@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.10 → 0.1.12

package/bin/reconcile

@@ -44,7 +44,7 @@ if [[ -z "${RECONCILE_REEXEC_BASH:-}" ]]; then
       export RECONCILE_REEXEC_BASH=1
       exec "$reconcile_newer_bash" "$0" "$@"
     fi
-    echo "bin/reconcile requires bash >= 4.4 (this run is bash ${BASH_VERSION:-unknown} -- empty-array expansions are unsafe under set -u before 4.4). No newer bash was found at: $reconcile_bash_candidates. Install one (e.g. 'brew install bash') and re-run, or put a newer bash earlier on PATH -- refusing to start rather than risk an 'unbound variable' abort mid-run after state has already changed." >&2
+    echo "ERROR bin/reconcile requires bash >= 4.4 (this run is bash ${BASH_VERSION:-unknown} -- empty-array expansions are unsafe under set -u before 4.4). No newer bash was found at: $reconcile_bash_candidates. Install one (e.g. 'brew install bash') and re-run, or put a newer bash earlier on PATH -- refusing to start rather than risk an 'unbound variable' abort mid-run after state has already changed." >&2
     exit 1
   fi
 fi
@@ -54,7 +54,7 @@ set -euo pipefail
 export PATH="/usr/local/bin:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
 
 usage() {
-  echo "usage: reconcile --device NAME [--source npm|checkout] [--mode audit|plan|apply] [--manifest PATH] [--state-dir PATH] [--platform mac|linux]" >&2
+  echo "ERROR usage: reconcile --device NAME [--source npm|checkout] [--mode audit|plan|apply] [--manifest PATH] [--state-dir PATH] [--platform mac|linux]" >&2
   exit 2
 }
 
@@ -68,8 +68,9 @@ source_mode="npm"
 # remove_one_repo_dir themselves, so packages/fleet/tests/test-manifest.sh
 # can point it at a disposable test_root directory (RECONCILE_SOURCE_ONLY=1)
 # and exercise the real sync/removal mechanics without root or a real
-# /usr/local. Matches packages/fleet/src/launch-agents.ts's
-# DEFAULT_LIBEXEC_DIR in production.
+# /usr/local. The production value is the libexec dir the apps/cli
+# commands (repo-controls, skills, hooks, settings) resolve the projected
+# payload from.
 repo_dir_libexec_root="/usr/local/libexec/adl"
 # Test-only escape hatch for default-agent-file.ts / managed-settings.ts's own
 # `--root` (both already accept it; see their headers). Unset in every real
@@ -225,11 +226,11 @@ source "$script_dir/lib/bun-compile-build.sh"
 "$script_dir/validate-manifest" "$manifest" >/dev/null
 if [[ "${RECONCILE_SOURCE_ONLY:-0}" != "1" ]]; then
   if [[ "$source_mode" == npm && -e "$repo_root/.git" ]]; then
-    echo "npm source mode requires an installed package root; use --source checkout for a Git checkout" >&2
+    echo "ERROR npm source mode requires an installed package root; use --source checkout for a Git checkout" >&2
     exit 2
   fi
   if [[ "$source_mode" == checkout && ! -e "$repo_root/.git" ]]; then
-    echo "checkout source mode requires a Git checkout" >&2
+    echo "ERROR checkout source mode requires a Git checkout" >&2
     exit 2
   fi
 fi
@@ -237,7 +238,7 @@ fi
 case "$(uname -s)" in
   Darwin) platform=mac; sha256_cmd=(shasum -a 256) ;;
   Linux) platform=linux; sha256_cmd=(sha256sum) ;;
-  *) echo "unsupported operating system: $(uname -s)" >&2; exit 1 ;;
+  *) echo "ERROR unsupported operating system: $(uname -s)" >&2; exit 1 ;;
 esac
 if [[ -n "$platform_override" ]]; then
   # Applying as a foreign platform would install the wrong platform's tools, so
@@ -248,7 +249,7 @@ if [[ -n "$platform_override" ]]; then
   # agents of the mixed CI pool it dies with "device m3 is not declared under
   # linux" (build 4226).
   if [[ "$mode" == apply && "${RECONCILE_SOURCE_ONLY:-0}" != "1" ]]; then
-    echo "--platform cannot override the host in apply mode" >&2
+    echo "ERROR --platform cannot override the host in apply mode" >&2
     exit 2
   fi
   [[ "$platform_override" == mac || "$platform_override" == linux ]] || usage
@@ -256,7 +257,7 @@ if [[ -n "$platform_override" ]]; then
 fi
 
 jq -e --arg platform "$platform" --arg device "$device" '.[$platform].devices[$device]' "$manifest" >/dev/null || {
-  echo "device $device is not declared under $platform" >&2
+  echo "ERROR device $device is not declared under $platform" >&2
   exit 1
 }
 
@@ -292,7 +293,7 @@ path_owner() {
   elif owner="$(stat -c '%U' "$path" 2>/dev/null)"; then
     printf '%s\n' "$owner"
   else
-    echo "cannot determine owner of Homebrew prefix: $path" >&2
+    echo "ERROR cannot determine owner of Homebrew prefix: $path" >&2
     return 1
   fi
 }
@@ -305,7 +306,7 @@ resolve_brew_owner() {
   fi
   if [[ ! -d "$prefix" ]]; then
     if [[ "$target_mode" == apply ]]; then
-      echo "Homebrew prefix missing: $prefix" >&2
+      echo "ERROR Homebrew prefix missing: $prefix" >&2
       return 1
     fi
     printf '%s\n' '<unresolved-linuxbrew-owner>'
@@ -313,7 +314,7 @@ resolve_brew_owner() {
   fi
   owner="$(path_owner "$prefix")" || return 1
   if [[ "$owner" == root ]]; then
-    echo "Homebrew prefix must be owned by a non-root account: $prefix" >&2
+    echo "ERROR Homebrew prefix must be owned by a non-root account: $prefix" >&2
     return 1
   fi
   printf '%s\n' "$owner"
@@ -329,7 +330,7 @@ run_brew() {
     printf '\n'
     return 0
   fi
-  [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
+  [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
   (cd /tmp && sudo -u "$brew_owner" -H env NONINTERACTIVE=1 PATH="${brew_bin%/*}:/usr/bin:/bin" "$brew_bin" "$@" </dev/null)
 }
 
@@ -395,14 +396,14 @@ run_brew_upgrade_all() {
     echo "would run: brew upgrade (all outdated formulae and casks)"
     return 0
   fi
-  [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
+  [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
   local outdated_formulae outdated_casks formulae_count casks_count
   outdated_formulae="$(brew_query outdated --formula --quiet)" || {
-    echo "brew outdated --formula check failed" >&2
+    echo "ERROR brew outdated --formula check failed" >&2
     return 1
   }
   outdated_casks="$(brew_query outdated --cask --quiet)" || {
-    echo "brew outdated --cask check failed" >&2
+    echo "ERROR brew outdated --cask check failed" >&2
     return 1
   }
   formulae_count=0
@@ -422,10 +423,10 @@ run_brew_upgrade_all() {
   echo "brew upgrade: $formulae_count formulae, $casks_count casks outdated; upgrading (timeout ${BREW_UPGRADE_ALL_TIMEOUT_SECONDS}s)"
   run_with_timeout "$BREW_UPGRADE_ALL_TIMEOUT_SECONDS" run_brew upgrade 2>&1 || upgrade_status=$?
   if [[ "$upgrade_status" -eq 124 ]]; then
-    echo "brew upgrade timed out after ${BREW_UPGRADE_ALL_TIMEOUT_SECONDS}s" >&2
+    echo "ERROR brew upgrade timed out after ${BREW_UPGRADE_ALL_TIMEOUT_SECONDS}s" >&2
     return 1
   elif [[ "$upgrade_status" -ne 0 ]]; then
-    echo "brew upgrade failed (exit $upgrade_status)" >&2
+    echo "ERROR brew upgrade failed (exit $upgrade_status)" >&2
     return 1
   fi
   echo "brew upgrade: $formulae_count formulae, $casks_count casks were outdated before upgrade"
@@ -439,7 +440,7 @@ run_apt() {
     printf '\n'
     return 0
   fi
-  [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
+  [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
   env DEBIAN_FRONTEND=noninteractive apt-get "$@" </dev/null
 }
 
