@event4u/agent-config 16.5.0 → 17.0.0

package/src/scripts/hooks_status.ts

@@ -30,6 +30,8 @@ import {
   _load_yaml,
 } from "./hooks/dispatch_hook.js";
 import { loadHostLowering } from "./hooks/host_lowering.js";
+import { type ClaudeHookScope, claudeHookScope } from "./_lib/claude_hook_scope.js";
+import { event4u_root } from "./_lib/user_global_paths.js";
 import { type SlotReading, readSlots } from "./report_enforcement_drift.js";
 
 // src/scripts/hooks_status.ts → parents[1] is the repo root (.../parents[2]
@@ -106,6 +108,13 @@ export interface PlatformRow {
    */
   blocking_enforcement: Record<string, string>;
   hint: string | null;
+  /**
+   * Claude only. Where the managed hooks are registered (global and/or
+   * project), which runtime they would reach, and the resulting state. Present
+   * because Claude Code MERGES `~/.claude/settings.json` with the project file,
+   * so one file cannot answer "are the hooks installed" for that host.
+   */
+  claude_scope?: ClaudeHookScope;
 }
 
 export interface StatusMatrix {
@@ -206,8 +215,27 @@ function _blocking_enforcement(
   return out;
 }
 
+/** Where to look for the user-scope half of Claude's merged settings. Injected by tests. */
+export interface UserScope {
+  home: string;
+  runtimeRoot: string;
+  pathEnv: string;
+}
+
+function _defaultUserScope(): UserScope {
+  return {
+    home: process.env["HOME"] ?? "",
+    runtimeRoot: path.join(event4u_root(), "runtime"),
+    pathEnv: process.env["PATH"] ?? "",
+  };
+}
+
 /** Build the runtime matrix as a plain object — JSON-serialisable. */
-export function collect(project_root: string, manifest: JsonObject): StatusMatrix {
+export function collect(
+  project_root: string,
+  manifest: JsonObject,
+  userScope: UserScope = _defaultUserScope(),
+): StatusMatrix {
   const platformsRaw = manifest["platforms"];
   const platforms = _isObject(platformsRaw) ? platformsRaw : {};
   const severities = _severities(manifest);
@@ -226,9 +254,20 @@ export function collect(project_root: string, manifest: JsonObject): StatusMatri
         }
       }
     }
+    // Claude merges the user-scope settings file with the project one, so its
+    // status comes from the managed commands in BOTH, never from whether the
+    // project file merely exists.
+    const claude_scope =
+      platform === "claude" && !fallback_only
+        ? claudeHookScope({ projectRoot: project_root, ...userScope })
+        : undefined;
     const status = fallback_only
       ? "degraded"
-      : _bridge_status(project_root, rel);
+      : claude_scope !== undefined
+        ? claude_scope.registered_in.length > 0
+          ? "installed"
+          : "missing"
+        : _bridge_status(project_root, rel);
     rows.push({
       platform,
       status,
@@ -240,6 +279,7 @@ export function collect(project_root: string, manifest: JsonObject): StatusMatri
       hint: ["missing", "empty", "degraded", "n/a"].includes(status)
         ? hint
         : null,
+      ...(claude_scope !== undefined ? { claude_scope } : {}),
     });
   }
   return { schema_version: 1, platforms: rows };
@@ -277,10 +317,25 @@ export function _render_table(matrix: StatusMatrix): string {
   for (const row of matrix.platforms) {
     const marker = _STATUS_MARKER[row.status] ?? "?  ";
     let head = `${marker}${row.platform.padEnd(9)} ${row.status}`;
-    if (row.bridge_path) {
+    if (row.claude_scope !== undefined) {
+      const where = row.claude_scope.registered_in.length > 0 ? row.claude_scope.registered_in.join(" + ") : "neither scope";
+      head += `  (managed hooks in: ${where} — ~/.claude/settings.json and <project>/.claude/settings.json are merged)`;
+    } else if (row.bridge_path) {
       head += `  (${row.bridge_path})`;
     }
     lines.push(head);
+    if (row.claude_scope !== undefined) {
+      const s = row.claude_scope;
+      lines.push(`    state                  → ${s.state}`);
+      lines.push(
+        `    runtime                → ${s.runtime}` + (s.runtime_version !== null ? ` v${s.runtime_version}` : ""),
+      );
+      lines.push(
+        `    managed / foreign      → global ${s.managed_commands.global} / ${s.foreign_commands.global}, ` +
+          `project ${s.managed_commands.project} / ${s.foreign_commands.project}  (foreign hooks are never counted as ours)`,
+      );
+      if (s.version_skew !== null) lines.push(`    ⚠️  ${s.version_skew}`);
+    }
     lines.push(
       `    ask                    → ${row.ask}` +
         (row.ask === "native"

