@ours.network/install 0.17.0-nightly.9 → 0.18.0-nightly.1

package/lib/components.mjs

@@ -7,8 +7,7 @@
 //
 // The three components are the MCP server, the Telegram connector and cowork.
 // None of them IS the daemon; all three attach to one. The messenger is out of
-// scope by the owner's instruction, and ours-fleet sits on top and is not
-// installed here.
+// scope here, and ours-fleet sits on top and is not installed here.
 
 import { join, resolve } from 'node:path';
 import { pkgSpec, resolveChannel } from './logic.mjs';
@@ -23,8 +22,13 @@ import { pkgSpec, resolveChannel } from './logic.mjs';
 // effects.installedVersion('@ours.network/mcp@nightly') return null forever,
 // which fails the cowork version floor CLOSED and blanks the version column —
 // a silent regression that looks like "cowork is too old".
+// `required` is not a stronger default — it is the absence of a choice. The
+// daemon is the ours-sdk CLI and this package is the MCP server every harness
+// speaks to it through, so an operator who declined it would have a daemon no
+// harness can reach — which is not a decision anyone means to make. Declining
+// has to be impossible rather than discouraged.
 export const COMPONENTS = [
-  { key: 'mcp', label: 'MCP server', pkg: '@ours.network/mcp', specKey: 'mcp', default: true },
+  { key: 'mcp', label: 'MCP server for your harness', pkg: '@ours.network/mcp', specKey: 'mcp', default: true, required: true },
   { key: 'tg', label: 'Telegram connector', pkg: '@ours.network/tg-connector', specKey: 'tg-connector', default: false },
   { key: 'cowork', label: 'cowork', pkg: '@ours.network/cowork', specKey: 'cowork', default: false },
 ];
@@ -41,7 +45,7 @@ export const COMPONENTS = [
  * over. Every install path for these three now goes through here.
  *
  * All three publish a real `nightly` dist-tag (verified against the registry,
- * 2026-08-17), so none of these pins can 404. `pkgSpec` falls back to `latest`
+ * so none of these pins can 404. `pkgSpec` falls back to `latest`
  * for anything unmapped rather than inventing a tag, so an unknown component
  * degrades to today's behaviour instead of failing.
  *
@@ -84,10 +88,10 @@ export const COWORK_DAEMON_FLOOR = '0.4.1-nightly.20260816.4aaf940';
  * daemon side, and anything the installer clears here is gone. The installer's
  * entire business with the connector is three keys in one config file.
  *
- * This also keeps the door open for the route migration the owner is considering
- * — moving each route's packet into the shared daemon. That migration has to read
- * this registry to know which daemon identity corresponds to which route; an
- * installer that had trampled it would have destroyed the mapping.
+ * It also keeps a future route migration possible — moving each route's packet
+ * into the shared daemon has to read this registry to know which daemon identity
+ * corresponds to which route, and an installer that trampled it would have
+ * destroyed the mapping.
  */
 export const TG_STATE_DIR_NAME = '.ours-telegram';
 export const TG_REGISTRY_FILES = ['bots.json'];
@@ -114,7 +118,12 @@ export function planComponentSelection({ answers = {}, installed = {}, assumeYes
   return COMPONENTS.map((component) => {
     const already = installed[component.key] === true;
     const answer = assumeYes ? component.default : answers[component.key];
-    const wanted = answer === undefined ? (already || component.default) : answer === true;
+    // A required component ignores the answer entirely, including an explicit no.
+    // The daemon phase has already installed and started it by the time this runs;
+    // "skip" here would only produce a screen that contradicts the machine.
+    const wanted = component.required
+      ? true
+      : (answer === undefined ? (already || component.default) : answer === true);
     return {
       ...component,
       already,

