@oxagen/cli 2.1.4-672 → 2.1.4-684

package/oxagen.mjs

@@ -149,359 +149,6 @@ var init_fs = __esm({
   }
 });
 
-// ../../packages/tacho/src/host/harness-file.ts
-import {
-  chmodSync as chmodSync2,
-  existsSync,
-  lstatSync,
-  mkdirSync as mkdirSync2,
-  readdirSync,
-  readFileSync as readFileSync2,
-  readlinkSync,
-  rmdirSync,
-  statSync,
-  unlinkSync as unlinkSync2
-} from "node:fs";
-import { createHash } from "node:crypto";
-import { basename as basename2, dirname as dirname2, join as join2, resolve } from "node:path";
-import { isDeepStrictEqual } from "node:util";
-function enrollmentIdsIn(text5) {
-  const ids = /* @__PURE__ */ new Set();
-  for (const match of text5.matchAll(ENROLLMENT_MARKER)) {
-    const id2 = match[1] ?? match[2];
-    if (id2 !== void 0) ids.add(id2);
-  }
-  return ids;
-}
-function withoutBom(text5) {
-  return text5.startsWith(BOM) ? text5.slice(BOM.length) : text5;
-}
-function realTarget(path2) {
-  let current = path2;
-  for (let hops = 0; hops < 16; hops += 1) {
-    let stat6;
-    try {
-      stat6 = lstatSync(current);
-    } catch {
-      return current;
-    }
-    if (!stat6.isSymbolicLink()) return current;
-    current = resolve(dirname2(current), readlinkSync(current));
-  }
-  throw new HarnessFileError(path2, "too many levels of symbolic links");
-}
-function writeAtomic(path2, data, mode) {
-  writeFileAtomic(path2, data, { mode });
-}
-function digestOf(text5) {
-  return createHash("sha256").update(text5).digest("hex");
-}
-function isBlank(text5) {
-  if (text5.trim() === "") return true;
-  try {
-    return isDeepStrictEqual(JSON.parse(withoutBom(text5)), {});
-  } catch {
-    return false;
-  }
-}
-function sameDocument(a, b5) {
-  if (a === b5) return true;
-  try {
-    return isDeepStrictEqual(
-      sortKeys(withoutStrippedEmpties(JSON.parse(withoutBom(a)))),
-      sortKeys(withoutStrippedEmpties(JSON.parse(withoutBom(b5))))
-    );
-  } catch {
-    return false;
-  }
-}
-function isEmptyContainer(value) {
-  if (Array.isArray(value)) return value.length === 0;
-  return typeof value === "object" && value !== null && Object.keys(value).length === 0;
-}
-function withoutStrippedEmpties(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value))
-    return value;
-  const document = { ...value };
-  const hooks = document["hooks"];
-  if (typeof hooks === "object" && hooks !== null && !Array.isArray(hooks))
-    document["hooks"] = Object.fromEntries(
-      Object.entries(hooks).filter(([, list]) => !isEmptyContainer(list))
-    );
-  for (const key of ["env", "hooks", "mcpServers"])
-    if (isEmptyContainer(document[key])) delete document[key];
-  return document;
-}
-function sortKeys(value) {
-  if (Array.isArray(value)) return value.map(sortKeys);
-  if (typeof value !== "object" || value === null) return value;
-  return Object.fromEntries(
-    Object.entries(value).sort(([a], [b5]) => a < b5 ? -1 : a > b5 ? 1 : 0).map(([key, child]) => [key, sortKeys(child)])
-  );
-}
-var HarnessFileError, ENROLLMENT_MARKER, BOM, HARNESS_RECEIPTS, HARNESS_BACKUPS, HarnessFiles;
-var init_harness_file = __esm({
-  "../../packages/tacho/src/host/harness-file.ts"() {
-    "use strict";
-    init_fs();
-    HarnessFileError = class extends Error {
-      constructor(path2, reason3) {
-        super(`${path2}: ${reason3}`);
-        this.path = path2;
-        this.reason = reason3;
-        this.name = "HarnessFileError";
-      }
-      path;
-      reason;
-    };
-    ENROLLMENT_MARKER = /--enrollment(?:\s+|"\s*,\s*")(tch_[a-z0-9]{22})|\/hook\/(tch_[a-z0-9]{22})/g;
-    BOM = "\uFEFF";
-    HARNESS_RECEIPTS = "install-receipts.json";
-    HARNESS_BACKUPS = "backups";
-    HarnessFiles = class {
-      /**
-       * `root` is the agent's directory (`TachoPaths.dir`). Each agent keeps the
-       * receipts for the files its own enroll touched, so its unenroll settles
-       * those and no other agent's.
-       */
-      constructor(root) {
-        this.root = root;
-        this.receiptsPath = join2(root, HARNESS_RECEIPTS);
-        this.backupsDir = join2(root, HARNESS_BACKUPS);
-      }
-      root;
-      receiptsPath;
-      backupsDir;
-      /** The file's text, or undefined when it does not exist. */
-      readText(path2) {
-        try {
-          return readFileSync2(path2, "utf8");
-        } catch (error) {
-          if (error.code === "ENOENT") return void 0;
-          throw new HarnessFileError(
-            path2,
-            `cannot be read (${error.code ?? "error"})`
-          );
-        }
-      }
-      /** The file parsed as JSON; undefined when absent; a named error when malformed. */
-      readJson(path2) {
-        const text5 = this.readText(path2);
-        if (text5 === void 0) return void 0;
-        if (text5.trim() === "") return void 0;
-        try {
-          return JSON.parse(withoutBom(text5));
-        } catch (error) {
-          throw new HarnessFileError(
-            path2,
-            `is not valid JSON (${error instanceof Error ? error.message : String(error)}); fix or remove it and run this again`
-          );
-        }
-      }
-      /**
-       * Whether `write` would be refused, without writing: the file, or the
-       * nearest existing directory above it, is not writable by this user.
-       */
-      writeProblem(path2) {
-        const target2 = realTarget(path2);
-        if (existsSync(target2)) {
-          if ((statSync(target2).mode & 128) === 0)
-            return "is read-only; Oxagen does not replace a file you have locked (chmod u+w it to allow the hooks)";
-          return void 0;
-        }
-        let dir = dirname2(target2);
-        while (!existsSync(dir) && dirname2(dir) !== dir) dir = dirname2(dir);
-        if ((statSync(dir).mode & 128) === 0)
-          return `cannot be created: ${dir} is read-only`;
-        return void 0;
-      }
-      /**
-       * Write `text`, taking a receipt the first time this path is touched.
-       *
-       * `vestigial` is the writer saying that what it is about to write holds
-       * nothing but the scaffolding it had to add itself (Cursor's `version`
-       * is the one instance), so `settle` may take the whole file back. It
-       * defaults to false, and every ordinary write leaves it false, because a
-       * teardown writes through here too: the stripped document is the bytes
-       * Tacho last wrote, and a hook the user added while enrolled survives
-       * inside it. Deleting on the digest alone would take that hook with the
-       * file.
-       */
-      write(path2, text5, vestigial = false) {
-        const problem = this.writeProblem(path2);
-        if (problem !== void 0) throw new HarnessFileError(path2, problem);
-        const target2 = realTarget(path2);
-        const receipts = this.load();
-        if (receipts.files[path2] === void 0) {
-          receipts.files[path2] = this.takeReceipt(path2, target2);
-          this.save(receipts);
-        }
-        for (const dir of receipts.files[path2]?.created_dirs ?? []) {
-          if (!existsSync(dir)) mkdirSync2(dir, { mode: 448 });
-        }
-        mkdirSync2(dirname2(target2), { recursive: true, mode: 448 });
-        const before = this.readText(target2);
-        const bom = !text5.startsWith(BOM) && before?.startsWith(BOM) === true ? BOM : "";
-        writeAtomic(target2, `${bom}${text5}`, 384);
-        const receipt = receipts.files[path2];
-        if (receipt !== void 0) {
-          receipt.last_written = digestOf(`${bom}${text5}`);
-          receipt.vestigial = vestigial;
-          receipt.enrollments = [
-            .../* @__PURE__ */ new Set([
-              ...receipt.enrollments ?? enrollmentIdsIn(before ?? ""),
-              ...enrollmentIdsIn(text5)
-            ])
-          ].sort();
-          this.save(receipts);
-        }
-      }
-      /**
-       * Give every file back (see the module comment). Safe to call with no
-       * receipts, twice, or after a run that died half way.
-       */
-      settle() {
-        const receipts = this.load();
-        const outcomes = [];
-        for (const [path2, receipt] of Object.entries(receipts.files)) {
-          const outcome = this.settleOne(path2, receipt);
-          outcomes.push(outcome);
-          if (outcome.result === "failed") continue;
-          delete receipts.files[path2];
-          this.save(receipts);
-        }
-        this.save(receipts);
-        return outcomes;
-      }
-      settleOne(path2, receipt) {
-        const target2 = realTarget(path2);
-        const backupPath = this.backupOf(receipt);
-        const backup = backupPath !== void 0 ? readFileSync2(backupPath) : void 0;
-        let result2;
-        let current;
-        try {
-          current = readFileSync2(target2, "utf8");
-        } catch (error) {
-          if (error.code !== "ENOENT") throw error;
-          current = void 0;
-        }
-        const original = enrollmentIdsIn(backup?.toString("utf8") ?? "");
-        const added = [...enrollmentIdsIn(current ?? "")].filter(
-          (id2) => !original.has(id2)
-        );
-        const ours = added.filter(
-          (id2) => receipt.enrollments?.includes(id2) ?? true
-        );
-        if (ours.length > 0) {
-          return {
-            path: path2,
-            result: "failed",
-            reason: `still carries Tacho's hooks, so it was not given back; run \`oxagen agent unenroll\` again from the environment that enrolled, or remove the entries that name ${ours.map((id2) => `\`${id2}\``).join(" or ")}`
-          };
-        }
-        if (added.length > 0) {
-          if (backupPath !== void 0 && existsSync(backupPath))
-            unlinkSync2(backupPath);
-          return { path: path2, result: "left-to-another-enrollment" };
-        }
-        if (current === void 0) {
-          result2 = "missing";
-        } else if (!receipt.existed) {
-          const oursAlone = receipt.vestigial === true && digestOf(current) === receipt.last_written;
-          if (isBlank(current) || oursAlone) {
-            unlinkSync2(target2);
-            result2 = "deleted";
-          } else {
-            result2 = "kept-user-edit";
-          }
-        } else if (backup !== void 0 && sameDocument(current, backup.toString("utf8"))) {
-          writeAtomic(target2, backup, receipt.mode ?? 420);
-          result2 = "restored";
-        } else {
-          if (receipt.mode !== void 0) chmodSync2(target2, receipt.mode);
-          result2 = "kept-user-edit";
-        }
-        if (backupPath !== void 0 && existsSync(backupPath))
-          unlinkSync2(backupPath);
-        for (const dir of [...receipt.created_dirs].reverse()) {
-          try {
-            if (readdirSync(dir).length === 0) rmdirSync(dir);
-          } catch {
-          }
-        }
-        return { path: path2, result: result2 };
-      }
-      /**
-       * Where the receipt's byte copy is now, or undefined when it is gone. The
-       * receipt records an absolute path, and the move of a pre-ADR-203
-       * enrollment into `agents/<id>/` (`migrateLegacyLayout`) carries
-       * `backups/` along without rewriting it, so a copy missing from the
-       * recorded path is looked for under its own name in this `backups/`.
-       */
-      backupOf(receipt) {
-        if (receipt.backup === void 0) return void 0;
-        if (existsSync(receipt.backup)) return receipt.backup;
-        const moved = join2(this.backupsDir, basename2(receipt.backup));
-        return existsSync(moved) ? moved : void 0;
-      }
-      takeReceipt(path2, target2) {
-        const created = [];
-        let dir = dirname2(target2);
-        while (!existsSync(dir) && dirname2(dir) !== dir) {
-          created.unshift(dir);
-          dir = dirname2(dir);
-        }
-        if (!existsSync(target2))
-          return { existed: false, created_dirs: created, enrollments: [] };
-        mkdirSync2(this.backupsDir, { recursive: true, mode: 448 });
-        const backup = join2(
-          this.backupsDir,
-          `${createHash("sha256").update(path2).digest("hex").slice(0, 24)}.orig`
-        );
-        writeAtomic(backup, readFileSync2(target2), 384);
-        return {
-          existed: true,
-          mode: statSync(target2).mode & 511,
-          backup,
-          created_dirs: created,
-          enrollments: []
-        };
-      }
-      load() {
-        try {
-          const parsed2 = JSON.parse(
-            readFileSync2(this.receiptsPath, "utf8")
-          );
-          if (typeof parsed2.files === "object" && parsed2.files !== null)
-            return { schema: "tacho.install-receipts.v1", files: parsed2.files };
-        } catch {
-        }
-        return { schema: "tacho.install-receipts.v1", files: {} };
-      }
-      save(receipts) {
-        if (Object.keys(receipts.files).length === 0) {
-          for (const path2 of [this.receiptsPath]) {
-            if (existsSync(path2)) unlinkSync2(path2);
-          }
-          try {
-            if (readdirSync(this.backupsDir).length === 0)
-              rmdirSync(this.backupsDir);
-          } catch {
-          }
-          return;
-        }
-        mkdirSync2(this.root, { recursive: true, mode: 448 });
-        writeAtomic(
-          this.receiptsPath,
-          `${JSON.stringify(receipts, null, 2)}
-`,
-          384
-        );
-      }
-    };
-  }
-});
-
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType;
 var init_util = __esm({
@@ -4609,7 +4256,7 @@ var init_zod = __esm({
 });
 
 // ../../packages/tacho/src/digest.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash } from "node:crypto";
 function jcs(value) {
   const text5 = serialize(value, false);
   if (text5 === void 0) {
@@ -4654,7 +4301,7 @@ function serialize(value, legacy) {
   return `{${out}}`;
 }
 function sha256Hex(input) {
-  return createHash2("sha256").update(input).digest("hex");
+  return createHash("sha256").update(input).digest("hex");
 }
 function digestBytes(input) {
   return `sha256:${sha256Hex(input)}`;
@@ -8155,7 +7802,7 @@ var init_bundle = __esm({
 });
 