@@ -454,7 +455,7 @@ run_npm() {
     printf '\n'
     return 0
   fi
-  [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
+  [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
   if [[ "$platform" == linux ]]; then
     (cd /tmp && sudo -u "$administrator" -H env npm_config_prefix=/usr/local PATH="${brew_bin%/*}:/usr/bin:/bin" npm "$@" </dev/null)
   else
@@ -538,12 +539,12 @@ canonical_parent_path() {
 npm_package_owns_executable() {
   local package="$1" executable="$2" npm_root package_manifest bin_relative actual_path actual_link expected_target actual_target
   npm_root="$(npm_global_root)" || {
-    echo "could not resolve npm global root for $package" >&2
+    echo "ERROR could not resolve npm global root for $package" >&2
     return 1
   }
   package_manifest="$npm_root/$package/package.json"
   [[ -f "$package_manifest" ]] || {
-    echo "npm package metadata missing: $package_manifest" >&2
+    echo "ERROR npm package metadata missing: $package_manifest" >&2
     return 1
   }
   bin_relative="$(jq -r --arg executable "$executable" '
@@ -553,20 +554,20 @@ npm_package_owns_executable() {
     end
   ' "$package_manifest")"
   [[ -n "$bin_relative" && "$bin_relative" != /* && "$bin_relative" != .. && "$bin_relative" != ../* && "$bin_relative" != */../* && "$bin_relative" != */.. ]] || {
-    echo "npm package $package does not declare a safe bin target for $executable" >&2
+    echo "ERROR npm package $package does not declare a safe bin target for $executable" >&2
     return 1
   }
   actual_path="$(npm_global_executable_path "$executable")" || {
-    echo "npm executable missing from global PATH: $executable" >&2
+    echo "ERROR npm executable missing from global PATH: $executable" >&2
     return 1
   }
   [[ -L "$actual_path" ]] || {
-    echo "npm executable is not an npm-managed symlink: $actual_path" >&2
+    echo "ERROR npm executable is not an npm-managed symlink: $actual_path" >&2
     return 1
   }
   expected_target="$(canonical_parent_path "$npm_root/$package/$bin_relative")" || return 1
   [[ -f "$expected_target" && -x "$expected_target" ]] || {
-    echo "npm package $package bin target is not an executable file: $expected_target" >&2
+    echo "ERROR npm package $package bin target is not an executable file: $expected_target" >&2
     return 1
   }
   actual_link="$(readlink "$actual_path")" || return 1
@@ -576,7 +577,7 @@ npm_package_owns_executable() {
     actual_target="$(canonical_parent_path "${actual_path%/*}/$actual_link")" || return 1
   fi
   [[ "$actual_target" == "$expected_target" ]] || {
-    echo "npm executable $executable is not owned by $package" >&2
+    echo "ERROR npm executable $executable is not owned by $package" >&2
     return 1
   }
 }
@@ -588,21 +589,21 @@ run_pip() {
     printf '\n'
     return 0
   fi
-  [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
+  [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
   (cd /tmp && sudo -u "$administrator" -H env PATH="${brew_bin%/*}:/usr/bin:/bin" python3 -m pip "$@" </dev/null)
 }
 
 pip_user_executable() {
   local executable="$1"
   [[ "$executable" != */* ]] || {
-    echo "pip executable must be a command name, not a path: $executable" >&2
+    echo "ERROR pip executable must be a command name, not a path: $executable" >&2
     exit 1
   }
   local user_base user_home
   user_home="$(cd /tmp && sudo -u "$administrator" -H /bin/sh -c 'printf "%s\n" "$HOME"')"
   user_base="$(cd /tmp && sudo -u "$administrator" -H env PATH="${brew_bin%/*}:/usr/bin:/bin" python3 -m site --user-base)"
   [[ "$user_base" == "$user_home" || "$user_base" == "$user_home"/* ]] || {
-    echo "pip user base is outside the declared administrator home: $user_base" >&2
+    echo "ERROR pip user base is outside the declared administrator home: $user_base" >&2
     exit 1
   }
   printf '%s/bin/%s\n' "${user_base%/}" "$executable"
@@ -615,11 +616,11 @@ ensure_global_pip_executable() {
     echo "would expose pip executable globally: $target"
     return 0
   fi
-  [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
+  [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
   local source existing_source user_home
   source="$(pip_user_executable "$executable")"
   user_home="$(cd /tmp && sudo -u "$administrator" -H /bin/sh -c 'printf "%s\n" "$HOME"')"
-  [[ -x "$source" ]] || { echo "pip executable missing after install: $source" >&2; exit 1; }
+  [[ -x "$source" ]] || { echo "ERROR pip executable missing after install: $source" >&2; exit 1; }
   if [[ -L "$target" ]]; then
     existing_source="$(readlink "$target")"
     if [[ "$existing_source" == "$source" ]]; then
@@ -628,10 +629,10 @@ ensure_global_pip_executable() {
     fi
     case "$existing_source" in
       "$user_home"/*/bin/"$executable") ;;
-      *) echo "refusing to replace unrelated symlink: $target -> $existing_source" >&2; exit 1 ;;
+      *) echo "ERROR refusing to replace unrelated symlink: $target -> $existing_source" >&2; exit 1 ;;
     esac
   elif [[ -e "$target" ]]; then
-    echo "refusing to replace unrelated global executable: $target" >&2
+    echo "ERROR refusing to replace unrelated global executable: $target" >&2
     exit 1
   fi
   ln -sfn "$source" "$target"
@@ -645,17 +646,17 @@ remove_global_pip_executable() {
     echo "would remove global pip executable: $target"
     return 0
   fi
-  [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
+  [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
   if [[ ! -e "$target" && ! -L "$target" ]]; then
     return 0
   fi
-  [[ -L "$target" ]] || { echo "refusing to remove unrelated global executable: $target" >&2; exit 1; }
+  [[ -L "$target" ]] || { echo "ERROR refusing to remove unrelated global executable: $target" >&2; exit 1; }
   local source user_home
   source="$(readlink "$target")"
   user_home="$(cd /tmp && sudo -u "$administrator" -H /bin/sh -c 'printf "%s\n" "$HOME"')"
   case "$source" in
     "$user_home"/*/bin/"$executable") rm -f -- "$target" ;;
-    *) echo "refusing to remove unrelated symlink: $target -> $source" >&2; exit 1 ;;
+    *) echo "ERROR refusing to remove unrelated symlink: $target -> $source" >&2; exit 1 ;;
   esac
 }
 
@@ -705,12 +706,12 @@ bun_source_hash() {
   local source_dir="$1" hash
   if repo_root_is_git; then
     hash="$(repo_git rev-parse --verify --quiet "HEAD:$source_dir")" || {
-      echo "bun-compile source is not tracked at HEAD: $source_dir" >&2
+      echo "ERROR bun-compile source is not tracked at HEAD: $source_dir" >&2
       return 1
     }
   else
     [[ -d "$repo_root/$source_dir" ]] || {
-      echo "bun-compile source missing from installed package: $repo_root/$source_dir" >&2
+      echo "ERROR bun-compile source missing from installed package: $repo_root/$source_dir" >&2
       return 1
     }
     hash="$(content_tree_hash "$repo_root/$source_dir")"
@@ -732,17 +733,17 @@ run_bun_compile() {
     printf 'would build and install bun binary: %s -> %s (source %s)\n' "$package" "$target" "$source_hash"
     return 0
   fi
-  [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
-  [[ "$target" == /usr/local/bin/* ]] || { echo "bun-compile target must be under /usr/local/bin: $target" >&2; exit 1; }
+  [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
+  [[ "$target" == /usr/local/bin/* ]] || { echo "ERROR bun-compile target must be under /usr/local/bin: $target" >&2; exit 1; }
   [[ "$source_dir" != /* && "$source_dir" != *..* ]] || {
-    echo "unsafe bun-compile source path: $source_dir" >&2
+    echo "ERROR unsafe bun-compile source path: $source_dir" >&2
     exit 1
   }
   local project_dir="$repo_root/$source_dir"
-  [[ -d "$project_dir" ]] || { echo "bun-compile source missing: $project_dir" >&2; exit 1; }
+  [[ -d "$project_dir" ]] || { echo "ERROR bun-compile source missing: $project_dir" >&2; exit 1; }
   local bun_bin
   bun_bin="$(command -v bun || true)"
-  [[ -n "$bun_bin" ]] || { echo "bun-compile requires bun on PATH; ensure bun installs before this tool" >&2; exit 1; }
+  [[ -n "$bun_bin" ]] || { echo "ERROR bun-compile requires bun on PATH; ensure bun installs before this tool" >&2; exit 1; }
   (cd "$project_dir" && "$bun_bin" install --frozen-lockfile)
   bun_compile_build "$bun_bin" "$project_dir/$entry" "$target"
 }
@@ -754,8 +755,8 @@ run_embedding_model() {
     printf 'would install embedding model: %s as %s -> ~/.cache/adl-embedding/model\n' "$package" "$administrator"
     return 0
   fi
-  [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
-  command -v bun >/dev/null 2>&1 || { echo "embedding-model requires bun; ensure bun installs before this tool" >&2; exit 1; }
+  [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
+  command -v bun >/dev/null 2>&1 || { echo "ERROR embedding-model requires bun; ensure bun installs before this tool" >&2; exit 1; }
   (cd /tmp && sudo -u "$administrator" -H env PATH="${brew_bin%/*}:/usr/bin:/bin" \
     bun "$repo_root/packages/fleet/src/install-embedding-model.ts" install --spec "$spec_json" </dev/null)
 }
@@ -782,9 +783,9 @@ install_surface_policy_file() {
     echo "would install required surface policy: $source -> $target"
     return 0
   fi
-  [[ -f "$source" ]] || { echo "surface policy source missing: $source" >&2; return 1; }
+  [[ -f "$source" ]] || { echo "ERROR surface policy source missing: $source" >&2; return 1; }
   jq -e '(.deny.paths | arrays) and (.deny.nativeTools | arrays)' "$source" >/dev/null || {
-    echo "surface policy source is invalid: $source" >&2
+    echo "ERROR surface policy source is invalid: $source" >&2
     return 1
   }
   mkdir -p /etc/adl
@@ -823,7 +824,7 @@ resolve_latest_release_tag() {
   local repo="$1"
   local location
   location="$(curl --proto '=https' --proto-redir '=https' -fsS -o /dev/null -w '%{redirect_url}' "https://github.com/$repo/releases/latest")"
-  [[ -n "$location" ]] || { echo "could not resolve latest release tag for $repo" >&2; exit 1; }
+  [[ -n "$location" ]] || { echo "ERROR could not resolve latest release tag for $repo" >&2; exit 1; }
   basename "$location"
 }
 
