@ours.network/install 0.17.0-nightly.15 → 0.17.0-nightly.17

package/lib/components.mjs

@@ -7,8 +7,7 @@
 //
 // The three components are the MCP server, the Telegram connector and cowork.
 // None of them IS the daemon; all three attach to one. The messenger is out of
-// scope by the owner's instruction, and ours-fleet sits on top and is not
-// installed here.
+// scope here, and ours-fleet sits on top and is not installed here.
 
 import { join, resolve } from 'node:path';
 import { pkgSpec, resolveChannel } from './logic.mjs';
@@ -23,12 +22,13 @@ import { pkgSpec, resolveChannel } from './logic.mjs';
 // effects.installedVersion('@ours.network/mcp@nightly') return null forever,
 // which fails the cowork version floor CLOSED and blanks the version column —
 // a silent regression that looks like "cowork is too old".
-// `required` is not a stronger default — it is the absence of a choice. The MCP
-// package IS the daemon now (the daemon phase installs and starts it), so an
-// operator who declined it would have no daemon at all, which is not a decision
-// anyone means to make. Declining has to be impossible rather than discouraged.
+// `required` is not a stronger default — it is the absence of a choice. The
+// daemon is the ours-sdk CLI and this package is the MCP server every harness
+// speaks to it through, so an operator who declined it would have a daemon no
+// harness can reach — which is not a decision anyone means to make. Declining
+// has to be impossible rather than discouraged.
 export const COMPONENTS = [
-  { key: 'mcp', label: 'ours daemon + MCP server', pkg: '@ours.network/mcp', specKey: 'mcp', default: true, required: true },
+  { key: 'mcp', label: 'MCP server for your harness', pkg: '@ours.network/mcp', specKey: 'mcp', default: true, required: true },
   { key: 'tg', label: 'Telegram connector', pkg: '@ours.network/tg-connector', specKey: 'tg-connector', default: false },
   { key: 'cowork', label: 'cowork', pkg: '@ours.network/cowork', specKey: 'cowork', default: false },
 ];
@@ -45,7 +45,7 @@ export const COMPONENTS = [
  * over. Every install path for these three now goes through here.
  *
  * All three publish a real `nightly` dist-tag (verified against the registry,
- * 2026-08-17), so none of these pins can 404. `pkgSpec` falls back to `latest`
+ * so none of these pins can 404. `pkgSpec` falls back to `latest`
  * for anything unmapped rather than inventing a tag, so an unknown component
  * degrades to today's behaviour instead of failing.
  *
@@ -88,10 +88,10 @@ export const COWORK_DAEMON_FLOOR = '0.4.1-nightly.20260816.4aaf940';
  * daemon side, and anything the installer clears here is gone. The installer's
  * entire business with the connector is three keys in one config file.
  *
- * This also keeps the door open for the route migration the owner is considering
- * — moving each route's packet into the shared daemon. That migration has to read
- * this registry to know which daemon identity corresponds to which route; an
- * installer that had trampled it would have destroyed the mapping.
+ * It also keeps a future route migration possible — moving each route's packet
+ * into the shared daemon has to read this registry to know which daemon identity
+ * corresponds to which route, and an installer that trampled it would have
+ * destroyed the mapping.
  */
 export const TG_STATE_DIR_NAME = '.ours-telegram';
 export const TG_REGISTRY_FILES = ['bots.json'];

package/lib/detect.mjs

@@ -1,19 +1,17 @@
 // ours-install v3 — which daemons are already on this machine, and which one this
 // run is for.
 //
-// OWNER RULING (C1, 2026-08-17), and the whole shape of this file follows from it:
-// never ask the user to TYPE a state directory or a port — that is what spec §2
-// forbids and it stands — but when several daemons are DETECTED, show them and let
-// the user pick. Selection from what was found is not prompting for a path.
+// Never ask for a state directory or a port to be TYPED (spec §2). When several
+// daemons are DETECTED, show them and let one be picked: selecting from what was
+// found is not prompting for a path.
 //
 // Pure, like target.mjs and plan.mjs: the caller injects the directory listing and
 // the file reads, so the whole decision is testable without a filesystem.
 //
-// DETECTION, NOT A REGISTRY. Coordinator ruling: build this from what is actually
-// on disk rather than from a persisted ~/.ours/installer-profiles.json. A stored
-// list is a second source of truth that goes stale against the daemons that really
-// exist, and staleness in exactly that file is how an installer ends up
-// confidently offering a daemon that is gone.
+// DETECTION, NOT A REGISTRY. This is built from what is on disk rather than from a
+// persisted list: a stored list is a second source of truth that goes stale against
+// the daemons that really exist, which is how an installer ends up confidently
+// offering a daemon that is gone.
 