 // ../../packages/tacho/src/host/host-file.ts
-import { dirname as dirname3, join as join3 } from "node:path";
+import { dirname as dirname2, join as join2 } from "node:path";
 function enrolledWithToken(host) {
   return host.agent_id !== void 0 || host.enrollment_source === "token";
 }
@@ -8192,7 +7839,7 @@ function withRecordedHarnessFiles(paths, host) {
     // A record from before #5287 has no entry, and the host it describes
     // never had the Oxagen MCP server written, so this process's path stands.
     claudeUserConfig: record.claude_user_config ?? paths.claudeUserConfig,
-    claudeProjects: record.claude_settings !== void 0 ? join3(dirname3(claudeSettings), "projects") : paths.claudeProjects,
+    claudeProjects: record.claude_settings !== void 0 ? join2(dirname2(claudeSettings), "projects") : paths.claudeProjects,
     codexHooks: record.codex_hooks ?? paths.codexHooks,
     cursorHooks: record.cursor_hooks ?? paths.cursorHooks,
     stellaToml: record.stella_toml ?? paths.stellaToml,
@@ -9035,10 +8682,10 @@ var init_mcp_config_writer = __esm({
 });
 
 // ../../packages/tacho/src/host/claude-desktop-writer.ts
-import { join as join4 } from "node:path";
+import { join as join3 } from "node:path";
 function claudeDesktopConfigPath(platform, home, env = {}) {
   if (platform === "darwin") {
-    return join4(
+    return join3(
       home,
       "Library",
       "Application Support",
@@ -9047,8 +8694,8 @@ function claudeDesktopConfigPath(platform, home, env = {}) {
     );
   }
   if (platform === "win32") {
-    const appData = env["APPDATA"] ?? join4(home, "AppData", "Roaming");
-    return join4(appData, "Claude", "claude_desktop_config.json");
+    const appData = env["APPDATA"] ?? join3(home, "AppData", "Roaming");
+    return join3(appData, "Claude", "claude_desktop_config.json");
   }
   return void 0;
 }
@@ -9071,9 +8718,9 @@ var init_claude_desktop_writer = __esm({
 });
 
 // ../../packages/tacho/src/claude-code/context.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 function digestText(value) {
-  return `sha256:${createHash3("sha256").update(value, "utf8").digest("hex")}`;
+  return `sha256:${createHash2("sha256").update(value, "utf8").digest("hex")}`;
 }
 function deliveredContext(text5, bundleEtag) {
   return text5 === null ? { chars: 0, bundle_etag: bundleEtag } : { digest: digestText(text5), chars: text5.length, bundle_etag: bundleEtag };
@@ -9355,18 +9002,18 @@ var init_cursor_adapter = __esm({
 });
 
 // ../../packages/tacho/src/host/cursor-writer.ts
-import { join as join5 } from "node:path";
+import { join as join4 } from "node:path";
 function cursorConfigDir(home, platform, env = {}) {
   const explicit = env["CURSOR_CONFIG_DIR"];
   if (explicit !== void 0 && explicit.length > 0) return explicit;
   const xdg = env["XDG_CONFIG_HOME"];
   if (platform !== "darwin" && platform !== "win32" && xdg !== void 0 && xdg.length > 0)
-    return join5(xdg, "cursor");
-  return join5(home, ".cursor");
+    return join4(xdg, "cursor");
+  return join4(home, ".cursor");
 }
 function cursorHooksPaths(home, platform, env = {}) {
-  const resolved = join5(cursorConfigDir(home, platform, env), "hooks.json");
-  const fallback = join5(home, ".cursor", "hooks.json");
+  const resolved = join4(cursorConfigDir(home, platform, env), "hooks.json");
+  const fallback = join4(home, ".cursor", "hooks.json");
   return resolved === fallback ? [resolved] : [resolved, fallback];
 }
 function cursorHooksShapeProblem(document) {
@@ -9489,16 +9136,16 @@ var init_cursor_writer = __esm({
 
 // ../../packages/tacho/src/host/paths.ts
 import { homedir } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join5 } from "node:path";
 function claudeConfigDirFor(env, home) {
-  return env["CLAUDE_CONFIG_DIR"] ?? join6(home, ".claude");
+  return env["CLAUDE_CONFIG_DIR"] ?? join5(home, ".claude");
 }
 function claudeUserConfigFor(env, home) {
   const dir = env["CLAUDE_CONFIG_DIR"];
-  return join6(dir === void 0 || dir === "" ? home : dir, ".claude.json");
+  return join5(dir === void 0 || dir === "" ? home : dir, ".claude.json");
 }
 function codexHomeFor(env, home) {
-  return env["CODEX_HOME"] ?? join6(home, ".codex");
+  return env["CODEX_HOME"] ?? join5(home, ".codex");
 }
 function harnessConfigDirs(home, env = process.env, ownHome = homedir()) {
   const own = home === ownHome ? env : {};
@@ -9508,23 +9155,23 @@ function harnessConfigDirs(home, env = process.env, ownHome = homedir()) {
   };
 }
 function tachoHome(env = process.env, home = homedir(), platform = process.platform) {
-  const tachoDir = env["TACHO_HOME"] ?? join6(home, ".config", "oxagen", "tacho");
+  const tachoDir = env["TACHO_HOME"] ?? join5(home, ".config", "oxagen", "tacho");
   const claudeConfigDir = claudeConfigDirFor(env, home);
   const codexHome = codexHomeFor(env, home);
-  const stellaHome = env["STELLA_HOME"] ?? join6(home, ".stella");
+  const stellaHome = env["STELLA_HOME"] ?? join5(home, ".stella");
   return {
     tachoDir,
-    agents: join6(tachoDir, "agents"),
-    pid: join6(tachoDir, "tachod.pid"),
-    log: join6(tachoDir, "tachod.log"),
-    daemonLauncher: join6(tachoDir, "tachod.cmd"),
-    claudeSettings: join6(claudeConfigDir, "settings.json"),
+    agents: join5(tachoDir, "agents"),
+    pid: join5(tachoDir, "tachod.pid"),
+    log: join5(tachoDir, "tachod.log"),
+    daemonLauncher: join5(tachoDir, "tachod.cmd"),
+    claudeSettings: join5(claudeConfigDir, "settings.json"),
     claudeUserConfig: claudeUserConfigFor(env, home),
-    claudeProjects: join6(claudeConfigDir, "projects"),
-    codexHooks: join6(codexHome, "hooks.json"),
+    claudeProjects: join5(claudeConfigDir, "projects"),
+    codexHooks: join5(codexHome, "hooks.json"),
     cursorHooks: cursorHooksPaths(home, platform, env),
-    stellaToml: join6(stellaHome, "stella.toml"),
-    stellaSettingsJson: join6(stellaHome, "settings.json"),
+    stellaToml: join5(stellaHome, "stella.toml"),
+    stellaSettingsJson: join5(stellaHome, "settings.json"),
     claudeDesktopConfig: claudeDesktopConfigPath(platform, home, env)
   };
 }
@@ -9546,16 +9193,16 @@ function homeOf(paths) {
   };
 }
 function agentPaths(home, id2) {
-  return pathsInDir(home, join6(home.agents, id2));
+  return pathsInDir(home, join5(home.agents, id2));
 }
 function pathsInDir(home, dir) {
   const files3 = {};
   for (const key of Object.keys(AGENT_FILES))
-    files3[key] = join6(dir, AGENT_FILES[key]);
+    files3[key] = join5(dir, AGENT_FILES[key]);
   return { ...homeOf(home), dir, ...files3 };
 }
 function oxagenConfigPath(home = homedir()) {
-  return join6(home, ".config", "oxagen", "config.json");
+  return join5(home, ".config", "oxagen", "config.json");
 }
 var AGENT_FILES;
 var init_paths = __esm({
@@ -9590,34 +9237,21 @@ var init_paths = __esm({
 
 // ../../packages/tacho/src/host/agents.ts
 import { randomBytes } from "node:crypto";
-import {
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync3,
-  readdirSync as readdirSync2,
-  renameSync as renameSync2,
-  rmdirSync as rmdirSync2,
-  statSync as statSync2
-} from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync, readdirSync } from "node:fs";
 function agentDirs(home) {
   let names2;
   try {
-    names2 = readdirSync2(home.agents);
+    names2 = readdirSync(home.agents);
   } catch {
     names2 = [];
   }
-  const dirs = names2.sort().filter((name) => !name.startsWith(".")).map((id2) => ({ id: id2, paths: agentPaths(home, id2) })).filter(({ paths }) => existsSync2(paths.hostFile));
-  const legacy = pathsInDir(home, home.tachoDir);
-  if (existsSync2(legacy.hostFile))
-    dirs.push({ id: LEGACY_AGENT_ID, paths: legacy });
-  return dirs;
+  return names2.sort().map((id2) => ({ id: id2, paths: agentPaths(home, id2) })).filter(({ paths }) => existsSync(paths.hostFile));
 }
 function listAgents(home) {
   return agentDirs(home).map(({ id: id2, paths }) => ({
     id: id2,
     paths,
-    host: readHostFileLenient(paths.hostFile).host,
-    legacy: id2 === LEGACY_AGENT_ID
+    host: readHostFileLenient(paths.hostFile).host
   })).sort((a, b5) => {
     if (a.host !== void 0 && b5.host !== void 0)
       return a.host.enrolled_at.localeCompare(b5.host.enrolled_at) || a.id.localeCompare(b5.id);
@@ -9686,8 +9320,7 @@ function freshAgentPaths(home, mint = newAgentId) {
   for (; ; ) {
     const id2 = mint();
     const paths = agentPaths(home, id2);
-    if (!existsSync2(paths.dir) && !existsSync2(migratingDir(home, id2)))
-      return paths;
+    if (!existsSync(paths.dir)) return paths;
   }
 }
 function agentPathsForEnrollment(home, enrollmentId, harness) {
@@ -9720,75 +9353,17 @@ function harnessesIn(hostFile) {
   const value = hostField(hostFile, "harnesses");
   return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
-function migratingDir(home, id2) {
-  return join7(home.agents, `${MIGRATING_PREFIX}${id2}`);
-}
-function legacyNames() {
-  return [
-    ...Object.values(AGENT_FILES).filter(
-      (name) => name !== AGENT_FILES.hostFile
-    ),
-    HARNESS_RECEIPTS,
-    HARNESS_BACKUPS
-  ];
-}
-function moveInto(from, to) {
-  if (!existsSync2(from)) return;
-  if (!existsSync2(to)) {
-    renameSync2(from, to);
-    return;
-  }
-  if (!statSync2(from).isDirectory() || !statSync2(to).isDirectory()) return;
-  for (const name of readdirSync2(from))
-    moveInto(join7(from, name), join7(to, name));
-  try {
-    rmdirSync2(from);
-  } catch {
-  }
-}
-function migrateLegacyLayout(home, mint = newAgentId) {
-  const legacy = pathsInDir(home, home.tachoDir);
-  let pending;
-  try {
-    pending = readdirSync2(home.agents).find(
-      (name) => name.startsWith(MIGRATING_PREFIX)
-    );
-  } catch {
-    pending = void 0;
-  }
-  if (pending === void 0 && !existsSync2(legacy.hostFile)) return void 0;
-  let id2;
-  if (pending === void 0) {
-    id2 = freshAgentPaths(home, mint).dir.slice(home.agents.length + 1);
-    mkdirSync3(migratingDir(home, id2), { recursive: true, mode: 448 });
-  } else {
-    id2 = pending.slice(MIGRATING_PREFIX.length);
-  }
-  const staging = migratingDir(home, id2);
-  for (const name of legacyNames())
-    moveInto(join7(home.tachoDir, name), join7(staging, name));
-  moveInto(legacy.hostFile, join7(staging, AGENT_FILES.hostFile));
-  const target2 = agentPaths(home, id2).dir;
-  renameSync2(staging, target2);
-  for (const name of legacyNames())
-    moveInto(join7(home.tachoDir, name), join7(target2, name));
-  return id2;
-}
-var LEGACY_AGENT_ID, MIGRATING_PREFIX;
 var init_agents = __esm({
   "../../packages/tacho/src/host/agents.ts"() {
     "use strict";
     init_fs();
-    init_harness_file();
     init_host_file();
     init_paths();
-    LEGACY_AGENT_ID = "legacy";
-    MIGRATING_PREFIX = ".migrating-";
   }
 });
 
 // ../../packages/tacho/src/ids.ts
-import { createHash as createHash4, randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash3, randomBytes as randomBytes2 } from "node:crypto";
 function uuidBytes(uuid) {
   const hex = uuid.replace(/-/g, "");
   if (!/^[0-9a-f]{32}$/i.test(hex)) {
@@ -9801,7 +9376,7 @@ function formatUuid(bytes) {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
 }
 function uuidv5(namespace, name) {
-  const hash3 = createHash4("sha1").update(uuidBytes(namespace)).update(Buffer.from(name, "utf8")).digest();
+  const hash3 = createHash3("sha1").update(uuidBytes(namespace)).update(Buffer.from(name, "utf8")).digest();
   const bytes = Buffer.from(hash3.subarray(0, 16));
   bytes[6] = (bytes[6] ?? 0) & 15 | 80;
   bytes[8] = (bytes[8] ?? 0) & 63 | 128;
@@ -9814,11 +9389,11 @@ function eventIdIdem(sessionUuidValue, seq) {
   if (!Number.isInteger(seq) || seq < 0) {
     throw new TypeError(`seq must be a non-negative integer, got ${seq}`);
   }
-  const hash3 = createHash4("sha256").update(sessionUuidValue).update(" ").update(String(seq)).digest("hex");
+  const hash3 = createHash3("sha256").update(sessionUuidValue).update(" ").update(String(seq)).digest("hex");
   return `evt_${hash3}`;
 }
 function effectId(sessionUuidValue, toolUseId, target2) {
-  return `eff_${createHash4("sha256").update(sessionUuidValue).update(" ").update(toolUseId).update(" ").update(target2).digest("hex")}`;
+  return `eff_${createHash3("sha256").update(sessionUuidValue).update(" ").update(toolUseId).update(" ").update(target2).digest("hex")}`;
 }
 function ulid(now = Date.now()) {
   let time = now;
@@ -9844,7 +9419,7 @@ function backfillEventId(sessionUuidValue, seq, rawSourceDigest, tsMs) {
     timePart = CROCKFORD[time % 32] + timePart;
     time = Math.floor(time / 32);
   }
-  const hash3 = createHash4("sha256").update(sessionUuidValue).update(" ").update(String(seq)).update(" ").update(rawSourceDigest).digest();
+  const hash3 = createHash3("sha256").update(sessionUuidValue).update(" ").update(String(seq)).update(" ").update(rawSourceDigest).digest();
   let bits2 = 0n;
   for (let index = 0; index < 10; index += 1)
     bits2 = bits2 << 8n | BigInt(hash3[index] ?? 0);
@@ -10075,7 +9650,7 @@ var init_codex_prompt_source = __esm({
 });
 