@@ -854,10 +855,10 @@ run_release_archive_latest() {
   local checksums_asset="$5"
   local archive_executable="$6"
   local target="$7"
-  [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
-  [[ "$target" == /usr/local/bin/* ]] || { echo "release archive target must be under /usr/local/bin: $target" >&2; exit 1; }
+  [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
+  [[ "$target" == /usr/local/bin/* ]] || { echo "ERROR release archive target must be under /usr/local/bin: $target" >&2; exit 1; }
   [[ "$archive_executable" != /* && "$archive_executable" != *..* ]] || {
-    echo "unsafe archive executable path: $archive_executable" >&2
+    echo "ERROR unsafe archive executable path: $archive_executable" >&2
     exit 1
   }
 
@@ -872,7 +873,7 @@ run_release_archive_latest() {
     curl --proto '=https' --proto-redir '=https' -fsSL --retry 3 \
       -o "$checksums_file" "https://github.com/$repo/releases/download/$tag/$checksums_asset"
     expected_sha256="$(awk -v want="$asset" '$2 == want { print $1; found = 1 } END { exit !found }' "$checksums_file")" || {
-      echo "no published checksum for $asset in $repo's $checksums_asset -- refusing to install unverified bytes" >&2
+      echo "ERROR no published checksum for $asset in $repo's $checksums_asset -- refusing to install unverified bytes" >&2
       exit 1
     }
     curl --proto '=https' --proto-redir '=https' -fsSL --retry 3 \
@@ -880,15 +881,15 @@ run_release_archive_latest() {
     case "$(uname -s)" in
       Darwin) actual_sha256="$(shasum -a 256 "$archive_file" | awk '{print $1}')" ;;
       Linux) actual_sha256="$(sha256sum "$archive_file" | awk '{print $1}')" ;;
-      *) echo "unsupported operating system for release archive" >&2; exit 1 ;;
+      *) echo "ERROR unsupported operating system for release archive" >&2; exit 1 ;;
     esac
     [[ "$actual_sha256" == "$expected_sha256" ]] || {
-      echo "checksum mismatch for $package (latest): expected $expected_sha256 from published $checksums_asset, got $actual_sha256" >&2
+      echo "ERROR checksum mismatch for $package (latest): expected $expected_sha256 from published $checksums_asset, got $actual_sha256" >&2
       exit 1
     }
     tar -xzf "$archive_file" -C "$extract_dir" "$archive_executable"
     [[ -f "$extract_dir/$archive_executable" ]] || {
-      echo "archive executable missing: $archive_executable" >&2
+      echo "ERROR archive executable missing: $archive_executable" >&2
       exit 1
     }
     atomic_install_executable "$extract_dir/$archive_executable" "$target"
@@ -934,7 +935,7 @@ install_one_tool() {
     echo "ensure Adl from explicit checkout source: $repo_root"
     build_checkout_adl || rc=1
     if [[ "$mode" == apply && "$rc" -eq 0 ]]; then
-      command -v "$executable" >/dev/null 2>&1 || { echo "checkout Adl executable missing from PATH: $executable" >&2; rc=1; }
+      command -v "$executable" >/dev/null 2>&1 || { echo "ERROR checkout Adl executable missing from PATH: $executable" >&2; rc=1; }
     fi
     return "$rc"
   fi
@@ -971,7 +972,7 @@ install_one_tool() {
             run_brew upgrade "$package" || rc=1
           fi
         else
-          echo "$tool_id: brew outdated check failed for $package" >&2
+          echo "ERROR $tool_id: brew outdated check failed for $package" >&2
           rc=1
         fi
       else
@@ -1012,12 +1013,12 @@ install_one_tool() {
           prepare_in_place_bun_to_npm_migration "$tool_id" || rc=1
         fi
         if [[ "$rc" -eq 0 ]] && ! npm_target_version="$(npm_latest_version "$package")"; then
-          echo "$tool_id: npm view could not resolve the latest version of $package" >&2
+          echo "ERROR $tool_id: npm view could not resolve the latest version of $package" >&2
           rc=1
         fi
         if [[ "$rc" -eq 0 ]]; then
           if ! npm_installed_ver="$(npm_installed_version "$package")"; then
-            echo "$tool_id: npm ls -g could not inspect the global install of $package" >&2
+            echo "ERROR $tool_id: npm ls -g could not inspect the global install of $package" >&2
             rc=1
           elif [[ -n "$npm_installed_ver" && "$npm_installed_ver" == "$npm_target_version" ]]; then
             echo "already latest: $tool_id (npm:$package@$npm_installed_ver)"
@@ -1068,15 +1069,15 @@ install_one_tool() {
         fi
       fi
       ;;
-    *) echo "unsupported manager: $manager" >&2; rc=1 ;;
+    *) echo "ERROR unsupported manager: $manager" >&2; rc=1 ;;
   esac
   if [[ "$mode" == apply && "$rc" -eq 0 ]]; then
     if [[ "$executable" == /* ]]; then
-      [[ -x "$executable" ]] || { echo "$tool_id executable missing: $executable" >&2; rc=1; }
+      [[ -x "$executable" ]] || { echo "ERROR $tool_id executable missing: $executable" >&2; rc=1; }
     else
       local executable_path
       executable_path="$(sudo -u "$administrator" -H env PATH="/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/usr/local/bin:/usr/bin:/bin" /bin/sh -c "command -v '$executable'" 2>/dev/null || true)"
-      [[ -n "$executable_path" ]] || { echo "$tool_id executable missing from global PATH: $executable" >&2; rc=1; }
+      [[ -n "$executable_path" ]] || { echo "ERROR $tool_id executable missing from global PATH: $executable" >&2; rc=1; }
     fi
   fi
   return "$rc"
@@ -1102,11 +1103,11 @@ is_in_place_bun_to_npm_migration() {
 remove_retired_bun_compilation() {
   local tool_id="$1" executable="$2" hash_file
   [[ "$tool_id" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]] || {
-    echo "unsafe retired Bun compilation tool id: $tool_id" >&2
+    echo "ERROR unsafe retired Bun compilation tool id: $tool_id" >&2
     return 1
   }
   [[ "$executable" =~ ^/usr/local/bin/[A-Za-z0-9][A-Za-z0-9._-]*$ ]] || {
-    echo "refusing unsafe retired Bun binary removal target: $executable" >&2
+    echo "ERROR refusing unsafe retired Bun binary removal target: $executable" >&2
     return 1
   }
   hash_file="$(bun_source_hash_file "$tool_id")"
@@ -1129,7 +1130,7 @@ prepare_in_place_bun_to_npm_migration() {
     package="$(jq -r --arg id "$tool_id" '.[$id].package' "$resolved_file")"
     executable="$(jq -r --arg id "$tool_id" '.[$id].executable' "$resolved_file")"
     npm_package_owns_executable "$package" "$executable" || {
-      echo "refusing to remove an executable symlink not owned by npm: $previous_executable" >&2
+      echo "ERROR refusing to remove an executable symlink not owned by npm: $previous_executable" >&2
       return 1
     }
     hash_file="$(bun_source_hash_file "$tool_id")"
@@ -1144,7 +1145,7 @@ failed_in_place_npm_migration() {
   local tool_id
   for tool_id in ${failed_tools[@]+"${failed_tools[@]}"}; do
     if is_in_place_bun_to_npm_migration "$tool_id"; then
-      echo "global-tools: npm migration failed for $tool_id; retired Bun command was removed and reconciliation must stop" >&2
+      echo "ERROR global-tools: npm migration failed for $tool_id; retired Bun command was removed and reconciliation must stop" >&2
       return 0
     fi
   done
@@ -1181,7 +1182,7 @@ build_one_bun_tool() {
   fi
   run_bun_compile "$package" "$source_hash" "$source_dir" "$entry" "$executable" || rc=1
   if [[ "$mode" == apply && "$rc" -eq 0 ]]; then
-    [[ -x "$executable" ]] || { echo "$tool_id executable missing: $executable" >&2; rc=1; }
+    [[ -x "$executable" ]] || { echo "ERROR $tool_id executable missing: $executable" >&2; rc=1; }
   fi
   if [[ "$mode" == apply && "$rc" -eq 0 ]]; then
     mkdir -p "${hash_file%/*}"
@@ -1202,7 +1203,7 @@ build_checkout_adl() {
   fi
   run_bun_compile adl "$source_hash" "$source_dir" "$entry" "$target" || rc=1
   if [[ "$mode" == apply && "$rc" -eq 0 ]]; then
-    [[ -x "$target" ]] || { echo "checkout Adl executable missing: $target" >&2; rc=1; }
+    [[ -x "$target" ]] || { echo "ERROR checkout Adl executable missing: $target" >&2; rc=1; }
     if [[ "$rc" -eq 0 ]]; then
       mkdir -p "${hash_file%/*}"
       printf '%s\n' "$source_hash" >"$hash_file.new"
@@ -1243,16 +1244,16 @@ write_one_shim() {
   executable="$(jq -r --arg id "$tool_id" '.[$id].executable' "$resolved_file")"
   echo "ensure shim: $tool_id (shim:$package -> $executable)"
   [[ "$executable" == /usr/local/bin/* ]] || {
-    echo "refusing unsafe shim target: $executable" >&2
+    echo "ERROR refusing unsafe shim target: $executable" >&2
     return 1
   }
   if [[ "$mode" != apply ]]; then
     echo "would write shim: $executable -> $package"
     return 0
   fi
-  [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
+  [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
   target_path="$(sudo -u "$administrator" -H env PATH="/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/usr/local/bin:/usr/bin:/bin" /bin/sh -c "command -v '$package'" 2>/dev/null || true)"
-  [[ -n "$target_path" ]] || { echo "shim target not yet on PATH: $package" >&2; return 1; }
+  [[ -n "$target_path" ]] || { echo "ERROR shim target not yet on PATH: $package" >&2; return 1; }
   content="#!/bin/sh
 # Generated by global-tools -- do not edit.
 exec '$target_path' \"\$@\"
@@ -1270,7 +1271,7 @@ exec '$target_path' \"\$@\"
   alias_name="$(basename "$executable")"
   resolved_alias="$(sudo -u "$administrator" -H env PATH="/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/usr/local/bin:/usr/bin:/bin" /bin/sh -c "command -v '$alias_name'" 2>/dev/null || true)"
   [[ "$resolved_alias" == "$executable" ]] || {
-    echo "$tool_id shim written but not resolving from global PATH as '$alias_name' (got: ${resolved_alias:-nothing})" >&2
+    echo "ERROR $tool_id shim written but not resolving from global PATH as '$alias_name' (got: ${resolved_alias:-nothing})" >&2
     rc=1
   }
   return "$rc"
@@ -1316,16 +1317,16 @@ write_one_repo_script() {
   source="$(jq -r --arg id "$tool_id" '.[$id].source' "$resolved_file")"
   echo "ensure managed repo script: $tool_id (repo-script:$package -> $executable)"
   [[ "$executable" =~ ^/usr/local/bin/[A-Za-z0-9][A-Za-z0-9._-]*$ ]] || {
-    echo "unsafe managed script target: $executable" >&2
+    echo "ERROR unsafe managed script target: $executable" >&2
     return 1
   }
   [[ "$source" != /* && "$source" != *..* ]] || {
-    echo "unsafe managed script source: $source" >&2
+    echo "ERROR unsafe managed script source: $source" >&2
     return 1
   }
   source_path="$repo_root/$source"