 import { basename, join, resolve } from 'node:path';
 
@@ -93,8 +91,7 @@ export function detectDaemons({ candidates = [], exists, readJson }) {
 /**
  * A state directory for a daemon this run would CREATE, derived and never typed.
  *
- * Spec §2 forbids asking for a path, and the C1 ruling did not change that — it
- * added "pick from what was found". So "create a new one" has to derive somewhere
+ * Spec §2 forbids asking for a path, so "create a new one" has to derive somewhere
  * to put it: `~/.ours` when free, else the first free `~/.ours-2`, `~/.ours-3`…
  * An operator who wants a specific path still has `--state-dir`, which bypasses
  * this screen entirely.
@@ -113,8 +110,8 @@ export function deriveNewStateDir(home, taken = [], { limit = 64 } = {}) {
 export const SELECT_CREATE = '__create__';
 
 // The nightly flow kept a registry of daemon profiles here. v3 does not read it —
-// detection replaced it (coordinator ruling) — so anyone who used that flow has a
-// file describing daemons that nothing consults any more.
+// detection replaced it — so anyone who used that flow has a file describing
+// daemons that nothing consults any more.
 //
 // It is NOT deleted. Quietly removing a file that describes someone's daemons is
 // not an installer's business, and the file is harmless. But leaving it looking

package/lib/extras.mjs

@@ -1,8 +1,7 @@
 // ours-install v3 — the four retained extras, re-pointed at the v3 arrangement.
 //
-// Owner ruling 2026-08-17: the v3 installer KEEPS harness plugins, ours-fleet,
-// voice setup and the copy-paste hand-off prompt. Spec v3's silence about them
-// was an oversight, not a decision.
+// The v3 installer keeps harness plugins, ours-fleet, voice setup and the
+// copy-paste hand-off prompt; spec v3's silence about them was an oversight.
 //
 // They are not four more screens carried across, because v2 and v3 disagree
 // about which package IS the daemon. In v2 @ours.network/mcp is the daemon and
@@ -52,7 +51,7 @@ export const HARNESSES = [
  *
  * So §5's guarantee is ALREADY unmet today for every non-default state
  * directory, silently: the harness attaches to ~/.ours while the operator was
- * told the run targeted somewhere else. Owner ruling Q1 settles the shape:
+ * told the run targeted somewhere else. The shape is:
  *
  *   default state directory   today's behaviour, byte for byte.
  *   Hermes, non-default       real: the pair is handed to ours-hermes-install's
@@ -270,7 +269,7 @@ export function planFleet({ stateDir, isDefaultStateDir, wanted = true, channel
 // -----------------------------------------------------------------------------
 
 /**
- * WHY THE INSTALLER OWNS THE RESTART NOW (owner ruling Q2).
+ * WHY THE INSTALLER OWNS THE RESTART.
  *
  * cmdVoiceSetup computes `managed = runningPid() !== null` from ours-mcp's OWN
  * pid record. A v3 daemon is started by `ours daemon start`, which writes
@@ -283,8 +282,8 @@ export function planFleet({ stateDir, isDefaultStateDir, wanted = true, channel
  * CLI-started daemon, which is right. But v2's entire restart protocol
  * (restartHandled, the exit-2 branch, "voice setup performed the required
  * restart") can only fire for a `managed` daemon, so carrying it across would
- * ship a branch that can never be taken. The beat it owned now has no owner, and
- * the installer is the only process that knows the daemon is CLI-managed.
+ * ship a branch that can never be taken. Nothing else owns that beat, and the
+ * installer is the only process that knows the daemon is CLI-managed.
  *
  * One phase, AFTER the component phase — voice-setup is an `ours-mcp`
  * subcommand and v3 installs @ours.network/mcp as a COMPONENT, so it is not on
@@ -337,8 +336,8 @@ export function planVoice({
     // TOUCHES THIS NEXT — the reason the installer owns this beat at all may have
     // just evaporated: cmdVoiceSetup computes `managed = runningPid() !== null`
     // from ours-mcp's OWN pid record, and an ours-mcp daemon HAS one. Under the
-    // SDK-CLI daemon it never did, which is why the restart had no owner and the
-    // installer took it. If voice-setup now classifies the daemon as managed it
+    // SDK-CLI daemon it never did, which is why the installer took the restart.
+    // If voice-setup now classifies the daemon as managed it
     // will run its own restart protocol, and this becomes a second restart rather
     // than the only one. Not changed here: that is a behaviour question for
     // packages/core, not a rename.

