@@ -46,12 +46,16 @@ workspace, then layers per-workspace **policy** on top:
 Bind, set policy, and unbind from the workspace agents page at
 **`/w/[slug]/settings/agents`**. The **catalog** there lists the
 profiles available to bind (ones you own, plus instance-shared ones)
-that aren't already bound. All three actions — `bind`, `setPolicy`,
-`unbind` — are workspace-admin-gated.
-
-::: tip Unbinding is non-destructive
-Unbinding archives the binding; runs, chats, and history are preserved.
-Re-binding the same profile reuses the archived row.
+that aren't already bound. The actions — `bind`, `setPolicy`, `unbind`,
+and `remove` — are workspace-admin-gated.
+
+::: tip Unbind vs Delete
+**Unbind** archives the binding (reversible) — runs, chats, and history are
+preserved, and re-binding the same profile reuses the archived row.
+**Delete** (the trash action beside Unbind) is a *smart remove*: it
+hard-deletes a genuinely unused agent (no runs, comments, keys, or
+assignments) and otherwise archives it — so a deletion can never cascade
+away an agent's run history.
 :::
 
 ## Tier 3 — Instance policy
@@ -65,6 +69,11 @@ Two governance levers belong to the instance admin (see
 - **`disabledAt`** — a force-disable. A disabled profile (and all its
   bindings) refuses dispatch and chat. Distinct from `archivedAt`
   (deletion).
+- **Remove** — Instance Admin → Agents has a **Remove** action
+  (`agents.profiles.remove`) beside Enable/Disable: it deletes a profile no
+  workspace has bound, and archives one that still has bindings (so those
+  agents aren't orphaned). Archived profiles drop out of the admin list and
+  the bind-catalog.
 
 ## Requesting a profile
 
 
@@ -136,9 +136,11 @@ Codex, container, and workspace versions from the runtime detail page.
 
 ## MCP tools (for runtimes that auto-register)
 
-`runtimes.register`, `runtimes.heartbeat`, and `runtimes.configure` are
-`ADMIN`-scoped. The `forge` CLI's `daemon start` calls register/heartbeat;
-operators can call configure to set runtime config without direct DB access.
+`runtimes.register`, `runtimes.heartbeat`, `runtimes.configure`, and
+`runtimes.archive` are `ADMIN`-scoped. The `forge` CLI's `daemon start` calls
+register/heartbeat; operators can call configure to set runtime config, or
+`runtimes.archive` (`forge runtimes archive <id>`) to deregister a runtime,
+without direct DB access.
 `runtimes.reportInfo` is agent-linked rather than admin-scoped so a runtime
 bootstrap key can report its own sanitized metadata without broad operator
 permissions.
 
@@ -14,7 +14,7 @@ wire format and auth path are identical for all kinds.
 |---|---|---|
 | `AGENT` | Linked to a specific agent via `linkedAgentId`. Permanent until revoked. | Hermes/runtime daemons, custom always-on bridges. |
 | `PERSONAL` | No agent link. Permanent until revoked. | Local Claude Code sessions, scripts, personal terminal access. |
-| `SESSION` | TTL-bounded via `expiresAt`. Auto-rejected after expiry. | Ephemeral Claude Code sessions, one-off Codex CLI runs. |
+| `SESSION` | TTL-bounded via `expiresAt`. Rejected at auth after expiry, then purged from the DB by an hourly sweep. | Ephemeral Claude Code sessions, one-off Codex CLI runs. |
 
 `kind` is inferred automatically when using `access.create`: if `linkedAgentId` is
 provided, kind defaults to `AGENT`; otherwise `PERSONAL`. To create a session key,
@@ -231,7 +231,9 @@ Three tRPC mutations create workspace keys:
 - **`access.createPersonal`** — shorthand for `kind: PERSONAL` with no agent
   link. Suitable for scripts and local dev access.
 - **`access.createSession`** — shorthand for `kind: SESSION` with a required
-  `ttlHours` (1–168, default 24). Auto-rejected after expiry.
+  `ttlHours` (1–168, default 24). Rejected at auth after expiry, and purged
+  from the DB by an hourly worker sweep so expired session keys don't
+  accumulate (PERSONAL/AGENT keys with an expiry are left for an admin).
 
 All three return `rawKey` in the response. Copy it immediately — the plaintext is
 shown exactly once and never stored.
 
@@ -25,6 +25,10 @@ The top-level identity panel.
   `agentIdleTimeoutMinutes`, `requiredAckSeconds`,
   `autoRedispatchOnStall`, `autoRedispatchOnNoack`,
   `slaEnforcementEnabled`.
+- **Ephemeral agent cleanup** — `ephemeralAgentIdleMinutes` (0 = off):
+  auto-archive an EPHEMERAL (session/CLI) agent that hasn't heartbeated for
+  this long, so abandoned session rows don't pile up. Reversible; PERSISTENT
+  agents (Hermes, etc.) are never touched.
 
