Use saved state terminology across the repository

.agents/architect.md

@@ -248,7 +248,7 @@ requirements.
 A finding has a **structural consequence** only when it changes one or more of:
 
 - what is authorized to execute;
-- which durable identity or retained history is accepted;
+- which durable identity or saved history is accepted;
 - what durable state is committed, published, or journaled;
 - whether replay can resume the intended run;
 - ownership of a transaction, resource, invocation, or lifecycle;

.agents/issue-writing.md

@@ -116,7 +116,7 @@ not a summary of the implementation plan.
     only when both are accurate. If one reading promises different behavior,
     make the object or relationship explicit.
 16. **Use observable language for durable concepts.** Prefer “run and resume” or
-    another consequence over “retained” when storage is not necessary to
+    another consequence over “saved” when storage is not necessary to
     distinguish the work.
 17. **Use code formatting for literal product names.** Commands, components,
     props, and extensions use their authored spelling. Ordinary concepts remain
@@ -176,7 +176,7 @@ evidence rather than the transcript of how the design was discovered.
    the contract. Say **a** for an ordinary instance and **one** only when exact
    cardinality matters.
 8. **Describe workflow behavior through actions.** Prefer start, interrupt,
-   resume, fork, export, and **workflow run** over the adjective **retained**
+   resume, fork, export, and **workflow run** over the adjective **saved**
    when persistence is only an implementation consequence. Use retain or
    preserve when storage itself is the contract.
 9. **Define the relevant alternative.** A qualifier such as in-process,
@@ -317,7 +317,7 @@ Present exactly five things:
    or wording judgment, or ask for approval when none remains.
 
 Do not move to the next issue until the reader answers. Apply an accepted change
-immediately and verify the exact title, body, and labels GitHub retained. Apply
+immediately and verify the exact title, body, and labels GitHub saved. Apply
 an accepted Quest classification to both the `Quest:` prefix and `quest` label.
 Keep a visible count of completed entries.
 

.github/workflows/ci.yml

@@ -228,7 +228,7 @@ jobs:
       - name: The <Plan> Component the compiled binary carries
         run: deno test --allow-all --frozen scripts/tests/plan-component-compiled.test.ts
 
-      # The entry host a REPL entry's file work is retained by is assembled by
+      # The entry host a REPL entry's file work is saved by is assembled by
       # `compiled.ts`, which is a different entrypoint from the one the source
       # row runs. A binary built without it starts a REPL, performs the work and
       # retains none of it, so the defect would appear at a person's first
@@ -258,7 +258,7 @@ jobs:
       # Fetch adapter, and detaches the response before binding it. All three
       # live in the module graph, so only the binary shows they survived
       # `deno compile`. The script owns the server the request reaches.
-      - name: Smoke test a retained HTTP read with the compiled binary
+      - name: Smoke test a saved HTTP read with the compiled binary
         run: deno run --allow-all --frozen scripts/smoke-fetch.ts
 
       # A built-in resolves from the module graph rather than a search path.

AGENTS.md

@@ -666,7 +666,7 @@ An architecture finding has a **structural consequence** only when it changes
 one or more of:
 
 - what is authorized to execute;
-- which durable identity or retained history is accepted;
+- which durable identity or saved history is accepted;
 - what durable state is committed, published, or journaled;
 - whether replay can resume the intended run;
 - ownership of a transaction, resource, invocation, or lifecycle;

packages/acp/mod.ts

@@ -81,8 +81,8 @@ export type {
  * ACPX's persistent session store, for a host arranging its own retention. The
  * provider takes one; this is how a host builds and reads the one it takes.
  */
-export { createAcpxSessionStore, retainedSession } from "./src/session-store.ts";
-export type { AcpxRetainedSession, AcpxSessionStore } from "./src/session-store.ts";
+export { createAcpxSessionStore, savedSession } from "./src/session-store.ts";
+export type { AcpxSavedSession, AcpxSessionStore } from "./src/session-store.ts";
 
 export {
   AcpxPartitionError,

packages/acp/src/ClaudeNativeToAcp.test.md

@@ -302,7 +302,7 @@ the launch, and nothing after it named a second.
 
 The route, the journal, the ACP client's own arrangement and the identity the
 launch reported all name the same conversation — and the build this run would
-use is the build the route retained.
+use is the build the route saved.
 
 <AssertEquals actual={proof.route.schema} expected={"session-route.v2"} />
 <AssertEquals actual={proof.route.kind} expected={"client-native"} />

packages/acp/src/CodexNativeLaunch.test.md

@@ -333,8 +333,8 @@ completion summary appears before the native UI opens.
 ## The turn was the exact one the contract names
 
 Its version, its bytes and its request identity are fixed by the product, not
-composed at the call site, and the retained preparation named the same request
-the retained turn later reported against.
+composed at the call site, and the saved preparation named the same request
+the saved turn later reported against.
 
