@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.46 → 0.1.48

package/bin/adl

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/adl
 size: 83039712 bytes
-sha256: 4d5b5b238a4691c251c90bba64dbf4e528e869c23c7fac82a1f07ac330b910f6
+sha256: b5c634b052b1e0d001848923690ecf8ec5208143d326ae2bcb061737c8997cb0

package/bin/reconcile

@@ -2119,8 +2119,13 @@ run_surface_update() {
 surface_update_error_reason() {
   local output="$1" plain line
   # LC_ALL=C: the strip is bytewise. Under en_US.UTF-8 glibc resolves [@-~]
-  # by collation, so the escape's final letter would never match.
-  plain="$(LC_ALL=C sed -E $'s/\x1b\\[[0-9;]*[@-~]//g' <<<"$output")"
+  # by collation, so the escape's final letter would never match. The
+  # ANSI strip uses `tr` to delete ESC bytes first -- BSD sed on macOS has a
+  # long-standing segfault (exit 139) when fed input that contains the ESC
+  # byte directly in a $'\x1b...' pattern, so we remove the byte in a
+  # bytewise pass and let sed handle the bracketed parameter sequences that
+  # remain (which do not contain ESC).
+  plain="$(LC_ALL=C tr -d '\033' <<<"$output" | LC_ALL=C sed -E 's/\[[0-9;]*[@-~]//g')"
   local error_re='^[[:space:]]*(✖[[:space:]]*)?[eE][rR][rR][oO][rR]:' candidate
   line=""
   while IFS= read -r candidate; do

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amsterdamdatalabs/adl-agent-control-linux-x64",
-  "version": "0.1.46",
+  "version": "0.1.48",
   "description": "adl CLI binary for linux/x64 (agent identity + Azure DevOps front door — see docs/architecture/cli-design.md)",
   "license": "UNLICENSED",
   "os": [

package/packages/agent-hooks/src/rules/impl/git-branch.ts

@@ -7,7 +7,7 @@ import { branchMutates, isHelpOnlyInvocation, isSequencerRecoveryOnly, switchChe
 import { LANDING_SUBCOMMANDS, resolveGitTarget } from './git-target.ts'
 import { gitAgentTail } from './messages.ts'
 
-const ASK_USER = 'ask the user for git branch operations'
+const ASK_USER = 'you are enforced to commit and push to the same branch, branches are not agent\'s choice. treat them as given and continue on the same branch without stopping'
 
 const UNRESOLVED =
   'The commit target (which repository and branch this would land on) could not be determined statically from this command line. ' +

package/packages/agent-skills/assets/write-feature/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: write-feature
-description: Live, human-attended session that creates a Feature on the ADO board, parent Epic chosen by the human and at least one predecessor Feature unless it is the very first, and writes its intent.md in the human's own words, then lands it through a docs branch and PR. Use when Tarun asks to start, create or write up a new Feature or its intent. Never dispatched.
+description: Live, human-attended session that creates a Feature on the ADO board under a parent Epic read from `[azdo.scope.epics]` in `adl-config.toml`, captures the human's intent verbatim into intent.md, and lands it through a docs branch and PR. Use when Tarun asks to start, create or write up a new Feature or its intent. Never dispatched.
 metadata:
   step: "live"
   role: "session agent with the human"
@@ -22,8 +22,7 @@ Load `workitems-process` first. This card adds only what the live Feature sessio
 | Input | Rule |
 |---|---|
 | The Feature in their words | Why, Outcome, Constraints, Non-goals; Open questions optional |
-| Parent Epic | **The human chooses.** Never guess, never create |
-| Predecessor Features | At least 1, unless the human says this is the very first Feature |
+| Parent Epic | Check `[azdo.scope.epics]` in `adl-config.toml` first and use the listed Epic that fits the Feature. If none fits, ask the human before allocating. Never guess, never create. |
 | Title and slug | Human confirms both |
 
 ## Preconditions
@@ -33,19 +32,18 @@ Load `workitems-process` first. This card adds only what the live Feature sessio
 
 ## Procedure
 
-Ask **one question at a time**. Lead with what you already know.
+The human gives one shot of intent in their own words; you capture it verbatim, allocate the Feature, write `intent.md`, and land the docs PR in the same session. **Do not loop the human for re-stating what they already gave.** You may ask at most ONE batching question to resolve hard blockers (parent Epic id, title, slug). Everything else — the four `intent.md` sections — is taken from the human's already-given words or read back to them as a final check before any board call.
 