package/lib/detect.mjs

@@ -1,19 +1,17 @@
 // ours-install v3 — which daemons are already on this machine, and which one this
 // run is for.
 //
-// OWNER RULING (C1, 2026-08-17), and the whole shape of this file follows from it:
-// never ask the user to TYPE a state directory or a port — that is what spec §2
-// forbids and it stands — but when several daemons are DETECTED, show them and let
-// the user pick. Selection from what was found is not prompting for a path.
+// Never ask for a state directory or a port to be TYPED (spec §2). When several
+// daemons are DETECTED, show them and let one be picked: selecting from what was
+// found is not prompting for a path.
 //
 // Pure, like target.mjs and plan.mjs: the caller injects the directory listing and
 // the file reads, so the whole decision is testable without a filesystem.
 //
-// DETECTION, NOT A REGISTRY. Coordinator ruling: build this from what is actually
-// on disk rather than from a persisted ~/.ours/installer-profiles.json. A stored
-// list is a second source of truth that goes stale against the daemons that really
-// exist, and staleness in exactly that file is how an installer ends up
-// confidently offering a daemon that is gone.
+// DETECTION, NOT A REGISTRY. This is built from what is on disk rather than from a
+// persisted list: a stored list is a second source of truth that goes stale against
+// the daemons that really exist, which is how an installer ends up confidently
+// offering a daemon that is gone.
 
 import { basename, join, resolve } from 'node:path';
 
@@ -93,8 +91,7 @@ export function detectDaemons({ candidates = [], exists, readJson }) {
 /**
  * A state directory for a daemon this run would CREATE, derived and never typed.
  *
- * Spec §2 forbids asking for a path, and the C1 ruling did not change that — it
- * added "pick from what was found". So "create a new one" has to derive somewhere
+ * Spec §2 forbids asking for a path, so "create a new one" has to derive somewhere
  * to put it: `~/.ours` when free, else the first free `~/.ours-2`, `~/.ours-3`…
  * An operator who wants a specific path still has `--state-dir`, which bypasses
  * this screen entirely.
@@ -112,16 +109,6 @@ export function deriveNewStateDir(home, taken = [], { limit = 64 } = {}) {
 
 export const SELECT_CREATE = '__create__';
 
-// The nightly flow kept a registry of daemon profiles here. v3 does not read it —
-// detection replaced it (coordinator ruling) — so anyone who used that flow has a
-// file describing daemons that nothing consults any more.
-//
-// It is NOT deleted. Quietly removing a file that describes someone's daemons is
-// not an installer's business, and the file is harmless. But leaving it looking
-// live is worse than saying it is not, so the run says so once.
-export const LEGACY_PROFILE_REGISTRY = 'installer-profiles.json';
-export const legacyRegistryPath = (home) => join(resolve(home), '.ours', LEGACY_PROFILE_REGISTRY);
-
 /**
  * What this run should do about choosing a daemon (C1's five rules, in one place
  * so they can be read together and tested without a terminal):

package/lib/effects.mjs

@@ -18,6 +18,7 @@ import { dirname, join, resolve } from 'node:path';
 import { atomicWriteConfig, snapshotConfig, restoreConfig } from './config.mjs';
 import { askYesNo, askLine as askLineOnTty } from './prompt.mjs';
 import { classifyHarnessProbe } from './logic.mjs';
+import { classifyStateDir } from './detect.mjs';
 
 /** GET http://127.0.0.1:<port>/state-dir — the unauthenticated identity probe. */
 async function probePort(port, { timeoutMs = 1500 } = {}) {
@@ -156,24 +157,41 @@ function copyToClipboard(text) {
 }
 