package/lib/journal.mjs

@@ -71,7 +71,10 @@ export function configJournal(effects, { dryRun = false } = {}) {
       for (const entry of entries.slice().reverse()) {
         try {
           effects.restore(entry.path, entry.snapshot);
-          restored.push({ path: entry.path, existed: entry.snapshot?.exists !== false });
+          // A write that RETURNED is not a file that HOLDS. Read the bytes back.
+          const mismatch = verifyRestored(effects, entry);
+          if (mismatch) failed.push({ path: entry.path, reason: mismatch });
+          else restored.push({ path: entry.path, existed: entry.snapshot?.exists !== false });
         } catch (error) {
           failed.push({ path: entry.path, reason: error instanceof Error ? error.message : String(error) });
         }
@@ -82,6 +85,48 @@ export function configJournal(effects, { dryRun = false } = {}) {
   };
 }
 
+/**
+ * Did the restore actually take? Returns null when it did, or the reason it did not.
+ *
+ * WHY THIS EXISTS. `restore` returning is evidence that a call completed, not that
+ * a file holds the bytes it was given. A full disk, a read-only mount, a rename
+ * that lands somewhere else, an editor holding the inode — each of those can let
+ * the write return and leave the old contents in place. Reporting on the call
+ * rather than on the state is how a rollback comes to LIE, and a rollback that
+ * lies is worse than one that admits it failed: the operator is told the machine
+ * is back where it was and stops looking.
+ *
+ * The read-back seam is `effects.snapshot`, the same one used to record the bytes
+ * in the first place — it already returns exactly the shape being compared, so
+ * this needs no second seam and no second notion of what a file's state is.
+ *
+ * Its own failure is a mismatch, not an exception: if the file cannot be read
+ * after being written, that is precisely the case this check exists to catch.
+ */
+function verifyRestored(effects, entry) {
+  const expected = entry.snapshot;
+  let actual;
+  try {
+    actual = effects.snapshot(entry.path);
+  } catch (error) {
+    return `restored, but the file could not be read back to confirm it (${error instanceof Error ? error.message : String(error)})`;
+  }
+  const shouldExist = expected?.exists !== false;
+  if (!shouldExist) {
+    return actual?.exists ? 'this run created it and the removal did not take — the file is still there' : null;
+  }
+  if (!actual?.exists) return 'the restore reported success but the file is not there';
+  if (actual.text !== expected.text) return 'the restore reported success but the bytes on disk are not the previous ones';
+  // Bytes first, permissions second: the contents are back either way, so this
+  // must not be reported as "could not restore the config".
+  if (expected.mode !== undefined && actual.mode !== undefined && actual.mode !== expected.mode) {
+    return `contents restored, but the permissions are ${fmtMode(actual.mode)} and were ${fmtMode(expected.mode)} — check them before re-running`;
+  }
+  return null;
+}
+
+const fmtMode = (mode) => `0${(mode & 0o777).toString(8).padStart(3, '0')}`;
+
 /**
  * The report, and it is half the feature.
  *

package/lib/logic.mjs

@@ -26,7 +26,7 @@ export function canonHarnesses(raw) {
   return { names, unknown };
 }
 