-1. **Listen.** Take the human's words. Do not rewrite, extend or "improve" them. Do not add a solution.
-2. **Fill gaps, not prose.** For each required section the human left empty (`## Why`, `## Outcome`, `## Constraints`, `## Non-goals`), ask for it. `## Open questions` is optional; add it only if the human has some.
-3. **Predecessors.** List candidate Features (`workitem_list_or_get --type Feature`) and let the human pick. A Feature needs at least 1 predecessor Feature; only the very first has none. The human says which case applies; you do not infer it. Enforcement is soft then hard: pending L2 in adl-agent-control.
-4. **Allocate the Feature on the board first.** `workitem_create_or_update_feature --title "<title>" --parent-id <epic> --predecessors <ids> --description "<Why, Outcome, Constraints, Non-goals>" --priority <1|2|3|4>`. State stays New (the tool refuses any other create state: pending F3). Mandatory at create: `title`, `parentId` (Epic), `description` (must carry the four intent.md headings `## Why` / `## Outcome` / `## Constraints` / `## Non-goals`), and `priority` ∈ `{1, 2, 3, 4}` (1=Very High, 2=High, 3=Medium, 4=Low). State-conditional gate — when moving off `New` (e.g. to `In Progress`), the call also requires `acceptanceCriteria` plus the three plan fields (`--plan-revision`, `--plan-hash`, `--baseline-sha`); create at `New` does not. Read it back: type Feature, state New, parent = the Epic, predecessors present. A refusal is the answer: report the exact text, stop, create nothing.
-   - **Description = copy of `intent.md`.** Pass the human's own `## Why`, `## Outcome`, `## Constraints`, `## Non-goals` text, verbatim and identical to what step 5 writes, as `--description` at create. Written once, here. Agents never edit it afterwards, the same as `intent.md`. The approved plan lives in the `plan-r<N>-<sha7>.md` attachment, not in the Description.
+1. **Capture, do not paraphrase.** Pull the four headings (`## Why`, `## Outcome`, `## Constraints`, `## Non-goals`) directly from the human's message. Use the human's own sentences, in the human's own order, with the human's own bullets. If they gave one paragraph, break it into bullets without renaming or rewording. If they gave bullets, keep the bullets. **No "improving".** If a heading is genuinely absent, copy the heading with a single placeholder bullet `- <missing: the human owes this line>` and STOP — do not write a guess.
+2. **One batching question, no more.** Ask exactly the questions the human has not answered and that you cannot invent: parent Epic id, title, slug. Everything else (`Why`/`Outcome`/`Constraints`/`Non-goals` text) comes from what the human already said. Asking again to confirm what is already on the page is a stop-rule violation.
+3. **Allocate the Feature on the board first.** `workitem_create_or_update_feature --title "<title>" --parent-id <epic> --description "<Why, Outcome, Constraints, Non-goals>" --priority <1|2|3|4>`. State stays New (the tool refuses any other create state: pending F3). Mandatory at create: `title`, `parentId` (Epic), `description` (must carry the four intent.md headings `## Why` / `## Outcome` / `## Constraints` / `## Non-goals`), and `priority` ∈ `{1, 2, 3, 4}` (1=Very High, 2=High, 3=Medium, 4=Low). State-conditional gate — when moving off `New` (e.g. to `In Progress`), the call also requires `acceptanceCriteria` plus the three plan fields (`--plan-revision`, `--plan-hash`, `--baseline-sha`); create at `New` does not. Read it back: type Feature, state New, parent = the Epic. A refusal is the answer: report the exact text, stop, create nothing.
+   - **Description = copy of `intent.md`.** Pass the human's own `## Why`, `## Outcome`, `## Constraints`, `## Non-goals` text, verbatim and identical to what step 4 writes, as `--description` at create. Written once, here. Agents never edit it afterwards, the same as `intent.md`. The approved plan lives in the `plan-r<N>-<sha7>.md` attachment, not in the Description.
    - Do not touch Features 548-554 ("Fixes to closed Features"); their description is already set.
    - Never create an Epic. Never set `epic:` from tool output; it is the human's value.
-5. **Write `plans/features/az<id>-<slug>/intent.md`.** The id is allocated before the file exists. Layout below. No other file in the folder.
-6. **Read it back to the human.** Commit only after an explicit yes. After that, agents never edit `intent.md`; only the human does.
-7. **Land it.** An ordinary docs change. You create the intent branch from the integration base: the one exception to "agents never create a branch." Add the `plans/LEDGER.md` row `az<id>-intent`. Commit `docs(plans): add intent for az<id> <slug>`. Push. Open the PR with `pr_create_or_update`, with the five PR body sections (Summary, Why, Changes, Test plan, Security impact considered); `## Test plan` and `## Security impact considered` say "none (docs-only)". The branch is not the planning branch and the Feature has no item at Approved or later (PBIs the human already made sit at New), so this is an ordinary PR: the tool links nothing, moves nothing, attaches nothing, and it needs no implementation report. Never rebase or force-push. No reviewer, no vote ([Human gates](../workitems-process/SKILL.md#human-gates)).
-8. **Stop.** Report: Feature URL, branch, PR URL. Say the Feature is at New and the planning trigger ([Targets and triggers](../workitems-process/SKILL.md#targets-and-triggers)) fires on it once the PR has merged. Do not start planning.
+4. **Write `plans/features/az<id>-<slug>/intent.md`.** The id is allocated before the file exists. Layout below. No other file in the folder.
+5. **Read it back to the human.** Commit only after an explicit yes. After that, agents never edit `intent.md`; only the human does.
+6. **Land it.** An ordinary docs change. You create the intent branch from the integration base: the one exception to "agents never create a branch." Add the `plans/LEDGER.md` row `az<id>-intent`. Commit `docs(plans): add intent for az<id> <slug>`. Push. Open the PR with `pr_create_or_update`, with the five PR body sections (Summary, Why, Changes, Test plan, Security impact considered); `## Test plan` and `## Security impact considered` say "none (docs-only)". The branch is not the planning branch and the Feature has no item at Approved or later (PBIs the human already made sit at New), so this is an ordinary PR: the tool links nothing, moves nothing, attaches nothing, and it needs no implementation report. Never rebase or force-push. No reviewer, no vote ([Human gates](../workitems-process/SKILL.md#human-gates)).
+7. **Stop.** Report: Feature URL, branch, PR URL. Say the Feature is at New and the planning trigger ([Targets and triggers](../workitems-process/SKILL.md#targets-and-triggers)) fires on it once the PR has merged. Do not start planning.
 
