@event4u/agent-config 16.4.0 → 17.0.0

package/src/install/wizard-plan.ts

@@ -9,7 +9,7 @@
  * {@link buildInstallPlan}.
  *
  * Mirrors the canonical mapping tables in
- * `scripts/install.py:2029-2222`:
+ * the retired Python installer, line 2029-2222:
  *   - {@link USER_SCOPE_PATHS}     ← `USER_SCOPE_PATHS`
  *   - {@link GLOBAL_DEPLOY_SOURCES} ← `_CLAUDE_SKILL_BUNDLE` + `GLOBAL_DEPLOY_SOURCES`
  *
@@ -27,7 +27,7 @@ import { ruleFileArrives, LEGACY_ALL, type RuleScope } from './rule_scope.js';
 
 /**
  * Per-tool user-scope anchor directory, mirrored 1:1 from
- * `scripts/install.py:USER_SCOPE_PATHS`. Values may use `~` for the
+ * `USER_SCOPE_PATHS` in the retired Python installer. Values may use `~` for the
  * user's home directory; {@link expandAnchor} resolves it server-side.
  *
  * Tools without a user-scope directory convention (e.g. `claude-desktop`
@@ -98,7 +98,7 @@ const CLAUDE_SKILL_BUNDLE: ReadonlyArray<readonly [string, string]> = [
     // subdirs route as `/<cluster>:<sub>`. Council session 2026-05-28
     // converged on Option B (native slash-only) — see
     // agents/runtime/council/responses/claude-code-distribution.json
-    // and scripts/install.py:_CLAUDE_SKILL_BUNDLE for the Python mirror.
+    // and `_CLAUDE_SKILL_BUNDLE` in the retired Python installer for the Python mirror.
     ['dist/agent-src/commands', 'commands'],
     ['dist/agent-src/personas', 'personas'],
 ];
@@ -110,7 +110,7 @@ const CLAUDE_SKILL_BUNDLE: ReadonlyArray<readonly [string, string]> = [
  * `packageSrcRelative` resolves against the agent-config package root;
  * `destSubpath` is appended to `USER_SCOPE_PATHS[toolId]` (expanded).
  *
- * Mirrors `GLOBAL_DEPLOY_SOURCES` in `scripts/install.py:2178-2222`.
+ * Mirrors `GLOBAL_DEPLOY_SOURCES` in the retired Python installer, line 2178-2222.
  * Tools absent from this map have no deployable content in global scope
  * — they either follow a marker-only convention (handled by bridges in
  * Phase A6) or have no markdown convention at all.
@@ -269,3 +269,24 @@ export function buildPlanFromWizard(inputs: WizardPlanInputs): InstallPlan {
         policy: inputs.policy,
     });
 }
+
+/**
+ * The `target` block of a dry-run plan summary.
+ *
+ * A global install has no project target, and printing the cwd here read as
+ * "this is where it writes" — under npx the cwd is often the npx cache, so the
+ * plan named a directory the install never touches. For global it prints the
+ * anchor of each SELECTED tool and which phases would run.
+ */
+export function dryRunTargetLines(global: boolean, tools: Iterable<string>, projectTarget: string): string {
+    if (!global) return `  target:      ${projectTarget}\n`;
+    let out = '  target:      user-scope host paths (no project target)\n';
+    for (const tool of tools) {
+        const anchor = USER_SCOPE_PATHS[tool];
+        if (anchor === undefined) continue;
+        out += `      ${tool} → ${anchor.startsWith('~/') ? join(homedir(), anchor.slice(2)) : anchor}\n`;
+    }
+    out += '  phases:      project payload sync — skipped (global installs write user-scope paths only)\n';
+    out += '               host projection + managed hooks — would run\n';
+    return out;
+}

package/src/scripts/_cli/_doctor_emit.ts

@@ -32,6 +32,30 @@ function print(line = ''): void {
     process.stdout.write(`${line}\n`);
 }
 