-// ── Release CHANNEL / npm dist-tag selection (owner 2026-07-17) ─────────────────
+// ── Release CHANNEL / npm dist-tag selection ───────────────────────────────────
 // The installer normally installs everything at @latest (stable). Setting
 // OURS_CHANNEL=nightly (or OURS_INSTALL_CHANNEL) makes it install each package's
 // PRERELEASE dist-tag instead — for the packages that publish one.
@@ -37,8 +37,8 @@ export function canonHarnesses(raw) {
 //     from this repo by .github/workflows/scripts/bump-versions.sh)
 //   · fleet                                          → `nightly` (its own repo,
 //     adapt-toolkit/ours-fleet, publishes a nightly dist-tag of its own)
-//   · cowork (rooms)                                 → `nightly` (owner decision
-//     2026-08-16: cowork aligns with every other service rather than keeping its
+//   · cowork (rooms)                                 → `nightly` (cowork aligns
+//     with every other service rather than keeping its
 //     historical `next` tag)
 //
 // WHY FLEET FOLLOWS THE CHANNEL NOW. It used to be pinned to @latest with the note
@@ -49,7 +49,7 @@ export function canonHarnesses(raw) {
 // channel exists to prevent.
 //
 // WHY COWORK STILL NEEDS ITS OWN ENTRY. It historically published its prerelease
-// line as `next`; the owner's decision on 2026-08-16 is that it aligns with every
+// line as `next`; the decision is that it aligns with every
 // other service and publishes `nightly` instead. The entry stays because the map,
 // not a hardcoded string, is what makes such a change one line — and because an
 // UNMAPPED package deliberately falls back to `latest` rather than a guessed tag.
@@ -60,7 +60,7 @@ export function canonHarnesses(raw) {
 // build that predates it — the same architecture-boundary mismatch this whole
 // mechanism exists to prevent, pointed at Rooms instead of Telegram.
 //
-// SEQUENCING — load-bearing, and not yet satisfied. As of 2026-08-16 cowork
+// SEQUENCING — load-bearing, and not yet satisfied. cowork
 // publishes NO `nightly` dist-tag at all (its tags are latest=0.4.0 and
 // next=0.3.7-nightly.20260815.80ea770). `npm i -g @ours.network/cowork@nightly`
 // therefore 404s today, and a 404 fails the WHOLE install. So the nightly
@@ -81,7 +81,7 @@ const PKG_CHANNEL_TAGS = {
   codex: { nightly: 'nightly' },
   hermes: { nightly: 'nightly' },
   fleet: { nightly: 'nightly' },
-  cowork: { nightly: 'nightly' }, // aligned with every other service (owner, 2026-08-16)
+  cowork: { nightly: 'nightly' }, // aligned with every other service
 };
 
 // Normalize a raw channel selection to 'latest' | 'nightly'. Anything unrecognized
@@ -600,7 +600,10 @@ export function parseVersion(text) {
 export function parseStatus(text) {
   const s = String(text || '');
   const bm = s.match(/^\s*broker:\s*(\S+)/m);
-  const pm = s.match(/url:\s*https?:\/\/[^:\s/]+:(\d+)/i);
+  // `api:` is the current line and `url:` the historical one. Both are matched
+  // because a newly installed CLI can be asked to report on an older running
+  // daemon, and a parser that knows only today's wording reads that as "no port".
+  const pm = s.match(/(?:api|url):\s*https?:\/\/[^:\s/]+:(\d+)/i);
   return {
     broker: bm ? bm[1] : null,
     port: pm ? Number.parseInt(pm[1], 10) : null,
@@ -644,7 +647,7 @@ export function detectPlatform({ platform, release = '', env = {} } = {}) {
 //               tell the user plainly + how to fix, and ALWAYS still offer a manual path
 //   'unsafe'  — on PATH but the probe failed/looked wrong → don't auto-drive; offer manual path
 //   'absent'  — genuinely not installed → this harness is skipped (with a note)
-// The golden rule (owner edit #3): 'alias'/'unsafe'/'absent' NEVER dead-end — the caller always
+// The golden rule: 'alias'/'unsafe'/'absent' NEVER dead-end — the caller always
 // prints a manual-install path so the component still gets installed.
 export function classifyHarnessProbe({ onPath, versionOk, timedOut, shellType = '' } = {}) {
   if (versionOk) return { status: 'ok', detail: 'real program' };

package/lib/orchestrate-uninstall.mjs

@@ -330,6 +330,9 @@ export async function runPluginPhase(plugins, { args, effects, selection = null
         effects.out(warn(`${block.path}: ${stripped.reason}. Remove it by hand.`));
         continue;
       }
+      // Deliberately NOT journalled: this write IS the state its bytes describe, so
+      // nothing behind it can fail and leave them untrue. Adding one would undo a
+      // completed removal.
       await perform(effects, args.dryRun, `remove the ours managed block from ${block.path} (file kept)`, () => effects.writeText(block.path, stripped.text));
     }
     for (const dir of harness.dirs) {

package/lib/orchestrate.mjs

@@ -100,7 +100,7 @@ function pairFor(plan, target) {
 }
 
 /**
- * Which daemon is this run for? (C1, owner ruling 2026-08-17.)
+ * Which daemon is this run for?
  *
  * Never asks for a PATH — spec §2 stands — but when several daemons are DETECTED
  * it shows them and lets the operator pick, because choosing from what was found
@@ -209,15 +209,18 @@ export async function runDaemonPhase(args, effects) {
 