 The full table of knobs lives in
 [Workspaces → Workspace knobs](/guide/workspaces.html).
 
@@ -470,7 +470,8 @@ the broader Runtime primitive.
 | `register` | Create (or restore) a Runtime row. `{ name, kind, endpoint?, providersAvailable, info? }`. `ownerId` is set from the calling key's `userId`; AGENT-kind keys leave it null. |
 | `heartbeat` | Bump `Runtime.heartbeatAt`. `{ runtimeId, info? }`. Optional `info` updates sanitized runtime version/environment metadata. |
 | `list` | List workspace runtimes. `{ kind?, includeArchived? = false }` → mirror of `trpc.runtime.list` shape, includes `_count: { agents }` + `owner` summary. Secrets are redacted to `hasSecret`. |
-| `configure` | Update adapter config. `{ runtimeId, config, merge? = true }`. Hermes accepts `localWorkspaceTools`, `toolCapabilities`, `workspaceRoot`, and `modeToolPolicyEnforced`; Codex app-server also accepts sandbox/approval config. |
+| `configure` | Update adapter config. `{ runtimeId, config, merge? = true }`. Hermes accepts `localWorkspaceTools`, `toolCapabilities`, `workspaceRoot`, and `modeToolPolicyEnforced`; Codex app-server also accepts sandbox/approval config. Scope `ADMIN`. |
+| `archive` | Deregister (archive) a runtime — `{ runtimeId }` sets `archivedAt`, so it drops out of `list` (unless `includeArchived`). The teardown counterpart of `register`; exposed as `forge runtimes archive <id>`. Scope `ADMIN`. |
 | `reportInfo` | Agent-linked runtime metadata report. `{ runtimeId?, info }`; omitted `runtimeId` resolves to the calling agent's attached Runtime. Stores a sanitized whitelist such as `runtimeVersion`, `bridgeVersion`, `codexVersion`, `containerImage`, `hostname`, `os`, `arch`, and `workspaceRoot`. |
 
 **`register`** is intentionally not deduping server-side — the CLI caches
@@ -484,6 +485,7 @@ heartbeat returns a missing-row error.
 
 | Tool | Summary |
 |---|---|
+| `open` | Open (or resume) a tracked run on an issue **you** are working — `{ issueId, summary?, mode? }`. Requires an agent-linked key; the run belongs to the key's `linkedAgentId`. Resumes an existing ACTIVE/WAITING run for the `(issue, agent)` pair instead of stacking a duplicate, and stamps a STARTED event so it shows in Mission Control. Lets an agent (e.g. a local CLI session) proactively self-report work rather than only getting a run as a dispatch side-effect. Issue-anchored; drive it afterward with `recordUsage` / `setWaiting` / `complete`. Scope `WRITE_ISSUES`. |
 | `recordUsage` | Update token + cost columns on an `AgentRun`. `{ runId, tokensIn?, tokensOut?, tokensCached?, costUsd? }`. Idempotent — latest call replaces (cumulative as reported by the agent). |
 | `complete` | Close an active/waiting run. `{ runId, summary, producedArtifactIds?, verificationResult?, followUps?, confidence?, verdict? }`. Requires an agent-linked key matching the run. Execute enforces issue artifact/checklist gates; Research requires `confidence`; Review requires `verdict`; Discuss is reply-only. Stores `completionMeta` with the Forge run contract version. |
 | `setWaiting` / `resumeWork` | Mark a run blocked on the operator, or resume it. Requires an agent-linked key matching the run. |
 
@@ -94,19 +94,28 @@ On start the daemon:
   there's no `statuses.list` MCP tool to discover the workspace's
   category-mapped started status.
 
-## Read-only commands
+## Commands
 
 ```bash
+# Read-only
 forge runtimes list                  # via runtimes.list MCP; --json, --archived
-forge runtimes configure <id> \
-  --local-workspace-tools \
-  --tool terminal --tool filesystem --tool git \
-  --workspace-root /home/bailey/forge
 forge agents list                    # workspace bindings via agents.list; --json, --archived, --runtime <id>
 forge agents list --global           # global AgentProfile defs via agents.profiles.list; --mine, --json, --archived
 forge issues list                    # most recent 25 issues
 forge issues list --mine             # issues assigned to your linked agent
-forge issue assign AXI-42 victor
+
+# Runtime config / teardown (ADMIN)
+forge runtimes configure <id> \
+  --local-workspace-tools \
+  --tool terminal --tool filesystem --tool git \
+  --workspace-root /home/bailey/forge
+forge runtimes archive <id>          # deregister (archive) a runtime via runtimes.archive
+
+# Work
+forge issue assign AXI-42 victor     # assign an existing issue to an agent
+forge task "Add a wake-word toggle" --agent victor   # create an issue AND dispatch it
+forge task "Fix the flaky sprint test"               # no --agent → queue for auto-dispatch
+#   task also accepts --project <id>, --priority NONE|LOW|MEDIUM|HIGH|URGENT, --title "<title>"
 ```
 
 ## Provider matrix