 ## `intent.md` layout
 
@@ -81,14 +79,14 @@ last_update: <YYYY-MM-DDTHH:MM:SSZ>
 
 ## Stop rules
 
-- Epic not given, or the human cannot say whether a predecessor exists → stop and ask; never default.
+- Epic not given → stop and ask; never default.
 - A refused create or a failed read-back → stop with the exact error; no file before the id.
 - Same command fails twice for the same reason → stop and report.
 
 ## Never
 
 - Never write, extend or paraphrase the human's intent for them.
-- Never choose the Epic or a predecessor.
+- Never choose the Epic.
 - Never create PBIs here; planning creates them. PBIs the human already made stay at New and planning reads them.
 - Never move a state, never plan, never post a run report.
 - Never edit `intent.md` after the human approved it.

package/bin/lean-ctx-observe-strip

@@ -1,434 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-export PATH="/usr/local/bin:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
-
-# lean-ctx-observe-strip -- the per-device half of STATUS.md 12p item 13.
-# Final scope (2026-09-29, Tarun, relayed through the orchestrator; see
-# bin/lib/lean-ctx-observe-hooks.sh's header for the full decision trail):
-# lean-ctx hooks are "moved to repo level" and must be REMOVED FROM GLOBAL --
-# the per-repo carrier (`adl hook lean-ctx pre-tool-use|post-tool-use`,
-# written by `adl hooks deploy`) already provides rewrite/redirect/
-# read-dedup with the repo's own config, and `observe` has no per-repo
-# carrier at all and is dropped outright. Six carriers, all written by
-# `lean-ctx setup`, are covered ("fix all the lean-ctx issues" -- Tarun,
-# 2026-09-29 -- widened this from an initial two-of-five scope):
-#   1. Raw, unwrapped `lean-ctx hook <subcommand>` entries -- observe,
-#      rewrite, redirect, read-dedup, any other -- in the two JSON
-#      hook-map files that can carry one: $HOME/.claude/settings.json and
-#      $HOME/.codex/hooks.json.
-#   2. The universal shell hook marker block (`# >>> lean-ctx shell hook
-#      >>>` ... `# <<< lean-ctx shell hook <<<`).
-#   3. `~/.zshrc`'s own differently-shaped shell hook block (an em dash,
-#      not `>>>`/`<<<`): `# lean-ctx shell hook — begin` ... `... — end`,
-#      sourcing a separate `~/.config/lean-ctx/shell-hook.zsh`.
-#   4. The agent-launcher aliases block: `# >>> lean-ctx agent aliases
-#      >>>` ... `# <<< lean-ctx agent aliases <<<`.
-#   Shapes 2-4 are all matched in the per-user shell rc/env files they can
-#   appear in: $HOME/.bashenv, .zshenv, .bashrc, .zshrc, .bash_profile,
-#   .zprofile, .profile -- see bin/lib/lean-ctx-observe-hooks.sh's header
-#   for exactly which marker text each shape matches, its trailing-
-#   whitespace tolerance, and its malformed-nesting/near-miss detection.
-#   5. Global lean-ctx SKILL.md directories (frontmatter `name: lean-ctx`)
-#      at $HOME/.claude/skills/lean-ctx, .codex/skills/lean-ctx,
-#      .cursor/skills/lean-ctx, .config/opencode/skills/lean-ctx,
-#      .agents/skills/lean-ctx.
-#   6. Global lean-ctx hook SCRIPTS: every entry named `lean-ctx-*` directly
-#      under $HOME/.claude/hooks (lean-ctx-rewrite.sh, lean-ctx-redirect.sh,
-#      their -native counterparts, and any .bak copies). Added 2026-09-30
-#      because of lean-ctx's own startup refresh gate (proven from v3.10.5
-#      source, rust/src/hooks/mod.rs): refresh_installed_hooks() re-writes
-#      the global Claude hooks whenever hooks_installed_for("claude", home)
-#      is true, i.e. <claude_dir>/hooks/lean-ctx-rewrite.sh EXISTS or