 // ../../packages/tacho/src/host/stella-writer.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 function stellaHookTimeoutMs(event) {
   switch (event) {
     case "SessionStart":
@@ -10101,7 +9676,7 @@ function stellaHookEntries(config) {
   }
   return out;
 }
-function readStellaHooksFile(paths, format, exists = existsSync3, read2 = (path2) => readFileSync3(path2, "utf8")) {
+function readStellaHooksFile(paths, format, exists = existsSync2, read2 = (path2) => readFileSync2(path2, "utf8")) {
   const chosen = format ?? (exists(paths.stellaToml) ? "toml" : exists(paths.stellaSettingsJson) ? "json" : "toml");
   const path2 = chosen === "toml" ? paths.stellaToml : paths.stellaSettingsJson;
   return { path: path2, format: chosen, text: exists(path2) ? read2(path2) : void 0 };
@@ -10324,7 +9899,7 @@ var init_stella_writer = __esm({
 
 // ../../packages/tacho/src/host/process-scan.ts
 import { execFile, spawnSync } from "node:child_process";
-import { readFileSync as readFileSync4, readlinkSync as readlinkSync2 } from "node:fs";
+import { readFileSync as readFileSync3, readlinkSync } from "node:fs";
 import { win32 as win322 } from "node:path";
 function parsePsListing(listing) {
   const out = [];
@@ -10380,7 +9955,7 @@ function psExecAsync(command2, args) {
 }
 function readText(path2) {
   try {
-    return readFileSync4(path2, "utf8");
+    return readFileSync3(path2, "utf8");
   } catch {
     return void 0;
   }
@@ -10502,7 +10077,7 @@ function createdAfterRecord(record, createdMs) {
 }
 function processExecutable(pid) {
   try {
-    return readlinkSync2(`/proc/${pid}/exe`).replace(/ \(deleted\)$/, "");
+    return readlinkSync(`/proc/${pid}/exe`).replace(/ \(deleted\)$/, "");
   } catch {
     return void 0;
   }
@@ -10523,8 +10098,8 @@ var init_process_scan = __esm({
 
 // ../../packages/tacho/src/claude-code/stella-adapter.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { readdirSync as readdirSync3, rmSync } from "node:fs";
-import { join as join8 } from "node:path";
+import { readdirSync as readdirSync2, rmSync } from "node:fs";
+import { join as join6 } from "node:path";
 function parsePsLine(stdout) {
   const match = /^\s*(\d+)\s+(.+?)\s*$/m.exec(stdout);
   if (match === null) return void 0;
@@ -10561,7 +10136,7 @@ function procLookupFor(platform) {
   return (pid) => readProcParent(pid);
 }
 function cachePath(cacheDir, pid) {
-  return join8(cacheDir, `${pid}.json`);
+  return join6(cacheDir, `${pid}.json`);
 }
 function readCachedIdentity(cacheDir, pid) {
   try {
@@ -10590,12 +10165,12 @@ function dropCachedIdentity(cacheDir, pid) {
 }
 function pruneCachedIdentities(cacheDir, keep, isAlive) {
   try {
-    for (const name of readdirSync3(cacheDir)) {
+    for (const name of readdirSync2(cacheDir)) {
       const match = /^(\d+)\.json$/.exec(name);
       if (match === null) continue;
       const pid = Number(match[1]);
       if (pid !== keep && !isAlive(pid))
-        rmSync(join8(cacheDir, name), { force: true });
+        rmSync(join6(cacheDir, name), { force: true });
     }
   } catch {
   }
@@ -12356,10 +11931,10 @@ var init_hooks = __esm({
 });
 
 // ../../packages/tacho/src/claude-code/hook-client.ts
-import { readdirSync as readdirSync4 } from "node:fs";
+import { readdirSync as readdirSync3 } from "node:fs";
 import { request } from "node:http";
 import { homedir as homedir2 } from "node:os";
-import { join as join9 } from "node:path";
+import { join as join7 } from "node:path";
 function cursorRefusal(raw, message) {
   const named = typeof raw === "object" && raw !== null ? raw["hook_event_name"] : void 0;
   const claudeEvent = typeof named === "string" && named in CURSOR_TO_CLAUDE_EVENT ? CURSOR_TO_CLAUDE_EVENT[named] : void 0;
@@ -12712,14 +12287,14 @@ function quarantineHookPayload(quarantineDir, record) {
   const { hookId, receivedAt, reason: reason3, rawText, label: label2 } = record;
   try {
     ensureDir(quarantineDir);
-    const held = readdirSync4(quarantineDir).filter(
+    const held = readdirSync3(quarantineDir).filter(
       (name) => name.endsWith(HOOK_PAYLOAD_SUFFIX)
     ).length;
     if (held >= MAX_QUARANTINED_HOOK_PAYLOADS) return;
     const fileId = typeof hookId === "string" && ULID_PATTERN.test(hookId) ? hookId : ulid();
     const truncated = rawText.length > MAX_QUARANTINED_PAYLOAD_BYTES;
     writeSensitiveFileAtomic(
-      join9(quarantineDir, `${fileId}${HOOK_PAYLOAD_SUFFIX}`),
+      join7(quarantineDir, `${fileId}${HOOK_PAYLOAD_SUFFIX}`),
       JSON.stringify({
         schema: "tacho.quarantined-hook-payload.v1",
         received_at: receivedAt,
@@ -12987,7 +12562,7 @@ async function runTachoHook(deps) {
     try {
       ensureDir(deps.paths.spool);
       writeSensitiveFileAtomic(
-        join9(deps.paths.spool, `${hookId}.json`),
+        join7(deps.paths.spool, `${hookId}.json`),
         JSON.stringify({
           schema: "tacho.spool.v1",
           received_at: receivedAt,
@@ -19248,16 +18823,16 @@ var init_registry = __esm({
 
 // ../../packages/tacho/src/collector/transcript-tailer.ts
 import { promises as fs } from "node:fs";
-import { basename as basename3, join as join10 } from "node:path";
+import { basename as basename2, join as join8 } from "node:path";
 function hasTranscriptNormalizer(session) {
   return session.harness === void 0 || TRANSCRIPT_NORMALIZED_HARNESSES.has(session.harness);
 }
 function subagentDirOf(transcriptPath) {
   if (!transcriptPath.endsWith(".jsonl")) return void 0;
-  return join10(transcriptPath.slice(0, -".jsonl".length), "subagents");
+  return join8(transcriptPath.slice(0, -".jsonl".length), "subagents");
 }
 function subagentIdOf(path2) {
-  return /^agent-(.+)\.jsonl$/.exec(basename3(path2))?.[1];
+  return /^agent-(.+)\.jsonl$/.exec(basename2(path2))?.[1];
 }
 function isPersistedTailState(value) {
   return value !== null && typeof value === "object" && value.schema === "tacho.transcript-tail.v1" && typeof value.cursors === "object";
@@ -19767,7 +19342,7 @@ var init_transcript_tailer = __esm({
         if (session.harness === "codex") return void 0;
         const dir = session.transcriptPath === void 0 ? void 0 : subagentDirOf(session.transcriptPath);
         if (dir === void 0) return void 0;
-        const own = join10(dir, `agent-${subagentId}.jsonl`);
+        const own = join8(dir, `agent-${subagentId}.jsonl`);
         if (own === path2) return void 0;
         return await statIfExists(own) === void 0 ? void 0 : own;
       }
@@ -19844,11 +19419,11 @@ var init_transcript_tailer = __esm({
        * those were 3,634 of 5,059 subagent transcripts.
        */
       async subagentTranscripts(dir) {
-        const paths = (await this.listDir(dir)).map((name) => join10(dir, name));
-        const workflows = join10(dir, "workflows");
+        const paths = (await this.listDir(dir)).map((name) => join8(dir, name));
+        const workflows = join8(dir, "workflows");
         for (const workflow of await this.listDir(workflows)) {
-          const at = join10(workflows, workflow);
-          for (const name of await this.listDir(at)) paths.push(join10(at, name));
+          const at = join8(workflows, workflow);
+          for (const name of await this.listDir(at)) paths.push(join8(at, name));
         }
         return paths.filter((path2) => subagentIdOf(path2) !== void 0).sort();
       }
@@ -20124,7 +19699,7 @@ var init_transcript_tailer = __esm({
 
 // ../../packages/tacho/src/collector/backfill.ts
 import { promises as fs2 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join9 } from "node:path";
 function parseBackfillRequest(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value))
     return { error: "the request must be a JSON object" };
@@ -20281,7 +19856,7 @@ async function discover(request3, deps, tally2) {
   const untilMs = request3.until === void 0 ? void 0 : Date.parse(`${request3.until}T00:00:00.000Z`);
   for (const root of deps.roots) {
     for (const slug of (await listDir(root)).sort()) {
-      const dir = join11(root, slug);
+      const dir = join9(root, slug);
       if (!await isDirectory(dir)) continue;
       const included = (only === void 0 || only.has(slug)) && !skip2.has(slug);
       const names2 = (await listDir(dir)).filter((name) => name.endsWith(".jsonl") && !name.startsWith("agent-")).sort();
@@ -20298,13 +19873,13 @@ async function discover(request3, deps, tally2) {
         const sessionId = name.slice(0, -".jsonl".length);
         if (sessionsWanted !== void 0 && !sessionsWanted.has(sessionId))
           continue;
-        const path2 = join11(dir, name);
+        const path2 = join9(dir, name);
         project2.sessions += 1;
         if (!included) {
-          project2.subagents += await countSubagents(join11(dir, sessionId));
+          project2.subagents += await countSubagents(join9(dir, sessionId));
           continue;
         }
-        const subagents = await subagentFiles(join11(dir, sessionId), tally2);
+        const subagents = await subagentFiles(join9(dir, sessionId), tally2);
         project2.subagents += subagents.length;
         let stat6;
         try {
@@ -20355,7 +19930,7 @@ async function isDirectory(path2) {
   }
 }
 async function subagentFiles(sessionDir, tally2) {
-  const dir = join11(sessionDir, "subagents");
+  const dir = join9(sessionDir, "subagents");
   const out = [];
   const add2 = async (folder, name) => {
     const match = /^agent-(.+)\.jsonl$/.exec(name);
@@ -20363,14 +19938,14 @@ async function subagentFiles(sessionDir, tally2) {
     const agentId = match[1];
     out.push({
       agentId,
-      path: join11(folder, name),
-      meta: await readMeta(join11(folder, `agent-${agentId}.meta.json`))
+      path: join9(folder, name),
+      meta: await readMeta(join9(folder, `agent-${agentId}.meta.json`))
     });
   };
   for (const name of (await listDir(dir)).sort()) await add2(dir, name);
-  const workflows = join11(dir, "workflows");
+  const workflows = join9(dir, "workflows");
   for (const workflow of (await listDir(workflows)).sort()) {
-    const folder = join11(workflows, workflow);
+    const folder = join9(workflows, workflow);
     for (const name of (await listDir(folder)).sort()) {
       if (name === "journal.jsonl") {
         tally2.recordsIgnored["workflow-journal"] = (tally2.recordsIgnored["workflow-journal"] ?? 0) + 1;
@@ -20382,11 +19957,11 @@ async function subagentFiles(sessionDir, tally2) {
   return out;
 }
 async function countSubagents(sessionDir) {
-  const dir = join11(sessionDir, "subagents");
+  const dir = join9(sessionDir, "subagents");
   const isAgent = (name) => /^agent-.+\.jsonl$/.test(name);
   let count12 = (await listDir(dir)).filter(isAgent).length;
-  for (const workflow of await listDir(join11(dir, "workflows")))
-    count12 += (await listDir(join11(dir, "workflows", workflow))).filter(
+  for (const workflow of await listDir(join9(dir, "workflows")))
+    count12 += (await listDir(join9(dir, "workflows", workflow))).filter(
       isAgent
     ).length;
   return count12;
@@ -21100,7 +20675,7 @@ var init_backfill3 = __esm({
 });
 
 // ../../packages/tacho/src/host/claude-code-mcp-writer.ts
-import { dirname as dirname4, join as join12, resolve as resolve2 } from "node:path";
+import { dirname as dirname3, join as join10, resolve } from "node:path";
 function mergeClaudeCodeMcpConfig(existing, config) {
   return mergeOxagenMcpServer(existing, config, "stdio");
 }
@@ -21124,11 +20699,11 @@ function claudeCodeSessionHasOxagenTools(check2) {
 }
 function shadowedInProject(userConfig, cwd, enrollmentId, readProjectConfig) {
   const projects = member2(userConfig, "projects");
-  for (let dir = resolve2(cwd); ; dir = dirname4(dir)) {
+  for (let dir = resolve(cwd); ; dir = dirname3(dir)) {
     if (shadows(member2(projects, dir), enrollmentId)) return true;
-    if (shadows(readProjectConfig(join12(dir, ".mcp.json")), enrollmentId))
+    if (shadows(readProjectConfig(join10(dir, ".mcp.json")), enrollmentId))
       return true;
-    if (dirname4(dir) === dir) return false;
+    if (dirname3(dir) === dir) return false;
   }
 }
 function shadows(config, enrollmentId) {
@@ -21156,22 +20731,367 @@ var init_claude_code_mcp_writer = __esm({
   }
 });
 
