docs: qualify BAA copy to decided position; broaden PHI to PHI/PII

docs/concepts/deployment-matrix.md

@@ -47,7 +47,7 @@ will remain sanitized; a real EMR can display PHI as soon as replay begins.
 | Existing raw authoring artifact | Refuse generic remote upload. | Keep within customer policy. | Local. |
 | Explicit hosted-recorder observations | Allow only for a public-HTTPS, non-regulated session inside the declared hosted recording boundary. | Keep within customer policy. | Local. |
 | Approved sanitized derivative | Allow when manifest, hash, review, and destination pass. | Allow to a verified customer endpoint when policy permits. | Local or explicitly exported. |
-| PHI-bearing runtime frame | Outside the shared hosted boundary unless a specific regulated service is configured. | Remains inside customer boundary. | Remains local. |
+| PHI/PII-bearing runtime frame | Outside the shared hosted boundary unless a specific regulated service is configured. | Remains inside customer boundary. | Remains local. |
 | Minimized control metadata | Allow by schema and destination policy. | Allow by schema and destination policy. | Optional/no egress. |
 | Secret value | Never browser-visible or serialized into enqueue payloads. | Resolve inside customer runner. | Resolve locally. |
 
@@ -56,7 +56,7 @@ will remain sanitized; a real EMR can display PHI as soon as replay begins.
 “Scrubbed” means the source was inventoried, a separate copy was transformed,
 the result was rescanned, unresolved content was refused, and a manifest binds
 the policy and approval to the exact derivative hash. It does not mean the
-source was modified or that every future run is PHI-free.
+source was modified or that every future run is PHI/PII-free.
 
 It also does not mean a transformed recording remains runnable. Register the
 approved recording derivative, compile/lint/certify/replay locally, then
@@ -115,8 +115,8 @@ not create a price, quota, SLA, certification, or backend entitlement.
 ## Customer-controlled regulated execution
 
 Use a customer-controlled boundary when a live workflow necessarily displays
-PHI or other regulated data. Sanitized authoring derivatives and minimized
-metadata may cross approved endpoints; PHI-bearing live frames and values stay
+PHI/PII or other regulated data. Sanitized authoring derivatives and minimized
+metadata may cross approved endpoints; PHI/PII-bearing live frames and values stay
 inside the boundary.
 
 A deployment scope must name:

docs/concepts/regulated-execution.md

@@ -84,7 +84,7 @@ The pre-flight gate is the entry check; the same posture governs every step:
   proceeding on a "Saved" banner.
 - An ambiguous identity abstains up the ladder and halts if nothing verifies.
 - A missing scrubbing capability, under `OPENADAPT_FLOW_SCRUB=on`, aborts rather
-  than writing PHI at all.
+  than writing PHI/PII at all.
 
 A halt is not a dead end. It feeds the [halt-learn loop](halt-learn-loop.md),
 where an operator demonstrates the fix, a regression gate proves it weakens

docs/concepts/vlm-appliance.md

@@ -55,7 +55,7 @@ record instead of the screen.
 
 ## Why on-prem matters
 
-Identity crops and full frames can carry PHI. The control is not redaction (the
+Identity crops and full frames can carry PHI/PII. The control is not redaction (the
 identity check needs the literal identifier), it is deployment. The appliance is
 designed to run on your infrastructure with no external model calls or payload
 persistence. Enforce and test its network and retention policy for the actual

docs/desktop/connect-to-cloud.md

@@ -7,8 +7,8 @@ covers the path: sign in → mint an ingest token → connect the desktop app 
 a recording → see it in the dashboard.
 
 !!! note "Which lane are you in?"
-    The cloud workspace is the **self-serve, non-PHI lane**: browser/web
-    automation with no regulated data. For **PHI or other regulated data**, do
+    The cloud workspace is the **self-serve, non-PHI/PII lane**: browser/web
+    automation with no regulated data. For **PHI/PII or other regulated data**, do
     **not** push to the cloud; use the
     [on-prem deployment](../guides/deploy-on-prem.md) instead, where recordings
     and teaching never leave your network. See
@@ -102,9 +102,9 @@ The recording directory is zipped before upload (the server ingests a `.zip`; th
 engine emits a directory). You can also push an already-compiled bundle with
 `--kind bundle`. See [`push`](../reference/cli.md#push).
 
-!!! warning "Push scrubs, but the cloud lane is for non-PHI work"
+!!! warning "Push scrubs, but the cloud lane is for non-PHI/PII work"
     A pre-push scrub runs fail-closed and the server re-scans on ingest, but the
-    cloud lane is **not** the PHI lane. Keep regulated recordings local and use
+    cloud lane is **not** the PHI/PII lane. Keep regulated recordings local and use
     [on-prem](../guides/deploy-on-prem.md).
 
 ## 5. See it in the dashboard
@@ -115,7 +115,7 @@ runnable; any run that halts surfaces under **Needs attention** for triage.
 