package/src/scripts/inbox_source_census.ts

@@ -113,6 +113,13 @@ export interface TopicCensus {
     decisionIds: string[];
     fileCount: number;
     anchorTotal: number;
+    /**
+     * Paths under this topic the census did NOT read, relative to the topic
+     * directory. A file the walk skipped is not a file that is not there, and
+     * the closing coverage line cannot be read as complete while this is
+     * non-empty.
+     */
+    uncounted: string[];
 }
 
 /**
@@ -195,13 +202,46 @@ function censusFile(abs: string, rel: string): FileCensus {
     };
 }
 
-/** Group one topic folder's files into source sets and count its anchors. */
-export function censusTopic(dir: string, topic: string): TopicCensus {
-    const names = fs
-        .readdirSync(dir, { withFileTypes: true })
-        .filter((d) => d.isFile() && TEXT_EXT.has(path.extname(d.name).toLowerCase()))
-        .map((d) => d.name)
-        .sort();
+/**
+ * Every path under `dir`, recursively, split into the text files the census
+ * reads and everything else. Both are relative to `dir` and sorted.
+ *
+ * The recursion is the repair. The previous reader took only the files
+ * DIRECTLY in a topic directory, so a nested folder of later-loop plans was
+ * invisible while the closing line still claimed every anchor left with a
+ * ledger row. Measured on the round that found it: twelve files reported
+ * against fourteen present, and zero revision sets against three.
+ */
+function collect(dir: string, recursive: boolean): { text: string[]; other: string[] } {
+    const text: string[] = [];
+    const other: string[] = [];
+    const walk = (abs: string, rel: string): void => {
+        for (const d of fs.readdirSync(abs, { withFileTypes: true })) {
+            const childRel = rel === '' ? d.name : `${rel}/${d.name}`;
+            if (d.isDirectory()) {
+                if (recursive) walk(path.join(abs, d.name), childRel);
+                continue;
+            }
+            if (!d.isFile()) continue;
+            if (TEXT_EXT.has(path.extname(d.name).toLowerCase())) text.push(childRel);
+            else other.push(childRel);
+        }
+    };
+    walk(dir, '');
+    text.sort();
+    other.sort();
+    return { text, other };
+}
+
+/**
+ * Group one topic folder's files into source sets and count its anchors.
+ *
+ * `recursive` is true for a topic, false for the round root — `censusRoot`
+ * treats each immediate subdirectory as its own topic, so a recursive root
+ * pass would count those files twice.
+ */
+export function censusTopic(dir: string, topic: string, recursive = true): TopicCensus {
+    const { text: names, other: uncounted } = collect(dir, recursive);
 