+/** Visible status → glyph map (`warn` keeps a trailing space for alignment). */
+export const STATUS_SYMBOLS: Record<string, string> = {
+    ok: '✅',
+    warn: '⚠️ ',
+    fail: '❌',
+    skipped: '⏭️ ',
+};
+
+/** The check rows in text mode — moved here with `STATUS_SYMBOLS` to pay for `update_verdict`. */
+export function _emit_checks_text(checks: Dict[]): void {
+    if (checks.length === 0) {
+        return;
+    }
+    print('checks:');
+    for (const c of checks) {
+        const sym = STATUS_SYMBOLS[c['status'] as string] ?? '?';
+        print(`  ${sym} ${c['id']}: ${c['message']}`);
+        if (c['status'] !== 'ok' && c['remedy']) {
+            print(`      fix: ${c['remedy']}`);
+        }
+    }
+    print('');
+}
+
 export function _emit_text(
     project_root: string,
     missing: Dict[],

package/src/scripts/_cli/cmd_brand_status.ts

@@ -11,14 +11,17 @@
  *
  * ## The filename defect this verb exposes
  *
- * The rule names `.tokens.json`, with a leading dot, four times. The only real
- * resolver in the tree — `BRAND_TOKEN_PATHS` in the UI scaffold directive —
+ * The authored surfaces once named `.tokens.json`, with a leading dot. The only
+ * real resolver in the tree — `BRAND_TOKEN_PATHS` in `shared/brandTokenPaths.ts` —
  * looks for `tokens.json`, without one, in four conventional locations. A
- * consumer who followed the rule literally would author a file the resolver can
- * never find, and nothing would report it. So this verb searches the canonical
- * list AND separately reports a dot-prefixed file sitting beside it, because
- * "you have a brand file in the wrong place" is a different answer from "you
- * have no brand".
+ * consumer who followed the old wording authored a file the resolver can never
+ * find. So this verb searches the canonical list AND separately reports a
+ * dot-prefixed file sitting beside it, because "you have a brand file in the
+ * wrong place" is a different answer from "you have no brand".
+ *
+ * A file that merely exists is not a brand either: each hit is parsed, hashed
+ * and classified (`inspectBrand`), so a malformed or shadowed file is named as
+ * such rather than reported as the brand.
  *
  * The path list is IMPORTED from the resolver rather than restated. A probe with
  * its own copy of the search order is a second answer waiting to disagree with
@@ -28,17 +31,22 @@
  * legitimate answer (greenfield), not a failure.
  */
 
+import { createHash } from 'node:crypto';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { resolve_project_root } from '../_lib/agent_settings.js';
+import { parseBrandVoiceSlot, slotDay, validateBrandVoiceSlotText } from '../_lib/brand_voice_slot.js';
 import { BRAND_TOKEN_PATHS } from '../../agent-src/templates/scripts/work_engine/directives/ui/scaffold.js';
+import { tokenDocumentError } from '../../shared/brandTokenDocument.js';
 
 export interface BrandStatusOptions {
     cwd: string;
     json: boolean;
+    /** The day review age is measured against; tests pin it. */
+    now?: Date;
 }
 
 export interface BrandStatusResult {
@@ -47,16 +55,185 @@ export interface BrandStatusResult {
     err: string[];
 }
 