   [[ -f "$source_path" && ! -L "$source_path" && -x "$source_path" ]] || {
-    echo "managed script source must be an executable regular non-symlink file: $source_path" >&2
+    echo "ERROR managed script source must be an executable regular non-symlink file: $source_path" >&2
     return 1
   }
   if [[ "$mode" != apply ]]; then
@@ -1339,10 +1340,10 @@ write_one_repo_script() {
     fi
     return 0
   fi
-  [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
+  [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
   if [[ -e "$executable" || -L "$executable" ]]; then
     is_managed_repo_script "$executable" || {
-      echo "refusing to replace unmanaged or symlinked managed script target: $executable" >&2
+      echo "ERROR refusing to replace unmanaged or symlinked managed script target: $executable" >&2
       return 1
     }
   fi
@@ -1361,7 +1362,7 @@ write_one_repo_script() {
         echo "backed up previous managed repo script to $repo_script_backup"
         record_backup "$executable" "$repo_script_backup"
       else
-        echo "could not back up managed repo script before replacing it: $executable" >&2
+        echo "ERROR could not back up managed repo script before replacing it: $executable" >&2
         return 1
       fi
     fi
@@ -1371,7 +1372,7 @@ write_one_repo_script() {
   alias_name="$(basename "$executable")"
   resolved_alias="$(sudo -u "$administrator" -H env PATH="/usr/local/bin:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin" /bin/sh -c 'command -v "$1"' sh "$alias_name" 2>/dev/null || true)"
   [[ "$resolved_alias" == "$executable" ]] || {
-    echo "$tool_id managed script installed but not resolving from global PATH as '$alias_name' (got: ${resolved_alias:-nothing})" >&2
+    echo "ERROR $tool_id managed script installed but not resolving from global PATH as '$alias_name' (got: ${resolved_alias:-nothing})" >&2
     rc=1
   }
   return "$rc"
@@ -1380,14 +1381,14 @@ write_one_repo_script() {
 remove_one_repo_script() {
   local executable="$1"
   [[ "$executable" =~ ^/usr/local/bin/[A-Za-z0-9][A-Za-z0-9._-]*$ ]] || {
-    echo "refusing unsafe managed script removal target: $executable" >&2
+    echo "ERROR refusing unsafe managed script removal target: $executable" >&2
     return 1
   }
   if [[ ! -e "$executable" && ! -L "$executable" ]]; then
     return 0
   fi
   is_managed_repo_script "$executable" || {
-    echo "refusing to remove unmanaged or symlinked managed script target: $executable" >&2
+    echo "ERROR refusing to remove unmanaged or symlinked managed script target: $executable" >&2
     return 1
   }
   rm -f -- "$executable"
@@ -1400,7 +1401,7 @@ repo_dir_source_hash() {
   local source_dir="$1" hash
   if repo_root_is_git; then
     hash="$(repo_git rev-parse --verify --quiet "HEAD:$source_dir")" || {
-      echo "repo-dir source is not tracked at HEAD: $source_dir" >&2
+      echo "ERROR repo-dir source is not tracked at HEAD: $source_dir" >&2
       return 1
     }
   else
@@ -1452,7 +1453,7 @@ managed_repo_dir_marker='.adl-managed-repo-dir'
 # have to provide.
 run_repo_dir_sync() {
   local tool_id="$1" source="$2" build_dir="$3" npm_install="$4" bun_bin
-  [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
+  [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
   if repo_root_is_git; then
     repo_git archive "HEAD:$source" | tar -x -C "$build_dir"
   else
@@ -1463,8 +1464,8 @@ run_repo_dir_sync() {
   fi
   if [[ "$npm_install" == true ]]; then
     bun_bin="$(command -v bun || true)"
-    [[ -n "$bun_bin" ]] || { echo "repo-dir $tool_id requires bun on PATH for npmInstall; ensure bun installs before this tool" >&2; return 1; }
-    (cd "$build_dir" && "$bun_bin" install) || { echo "repo-dir $tool_id: bun install failed" >&2; return 1; }
+    [[ -n "$bun_bin" ]] || { echo "ERROR repo-dir $tool_id requires bun on PATH for npmInstall; ensure bun installs before this tool" >&2; return 1; }
+    (cd "$build_dir" && "$bun_bin" install) || { echo "ERROR repo-dir $tool_id: bun install failed" >&2; return 1; }
     # agent-skills (the only npmInstall:true source today) ships no `dist/`
     # in git -- every one of its script entry points imports from
     # `../../dist/index.js` (confirmed empirically, all four: run-sync,
@@ -1474,7 +1475,7 @@ run_repo_dir_sync() {
     # the package's own declared `build` script, exactly as a developer
     # would, whenever the synced package.json has one.
     if [[ "$(jq -r '.scripts.build // empty' "$build_dir/package.json" 2>/dev/null)" != "" ]]; then
-      (cd "$build_dir" && "$bun_bin" run build) || { echo "repo-dir $tool_id: bun run build failed" >&2; return 1; }
+      (cd "$build_dir" && "$bun_bin" run build) || { echo "ERROR repo-dir $tool_id: bun run build failed" >&2; return 1; }
     fi
   fi
 }
@@ -1535,16 +1536,16 @@ write_one_repo_dir() {
   npm_install="$(jq -r --arg id "$tool_id" '.[$id].npmInstall // false' "$resolved_file")"
   echo "ensure repo dir: $tool_id (repo-dir:$package -> $target)"
   [[ "$target" == "$repo_dir_libexec_root"/* ]] || {
-    echo "unsafe repo-dir target: $target" >&2
+    echo "ERROR unsafe repo-dir target: $target" >&2
     return 1
   }
   [[ "$source" != /* && "$source" != *..* ]] || {
-    echo "unsafe repo-dir source: $source" >&2
+    echo "ERROR unsafe repo-dir source: $source" >&2
     return 1
   }
   source_path="$repo_root/$source"
   [[ -d "$source_path" ]] || {
-    echo "repo-dir source missing: $source_path" >&2
+    echo "ERROR repo-dir source missing: $source_path" >&2
     return 1
   }
   source_hash="$(repo_dir_source_hash "$source")" || return 1
@@ -1588,7 +1589,7 @@ write_one_repo_dir() {
     fi
   fi
   [[ -e "$target/$executable" ]] || {
-    echo "$tool_id repo dir installed but entry missing: $target/$executable" >&2
+    echo "ERROR $tool_id repo dir installed but entry missing: $target/$executable" >&2
     rc=1
   }
   return "$rc"
@@ -1597,12 +1598,12 @@ write_one_repo_dir() {
 remove_one_repo_dir() {
   local target="$1"
   [[ "$target" == "$repo_dir_libexec_root"/* ]] || {
-    echo "refusing unsafe repo-dir removal target: $target" >&2
+    echo "ERROR refusing unsafe repo-dir removal target: $target" >&2
     return 1
   }
   [[ -e "$target" ]] || return 0
   [[ -f "$target/$managed_repo_dir_marker" ]] || {
-    echo "refusing to remove unmanaged repo dir: $target" >&2
+    echo "ERROR refusing to remove unmanaged repo dir: $target" >&2
     return 1
   }
   rm -rf -- "$target"
@@ -1683,7 +1684,7 @@ executable_claimed_by_current_manifest() {
 remove_one_manifest_entry() {
   local tool_id="$1" manager package executable removed_repo_dir_target
   if jq -e --arg id "$tool_id" '.config.protected_tools | index($id)' "$manifest" >/dev/null; then
-    echo "refusing to remove protected bootstrap tool: $tool_id" >&2
+    echo "ERROR refusing to remove protected bootstrap tool: $tool_id" >&2
     exit 1
   fi
   manager="$(jq -r --arg id "$tool_id" '.[$id].manager' "$previous_resolved_file")"
@@ -1735,7 +1736,7 @@ remove_one_manifest_entry() {
     # state is read straight from disk, never re-validated.
     release-archive)
       [[ "$executable" == /usr/local/bin/* ]] || {
-        echo "refusing unsafe release archive removal target: $executable" >&2
+        echo "ERROR refusing unsafe release archive removal target: $executable" >&2
         exit 1
       }
       if [[ "$mode" == apply ]]; then
@@ -1746,7 +1747,7 @@ remove_one_manifest_entry() {
       ;;
     release-archive-latest)
       [[ "$executable" == /usr/local/bin/* ]] || {
-        echo "refusing unsafe release archive removal target: $executable" >&2
+        echo "ERROR refusing unsafe release archive removal target: $executable" >&2
         exit 1
       }
       if [[ "$mode" == apply ]]; then
@@ -1757,7 +1758,7 @@ remove_one_manifest_entry() {
       ;;
     shim)
       [[ "$executable" == /usr/local/bin/* ]] || {
-        echo "refusing unsafe shim removal target: $executable" >&2
+        echo "ERROR refusing unsafe shim removal target: $executable" >&2
         exit 1
       }
       if [[ "$mode" == apply ]]; then
@@ -1771,7 +1772,7 @@ remove_one_manifest_entry() {
         remove_one_repo_script "$executable"
       else
         [[ "$executable" =~ ^/usr/local/bin/[A-Za-z0-9][A-Za-z0-9._-]*$ ]] || {
-          echo "refusing unsafe managed script removal target: $executable" >&2
+          echo "ERROR refusing unsafe managed script removal target: $executable" >&2
           exit 1
         }
         echo "would remove managed repo script: $executable"
@@ -1783,7 +1784,7 @@ remove_one_manifest_entry() {
         remove_one_repo_dir "$removed_repo_dir_target"
       else
         [[ "$removed_repo_dir_target" == "$repo_dir_libexec_root"/* ]] || {
-          echo "refusing unsafe repo-dir removal target: $removed_repo_dir_target" >&2
+          echo "ERROR refusing unsafe repo-dir removal target: $removed_repo_dir_target" >&2
           exit 1
         }
         echo "would remove repo dir: $removed_repo_dir_target"
@@ -1791,7 +1792,7 @@ remove_one_manifest_entry() {
       ;;
     bun-compile)
       [[ "$executable" == /usr/local/bin/* ]] || {
-        echo "refusing unsafe bun binary removal target: $executable" >&2
+        echo "ERROR refusing unsafe bun binary removal target: $executable" >&2
         exit 1
       }
       if [[ "$mode" == apply ]]; then
@@ -1802,15 +1803,15 @@ remove_one_manifest_entry() {
       ;;
     embedding-model)
       if [[ "$mode" == apply ]]; then
-        [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
-        command -v bun >/dev/null 2>&1 || { echo "embedding-model requires bun; ensure bun installs before this tool" >&2; exit 1; }
+        [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
+        command -v bun >/dev/null 2>&1 || { echo "ERROR embedding-model requires bun; ensure bun installs before this tool" >&2; exit 1; }
         (cd /tmp && sudo -u "$administrator" -H env PATH="${brew_bin%/*}:/usr/bin:/bin" \
           bun "$repo_root/packages/fleet/src/install-embedding-model.ts" uninstall </dev/null)
       else
         echo "would remove embedding model cache: ~/.cache/adl-embedding/model (as $administrator)"
       fi
       ;;
-    *) echo "unsupported manager in previous manifest: $manager" >&2; exit 1 ;;
+    *) echo "ERROR unsupported manager in previous manifest: $manager" >&2; exit 1 ;;
   esac
 }
 