     const byStem = new Map<string, FileCensus[]>();
     const ids = new Set<string>();
@@ -209,7 +249,12 @@ export function censusTopic(dir: string, topic: string): TopicCensus {
         const abs = path.join(dir, name);
         const fc = censusFile(abs, name);
         for (const id of decisionIds(fs.readFileSync(abs, 'utf-8'))) ids.add(id);
-        const stem = stemOf(name);
+        // The stem comes from the BASENAME, so `plan.md` and `v2/plan.md` are
+        // one revision set across directory levels. That is the grouping this
+        // repair is for; it also means two unrelated files that happen to
+        // share a stem at different depths read as one set, which is why each
+        // member is printed with its path relative to the topic.
+        const stem = stemOf(path.basename(name));
         const bucket = byStem.get(stem);
         if (bucket) bucket.push(fc);
         else byStem.set(stem, [fc]);
@@ -228,6 +273,7 @@ export function censusTopic(dir: string, topic: string): TopicCensus {
         sets,
         decisionIds: [...ids].sort(),
         fileCount: names.length,
+        uncounted,
         anchorTotal: sets.reduce(
             (n, s) => n + s.members.reduce((m, f) => m + f.total, 0),
             0,
@@ -238,12 +284,12 @@ export function censusTopic(dir: string, topic: string): TopicCensus {
 /** Walk a round root: each immediate subdirectory is a topic, plus the root itself. */
 export function censusRoot(root: string): TopicCensus[] {
     const out: TopicCensus[] = [];
-    const rootLevel = censusTopic(root, '.');
-    if (rootLevel.fileCount > 0) out.push(rootLevel);
+    const rootLevel = censusTopic(root, '.', false);
+    if (rootLevel.fileCount > 0 || rootLevel.uncounted.length > 0) out.push(rootLevel);
     for (const d of fs.readdirSync(root, { withFileTypes: true })) {
         if (!d.isDirectory()) continue;
         const t = censusTopic(path.join(root, d.name), d.name);
-        if (t.fileCount > 0) out.push(t);
+        if (t.fileCount > 0 || t.uncounted.length > 0) out.push(t);
     }
     return out;
 }
@@ -252,6 +298,7 @@ function render(topics: TopicCensus[], write: (s: string) => unknown): void {
     let files = 0;
     let anchors = 0;
     let revisionSets = 0;
+    let uncounted = 0;
     for (const t of topics) {
         write(`\n## ${t.topic}\n`);
         for (const s of t.sets) {
@@ -268,13 +315,27 @@ function render(topics: TopicCensus[], write: (s: string) => unknown): void {
             if (s.isRevisionSet) revisionSets += 1;
         }
         if (t.decisionIds.length > 0) write(`  decision ids: ${t.decisionIds.join(' ')}\n`);
+        if (t.uncounted.length > 0) {
+            write(`  not counted (${String(t.uncounted.length)}): ${t.uncounted.join(', ')}\n`);
+        }
         files += t.fileCount;
         anchors += t.anchorTotal;
+        uncounted += t.uncounted.length;
     }
     write(
         `\ntopics ${String(topics.length)} · files ${String(files)} · ` +
-            `revision sets ${String(revisionSets)} · anchors ${String(anchors)}\n` +
-            'Every anchor leaves the run carrying a ledger row or named in one `no-demand` line.\n' +
+            `revision sets ${String(revisionSets)} · anchors ${String(anchors)} · ` +
+            `not counted ${String(uncounted)}\n`,
+    );
+    if (uncounted > 0) {
+        write(
+            `${String(uncounted)} file(s) are named above and were NOT read — the census reads ` +
+                `${[...TEXT_EXT].sort().join(' ')} only. The anchor total below is over what was ` +
+                'read, so it is a floor and not a measure of the folder.\n',
+        );
+    }
+    write(
+        'Every anchor leaves the run carrying a ledger row or named in one `no-demand` line.\n' +
             'Every revision set owes a consecutive-member diff (/analyze:inbox Phase 2b).\n',
     );
 }

package/src/scripts/install

@@ -208,6 +208,15 @@ if $NO_UI; then
     export AGENT_CONFIG_NO_UI=1
 fi
 
+# `--scope global` is documented above as "same as --global", and it was not:
+# it set SCOPE and nothing else, so the PROJECT payload sync still ran. Under
+# npx that sync auto-detects its target three levels above the package, which
+# is the npx cache, so a global dry-run reported writing `.augment/` there.
+if [[ "${SCOPE:-}" == "global" ]]; then
+    GLOBAL=true
+    SKIP_SYNC=true
+fi
+
 # road-to-global-only-install § Phase 3.3 — consumer-floor gate.
 #
 # Consumer installs are global-only (ADR-020). Explicit --scope=project
@@ -419,12 +428,19 @@ run_bridges() {
         runner=($tsx_bin "$INSTALL_TS")
     fi
 
+    local args=(--project "$TARGET_DIR" --package "$SOURCE_DIR")
     if $DRY_RUN; then
-        $QUIET || echo "  ⏭️  Skipping bridges (--dry-run)"
-        return 0
+        # The install stage owns the global plan, so a dry run asks IT rather
+        # than skipping it: install.ts returns from its plan summary before any
+        # write or subprocess. Skipping it here left a global dry run printing
+        # nothing but the one stage that does not apply to a global install.
+        $GLOBAL && args+=(--global)
+        [[ -n "$SCOPE" ]] && args+=(--scope="$SCOPE")
+        args+=(--tools="$TOOLS" --no-ui --dry-run)
+        "${runner[@]}" "${args[@]}"
+        return $?
     fi
 