   // Asked ONCE, and only when this run is creating the daemon — an existing
   // daemon's broker is its own record, and re-asking would invite an operator to
-  // change it from a screen that is not about changing it. Owner ruling: the
-  // broker question stays in v3. It is orthogonal to --state-dir/--port, so it
+  // change it from a screen that is not about changing it. The broker question
+  // stays in v3: it is orthogonal to --state-dir/--port, so it
   // does not violate spec §2's "nothing about a state directory or a port
   // appears in any prompt".
   if (creating) args.brokerUrl = await askBroker(args, effects);
 
   const steps = [];
 
-  // THE DAEMON IS ours-mcp, SO ITS PACKAGE COMES FIRST.
+  // The daemon is the ours-sdk CLI; ours-mcp is the per-session MCP server the
+  // harness spawns, and it reaches the daemon over the HTTP API. Both are
+  // installed here and both are required: an install without ours-mcp leaves a
+  // machine with a daemon and no MCP at all.
   //
   // This used to install @ours.network/cli, because the daemon used to be
   // `ours daemon serve`. That daemon does not mount /mcp — the SDK serves that
@@ -230,13 +233,15 @@ export async function runDaemonPhase(args, effects) {
   //
   // The order therefore inverts: the MCP package was a COMPONENT installed after
   // this phase, and it is now the thing this phase starts.
-  const daemonPkg = componentSpec(componentByKey('mcp'), args.channel);
-  await perform(effects, args.dryRun, `ours daemon installed (npm i -g ${daemonPkg})`, () => effects.run('npm', ['i', '-g', daemonPkg]));
-  steps.push({ id: 'daemon-package', changed: true, packageRefresh: true });
+  const mcpPkg = componentSpec(componentByKey('mcp'), args.channel);
+  await perform(effects, args.dryRun, `MCP server installed (npm i -g ${mcpPkg})`, () => effects.run('npm', ['i', '-g', mcpPkg]));
+  steps.push({ id: 'mcp-package', changed: true, packageRefresh: true });
+  await perform(effects, args.dryRun, 'ours CLI installed (npm i -g @ours.network/cli)', () => effects.run('npm', ['i', '-g', '@ours.network/cli']));
+  steps.push({ id: 'cli', changed: true, packageRefresh: true });
 
   // The config file — merged, never rewritten, and untouched when it already
-  // matches. No provenance marker is written: the owner ruled that --purge works
-  // on any state directory, so a `createdBy` key would have had no consumer, and
+  // matches. No provenance marker is written: --purge works on any state
+  // directory, so a `createdBy` key would have no consumer, and
   // an unread key in a user's config file is future confusion for nothing.
   const configPath = join(dir, 'config.json');
   const merged = planDaemonConfig(
@@ -254,6 +259,7 @@ export async function runDaemonPhase(args, effects) {
   // lookup exists to prevent; this is what stops the installer from setting up the
   // conditions for it.
   const journal = configJournal(effects, { dryRun: args.dryRun });
+  let serviceUnsupported = null;
   if (merged.changed) {
     journal.snapshot(configPath);
     await perform(effects, args.dryRun, `write ${configPath} (port ${target.port})`, () => effects.writeJson(configPath, merged.text));
@@ -264,18 +270,12 @@ export async function runDaemonPhase(args, effects) {
 
   try {
     if (creating) {
-      // `start`, not `serve`: start backgrounds the daemon and polls until the port
-      // is open, which is the same observable readiness the old path had. `serve`
-      // runs in the foreground and would never return.
-      //
-      // Selected by ENVIRONMENT rather than flags — ours-mcp reads OURS_CONFIG /
-      // OURS_PORT / OURS_STATE_DIR — and daemonEnv is the one place that pair is
-      // built, so the daemon this run created is the daemon that starts.
-      await perform(effects, args.dryRun, `start the daemon on port ${target.port}`, () => effects.run('ours-mcp', ['start'], { env: daemonEnv(dir, target.port) }));
+      await perform(effects, args.dryRun, `start the daemon on port ${target.port}`, () => effects.run('ours', ['daemon', 'start', '--config', configPath]));
       steps.push({ id: 'start', changed: true });
     }
 