+// ../../packages/tacho/src/host/harness-file.ts
+import {
+  chmodSync as chmodSync2,
+  existsSync as existsSync3,
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  readdirSync as readdirSync4,
+  readFileSync as readFileSync4,
+  readlinkSync as readlinkSync2,
+  rmdirSync,
+  statSync,
+  unlinkSync as unlinkSync2
+} from "node:fs";
+import { createHash as createHash4 } from "node:crypto";
+import { dirname as dirname4, join as join11, resolve as resolve2 } from "node:path";
+import { isDeepStrictEqual } from "node:util";
+function enrollmentIdsIn(text5) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const match of text5.matchAll(ENROLLMENT_MARKER)) {
+    const id2 = match[1] ?? match[2];
+    if (id2 !== void 0) ids.add(id2);
+  }
+  return ids;
+}
+function withoutBom(text5) {
+  return text5.startsWith(BOM) ? text5.slice(BOM.length) : text5;
+}
+function realTarget(path2) {
+  let current = path2;
+  for (let hops = 0; hops < 16; hops += 1) {
+    let stat6;
+    try {
+      stat6 = lstatSync(current);
+    } catch {
+      return current;
+    }
+    if (!stat6.isSymbolicLink()) return current;
+    current = resolve2(dirname4(current), readlinkSync2(current));
+  }
+  throw new HarnessFileError(path2, "too many levels of symbolic links");
+}
+function writeAtomic(path2, data, mode) {
+  writeFileAtomic(path2, data, { mode });
+}
+function digestOf(text5) {
+  return createHash4("sha256").update(text5).digest("hex");
+}
+function isBlank(text5) {
+  if (text5.trim() === "") return true;
+  try {
+    return isDeepStrictEqual(JSON.parse(withoutBom(text5)), {});
+  } catch {
+    return false;
+  }
+}
+function sameDocument(a, b5) {
+  if (a === b5) return true;
+  try {
+    return isDeepStrictEqual(
+      sortKeys(withoutStrippedEmpties(JSON.parse(withoutBom(a)))),
+      sortKeys(withoutStrippedEmpties(JSON.parse(withoutBom(b5))))
+    );
+  } catch {
+    return false;
+  }
+}
+function isEmptyContainer(value) {
+  if (Array.isArray(value)) return value.length === 0;
+  return typeof value === "object" && value !== null && Object.keys(value).length === 0;
+}
+function withoutStrippedEmpties(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return value;
+  const document = { ...value };
+  const hooks = document["hooks"];
+  if (typeof hooks === "object" && hooks !== null && !Array.isArray(hooks))
+    document["hooks"] = Object.fromEntries(
+      Object.entries(hooks).filter(([, list]) => !isEmptyContainer(list))
+    );
+  for (const key of ["env", "hooks", "mcpServers"])
+    if (isEmptyContainer(document[key])) delete document[key];
+  return document;
+}
+function sortKeys(value) {
+  if (Array.isArray(value)) return value.map(sortKeys);
+  if (typeof value !== "object" || value === null) return value;
+  return Object.fromEntries(
+    Object.entries(value).sort(([a], [b5]) => a < b5 ? -1 : a > b5 ? 1 : 0).map(([key, child]) => [key, sortKeys(child)])
+  );
+}
+var HarnessFileError, ENROLLMENT_MARKER, BOM, HARNESS_RECEIPTS, HARNESS_BACKUPS, HarnessFiles;
+var init_harness_file = __esm({
+  "../../packages/tacho/src/host/harness-file.ts"() {
+    "use strict";
+    init_fs();
+    HarnessFileError = class extends Error {
+      constructor(path2, reason3) {
+        super(`${path2}: ${reason3}`);
+        this.path = path2;
+        this.reason = reason3;
+        this.name = "HarnessFileError";
+      }
+      path;
+      reason;
+    };
+    ENROLLMENT_MARKER = /--enrollment(?:\s+|"\s*,\s*")(tch_[a-z0-9]{22})|\/hook\/(tch_[a-z0-9]{22})/g;
+    BOM = "\uFEFF";
+    HARNESS_RECEIPTS = "install-receipts.json";
+    HARNESS_BACKUPS = "backups";
+    HarnessFiles = class {
+      /**
+       * `root` is the agent's directory (`TachoPaths.dir`). Each agent keeps the
+       * receipts for the files its own enroll touched, so its unenroll settles
+       * those and no other agent's.
+       */
+      constructor(root) {
+        this.root = root;
+        this.receiptsPath = join11(root, HARNESS_RECEIPTS);
+        this.backupsDir = join11(root, HARNESS_BACKUPS);
+      }
+      root;
+      receiptsPath;
+      backupsDir;
+      /** The file's text, or undefined when it does not exist. */
+      readText(path2) {
+        try {
+          return readFileSync4(path2, "utf8");
+        } catch (error) {
+          if (error.code === "ENOENT") return void 0;
+          throw new HarnessFileError(
+            path2,
+            `cannot be read (${error.code ?? "error"})`
+          );
+        }
+      }
+      /** The file parsed as JSON; undefined when absent; a named error when malformed. */
+      readJson(path2) {
+        const text5 = this.readText(path2);
+        if (text5 === void 0) return void 0;
+        if (text5.trim() === "") return void 0;
+        try {
+          return JSON.parse(withoutBom(text5));
+        } catch (error) {
+          throw new HarnessFileError(
+            path2,
+            `is not valid JSON (${error instanceof Error ? error.message : String(error)}); fix or remove it and run this again`
+          );
+        }
+      }
+      /**
+       * Whether `write` would be refused, without writing: the file, or the
+       * nearest existing directory above it, is not writable by this user.
+       */
+      writeProblem(path2) {
+        const target2 = realTarget(path2);
+        if (existsSync3(target2)) {
+          if ((statSync(target2).mode & 128) === 0)
+            return "is read-only; Oxagen does not replace a file you have locked (chmod u+w it to allow the hooks)";
+          return void 0;
+        }
+        let dir = dirname4(target2);
+        while (!existsSync3(dir) && dirname4(dir) !== dir) dir = dirname4(dir);
+        if ((statSync(dir).mode & 128) === 0)
+          return `cannot be created: ${dir} is read-only`;
+        return void 0;
+      }
+      /**
+       * Write `text`, taking a receipt the first time this path is touched.
+       *
+       * `vestigial` is the writer saying that what it is about to write holds
+       * nothing but the scaffolding it had to add itself (Cursor's `version`
+       * is the one instance), so `settle` may take the whole file back. It
+       * defaults to false, and every ordinary write leaves it false, because a
+       * teardown writes through here too: the stripped document is the bytes
+       * Tacho last wrote, and a hook the user added while enrolled survives
+       * inside it. Deleting on the digest alone would take that hook with the
+       * file.
+       */
+      write(path2, text5, vestigial = false) {
+        const problem = this.writeProblem(path2);
+        if (problem !== void 0) throw new HarnessFileError(path2, problem);
+        const target2 = realTarget(path2);
+        const receipts = this.load();
+        if (receipts.files[path2] === void 0) {
+          receipts.files[path2] = this.takeReceipt(path2, target2);
+          this.save(receipts);
+        }
+        for (const dir of receipts.files[path2]?.created_dirs ?? []) {
+          if (!existsSync3(dir)) mkdirSync2(dir, { mode: 448 });
+        }
+        mkdirSync2(dirname4(target2), { recursive: true, mode: 448 });
+        const before = this.readText(target2);
+        const bom = !text5.startsWith(BOM) && before?.startsWith(BOM) === true ? BOM : "";
+        writeAtomic(target2, `${bom}${text5}`, 384);
+        const receipt = receipts.files[path2];
+        if (receipt !== void 0) {
+          receipt.last_written = digestOf(`${bom}${text5}`);
+          receipt.vestigial = vestigial;
+          receipt.enrollments = [
+            .../* @__PURE__ */ new Set([
+              ...receipt.enrollments ?? enrollmentIdsIn(before ?? ""),
+              ...enrollmentIdsIn(text5)
+            ])
+          ].sort();
+          this.save(receipts);
+        }
+      }
+      /**
+       * Give every file back (see the module comment). Safe to call with no
+       * receipts, twice, or after a run that died half way.
+       */
+      settle() {
+        const receipts = this.load();
+        const outcomes = [];
+        for (const [path2, receipt] of Object.entries(receipts.files)) {
+          const outcome = this.settleOne(path2, receipt);
+          outcomes.push(outcome);
+          if (outcome.result === "failed") continue;
+          delete receipts.files[path2];
+          this.save(receipts);
+        }
+        this.save(receipts);
+        return outcomes;
+      }
+      settleOne(path2, receipt) {
+        const target2 = realTarget(path2);
+        const backupPath = this.backupOf(receipt);
+        const backup = backupPath !== void 0 ? readFileSync4(backupPath) : void 0;
+        let result2;
+        let current;
+        try {
+          current = readFileSync4(target2, "utf8");
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+          current = void 0;
+        }
+        const original = enrollmentIdsIn(backup?.toString("utf8") ?? "");
+        const added = [...enrollmentIdsIn(current ?? "")].filter(
+          (id2) => !original.has(id2)
+        );
+        const ours = added.filter(
+          (id2) => receipt.enrollments?.includes(id2) ?? true
+        );
+        if (ours.length > 0) {
+          return {
+            path: path2,
+            result: "failed",
+            reason: `still carries Tacho's hooks, so it was not given back; run \`oxagen agent unenroll\` again from the environment that enrolled, or remove the entries that name ${ours.map((id2) => `\`${id2}\``).join(" or ")}`
+          };
+        }
+        if (added.length > 0) {
+          if (backupPath !== void 0 && existsSync3(backupPath))
+            unlinkSync2(backupPath);
+          return { path: path2, result: "left-to-another-enrollment" };
+        }
+        if (current === void 0) {
+          result2 = "missing";
+        } else if (!receipt.existed) {
+          const oursAlone = receipt.vestigial === true && digestOf(current) === receipt.last_written;
+          if (isBlank(current) || oursAlone) {
+            unlinkSync2(target2);
+            result2 = "deleted";
+          } else {
+            result2 = "kept-user-edit";
+          }
+        } else if (backup !== void 0 && sameDocument(current, backup.toString("utf8"))) {
+          writeAtomic(target2, backup, receipt.mode ?? 420);
+          result2 = "restored";
+        } else {
+          if (receipt.mode !== void 0) chmodSync2(target2, receipt.mode);
+          result2 = "kept-user-edit";
+        }
+        if (backupPath !== void 0 && existsSync3(backupPath))
+          unlinkSync2(backupPath);
+        for (const dir of [...receipt.created_dirs].reverse()) {
+          try {
+            if (readdirSync4(dir).length === 0) rmdirSync(dir);
+          } catch {
+          }
+        }
+        return { path: path2, result: result2 };
+      }
+      /** The receipt's byte copy, or undefined when it is gone. */
+      backupOf(receipt) {
+        if (receipt.backup === void 0) return void 0;
+        return existsSync3(receipt.backup) ? receipt.backup : void 0;
+      }
+      takeReceipt(path2, target2) {
+        const created = [];
+        let dir = dirname4(target2);
+        while (!existsSync3(dir) && dirname4(dir) !== dir) {
+          created.unshift(dir);
+          dir = dirname4(dir);
+        }
+        if (!existsSync3(target2))
+          return { existed: false, created_dirs: created, enrollments: [] };
+        mkdirSync2(this.backupsDir, { recursive: true, mode: 448 });
+        const backup = join11(
+          this.backupsDir,
+          `${createHash4("sha256").update(path2).digest("hex").slice(0, 24)}.orig`
+        );
+        writeAtomic(backup, readFileSync4(target2), 384);
+        return {
+          existed: true,
+          mode: statSync(target2).mode & 511,
+          backup,
+          created_dirs: created,
+          enrollments: []
+        };
+      }
+      load() {
+        try {
+          const parsed2 = JSON.parse(
+            readFileSync4(this.receiptsPath, "utf8")
+          );
+          if (typeof parsed2.files === "object" && parsed2.files !== null)
+            return { schema: "tacho.install-receipts.v1", files: parsed2.files };
+        } catch {
+        }
+        return { schema: "tacho.install-receipts.v1", files: {} };
+      }
+      save(receipts) {
+        if (Object.keys(receipts.files).length === 0) {
+          for (const path2 of [this.receiptsPath]) {
+            if (existsSync3(path2)) unlinkSync2(path2);
+          }
+          try {
+            if (readdirSync4(this.backupsDir).length === 0)
+              rmdirSync(this.backupsDir);
+          } catch {
+          }
+          return;
+        }
+        mkdirSync2(this.root, { recursive: true, mode: 448 });
+        writeAtomic(
+          this.receiptsPath,
+          `${JSON.stringify(receipts, null, 2)}
+`,
+          384
+        );
+      }
+    };
+  }
+});
+
 // ../../packages/tacho/src/host/install-lock.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
 import {
   closeSync as closeSync3,
   existsSync as existsSync4,
   linkSync,
-  mkdirSync as mkdirSync4,
+  mkdirSync as mkdirSync3,
   openSync as openSync3,
   readdirSync as readdirSync5,
   readFileSync as readFileSync5,
-  renameSync as renameSync3,
-  rmdirSync as rmdirSync3,
+  renameSync as renameSync2,
+  rmdirSync as rmdirSync2,
   unlinkSync as unlinkSync3,
   writeSync as writeSync2
 } from "node:fs";
-import { dirname as dirname5, join as join13 } from "node:path";
+import { dirname as dirname5, join as join12 } from "node:path";
 function readLock(path2) {
   try {
     return readFileSync5(path2, "utf8");
@@ -21201,14 +21121,14 @@ function pidAlive(pid) {
   }
 }
 function acquireInstallLock(root, now = Date.now, alive = pidAlive) {
-  const path2 = join13(root, "install.lock");
+  const path2 = join12(root, "install.lock");
   const created = [];
   let dir = root;
   while (!existsSync4(dir) && dirname5(dir) !== dir) {
     created.unshift(dir);
     dir = dirname5(dir);
   }
-  mkdirSync4(root, { recursive: true, mode: 448 });
+  mkdirSync3(root, { recursive: true, mode: 448 });
   const token = randomBytes3(12).toString("hex");
   const liveHolder = (holder) => typeof holder.pid === "number" && typeof holder.at === "number" && now() - holder.at < STALE_AFTER_MS && alive(holder.pid) ? holder.pid : void 0;
   for (let attempt = 0; attempt < 2; attempt += 1) {
@@ -21221,7 +21141,7 @@ function acquireInstallLock(root, now = Date.now, alive = pidAlive) {
           if (holderOf(readLock(path2)).token === token) removeQuietly(path2);
           for (const made of [...created].reverse()) {
             try {
-              if (readdirSync5(made).length === 0) rmdirSync3(made);
+              if (readdirSync5(made).length === 0) rmdirSync2(made);
             } catch {
             }
           }
@@ -21233,7 +21153,7 @@ function acquireInstallLock(root, now = Date.now, alive = pidAlive) {
       if (live !== void 0) return { heldBy: live };
       const aside = `${path2}.${process.pid}.${token}.stale`;
       try {
-        renameSync3(path2, aside);
+        renameSync2(path2, aside);
       } catch (renameError) {
         if (renameError.code === "ENOENT") continue;
         throw renameError;
@@ -21514,12 +21434,12 @@ import { createHash as createHash5 } from "node:crypto";
 import {
   chmodSync as chmodSync3,
   existsSync as existsSync5,
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync4,
   readFileSync as readFileSync6,
-  statSync as statSync3,
+  statSync as statSync2,
   unlinkSync as unlinkSync4
 } from "node:fs";
-import { basename as basename4, dirname as dirname6, join as join14 } from "node:path";
+import { basename as basename3, dirname as dirname6, join as join13 } from "node:path";
 function claudeToolSearchEnabled(value) {
   return typeof value === "string" && /^(true|auto(:\d+)?)$/i.test(value);
 }
@@ -21533,18 +21453,18 @@ function isModelProxyBaseUrl(harness, value) {
 }
 function modelBaseUrlFile(harness, homes) {
   if (harness === "claude-code")
-    return join14(
+    return join13(
       homes.claudeConfigDir ?? harnessConfigDirs(homes.home).claudeConfigDir,
       "settings.json"
     );
   if (harness === "codex")
-    return join14(
+    return join13(
       homes.codexHome ?? harnessConfigDirs(homes.home).codexHome,
       "config.toml"
     );
-  const stellaHome = homes.stellaHome ?? join14(homes.home, ".stella");
-  const toml = join14(stellaHome, "stella.toml");
-  const json2 = join14(stellaHome, "settings.json");
+  const stellaHome = homes.stellaHome ?? join13(homes.home, ".stella");
+  const toml = join13(stellaHome, "stella.toml");
+  const json2 = join13(stellaHome, "settings.json");
   return !existsSync5(toml) && existsSync5(json2) ? json2 : toml;
 }
 function keyLabel(harness) {
@@ -21555,7 +21475,7 @@ function isJsonFile(file) {
   return file.endsWith(".json");
 }
 function sidecarFor(file) {
-  return join14(dirname6(file), `.${basename4(file)}.oxagen-model-base-url.json`);
+  return join13(dirname6(file), `.${basename3(file)}.oxagen-model-base-url.json`);
 }
 function modelBaseUrlBackupPath(harness, home, stellaHome, dirs = {}) {
   return sidecarFor(fileFor(harness, homesOf(home, stellaHome, dirs)));
@@ -21599,11 +21519,11 @@ function readSidecar(path2) {
   }
 }
 function writeAtomicPreserving(path2, data) {
-  mkdirSync5(dirname6(path2), { recursive: true });
+  mkdirSync4(dirname6(path2), { recursive: true });
   let mode = 384;
   let owner;
   try {
-    const stat6 = statSync3(path2);
+    const stat6 = statSync2(path2);
     mode = stat6.mode & 4095;
     owner = { uid: stat6.uid, gid: stat6.gid };
   } catch {
@@ -21706,8 +21626,8 @@ function stellaManagedSettingsPath(platform = process.platform, env = process.en
   const named = env["STELLA_MANAGED_SETTINGS"];
   if (named !== void 0 && named.length > 0) return named;
   const dir = platform === "darwin" ? "/Library/Application Support/stella" : "/etc/stella";
-  const toml = join14(dir, "stella.toml");
-  const json2 = join14(dir, "settings.json");
+  const toml = join13(dir, "stella.toml");
+  const json2 = join13(dir, "settings.json");
   return !existsSync5(toml) && existsSync5(json2) ? json2 : toml;
 }
 function managedShadow(harness, managedFile, expected) {
@@ -22281,12 +22201,12 @@ import {
   chmodSync as chmodSync4,
   existsSync as existsSync6,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync6,
+  mkdirSync as mkdirSync5,
   readFileSync as readFileSync8,
-  statSync as statSync4,
+  statSync as statSync3,
   unlinkSync as unlinkSync5
 } from "node:fs";
-import { basename as basename5, dirname as dirname7, join as join15 } from "node:path";
+import { basename as basename4, dirname as dirname7, join as join14 } from "node:path";
 function isTachoHelper(value) {
   return typeof value === "string" && HELPER_MARK.test(value);
 }
@@ -22294,16 +22214,16 @@ function helperCommandFor(tachoCommand) {
   return `${tachoCommand} credential issue --harness claude-code`;
 }
 function fileFor2(harness, homes) {
-  return harness === "claude-code" ? join15(
+  return harness === "claude-code" ? join14(
     homes.claudeConfigDir ?? harnessConfigDirs(homes.home).claudeConfigDir,
     "settings.json"
-  ) : join15(
+  ) : join14(
     homes.codexHome ?? harnessConfigDirs(homes.home).codexHome,
     "auth.json"
   );
 }
 function sidecarFor2(file) {
-  return join15(dirname7(file), `.${basename5(file)}.oxagen-model-credential.json`);
+  return join14(dirname7(file), `.${basename4(file)}.oxagen-model-credential.json`);
 }
 function modelCredentialBackupPath(harness, home, dirs = {}) {
   return sidecarFor2(fileFor2(harness, { ...dirs, home }));
@@ -22334,11 +22254,11 @@ function readSidecar2(path2) {
   }
 }
 function writeAtomicPreserving2(path2, data) {
-  mkdirSync6(dirname7(path2), { recursive: true });
+  mkdirSync5(dirname7(path2), { recursive: true });
   let mode = 384;
   let owner;
   try {
-    const stat6 = statSync4(path2);
+    const stat6 = statSync3(path2);
     mode = stat6.mode & 4095;
     owner = { uid: stat6.uid, gid: stat6.gid };
   } catch {
@@ -23309,7 +23229,7 @@ import {
   fsyncSync as fsyncSync2,
   openSync as openSync4,
   readFileSync as readFileSync9,
-  statSync as statSync5,
+  statSync as statSync4,
   unlinkSync as unlinkSync6,
   writeSync as writeSync3
 } from "node:fs";
@@ -23343,7 +23263,7 @@ function requireKey(path2) {
 function overwriteInPlace(path2) {
   let fd2;
   try {
-    const size = statSync5(path2).size;
+    const size = statSync4(path2).size;
     fd2 = openSync4(path2, "r+");
     writeSync3(fd2, randomBytes5(Math.max(size, KEY_BYTES2 * 2)), 0, void 0, 0);
     fsyncSync2(fd2);
@@ -23520,7 +23440,7 @@ var init_credential_store = __esm({
 });
 