-    local args=(--project "$TARGET_DIR" --package "$SOURCE_DIR")
     [[ -n "$PROFILE" ]] && args+=(--profile="$PROFILE")
     [[ -n "$USER_TYPE" ]] && args+=(--user-type="$USER_TYPE")
     $FORCE && args+=(--force)
@@ -473,6 +489,12 @@ if ! $SKIP_SYNC; then
         exit 1
     fi
     run_sync || RC=$?
+elif $DRY_RUN && ! $QUIET; then
+    if $GLOBAL; then
+        echo "  ⏭️  Project payload sync: skipped — a global install writes user-scope host paths only."
+    else
+        echo "  ⏭️  Project payload sync: skipped (--skip-sync)."
+    fi
 fi
 
 if [[ $RC -ne 0 ]]; then

package/src/scripts/install.ts

@@ -2,7 +2,7 @@
 /**
  * Agent Config — Project Bridge Installer (TypeScript twin).
  *
- * Ported from the retired Python `src/scripts/install.py` (ADR-200).
+ * Ported from the retired Python installer (ADR-200).
  * The CLI contract pins the historical contract exactly — same flags, same
  * exit codes, same stdout/stderr split, byte-identical emitted output,
  * same filesystem effects, same subprocess argv/cwd/env. No behaviour
@@ -88,8 +88,9 @@ import * as mcp_consent from './_lib/mcp_consent_residual.js';
 import * as scoped_projection from './_lib/scoped_projection.js';
 import { createConflictTracker } from '../install/conflictTracker.js';
 import { mkdirp, pathExists, resolvePath, sha256OfFile } from '../install/fsPrimitives.js';
-import { filesByToolFromBridges as _files_by_tool_from_bridges, filesByToolFromDeploy as _files_by_tool_from_deploy, hydrateRecordedInventories, preservedIndex, readRecordedByTool, reconcileToolFiles, type ManifestFileEntry } from '../install/manifestFiles.js';
+import { dropGlobalScopeFiles, filesByToolFromBridges as _files_by_tool_from_bridges, filesByToolFromDeploy as _files_by_tool_from_deploy, hydrateRecordedInventories, preservedIndex, readRecordedByTool, reconcileToolFiles, type ManifestFileEntry } from '../install/manifestFiles.js';
 import { EXIT_COMPLETED_WITH_CONFLICTS } from '../install/preserve.js';
+import { recordGlobalDeploy, retainedFileMessage } from '../install/ownershipLedger.js';
 import * as surface_tiers from './_lib/surface_tiers.js';
 import * as global_deploy_inventory from './_lib/global_deploy_inventory.js';
 import * as rule_layer_overlap from './_lib/rule_layer_overlap.js';
@@ -105,8 +106,10 @@ import * as catalogue from './_lib/skill_catalogue.js';
 import { isInteractiveSession, type SessionProbe } from '../shared/interactiveContext.js';
 import * as claude_desktop_bundler from './_lib/claude_desktop_bundler.js';
 import * as claude_settings_hooks from './_lib/claude_settings_hooks.js';
+import { applyHostListingPolicies } from './_lib/skill_listing_overrides.js';
 import { hostBindings } from './hooks/host_lowering.js';
 import { find_project_root_with_anchor, load_agent_settings } from './_lib/agent_settings.js';
+import { legacyProjectionPin } from './_lib/projection_key_migration.js';
 import { ruleFileArrives, type RuleScope } from '../install/rule_scope.js';
 import { isExclusivelyPackageOnly, stampHostLayerFingerprint } from '../install/partitionEligibility.js'; // ADR-236
 import * as claude_rule_rewrite from '../install/claudeRuleRewrite.js';
@@ -116,8 +119,10 @@ import {
     thinInstalledRuleLayer,
 } from '../install/installThinLayer.js';
 import { resolveGlobalRuleScope } from '../install/globalRuleScope.js';
+import { deployClaudeCarrier } from '../install/stagedRuntime.js';
+import { mergeToolsAliases as _merge_tools_aliases } from '../install/toolsArg.js';
 import { installerThinsHost } from './_lib/lean_projection_mode.js';
-import { GLOBAL_DEPLOY_SOURCES, RULE_SOURCE_REL } from '../install/wizard-plan.js';
+import { GLOBAL_DEPLOY_SOURCES, RULE_SOURCE_REL, dryRunTargetLines } from '../install/wizard-plan.js';
 import { flattenSurface, computeSurfaceDelta, type SettingsSurface } from '../shared/settingsSurface.js';
 import { settingsSchema } from '../server/schemas/settings.js';
 import { zodToJsonSchema } from 'zod-to-json-schema';
@@ -348,6 +353,7 @@ const LEGACY_RENAME_MAP: Record<string, string> = {
 const state = {
     QUIET: false,
     PROGRESS_NDJSON: false,
+    FULL_PIN: false,
 };
 
