@ours.network/install 0.17.0-nightly.9 → 0.18.0-nightly.1

package/lib/orchestrate-uninstall.mjs

@@ -19,7 +19,7 @@
 
 import { join } from 'node:path';
 import { parseInstallArgs, InstallUsageError } from './target.mjs';
-import { planUninstall, planComponentDetach, planStatePurge, stripManagedBlock } from './uninstall.mjs';
+import { planUninstall, planComponentDetach, planStatePurge, stripManagedBlock, planHarnessSelection, selectHarnesses, planGlobalPackages, planPluginRemoval, parseUninstallEnv } from './uninstall.mjs';
 import { tgConfigPath, coworkConfigPath } from './components.mjs';
 import { configJournal, reportRollback } from './journal.mjs';
 import { UNINSTALL_USAGE } from './usage.mjs';
@@ -81,6 +81,33 @@ export async function runUninstall(argv, effects) {
   effects.out(heading(`ours-uninstall --state-dir ${dir}`));
   if (args.dryRun) effects.out(info('dry-run: nothing will be removed or stopped'));
 
+  // §9 — the documented OURS_UNINSTALL_* contract (item 10.9), read BEFORE any
+  // file is opened. A variable this uninstaller cannot deliver stops the run
+  // here, naming itself and naming the replacement, rather than being silently
+  // ignored while the operator's script reports success.
+  const contract = parseUninstallEnv(effects.env);
+  if (contract.action === 'refuse') {
+    effects.out(warn(`ours: ${contract.message}`));
+    return EXIT_REFUSED;
+  }
+
+  // OURS_UNINSTALL_DAEMON decides whether this is an uninstall of the daemon at
+  // all. Before this gate, OURS_UNINSTALL="hermes" — a script asking for one
+  // harness plugin — tore down the daemon, its service and the global packages,
+  // because none of the seven variables was read. A request to detach a plugin
+  // stays a request to detach a plugin.
+  if (!contract.daemon) {
+    effects.out(info(`the daemon at ${dir} is KEPT — OURS_UNINSTALL is set and OURS_UNINSTALL_DAEMON is not "yes"`));
+    const plugins = planPluginRemoval({ home: effects.home, env: effects.env, exists: effects.exists, lastDaemon: false, explicitSelection: true });
+    const outcome = await runPluginPhase(plugins, { args, effects, selection: contract.harnesses });
+    // Only the launchers of the harnesses that actually went. @ours.network/cli
+    // and /mcp belong to the daemon, and the daemon is staying.
+    for (const pkg of outcome.packages) {
+      await perform(effects, args.dryRun, `npm rm -g ${pkg}`, () => effects.run('npm', ['rm', '-g', pkg]));
+    }
+    return EXIT_OK;
+  }
+
   // Ask first, mutate second. The question is about resolving the step-1
   // refusal, so it has to come before the plan that would refuse.
   // `readText` is passed alongside `readJson` so the planner can tell an ABSENT
@@ -93,7 +120,13 @@ export async function runUninstall(argv, effects) {
     return EXIT_REFUSED;
   }
   const pointing = probe.action === 'refuse' ? probe.components : [];
-  const confirmedComponents = await confirmComponentRemoval(pointing, { assumeYes: args.assumeYes, effects });
+  // With the contract engaged there is nobody to ask, and OURS_UNINSTALL_TELEGRAM
+  // / _ROOMS at `detach` is exactly the answer the question wants. Without it, an
+  // unattended run against a daemon a connector points at refuses — which is the
+  // right outcome, and the reason honouring `detach` is worth doing.
+  const confirmedComponents = contract.engaged
+    ? contract.confirmedComponents
+    : await confirmComponentRemoval(pointing, { assumeYes: args.assumeYes, effects });
 
   const plan = planUninstall({
     home: effects.home,
@@ -106,9 +139,12 @@ export async function runUninstall(argv, effects) {
     readJson: effects.readJson,
     readText: effects.readText,
     exists: effects.exists,
-    cliStartedIt: effects.readJson(join(dir, 'ours-cli-daemon.json')) !== null,
+    // Accept the current CLI record and the legacy ours-mcp pid file during migration.
+    cliStartedIt: effects.readJson(join(dir, 'ours-cli-daemon.json')) !== null
+      || effects.readText(join(dir, 'daemon.pid')) !== null,
     otherStateDirsWithConfig: effects.knownStateDirs(),
     typedConfirmation: null,
+    explicitHarnessSelection: contract.engaged,
   });
 
   if (plan.action === 'refuse') {
@@ -156,16 +192,32 @@ export async function runUninstall(argv, effects) {
   }
 