 <AssertEquals actual={proof.materialization.promptVersion} expected={"codex-materialization.v1"} />
 <Assert expr={proof.materialization.promptExact} />

packages/acp/src/CodexZeroNativeTurnExit.test.md

@@ -308,8 +308,8 @@ completion summary appears before the native UI opens.
 ## The turn was the exact one the contract names
 
 Its version, its bytes and its request identity are fixed by the product, not
-composed at the call site, and the retained preparation named the same request
-the retained turn later reported against.
+composed at the call site, and the saved preparation named the same request
+the saved turn later reported against.
 
 <AssertEquals actual={proof.materialization.promptVersion} expected={"codex-materialization.v1"} />
 <Assert expr={proof.materialization.promptExact} />

packages/acp/src/adapter-snapshots.ts

@@ -5,7 +5,7 @@
  * and compiled distributions execute identical bytes.
  *
  * A snapshot materializes under its SHA-256. Durable identity is provider, package,
- * version and digest; the quoted host-local launch path is never retained in a
+ * version and digest; the quoted host-local launch path is never saved in a
  * session or sealed artifact.
  *
  * Stage privately, publish by one rename and verify the published tree before
@@ -136,7 +136,7 @@ export interface EmbeddedAdapters {
    * What this adapter *is*, independent of where this host put it.
    *
    * The durable half: provider, package, version and snapshot digest, and
-   * nothing about this machine. A retained Agent session records this and a
+   * nothing about this machine. A saved Agent session records this and a
    * sealed artifact carries it, so the same snapshot compares equal wherever it
    * was materialized.
    */
@@ -146,13 +146,13 @@ export interface EmbeddedAdapters {
    *
    * The path on its own, for a caller that needs to inspect or verify it rather
    * than launch it. Host-local like {@link EmbeddedAdapters.command}, and
-   * retained nowhere.
+   * saved nowhere.
    */
   executablePath(provider: string): string;
   /**
    * The command that launches one provider's embedded adapter here.
    *
-   * The host-local half, and never retained. Answers before the adapter is on
+   * The host-local half, and never saved. Answers before the adapter is on
    * disk, because the path is the snapshot's digest beneath a known root. The
    * path is quoted: a materialization root may contain a space, and an unquoted
    * command would split there.
@@ -640,7 +640,7 @@ export function createEmbeddedAdapters(
  * A closed registry was the wrong shape for the same reason. It made "this
  * build has no Codex snapshot problem to solve for Gemini" into "this build
  * refuses Gemini", which is a much broader restriction than the one being made,
- * and it would have changed the retained identity of agents the checkpoint work
+ * and it would have changed the saved identity of agents the checkpoint work
  * has nothing to say about.
  *
  * The overlay is *qualified*: an embedded provider never falls through. A

packages/acp/src/checkpoint.ts

@@ -19,7 +19,7 @@ interface RecognizedNamespace {
   readonly namespace: string;
   /** The member inside it that holds the identity. */
   readonly member: string;
-  /** How this provider names itself in a retained checkpoint. */
+  /** How this provider names itself in a saved checkpoint. */
   readonly provider: string;
   /** What kind of identity the value is. */
   readonly kind: string;

packages/acp/src/native-launch.ts

@@ -30,7 +30,7 @@ import type { IdentityProvenance } from "@executablemd/core";
  * same build. None of it reaches a document.
  */
 export interface NativeBinding {
-  /** The command whose build is observed, bound and retained. */
+  /** The command whose build is observed, bound and saved. */
   command: string;
   /** The arguments that ask that exact file its version. */
   versionArgs?: readonly string[];
@@ -71,10 +71,10 @@ export interface NativeBinding {
 /**
  * Claude reports `2.1.241 (Claude Code)`.
  *
- * The whole line is retained rather than the number alone, because the number
+ * The whole line is saved rather than the number alone, because the number
  * alone is not a build: the same version string from a different product would
  * compare equal. Anything that does not look like this is unrecognized, and an
- * unrecognized build is refused rather than retained under a guess.
+ * unrecognized build is refused rather than saved under a guess.
  *
  * Exactly one line may match. Zero is an output this adapter does not
  * recognize; two or more is output it cannot read as one answer, and taking
@@ -96,10 +96,10 @@ function claudeVersion(output: string): string | undefined {
  *
  * What is admitted is that shape, not that release: another canonical version
  * passes here. Exactness belongs to the session instead — the string accepted
- * here becomes its retained executable binding, and a later build that differs
+ * here becomes its saved executable binding, and a later build that differs
  * refuses against that binding rather than against a constant written down here.
  *
- * The product word is retained with the number for the same reason Claude's
+ * The product word is saved with the number for the same reason Claude's
  * whole line is: a bare semver from another tool compares equal. The one-line
  * rule is the same as well, and so is the silence about what did not match.
  */