 function _emit_progress(obj: Record<string, unknown>): void {
@@ -952,13 +958,7 @@ function ensure_claude_bridge(project_root: string, force: boolean): Record<stri
 // `_lib/mcp_bridge.ts`; only the call sites are here (see that module's header
 // for why). Names are forwarded so the export surface is unchanged.
 const ensure_mcp_bridge = mcp_bridge.makeEnsureMcpBridge(merge_json_file);
-const _resolve_tier_b = mcp_bridge.resolveTierB;
 const _tier_b_advisory = mcp_bridge.tierBAdvisory;
-const _prune_tier_b_modules = (
-    dr: Record<string, DeployResult>,
-    tier_b: ReadonlySet<string>,
-): [number, Record<string, DeployResult>] =>
-    _prune_modules_by(dr, mcp_bridge.tierBPrunePredicate(tier_b));
 
 function _cursor_dispatch_command(ac_event: string, native: string): string {
     // Hook-resilience shim (P1.4): missing binary → silent exit 0; a
@@ -1935,6 +1935,8 @@ interface Options {
     interactive: boolean;
     no_ui: boolean;
     dry_run: boolean;
+    /** `--full`: write the sticky user pin into the install receipt (`src/install/userPin.ts`). */
+    full: boolean;
     apply_payload: string | null;
     /**
      * Which rule layer owns the corpus when both `~/.claude/rules/` and
@@ -2306,7 +2308,7 @@ function _update_installed_tools_manifest(
         }
     }
 
-    installed_tools.write_manifest(target, version, entries);
+    installed_tools.write_manifest(target, version, dropGlobalScopeFiles(entries, scope === 'global' ? tools : new Set()));
     if (!state.QUIET) {
         const rel = isRelativeTo(target, project_root) ? path.relative(project_root, target) : target;
         info(`Manifest updated: ${rel}`);
@@ -2714,7 +2716,7 @@ function _copy_dir_dereferencing_symlinks(
             return [0, 0, written_paths];
         }
         mkdirp(path.dirname(dest));
-        const decision = tracker.resolve(dest, force);
+        const decision = tracker.resolve(dest, force, { from: resolved_src, packageRoot: package_root });
         if (decision === 'preserve') {
             tracker.preserve(dest, resolved_src, package_root);
             _log_tx_entry('skip', dest);
@@ -2789,7 +2791,7 @@ function _copy_dir_dereferencing_symlinks(
         if (file_filter !== null && !file_filter(entry)) {
             continue;
         }
-        const decision = tracker.resolve(target, force);
+        const decision = tracker.resolve(target, force, { from: resolved, packageRoot: package_root });
         if (decision === 'preserve') {
             tracker.preserve(target, resolved, package_root);
             skipped += 1;
@@ -2823,7 +2825,7 @@ function _write_claude_desktop_marker(
     // Generated, but manifest-recorded with a digest — so it is in the class the
     // preservation ruling covers, and it used to write unconditionally, ignoring
     // even `--force`, because the tracker was wired only into the copy loop.
-    if (tracker.resolve(target, force) === 'preserve') {
+    if (tracker.resolve(target, force, { content: body }) === 'preserve') {
         tracker.preserveContent(target, body);
         return [0, 1, []];
     }
@@ -2841,12 +2843,9 @@ function _deploy_claude_desktop(
     claude_desktop_bundler.build_skill_bundles(package_root, bundles_dir, force);
     claude_desktop_bundler.build_command_bundles(package_root, bundles_dir, force);
     const bundle_count = countZips(bundles_dir);
-    const [, , marker_paths] = _write_claude_desktop_marker(
-        force,
-        lockfile_path,
-        bundles_dir,
-        bundle_count,
-    );
+    const [, , marker_paths] = _write_claude_desktop_marker(force, lockfile_path, bundles_dir, bundle_count);
+    // The marker's digest is the ledger's to hold: a global lock entry records no files[].
+    recordGlobalDeploy({ toolId: 'claude-desktop', anchorRaw: USER_SCOPE_PATHS['claude-desktop'] as string, anchor: expanduser(USER_SCOPE_PATHS['claude-desktop'] as string), currentFiles: new Set(['agent-config.md']), destSubs: [], packageTag: PACKAGE_TAG_ID, preserved: tracker.conflictState.preserved, staged: tracker.conflictState.staged, recordedFor: tracker.recordedDigest });
     return [bundle_count, 0, 'deployed', [bundles_dir, ...marker_paths]];
 }
 