-/** The first canonical path holding a tokens file under `root`, or `null`. */
-export function findBrandTokens(root: string): string | null {
+/** The source kinds `brand-token-consumption` names. Only `tokens` has a resolver path today. */
+export type BrandSourceKind = 'tokens' | 'voice' | 'design-system' | 'design-md';
+
+/**
+ * `valid` — the file the brand is read from. `invalid` — unparseable or not a
+ * DTCG document. `duplicate` — byte-identical to the winner. `shadowed` — a
+ * valid file with different content that loses to the winner on precedence.
+ */
+export type BrandSourceStatus = 'valid' | 'invalid' | 'duplicate' | 'shadowed';
+
+export interface BrandSource {
+    path: string;
+    kind: BrandSourceKind;
+    sha256: string;
+    status: BrandSourceStatus;
+    error?: string;
+    winner?: string;
+}
+
+/**
+ * The contract's set names, verbatim (`brand-token-consumption.md` § 2): `bare`
+ * is the greenfield case. One vocabulary — never a second one beside it.
+ */
+export type BrandState = 'bare' | 'mixed' | 'branded';
+export type BrandQualifier = 'invalid' | 'shadowed';
+
+export interface BrandInspection {
+    state: BrandState;
+    qualifiers: BrandQualifier[];
+    tokens_file: string | null;
+    sources: BrandSource[];
+    voice: VoiceReport;
+}
+
+/**
+ * The voice side in counts and dates only. Nothing from the slot's content —
+ * no term, claim text, attribute or reference — is ever reported.
+ */
+export type VoiceReport =
+    | { read: false; path: string }
+    | {
+          read: true;
+          path: string;
+          schema_valid: boolean;
+          avoid_count: number;
+          claims_count: number;
+          expired_claims: number;
+          confidence: string | null;
+          last_reviewed_at: string | null;
+          days_since_review: number | null;
+          stale: boolean;
+      };
+
+/** `adr-gtm-context-spine-brand-voice`: the slot the voice side is read from. */
+export const VOICE_SLOT = 'agents/context-spine/brand-voice.md';
+/** A voice not reviewed for longer than this many days is stale (D12). */
+export const VOICE_STALE_DAYS = 90;
+const DAY_MS = 86_400_000;
+
+function _utcDay(d: Date): number {
+    return Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate());
+}
+
+function _list(v: unknown): unknown[] {
+    return Array.isArray(v) ? v : [];
+}
+
+function inspectVoice(root: string, now: Date, sources: BrandSource[]): VoiceReport {
+    let text: string;
+    try {
+        const abs = path.join(root, VOICE_SLOT);
+        if (!fs.statSync(abs).isFile()) return { read: false, path: VOICE_SLOT };
+        text = fs.readFileSync(abs, 'utf-8');
+    } catch {
+        return { read: false, path: VOICE_SLOT };
+    }
+    const sha256 = createHash('sha256').update(text).digest('hex');
+    const issues = validateBrandVoiceSlotText(text);
+    const fields = [...new Set(issues.map((i) => i.field))];
+    sources.push(
+        issues.length === 0
+            ? { path: VOICE_SLOT, kind: 'voice', sha256, status: 'valid' }
+            : { path: VOICE_SLOT, kind: 'voice', sha256, status: 'invalid', error: `schema: ${fields.join(', ')}` },
+    );
+    const data = parseBrandVoiceSlot(text).data ?? {};
+    const prov = typeof data['provenance'] === 'object' && data['provenance'] !== null ? (data['provenance'] as Record<string, unknown>) : {};
+    const today = _utcDay(now);
+    const claims = _list(data['claims']);
+    const expired = claims.filter((c) => {
+        const day = typeof c === 'object' && c !== null ? slotDay((c as Record<string, unknown>)['expires']) : null;
+        return day !== null && Date.parse(`${day}T00:00:00Z`) < today;
+    }).length;
+    const reviewed = slotDay(prov['last_reviewed_at']);
+    const days = reviewed === null ? null : Math.round((today - Date.parse(`${reviewed}T00:00:00Z`)) / DAY_MS);
+    const confidence = prov['confidence'];
+    return {
+        read: true,
+        path: VOICE_SLOT,
+        schema_valid: issues.length === 0,
+        avoid_count: _list(data['avoid']).length,
+        claims_count: claims.length,
+        expired_claims: expired,
+        confidence: issues.some((i) => i.field === 'provenance.confidence') || typeof confidence !== 'string' ? null : confidence,
+        last_reviewed_at: reviewed,
+        days_since_review: days,
+        stale: days === null || days > VOICE_STALE_DAYS,
+    };
+}
+
+const DESIGN_MD = 'DESIGN.md';
+
+/**
+ * Re-exported, not declared: the scaffold's `token_seed` line and the asset
+ * renderer answer the same question and must answer it the same way, and
+ * neither can import from here at runtime.
+ */
+export { tokenDocumentError } from '../../shared/brandTokenDocument.js';
+
+/**
+ * Every canonical path holding a tokens file, classified. Computed on every
+ * call and never persisted — a stored index would be a third brand truth.
+ * Nothing is merged by value: the first valid file in resolver order wins.
+ */
+export function inspectBrand(root: string, now: Date = new Date()): BrandInspection {
+    const sources: BrandSource[] = [];
+    let winner: BrandSource | null = null;
     for (const rel of BRAND_TOKEN_PATHS) {
+        let bytes: Buffer;
         try {
-            if (fs.statSync(path.join(root, rel)).isFile()) return rel;
+            const abs = path.join(root, rel);
+            if (!fs.statSync(abs).isFile()) continue;
+            bytes = fs.readFileSync(abs);
         } catch {
             continue;
         }
+        const sha256 = createHash('sha256').update(bytes).digest('hex');
+        const error = tokenDocumentError(bytes.toString('utf-8'));
+        if (error !== null) {
+            sources.push({ path: rel, kind: 'tokens', sha256, status: 'invalid', error });
+        } else if (winner === null) {
+            winner = { path: rel, kind: 'tokens', sha256, status: 'valid' };
+            sources.push(winner);
+        } else {
+            sources.push({
+                path: rel,
+                kind: 'tokens',
+                sha256,
+                status: sha256 === winner.sha256 ? 'duplicate' : 'shadowed',
+                winner: winner.path,
+            });
+        }
+    }
+    // DESIGN.md sits at the project root (`design-system-capture`). It records
+    // usage decisions, not values, so it is listed and never decides the state.
+    // A `design-system.json` has no canonical location in the tree to search.
+    try {
+        const abs = path.join(root, DESIGN_MD);
+        if (fs.statSync(abs).isFile()) {
+            const sha256 = createHash('sha256').update(fs.readFileSync(abs)).digest('hex');
+            sources.push({ path: DESIGN_MD, kind: 'design-md', sha256, status: 'valid' });
+        }
+    } catch {
+        // absent — nothing to list
     }
-    return null;
+    const voice = inspectVoice(root, now, sources);
+    const qualifiers: BrandQualifier[] = [];
+    if (sources.some((s) => s.status === 'invalid')) qualifiers.push('invalid');
+    if (sources.some((s) => s.status === 'shadowed')) qualifiers.push('shadowed');
+    // Only a schema-valid voice slot counts; an invalid one is listed and qualifies.
+    const voicePresent = voice.read && voice.schema_valid;
+    const tokensPresent = winner !== null;
+    const state: BrandState =
+        tokensPresent && voicePresent ? 'branded' : tokensPresent || voicePresent ? 'mixed' : 'bare';
+    return { state, qualifiers, tokens_file: winner?.path ?? null, sources, voice };
+}
+
+/** The canonical path the brand is read from — the first VALID tokens file — or `null`. */
+export function findBrandTokens(root: string): string | null {
+    return inspectBrand(root).tokens_file;
 }
 
