Entry gains Only/Never fields for per-machine targeting. Machine identity = short hostname + os:<GOOS> + arch:<GOARCH> + tag:<name>. Tags stored in local <repo>/tags file (added to .gitignore by init). EntryApplies() matching: only=any-match, never=no-match, both=error. 13 tests covering matching, identity, tags CRUD, gitignore. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>