     const service = await runServicePhase(args, effects, dir, target.port);
+    if (service.unsupported) serviceUnsupported = service.unsupported;
     if (service.refused) {
       // A REFUSAL IS A FAILURE TO REACH THE STATE, not a special case. An unknown
       // unit file stops the run just as a failed start does, and it stops it with
@@ -304,12 +304,12 @@ export async function runDaemonPhase(args, effects) {
       effects.out(recovery.recovered
         ? ok('your daemon is running again — nothing was committed, and the service is unchanged')
         : warn('and the daemon did NOT come back up — start it yourself before anything else: '
-          + `OURS_CONFIG=${configPath} ours-mcp start`));
+          + `ours daemon start --config ${configPath}`));
     }
     throw error;
   }
 
-  return { target, steps };
+  return { target, steps, serviceUnsupported };
 }
 
 /**
@@ -327,7 +327,7 @@ export async function runDaemonPhase(args, effects) {
 async function recoverDaemon(args, effects, dir, configPath, port) {
   if (args.dryRun) return null;
   try {
-    await effects.run('ours-mcp', ['start'], { env: daemonEnv(dir, port) });
+    await effects.run('ours', ['daemon', 'start', '--config', configPath]);
     return { recovered: true };
   } catch (recoveryError) {
     return { recovered: false, reason: reason(recoveryError) };
@@ -367,11 +367,24 @@ function rollBack(effects, journal, args, why, { packagesInstalled = true, repla
  * The boot service: §4 step 4, including the legacy-unit case.
  *
  * A legacy ours-mcp unit is adopted SILENTLY, with one informational line naming
- * the file — the owner's decision. `--force` is passed ONLY here, only for a unit
+ * the file. `--force` is passed ONLY here, only for a unit
  * positively identified as ours-mcp's, and never for one we cannot identify.
  */
 export async function runServicePhase(args, effects, dir, port) {
-  const plan = planServiceInstall({ stateDir: dir, home: effects.home, readText: effects.readText });
+  const plan = planServiceInstall({
+    stateDir: dir, home: effects.home, readText: effects.readText, platform: effects.platform?.platform,
+  });
+  // NOT a refusal and NOT a failure: the daemon is running and correct, and only
+  // the boot service could not be installed — `ours daemon install-service` throws
+  // on any non-linux platform. The run CONTINUES, says so, and the summary marks
+  // it, because the person this hurts reboots in a fortnight and finds nothing
+  // listening.
+  if (plan.action === 'unsupported') {
+    effects.out(warn(`ours: ${plan.message}`));
+    effects.out(info(`Your daemon is installed and running now. To start it after a reboot, run:  ${plan.manual.join(' ')} ${join(dir, 'config.json')}`));
+    effects.out(info('Nothing else in this run depends on the boot service.'));
+    return { step: { id: 'service', changed: false, reason: 'not available on this platform' }, plan, unsupported: plan };
+  }
   if (plan.action === 'refuse') {
     effects.out(warn(`ours: refusing to continue — ${plan.message}`));
     return { refused: plan };
@@ -608,7 +621,7 @@ async function attachComponent(component, { args, effects, dir, endpoint, isDefa
 }
 
 /**
- * The broker question (v2's Step 0a, kept by the owner's ruling).
+ * The broker question (v2's Step 0a, deliberately kept).
  *
  * Consent-first, with the undo built in: a mistaken custom address is one
  * keystroke back to the standard broker, because the alternative is an operator
@@ -671,6 +684,9 @@ export function runPreflight(effects) {
     return { ok: false, platform: plat };
   }
   effects.out(ok(`Platform: ${plat.label} (supported)`));
+  if (effects.platform?.platform && effects.platform.platform !== 'linux') {
+    effects.out(info(`On ${plat.label} the daemon runs, but installing a BOOT SERVICE is not available — you will start it yourself after a reboot.`));
+  }
   const version = String(effects.nodeVersion ?? '0');
   if (Number.parseInt(version.split('.')[0], 10) < 20) {
     effects.out(warn(`Node.js ${version} — ours needs v20 or newer. Update Node and re-run.`));
@@ -681,7 +697,7 @@ export function runPreflight(effects) {
 }
 