@@ -1823,7 +1824,7 @@ remove_one_manifest_entry() {
 # the LFS pre-push hook.
 run_git_config_global() {
   if [[ "$mode" == apply ]]; then
-    [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
+    [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
     (cd /tmp && sudo -u "$git_config_user" -H git config --global "$@" </dev/null)
   else
     git config --global "$@" </dev/null
@@ -1848,7 +1849,7 @@ cleanup_legacy_linux_git_config() {
   legacy_home="$(jq -r --arg device "$device" '.linux.devices[$device].brew_user_home // empty' "$applied_manifest")"
   [[ -n "$legacy_user" && -n "$legacy_home" ]] || return 0
   [[ "$legacy_home" == /* && "$legacy_home" != / ]] || {
-    echo "invalid legacy per-user home in applied manifest: $legacy_home" >&2
+    echo "ERROR invalid legacy per-user home in applied manifest: $legacy_home" >&2
     return 1
   }
   config_file="$legacy_home/.gitconfig"
@@ -1862,7 +1863,7 @@ cleanup_legacy_linux_git_config() {
       continue
     fi
     [[ "$rc" -eq 0 ]] || {
-      echo "failed to inspect legacy global git config: $key in $config_file (exit $rc)" >&2
+      echo "ERROR failed to inspect legacy global git config: $key in $config_file (exit $rc)" >&2
       return "$rc"
     }
     if [[ "$mode" != apply ]]; then
@@ -1882,7 +1883,7 @@ git_global_config_value() {
   if [[ "$rc" -eq 1 ]]; then
     return 0
   fi
-  [[ "$rc" -eq 0 ]] || { echo "git config --global --get $key failed (exit $rc)" >&2; return "$rc"; }
+  [[ "$rc" -eq 0 ]] || { echo "ERROR git config --global --get $key failed (exit $rc)" >&2; return "$rc"; }
   printf '%s\n' "$value"
 }
 