   // 5. The harness plugins the installer wrote.
-  await runPluginPhase(plan.plugins, { args, effects });
+  const pluginOutcome = await runPluginPhase(plan.plugins, { args, effects, selection: contract.harnesses });
 
   // 6. State. Last, because it is the only irreversible thing here.
   await runPurgePhase({ dir, purge, args, effects });
 
   // 7. Global packages, only when this was the last daemon.
-  if (plan.packages.action === 'keep') {
-    effects.out(info(`@ours.network/cli kept — ${plan.packages.reason}`));
+  //
+  // Recomputed from what the plugin phase ACTUALLY removed, not from what it
+  // found. A harness the operator kept keeps its launcher: removing the package
+  // out from under a plugin that is still registered is the same broken
+  // half-state, one layer down.
+  const packages = planGlobalPackages({
+    stateDir: dir,
+    otherStateDirsWithConfig: effects.knownStateDirs(),
+    pluginPackages: pluginOutcome.packages,
+    // The plugin packages are recomputed; the CONNECTOR packages are not. They
+    // are decided by what the operator confirmed detaching, which the plugin
+    // phase does not touch, so this repeats the plan's own answer rather than
+    // inventing a second one — and rather than dropping it, which would quietly
+    // undo the connector-package removal one line up the file.
+    detachedComponents: plan.detach.map((d) => d.key),
+  });
+  if (packages.action === 'keep') {
+    effects.out(info(`@ours.network/cli kept — ${packages.reason}`));
   } else {
-    for (const pkg of plan.packages.packages) {
+    for (const pkg of packages.packages) {
       await perform(effects, args.dryRun, `npm rm -g ${pkg}`, () => effects.run('npm', ['rm', '-g', pkg]));
     }
   }
@@ -224,24 +276,45 @@ export async function rollBackDetach(effects, journal, detached, args) {
  * harnesses still need these plugins — the same condition that keeps the global
  * packages, decided once.
  */
-export async function runPluginPhase(plugins, { args, effects }) {
+export async function runPluginPhase(plugins, { args, effects, selection = null }) {
   effects.out(heading('Harness plugins'));
-  for (const step of plugins.manual) {
-    // Never a dead end, and never a claim: Claude Code's plugin is not ours to
-    // remove, so the run says so and prints the two commands that do it.
-    effects.out(info(`${step.label} — ${step.reason}. Inside Claude Code, run:`));
-    for (const command of step.steps) effects.out(info(`  ${command}`));
-  }
   if (plugins.action === 'keep') {
+    for (const step of plugins.manual) announceManual(step, effects);
     effects.out(info(`harness plugins kept — ${plugins.reason}`));
-    return;
+    return { removed: [], packages: [] };
+  }
+
+  // WHICH harnesses (item 9.5). Asked before the first block is stripped, so a
+  // "no" costs nothing and a "yes" is the operator's, not this file's.
+  const choice = planHarnessSelection(plugins, { selection, assumeYes: args.assumeYes });
+  let chosen = choice.chosen;
+  if (choice.mode === 'ask') {
+    chosen = [];
+    for (const harness of choice.offered) {
+      if (await effects.ask(`Remove the ${harness.label}?`, true)) chosen.push(harness.key);
+    }
+  }
+  for (const name of choice.ignored) {
+    effects.out(info(`${name} was named for removal but no ${name} plugin is installed here — nothing to do for it`));
   }
-  if (plugins.harnesses.length === 0) {
-    effects.out(info('no Hermes or Codex plugin files found — nothing of ours to remove'));
-    return;
+  if (choice.mode === 'keep') {
+    effects.out(info(`harness plugins kept — ${choice.reason}`));
+    effects.out(info(choice.hint));
+    return { removed: [], packages: [] };
   }
 