@@ -3015,18 +3014,11 @@ function _deploy_global_content(
             );
             // Steps 1.1 and 1.4 of road-to-an-installed-layer-that-is-thinned;
             // both modules' headers carry the reasoning.
-            if (installerThinsHost(tool_id, { packageRoot: package_root })) {
-                try {
-                    const thin = thinInstalledRuleLayer({
-                        rulesDir: path.join(anchor, 'rules'),
-                        packageRoot: package_root,
-                        preserved: preserved_now,
-                    });
-                    if (!state.QUIET) for (const l of describeThinInstalledLayer(thin)) info(l);
-                } catch (e) {
-                    warn(`claude-code: thinned rule layer not written — ${String(e)}`);
-                }
-            }
+            deployClaudeCarrier({
+                packageRoot: package_root, rulesDir: path.join(anchor, 'rules'), quiet: state.QUIET, info, warn, userPin: state.FULL_PIN,
+                wantsThin: installerThinsHost(tool_id, { packageRoot: package_root }),
+                thin: (bodyLinkRoot) => describeThinInstalledLayer(thinInstalledRuleLayer({ rulesDir: path.join(anchor, 'rules'), packageRoot: package_root, preserved: preserved_now, bodyLinkRoot })),
+            });
             if (!state.QUIET) for (const l of installReceiptBudgetLines(package_root, undefined, { thisDeploy: new Map([[anchor, current_files]]) })) info(l);
         }
 
@@ -3044,25 +3036,14 @@ function _deploy_global_content(
         }
         _emit_progress({ type: 'verified', tool: tool_id });
 
-        const inventory = global_deploy_inventory.load_inventory();
-        let reaped: string[] = [];
-        const inv_tools = (inventory['tools'] as Record<string, unknown> | undefined) ?? {};
-        if (tool_id in inv_tools) {
-            reaped = reaped.concat(
-                global_deploy_inventory.reap_stale(tool_id, anchor, current_files, inventory),
-            );
-        }
-        reaped = reaped.concat(
-            global_deploy_inventory.reap_tagged_orphans(
-                anchor,
-                plan.map(([, dest_sub]) => dest_sub),
-                current_files,
-                PACKAGE_TAG_ID,
-            ),
-        );
-        reaped = [...new Set(reaped)].sort();
-        global_deploy_inventory.record_deploy(tool_id, anchor_raw, current_files, inventory);
-        global_deploy_inventory.save_inventory(inventory);
+        // Reap, then record the user-scoped ownership ledger — see the module.
+        const { reaped, retained } = recordGlobalDeploy({
+            toolId: tool_id, anchorRaw: anchor_raw, anchor, currentFiles: current_files,
+            destSubs: plan.map(([, dest_sub]) => dest_sub), packageTag: PACKAGE_TAG_ID,
+            preserved: tracker.conflictState.preserved, staged: tracker.conflictState.staged,
+            recordedFor: tracker.recordedDigest,
+        });
+        for (const p of retained) warn(retainedFileMessage(p));
         if (reaped.length > 0 && !state.QUIET) {
             info(
                 `  ${tool_id}: reaped ${reaped.length} stale deployed file(s) ` +
@@ -3072,11 +3053,8 @@ function _deploy_global_content(
         _emit_progress({ type: 'reaped', tool: tool_id, count: reaped.length });
         results[tool_id] = [written_total, skipped_total, 'deployed', written_paths];
 