-#      <claude_dir>/settings.json contains the substring `lean-ctx`.
-#      Stripping settings.json (shape 1) alone leaves the scripts behind and
-#      the gate armed, so the carrier rewrites the global hooks on its next
-#      start. Only names starting with `lean-ctx-` are touched; every other
-#      file there (enact-*, code-simplifier.mjs, lib/, symlinks to other
-#      repos) is left alone. Scope is $HOME/.claude only -- CLAUDE_CONFIG_DIR
-#      is deliberately not consulted (the tool takes --home explicitly).
-# `adl hook lean-ctx ...` (the per-repo carrier) and Orca's own hooks are
-# never touched -- see bin/lib/lean-ctx-observe-hooks.sh's own header for
-# exactly why the match can never catch either, and for the full "which
-# files can carry this, and why the others can't" accounting. `~/.config/
-# lean-ctx/` itself (which shape 3 sources) is deliberately left alone --
-# Tarun uses the global CLI directly from his own terminal -- flagged in
-# that same header, not stripped. Run by bin/reconcile on every
-# reconciliation (plan AND apply, exactly like bin/kimi-hooks /
-# bin/opencode-hooks) so a hand-edited or Orca-reinstalled per-user config
-# never lets any of the six carriers creep back in unnoticed.
-#
-# Usage: lean-ctx-observe-strip --home ABSOLUTE_PATH --mode plan|apply
-#
-#   plan:  READ-ONLY. Prints what apply would do; never writes, never backs
-#          up. A second run (plan or apply) against an already-clean home is
-#          a no-op.
-#   apply: For each target that still carries its carrier, backs it up
-#          first (same "<path>.pre-<label>-<UTC compact timestamp>" shape
-#          every other backup in this codebase uses -- bin/reconcile's own
-#          strip_backup_suffix recovers the original path from it, except
-#          for a skill directory's backup, which sits OUTSIDE the scanned
-#          skills/ tree and is reported via its own explicit two-path
-#          note; see strip_skill_dir_one below and final review finding
-#          1), then rewrites/moves it via the shared
-#          bin/lib/lean-ctx-observe-hooks.sh helpers. A JSON file that
-#          fails to parse, a shell file with a malformed marker (unclosed,
-#          nested, orphaned, or a near-miss mention of the marker phrase
-#          that doesn't exactly match a known marker line), is a loud
-#          failure (non-zero exit, nothing written) -- never a silent skip
-#          or a partial edit. A target with nothing to strip, or that does
-#          not exist, is reported and left alone. A skill directory is
-#          moved (never deleted) only when its SKILL.md frontmatter says
-#          `name: lean-ctx`; any other content there is left alone and
-#          reported. The `lean-ctx-*` hook scripts under ~/.claude/hooks are
-#          moved (never deleted) into a sibling
-#          `hooks.pre-lean-ctx-observe-strip-<UTC ts>/` directory OUTSIDE
-#          the scanned hooks/ directory, exactly like a skill directory's
-#          backup, and reported one line per file. Refuses outright (before touching anything) when run
-#          as literal root (EUID 0) against a --home it does not own --
-#          bin/reconcile's apply path never does this itself; see
-#          lean_ctx_observe_strip_guard_euid in the shared lib.
-
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
-command -v jq >/dev/null 2>&1 || {
-  echo "lean-ctx-observe-strip requires jq" >&2
-  exit 1
-}
-
-# shellcheck source=lib/lean-ctx-observe-hooks.sh
-source "$script_dir/lib/lean-ctx-observe-hooks.sh"
-
-usage() {