-  for (const harness of plugins.harnesses) {
+  const selected = selectHarnesses(plugins, chosen);
+  for (const step of selected.manual) announceManual(step, effects);
+  if (selected.harnesses.length === 0) {
+    effects.out(info(
+      chosen.length === 0
+        ? 'no harness plugin selected — none removed'
+        : 'no Hermes or Codex plugin files found — nothing of ours to remove',
+    ));
+    return { removed: chosen, packages: [] };
+  }
+
+  for (const harness of selected.harnesses) {
     for (const block of harness.blocks) {
       const before = effects.readText(block.path);
       if (before === null) continue;
@@ -254,6 +327,9 @@ export async function runPluginPhase(plugins, { args, effects }) {
         effects.out(warn(`${block.path}: ${stripped.reason}. Remove it by hand.`));
         continue;
       }
+      // Deliberately NOT journalled: this write IS the state its bytes describe, so
+      // nothing behind it can fail and leave them untrue. Adding one would undo a
+      // completed removal.
       await perform(effects, args.dryRun, `remove the ours managed block from ${block.path} (file kept)`, () => effects.writeText(block.path, stripped.text));
     }
     for (const dir of harness.dirs) {
@@ -265,6 +341,16 @@ export async function runPluginPhase(plugins, { args, effects }) {
       await perform(effects, args.dryRun, `remove ${file}`, () => effects.removeFile(file));
     }
   }
+  return { removed: chosen, packages: selected.packages };
+}
+
+/**
+ * Never a dead end, and never a claim: Claude Code's plugin is not ours to
+ * remove, so the run says so and prints the two commands that do it.
+ */
+function announceManual(step, effects) {
+  effects.out(info(`${step.label} — ${step.reason}. Inside Claude Code, run:`));
+  for (const command of step.steps) effects.out(info(`  ${command}`));
 }
 
 /**

package/lib/orchestrate.mjs

@@ -29,12 +29,12 @@ import { planDaemonConfig, planServiceInstall, serviceInstallCommand } from './p
 import {
   COMPONENTS,
   planComponentSelection, planMcpAttachment, planTgAttachment, planCoworkAttachment,
-  tgConfigPath, coworkConfigPath, summarizeComponentRun, componentSpec,
+  tgConfigPath, coworkConfigPath, summarizeComponentRun, componentSpec, componentByKey,
 } from './components.mjs';
-import { planHarnessPlugins, planFleet, planVoice, buildHandoffPromptV3, restartHints } from './extras.mjs';
+import { planHarnessPlugins, planFleet, buildHandoffPromptV3, restartHints } from './extras.mjs';
 import { summarizeRun } from './rerun.mjs';
 import { configJournal, reportRollback } from './journal.mjs';
-import { detectDaemons, planDaemonSelection, resolveSelection, legacyRegistryPath } from './detect.mjs';
+import { detectDaemons, planDaemonSelection, resolveSelection } from './detect.mjs';
 import { detectPlatform, resolveChannel, validateBroker } from './logic.mjs';
 import { daemonEnv } from './effects.mjs';
 import { USAGE } from './usage.mjs';
@@ -100,7 +100,7 @@ function pairFor(plan, target) {
 }
 
 /**
- * Which daemon is this run for? (C1, owner ruling 2026-08-17.)
+ * Which daemon is this run for?
  *
  * Never asks for a PATH — spec §2 stands — but when several daemons are DETECTED
  * it shows them and lets the operator pick, because choosing from what was found
@@ -111,14 +111,6 @@ function pairFor(plan, target) {
  * not know a screen happened, which is what keeps the flags path byte-identical.
  */
 export async function runSelectionPhase(args, effects) {
-  // Said once, and only when the file is actually there: a file that looks live is
-  // worse than a file that says it is not. Never deleted — quietly removing
-  // something that describes an operator's daemons is not this installer's
-  // business.
-  const legacy = legacyRegistryPath(effects.home);
-  if (effects.exists(legacy)) {
-    effects.out(info(`${legacy} is left over from the older nightly installer and is no longer read — this run detects daemons directly. It is left alone; you can delete it.`));
-  }
   const detected = detectDaemons({
     candidates: effects.knownStateDirs(),
     exists: effects.exists,
@@ -176,6 +168,7 @@ export async function runDaemonPhase(args, effects) {
     portExplicit: args.portExplicit,
     probe: effects.probe,
     readJson: effects.readJson,
+    readText: effects.readText,
     isTaken: effects.isTaken,
   });
 
@@ -208,20 +201,26 @@ export async function runDaemonPhase(args, effects) {
 
   // Asked ONCE, and only when this run is creating the daemon — an existing
   // daemon's broker is its own record, and re-asking would invite an operator to
-  // change it from a screen that is not about changing it. Owner ruling: the
-  // broker question stays in v3. It is orthogonal to --state-dir/--port, so it
+  // change it from a screen that is not about changing it. The broker question
+  // stays in v3: it is orthogonal to --state-dir/--port, so it
   // does not violate spec §2's "nothing about a state directory or a port
   // appears in any prompt".
   if (creating) args.brokerUrl = await askBroker(args, effects);
 
   const steps = [];
 