@@ -1931,7 +1932,7 @@ reconcile_git_global_config() {
 # "bun: command not found" abort with no explanation.
 require_bun_for_identity_files() {
   command -v bun >/dev/null 2>&1 || {
-    echo "global-tools: bun is required before default-agent-file/managed-settings; install bun first, then re-run reconcile" >&2
+    echo "ERROR global-tools: bun is required before default-agent-file/managed-settings; install bun first, then re-run reconcile" >&2
     return 1
   }
 }
@@ -2032,12 +2033,12 @@ reconcile_one_surface_cli() {
       echo "would ensure Homebrew cask: $name (brew install --cask $name; brew upgrade --cask $name)"
       return 0
     fi
-    [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
+    [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
     local installed_casks query_status=0 cask_action=() update_output update_status=0
     installed_casks="$(brew_query list --cask --versions 2>&1)" || query_status=$?
     if [[ "$query_status" -ne 0 ]]; then
-      printf '%s\n' "$installed_casks" >&2
-      echo "brew list --cask --versions failed for surface $name (exit $query_status)" >&2
+      printf 'ERROR brew list --cask --versions output: %s\n' "$installed_casks" >&2
+      echo "ERROR brew list --cask --versions failed for surface $name (exit $query_status)" >&2
       return 1
     fi
     if awk -v cask="$name" '$1 == cask { found = 1 } END { exit !found }' <<<"$installed_casks"; then
@@ -2048,10 +2049,10 @@ reconcile_one_surface_cli() {
     update_output="$(run_with_timeout "$SURFACE_UPDATE_TIMEOUT_SECONDS" run_brew ${cask_action[@]+"${cask_action[@]}"} 2>&1)" || update_status=$?
     printf '%s\n' "$update_output"
     if [[ "$update_status" -eq 124 ]]; then
-      echo "surface update timed out: $name" >&2
+      echo "ERROR surface update timed out: $name" >&2
       return 1
     elif [[ "$update_status" -ne 0 ]]; then
-      echo "surface update failed: $name (exit $update_status)" >&2
+      echo "ERROR surface update failed: $name (exit $update_status)" >&2
       return 1
     fi
     # Same broadened check as the native/npm path below (independent
@@ -2068,9 +2069,9 @@ reconcile_one_surface_cli() {
       # coordinator pass, 2026-09-30): the same `cask_action[0]` that already
       # picks the real brew argv above also names which one failed.
       if [[ "${cask_action[0]}" == install ]]; then
-        echo "surface $name: cask install failed ($update_error_line)" >&2
+        echo "ERROR surface $name: cask install failed ($update_error_line)" >&2
       else
-        echo "surface $name: cask upgrade failed ($update_error_line)" >&2
+        echo "ERROR surface $name: cask upgrade failed ($update_error_line)" >&2
       fi
       return 1
     fi
@@ -2089,7 +2090,7 @@ reconcile_one_surface_cli() {
     fi
     return 0
   fi
-  [[ "$(id -u)" -eq 0 ]] || { echo "apply mode must run as root" >&2; exit 1; }
+  [[ "$(id -u)" -eq 0 ]] || { echo "ERROR apply mode must run as root" >&2; exit 1; }
   local resolved
   resolved="$(resolve_surface_executable "$command_name" "$executable_override")"
   if [[ -z "$resolved" ]]; then
@@ -2107,10 +2108,10 @@ reconcile_one_surface_cli() {
   update_output="$(run_with_timeout "$SURFACE_UPDATE_TIMEOUT_SECONDS" run_surface_update "$resolved" ${update_args[@]+"${update_args[@]}"} 2>&1)" || update_status=$?
   printf '%s\n' "$update_output"
   if [[ "$update_status" -eq 124 ]]; then
-    echo "surface update timed out: $name" >&2
+    echo "ERROR surface update timed out: $name" >&2
     return 1
   elif [[ "$update_status" -ne 0 ]]; then
-    echo "surface update failed: $name (exit $update_status)" >&2
+    echo "ERROR surface update failed: $name (exit $update_status)" >&2
     return 1
   fi
   # A surface's update command can exit 0 while its own output says the
@@ -2139,7 +2140,7 @@ reconcile_one_surface_cli() {
   new_version="$(surface_cli_version "$resolved")"
   update_error_line="$(surface_update_error_reason "$update_output")"
   if [[ -z "$new_version" ]]; then
-    echo "surface $name: update ran but version unreadable (${update_error_line:-"--version produced no output"}); was ${old_version:-unknown}" >&2
+    echo "WARN surface $name: update ran but version unreadable (${update_error_line:-"--version produced no output"}); was ${old_version:-unknown}" >&2
     return 1
   fi
   if [[ "$old_version" != "$new_version" ]]; then
@@ -2151,7 +2152,7 @@ reconcile_one_surface_cli() {
     return 0
   fi
   if [[ -n "$update_error_line" ]]; then
-    echo "surface $name: update check failed ($update_error_line); kept ${old_version:-unknown}" >&2
+    echo "WARN surface $name: update check failed ($update_error_line); kept ${old_version:-unknown}" >&2
     return 1
   fi
   echo "surface $name: already latest ($new_version)"
@@ -2159,7 +2160,7 @@ reconcile_one_surface_cli() {
 }
 
 # Loops over this device's declared surface_clis (absent or empty -> silently
-# does nothing, same convention as launch_agents/scratch_repos). A failure is
+# does nothing, same convention as scratch_repos). A failure is
 # collected into failed_tools by id "surface-<name>", exactly like every other
 # apply-mode step's continue-on-failure contract in this file.
 reconcile_surface_clis() {
@@ -2185,12 +2186,78 @@ reconcile_surface_clis() {
     done < <(jq -r --argjson i "$i" --arg platform "$platform" --arg device "$device" \
       '.[$platform].devices[$device].surface_clis[$i].update_args // [] | .[]' "$manifest")
     if ! reconcile_one_surface_cli "$name" "$command_name" "$executable_override" "$report_only" "$manager" ${update_args[@]+"${update_args[@]}"}; then
-      echo "global-tools: TOOL INSTALL FAILED: surface-$name" >&2
+      echo "ERROR global-tools: TOOL INSTALL FAILED: surface-$name" >&2
       failed_tools+=("surface-$name")
     fi
   done
 }
 
+# retire_git_maintain (2026-09-30, Tarun: "one binary controlling everything"):
+# the git-maintain user LaunchAgent (com.adl.git-maintain) and its compiled
+# binary are retired; repository maintenance is `adl reconcile`'s own step
+# (bin/reconcile-host -> `adl maintain`). M3 and M5 already have the agent
+# installed and loaded, so this cleans it up actively rather than leaving a
+# job that scans ~/Documents on its own timer:
+#   - boot out gui/<administrator uid>/com.adl.git-maintain if loaded, and fail
+#     loud if it is still loaded afterwards (nothing is moved in that case);
+#   - move the plist, the compiled binary and its source-hash marker ASIDE
+#     (never deleted) under <state dir>/retired-git-maintain/<UTC stamp>/,
+#     logging each one.
+# Already gone means no change and no output; plan/audit only list what they
+# would do; Linux never had it. Returns non-zero (after an ERROR line) on a
+# failure; the caller records it like any other failed step.
+retire_git_maintain() {
+  [[ "$platform" == mac ]] || return 0
+  local label=com.adl.git-maintain uid loaded=0 path aside
+  local leftovers=()
+  local agent_plist="$administrator_home/Library/LaunchAgents/$label.plist"
+  local binary="$repo_dir_libexec_root/git-maintain"
+  local hash_marker="$state_dir/launch-agents/git-maintain.source-hash"
+
+  if uid="$(id -u "$administrator" 2>/dev/null)"; then
+    if launchctl print "gui/$uid/$label" >/dev/null 2>&1; then loaded=1; fi
+  elif [[ "$mode" == apply ]]; then
+    echo "ERROR global-tools: cannot resolve the uid of $administrator to retire git-maintain" >&2
+    return 1
+  else
+    # plan/audit on a machine without that account (a test, a preview): the
+    # leftover files can still be listed, but there is nothing to ask launchd.
+    uid="<uid of $administrator>"
+  fi
+  for path in "$agent_plist" "$binary" "$hash_marker"; do
+    if [[ -e "$path" || -L "$path" ]]; then leftovers+=("$path"); fi
+  done
+  if [[ "$loaded" -eq 0 && "${#leftovers[@]}" -eq 0 ]]; then return 0; fi
+
+  if [[ "$mode" != apply ]]; then
+    if [[ "$loaded" -eq 1 ]]; then echo "global-tools: would retire git-maintain: boot out gui/$uid/$label"; fi
+    for path in ${leftovers[@]+"${leftovers[@]}"}; do
+      echo "global-tools: would retire git-maintain: move $path aside"
+    done
+    return 0
+  fi
+
+  if [[ "$loaded" -eq 1 ]]; then
+    if ! launchctl bootout "gui/$uid/$label"; then
+      echo "ERROR global-tools: could not boot out gui/$uid/$label; git-maintain is not retired" >&2
+      return 1
+    fi
+    if launchctl print "gui/$uid/$label" >/dev/null 2>&1; then
+      echo "ERROR global-tools: gui/$uid/$label is still loaded after bootout; git-maintain is not retired" >&2
+      return 1
+    fi
+    echo "global-tools: retiring git-maintain: booted out gui/$uid/$label"
+  fi
+  if [[ "${#leftovers[@]}" -gt 0 ]]; then
+    aside="$state_dir/retired-git-maintain/$(date -u +%Y%m%dT%H%M%SZ)"
+    mkdir -p -- "$aside"
+    for path in "${leftovers[@]}"; do
+      mv -- "$path" "$aside/" || { echo "ERROR global-tools: could not move $path aside to $aside" >&2; return 1; }
+      echo "global-tools: retiring git-maintain: moved $path aside to $aside"
+    done
+  fi
+}
+
 # Test-only escape hatch: source this script with RECONCILE_SOURCE_ONLY=1 to
 # load every function definition above (and the arg-parsing / manifest
 # validation / platform-and-tool-resolution state already computed by this
@@ -2215,7 +2282,7 @@ scratch_reap_failed=0
 available_kib="$(df -Pk / | awk 'NR == 2 {print $4}')"
 required_kib="$((minimum_free_gib * 1024 * 1024))"
 if [[ "$available_kib" -lt "$required_kib" ]]; then
-  echo "global-tools: only $((available_kib / 1024 / 1024)) GiB free; $minimum_free_gib GiB required" >&2
+  echo "ERROR global-tools: only $((available_kib / 1024 / 1024)) GiB free; $minimum_free_gib GiB required" >&2
   [[ "$mode" != apply ]] || exit 1
 fi
 
@@ -2224,7 +2291,7 @@ if [[ "$mode" == apply ]]; then
 fi
 
 if ! install_surface_policy_file; then
-  echo "global-tools: TOOL INSTALL FAILED: surface-policy-file" >&2
+  echo "ERROR global-tools: TOOL INSTALL FAILED: surface-policy-file" >&2
   failed_tools+=("surface-policy-file")
 fi
 
