        verb.chars().take(96).collect()
+    };
+    let known = SURFACE
+        .verbs
+        .iter()
+        .any(|candidate| verb.eq_ignore_ascii_case(&format!("@{}:{candidate}", SURFACE.namespace)));
+    Some(Authored::Refused(Outcome::Refused {
+        what: named,
+        code: if has_bidi || known {
+            "SYNTAX_INVALID".into()
+        } else {
+            "ENTITY_NOT_FOUND".into()
+        },
+    }))
+}
+
 /// Whether the agent is allowed to set this status.
 #[must_use]
 pub fn settable(status: &str) -> bool {
@@ -381,6 +438,32 @@ mod tests {
         assert!(parse(r#"<ps @agency:items.state(status: "new")>"#).is_none());
     }
 
+    #[test]
+    fn an_authored_segment_never_fails_as_silent_text() {
+        let valid =
+            parse_authored(r#"<ps @agency:items.state(id: "item-869382d3", status: "active")>"#);
+        assert!(matches!(
+            valid,
+            Some(Authored::Directive(Directive::ItemState { ref id, .. }))
+                if id == "item-869382d3"
+        ));
+
+        let unknown = parse_authored(r#"<ps @agency:items.destroy(id: "item-a3f9")>"#);
+        assert!(matches!(
+            unknown,
+            Some(Authored::Refused(Outcome::Refused { ref code, .. }))
+                if code == "ENTITY_NOT_FOUND"
+        ));
+
+        let malformed = parse_authored(r#"<ps @agency:items.state(status: "active")>"#);
+        assert!(matches!(
+            malformed,
+            Some(Authored::Refused(Outcome::Refused { ref code, .. }))
+                if code == "SYNTAX_INVALID"
+        ));
+        assert_eq!(parse_authored("ordinary prose"), None);
+    }
+
     /// The owner closes an item. The agent can report that it shipped
     /// something; it cannot report that the thing works, because it is not the
     /// one looking at the screen.
diff --git a/apps/gui/src/projects.rs b/apps/gui/src/projects.rs
index 95ba0f1..53bf556 100644
--- a/apps/gui/src/projects.rs
+++ b/apps/gui/src/projects.rs
@@ -1139,16 +1139,59 @@ async fn apply_directive(
                 .collect();
 