 /**
- * Every state directory on this machine that still has a daemon config.
+ * Every DAEMON state directory on this machine.
  *
- * `ours-uninstall` asks this exactly once, to answer one question: are the
- * GLOBAL packages still needed by somebody else? Getting it wrong the optimistic
- * way (reporting none) uninstalls the CLI out from under a second daemon that is
- * still running, so the search is deliberately conservative — it looks only where
- * a state directory can actually be, and an unreadable home means "there might be
- * others", not "there are none".
+ * ONE DEFINITION OF WHAT A DAEMON IS, and this function is why that matters.
  *
- * Where they can be: the default `~/.ours`, plus any `~/.ours*` sibling, which is
- * the shape every other part of this installer uses for a second daemon. A state
- * directory somewhere else entirely will not be found, and that is a KNOWN limit
- * rather than a claim — the failure is keeping a global package that could have
- * been removed, which is the harmless direction.
+ * It used to count any `~/.ours*` directory containing a config.json. Two of those
+ * are not daemons on a perfectly normal machine: `~/.ours-telegram/config.json` is
+ * the Telegram connector's and `~/.ours-cowork/config.json` is cowork's. So the
+ * uninstaller reported "@ours.network/cli kept — still used by the daemon at
+ * ~/.ours-telegram", and two things followed silently:
+ *
+ *   · planGlobalPackages kept cli, mcp and the plugin packages FOREVER on any
+ *     machine with the connector installed, naming a connector's config directory
+ *     as a daemon;
+ *   · worse, planPluginRemoval's `lastDaemon` went false, so the whole harness
+ *     plugin phase was skipped — with a reason that was not true. A plain
+ *     interactive `ours-uninstall` on a machine with the connector removed no
+ *     plugins at all.
+ *
+ * The selection screen had already closed exactly this: config.json is the one
+ * piece of evidence that is AMBIGUOUS, so it cannot be the test. That predicate
+ * lives in lib/detect.mjs and this now calls it rather than keeping a second,
+ * naive copy that drifted. A daemon is identified by an artefact only a daemon
+ * writes, or by a config whose SHAPE is a daemon's.
+ *
+ * Still deliberately conservative about WHERE it looks: only `~/.ours` and its
+ * `~/.ours*` siblings. A state directory somewhere else is not found, and an
+ * unreadable home means "there might be others", not "there are none" — because
+ * the caller uses this to decide whether a GLOBAL package is still needed, and
+ * being wrong the optimistic way uninstalls the CLI out from under a running
+ * daemon.
  */
 function knownStateDirsIn(home) {
   const found = [];
-  const consider = (dir) => { if (existsSync(join(dir, 'config.json'))) found.push(dir); };
+  const io = { exists: existsSync, readJson: readJsonFile };
+  const consider = (dir) => { if (classifyStateDir(dir, io).isDaemon) found.push(dir); };
   consider(join(home, '.ours'));
   try {
     for (const entry of readdirSync(home, { withFileTypes: true })) {
@@ -278,7 +296,7 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
   };
 }
 
-export const __testables = { probePort, portTakenSync, readJsonFile, readTextFile, installedVersionOf };
+export const __testables = { probePort, portTakenSync, readJsonFile, readTextFile, installedVersionOf, knownStateDirsIn };
 
 // -----------------------------------------------------------------------------
 // THE PAIR

package/lib/extras.mjs

@@ -1,14 +1,10 @@
 // ours-install v3 — the four retained extras, re-pointed at the v3 arrangement.
 //
-// Owner ruling 2026-08-17: the v3 installer KEEPS harness plugins, ours-fleet,
-// voice setup and the copy-paste hand-off prompt. Spec v3's silence about them
-// was an oversight, not a decision.
+// The v3 installer keeps harness plugins, ours-fleet, voice setup and the
+// copy-paste hand-off prompt; spec v3's silence about them was an oversight.
 //
-// They are not four more screens carried across, because v2 and v3 disagree
-// about which package IS the daemon. In v2 @ours.network/mcp is the daemon and
-// gets the unit; in v3 the daemon is the ours-sdk CLI and ours-mcp is a
-// per-session stdio proxy with no unit. Each of the four had assumed the v2
-// arrangement somewhere, and this module is where the new assumption lives.
+// The shared daemon belongs to the operator CLI. ours-mcp is only a per-session
+// stdio adapter with no unit, and these extra phases preserve that boundary.
 //
 // Pure, like target.mjs / plan.mjs / components.mjs: no I/O, no subprocess, no
 // terminal. Every function takes what was observed and returns a plan; the
@@ -52,7 +48,7 @@ export const HARNESSES = [
  *
  * So §5's guarantee is ALREADY unmet today for every non-default state
  * directory, silently: the harness attaches to ~/.ours while the operator was
- * told the run targeted somewhere else. Owner ruling Q1 settles the shape:
+ * told the run targeted somewhere else. The shape is:
  *
  *   default state directory   today's behaviour, byte for byte.
  *   Hermes, non-default       real: the pair is handed to ours-hermes-install's
@@ -265,82 +261,6 @@ export function planFleet({ stateDir, isDefaultStateDir, wanted = true, channel
   return wanted ? { ...plan, action: 'install' } : { ...plan, action: 'skip', offerOnRerun: true };
 }
 