+  // The operator CLI owns the shared daemon; ours-mcp is the per-session stdio
+  // adapter each harness spawns. Both are required, but only `ours daemon`
+  // participates in lifecycle or service management.
+  const mcpPkg = componentSpec(componentByKey('mcp'), args.channel);
+  await perform(effects, args.dryRun, `MCP server installed (npm i -g ${mcpPkg})`, () => effects.run('npm', ['i', '-g', mcpPkg]));
+  steps.push({ id: 'mcp-package', changed: true, packageRefresh: true });
   await perform(effects, args.dryRun, 'ours CLI installed (npm i -g @ours.network/cli)', () => effects.run('npm', ['i', '-g', '@ours.network/cli']));
   steps.push({ id: 'cli', changed: true, packageRefresh: true });
 
   // The config file — merged, never rewritten, and untouched when it already
-  // matches. No provenance marker is written: the owner ruled that --purge works
-  // on any state directory, so a `createdBy` key would have had no consumer, and
+  // matches. No provenance marker is written: --purge works on any state
+  // directory, so a `createdBy` key would have no consumer, and
   // an unread key in a user's config file is future confusion for nothing.
   const configPath = join(dir, 'config.json');
   const merged = planDaemonConfig(
@@ -239,6 +238,7 @@ export async function runDaemonPhase(args, effects) {
   // lookup exists to prevent; this is what stops the installer from setting up the
   // conditions for it.
   const journal = configJournal(effects, { dryRun: args.dryRun });
+  let serviceUnsupported = null;
   if (merged.changed) {
     journal.snapshot(configPath);
     await perform(effects, args.dryRun, `write ${configPath} (port ${target.port})`, () => effects.writeJson(configPath, merged.text));
@@ -253,7 +253,8 @@ export async function runDaemonPhase(args, effects) {
       steps.push({ id: 'start', changed: true });
     }
 
-    const service = await runServicePhase(args, effects, dir);
+    const service = await runServicePhase(args, effects, dir, target.port);
+    if (service.unsupported) serviceUnsupported = service.unsupported;
     if (service.refused) {
       // A REFUSAL IS A FAILURE TO REACH THE STATE, not a special case. An unknown
       // unit file stops the run just as a failed start does, and it stops it with
@@ -274,7 +275,7 @@ export async function runDaemonPhase(args, effects) {
     // The nightly flow re-runs `start` and, crucially, tells the two outcomes
     // apart: "the service failed but the daemon is back" is a bad evening, and "the
     // service failed AND it will not come back" is the one that needs a human now.
-    const recovery = error?.servicePlan ? await recoverDaemon(args, effects, dir, configPath) : null;
+    const recovery = error?.servicePlan ? await recoverDaemon(args, effects, dir, configPath, target.port) : null;
     rollBack(effects, journal, args, 'the daemon did not reach the state its config describes — putting the config back', {
       replacedUnit: error?.servicePlan?.action === 'adopt' ? error.servicePlan.unitPath : null,
     });
@@ -287,7 +288,7 @@ export async function runDaemonPhase(args, effects) {
     throw error;
   }
 