             // The same title twice is the agent restating itself, not a second
-            // item. It answers with the existing id so the next reference is
-            // by id, which is how a restatement stops becoming a duplicate.
-            if let Some(existing) = target_rows
+            // item. Resolve only a unique legacy match: old title-based flows
+            // could leave duplicates, and choosing one would repeat that bug.
+            //
+            // A restated add may carry newer state. Home used to acknowledge
+            // the existing title without applying that state, so a request to
+            // make an existing task active reported success while leaving it
+            // new. Reconcile the unique row, then answer with its id so every
+            // later reference can use the stable identity.
+            let mut matching = target_rows
                 .iter()
-                .find(|row| row.title.eq_ignore_ascii_case(title.trim()))
-            {
-                return Outcome::Done(match handle {
-                    Some(handle) => format!("{handle} -> {} (already open)", existing.id),
-                    None => format!("{} already open", existing.id),
-                });
+                .filter(|row| row.title.eq_ignore_ascii_case(title.trim()));
+            match (matching.next(), matching.next()) {
+                (Some(_), Some(_)) => {
+                    return Outcome::Refused {
+                        what: format!("items.add({title:?})"),
+                        code: "ENTITY_AMBIGUOUS".into(),
+                    };
+                }
+                (Some(existing), None) => {
+                    let moved = existing.status != status;
+                    if moved
+                        && let Err(error) = tables
+                            .project_item
+                            .update_status_by_id(
+                                ItemStatusByIdQuery {
+                                    status: status.clone(),
+                                },
+                                existing.id.clone(),
+                            )
+                            .await
+                    {
+                        return Outcome::Refused {
+                            what: format!("items.add({title:?})"),
+                            code: format!("WRITE_FAILED: {error}"),
+                        };
+                    }
+                    if moved && let Some(updated) = tables.project_item.select(existing.id.clone())
+                    {
+                        let _ = app.emit("item:updated", ProjectItemDto::from(updated));
+                    }
+                    let state = moved.then(|| format!("; -> {status}"));
+                    return Outcome::Done(match handle {
+                        Some(handle) => format!(
+                            "{handle} -> {} (already open{})",
+                            existing.id,
+                            state.unwrap_or_default()
+                        ),
+                        None => {
+                            format!("{} already open{}", existing.id, state.unwrap_or_default())
+                        }
+                    });
+                }
+                (None, _) => {}
             }
             let row = ProjectItemRow {
                 id: id("item"),
@@ -1339,10 +1382,12 @@ async fn apply_directives_with_state(
 ) -> Vec<crate::directives::Outcome> {
     let mut done = Vec::new();
     for line in text.lines() {
-        if let Some(directive) =
-            authored_directive_line(line, fenced).and_then(crate::directives::parse)
-        {
-            done.push(apply_directive(app, tables, project_id, directive).await);
+        match authored_directive_line(line, fenced).and_then(crate::directives::parse_authored) {
+            Some(crate::directives::Authored::Directive(directive)) => {
+                done.push(apply_directive(app, tables, project_id, directive).await);
+            }
+            Some(crate::directives::Authored::Refused(outcome)) => done.push(outcome),
+            None => {}
         }
     }
     done
@@ -1887,7 +1932,10 @@ pub type PendingApprovals =
 ///
 /// File tools collapse to the file's parent directory, so allowing one edit
 /// in a crate allows that directory, not the disk. URL tools collapse to the
-/// host. Anything else is the tool name alone.
+/// host. Codex permission requests carry their roots in a nested permission
+/// object; those collapse to the sorted, exact write-root set so remembering
+/// one directory can never silently approve another. Anything else is the tool
+/// name alone.
 fn approval_signature(tool: &str, input: &serde_json::Value) -> String {
     let text = |key: &str| {
         input
@@ -1915,6 +1963,22 @@ fn approval_signature(tool: &str, input: &serde_json::Value) -> String {
         };
     }
 
+    if tool.eq_ignore_ascii_case("permissions") {
+        let mut roots: Vec<&str> = input
+            .pointer("/permissions/fileSystem/write")
+            .and_then(serde_json::Value::as_array)
+            .into_iter()
+            .flatten()
+            .filter_map(serde_json::Value::as_str)
+            .filter(|root| !root.is_empty())
+            .collect();
+        roots.sort_unstable();
+        roots.dedup();
+        if !roots.is_empty() {
+            return format!("Permissions: write {}", roots.join(", "));
+        }
+    }
+
     for key in ["file_path", "path", "notebook_path"] {
         let value = text(key);
         if !value.is_empty() {
@@ -5509,6 +5573,26 @@ mod tests {
         assert_eq!(sig, "WebFetch: docs.rs");
     }
 
+    #[test]
+    fn codex_permission_rules_name_the_exact_write_roots() {
+        let input = serde_json::json!({
+            "permissions": {"fileSystem": {"write": ["/repo-b", "/repo-a", "/repo-a"]}}
+        });
+        assert_eq!(
+            approval_signature("Permissions", &input),
+            "Permissions: write /repo-a, /repo-b"
+        );
+        assert_ne!(
+            approval_signature("Permissions", &input),
+            approval_signature(
+                "Permissions",
+                &serde_json::json!({
+                    "permissions": {"fileSystem": {"write": ["/somewhere-else"]}}
+                })
+            )
+        );
+    }
+
     /// A tool with no recognized shape falls back to the tool name alone —
     /// still a rule, just a coarse one, and visibly so in the UI.
     #[test]
diff --git a/docs/ps-capability.yaml b/docs/ps-capability.yaml
index 195acf6..74b803f 100644
--- a/docs/ps-capability.yaml
+++ b/docs/ps-capability.yaml
@@ -11,8 +11,8 @@ standing_promotion:
   # over undifferentiated output: fenced and quoted text stays inert.
   delimiter: "<ps …> on its own line, outside fenced or quoted content"
 