 /**
@@ -82,7 +259,8 @@ export function findDottedNearMisses(root: string): string[] {
 export function runBrandStatus(opts: BrandStatusOptions): BrandStatusResult {
     const out: string[] = [];
     const [projectRoot] = resolve_project_root(null, { cwd: opts.cwd });
-    const found = findBrandTokens(projectRoot);
+    const inspection = inspectBrand(projectRoot, opts.now ?? new Date());
+    const found = inspection.tokens_file;
     const nearMisses = findDottedNearMisses(projectRoot);
 
     if (opts.json) {
@@ -91,6 +269,10 @@ export function runBrandStatus(opts: BrandStatusOptions): BrandStatusResult {
                 {
                     brand_layer_present: found !== null,
                     tokens_file: found,
+                    state: inspection.state,
+                    qualifiers: inspection.qualifiers,
+                    sources: inspection.sources,
+                    voice: inspection.voice,
                     searched: [...BRAND_TOKEN_PATHS],
                     dotted_near_misses: nearMisses,
                     project_root: projectRoot,
@@ -102,6 +284,8 @@ export function runBrandStatus(opts: BrandStatusOptions): BrandStatusResult {
         return { code: 0, out, err: [] };
     }
 
+    const qualifierText = inspection.qualifiers.length > 0 ? ` (${inspection.qualifiers.join(', ')})` : '';
+    out.push(`brand state   ${inspection.state}${qualifierText}`);
     if (found !== null) {
         out.push(`brand layer   present — ${found}`);
         out.push('              brand-source-of-truth applies: these tokens outrank the corpus.');
@@ -113,6 +297,33 @@ export function runBrandStatus(opts: BrandStatusOptions): BrandStatusResult {
         out.push('              greenfield branch of brand-source-of-truth, not a misconfiguration.');
     }
 