-  echo "usage: lean-ctx-observe-strip --home ABSOLUTE_PATH --mode plan|apply" >&2
-  exit 2
-}
-
-home=""
-mode=""
-while [[ "$#" -gt 0 ]]; do
-  case "$1" in
-    --home) home="${2:-}"; shift 2 ;;
-    --mode) mode="${2:-}"; shift 2 ;;
-    *) usage ;;
-  esac
-done
-[[ -n "$home" ]] || usage
-[[ "$mode" == plan || "$mode" == apply ]] || usage
-
-# Final review finding 5: refuse before touching anything if this is a
-# literal-root (EUID 0) invocation against a --home it does not own -- see
-# lean_ctx_observe_strip_guard_euid's own header for exactly why this can
-# never fire on bin/reconcile's real apply path (macOS: already dropped to
-# the administrator; Linux: administrator IS root, home IS /root).
-lean_ctx_observe_strip_guard_euid "$EUID" "$home" || exit 1
-
-# backup_file_safely <path> <backup> -- creates <backup> (a brand-new path)
-# holding a copy of <path>'s content and mode, WITHOUT ever following a
-# pre-existing file or symlink that happens to already sit at <backup>
-# (final review finding 5: a predictable, timestamp-based backup path
-# could be pre-planted by an attacker with write access to the same
-# directory; a plain `cp -p "$path" "$backup"` FOLLOWS an existing
-# symlink there and overwrites whatever it points at). `set -C`
-# (noclobber) reserves the name atomically first -- verified live, not
-# assumed: refuses to open `>` through both a valid and a dangling
-# pre-existing symlink at that exact path, on this machine's real bash,
-# leaving the symlink's target completely untouched either way -- and only
-# once that empty placeholder is confirmed OURS does `cp -p` fill it in.
-backup_file_safely() {
-  local path="$1" backup="$2"
-  if ! ( set -C; : > "$backup" ) 2>/dev/null; then
-    return 1
-  fi
-  cp -p "$path" "$backup"
-}
-
-# The two per-user JSON hook-map files that can carry a raw
-# `lean-ctx hook <subcommand>` entry -- see bin/lib/lean-ctx-observe-hooks.sh's
-# header for the read-only accounting of every other per-user agent config
-# file this machine has, and why each of those is NOT a target.
-targets=(
-  "$home/.claude/settings.json"
-  "$home/.codex/hooks.json"
-)
-
-# The per-user shell rc/env files `lean-ctx setup` can write any of the
-# three shell-hook marker shapes into (confirmed live: .zshenv and
-# .bashenv both carry shape 2 after a real `lean-ctx setup` run, .zshrc
-# carries shapes 3 and 4; the others are included because the same
-# installer step targets the whole rc/env family).
-shell_hook_targets=(
-  "$home/.bashenv"
-  "$home/.zshenv"
-  "$home/.bashrc"
-  "$home/.zshrc"
-  "$home/.bash_profile"
-  "$home/.zprofile"
-  "$home/.profile"
-)
-
-# The global lean-ctx SKILL.md directories `lean-ctx setup` can write, one
-# per agent surface it detects (confirmed live for Claude/Codex/OpenCode;
-# Cursor and .agents included for the same reason as above -- the
-# installer targets the whole surface family, not just the ones detected
-# on any one machine).
-skill_dir_targets=(
-  "$home/.claude/skills/lean-ctx"
-  "$home/.codex/skills/lean-ctx"
-  "$home/.cursor/skills/lean-ctx"
-  "$home/.config/opencode/skills/lean-ctx"
-  "$home/.agents/skills/lean-ctx"
-)
-
-strip_one() {
-  local path="$1"
-  if [[ ! -f "$path" ]]; then
-    echo "lean-ctx-observe-strip: $path: not present -- nothing to strip"
-    return 0
-  fi
-  local events
-  if ! events="$(lean_ctx_observe_hook_events "$path")"; then
-    echo "lean-ctx-observe-strip: $path: FAILED to parse as JSON -- not modified" >&2
-    return 1
-  fi
-  if [[ -z "$events" ]]; then