 /**
- * The human identity: `ours-mcp create-root`, kept by the owner's ruling.
+ * The human identity: `ours-mcp create-root`.
  *
  * It needs `ours-mcp` on PATH and a reachable daemon, so under v3 it lands here
  * — after the component phase installed the MCP server, not back in the daemon
@@ -743,7 +759,7 @@ export async function runIdentityPhase(args, effects, { target, mcpReady }) {
       // by environment instead, so the pair travels as an env prefix rather than a
       // flag. A retry command that omits it would start the DEFAULT daemon — which
       // is how someone ends up with an identity on a daemon they did not choose.
-      effects.out(info(`Fix: run 'OURS_CONFIG=${env.OURS_CONFIG} ours-mcp start', then 'OURS_CONFIG=${env.OURS_CONFIG} ours-mcp create-root "${name}"'.`));
+      effects.out(info(`Fix: run 'ours daemon start --config ${env.OURS_CONFIG}', then 'OURS_CONFIG=${env.OURS_CONFIG} ours-mcp create-root "${name}"'.`));
       return { key: 'identity', label: 'Human identity', state: 'failed', note: 'daemon not reachable' };
     }
     effects.out(warn(`Couldn't create your human identity: ${text.split('\n')[0]}`));
@@ -876,7 +892,6 @@ export async function runFleetPhase(args, effects, { target, isDefaultStateDir }
   // Passing it is harmless if extras.mjs is right and load-bearing if
   // nightly-install.mjs is. When the cheap action is safe under both readings and
   // the expensive one is only safe under one, take the cheap one. (Coordinator
-  // ruling, 2026-08-17.)
   //
   // Passed for EVERY state directory, not only a non-default one, exactly as the
   // nightly flow does: `init` is a one-time host setup and the pair is what names
@@ -1110,6 +1125,17 @@ export async function runInstall(argv, effects) {
     state: target.action === 'create' ? 'installed' : 'current',
     note: `port ${target.port}`,
   }];
+  // The skip must not read as success: same "needs attention" mark a failed
+  // component gets, so the closing screen cannot say everything is clean.
+  if (daemon.serviceUnsupported) {
+    summary.push({
+      key: 'service',
+      label: 'Boot service',
+      state: 'failed',
+      note: `not available on ${daemon.serviceUnsupported.platform === 'darwin' ? 'macOS' : daemon.serviceUnsupported.platform} — start the daemon yourself after a reboot`,
+    });
+  }
+
   const components = await runComponentPhase(args, effects, target);
   for (const component of COMPONENTS) {
     const state = components.installed.includes(component.key) ? 'installed'