-  return { target, steps };
+  return { target, steps, serviceUnsupported };
 }
 
 /**
@@ -302,7 +303,7 @@ export async function runDaemonPhase(args, effects) {
  * is REPORTED, never thrown: the caller is already carrying the real error, and
  * losing it to a second one would hide what actually went wrong.
  */
-async function recoverDaemon(args, effects, dir, configPath) {
+async function recoverDaemon(args, effects, dir, configPath, port) {
   if (args.dryRun) return null;
   try {
     await effects.run('ours', ['daemon', 'start', '--config', configPath]);
@@ -345,11 +346,24 @@ function rollBack(effects, journal, args, why, { packagesInstalled = true, repla
  * The boot service: §4 step 4, including the legacy-unit case.
  *
  * A legacy ours-mcp unit is adopted SILENTLY, with one informational line naming
- * the file — the owner's decision. `--force` is passed ONLY here, only for a unit
+ * the file. `--force` is passed ONLY here, only for a unit
  * positively identified as ours-mcp's, and never for one we cannot identify.
  */
-export async function runServicePhase(args, effects, dir) {
-  const plan = planServiceInstall({ stateDir: dir, home: effects.home, readText: effects.readText });
+export async function runServicePhase(args, effects, dir, port) {
+  const plan = planServiceInstall({
+    stateDir: dir, home: effects.home, readText: effects.readText, platform: effects.platform?.platform,
+  });
+  // NOT a refusal and NOT a failure: the daemon is running and correct, and only
+  // the boot service could not be installed — `ours daemon install-service` throws
+  // on any non-linux platform. The run CONTINUES, says so, and the summary marks
+  // it, because the person this hurts reboots in a fortnight and finds nothing
+  // listening.
+  if (plan.action === 'unsupported') {
+    effects.out(warn(`ours: ${plan.message}`));
+    effects.out(info(`Your daemon is installed and running now. To start it after a reboot, run:  ${plan.manual.join(' ')} ${join(dir, 'config.json')}`));
+    effects.out(info('Nothing else in this run depends on the boot service.'));
+    return { step: { id: 'service', changed: false, reason: 'not available on this platform' }, plan, unsupported: plan };
+  }
   if (plan.action === 'refuse') {
     effects.out(warn(`ours: refusing to continue — ${plan.message}`));
     return { refused: plan };
@@ -357,6 +371,14 @@ export async function runServicePhase(args, effects, dir) {
   const adopting = plan.action === 'adopt';
   if (adopting) effects.out(info(plan.notice));
   const command = serviceInstallCommand({ stateDir: dir, adoptLegacyUnit: adopting });
+  // The unit's bytes BEFORE, so "did it change?" survives the loss of --json.
+  // `ours daemon install-service --json` used to answer that itself; ours-mcp's
+  // takes no flags and reports nothing machine-readable. Assuming `changed: true`
+  // would make every re-run claim it rewrote the unit, which turns the honest
+  // "everything already correct" line into one that never appears — a screen that
+  // is wrong in the reassuring direction. So the installer does the comparison it
+  // used to delegate: it already reads this file to classify it.
+  const unitBefore = plan.unitPath ? effects.readText(plan.unitPath) : null;
   let outcome;
   try {
     outcome = await perform(effects, args.dryRun, `boot service ${plan.unit} installed and enabled`, () => effects.run(command[0], command.slice(1)));
@@ -368,11 +390,16 @@ export async function runServicePhase(args, effects, dir) {
     error.servicePlan = plan;
     throw error;
   }
-  // Whether the unit actually changed is the CLI's answer, not ours: it does the
-  // byte comparison and returns `changed` in its --json plan. Guessing here would
-  // let a run that rewrote a unit report "nothing changed". Unreadable output is
-  // treated as "changed", which is the safe direction for a summary line.
-  const changed = readChanged(outcome.stdout);
+  // Ours now, by the same byte comparison the CLI used to do. A dry run changed
+  // nothing by definition; an unreadable file either side is treated as "changed",
+  // which is the safe direction for a summary line.
+  const changed = args.dryRun
+    ? false
+    : (() => {
+      const after = plan.unitPath ? effects.readText(plan.unitPath) : null;
+      if (unitBefore === null || after === null) return true;
+      return unitBefore !== after;
+    })();
   return { step: { id: 'service', changed, reason: changed ? undefined : 'unit unchanged' }, plan };
 }
 