 // ../../packages/tacho/src/host/claude-config-lock.ts
-import { mkdirSync as mkdirSync7, rmdirSync as rmdirSync4, statSync as statSync6 } from "node:fs";
+import { mkdirSync as mkdirSync6, rmdirSync as rmdirSync3, statSync as statSync5 } from "node:fs";
 function sleepSync(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
@@ -23537,7 +23457,7 @@ function withClaudeConfigLock(file, edit, options = {}) {
   let held = false;
   for (; ; ) {
     try {
-      mkdirSync7(lock);
+      mkdirSync6(lock);
       held = true;
       break;
     } catch (error) {
@@ -23547,15 +23467,15 @@ function withClaudeConfigLock(file, edit, options = {}) {
     }
     let modified;
     try {
-      modified = statSync6(lock).mtimeMs;
+      modified = statSync5(lock).mtimeMs;
     } catch {
       modified = void 0;
     }
     let retryNow = modified === void 0;
     if (modified !== void 0 && now() - modified > staleMs) {
       try {
-        if (statSync6(lock).mtimeMs === modified) {
-          rmdirSync4(lock);
+        if (statSync5(lock).mtimeMs === modified) {
+          rmdirSync3(lock);
           retryNow = true;
         }
       } catch {
@@ -23573,7 +23493,7 @@ function withClaudeConfigLock(file, edit, options = {}) {
   } finally {
     if (held) {
       try {
-        rmdirSync4(lock);
+        rmdirSync3(lock);
       } catch {
       }
     }
@@ -23591,12 +23511,12 @@ var init_claude_config_lock = __esm({
 });
 
 // ../../packages/tacho/src/host/service.ts
-import { join as join16 } from "node:path";
+import { join as join15 } from "node:path";
 import {
   existsSync as existsSync9,
   readdirSync as readdirSync6,
   readFileSync as readFileSync10,
-  rmdirSync as rmdirSync5,
+  rmdirSync as rmdirSync4,
   unlinkSync as unlinkSync7
 } from "node:fs";
 import { randomBytes as randomBytes6 } from "node:crypto";
@@ -23671,8 +23591,8 @@ function blockingSleep(ms) {
 }
 function launchdManager(options) {
   const sleep3 = options.sleep ?? blockingSleep;
-  const dir = join16(options.home, "Library", "LaunchAgents");
-  const unitPath = join16(dir, `${SERVICE_LABEL}.plist`);
+  const dir = join15(options.home, "Library", "LaunchAgents");
+  const unitPath = join15(dir, `${SERVICE_LABEL}.plist`);
   const domain = `gui/${options.uid ?? process.getuid?.() ?? 501}`;
   const target2 = `${domain}/${SERVICE_LABEL}`;
   const loaded = () => options.exec("launchctl", ["print", target2]).status === 0;
@@ -23777,9 +23697,9 @@ function stopByPidFile(options) {
     );
 }
 function systemdManager(options) {
-  const dir = join16(options.home, ".config", "systemd", "user");
-  const unitPath = join16(dir, "tachod.service");
-  const wants = join16(dir, "default.target.wants");
+  const dir = join15(options.home, ".config", "systemd", "user");
+  const unitPath = join15(dir, "tachod.service");
+  const wants = join15(dir, "default.target.wants");
   return {
     kind: "systemd",
     unitPath,
@@ -23858,7 +23778,7 @@ function systemdManager(options) {
       }
       if (unit4?.includes(CREATED_WANTS_MARK) === true) {
         try {
-          if (readdirSync6(wants).length === 0) rmdirSync5(wants);
+          if (readdirSync6(wants).length === 0) rmdirSync4(wants);
         } catch {
         }
       }
@@ -23926,8 +23846,8 @@ function windowsCreatedMs(exec4, pid) {
   return result2.status === 0 && /^\d+$/.test(text5) ? Number(text5) : void 0;
 }
 function schtasksManager(options) {
-  const launcher = options.launcherPath ?? join16(options.home, "tachod.cmd");
-  const pidPath = options.pidPath ?? join16(launcher, "..", "tachod.pid");
+  const launcher = options.launcherPath ?? join15(options.home, "tachod.cmd");
+  const pidPath = options.pidPath ?? join15(launcher, "..", "tachod.pid");
   const liveRecord = () => {
     if (!existsSync9(pidPath)) return void 0;
     const record = parseDaemonPid(readFileSync10(pidPath, "utf8"));
@@ -23972,7 +23892,7 @@ function schtasksManager(options) {
     unitPath: launcher,
     install: (spec) => {
       stopDaemon();
-      ensureDir(join16(launcher, ".."), 493);
+      ensureDir(join15(launcher, ".."), 493);
       writeSensitiveFileAtomic(
         launcher,
         renderWindowsLauncher(
@@ -24104,7 +24024,7 @@ import { readFileSync as readFileSync11 } from "node:fs";
 import { dirname as dirname9, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function readVersion() {
-  if (true) return "2.1.4-672";
+  if (true) return "2.1.4-684";
   try {
     const here = dirname9(fileURLToPath(import.meta.url));
     const pkg = JSON.parse(
@@ -25314,11 +25234,11 @@ import {
   existsSync as existsSync11,
   openSync as openSync5,
   readSync as readSync2,
-  statSync as statSync7,
+  statSync as statSync6,
   unlinkSync as unlinkSync8
 } from "node:fs";
 import { open as open2 } from "node:fs/promises";
-import { join as join17 } from "node:path";
+import { join as join16 } from "node:path";
 function parseStoredBody(text5) {
   let value;
   try {
@@ -25332,7 +25252,7 @@ function parseStoredBody(text5) {
     return void 0;
   return stored;
 }
-function readTailLine(path2, size = statSync7(path2).size, window2 = SCAN_CHUNK_BYTES) {
+function readTailLine(path2, size = statSync6(path2).size, window2 = SCAN_CHUNK_BYTES) {
   if (size === 0) return void 0;
   const fd2 = openSync5(path2, "r");
   try {
@@ -25516,7 +25436,7 @@ var init_wal_index = __esm({
       /** The scan `ensureAsync` has running for a session, shared by callers. */
       building = /* @__PURE__ */ new Map();
       sidecarFor(sessionUuid2) {
-        return join17(this.dir, `${sessionUuid2}${SIDECAR_SUFFIX}`);
+        return join16(this.dir, `${sessionUuid2}${SIDECAR_SUFFIX}`);
       }
       /** Whether a name in the WAL directory is one of these sidecars. */
       static isSidecar(name) {
@@ -25549,7 +25469,7 @@ var init_wal_index = __esm({
       }
       /** The index to extend, and the byte the scan starts from. */
       base(sessionUuid2, bodiesPath) {
-        const size = statSync7(bodiesPath).size;
+        const size = statSync6(bodiesPath).size;
         const held = this.cached.get(sessionUuid2) ?? this.load(sessionUuid2);
         if (held !== void 0 && held.covered <= size) return held;
         this.discard(sessionUuid2);
@@ -25623,7 +25543,7 @@ ${lines.join("\n")}
        * answers undefined.
        */
       covering(sessionUuid2, bodiesPath) {
-        const size = statSync7(bodiesPath).size;
+        const size = statSync6(bodiesPath).size;
         const held = this.cached.get(sessionUuid2) ?? this.load(sessionUuid2);
         if (held === void 0 || held.covered !== size) return void 0;
         this.remember(sessionUuid2, held);
@@ -25637,7 +25557,7 @@ ${lines.join("\n")}
        * file.
        */
       held(sessionUuid2, bodiesPath) {
-        const size = statSync7(bodiesPath).size;
+        const size = statSync6(bodiesPath).size;
         const held = this.cached.get(sessionUuid2) ?? this.load(sessionUuid2);
         if (held === void 0 || held.covered > size) return void 0;
         this.remember(sessionUuid2, held);
@@ -25646,7 +25566,7 @@ ${lines.join("\n")}
       /** The index of a body file, built or extended to cover the whole file. */
       ensure(sessionUuid2, bodiesPath, onInvalidRecord, onWriteFailure) {
         const index = this.base(sessionUuid2, bodiesPath);
-        const size = statSync7(bodiesPath).size;
+        const size = statSync6(bodiesPath).size;
         if (index.covered < size) {
           const result2 = {
             added: [],
@@ -25700,7 +25620,7 @@ ${lines.join("\n")}
         for (let attempt = 0; ; attempt += 1) {
           const generation = this.generationOf(sessionUuid2);
           const index = this.base(sessionUuid2, bodiesPath);
-          const size = statSync7(bodiesPath).size;
+          const size = statSync6(bodiesPath).size;
           if (index.covered >= size) {
             this.remember(sessionUuid2, index);
             return index;
@@ -25739,19 +25659,19 @@ import {
   readdirSync as readdirSync7,
   readSync as readSync3,
   truncateSync,
-  renameSync as renameSync4,
-  statSync as statSync8,
+  renameSync as renameSync3,
+  statSync as statSync7,
   unlinkSync as unlinkSync9,
   writeSync as writeSync4
 } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { join as join18 } from "node:path";
+import { join as join17 } from "node:path";
 function activityAt(event) {
   const at = Date.parse(event.ts);
   return Number.isFinite(at) ? at : Number.NEGATIVE_INFINITY;
 }
 function sizeOf(path2) {
-  return statSync8(path2, { throwIfNoEntry: false })?.size ?? 0;
+  return statSync7(path2, { throwIfNoEntry: false })?.size ?? 0;
 }
 var BODY_READ_SLICE, BODY_DROP_SLICE_BYTES, BODY_DROP_SCANS, NEWLINE, EVENT_TAIL_WINDOW, WalRecoveryConflict, Wal;
 var init_wal = __esm({
@@ -25783,7 +25703,7 @@ var init_wal = __esm({
         this.dir = dir;
         ensureDir(dir);
         this.bodyIndexes = new BodyIndexStore(dir);
-        this.cursorPath = join18(dir, "cursor.json");
+        this.cursorPath = join17(dir, "cursor.json");
         let raw;
         if (onCursorSetAside !== void 0)
           raw = readJsonStateFile(this.cursorPath, onCursorSetAside);
@@ -25862,10 +25782,10 @@ var init_wal = __esm({
        */
       dirtyPaths = /* @__PURE__ */ new Set();
       fileFor(sessionUuid2) {
-        return join18(this.dir, `${sessionUuid2}.ndjson`);
+        return join17(this.dir, `${sessionUuid2}.ndjson`);
       }
       bodyFileFor(sessionUuid2) {
-        return join18(this.dir, `${sessionUuid2}.bodies.jsonl`);
+        return join17(this.dir, `${sessionUuid2}.bodies.jsonl`);
       }
       persistCursor() {
         this.flush();
@@ -26111,7 +26031,7 @@ ${lines.join("\n")}
         for (const session of sessions) {
           if (sizes.has(session)) continue;
           const path2 = pathOf2(session);
-          sizes.set(session, existsSync12(path2) ? statSync8(path2).size : void 0);
+          sizes.set(session, existsSync12(path2) ? statSync7(path2).size : void 0);
         }
         return sizes;
       }
@@ -26127,7 +26047,7 @@ ${lines.join("\n")}
           try {
             if (!existsSync12(path2)) continue;
             if (size === void 0) unlinkSync9(path2);
-            else if (statSync8(path2).size !== size) truncateSync(path2, size);
+            else if (statSync7(path2).size !== size) truncateSync(path2, size);
           } catch (error) {
             onFailure(session, error);
           }
@@ -26810,7 +26730,7 @@ ${lines.join("\n")}
         const lastSeq = this.lastWrittenSeq(sessionUuid2);
         if (lastSeq === void 0) return 0;
         const path2 = this.bodyFileFor(sessionUuid2);
-        const size = statSync8(path2).size;
+        const size = statSync7(path2).size;
         let keep = size;
         let cut2 = 0;
         while (keep > 0) {
@@ -26843,7 +26763,7 @@ ${lines.join("\n")}
        */
       lastWrittenSeq(sessionUuid2) {
         const path2 = this.fileFor(sessionUuid2);
-        if (!existsSync12(path2) || statSync8(path2).size === 0) return -1;
+        if (!existsSync12(path2) || statSync7(path2).size === 0) return -1;
         return this.lastEvent(sessionUuid2)?.seq;
       }
       /**
@@ -26874,7 +26794,7 @@ ${lines.join("\n")}
       *eventsBackward(sessionUuid2) {
         const path2 = this.fileFor(sessionUuid2);
         if (!existsSync12(path2)) return;
-        let end = statSync8(path2).size;
+        let end = statSync7(path2).size;
         while (end > 0) {
           const line = readTailLine(path2, end, EVENT_TAIL_WINDOW);
           if (line === void 0) return;
@@ -26905,7 +26825,7 @@ ${lines.join("\n")}
         this.unverifiedResume.delete(sessionUuid2);
         let holds2 = false;
         try {
-          if (mark.offset <= statSync8(path2).size) {
+          if (mark.offset <= statSync7(path2).size) {
             const line = readTailLine(path2, mark.offset, EVENT_TAIL_WINDOW);
             holds2 = line !== void 0 && line.terminated && line.end === mark.offset && JSON.parse(line.text).seq === mark.afterSeq;
           }
@@ -27258,7 +27178,7 @@ ${lines.join("\n")}
           }
           if (cut2 === 0) return 0;
           if (kept === 0) unlinkSync9(path2);
-          else renameSync4(tmp, path2);
+          else renameSync3(tmp, path2);
           this.bodyIndexes.invalidate(sessionUuid2);
           return cut2;
         } finally {
@@ -27289,7 +27209,7 @@ ${lines.join("\n")}
         for (const name of readdirSync7(this.dir)) {
           if (abandonedRewrite.test(name)) {
             try {
-              unlinkSync9(join18(this.dir, name));
+              unlinkSync9(join17(this.dir, name));
             } catch (error) {
               this.bodyFailure(name.slice(0, 36), "cleanup", error);
             }
@@ -27301,7 +27221,7 @@ ${lines.join("\n")}
           if (sealedAt === void 0) continue;
           const path2 = this.fileFor(session);
           try {
-            const age = now - Math.max(Date.parse(sealedAt), statSync8(path2).mtimeMs);
+            const age = now - Math.max(Date.parse(sealedAt), statSync7(path2).mtimeMs);
             if (age < retainMs) continue;
             const last = this.lastSeqOf(session);
             if (last < 0 || last > this.shippedThrough(session)) continue;
@@ -27323,7 +27243,7 @@ ${lines.join("\n")}
           if (removed.includes(session) || existsSync12(this.fileFor(session)))
             continue;
           try {
-            if (now - statSync8(this.bodyFileFor(session)).mtimeMs < retainMs)
+            if (now - statSync7(this.bodyFileFor(session)).mtimeMs < retainMs)
               continue;
           } catch (error) {
             this.bodyFailure(session, "cleanup", error);
@@ -27679,7 +27599,7 @@ var init_policy_mode = __esm({
 