-        // Single-surface model (road-to-claude-code-single-surface): the
-        // deterministic hook matrix registers directly in the user-scope
-        // settings file — the marketplace plugin is no longer required for
-        // hooks. Failure here must not sink the content deploy (hooks can
-        // be re-wired via `agent-config refresh --global` / doctor).
+        // The hook matrix registers in the user-scope settings file; failure must not sink the
+        // content deploy (re-wire via `agent-config refresh --global` / doctor).
         if (tool_id === 'claude-code') {
             try {
                 const manifest = path.join(package_root, 'src', 'scripts', 'hook_manifest.yaml');
@@ -3151,6 +3129,8 @@ function _preview_global_reap(
                 current_files,
                 PACKAGE_TAG_ID,
                 true,
+                // The ledger spares an edited retired file, so the preview must too.
+                global_deploy_inventory.recorded_digests(tool_id, anchor, inventory),
             ),
         );
         const paths = [...new Set(would_reap.map((p) => String(p)))].sort();
@@ -3296,19 +3276,8 @@ function _rule_filter_for_source(
         ruleFileArrives(srcFile, scope) && !isExclusivelyPackageOnly(srcFile);
 }
 
-/**
- * Prune every skill/command artefact whose `packs:` frontmatter is
- * non-empty AND has no intersection with `active_ids`. Untagged artefacts
- * (empty `packs:` frontmatter) are core/shared and always kept.
- */
-function _prune_scoped_modules(
-    deploy_results: Record<string, DeployResult>,
-    active_ids: ReadonlySet<string>,
-): [number, Record<string, DeployResult>] {
-    return _prune_modules_by(deploy_results, (p) =>
-        scoped_projection.is_pruned_under_scoped(p, active_ids),
-    );
-}
+/** Pack prune that keeps every skill a surviving artefact declares (ADR-289). */
+const _prune_scoped_modules = scoped_projection.prune_scoped_modules;
 
 function install_global(
     tools: Set<string>,
@@ -3438,13 +3407,6 @@ function install_global(
     // here and restores the full tree — never a partial or crashed prune.
     try {
         const { mode, active_packs } = _resolve_scoped_projection(package_root);
-        if (mode === 'tiered') {
-            const outcome = mcp_bridge.applyTieredPrune(deploy_results, package_root, _prune_modules_by);
-            deploy_results = outcome.deployResults;
-            if (!state.QUIET && outcome.message !== null) {
-                (outcome.level === 'warn' ? warn : info)(outcome.message);
-            }
-        }
         if (mode === 'scoped') {
             const packs_registry = _load_packs_registry(package_root);
             const active_ids = _compute_active_pack_ids(packs_registry, active_packs);
@@ -3463,6 +3425,8 @@ function install_global(
             warn(`Scoped-projection prune failed — restoring full tree (${String(e)}).`);
         }
     }
+    // After every prune, so only skills still on disk are computed into the listing override.
+    applyHostListingPolicies({ claudeCode: deploy_results['claude-code']?.[2] === 'deployed', codex: deploy_results['codex']?.[2] === 'deployed' }, os.homedir(), expanduser(USER_SCOPE_PATHS['claude-code']!), state.QUIET ? () => undefined : info);
 
     const failed_tools = new Set<string>(
         Object.keys(deploy_results).filter(
@@ -3758,18 +3722,6 @@ function arrayStrEqual(a: string[], b: string[]): boolean {
 
 // --- Argument parsing ---
 
-function _merge_tools_aliases(tools: string | null, ai: string | null): string {
-    const items: string[] = [];
-    for (const raw of [tools, ai]) {
-        if (!raw) continue;
-        for (const piece of raw.split(',')) {
-            const stripped = piece.trim();
-            if (stripped && !items.includes(stripped)) items.push(stripped);
-        }
-    }
-    return items.length > 0 ? items.join(',') : 'all';
-}
-
 const PROG = 'agent-config install';
 // Verbatim argparse usage block at COLUMNS=80 (captured from the .py). The
 // `--help` BODY (per-flag descriptions) is a documented divergence — argparse
@@ -3782,7 +3734,7 @@ const USAGE =
     '                  [--windsurf-user-hooks] [--gemini-user-hooks]\n' +
     '                  [--project PROJECT] [--package PACKAGE] [--quiet]\n' +
     '                  [--tools TOOLS] [--ai AI] [--packs PACKS] [--core-only]\n' +
-    '                  [--no-smoke] [--global]\n' +
+    '                  [--no-smoke] [--global] [--full]\n' +
     '                  [--scope {project,global,prompt,auto}]\n' +
     '                  [--layer {global,project,both-acknowledged}]\n' +
     '                  [--custom-path CUSTOM_PATH] [--offline] [--minimal]\n' +
@@ -3807,6 +3759,7 @@ const _STORE_TRUE_FLAGS: Record<string, keyof Options> = {
     '--interactive': 'interactive',
     '--no-ui': 'no_ui',
     '--dry-run': 'dry_run',
+    '--full': 'full',
 };
 