package/lib/plan.mjs

@@ -94,10 +94,9 @@ export function classifyUnit(text) {
  *                                                  informational line naming it
  *   { action: 'refuse', exitCode: 2, … }         — unknown unit, or unusable state dir
  *
- * Adoption of a legacy unit is SILENT by the owner's decision: no prompt, no
- * question, so an upgrading user has no manual step. The one line of output
- * exists so the replacement is not literally invisible; it does not block and it
- * is not a warning.
+ * Adoption of a legacy unit is SILENT: no prompt, no question, so an upgrading
+ * user has no manual step. The one line of output exists so the replacement is not
+ * literally invisible; it does not block and it is not a warning.
  *
  * BECAUSE THERE IS NO PROMPT, `classifyUnit`'s `legacy` match is now the ENTIRE
  * safety boundary between a stranger's file and a silent rewrite. It must stay
@@ -130,18 +129,20 @@ export function planServiceInstall({ stateDir, home, readText, platform = 'linux
   // A real launchd adapter belongs in the SDK CLI, not here. Nothing in this
   // package can install a launchd agent, and pretending otherwise by writing a
   // plist ourselves would put a second service implementation in a second repo.
-  // THE macOS SKIP IS GONE, AND THAT IS A CONSEQUENCE OF THE DAEMON CHANGE.
-  //
-  // It existed because `ours daemon install-service` refuses on any non-linux
-  // platform — createLinuxUserSystemdAdapter() throws on its first line, and the
-  // whole @ours.network/cli package contains no launchd support. That was true and
-  // is no longer the relevant question: the unit is now installed by ours-mcp's
-  // own install-service, which handles systemd AND launchd
-  // (packages/core/src/cli.ts writes ~/Library/LaunchAgents and runs launchctl
-  // bootstrap). So macOS gets a real boot service rather than a named gap.
-  //
-  // A gap list that warns about something already fixed is as misleading as one
-  // that hides something broken, which is why the warning goes with the skip.
+  // `ours daemon install-service` supports Linux/systemd only: its adapter throws
+  // for any other platform, so calling it would fail the run rather than degrade.
+  // Skip it and say so; the daemon itself is unaffected.
+  if (platform && platform !== 'linux') {
+    return {
+      action: 'unsupported',
+      platform,
+      reason: 'no-service-manager',
+      message: platform === 'darwin'
+        ? 'installing a boot service is not available on macOS — the ours CLI can only manage a Linux user systemd service'
+        : `installing a boot service is not available on ${platform} — the ours CLI can only manage a Linux user systemd service`,
+      manual: ['ours', 'daemon', 'serve', '--config'],
+    };
+  }
   const derived = unitPathForStateDir(stateDir, home);
   if (!derived.ok) {
     return { action: 'refuse', exitCode: 2, reason: 'unusable-state-dir', message: derived.reason };
@@ -211,35 +212,12 @@ export function serviceInstallCommand({ stateDir, adoptLegacyUnit = false }) {
   // --json so the caller can read back whether the unit actually CHANGED. The
   // CLI owns that byte-comparison, and an installer that guessed at it would
   // report "nothing changed" on a run that rewrote a unit.
-  // ours-mcp's install-service, NOT the SDK CLI's, and the difference is not
-  // cosmetic. `ours daemon install-service` writes a unit whose ExecStart runs
-  // `ours daemon serve` — a daemon that does not mount /mcp — so the boot service
-  // would resurrect exactly the daemon the /mcp 404 came from. ours-mcp's writes
-  // ExecStart=<node> <ours-mcp> serve (packages/core/src/service-instance.ts:106),
-  // and it handles launchd as well as systemd.
-  //
-  // It takes no arguments: like `start`, it is selected by OURS_CONFIG /
-  // OURS_PORT / OURS_STATE_DIR, and it BAKES those resolved values into the unit.
-  // The caller passes the pair as an environment, which is why this returns a bare
-  // command and the orchestrator supplies daemonEnv.
-  //
-  // WHAT IS LOST, stated rather than discovered later. ours-mcp's install-service
-  // takes NO flags:
-  //
-  //   · no --json, so the caller cannot read back whether the unit actually
-  //     changed. `changed` is now assumed true, which is the safe direction for a
-  //     summary line but is an assumption where it used to be an answer.
-  //   · no --force, and no marker check either: it writes the unit file
-  //     unconditionally. The SDK CLI refused to overwrite a unit it had not
-  //     marked, and that refusal was the backstop behind classifyUnit. It is gone.
-  //     classifyUnit's `foreign` refusal is now the ONLY thing standing between a
-  //     stranger's unit file and an overwrite, so `adoptLegacyUnit` no longer
-  //     changes the COMMAND — it records that the caller already decided, and the
-  //     decision is enforced entirely by refusing to get here at all.
-  //
-  // That is a real reduction in defence in depth and it belongs in the PR, not in
-  // a comment nobody reads.
-  return ['ours-mcp', 'install-service'];
+  // --json so the caller can read back whether the unit actually CHANGED rather
+  // than assuming it did. --force is reachable only through the explicit argument
+  // above, and the CLI refuses to overwrite a unit it did not write.
+  const cmd = ['ours', 'daemon', 'install-service', '--yes', '--json', '--state-dir', dir, '--config', join(dir, 'config.json')];
+  if (adoptLegacyUnit) cmd.push('--force');
+  return cmd;
 }
 
 // -----------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "0.17.0-nightly.15",
+  "version": "0.17.0-nightly.17",
   "private": false,
   "description": "The unified ours.network stack installer (ours-install): one guided ~3-minute flow for ours core (the daemon) + the harness plugins (Claude Code / Codex) + ours-fleet + the Telegram connector, then a single copy-paste hand-off prompt. Self-contained (Node built-ins only); run as `ours-install` or via curl|bash (install.sh).",
   "type": "module",