@@ -2235,7 +2302,7 @@ require_bun_for_identity_files || exit 1
 # below that could read it (kimi-hooks resolves adl the same way; this
 # is the identity every consumer -- `adl run`, the managed-settings render
 # below, and host automation's git-ado call -- reads instead of its own
-# copy). Runs for real in plan mode too (like launch-agents.ts): default-agent-file.ts's
+# copy). Runs for real in plan mode too (like the other plan-safe steps): default-agent-file.ts's
 # own --mode plan never writes, so this is safe to run unconditionally.
 default_agent="$(jq -r --arg platform "$platform" --arg device "$device" '.[$platform].devices[$device].default_agent' "$manifest")"
 if [[ "$mode" != apply ]]; then
@@ -2244,7 +2311,7 @@ if [[ "$mode" != apply ]]; then
 else
   echo "global-tools: default-agent file mode=apply device=$device -> $default_agent"
   if ! bun "$repo_root/packages/fleet/src/default-agent-file.ts" --agent "$default_agent" --platform "$platform" --mode apply ${reconcile_test_system_root_args[@]+"${reconcile_test_system_root_args[@]}"}; then
-    echo "global-tools: TOOL INSTALL FAILED: default-agent-file" >&2
+    echo "ERROR global-tools: TOOL INSTALL FAILED: default-agent-file" >&2
     failed_tools+=("default-agent-file")
   fi
 fi
@@ -2261,7 +2328,7 @@ if [[ "$mode" != apply ]]; then
 else
   echo "global-tools: managed settings mode=apply device=$device -> $default_agent"
   if ! bun "$repo_root/packages/fleet/src/managed-settings.ts" --agent "$default_agent" --platform "$platform" --mode apply ${reconcile_test_system_root_args[@]+"${reconcile_test_system_root_args[@]}"}; then
-    echo "global-tools: TOOL INSTALL FAILED: managed-settings" >&2
+    echo "ERROR global-tools: TOOL INSTALL FAILED: managed-settings" >&2
     failed_tools+=("managed-settings")
   fi
 fi
@@ -2282,7 +2349,7 @@ if jq -e 'to_entries | any(.value.manager == "brew")' "$resolved_file" >/dev/nul
   brew_upgrade_all="$(jq -r --arg platform "$platform" --arg device "$device" '.[$platform].devices[$device].brew_upgrade_all // false' "$manifest")"
   if [[ "$brew_upgrade_all" == true ]]; then
     if ! run_brew_upgrade_all; then
-      echo "global-tools: TOOL INSTALL FAILED: brew-upgrade-all" >&2
+      echo "ERROR global-tools: TOOL INSTALL FAILED: brew-upgrade-all" >&2
       failed_tools+=("brew-upgrade-all")
     fi
   fi
@@ -2295,7 +2362,7 @@ fi
 
 while IFS= read -r tool_id; do
   if ! install_one_tool "$tool_id"; then
-    echo "global-tools: TOOL INSTALL FAILED: $tool_id" >&2
+    echo "ERROR global-tools: TOOL INSTALL FAILED: $tool_id" >&2
     failed_tools+=("$tool_id")
   fi
 done < <(jq -r 'to_entries[] | select(.value.manager != "shim" and .value.manager != "repo-script" and .value.manager != "repo-dir" and .value.manager != "bun-compile" and .value.manager != "embedding-model") | .key' "$resolved_file")
@@ -2310,28 +2377,28 @@ fi
 
 while IFS= read -r tool_id; do
   if ! build_one_bun_tool "$tool_id"; then
-    echo "global-tools: TOOL INSTALL FAILED: $tool_id" >&2
+    echo "ERROR global-tools: TOOL INSTALL FAILED: $tool_id" >&2
     failed_tools+=("$tool_id")
   fi
 done < <(jq -r 'to_entries[] | select(.value.manager == "bun-compile") | .key' "$resolved_file")
 
 while IFS= read -r tool_id; do
   if ! install_one_embedding_model_tool "$tool_id"; then
-    echo "global-tools: TOOL INSTALL FAILED: $tool_id" >&2
+    echo "ERROR global-tools: TOOL INSTALL FAILED: $tool_id" >&2
     failed_tools+=("$tool_id")
   fi
 done < <(jq -r 'to_entries[] | select(.value.manager == "embedding-model") | .key' "$resolved_file")
 
 while IFS= read -r tool_id; do
   if ! write_one_shim "$tool_id"; then
-    echo "global-tools: TOOL INSTALL FAILED: $tool_id" >&2
+    echo "ERROR global-tools: TOOL INSTALL FAILED: $tool_id" >&2
     failed_tools+=("$tool_id")
   fi
 done < <(jq -r 'to_entries[] | select(.value.manager == "shim") | .key' "$resolved_file")
 
 while IFS= read -r tool_id; do
   if ! write_one_repo_script "$tool_id"; then
-    echo "global-tools: TOOL INSTALL FAILED: $tool_id" >&2
+    echo "ERROR global-tools: TOOL INSTALL FAILED: $tool_id" >&2
     failed_tools+=("$tool_id")
   fi
 done < <(jq -r 'to_entries[] | select(.value.manager == "repo-script") | .key' "$resolved_file")
@@ -2426,7 +2493,7 @@ fi
 
 while IFS= read -r tool_id; do
   if ! write_one_repo_dir "$tool_id"; then
-    echo "global-tools: TOOL INSTALL FAILED: $tool_id" >&2
+    echo "ERROR global-tools: TOOL INSTALL FAILED: $tool_id" >&2
     failed_tools+=("$tool_id")
   fi
 done < <(jq -r 'to_entries[] | select(.value.manager == "repo-dir") | .key' "$resolved_file")
@@ -2466,12 +2533,12 @@ project_adl_package_payload() {
   local adl_package bun_bin
   adl_package="$(jq -r '.adl.package // empty' "$resolved_file")"
   [[ "$adl_package" == @amsterdamdatalabs/adl-agent-control ]] || {
-    echo "Adl package projection requires the published wrapper entry" >&2
+    echo "ERROR Adl package projection requires the published wrapper entry" >&2
     return 1
   }
   for failed_tool in ${failed_tools[@]+"${failed_tools[@]}"}; do
     if [[ "$failed_tool" == adl ]]; then
-      echo "skipping Adl payload projection because Adl source verification failed" >&2
+      echo "WARN skipping Adl payload projection because Adl source verification failed" >&2
       return 1
     fi
   done
@@ -2483,10 +2550,10 @@ project_adl_package_payload() {
     return 0
   fi
   bun_bin="$(command -v bun || true)"
-  [[ -n "$bun_bin" ]] || { echo "Adl package projection requires bun on PATH" >&2; return 1; }
+  [[ -n "$bun_bin" ]] || { echo "ERROR Adl package projection requires bun on PATH" >&2; return 1; }
   if [[ "$source_mode" == checkout ]]; then
     (cd "$repo_root/packages/agent-skills" && "$bun_bin" run build) || {
-      echo "could not build agent-skills payload from checkout" >&2
+      echo "ERROR could not build agent-skills payload from checkout" >&2
       return 1
     }
   fi
@@ -2499,50 +2566,33 @@ project_adl_package_payload() {
 }
 
 if ! project_adl_package_payload; then
-  echo "global-tools: TOOL INSTALL FAILED: adl-package-projection" >&2
+  echo "ERROR global-tools: TOOL INSTALL FAILED: adl-package-projection" >&2
   failed_tools+=("adl-package-projection")
 fi
 
 # Same continue-on-failure contract as the tool passes above: runs after git
 # itself is installed/upgraded, and a failure is recorded, not fatal.
 if ! "$repo_root/bin/shell-path-policy" --home "$administrator_home" --platform "$platform" --mode "$mode" --owner "$administrator"; then
-  echo "global-tools: TOOL INSTALL FAILED: shell-path-policy" >&2
+  echo "ERROR global-tools: TOOL INSTALL FAILED: shell-path-policy" >&2
   failed_tools+=("shell-path-policy")
 fi
 
 if ! reconcile_git_global_config; then
-  echo "global-tools: TOOL INSTALL FAILED: git-global-config" >&2
+  echo "ERROR global-tools: TOOL INSTALL FAILED: git-global-config" >&2
   failed_tools+=("git-global-config")
 fi
 cleanup_legacy_linux_git_config || {
-  echo "global-tools: legacy Linux git config cleanup failed" >&2
+  echo "ERROR global-tools: legacy Linux git config cleanup failed" >&2
   exit 1
 }
 