-// -----------------------------------------------------------------------------
-// voice setup — the installer takes the restart beat
-// -----------------------------------------------------------------------------
-
-/**
- * WHY THE INSTALLER OWNS THE RESTART NOW (owner ruling Q2).
- *
- * cmdVoiceSetup computes `managed = runningPid() !== null` from ours-mcp's OWN
- * pid record. A v3 daemon is started by `ours daemon start`, which writes
- * <state-dir>/ours-cli-daemon.json — not that record. So runningPid() is null
- * and EVERY v3 daemon classifies as `external`. transactVoiceConfig then returns
- * at its `if (daemonState !== 'managed') return { ok: true, stage: 'write' }`:
- * config written, no apply, no restart, no readiness check, exit 0.
- *
- * Nothing goes wrong — voice-setup will not run `ours-mcp restart` against a
- * CLI-started daemon, which is right. But v2's entire restart protocol
- * (restartHandled, the exit-2 branch, "voice setup performed the required
- * restart") can only fire for a `managed` daemon, so carrying it across would
- * ship a branch that can never be taken. The beat it owned now has no owner, and
- * the installer is the only process that knows the daemon is CLI-managed.
- *
- * One phase, AFTER the component phase — voice-setup is an `ours-mcp`
- * subcommand and v3 installs @ours.network/mcp as a COMPONENT, so it is not on
- * PATH any earlier. The create path needs no special case: in v3 the first
- * `ours daemon start` already happened back in the daemon phase.
- *
- * FILED, NOT FIXED HERE: voice-setup's own hints still say `ours-mcp start` and
- * "restart its external launcher" (packages/core/src/cli.ts:542,547). Under v3
- * the answer is `ours daemon restart --config <cfg>`. That is a packages/core
- * change with its own blast radius and does not belong in an installer PR.
- */
-export function planVoice({
-  mcpInstalled = false,
-  ready = false,
-  assumeYes = false,
-  accepted = null,
-  configChanged = false,
-  stateDir,
-  port,
-} = {}) {
-  const config = stateDir ? cfgPath(stateDir) : null;
-  const skip = (reason, message, extra = {}) => ({
-    key: 'voice', action: 'skip', reason, message, offerOnRerun: true, restartOwed: false, ...extra,
-  });
-
-  if (!mcpInstalled) {
-    return skip('no-mcp', 'voice setup needs the MCP server, which this run did not install — re-run ours-install to add both.');
-  }
-  if (ready) {
-    return { key: 'voice', action: 'skip', reason: 'already-configured', message: 'voice transcription is already configured', offerOnRerun: false, restartOwed: false };
-  }
-  if (assumeYes) {
-    return skip('non-interactive', 'voice setup is interactive and this run is not — re-run ours-install to configure it.');
-  }
-  if (accepted === false) {
-    return skip('declined', 'skipped cleanly — re-run ours-install any time to configure voice.');
-  }
-
-  const env = config ? { OURS_CONFIG: config } : {};
-  return {
-    key: 'voice',
-    action: 'setup',
-    env,
-    setup: ['ours-mcp', 'voice-setup'],
-    statusCheck: ['ours-mcp', 'voice-status', '--json'],
-    // The beat. Only owed when the config actually changed: an unchanged config
-    // is not a reason to bounce a daemon somebody else may be using.
-    restartOwed: Boolean(configChanged),
-    restart: configChanged && config ? ['ours', 'daemon', 'restart', '--config', config] : null,
-    // Never rolls the daemon back: voice-setup leaves the prior config intact on
-    // its own failure path, so the recovery is a retry, not an undo.
-    retryHint: config ? `ours daemon restart --config ${config}` : null,
-    port: Number.isInteger(port) ? port : null,
-  };
-}
-
 // -----------------------------------------------------------------------------
 // the copy-paste hand-off prompt
 // -----------------------------------------------------------------------------

package/lib/journal.mjs

@@ -71,7 +71,10 @@ export function configJournal(effects, { dryRun = false } = {}) {
       for (const entry of entries.slice().reverse()) {
         try {
           effects.restore(entry.path, entry.snapshot);
-          restored.push({ path: entry.path, existed: entry.snapshot?.exists !== false });
+          // A write that RETURNED is not a file that HOLDS. Read the bytes back.
+          const mismatch = verifyRestored(effects, entry);
+          if (mismatch) failed.push({ path: entry.path, reason: mismatch });
+          else restored.push({ path: entry.path, existed: entry.snapshot?.exists !== false });
         } catch (error) {
           failed.push({ path: entry.path, reason: error instanceof Error ? error.message : String(error) });
         }
@@ -82,6 +85,48 @@ export function configJournal(effects, { dryRun = false } = {}) {
   };
 }
 