-    echo "lean-ctx-observe-strip: $path: no raw lean-ctx hook entries found"
-    return 0
-  fi
-  echo "lean-ctx-observe-strip: $path: found raw lean-ctx hook entries under: $events"
-  if [[ "$mode" != apply ]]; then
-    echo "lean-ctx-observe-strip: would strip raw lean-ctx hook entries from $path (events: $events)"
-    return 0
-  fi
-  local backup
-  backup="${path}.pre-lean-ctx-observe-strip-$(date -u +%Y%m%dT%H%M%SZ)"
-  if ! backup_file_safely "$path" "$backup"; then
-    echo "lean-ctx-observe-strip: backup of $path to $backup did not complete -- $path was NOT modified" >&2
-    return 1
-  fi
-  echo "lean-ctx-observe-strip: backed up previous config to $backup"
-  local staged
-  staged="$(mktemp "$(dirname "$path")/.$(basename "$path").filtered.XXXXXX" 2>/dev/null)" || {
-    echo "lean-ctx-observe-strip: $path: FAILED to allocate staging file -- not modified (backup: $backup)" >&2
-    return 1
-  }
-  if ! lean_ctx_observe_hook_filtered "$path" "$staged"; then
-    echo "lean-ctx-observe-strip: $path: FAILED to compute filtered content -- not modified (backup: $backup)" >&2
-    rm -f "$staged"
-    return 1
-  fi
-  if ! lean_ctx_observe_hook_write "$path" "$staged"; then
-    echo "lean-ctx-observe-strip: $path: FAILED to write -- not modified (backup: $backup)" >&2
-    rm -f "$staged"
-    return 1
-  fi
-  rm -f "$staged"
-  echo "lean-ctx-observe-strip: stripped raw lean-ctx hook entries from $path (backup: $backup)"
-  return 0
-}
-
-# strip_shell_hook_one <path> -- covers all THREE shell-hook marker shapes
-# bin/lib/lean-ctx-observe-hooks.sh's header documents, via ONE single-pass
-# call to lean_ctx_shell_rc_scan_and_filter: one backup, one write, never
-# one per shape, even for a file (a real `~/.zshrc`) carrying more than
-# one. Malformed input in ANY shape (unclosed, nested, orphaned, or a
-# near-miss marker-phrase mention) aborts before any write, with the
-# backup only ever created once something is confirmed found.
-strip_shell_hook_one() {
-  local path="$1"
-  if [[ ! -f "$path" ]]; then
-    echo "lean-ctx-observe-strip: $path: not present -- nothing to strip"
-    return 0
-  fi
-
-  local staged report
-  staged="$(mktemp "$(dirname "$path")/.$(basename "$path").filtered.XXXXXX" 2>/dev/null)" || {
-    echo "lean-ctx-observe-strip: $path: FAILED to allocate staging file -- not modified" >&2
-    return 1
-  }
-  report="$(mktemp "$(dirname "$path")/.$(basename "$path").report.XXXXXX" 2>/dev/null)" || {
-    echo "lean-ctx-observe-strip: $path: FAILED to allocate report file -- not modified" >&2
-    rm -f "$staged"
-    return 1
-  }
-
-  if ! lean_ctx_shell_rc_scan_and_filter "$path" "$staged" "$report"; then
-    echo "lean-ctx-observe-strip: $path: FAILED -- see the malformed-marker message above -- not modified" >&2
-    rm -f "$staged" "$report"
-    return 1
-  fi
-
-  local found1=absent found2=absent found3=absent line
-  while IFS= read -r line; do
-    case "$line" in
-      1:*) found1="${line#1:}" ;;
-      2:*) found2="${line#2:}" ;;
-      3:*) found3="${line#3:}" ;;
-    esac
-  done < "$report"
-  rm -f "$report"
-
-  [[ "$found1" == present ]] && echo "lean-ctx-observe-strip: $path: found lean-ctx shell hook marker block" \
-    || echo "lean-ctx-observe-strip: $path: no lean-ctx shell hook marker found"
-  [[ "$found2" == present ]] && echo "lean-ctx-observe-strip: $path: found lean-ctx shell hook marker block (zshrc begin/end form)" \
-    || echo "lean-ctx-observe-strip: $path: no lean-ctx shell hook marker (zshrc begin/end form) found"