-# launch_agents (mac only; validate-manifest rejects them on linux): user
-# LaunchAgents adl owns -- see packages/fleet/src/launch-agents.ts. Runs
-# before the global surface sweep, whose LaunchAgent protection is derived
-# from these same manifest declarations. Apply runs as root (it installs the
-# compiles each job into its own signed binary under
-# /usr/local/libexec/adl, writes the administrator's plist owned by
-# that user, and bootstraps gui/<uid>); plan only prints. Same
-# continue-on-failure contract as the tool passes above.
-if [[ "$platform" == mac ]] && jq -e --arg device "$device" \
-  '((.mac.common.launch_agents // {}) + (.mac.devices[$device].launch_agents // {})) | length > 0' "$manifest" >/dev/null; then
-  launch_agents_args=(--manifest "$manifest" --platform "$platform" --device "$device" --home "$administrator_home" --state-dir "$state_dir")
-  if [[ "$have_previous" -eq 1 ]]; then
-    launch_agents_args+=(--previous-manifest "$applied_manifest")
-  fi
-  if [[ "$mode" == apply ]]; then
-    echo "global-tools: launch agents mode=apply home=$administrator_home (for $administrator)"
-    if ! bun "$repo_root/packages/fleet/src/launch-agents.ts" --mode apply "${launch_agents_args[@]}"; then
-      echo "global-tools: TOOL INSTALL FAILED: launch-agents" >&2
-      failed_tools+=("launch-agents")
-    fi
-  else
-    echo "global-tools: launch agents mode=plan home=$administrator_home"
-    bun "$repo_root/packages/fleet/src/launch-agents.ts" --mode plan "${launch_agents_args[@]}"
-  fi
+# git-maintain is retired: clean it up where it is still installed (mac), ahead
+# of the global surface sweep, which would otherwise see its leftover
+# LaunchAgent as an approval-gated candidate. Same continue-on-failure
+# contract as the tool passes above.
+if ! retire_git_maintain; then
+  echo "ERROR global-tools: TOOL INSTALL FAILED: git-maintain-retire" >&2
+  failed_tools+=("git-maintain-retire")
 fi
 
 if [[ "$mode" == apply ]]; then
@@ -2608,11 +2658,11 @@ if [[ "$kimi_hooks_enabled" == true ]]; then
     # shim: there is no standalone hook executable to resolve any more.
     adl_executable="$(jq -r '."adl".executable' "$resolved_file")"
     if ! adl_resolved="$(sudo -u "$administrator" -H env PATH="/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/usr/local/bin:/usr/bin:/bin" /bin/sh -c "command -v '$adl_executable'" 2>/dev/null)"; then
-      echo "global-tools: could not resolve adl from the administrator PATH" >&2
+      echo "ERROR global-tools: could not resolve adl from the administrator PATH" >&2
       exit 1
     fi
     [[ -n "$adl_resolved" && -x "$adl_resolved" ]] || {
-      echo "global-tools: kimi-hooks requires adl on PATH ($adl_executable); bun-compile installation must succeed first" >&2
+      echo "ERROR global-tools: kimi-hooks requires adl on PATH ($adl_executable); bun-compile installation must succeed first" >&2
       exit 1
     }
     echo "global-tools: kimi hooks mode=apply home=$administrator_home (as $administrator)"
@@ -2764,14 +2814,14 @@ fi
 if [[ "$mode" == apply ]]; then
   if repo_root_is_git; then
     applied_commit="$(sudo -u "$administrator" -H git -C "$repo_root" rev-parse HEAD)" || {
-      echo "could not resolve checkout commit for applied manifest identity" >&2
+      echo "ERROR could not resolve checkout commit for applied manifest identity" >&2
       exit 1
     }
   else
     # az374: the installed npm package's own version is the identity of what
     # was applied -- there is no commit to ask for.
     applied_npm_version="$(jq -er '.version | select(type == "string" and length > 0)' "$repo_root/package.json")" || {
-      echo "installed Adl package has no valid version: $repo_root/package.json" >&2
+      echo "ERROR installed Adl package has no valid version: $repo_root/package.json" >&2
       exit 1
     }
     applied_commit="npm:$applied_npm_version"
@@ -2785,83 +2835,6 @@ else
   echo "global-tools: $mode complete; no state changed"
 fi
 
-# git_maintain_repos (2026-09-30, arm-only decision the same day): an
-# explicit, closed list of repositories this device's own checkout lives
-# at OUTSIDE any recursively-scanned home directory -- the Linux VPSes'
-# root-owned /opt/adl-azdo is the confirmed case for both strato-vps-1 and
-# hostinger-vps-1 (STATUS.md's 2026-09-29 first-deployment record;
-# hostinger's own fleet-cutover --apply landed 2026-09-29T23:43Z, confirmed
-# the same day). git-maintain's own scheduling (packages/fleet/src/
-# launch-agents.ts: a dedicated compiled binary, ad-hoc signed, run by a
-# launchd LaunchAgent under TCC) is macOS-only by construction, so it never
-# reaches these checkouts on its own. This runs the job directly, on
-# reconcile's own schedule (every platform this script runs on already has
-# one), passing each declared path as `--repo` argv -- never a recursive
-# scan of a shared parent like `/opt` (which also holds unrelated,
-# explicitly off-limits directories), and never a new environment
-# variable: the list itself comes only from the manifest, and
-# GIT_MAINTAIN_DRY below is this job's own pre-existing dry/real contract,
-# driven by reconcile's own --mode exactly like every other step in this
-# file, not a knob an operator sets by hand. Absent or empty (every mac
-# device today) is a silent no-op, the same convention
-# launch_agents/scratch_repos/surface_clis already use.
-#
-# ARM-ONLY, always, on this path (independent review, 2026-09-30): the full
-# job on this SAME checkout `bin/reconcile` runs from turned out to be new,
-# unapproved, root-run behaviour once actually reasoned through, not merely
-# a self-checkout read/write ordering hazard -- see the `--arm-only`
-# decision recorded in jobs/git-maintain/src/main.ts's own header comment
-# for the full list (a silent fast-forward-driven auto-deploy of
-# `origin/integration`/main with no approval gate, colliding with
-# fleet-cutover.sh re-reading fleet-retire-list.json from this same
-# checkout after reconcile runs, `git branch -D` as root, and a fetch that
-# still runs even in dry/plan/audit mode and exits 0 on its own failure).
-# `--arm-only` narrows this call to ONLY `armHooks`: no fetch, no
-# fast-forward, no branch prune, no bundle-refresh installer, no network,
-# and no Azure DevOps identity resolution. The only remaining write is
-# `.git/config`'s `core.hooksPath`, real only in apply mode
-# (GIT_MAINTAIN_DRY=1 below makes it a `[dry] would arm ...` log line and
-# nothing else, in both plan AND audit mode). That is never a tracked file
-# this script (or anything downstream of it) reads, so arm-only has no
-# self-checkout read/write ordering hazard left to avoid -- this step stays
-# in this late position anyway, unchanged from the full-job version: it is
-# still the simplest place for it, and there is no reason to special-case
-# arm-only's position just because its own hazard is gone.
-git_maintain_repos=()
-while IFS= read -r repo; do
-  [[ -n "$repo" ]] && git_maintain_repos+=("$repo")
-done < <(jq -r --arg platform "$platform" --arg device "$device" \
-  '.[$platform].devices[$device].git_maintain_repos // [] | .[]' "$manifest")
-if [[ "${#git_maintain_repos[@]}" -gt 0 ]]; then
-  git_maintain_repo_args=(--arm-only)
-  for repo in "${git_maintain_repos[@]}"; do
-    git_maintain_repo_args+=(--repo "$repo")
-  done
-  # Unlike default-agent-file.ts/managed-settings.ts's plan branches earlier
-  # in this file (which never fail, by construction, so they run
-  # unguarded), this job's dry pass still validates each declared path is a
-  # real repo -- a genuine failure mode even in a non-apply mode, e.g. a
-  # declared checkout that has not been cloned yet. So every non-apply mode
-  # is guarded exactly like apply mode here, deliberately deviating from
-  # those sibling steps: report it, collect it, never let it abort the rest
-  # of this script under this file's own `set -e`. `$mode` (plan OR audit)
-  # is reported verbatim -- audit is a real, distinct reconcile mode, never
-  # relabeled "plan".
-  if [[ "$mode" != apply ]]; then
-    echo "global-tools: git-maintain (declared repos, arm-only) mode=$mode device=$device -> ${git_maintain_repos[*]}"
-    if ! GIT_MAINTAIN_DRY=1 bun "$repo_root/packages/fleet/jobs/git-maintain/src/main.ts" "${git_maintain_repo_args[@]}"; then
-      echo "global-tools: TOOL INSTALL FAILED: git-maintain-repos" >&2
-      failed_tools+=("git-maintain-repos")
-    fi
-  else
-    echo "global-tools: git-maintain (declared repos, arm-only) mode=apply device=$device -> ${git_maintain_repos[*]}"
-    if ! bun "$repo_root/packages/fleet/jobs/git-maintain/src/main.ts" "${git_maintain_repo_args[@]}"; then
-      echo "global-tools: TOOL INSTALL FAILED: git-maintain-repos" >&2
-      failed_tools+=("git-maintain-repos")
-    fi
-  fi
-fi
-
 # A recorded, continued-past tool failure (install_one_tool /
 # build_one_bun_tool / install_one_embedding_model_tool / write_one_shim)
 # still lets every post-pass above run -- sweep, kimi-hooks, global-agents,
@@ -2869,11 +2842,11 @@ fi
 # this point. The non-zero exit here is the only signal a caller (cron,
 # systemd, CI) needs that something needs attention.
 if [[ "${#failed_tools[@]}" -gt 0 ]]; then
-  echo "global-tools: FAILED to install/build ${#failed_tools[@]} tool(s): ${failed_tools[*]}" >&2
+  echo "ERROR global-tools: FAILED to install/build ${#failed_tools[@]} tool(s): ${failed_tools[*]}" >&2
   exit 1
 fi
 
 if [[ "$scratch_reap_failed" -eq 1 ]]; then
-  echo "global-tools: scratch reap could not verify remotes; worktree removal was refused" >&2
+  echo "ERROR global-tools: scratch reap could not verify remotes; worktree removal was refused" >&2
   exit 1
 fi