+/**
+ * Did the restore actually take? Returns null when it did, or the reason it did not.
+ *
+ * WHY THIS EXISTS. `restore` returning is evidence that a call completed, not that
+ * a file holds the bytes it was given. A full disk, a read-only mount, a rename
+ * that lands somewhere else, an editor holding the inode — each of those can let
+ * the write return and leave the old contents in place. Reporting on the call
+ * rather than on the state is how a rollback comes to LIE, and a rollback that
+ * lies is worse than one that admits it failed: the operator is told the machine
+ * is back where it was and stops looking.
+ *
+ * The read-back seam is `effects.snapshot`, the same one used to record the bytes
+ * in the first place — it already returns exactly the shape being compared, so
+ * this needs no second seam and no second notion of what a file's state is.
+ *
+ * Its own failure is a mismatch, not an exception: if the file cannot be read
+ * after being written, that is precisely the case this check exists to catch.
+ */
+function verifyRestored(effects, entry) {
+  const expected = entry.snapshot;
+  let actual;
+  try {
+    actual = effects.snapshot(entry.path);
+  } catch (error) {
+    return `restored, but the file could not be read back to confirm it (${error instanceof Error ? error.message : String(error)})`;
+  }
+  const shouldExist = expected?.exists !== false;
+  if (!shouldExist) {
+    return actual?.exists ? 'this run created it and the removal did not take — the file is still there' : null;
+  }
+  if (!actual?.exists) return 'the restore reported success but the file is not there';
+  if (actual.text !== expected.text) return 'the restore reported success but the bytes on disk are not the previous ones';
+  // Bytes first, permissions second: the contents are back either way, so this
+  // must not be reported as "could not restore the config".
+  if (expected.mode !== undefined && actual.mode !== undefined && actual.mode !== expected.mode) {
+    return `contents restored, but the permissions are ${fmtMode(actual.mode)} and were ${fmtMode(expected.mode)} — check them before re-running`;
+  }
+  return null;
+}
+
+const fmtMode = (mode) => `0${(mode & 0o777).toString(8).padStart(3, '0')}`;
+
 /**
  * The report, and it is half the feature.
  *

package/lib/logic.mjs

@@ -26,7 +26,7 @@ export function canonHarnesses(raw) {
   return { names, unknown };
 }
 
-// ── Release CHANNEL / npm dist-tag selection (owner 2026-07-17) ─────────────────
+// ── Release CHANNEL / npm dist-tag selection ───────────────────────────────────
 // The installer normally installs everything at @latest (stable). Setting
 // OURS_CHANNEL=nightly (or OURS_INSTALL_CHANNEL) makes it install each package's
 // PRERELEASE dist-tag instead — for the packages that publish one.
@@ -37,8 +37,8 @@ export function canonHarnesses(raw) {
 //     from this repo by .github/workflows/scripts/bump-versions.sh)
 //   · fleet                                          → `nightly` (its own repo,
 //     adapt-toolkit/ours-fleet, publishes a nightly dist-tag of its own)
-//   · cowork (rooms)                                 → `nightly` (owner decision
-//     2026-08-16: cowork aligns with every other service rather than keeping its
+//   · cowork (rooms)                                 → `nightly` (cowork aligns
+//     with every other service rather than keeping its
 //     historical `next` tag)
 //
 // WHY FLEET FOLLOWS THE CHANNEL NOW. It used to be pinned to @latest with the note
@@ -49,7 +49,7 @@ export function canonHarnesses(raw) {
 // channel exists to prevent.
 //
 // WHY COWORK STILL NEEDS ITS OWN ENTRY. It historically published its prerelease
-// line as `next`; the owner's decision on 2026-08-16 is that it aligns with every
+// line as `next`; the decision is that it aligns with every
 // other service and publishes `nightly` instead. The entry stays because the map,
 // not a hardcoded string, is what makes such a change one line — and because an
 // UNMAPPED package deliberately falls back to `latest` rather than a guessed tag.
@@ -60,7 +60,7 @@ export function canonHarnesses(raw) {
 // build that predates it — the same architecture-boundary mismatch this whole
 // mechanism exists to prevent, pointed at Rooms instead of Telegram.
 //
-// SEQUENCING — load-bearing, and not yet satisfied. As of 2026-08-16 cowork
+// SEQUENCING — load-bearing, and not yet satisfied. cowork
 // publishes NO `nightly` dist-tag at all (its tags are latest=0.4.0 and
 // next=0.3.7-nightly.20260815.80ea770). `npm i -g @ours.network/cowork@nightly`
 // therefore 404s today, and a 404 fails the WHOLE install. So the nightly
@@ -81,7 +81,7 @@ const PKG_CHANNEL_TAGS = {
   codex: { nightly: 'nightly' },
   hermes: { nightly: 'nightly' },
   fleet: { nightly: 'nightly' },
-  cowork: { nightly: 'nightly' }, // aligned with every other service (owner, 2026-08-16)
+  cowork: { nightly: 'nightly' }, // aligned with every other service
 };
 