+    if (inspection.sources.length > 0) {
+        out.push('', 'sources');
+        for (const s of inspection.sources) {
+            const note =
+                s.status === 'invalid'
+                    ? ` — ${s.error ?? 'invalid'}`
+                    : s.winner !== undefined
+                      ? ` — loses to ${s.winner}`
+                      : '';
+            out.push(`  ${s.status.padEnd(9)} ${s.path}  sha256:${s.sha256.slice(0, 12)}${note}`);
+        }
+    }
+    const v = inspection.voice;
+    if (!v.read) {
+        out.push('', `voice         none — no ${VOICE_SLOT}`);
+    } else {
+        const review =
+            v.days_since_review === null
+                ? 'never reviewed (stale)'
+                : `reviewed ${v.days_since_review} day(s) ago${v.stale ? ' (stale)' : ''}`;
+        out.push(
+            '',
+            `voice         ${v.schema_valid ? 'present' : 'invalid'} — ${VOICE_SLOT}`,
+            `              ${v.avoid_count} avoid term(s), ${v.claims_count} claim(s), ${v.expired_claims} expired; confidence ${v.confidence ?? 'unset'}; ${review}`,
+        );
+    }
+
     if (nearMisses.length > 0) {
         out.push(
             '',

package/src/scripts/_cli/cmd_ci_settle.ts

@@ -0,0 +1,32 @@
+/**
+ * `agent-config ci:settle <pr>` — the CI waiter, reached through the package's
+ * own executable.
+ *
+ * Shipped commands used to name `npx tsx node_modules/@event4u/agent-config/
+ * src/scripts/ci_settle.ts`, which fails on a global or ephemeral install (no
+ * such path) and pulls `tsx` from the registry on a cold cache. Living under
+ * `_cli/` gets this file bundled into `dist/cli-delegate/`, so a consumer runs
+ * it with plain `node` and no TypeScript runner at all.
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { main } from '../ci_settle.js';
+
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) return false;
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) return true;
+    try {
+        return fs.realpathSync(fileURLToPath(import.meta.url)) === fs.realpathSync(path.resolve(process.argv[1]));
+    } catch {
+        return false;
+    }
+}
+
+if (_isCliEntry()) {
+    process.exitCode = main(process.argv.slice(2));
+}

package/src/scripts/_cli/cmd_doctor.ts

@@ -26,7 +26,7 @@
  *   here; files without frontmatter are skipped (P5.1 contract).
  *
  * Health checks (see `CHECK_IDS`):
- * scope · global-binary · claude-plugin · stale-orphans · manifest-integrity ·
+ * scope · global-binary · claude-plugin · hook-carrier · stale-orphans · manifest-integrity ·
  * lockfile-freshness · bridge-drift · mcp-mode · mcp-beta-readiness ·
  * offline-readiness · python-runtime · humanizer-runtime · tier-usage-readiness ·
  * council-cli · team ·
@@ -84,6 +84,7 @@ import * as YAML from 'yaml';
 
 import { _check_overrides } from './doctor_overrides.js';
 import { _is_global_only_consumer } from './doctor_install_mode.js';
+import { classifyOwnership, ledgerModifiedRecords, noProjectInstallLines } from './doctor_ownership_ledger.js';
 // Forwarded, not re-declared: both names moved to doctor_install_mode.ts and existing
 // importers of cmd_doctor.js keep resolving. `export ... from` rather than an import,
 // because INSTALL_MODE_MARKER_RELATIVE is not referenced here any more and an unused
@@ -91,6 +92,7 @@ import { _is_global_only_consumer } from './doctor_install_mode.js';
 export { INSTALL_MODE_MARKER_RELATIVE, _is_global_only_consumer } from './doctor_install_mode.js';
 import * as claude_plugin from '../_lib/claude_plugin.js';
 import * as claude_settings_hooks from '../_lib/claude_settings_hooks.js';
+import * as staged_runtime from '../../install/stagedRuntime.js';
 import { _is_source_repo } from './cmd_refresh.js';
 import * as installed_lock from '../_lib/installed_lock.js';
 import * as installed_tools from '../_lib/installed_tools.js';
@@ -116,6 +118,7 @@ import {
 } from '../_lib/agent_settings.js';
 import { executionJson, forgeDepsFor, forgeProtectionJsonFor, type ForgeDeps } from './doctor_execution.js';
 import { checkOfflineReadiness, trafficEnvironmentJson } from './doctor_network_posture.js';
+import { updateVerdictFor } from './doctor_update_verdict.js';
 import * as ai_council_clients from '../ai_council/clients.js';
 import * as ai_council_config from '../ai_council/config.js';
 import {
@@ -594,9 +597,8 @@ function _collect_manifest_entries(
     const known = new Set<string>();
     const tools = (manifest['tools'] as Dict[] | undefined) || [];
     for (const tool of tools) {
-        if (tool['scope'] !== 'project') {
-            continue;
-        }
+        // Global scope is read from the user ledger (doctor_ownership_ledger.ts).
+        if (tool['scope'] !== 'project') continue;
         const tool_id = String(tool['name'] ?? '');
         const files = (tool['files'] as Dict[] | undefined) || [];
         for (const entry of files) {
@@ -659,11 +661,8 @@ function _classify(records: ManifestRecord[]): [Dict[], Dict[], Dict[]] {
                 fix: _fix_hint('tag-drift', kind),
             });
         }
-        if (expected === null) {
-            continue;
-        }
-        const actual = _sha256(target);
-        if (actual === null || actual === expected) {
+        // The installer's own classifier, so doctor cannot call a file modified the writer would not preserve.
+        if (classifyOwnership(expected, _sha256(target)) !== 'recorded-modified') {
             continue;
         }
         modified.push({
@@ -719,6 +718,7 @@ const CHECK_IDS = [
     'claude-command-wrappers',
     'surface-state',
     'hook-wiring',
+    'hook-carrier',
     ...runtime_wiring.WIRING_CHECK_IDS,
     ...install_reach.REACH_CHECK_IDS,
     'stale-orphans',
@@ -793,14 +793,6 @@ const MCP_BETA_GATES: ReadonlyArray<[string, string]> = [
     ['gate-6-no-drift', '.github/workflows/mcp-no-drift.yml'],
 ];
 