-  [[ "$found3" == present ]] && echo "lean-ctx-observe-strip: $path: found lean-ctx agent aliases marker block" \
-    || echo "lean-ctx-observe-strip: $path: no lean-ctx agent aliases marker found"
-
-  if [[ "$found1" != present && "$found2" != present && "$found3" != present ]]; then
-    rm -f "$staged"
-    return 0
-  fi
-
-  if [[ "$mode" != apply ]]; then
-    [[ "$found1" == present ]] && echo "lean-ctx-observe-strip: would strip lean-ctx shell hook marker block from $path"
-    [[ "$found2" == present ]] && echo "lean-ctx-observe-strip: would strip lean-ctx shell hook marker block (zshrc begin/end form) from $path"
-    [[ "$found3" == present ]] && echo "lean-ctx-observe-strip: would strip lean-ctx agent aliases marker block from $path"
-    rm -f "$staged"
-    return 0
-  fi
-
-  local backup
-  backup="${path}.pre-lean-ctx-observe-strip-$(date -u +%Y%m%dT%H%M%SZ)"
-  if ! backup_file_safely "$path" "$backup"; then
-    echo "lean-ctx-observe-strip: backup of $path to $backup did not complete -- $path was NOT modified" >&2
-    rm -f "$staged"
-    return 1
-  fi
-  echo "lean-ctx-observe-strip: backed up previous config to $backup"
-
-  if ! lean_ctx_observe_hook_write "$path" "$staged"; then
-    echo "lean-ctx-observe-strip: $path: FAILED to write -- not modified (backup: $backup)" >&2
-    rm -f "$staged"
-    return 1
-  fi
-  rm -f "$staged"
-
-  [[ "$found1" == present ]] && echo "lean-ctx-observe-strip: stripped lean-ctx shell hook marker block from $path (backup: $backup)"
-  [[ "$found2" == present ]] && echo "lean-ctx-observe-strip: stripped lean-ctx shell hook marker block (zshrc begin/end form) from $path (backup: $backup)"
-  [[ "$found3" == present ]] && echo "lean-ctx-observe-strip: stripped lean-ctx agent aliases marker block from $path (backup: $backup)"
-  return 0
-}
-
-# strip_skill_dir_one <dir> -- final review finding 1 (HIGH): the backup
-# location is a SIBLING of the scanned `skills/` directory
-# (`<surface>/skills.pre-lean-ctx-observe-strip-<ts>/<leaf>`), never a path
-# INSIDE it. The previous shape (`skills/<leaf>.pre-...-<ts>`) left the
-# moved directory's own SKILL.md -- frontmatter `name: lean-ctx` and all --
-# still sitting directly under `skills/`, where any surface that globs
-# `skills/*/SKILL.md` by frontmatter name would load it right back up as a
-# live skill; the whole point of "moved, never deleted" was to make it
-# INERT, not just renamed. Reported via its own explicit two-path "backed
-# up previous skill directory <original> to <backup>" note (distinct from
-# the single-path "backed up previous config to <path>" the JSON/shell-hook
-# carriers use) because the new backup path no longer ends in
-# `.pre-<label>-<timestamp>` -- bin/reconcile's suffix-stripping
-# strip_backup_suffix can't recover the original from it, so the original
-# is stated directly instead; see bin/reconcile's
-# collect_lean_ctx_observe_strip_backups.
-strip_skill_dir_one() {
-  local dir="$1"
-  if [[ ! -e "$dir" ]]; then
-    echo "lean-ctx-observe-strip: $dir: not present -- nothing to strip"
-    return 0
-  fi
-  local skill_md="$dir/SKILL.md"
-  if [[ ! -f "$skill_md" ]]; then
-    echo "lean-ctx-observe-strip: $dir: present but has no SKILL.md -- left alone"
-    return 0
-  fi
-  local name
-  name="$(lean_ctx_skill_frontmatter_name "$skill_md")"
-  if [[ "$name" != "$LEAN_CTX_SKILL_FRONTMATTER_NAME" ]]; then
-    echo "lean-ctx-observe-strip: $dir: SKILL.md frontmatter name is '${name:-<none>}', not lean-ctx -- left alone"
-    return 0
-  fi
-  echo "lean-ctx-observe-strip: $dir: found lean-ctx skill directory (SKILL.md name: lean-ctx)"