 // Normalize a raw channel selection to 'latest' | 'nightly'. Anything unrecognized
@@ -133,81 +133,6 @@ export const RESERVED_PORTS = [3051, 3052];
 export const DEFAULT_PORT = 3050;
 export const DEFAULT_BROKER = 'wss://broker1.ours.network';
 
-// ── Daemon topology: one COMMON daemon, plus optional DEDICATED ones ───────────
-// Every consumer defaults to the common daemon on the common port — that is the
-// backward-compatible answer and what Enter / non-interactive mode picks. A
-// consumer may instead be given its OWN daemon, which needs three things to be
-// genuinely isolated and not merely differently-addressed:
-//   · its own PORT              (nothing else may bind it)
-//   · its own STATE DIRECTORY   (the daemon's API token lives there; sharing one
-//                                state dir between two daemons corrupts both)
-//   · its own SERVICE NAME      (ours-mcp's boot unit — without a distinct name,
-//                                `install-service` overwrites the common daemon's
-//                                unit; see packages/core/src/service-instance.ts)
-// The config file is separate too, since ours-mcp resolves port + stateDir from
-// whatever OURS_CONFIG points at.
-export const DAEMON_MODES = ['common', 'dedicated'];
-
-// Fixed instance names, one per consumer that can own a daemon. These are what
-// core validates and turns into `ours-<name>.service`, so they must satisfy its
-// rules (alphanumeric, no separators at the ends).
-export const DEDICATED_INSTANCES = { telegram: 'tg', rooms: 'rooms' };
-
-// Where a dedicated daemon's private config + state live. Derived from the
-// instance name so two consumers can never be handed the same directory.
-export function dedicatedDaemonPaths(home, instance) {
-  const name = String(instance || '').trim();
-  const stateDir = `${home}/.ours-${name}`;
-  return { stateDir, configPath: `${stateDir}/config.json`, serviceName: name };
-}
-
-// Normalize a daemon-mode answer. Anything unrecognized (including empty and
-// non-interactive) is 'common' — the backward-compatible default.
-export function resolveDaemonMode(raw) {
-  const v = String(raw || '').trim().toLowerCase();
-  return v === 'dedicated' || v === 'own' || v === 'separate' ? 'dedicated' : 'common';
-}
-
-// Validate a port the user picked for a daemon, against the reserved list AND
-// every port this install has already committed to. `isTaken(port)` probes a real
-// bind; `taken` is the set of ports already chosen in THIS run, which a live probe
-// cannot see (nothing is listening on them yet). Returns
-// { ok, port, reason } — ok=false means "ask again", never "silently substitute".
-export function validateDaemonPort(input, { fallback = DEFAULT_PORT, isTaken = () => false, taken = [], reserved = RESERVED_PORTS } = {}) {
-  // Stricter than parsePort on purpose: this answer becomes a persisted listen port,
-  // so "3.5.1" must be a question repeated, not silently accepted as port 3.
-  if (!/^\d+$/.test(String(input ?? '').trim())) {
-    return { ok: false, port: fallback, reason: 'that is not a port number between 1 and 65535' };
-  }
-  const parsed = parsePort(input, fallback);
-  if (!parsed.ok) return { ok: false, port: fallback, reason: 'that is not a port number between 1 and 65535' };
-  const port = parsed.port;
-  if (reserved.includes(port)) {
-    return { ok: false, port, reason: `port ${port} is reserved by another part of the stack` };
-  }
-  if (taken.includes(port)) {
-    return { ok: false, port, reason: `port ${port} is already being used by another daemon in this install` };
-  }
-  if (isTaken(port)) {
-    return { ok: false, port, reason: `port ${port} is already in use on this machine` };
-  }
-  return { ok: true, port, reason: '' };
-}
-
-// The whole install's port plan, checked as a set. Returns { ok, duplicates } so
-// the caller can refuse a topology where two daemons would fight over one port
-// even though each looked fine on its own.
-export function planPorts(entries = []) {
-  const seen = new Map();
-  const duplicates = [];
-  for (const { label, port } of entries) {
-    if (!Number.isInteger(port)) continue;
-    if (seen.has(port)) duplicates.push({ port, labels: [seen.get(port), label] });
-    else seen.set(port, label);
-  }
-  return { ok: duplicates.length === 0, duplicates };
-}
-
 // ── Handing the Telegram connector the ONE shared daemon ───────────────────────
 // The connector has its OWN config file and never inherits the daemon's. Two
 // generations of it are in the wild and the installer must satisfy BOTH, because
@@ -246,7 +171,7 @@ export function daemonEndpoint(port) {
 