-/** Visible status → glyph map (`warn` keeps a trailing space for alignment). */
-const STATUS_SYMBOLS: Record<string, string> = {
-    ok: '✅',
-    warn: '⚠️ ',
-    fail: '❌',
-    skipped: '⏭️ ',
-};
-
 /** Minimum Python interpreter the CLI targets (parity constant). */
 const MIN_PYTHON: [number, number] = [3, 10];
 
@@ -1520,7 +1512,7 @@ const _RULE_PROJECTION_DIRS: readonly string[] = [
  * `.augment/rules` is the full generated projection, not a consumer surface)
  * and `skipped` when no projected rule tree is present to inspect.
  */
-function _check_rule_scope_drift(project_root: string): Dict {
+function _check_rule_scope_drift(project_root: string, package_root: string = _package_root()): Dict {
     if (_is_source_repo(project_root)) {
         return {
             id: 'rule-scope-drift',
@@ -1540,7 +1532,7 @@ function _check_rule_scope_drift(project_root: string): Dict {
             typeof loaded === 'object' && loaded !== null && !Array.isArray(loaded)
                 ? (loaded as Dict)
                 : {};
-        scope = ruleScopeFromSettings(raw);
+        scope = ruleScopeFromSettings(raw, package_root);
     }
 
     // First projected rule tree that exists and holds a `.md` rule.
@@ -2809,6 +2801,7 @@ function _run_checks(
         'claude-command-wrappers': _check_claude_command_wrappers,
         'surface-state': _check_surface_state,
         'hook-wiring': _check_hook_wiring,
+        'hook-carrier': () => staged_runtime.checkHookCarrier(_package_root()) as unknown as Dict,
         ...(runtime_wiring.wiringRunners({ packageRoot: _package_root(), projectRoot: project_root, iterOverrides: () => iter_setting_overrides({ cwd: project_root }) }) as unknown as Record<string, CheckRunner>),
         ...(install_reach.reachRunners({ projectRoot: project_root, resolvableVersion: _current_package_version() }) as unknown as Record<string, CheckRunner>),
         'stale-orphans': _check_stale_orphans,
@@ -2895,6 +2888,7 @@ function _run_checks_no_manifest(
         'claude-command-wrappers': _check_claude_command_wrappers,
         'surface-state': _check_surface_state,
         'hook-wiring': _check_hook_wiring,
+        'hook-carrier': () => staged_runtime.checkHookCarrier(_package_root()) as unknown as Dict,
         ...(runtime_wiring.wiringRunners({ packageRoot: _package_root(), projectRoot: project_root, iterOverrides: () => iter_setting_overrides({ cwd: project_root }) }) as unknown as Record<string, CheckRunner>),
         ...(install_reach.reachRunners({ projectRoot: project_root, resolvableVersion: _current_package_version() }) as unknown as Record<string, CheckRunner>),
         'stale-orphans': _check_stale_orphans,
@@ -2943,9 +2937,10 @@ function _run_no_manifest(
     const skipped_requested =
         opts.check !== null &&
         checks.some((c) => c['id'] === opts.check && c['status'] === 'skipped');
+    const modified = ledgerModifiedRecords(); // global scope has no project lockfile to wait for
 