 // ../../packages/tacho/src/host/wal-ceiling.ts
 import { statfsSync } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join18 } from "node:path";
 function freeBytesOn(dir) {
   try {
     const stats2 = statfsSync(dir);
@@ -27726,7 +27646,7 @@ function isDrop(value) {
 function readWalCeilingState(walDir) {
   let raw;
   try {
-    raw = readJsonFileIfExists(join19(walDir, STATE_FILE));
+    raw = readJsonFileIfExists(join18(walDir, STATE_FILE));
   } catch {
     return void 0;
   }
@@ -27927,7 +27847,7 @@ var init_wal_ceiling = __esm({
         if (!changed) return;
         try {
           writeSensitiveFileAtomic(
-            join19(this.walDir, STATE_FILE),
+            join18(this.walDir, STATE_FILE),
             JSON.stringify(next)
           );
           this.unsaved = false;
@@ -28410,11 +28330,11 @@ import {
   existsSync as existsSync15,
   lstatSync as lstatSync3,
   readdirSync as readdirSync8,
-  rmdirSync as rmdirSync6,
+  rmdirSync as rmdirSync5,
   rmSync as rmSync2,
   unlinkSync as unlinkSync10
 } from "node:fs";
-import { dirname as dirname12, join as join20 } from "node:path";
+import { dirname as dirname12, join as join19 } from "node:path";
 async function revokeOnControlPlane(host, options, deps, warnings) {
   const resolved = resolveCredentials(
     {
@@ -28729,7 +28649,7 @@ async function unenroll(options, deps) {
     }
     for (const agent of target2) {
       if (many) deps.out(`Unenrolling ${describeAgent(agent)}`);
-      if (!agent.legacy) dirs.push(agent.paths.dir);
+      dirs.push(agent.paths.dir);
       results.push(await unenrollLocked(options, depsForAgent(deps, agent)));
     }
     const result2 = combined(results);
@@ -28795,7 +28715,7 @@ function restartForRemaining(installed, deps) {
 }
 function removeIfEmpty(dir) {
   try {
-    if (readdirSync8(dir).length === 0) rmdirSync6(dir);
+    if (readdirSync8(dir).length === 0) rmdirSync5(dir);
   } catch {
   }
 }
@@ -28997,8 +28917,8 @@ async function unenrollLocked(options, deps) {
       rmSync2(dir, { recursive: true, force: true });
     }
     rmSync2(deps.paths.pendingEnds, { force: true });
-    if (!existsSync15(join20(deps.paths.dir, HARNESS_RECEIPTS)))
-      rmSync2(join20(deps.paths.dir, HARNESS_BACKUPS), {
+    if (!existsSync15(join19(deps.paths.dir, HARNESS_RECEIPTS)))
+      rmSync2(join19(deps.paths.dir, HARNESS_BACKUPS), {
         recursive: true,
         force: true
       });
@@ -29054,7 +28974,7 @@ var init_unenroll = __esm({
 
 // ../../packages/tacho/src/cli/enroll.ts
 import { existsSync as existsSync16, lstatSync as lstatSync4, rmSync as rmSync3 } from "node:fs";
-import { dirname as dirname13, isAbsolute, join as join21 } from "node:path";
+import { dirname as dirname13, isAbsolute, join as join20 } from "node:path";
 function rootRefusal(command2, deps, allowRoot) {
   if (allowRoot === true || deps.getuid?.() !== 0) return void 0;
   const user = deps.env["SUDO_USER"] ?? "<user>";
@@ -29080,7 +29000,7 @@ function runtimeOf(host) {
   if (first === void 0 || !files3.every((file) => existsSync16(file)))
     return void 0;
   const binDir = dirname13(first);
-  const tacho = host.daemon_command[0] === first ? shellQuote(first) : `${host.daemon_command[0]} ${shellQuote(join21(binDir, "tacho.mjs"))}`;
+  const tacho = host.daemon_command[0] === first ? shellQuote(first) : `${host.daemon_command[0]} ${shellQuote(join20(binDir, "tacho.mjs"))}`;
   return {
     hookCommand: host.hook_command,
     credentialHelperCommand: helperCommandFor(tacho),
@@ -29302,7 +29222,7 @@ function enrollTarget(options, paths, mint) {
   const [only] = held;
   if (only !== void 0) return { paths: only.paths, fresh: false };
   const retired = listAgents(paths).filter(
-    (agent) => !agent.legacy && !agentIsLive(agent) && harnesses.some((harness) => agent.host?.harnesses.includes(harness))
+    (agent) => !agentIsLive(agent) && harnesses.some((harness) => agent.host?.harnesses.includes(harness))
   ).at(-1);
   if (retired !== void 0) return { paths: retired.paths, fresh: false };
   if (!existsSync16(paths.hostFile))
@@ -31241,26 +31161,26 @@ import {
   readFileSync as readFileSync14,
   readlinkSync as readlinkSync3,
   realpathSync as realpathSync2,
-  rmdirSync as rmdirSync7,
+  rmdirSync as rmdirSync6,
   rmSync as rmSync4,
-  statSync as statSync9,
+  statSync as statSync8,
   unlinkSync as unlinkSync11
 } from "node:fs";
-import { dirname as dirname14, isAbsolute as isAbsolute2, join as join22, relative, resolve as resolve7, sep } from "node:path";
+import { dirname as dirname14, isAbsolute as isAbsolute2, join as join21, relative, resolve as resolve7, sep } from "node:path";
 function dataLocalDir(home, env, platform) {
   if (platform === "darwin")
-    return join22(home, "Library", "Application Support");
+    return join21(home, "Library", "Application Support");
   if (platform === "win32")
-    return env["LOCALAPPDATA"] ?? join22(home, "AppData", "Local");
+    return env["LOCALAPPDATA"] ?? join21(home, "AppData", "Local");
   const xdg = env["XDG_DATA_HOME"];
-  return xdg !== void 0 && isAbsolute2(xdg) ? xdg : join22(home, ".local", "share");
+  return xdg !== void 0 && isAbsolute2(xdg) ? xdg : join21(home, ".local", "share");
 }
 function desktopPlaces(deps) {
-  const oxagenDir = join22(deps.home, ".config", "oxagen");
+  const oxagenDir = join21(deps.home, ".config", "oxagen");
   return {
     oxagenDir,
-    desktopConfig: join22(oxagenDir, "desktop.json"),
-    copies: join22(
+    desktopConfig: join21(oxagenDir, "desktop.json"),
+    copies: join21(
       dataLocalDir(deps.home, deps.env, deps.platform),
       "oxagen",
       "bin"
@@ -31400,7 +31320,7 @@ function removeFile(path2, tally2, note = "") {
 function removeDirIfEmpty(dir) {
   try {
     if (readdirSync9(dir).length > 0) return false;
-    rmdirSync7(dir);
+    rmdirSync6(dir);
     return true;
   } catch {
     return false;
@@ -31421,7 +31341,7 @@ function removeProfileBlock(path2, tally2) {
   if (updated === text5) return;
   try {
     const real = realpathSync2(path2);
-    writeFileAtomic(real, updated, { mode: statSync9(real).mode & 4095 });
+    writeFileAtomic(real, updated, { mode: statSync8(real).mode & 4095 });
     tally2.removed.push(`the Oxagen PATH lines in ${path2}`);
   } catch (error) {
     tally2.left.push(`cannot rewrite ${path2}: ${reasonOf3(error)}`);
@@ -31506,7 +31426,7 @@ function undoEntry(entry2, deps, tally2) {
 }
 function versionDirs(copies) {
   try {
-    return readdirSync9(copies, { withFileTypes: true }).filter((entry2) => entry2.isDirectory() && !entry2.name.startsWith(".")).map((entry2) => join22(copies, entry2.name)).sort();
+    return readdirSync9(copies, { withFileTypes: true }).filter((entry2) => entry2.isDirectory() && !entry2.name.startsWith(".")).map((entry2) => join21(copies, entry2.name)).sort();
   } catch {
     return [];
   }
@@ -31542,7 +31462,7 @@ function journaledCopies(journal, copies, tally2) {
 function removeSidecars(dir, platform, tally2) {
   const note = platform === "win32" ? `. Windows keeps a running program's file, so delete ${dir} after this command exits` : "";
   for (const name of ["oxagen", "tacho"]) {
-    const file = join22(dir, platform === "win32" ? `${name}.exe` : name);
+    const file = join21(dir, platform === "win32" ? `${name}.exe` : name);
     removeFile(file, tally2, note);
   }
 }
@@ -31630,7 +31550,7 @@ async function uninstall(options, deps) {
       tally2.left.push(`cannot remove ${dir}: ${reasonOf3(error)}`);
     }
   }
-  const configDir = join22(deps.home, ".config");
+  const configDir = join21(deps.home, ".config");
   if (record.configDirCreated && removeDirIfEmpty(configDir))
     tally2.removed.push(configDir);
   for (const path2 of tally2.removed) deps.out(`      removed ${path2}`);
@@ -32180,109 +32100,13 @@ var init_agent_run = __esm({
   }
 });
 