@@ -388,6 +415,47 @@ function readChanged(stdout) {
   }
 }
 
+/**
+ * THE QUESTION NOBODY WAS ASKING.
+ *
+ * `planComponentSelection` has always read an `answers` map — and NOTHING EVER
+ * POPULATED IT. `args.answers` is not produced by parseInstallArgs and is not
+ * written by any phase, so it was permanently `{}`, every optional component fell
+ * to its own default, and tg and cowork (both default false) were skipped in
+ * silence. The screen then printed "cowork — not installed" as though that had
+ * been a decision.
+ *
+ * This was the ONE phase with no question. Harness plugins ask, ours-fleet asks,
+ * voice asks, the broker asks. Components did not.
+ *
+ * IT IS NOT A COWORK BUG, and fixing only the component that got reported would
+ * have left the identical defect live under a different label: the Telegram
+ * connector is unreachable by exactly the same route, and nobody noticed only
+ * because tg is usually configured somewhere else.
+ *
+ * A REQUIRED component is never asked — since #74 the MCP package IS the daemon,
+ * the daemon phase has already installed it, and a question whose only honest
+ * answer is yes is not a question. Non-interactive runs are unchanged: assumeYes
+ * takes each component's own default, which is what NON_INTERACTIVE_ANSWERS
+ * documents (mcp yes, tg no, cowork no), so nothing about the unattended contract
+ * moves.
+ */
+export async function askComponents(args, effects) {
+  const answers = { ...(args.answers ?? {}) };
+  if (args.assumeYes) return answers;
+  const optional = COMPONENTS.filter((c) => !c.required && answers[c.key] === undefined);
+  if (optional.length === 0) return answers;
+  effects.out(heading('What else should this daemon carry?'));
+  for (const component of optional) {
+    const already = (args.installed ?? {})[component.key] === true;
+    answers[component.key] = await effects.ask(
+      already ? `Keep ${component.label}?` : `Install ${component.label}?`,
+      already || component.default,
+    );
+  }
+  return answers;
+}
+
 /**
  * Components: §5. A component that fails is reported with its retry command and
  * the run CONTINUES — a failed component is never a reason to undo a successful
@@ -397,8 +465,9 @@ export async function runComponentPhase(args, effects, target) {
   const dir = target.stateDir;
   const endpoint = `http://127.0.0.1:${target.port}`;
   const isDefaultStateDir = dir === join(effects.home, '.ours');
+  const answers = await askComponents(args, effects);
   const chosen = planComponentSelection({
-    answers: args.answers ?? {},
+    answers,
     installed: args.installed ?? {},
     assumeYes: args.assumeYes,
   });
@@ -531,7 +600,7 @@ async function attachComponent(component, { args, effects, dir, endpoint, isDefa
 }
 
 /**
- * The broker question (v2's Step 0a, kept by the owner's ruling).
+ * The broker question (v2's Step 0a, deliberately kept).
  *
  * Consent-first, with the undo built in: a mistaken custom address is one
  * keystroke back to the standard broker, because the alternative is an operator
@@ -594,6 +663,9 @@ export function runPreflight(effects) {
     return { ok: false, platform: plat };
   }
   effects.out(ok(`Platform: ${plat.label} (supported)`));
+  if (effects.platform?.platform && effects.platform.platform !== 'linux') {
+    effects.out(info(`On ${plat.label} the daemon runs, but installing a BOOT SERVICE is not available — you will start it yourself after a reboot.`));
+  }
   const version = String(effects.nodeVersion ?? '0');
   if (Number.parseInt(version.split('.')[0], 10) < 20) {
     effects.out(warn(`Node.js ${version} — ours needs v20 or newer. Update Node and re-run.`));
@@ -604,11 +676,9 @@ export function runPreflight(effects) {
 }
 
 /**
- * The human identity: `ours-mcp create-root`, kept by the owner's ruling.
+ * The human identity: `ours identity create-root`.
  *
- * It needs `ours-mcp` on PATH and a reachable daemon, so under v3 it lands here
- * — after the component phase installed the MCP server, not back in the daemon
- * phase where v2 had it. Already-exists is a friendly keep, never an error, and
+ * It needs the operator CLI and a reachable daemon. Already-exists is a friendly keep, never an error, and
  * an unreachable daemon gets the exact retry command rather than "ask your agent
  * later"; the hand-off's identity step is the fallback for both failures.
  */
@@ -628,16 +698,11 @@ export async function runIdentityPhase(args, effects, { target, mcpReady }) {
 