     if (opts.json) {
-        _emit_json(project_root, [], [], [], [], checks, origin, forgeDepsFor(opts));
+        _emit_json(project_root, [], modified, [], [], checks, origin, forgeDepsFor(opts));
     } else if (opts.check === null) {
         print(`  📍  project_root: ${project_root} (origin: ${origin})`);
         if (bridge_present) {
@@ -2958,14 +2953,11 @@ function _run_no_manifest(
                     'to project-local distributed tools',
             );
         } else {
-            eprint(`  ⚠️   no project lockfile and no consumer install marker at ${project_root}`);
-            eprint(
-                '      run `agent-config init` (project install) or ' +
-                    '`agent-config refresh --project` (global-only consumer)',
-            );
+            for (const [stream, line] of noProjectInstallLines(project_root)) (stream === 'err' ? eprint : print)(line);
         }
         _emit_checks_text(checks);
         _emit_detection_text(project_root, checks);
+        if (modified.length > 0) _emit_text(project_root, [], modified, [], []);
     } else {
         _emit_checks_text(checks);
         _emit_detection_text(project_root, checks);
@@ -2985,10 +2977,10 @@ function _run_no_manifest(
     const sx = strictExit(opts, checks, false); // no manifest: keep the 2, never soften to 1
     if (sx !== null) return bridge_present ? sx : 2;
     if (opts.ci && bridge_present) {
-        // Same fold as the manifest path: check failures are red under --ci.
-        return fail_check ? 1 : 0;
+        // Same fold as the manifest path: check failures and ledger drift are red under --ci.
+        return fail_check || modified.length > 0 ? 1 : 0;
     }
-    return bridge_present ? 0 : 2;
+    return bridge_present ? (modified.length > 0 ? 1 : 0) : 2;
 }
 
 function _emit_json(
@@ -3011,6 +3003,7 @@ function _emit_json(
     payload['execution'] = executionJson(() => iter_setting_overrides({ cwd: project_root }));
     payload['forge_protection'] = forgeProtectionJsonFor(String(project_root), forge); // 3.2 · AC-5
     payload['traffic_environment'] = trafficEnvironmentJson(process.env);
+    payload['update_verdict'] = updateVerdictFor(String(project_root), _package_root(), _current_package_version()); // read-only
     if (checks !== null) {
         payload['checks'] = checks;
         const drift = missing.length + modified.length + foreign.length + tag_drift.length;
@@ -3025,21 +3018,6 @@ function _emit_json(
     print(_jsonDumpsIndentAscii(payload, 2));
 }
 
-function _emit_checks_text(checks: Dict[]): void {
-    if (checks.length === 0) {
-        return;
-    }
-    print('checks:');
-    for (const c of checks) {
-        const sym = STATUS_SYMBOLS[c['status'] as string] ?? '?';
-        print(`  ${sym} ${c['id']}: ${c['message']}`);
-        if (c['status'] !== 'ok' && c['remedy']) {
-            print(`      fix: ${c['remedy']}`);
-        }
-    }
-    print('');
-}
-
 /**
  * The detection section in text mode. Rendered from the same report the
  * `detection` check row and the `--json` payload use, so the three cannot
@@ -3058,7 +3036,7 @@ function _emit_detection_text(project_root: string, checks: Dict[]): void {
 
 // `--strict` lives in `_doctor_strict.ts`; the drift renderer in `_doctor_emit.ts`.
 import { STRICT_DEFAULTS, STRICT_STORE_TRUE, STRICT_USAGE, STRICT_VALUE_FLAGS, attachProceedFields, strictExit, validateStrictLevelOr } from './_doctor_strict.js';
-import { _emit_text } from './_doctor_emit.js';
+import { STATUS_SYMBOLS, _emit_checks_text, _emit_text } from './_doctor_emit.js';
 
 interface Options {
     project: string | null;
@@ -3379,6 +3357,7 @@ function main(argv: string[] | null = null): number {
 
     const [records, known] = _collect_manifest_entries(project_root, manifest);
     const [missing, modified, tag_drift] = _classify(records);
+    modified.push(...ledgerModifiedRecords());
     const foreign = _foreign_records(project_root, _scan_foreign(project_root, manifest, known));
     const drift_groups: Record<string, Dict[]> = {
         missing,