 const _VALUE_FLAGS: Record<string, keyof Options> = {
@@ -3856,6 +3809,7 @@ function parse_options(argv: string[]): Options {
         interactive: false,
         no_ui: false,
         dry_run: false,
+        full: false,
         apply_payload: null,
         layer: null,
     };
@@ -4478,7 +4432,7 @@ function _dry_run_summary(opts: Options): number {
     process.stdout.write(`  user-type:   ${opts.user_type || '(none)'}\n`);
     process.stdout.write(`  scope:       ${opts.scope || (opts.global_install ? 'global' : 'auto')}\n`);
     process.stdout.write(`  tools:       ${opts.tools || 'all'}\n`);
-    process.stdout.write(`  target:      ${target}\n`);
+    process.stdout.write(dryRunTargetLines(Boolean(opts.global_install) || opts.scope === 'global', _parse_tools(opts.tools || 'all'), target));
     process.stdout.write(`  minimal:     ${pyBool(opts.minimal)}\n`);
     process.stdout.write(`  force:       ${pyBool(opts.force)}\n`);
     process.stdout.write(`  offline:     ${pyBool(opts.offline)}\n`);
@@ -4567,6 +4521,7 @@ function pyRepr(v: unknown): string {
 function main(argv: string[]): number {
     const opts = parse_options(argv);
     state.QUIET = opts.quiet;
+    state.FULL_PIN = opts.full || _legacy_projection_pin();
 
     if (opts.apply_payload) {
         const payload_path = resolvePath(opts.apply_payload);
@@ -4750,6 +4705,22 @@ function _propose_modules_config(project_root: string, is_first_run: boolean): v
     );
 }
 
+/**
+ * ADR-293's one-window read of the removed projection keys — rules in
+ * `_lib/projection_key_migration.ts`. MACHINE-global layers only, with the
+ * TEMPLATE isolated (ADR-278 / D3: a template value is not consent, and the
+ * shipped template carried `delivery`), and a layer nothing can read states no
+ * preference. `_ABSENT_LAYER` is [project, template]; no tree contains either.
+ */
+const _ABSENT_LAYER: readonly [string, string] = ['project-settings', 'template'].map((n) => path.join(path.sep, 'dev', 'null', `agent-config-absent-${n}.yml`)) as unknown as readonly [string, string];
+function _legacy_projection_pin(): boolean {
+    let data: Record<string, unknown> | null = null;
+    try {
+        data = load_agent_settings({ project_path: _ABSENT_LAYER[0], template_path: _ABSENT_LAYER[1] });
+    } catch { /* empty */ }
+    return legacyProjectionPin(data, (line) => warn(line));
+}
+
 function _read_consumer_auto_switch(project_root: string): string {
     let data: Record<string, unknown>;
     try {
@@ -5101,8 +5072,6 @@ export {
     ensure_cursor_bridge,
     ensure_cline_bridge,
     ensure_mcp_bridge,
-    _prune_tier_b_modules,
-    _resolve_tier_b,
     _tier_b_advisory,
     ensure_windsurf_bridge,
     ensure_gemini_bridge,

package/src/scripts/interruption_report.ts

@@ -94,7 +94,17 @@ export interface RunReport {
     elapsed_minutes: number | null;
     waiting_minutes: number | null;
     working_minutes: number | null;
-    /** `engage` events for this run in `run-continuation.jsonl`. */
+    /**
+     * `engage` events for this run in `run-continuation.jsonl`.
+     *
+     * The concern that wrote that ledger was withdrawn on its own
+     * pre-registered kill date (road-to-what-was-built-and-never-ran Phase 4),
+     * so this reads a HISTORICAL record: three lines, the last from
+     * 2026-08-19. The read is kept because the kill criterion kept the
+     * observation record, and a run that engaged before the withdrawal did
+     * engage. A fresh checkout has no file and the count is 0, which is the
+     * same answer it gave for every run that never engaged.
+     */
     reengagements: number;
     /** `halt-stall` events — the anti-stall rung firing, not the loop working. */
     stall_halts: number;