-  if [[ "$mode" != apply ]]; then
-    echo "lean-ctx-observe-strip: would move $dir to a timestamped backup location outside the scanned skills/ directory"
-    return 0
-  fi
-  local skills_dir leaf backup_root backup
-  skills_dir="$(dirname "$dir")"
-  leaf="$(basename "$dir")"
-  backup_root="${skills_dir}.pre-lean-ctx-observe-strip-$(date -u +%Y%m%dT%H%M%SZ)"
-  backup="$backup_root/$leaf"
-  if ! mkdir "$backup_root" 2>/dev/null; then
-    echo "lean-ctx-observe-strip: $dir: FAILED to create backup location $backup_root -- not modified" >&2
-    return 1
-  fi
-  if ! mv "$dir" "$backup"; then
-    echo "lean-ctx-observe-strip: $dir: FAILED to move to $backup -- not modified" >&2
-    return 1
-  fi
-  echo "lean-ctx-observe-strip: backed up previous skill directory $dir to $backup"
-  echo "lean-ctx-observe-strip: moved lean-ctx skill directory $dir to $backup"
-  return 0
-}
-
-# strip_hook_scripts_one <hooks-dir> -- shape 6 (see the header): moves every
-# entry named `lean-ctx-*` directly under <hooks-dir> into a sibling
-# `<hooks-dir>.pre-lean-ctx-observe-strip-<UTC ts>/` directory (OUTSIDE the
-# scanned hooks/ directory, same reasoning as strip_skill_dir_one), so
-# lean-ctx's refresh gate (`hooks/lean-ctx-rewrite.sh` exists) is disarmed.
-# Matches by name prefix only, never by content; a symlink named
-# `lean-ctx-*` is moved as the link itself (mv never follows it). Nothing
-# else in <hooks-dir> is read or touched. Each file is reported as
-# "backed up previous hook script <original> to <backup>" (two explicit
-# paths, like the skill-directory note -- the backup path does not end in
-# `.pre-<label>-<timestamp>`, so bin/reconcile cannot recover the original
-# by suffix-stripping).
-strip_hook_scripts_one() {
-  local hooks_dir="$1" entry
-  local found=()
-  if [[ -d "$hooks_dir" ]]; then
-    for entry in "$hooks_dir"/lean-ctx-*; do
-      if [[ -e "$entry" || -L "$entry" ]]; then
-        found+=("$entry")
-      fi
-    done
-  fi
-  if [[ "${#found[@]}" -eq 0 ]]; then
-    echo "lean-ctx-observe-strip: $hooks_dir/lean-ctx-*: not present -- nothing to strip"
-    return 0
-  fi
-  for entry in "${found[@]}"; do
-    echo "lean-ctx-observe-strip: $entry: found lean-ctx hook script"
-    if [[ "$mode" != apply ]]; then
-      echo "lean-ctx-observe-strip: would move $entry to a timestamped backup location outside $hooks_dir"
-    fi
-  done
-  [[ "$mode" == apply ]] || return 0
-
-  local backup_root
-  backup_root="${hooks_dir}.pre-lean-ctx-observe-strip-$(date -u +%Y%m%dT%H%M%SZ)"
-  if ! mkdir "$backup_root" 2>/dev/null; then
-    echo "lean-ctx-observe-strip: $hooks_dir: FAILED to create backup location $backup_root -- not modified" >&2
-    return 1
-  fi
-  local backup rc=0
-  for entry in "${found[@]}"; do
-    backup="$backup_root/$(basename "$entry")"
-    if ! mv "$entry" "$backup"; then
-      echo "lean-ctx-observe-strip: $entry: FAILED to move to $backup -- not modified" >&2
-      rc=1
-      continue
-    fi
-    echo "lean-ctx-observe-strip: backed up previous hook script $entry to $backup"
-    echo "lean-ctx-observe-strip: moved lean-ctx hook script $entry to $backup"
-  done
-  return "$rc"
-}
-
-status=0
-for target in "${targets[@]}"; do
-  strip_one "$target" || status=1
-done
-for target in "${shell_hook_targets[@]}"; do
-  strip_shell_hook_one "$target" || status=1
-done
-for target in "${skill_dir_targets[@]}"; do
-  strip_skill_dir_one "$target" || status=1
-done
-strip_hook_scripts_one "$home/.claude/hooks" || status=1
-exit "$status"