-  # 13.2.2 The live namespace and its closed verb set. An unlisted verb parses
-  # to nothing rather than being guessed at.
+  # 13.2.2 The live namespace and its closed verb set. An unlisted verb is
+  # refused as ENTITY_NOT_FOUND rather than guessed or silently left as text.
   namespace: agency
   verbs:
     - agency:items.state
@@ -51,7 +51,8 @@ standing_promotion:
   # no-op, and the outcomes are quoted back to the agent on the following turn.
   trace:
     per_directive_outcome: true
-    failure_codes: [ENTITY_NOT_FOUND, ENTITY_AMBIGUOUS, STATUS_NOT_YOURS, WRITE_FAILED]
+    failure_codes:
+      [ENTITY_NOT_FOUND, ENTITY_AMBIGUOUS, SYNTAX_INVALID, STATUS_NOT_YOURS, WRITE_FAILED]
     surfaced_to: [agent, agent_io_panel]
     # Not yet: outcomes are text lines rather than traced events carrying the
     # segment and its provenance type. Stated because an unmet obligation that
diff --git a/docs/task-manager.md b/docs/task-manager.md
index 39a14e2..72542da 100644
--- a/docs/task-manager.md
+++ b/docs/task-manager.md
@@ -30,9 +30,12 @@ Home now uses the same declared Prompt Syntax surface as every project tab:
 <ps @agency:items.retire(id: "<item id>")>
 ```
 
-The `<ps ...>` line is the authority. Prose, quoted material, fenced examples,
-and URLs outside one of those lines are inert. Each directive ends in a receipt
-on the next turn, including typed failures for an unknown or ambiguous id.
+The `<ps ...>` line is the authority and is visually marked in the transcript.
+Prose, quoted material, fenced examples, and URLs outside one of those lines are
+inert. Each authored line ends in a receipt on the next turn, including typed
+failures for an unknown verb, malformed arguments, or an unknown or ambiguous
+id. A malformed authored line therefore cannot disappear as unexplained raw
+text.
 
 The Task Manager keeps one context-specific capability from the old contract.
 An explicit `items.add(project: ...)` that names no existing project creates a
@@ -64,7 +67,9 @@ Ordinary project conversations use the same directives. The prompt supplies
 the current ids and the declared closed verb set:
 
 - `items.add` creates a row. Its `ref` is a temporary handle echoed beside the
-  real id in the next-turn receipt.
+  real id in the next-turn receipt. Repeating one uniquely matching title
+  returns that stable id and applies the requested status; legacy duplicate
+  titles are refused as ambiguous rather than choosing one.
 - `items.state` moves an existing id through `new`, `planning`, `active`,
   `questions`, or `shipped`.
 - `items.retire` removes exactly the named id.
@@ -157,9 +162,9 @@ All built, on Home:
 
 ## Working directories, and asking instead of denying
 
-The runs go out as `ask` — `Permission::Edit` plus `Request::approvals()`
-(agent-abstraction 0.3.4). A gated call — a write, a command, a read outside
-the working tree — arrives as an approval card on Home and the run waits,
+The permission posture is selected in Settings. `Ask` is `Permission::Edit`
+plus `Request::approvals()`: a gated call (a write, a command, or a read outside
+the working tree) arrives as an approval card on Home and the run waits,
 mid-turn, until Allow or Deny; an abandoned question becomes a denial after 30
 minutes. It cannot be ReadOnly underneath: that posture strips the mutating
 tools, so nothing would ever ask, and the crate refuses the combination.
@@ -170,9 +175,11 @@ input; and silence is not proof nothing ran — Claude allows read-only commands
 without asking.
 
 `GlobalSettings.taskManager.dirs` still matters: the first entry becomes the
-run's cwd, and everything inside it runs unasked. Point it at the tree the
-task manager usually reads so approvals stay rare. One directory of reach for
-now — the crate has no `--add-dir` passthrough yet, so additional entries are
-stored but only the first takes effect until it grows one.
+run's cwd and every later entry is sent as another declared working root. Add
+every repository the Task Manager normally works across so permission requests
+stay rare. For Codex, a request for an undeclared write root names the exact
+path set in its approval card; a remembered answer applies only to that same
+set. Adding the path here is the persistent way to make it available from the
+start of later runs.
 
 `crates/wt-tools` is built too: the agent can see its own projects.