 // The broker the whole deployment shares, for a <=0.3.2 connector.
 // Precedence: what the user chose in THIS run > what the running daemon actually
-// resolved (`ours-mcp status`, which already accounts for OURS_BROKER_URL) > what
+// resolved (`ours daemon status`, which accounts for the selected config) > what
 // the daemon's config file says > the built-in default (identical to the daemon's
 // DEFAULT_CONFIG.brokerUrl, so "no answer anywhere" still agrees).
 export function resolveSharedBroker({ chosenBroker, statusBroker, configBroker } = {}) {
@@ -592,7 +517,7 @@ export function parseVersion(text) {
   return m ? m[0] : '';
 }
 
-// parseStatus: read the daemon's RESOLVED broker + port out of `ours-mcp status` output, so we
+// parseStatus: read the daemon's RESOLVED broker + port out of `ours daemon status` output, so we
 // prompt with what the daemon is actually using rather than a hardcoded guess. Returns
 // { broker, port } with either field null when the line isn't present (daemon stopped / older
 // build). Lines look like:  "  broker: wss://broker1.ours.network"  and
@@ -600,7 +525,10 @@ export function parseVersion(text) {
 export function parseStatus(text) {
   const s = String(text || '');
   const bm = s.match(/^\s*broker:\s*(\S+)/m);
-  const pm = s.match(/url:\s*https?:\/\/[^:\s/]+:(\d+)/i);
+  // `api:` is the current line and `url:` the historical one. Both are matched
+  // because a newly installed CLI can be asked to report on an older running
+  // daemon, and a parser that knows only today's wording reads that as "no port".
+  const pm = s.match(/(?:api|url):\s*https?:\/\/[^:\s/]+:(\d+)/i);
   return {
     broker: bm ? bm[1] : null,
     port: pm ? Number.parseInt(pm[1], 10) : null,
@@ -644,7 +572,7 @@ export function detectPlatform({ platform, release = '', env = {} } = {}) {
 //               tell the user plainly + how to fix, and ALWAYS still offer a manual path
 //   'unsafe'  — on PATH but the probe failed/looked wrong → don't auto-drive; offer manual path
 //   'absent'  — genuinely not installed → this harness is skipped (with a note)
-// The golden rule (owner edit #3): 'alias'/'unsafe'/'absent' NEVER dead-end — the caller always
+// The golden rule: 'alias'/'unsafe'/'absent' NEVER dead-end — the caller always
 // prints a manual-install path so the component still gets installed.
 export function classifyHarnessProbe({ onPath, versionOk, timedOut, shellType = '' } = {}) {
   if (versionOk) return { status: 'ok', detail: 'real program' };