diff --git a/CLAUDE.md b/CLAUDE.md
index c190a16..d8e3b37 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -75,7 +75,7 @@ auto-builds the GitHub Release notes by **grouping commit subjects** (`feat:` 
 `fix:` → Bug fixes, else → Other changes; `docs:`/`test:`/`chore:` excluded) plus a static
 install footer — there is **no `CHANGELOG.md`**. Use the right prefix so the changelog groups
 cleanly, and squash-merge PRs with a clean Conventional-Commit title. Full release playbook
-(versioning, tagging, dry-runs): `Releasing.md`.
+(versioning, tagging, dry-runs): `RELEASING.md`.
 
 ## Scope — don't add a `doctor`/health command
 
diff --git a/README.md b/README.md
index 1e2d0f4..2413fac 100644
--- a/README.md
+++ b/README.md
@@ -38,15 +38,23 @@ same `--json`).
 
 ```bash
 go install github.com/stozo04/speediance-cli/cmd/speediance-cli@latest
-speediance-cli login
 ```
 
 `go install` drops the binary in `$(go env GOPATH)/bin` — make sure that's on your `PATH`.
 
-Credentials via env vars (`SPEEDIANCE_EMAIL`, `SPEEDIANCE_PASSWORD`, `SPEEDIANCE_REGION`),
-a gitignored `config.json`, or a gitignored `.env` file in the working directory (auto-loaded;
-real exported env vars take precedence over it) — see `.env.example` / `config.example.json` and
-[AGENTS.md](AGENTS.md). SSO/Google accounts: set a password in the Speediance app once.
+Set credentials **before** your first command — `login` and every data command read
+them and exit with a config error if none are found. Provide them via env vars
+(`SPEEDIANCE_EMAIL`, `SPEEDIANCE_PASSWORD`, `SPEEDIANCE_REGION`), a gitignored `config.json`,
+a gitignored `.env` in the working directory (auto-loaded; real exported env vars take
+precedence), or `speediance-cli config set email|password …` (writes `config.json` at `0600`).
+SSO/Google accounts: set a password in the Speediance app once. See `.env.example` /
+`config.example.json` and [AGENTS.md](AGENTS.md).
+
+```bash
+export SPEEDIANCE_EMAIL="you@example.com"
+export SPEEDIANCE_PASSWORD="your-password"
+speediance-cli login   # verifies the credentials and caches a session token
+```
 
 ## Commands
 
@@ -126,7 +134,8 @@ GitHub Actions — no manual publish step needed.
   isn't synced across machines. Override with `SPEEDIANCE_TOKEN_CACHE` or the
   `token_cache_path` config key; `config path` shows where it resolved. An older
   `.token.json` in the working directory is migrated automatically on first run.
-- "Free Lift" (freestyle) sessions return totals only — no per-set detail. Programs do.
+- A *freestyle* "Free Lift" returns session totals only (no per-set detail); **programs
+  and guided free sessions (e.g. Aerobic Rowing) return full per-rep/per-interval detail.**
 - `library.json` is a committed **snapshot** of the exercise catalog for convenience;
   regenerate it anytime with `speediance-cli library`.
 - `main` is PR-protected; changes land via pull request.
diff --git a/SKILL.md b/SKILL.md
index af49d90..6dc5a2e 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -65,7 +65,11 @@ no app navigation mid-session.
 
 `speediance-cli` is a single static binary — **no Python or other runtime needed**.
 
-Install it one of two ways:
+Do these steps **in order**. Step 2 must come before step 3: `login` authenticates
+with the credentials you supply in step 2 and exits with a config error if neither
+the environment, a `.env`, nor `config.json` provides an email *and* password.
+
+**1. Install** — one of two ways:
 
 ```bash
 # A) Download a release binary for your OS/arch, extract, put it on your PATH:
@@ -75,10 +79,39 @@ Install it one of two ways:
 go install github.com/stozo04/speediance-cli/cmd/speediance-cli@latest
 ```
 
-Then authenticate:
+**2. Provide your credentials** — pick whichever fits how you run the tool
+(full reference in [Credentials](#credentials) below):
+
+```bash
+# A) Environment variables — best for CI / one-off shells:
+export SPEEDIANCE_EMAIL="you@example.com"
+export SPEEDIANCE_PASSWORD="your-password"
+
+# B) Or a gitignored .env in the working directory — recommended for OpenClaw /
+#    agent workspaces, since a headless agent can't answer an interactive prompt.
+#    Put this in <workspace>/.env:
+#      SPEEDIANCE_EMAIL=you@example.com
+#      SPEEDIANCE_PASSWORD=your-password
+
+# C) Or write them into config.json (created 0600, owner-only) without hand-editing:
+speediance-cli config set email "you@example.com"
+speediance-cli config set password "your-password"
+```
+
+> **Heads-up on option C:** a value passed on the command line is visible in your
+> shell history and process list. For interactive setup prefer A or B; if you use
+> C, clear the history entry afterward.
+
+**3. Authenticate** — verifies the credentials and caches a session token:
+
+```bash
+speediance-cli login   # run `speediance-cli config path` to see where the token is cached
+```
+
+**4. Read your data:**
 
 ```bash
-speediance-cli login   # authenticates and caches a session token (run `config path` to see where)
+speediance-cli today --json
 ```
 
 ## Credentials
@@ -221,7 +254,8 @@ Notes for consumers:
 - **Empty shape.** `info` is `object | null`; `detail` is `array | null`. These are
   the verbatim endpoint payloads (never normalized), so treat **both `null` and
   `[]`** as "no rows" — e.g. `if not detail`. In practice `detail` is a populated
-  array for `kind:"program"`, `[]` for `kind:"free"`, and `null` only for `kind:""`.
+  array for `kind:"program"`, `[]` for a freestyle Free Lift but a **populated array
+  for a guided free session** (e.g. Aerobic Rowing), and `null` only for `kind:""`.
 - **No flag unlocks data** — the endpoints return it, so the CLI returns it. There
   is no `--telemetry`.