 ## Reporting a halt back to the workspace
 
-When a governed run halts locally, send a **PHI-free** break descriptor to the
+When a governed run halts locally, send a **PHI/PII-free** break descriptor to the
 workspace so the halt is visible centrally, without the recording ever leaving
 the machine:
 

docs/get-started/what-works-today.md

@@ -60,14 +60,14 @@ it carries consequential work.
 | Citrix / VDI backend | **Exploratory** | The pixel-first mechanism (the same remote-display adapter, identity gate, and effect verification as every substrate) is implemented, but no real Citrix ICA/HDX environment has been qualified yet. | Each Citrix/VDI workflow must be qualified in its real ICA/HDX environment, where the client, latency, compression, DPI, lock-screen, input, identity, and effect behavior are exercised against the actual application, before it carries consequential work. |
 | Desktop authoring GUI and tray | **Supported** | The published 0.1.1 prerelease provides install/uninstall-qualified native packages across the six targeted platform/architecture variants. | The current prerelease qualifies packaging and removal; the complete record -> compile -> replay -> teach cockpit remains an integration track. |
 | Hosted CLI connectivity | **Supported / public offer** | `login`, exact-hash artifact preparation/upload, one-time runtime validation, bound replacement activation, and `report-break` connect the local engine to the live control plane. | Upload requires destination policy and an approved sanitized derivative; checkout never bypasses an egress refusal. |
-| Artifact sanitation and local review | **Supported / launch gate** | The sanitized-derivative pipeline inventories, transforms, rescans, manifests, hashes, and supports local review/approval. | The raw original remains sensitive; unknown or unresolved content is refused; runtime observations can reintroduce PHI. |
+| Artifact sanitation and local review | **Supported / launch gate** | The sanitized-derivative pipeline inventories, transforms, rescans, manifests, hashes, and supports local review/approval. | The raw original remains sensitive; unknown or unresolved content is refused; runtime observations can reintroduce PHI/PII. |
 | Cross-engine hosted validation | **Supported / launch gate** | `validate-hosted` binds an approved recording and bundle, compiler provenance, strict lint, policy certification, derived risk class, and successful replay report to a one-time Cloud challenge. | It is operator self-attestation signed with the ingest token, not an independently observed certification. Exact deployment policy, risk-class, and deployed compiler-version allowlists still apply. |
 | Hosted browser recorder and runtime health | **Supported / bounded launch component** | A non-simulated hosted browser session on `openadapt-flow` 1.8.0 produced PNG frames and retained input evidence, assembled a compileable recording, finalized one workflow idempotently, enforced resource limits, and cleaned up ephemeral qualification data. Authenticated live health probes also qualified the exact-version replay and compiler service identities. | Explicitly initiated, public-HTTPS, non-regulated authoring only. Raw observations remain private inside the declared hosted boundary. Health proves deployed service identity and reachability, not a paid checkout-to-run lifecycle or successful managed replay. |
 | Hosted dashboard/control plane | **Supported / public offer** | Authentication, organizations, exact-hash bundle ingest, immutable run admission, browser runner orchestration, structural reports, replacement activation, billing, and metering form the managed lifecycle. | Production uses live dependencies and fails unavailable rather than substituting mock behavior. |
 | Hosted execution | **Supported / public offer** | Live Stripe Checkout connects onboarding and subscription entitlements to managed browser execution; the runner verifies exact admitted bundle bytes and authenticated callbacks. | The public subscription covers approved browser workflows. Other substrates use separately scoped deployments and commercial terms. Checkout does not create an SLA or certification. |
 | Air-gapped on-prem package | **Supported** | A local queue, systemd unit, minimized hash-chained audit log, and air-gap checks are provided. | Full-disk encryption and operational hardening remain operator/deployment responsibilities. |
-| Control-plane-managed customer cloud (BYOC) | **Experimental** | An outbound-connector pull queue, per-connector authentication, and a customer-owned storage handoff are implemented, but the lane is disabled on the live hosted path and no connector transport ships in the engine yet. | Qualify the actual substrate and destination; PHI-bearing runtime data must not cross into a shared boundary. |
-| Hosted desktop runner (in OpenAdapt's cloud) | **Internal only** | A Windows-in-cloud runner and its enqueue/callback contract are implemented, but the lane is licensing-gated and a fail-closed flag restricts it to an internal allowlist. | This lane is not part of any public commercial offer. Hosted in-our-cloud desktop, RDP, and Citrix execution is not sold today; those substrates run self-hosted or on-prem in the customer boundary, with control-plane-managed BYOC as an Experimental lane, and are scoped separately from the public browser offer and qualified per workflow. Multi-tenant hosting of the desktop substrate in OpenAdapt's cloud is deferred. |
+| BYOC / customer-controlled execution | **Supported / scoped deployment** | A connector and customer-storage contract support keeping the data plane inside an approved customer boundary. | Qualify the actual substrate and destination; PHI/PII-bearing runtime data must not cross into a shared boundary. |
+| Hosted desktop runner | **Supported** | A Windows runner contract and implementation path exist. | Desktop subscriptions and deployments are scoped separately from the public browser offer and qualified per workflow. |
 
 ## Before using consequential data
 
@@ -79,7 +79,7 @@ Treat the matrix as a starting point, not an authorization. For each workflow:
    record exists.
 4. Certify against a workload-specific policy.
 5. Exercise expected drift and failure cases with repeated trials.
-6. Review the PHI boundary, storage encryption, logs, model egress, updates,
+6. Review the PHI/PII boundary, storage encryption, logs, model egress, updates,
    rollback, and operator approval design.
 7. If an artifact crosses a boundary, inspect its sanitation manifest and
    approve the exact derivative hash required by policy.

docs/get-started/what-you-get.md

@@ -47,7 +47,7 @@ openadapt flow emit-mcp   bundle --out server.py
 
 ## Privacy of the artifacts
 
-The `REPORT.md` and console logs can be processed by the PHI sanitizer on the
+The `REPORT.md` and console logs can be processed by the PHI/PII sanitizer on the
 persist/log path (Presidio-backed, via the optional `privacy` extra). The
 compiled bundle and `report.json` keep literal identifiers on purpose: they are
 the identity check and the audit trail, protected by a documented boundary