   const env = daemonEnv(target.stateDir, target.port);
   if (args.dryRun) {
-    effects.out(info(wouldPrefix(`ours-mcp create-root "${name}"`)));
+    effects.out(info(wouldPrefix(`ours identity create-root --name "${name}"`)));
     return { key: 'identity', label: 'Human identity', state: 'installed', note: name };
   }
   try {
-    const result = await effects.run('ours-mcp', ['create-root', name], { env });
-    const existing = String(result?.stdout ?? '').match(/already exists \("([^"]+)"\)/);
-    if (existing) {
-      effects.out(ok(`You already have a human identity ("${existing[1]}") — keeping it.`));
-      return { key: 'identity', label: 'Human identity', state: 'current', note: existing[1] };
-    }
+    await effects.run('ours', ['identity', 'create-root', '--name', name, '--json'], { env });
     effects.out(ok(`Your human identity "${name}" is created.`));
     return { key: 'identity', label: 'Human identity', state: 'installed', note: name };
   } catch (error) {
@@ -648,11 +713,11 @@ export async function runIdentityPhase(args, effects, { target, mcpReady }) {
     }
     if (/not running|not reachable|ECONNREFUSED|connect/i.test(text)) {
       effects.out(warn("The daemon isn't reachable yet — couldn't create your human identity."));
-      effects.out(info(`Fix: run 'ours daemon start --config ${env.OURS_CONFIG}', then 'ours-mcp create-root "${name}"'.`));
+      effects.out(info(`Fix: run 'ours daemon start --config ${env.OURS_CONFIG}', then 'ours identity create-root --config ${env.OURS_CONFIG} --name "${name}"'.`));
       return { key: 'identity', label: 'Human identity', state: 'failed', note: 'daemon not reachable' };
     }
     effects.out(warn(`Couldn't create your human identity: ${text.split('\n')[0]}`));
-    effects.out(info(`Retry any time: 'ours-mcp create-root "${name}"'.`));
+    effects.out(info(`Retry any time: 'ours identity create-root --config ${env.OURS_CONFIG} --name "${name}"'.`));
     return { key: 'identity', label: 'Human identity', state: 'failed', note: 'create-root failed' };
   }
 }
@@ -781,7 +846,6 @@ export async function runFleetPhase(args, effects, { target, isDefaultStateDir }
   // Passing it is harmless if extras.mjs is right and load-bearing if
   // nightly-install.mjs is. When the cheap action is safe under both readings and
   // the expensive one is only safe under one, take the cheap one. (Coordinator
-  // ruling, 2026-08-17.)
   //
   // Passed for EVERY state directory, not only a non-default one, exactly as the
   // nightly flow does: `init` is a one-time host setup and the pair is what names
@@ -799,81 +863,11 @@ export async function runFleetPhase(args, effects, { target, isDefaultStateDir }
   return { key: 'fleet', label: plan.label, state: 'installed', note: 'CLI + core-plugin discovery' };
 }
 
-/**
- * Voice transcription — and the restart beat the installer now owns.
- *
- * Under v3 `ours-mcp voice-setup` classifies every daemon as `external`, because
- * a v3 daemon is started by `ours daemon start` and leaves no ours-mcp pid
- * record. So voice-setup writes the config and returns, correctly declining to
- * restart a daemon it does not manage — and the restart nobody now owns is
- * this phase's, because the installer is the only process that knows the daemon
- * is CLI-managed. Failure never rolls the daemon back: voice-setup leaves the
- * prior config intact on its own failure path, so the recovery is a retry.
- */
+/** Voice configuration belongs to the shared daemon, not the MCP adapter. */
 export async function runVoicePhase(args, effects, { target, mcpReady }) {
   effects.out(heading('Voice messages'));
-  const env = daemonEnv(target.stateDir, target.port);
-  const ready = mcpReady && !args.dryRun ? await voiceReady(effects, env) : false;
-
-  const offer = planVoice({
-    mcpInstalled: mcpReady, ready, assumeYes: args.assumeYes, stateDir: target.stateDir, port: target.port,
-  });
-  if (offer.action === 'skip') {
-    effects.out(offer.reason === 'already-configured' ? ok(offer.message) : info(offer.message));
-    return {
-      key: 'voice',
-      label: 'Voice transcription',
-      state: offer.reason === 'already-configured' ? 'current' : 'skipped',
-      note: offer.reason === 'already-configured' ? 'configured' : offer.reason,
-    };
-  }
-
-  effects.out(info('Voice notes can be transcribed by a provider you choose. Audio is sent to that'));
-  effects.out(info('provider; use a self-hosted endpoint if it must stay local. The API key is hidden.'));
-  if (!(await effects.ask('Set up voice transcription now?', true))) {
-    const declined = planVoice({ mcpInstalled: mcpReady, ready, accepted: false, stateDir: target.stateDir, port: target.port });
-    effects.out(info(declined.message));
-    return { key: 'voice', label: 'Voice transcription', state: 'skipped', note: 'declined; offered again on re-run' };
-  }
-
-  if (args.dryRun) {
-    effects.out(info(wouldPrefix(offer.setup.join(' '))));
-    return { key: 'voice', label: 'Voice transcription', state: 'skipped', note: 'dry run' };
-  }
-  // Interactive on purpose: voice-setup owns the provider choice and the masked
-  // key prompt, and the installer keeps no second implementation of either.
-  const setup = await effects.runInteractive(offer.setup[0], offer.setup.slice(1), { env });
-  if (!setup.ok) {
-    effects.out(warn('Voice setup did not complete; no installer-side credential fallback was used.'));
-    effects.out(info(`Run '${offer.setup.join(' ')}' directly to try again.`));
-    return { key: 'voice', label: 'Voice transcription', state: 'failed', note: 'voice-setup did not complete' };
-  }
-
-  const applied = planVoice({
-    mcpInstalled: mcpReady, ready, accepted: true, configChanged: true, stateDir: target.stateDir, port: target.port,
-  });
-  const restart = await attempt(effects, args.dryRun, applied.restart.join(' '), () => effects.run(applied.restart[0], applied.restart.slice(1)));
-  if (!restart.ok) {
-    effects.out(info(`the configuration is saved; apply it with: ${applied.retryHint}`));
-    return { key: 'voice', label: 'Voice transcription', state: 'failed', note: 'saved, but the daemon did not restart' };
-  }
-  if (await voiceReady(effects, env)) {
-    effects.out(ok('Voice transcription is ready; the API key remains hidden.'));
-    return { key: 'voice', label: 'Voice transcription', state: 'installed', note: 'ready' };
-  }
-  effects.out(warn(`Voice configuration was saved, but readiness was not confirmed — check '${offer.statusCheck.join(' ')}'.`));
-  return { key: 'voice', label: 'Voice transcription', state: 'failed', note: 'readiness not confirmed' };
-}
-
-// Read-only, and deliberately lenient: an unreadable answer is "not ready",
-// which offers voice setup again rather than skipping it on a bad parse.
-async function voiceReady(effects, env) {
-  try {
-    const result = await effects.run('ours-mcp', ['voice-status', '--json'], { env });
-    return JSON.parse(String(result?.stdout ?? '').trim())?.ready === true;
-  } catch {
-    return false;
-  }
+  effects.out(info('Voice transcription setup is not managed by ours-mcp. Existing daemon configuration is left unchanged.'));
+  return { key: 'voice', label: 'Voice transcription', state: 'skipped', note: 'configure on the shared daemon' };
 }
 