-// ../../packages/tacho/src/cli/move-commands.ts
-import { posix as posix4, win32 as win325 } from "node:path";
-function executableName(word) {
-  const base2 = (/^[A-Za-z]:\\|\\/.test(word) ? win325 : posix4).basename(word);
-  return base2.replace(/\.exe$/i, "").toLowerCase();
-}
-function namesTachoExecutable(host) {
-  const legacyHook = /(?:^|[\s'"/\\])tacho-hook(?:\.mjs)?(?=$|[\s'"])/i.test(
-    host.hook_command
-  ) || /(?:^|[\s'"/\\])tacho(?:-[a-z0-9_]+(?:-[a-z0-9_]+){2,3})?(?:\.exe)?['"]?\s+hook(?=$|\s)/i.test(
-    host.hook_command
-  );
-  const legacyDaemon = host.daemon_command.some((word, index) => {
-    const name = executableName(word);
-    if (name === "tachod" || name === "tachod.mjs") return true;
-    return TACHO_NAME.test(name) && host.daemon_command[index + 1] === "daemon";
-  });
-  return legacyHook || legacyDaemon;
-}
-function relocatedHarnessFiles(host, paths) {
-  const recorded = host.harness_files ?? {};
-  const named = (value) => {
-    const files3 = [value].flat().filter((path2) => typeof path2 === "string");
-    return files3.length > 0 ? files3.join(", ") : "(none)";
-  };
-  return Object.entries(harnessFilesRecord(paths)).flatMap(([key, here]) => {
-    const then = recorded[key];
-    return then === void 0 || JSON.stringify(then) === JSON.stringify(here) ? [] : [{ recorded: named(then), here: named(here) }];
-  });
-}
-async function currentCredentialMode(host, deps) {
-  if (deps.modelCredentials === void 0) return void 0;
-  const harnesses = host.harnesses.filter(
-    (harness) => MODEL_CREDENTIAL_HARNESSES.includes(harness)
-  );
-  if (harnesses.length === 0) return void 0;
-  const state = await deps.modelCredentials.read({
-    home: deps.home,
-    harnesses,
-    helperCommand: deps.runtime.credentialHelperCommand
-  });
-  return state.harnesses.some((entry2) => entry2.brokered) ? "brokered" : "passthrough";
-}
-async function moveOffTachoNames(deps, run3 = enroll) {
-  const runtime = deps.runtime;
-  if (runtime.program !== "oxagen" || runtime.transient !== void 0 || runtime.executableProblem !== void 0)
-    return [];
-  const moved = [];
-  for (const agent of listAgents(deps.paths)) {
-    if (!agentIsLive(agent) || !namesTachoExecutable(agent.host)) continue;
-    const host = agent.host;
-    const relocated = relocatedHarnessFiles(host, agent.paths);
-    if (relocated.length > 0) {
-      deps.err(
-        `${host.agent_key} was enrolled with its harness files at ${relocated.map((file) => file.recorded).join(", ")}, and this command finds them at ${relocated.map((file) => file.here).join(", ")}, so its hooks stay where they are. Run \`oxagen agent enroll\` from a shell that sets the harness homes it was enrolled with, such as CLAUDE_CONFIG_DIR.`
-      );
-      moved.push({
-        agentKey: host.agent_key,
-        from: host.hook_command,
-        ok: false,
-        skipped: "harness_files_elsewhere"
-      });
-      continue;
-    }
-    const own = depsForAgent(deps, agent);
-    const credentials2 = await currentCredentialMode(host, own);
-    const serviceInstalled2 = deps.serviceManager.status().installed;
-    const result2 = await run3(
-      {
-        harnesses: host.harnesses,
-        ...credentials2 !== void 0 ? { credentials: credentials2 } : {},
-        ...serviceInstalled2 ? {} : { service: false }
-      },
-      own
-    );
-    moved.push({
-      agentKey: host.agent_key,
-      from: host.hook_command,
-      ok: result2.ok
-    });
-  }
-  return moved;
-}
-var TACHO_NAME;
-var init_move_commands = __esm({
-  "../../packages/tacho/src/cli/move-commands.ts"() {
-    "use strict";
-    init_agents();
-    init_host_file();
-    init_agent_deps();
-    init_credential();
-    init_enroll();
-    TACHO_NAME = /^tacho(?:-[a-z0-9_]+(?:-[a-z0-9_]+){2,3})?$/;
-  }
-});
-
 // ../../packages/tacho/src/host/work-orders.ts
 import { readdirSync as readdirSync10, rmSync as rmSync5 } from "node:fs";
-import { join as join23 } from "node:path";
+import { join as join22 } from "node:path";
 function orderFile(paths, id2) {
   if (!WORK_ORDER_ID_PATTERN.test(id2))
     throw new Error(`${JSON.stringify(id2)} is not a work order id`);
-  return join23(paths.workOrders, `${id2}.json`);
+  return join22(paths.workOrders, `${id2}.json`);
 }
 function readWorkOrder(paths, id2) {
   let raw;
@@ -32327,7 +32151,7 @@ function removeWorkOrder(paths, id2) {
 function runningFile(paths, id2) {
   if (!WORK_ORDER_ID_PATTERN.test(id2))
     throw new Error(`${JSON.stringify(id2)} is not a work order id`);
-  return join23(paths.workOrders, `${id2}.running`);
+  return join22(paths.workOrders, `${id2}.running`);
 }
 function processIsAlive(pid) {
   try {
@@ -32751,8 +32575,6 @@ __export(cli_exports, {
   harnessFileProblems: () => harnessFileProblems,
   isCredentialHarness: () => isCredentialHarness,
   isNativeBuild: () => isNativeBuild,
-  moveOffTachoNames: () => moveOffTachoNames,
-  namesTachoExecutable: () => namesTachoExecutable,
   needsClaudeCodeMcp: () => needsClaudeCodeMcp,
   observedTiers: () => observedTiers,
   oxagenRuntimeCommands: () => oxagenRuntimeCommands,
@@ -32820,7 +32642,6 @@ var init_cli = __esm({
     init_verify();
     init_run();
     init_agent_run();
-    init_move_commands();
     init_work();
   }
 });
@@ -36612,7 +36433,7 @@ var init_bridge = __esm({
 
 // ../../packages/tacho/src/contained/workspace.ts
 import { lstatSync as lstatSync6, readFileSync as readFileSync15, readdirSync as readdirSync11, realpathSync as realpathSync3 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join24, relative as relative2, resolve as resolve9, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join23, relative as relative2, resolve as resolve9, sep as sep2 } from "node:path";
 function within(root, path2) {
   const rel = relative2(root, path2);
   return rel === "" || !isAbsolute3(rel) && rel !== ".." && !rel.startsWith(`..${sep2}`);
@@ -36643,7 +36464,7 @@ function validateContainedWorkspace(workspace, sessionDirectory, mountInfo = rea
         throw new Error(
           "Remove local credential files from the contained checkout before launch"
         );
-      const path2 = join24(directory, entry2);
+      const path2 = join23(directory, entry2);
       const stat6 = lstatSync6(path2);
       if (stat6.isSymbolicLink()) {
         let target2;
@@ -36797,7 +36618,7 @@ import {
   writeFileSync as writeFileSync2
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute4, join as join25 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join24 } from "node:path";
 import { promisify } from "node:util";
 async function launchContainedAgent(options) {
   validateContainedArguments(options.request.harness, options.request.args);
@@ -36830,7 +36651,7 @@ async function launchContainedAgent(options) {
   if (digest7 === void 0)
     throw new Error("The operator's contained image is not installed");
   const sessionId = `contained-${randomBytes8(16).toString("hex")}`;
-  const directory = mkdtempSync(join25(tmpdir(), "oxagen-contained-"));
+  const directory = mkdtempSync(join24(tmpdir(), "oxagen-contained-"));
   chmodSync6(directory, 448);
   let prepared;
   let containerCreated = false;
@@ -36850,7 +36671,7 @@ async function launchContainedAgent(options) {
     for (const [name2, contents] of entries2) {
       if (!/^[a-z0-9.-]+$/.test(name2))
         throw new Error("Invalid contained configuration filename");
-      writeFileSync2(join25(directory, name2), contents, {
+      writeFileSync2(join24(directory, name2), contents, {
         mode: 256,
         flag: "wx"
       });
@@ -37238,7 +37059,7 @@ var init_privilege = __esm({
 
 // ../../packages/tacho/src/contained/sandbox/launcher.ts
 import { randomBytes as randomBytes9 } from "node:crypto";
-import { join as join26 } from "node:path";
+import { join as join25 } from "node:path";
 function shellQuote2(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -37328,7 +37149,7 @@ async function launchSandboxAgent(options) {
       { ...asAgent, cwd: SANDBOX_AGENT_HOME, timeoutMs: 15 * 6e4 }
     );
     for (const [name, contents] of Object.entries(claudeCodeUserState())) {
-      const path2 = join26(SANDBOX_AGENT_HOME, name);
+      const path2 = join25(SANDBOX_AGENT_HOME, name);
       system.writeFile(path2, contents, 384);
       system.chown(path2, SANDBOX_AGENT_UID, SANDBOX_AGENT_GID);
     }
@@ -37457,9 +37278,9 @@ import {
   chmodSync as chmodSync7,
   chownSync as chownSync2,
   existsSync as existsSync17,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync7,
   readFileSync as readFileSync16,
-  statSync as statSync10,
+  statSync as statSync9,
   writeFileSync as writeFileSync3
 } from "node:fs";
 import { promisify as promisify2 } from "node:util";
@@ -37507,7 +37328,7 @@ var init_system = __esm({
       exists: (path2) => existsSync17(path2),
       stat: (path2) => {
         try {
-          const found = statSync10(path2);
+          const found = statSync9(path2);
           return {
             uid: found.uid,
             gid: found.gid,
@@ -37525,7 +37346,7 @@ var init_system = __esm({
         chmodSync7(path2, mode);
       },
       mkdir: (path2, mode) => {
-        mkdirSync8(path2, { recursive: true, mode });
+        mkdirSync7(path2, { recursive: true, mode });
         chmodSync7(path2, mode);
       },
       chown: (path2, uid, gid) => chownSync2(path2, uid, gid)
@@ -37534,10 +37355,10 @@ var init_system = __esm({
 });
 
 // ../../packages/tacho/src/contained/runner.ts
-import { join as join27 } from "node:path";
+import { join as join26 } from "node:path";
 function containedHookEnv(harness, workspace) {
-  const home = join27(workspace, ".oxagen-contained", "home");
-  return harness === "codex" ? { CODEX_HOME: join27(home, ".codex") } : { CLAUDE_CONFIG_DIR: join27(home, ".claude") };
+  const home = join26(workspace, ".oxagen-contained", "home");
+  return harness === "codex" ? { CODEX_HOME: join26(home, ".codex") } : { CLAUDE_CONFIG_DIR: join26(home, ".claude") };
 }
 function containedLaunchEndpoint(host) {
   const ingest = new URL(host.endpoints.ingest);
@@ -37733,7 +37554,7 @@ function createContainedRunner(options) {
             sessionUuid2 = started.recorder.sessionUuid;
             active2.set(sessionUuid2, controller);
             const bridge = await startContainedBridge({
-              socketPath: join27(directory, "bridge.sock"),
+              socketPath: join26(directory, "bridge.sock"),
               ...bridgeRoutes({
                 sessionId,
                 workspace,
@@ -37817,7 +37638,7 @@ function createContainedRunner(options) {
       const abort = () => controller.abort();
       signal?.addEventListener("abort", abort, { once: true });
       if (signal?.aborted) abort();
-      const env = { CLAUDE_CONFIG_DIR: join27(SANDBOX_AGENT_HOME, ".claude") };
+      const env = { CLAUDE_CONFIG_DIR: join26(SANDBOX_AGENT_HOME, ".claude") };
       let sessionUuid2;
       let launchedSessionId;
       let opened = false;
@@ -37952,7 +37773,7 @@ var init_runner = __esm({
 