 /**
@@ -976,7 +970,19 @@ export async function runInstall(argv, effects) {
   if (args.version) { effects.out(`ours-install v${effects.version ?? '?'}`); return EXIT_OK; }
 
   args.brokerUrl = args.brokerUrl ?? effects.brokerUrl;
-  args.channel = resolveChannel(effects.env.OURS_CHANNEL ?? effects.env.OURS_INSTALL_CHANNEL);
+  // THE INSTALLER'S OWN VERSION IS THE CHANNEL SIGNAL WHEN NOTHING SAYS OTHERWISE.
+  //
+  // resolveChannel falls back to `selfVersion` only when the environment is
+  // silent, and this call passed no selfVersion — so a NIGHTLY installer with no
+  // OURS_CHANNEL set resolved to `latest` and installed the whole stack at latest.
+  // That is what put fleet@latest and a stable ours-mcp on a nightly machine.
+  //
+  // The v2 bin has always done this correctly (install.mjs:53 passes pkgVersion());
+  // the v3 orchestrator dropped the argument. @ours.network/install is published on
+  // BOTH dist-tags from one lockstep bump, so its own version is the only thing
+  // that distinguishes a nightly installer from a stable one when the operator has
+  // said nothing.
+  args.channel = resolveChannel(effects.env.OURS_CHANNEL ?? effects.env.OURS_INSTALL_CHANNEL, effects.version);
 
   effects.out(banner());
   effects.out(heading(`ours: target ${args.stateDir}${args.portExplicit ? `, port ${args.port}` : ''}`));
@@ -1003,6 +1009,16 @@ export async function runInstall(argv, effects) {
     state: target.action === 'create' ? 'installed' : 'current',
     note: `port ${target.port}`,
   }];
+  // The skip must not read as success: same "needs attention" mark a failed
+  // component gets, so the closing screen cannot say everything is clean.
+  if (daemon.serviceUnsupported) {
+    summary.push({
+      key: 'service',
+      label: 'Boot service',
+      state: 'failed',
+      note: `not available on ${daemon.serviceUnsupported.platform === 'darwin' ? 'macOS' : daemon.serviceUnsupported.platform} — start the daemon yourself after a reboot`,
+    });
+  }
 
   const components = await runComponentPhase(args, effects, target);
   for (const component of COMPONENTS) {