 // ../../packages/tacho/src/collector/detector.ts
 import { promises as fs3 } from "node:fs";
-import { basename as basename6, join as join28 } from "node:path";
+import { basename as basename5, join as join27 } from "node:path";
 async function eachLimited(items, limit, task) {
   let next = 0;
   const workers = Array.from(
@@ -37978,7 +37799,7 @@ async function scanProject(dir) {
   await eachLimited(names2, SCAN_CONCURRENCY, async (name) => {
     const match = SESSION_FILE.exec(name);
     if (match === null) return;
-    const path2 = join28(dir, name);
+    const path2 = join27(dir, name);
     try {
       const st = await fs3.stat(path2);
       out.push({ sessionId: match[1], path: path2, mtimeMs: st.mtimeMs });
@@ -38019,7 +37840,7 @@ var init_detector = __esm({
             continue;
           }
           await eachLimited(names2, SCAN_CONCURRENCY, async (name) => {
-            const dir = join28(root, name);
+            const dir = join27(root, name);
             try {
               const st = await fs3.stat(dir);
               if (st.isDirectory()) dirs.push({ dir, mtimeMs: st.mtimeMs });
@@ -38258,7 +38079,7 @@ var init_detector = __esm({
                 transcript_path: transcript.path,
                 transcript_mtime: new Date(transcript.mtimeMs).toISOString(),
                 claude_pids: processes.map((p) => p.pid),
-                project: basename6(join28(transcript.path, ".."))
+                project: basename5(join27(transcript.path, ".."))
               }
             })
           );
@@ -38676,7 +38497,7 @@ import {
   rm,
   unlink
 } from "node:fs/promises";
-import { dirname as dirname16, join as join29 } from "node:path";
+import { dirname as dirname16, join as join28 } from "node:path";
 async function statOf(absolutePath) {
   try {
     const info = await lstat(absolutePath);
@@ -38716,7 +38537,7 @@ async function contentHash(absolutePath, kind, keep) {
   if (keep !== void 0) {
     try {
       await mkdir(keep.dir, { recursive: true, mode: 448 });
-      const temp2 = join29(keep.dir, `.partial-${randomUUID3()}`);
+      const temp2 = join28(keep.dir, `.partial-${randomUUID3()}`);
       copy = {
         temp: temp2,
         handle: await open3(temp2, "wx", keep.executable ? 448 : 384)
@@ -38760,7 +38581,7 @@ async function settleCopy(temp, name) {
   if (temp === void 0) return;
   if (name !== void 0)
     try {
-      await rename(temp, join29(dirname16(temp), name));
+      await rename(temp, join28(dirname16(temp), name));
       return;
     } catch {
     }
@@ -38776,7 +38597,7 @@ async function copiedBytes(dir) {
   let total2 = 0;
   for (const name of names2) {
     try {
-      total2 += (await lstat(join29(dir, name))).size;
+      total2 += (await lstat(join28(dir, name))).size;
     } catch {
     }
   }
@@ -38792,7 +38613,7 @@ async function removeCopiesOutside(root, live) {
   const keep = new Set(live());
   await Promise.all(
     names2.filter((name) => !keep.has(name)).map(
-      (name) => rm(join29(root, name), { recursive: true, force: true }).catch(
+      (name) => rm(join28(root, name), { recursive: true, force: true }).catch(
         () => void 0
       )
     )
@@ -38900,7 +38721,7 @@ async function contributionOf(exec4, cwd, root, repoRelative, entry2, copies) {
   let copy = null;
   if (entry2 !== null) {
     if (copies === void 0 || !COPY_NAME.test(entry2[0])) return void 0;
-    copy = join29(copies, entry2[0]);
+    copy = join28(copies, entry2[0]);
     const kept = await statOf(copy);
     if (kept === void 0 || kept === "absent" || kept.kind !== "file")
       return void 0;
@@ -39298,7 +39119,7 @@ var init_session_changes = __esm({
 });
 
 // ../../packages/tacho/src/collector/session-commits.ts
-import { join as join30 } from "node:path";
+import { join as join29 } from "node:path";
 function parseMeta(stdout) {
   const out = [];
   for (const record of stdout.split("\0")) {
@@ -39435,7 +39256,7 @@ async function readSessionCommits(exec4, cwd, input) {
     const test = input.tests[commit.sha];
     const toolUseId = callAt(times.get(commit.sha), calls);
     const written = input.written;
-    const outside = merge || written === void 0 || root === void 0 ? void 0 : files3.some((file) => !written.has(join30(root, file.path)));
+    const outside = merge || written === void 0 || root === void 0 ? void 0 : files3.some((file) => !written.has(join29(root, file.path)));
     return {
       sha: commit.sha,
       parent_shas: commit.parents.slice(0, MAX_COMMIT_PARENTS),
@@ -39481,7 +39302,7 @@ var init_session_commits = __esm({
 
 // ../../packages/tacho/src/collector/worktree-snapshot.ts
 import { lstat as lstat2 } from "node:fs/promises";
-import { join as join31 } from "node:path";
+import { join as join30 } from "node:path";
 function headerPath(prefix, path2) {
   const name = `${prefix}${path2}`;
   let quoted3 = false;
@@ -39556,7 +39377,7 @@ async function worktreeFingerprint(status2, root) {
       const path2 = statusPath(record);
       if (path2 === null) return "";
       try {
-        const info = await lstat2(join31(root, path2));
+        const info = await lstat2(join30(root, path2));
         return `${info.size}:${info.mtimeMs}:${info.ctimeMs}`;
       } catch {
         return "absent";
@@ -39662,7 +39483,7 @@ async function readWorktreeSnapshot(exec4, cwd, baseline, measured) {
       }
       let present;
       try {
-        present = (await lstat2(join31(root, path2))).isFile();
+        present = (await lstat2(join30(root, path2))).isFile();
       } catch {
         present = false;
       }
@@ -39763,10 +39584,10 @@ var init_worktree_snapshot = __esm({
 });
 
 // ../../packages/tacho/src/collector/git-lane.ts
-import { join as join32 } from "node:path";
+import { join as join31 } from "node:path";
 function copiesDirOf(root, session) {
   const uuid = session.recorder.sessionUuid;
-  return /^[0-9a-f-]{36}$/i.test(uuid) ? join32(root, uuid) : void 0;
+  return /^[0-9a-f-]{36}$/i.test(uuid) ? join31(root, uuid) : void 0;
 }
 function holdsBaseline(session) {
   return session.baselineCommit !== void 0 || Object.keys(session.baselines ?? {}).length > 0;
@@ -42758,7 +42579,7 @@ var init_hook_queues = __esm({
 });
 
 // ../../packages/tacho/src/collector/memory-capture/memory-reader.ts
-import { isAbsolute as isAbsolute7, join as join33, sep as sep4 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join32, sep as sep4 } from "node:path";
 function claudeCodeLocation(projectsDir, memoryDir) {
   return {
     harness: "claude-code",
@@ -42770,13 +42591,13 @@ function claudeCodeLocation(projectsDir, memoryDir) {
 }
 function claudeCodeMemoryLocations(configDir, projectDirs = []) {
   const locations = [
-    claudeCodeLocation(() => join33(configDir, "projects"), "memory"),
-    claudeCodeLocation(() => join33(configDir, "agent-memory"), "")
+    claudeCodeLocation(() => join32(configDir, "projects"), "memory"),
+    claudeCodeLocation(() => join32(configDir, "agent-memory"), "")
   ];
   for (const dir of projectDirs.slice(0, MEMORY_PROJECT_DIRS_MAX))
     locations.push(
-      claudeCodeLocation(() => join33(dir, ".claude", "agent-memory"), ""),
-      claudeCodeLocation(() => join33(dir, ".claude", "agent-memory-local"), "")
+      claudeCodeLocation(() => join32(dir, ".claude", "agent-memory"), ""),
+      claudeCodeLocation(() => join32(dir, ".claude", "agent-memory-local"), "")
     );
   return locations;
 }
@@ -42955,13 +42776,13 @@ function createMemoryReader(deps) {
       const projects = await list(top);
       let complete = projects.complete;
       for (const project2 of projects.names) {
-        const dir = location.memoryDir === "" ? join33(top, project2) : join33(top, project2, location.memoryDir);
+        const dir = location.memoryDir === "" ? join32(top, project2) : join32(top, project2, location.memoryDir);
         const files3 = await list(dir);
         if (!files3.complete) complete = false;
         for (const name of files3.names) {
           if (!name.endsWith(location.extension)) continue;
           if (location.skip.includes(name)) continue;
-          const path2 = join33(dir, name);
+          const path2 = join32(dir, name);
           const file = await readAt2(location.harness, path2);
           if (file.kind === "absent" || file.kind === "empty") continue;
           paths.push(path2);
@@ -43047,8 +42868,8 @@ var init_memory_reader = __esm({
     MEMORY_TYPE_PATTERN = /^[a-z][a-z0-9_-]{0,31}$/;
     MEMORY_PROJECT_DIRS_MAX = 200;
     HARNESS_MEMORY_LOCATIONS = [
-      claudeCodeLocation((home) => join33(home, ".claude", "projects"), "memory"),
-      claudeCodeLocation((home) => join33(home, ".claude", "agent-memory"), "")
+      claudeCodeLocation((home) => join32(home, ".claude", "projects"), "memory"),
+      claudeCodeLocation((home) => join32(home, ".claude", "agent-memory"), "")
     ];
     FRONTMATTER = /^---[ \t]*\r?\n(?:([\s\S]*?)\r?\n)?---[ \t]*(?:\r?\n|$)/;
     FRONTMATTER_LINE = /^([ \t]*)([A-Za-z_][\w-]*)[ \t]*:[ \t]*(.*)$/;
@@ -43534,17 +43355,17 @@ var init_memory_upload = __esm({
 });
 
 // ../../packages/tacho/src/collector/memory-capture/memory-uses.ts
-import { basename as basename7, dirname as dirname18, isAbsolute as isAbsolute8, join as join34, resolve as resolve12 } from "node:path";
+import { basename as basename6, dirname as dirname18, isAbsolute as isAbsolute8, join as join33, resolve as resolve12 } from "node:path";
 function memoryFileOf(path2, locations, home) {
   if (!isAbsolute8(path2)) return void 0;
   const file = resolve12(path2);
-  const name = basename7(file);
+  const name = basename6(file);
   const folder = dirname18(file);
   for (const location of locations) {
     if (!name.endsWith(location.extension)) continue;
     if (location.skip.includes(name)) continue;
     const projectDir = location.memoryDir === "" ? folder : dirname18(folder);
-    if (location.memoryDir !== "" && basename7(folder) !== location.memoryDir)
+    if (location.memoryDir !== "" && basename6(folder) !== location.memoryDir)
       continue;
     if (dirname18(projectDir) !== resolve12(location.projectsDir(home))) continue;
     return { harness: location.harness, path: file };
@@ -43552,7 +43373,7 @@ function memoryFileOf(path2, locations, home) {
   return void 0;
 }
 function pathOf(word, cwd, home) {
-  const expanded = /^(?:~|\$HOME|\$\{HOME\})\//.test(word) ? join34(home, word.slice(word.indexOf("/") + 1)) : word;
+  const expanded = /^(?:~|\$HOME|\$\{HOME\})\//.test(word) ? join33(home, word.slice(word.indexOf("/") + 1)) : word;
   if (isAbsolute8(expanded)) return expanded;
   if (cwd !== void 0 && isAbsolute8(cwd)) return resolve12(cwd, expanded);
   return void 0;
@@ -43829,7 +43650,7 @@ ${use.path}`;
 
 // ../../packages/tacho/src/collector/memory-capture/stella-store.ts
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname19, isAbsolute as isAbsolute9, join as join35, resolve as resolve13 } from "node:path";
+import { dirname as dirname19, isAbsolute as isAbsolute9, join as join34, resolve as resolve13 } from "node:path";
 function sqlite2() {
   sqliteModule2 ??= createRequire3(import.meta.url)(
     "node:sqlite"
@@ -43932,7 +43753,7 @@ async function stellaStoreOf(dir, exists) {
   if (!isAbsolute9(dir)) return void 0;
   let at = resolve13(dir);
   for (let depth = 0; depth < WORKSPACE_SEARCH_DEPTH; depth += 1) {
-    const candidate = join35(at, STELLA_CONTEXT_DB);
+    const candidate = join34(at, STELLA_CONTEXT_DB);
     if (await exists(candidate)) return candidate;
     const up = dirname19(at);
     if (up === at) return void 0;
@@ -43945,7 +43766,7 @@ var init_stella_store = __esm({
   "../../packages/tacho/src/collector/memory-capture/stella-store.ts"() {
     "use strict";
     init_memory_reader();
-    STELLA_CONTEXT_DB = join35(".stella", "private", "context.db");
+    STELLA_CONTEXT_DB = join34(".stella", "private", "context.db");
     STELLA_MEMORIES_VIEW = "export_memories_v1";
     STELLA_USES_VIEW = "export_memory_uses_v1";
     STELLA_USES_PER_READ = 5e3;
@@ -44576,7 +44397,7 @@ var init_cloud_link = __esm({
 });
 
 // ../../packages/tacho/src/collector/local-servers/digest.ts
-import { join as join36 } from "node:path";
+import { join as join35 } from "node:path";
 function objectOf(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
@@ -44606,7 +44427,7 @@ function npmNameSegment(name) {
   return name.startsWith("@") ? `@${encodeURIComponent(name.slice(1))}` : encodeURIComponent(name);
 }
 async function whichOnPath(command2, pathValue, search) {
-  const candidates = command2.includes("/") || command2.includes("\\") ? [command2] : (pathValue ?? "").split(search.delimiter).filter((dir) => dir.length > 0).map((dir) => join36(dir, command2));
+  const candidates = command2.includes("/") || command2.includes("\\") ? [command2] : (pathValue ?? "").split(search.delimiter).filter((dir) => dir.length > 0).map((dir) => join35(dir, command2));
   for (const candidate of candidates) {
     for (const extension of search.extensions) {
       if (await search.isExecutable(candidate + extension))
@@ -45748,7 +45569,7 @@ var init_codec = __esm({
 import { createHash as createHash13 } from "node:crypto";
 import { mkdir as mkdir2, readdir as readdir2, readFile as readFile2, rm as rm2, writeFile } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname20, join as join37 } from "node:path";
+import { dirname as dirname20, join as join36 } from "node:path";
 function envDir(env, key) {
   const value = env[key];
   return value === void 0 || value.trim() === "" ? null : value;
@@ -45756,17 +45577,17 @@ function envDir(env, key) {
 function skillsRoot(harness, env = process.env, home = homedir5()) {
   switch (harness) {
     case "claude-code":
-      return join37(
-        envDir(env, "CLAUDE_CONFIG_DIR") ?? join37(home, ".claude"),
+      return join36(
+        envDir(env, "CLAUDE_CONFIG_DIR") ?? join36(home, ".claude"),
         "skills"
       );
     case "codex": {
       const codexHome = envDir(env, "CODEX_HOME");
-      return codexHome === null ? join37(home, ".agents", "skills") : join37(codexHome, "skills");
+      return codexHome === null ? join36(home, ".agents", "skills") : join36(codexHome, "skills");
     }
     case "stella":
-      return join37(
-        envDir(env, "STELLA_HOME") ?? join37(home, ".stella"),
+      return join36(
+        envDir(env, "STELLA_HOME") ?? join36(home, ".stella"),
         "skills"
       );
     case "cursor":
@@ -45825,7 +45646,7 @@ async function readMarker(folder) {
   if (!entries2.includes(SESSION_MARKER)) return { state: "foreign" };
   try {
     const parsed2 = JSON.parse(
-      await readFile2(join37(folder, SESSION_MARKER), "utf8")
+      await readFile2(join36(folder, SESSION_MARKER), "utf8")
     );
     return isMarker(parsed2) ? { state: "ours", marker: parsed2 } : { state: "foreign" };
   } catch {
@@ -45843,7 +45664,7 @@ function liveSessions(marker, now) {
 }
 async function writeMarker(folder, marker) {
   await writeFile(
-    join37(folder, SESSION_MARKER),
+    join36(folder, SESSION_MARKER),
     `${JSON.stringify(marker, null, 2)}
 `
   );
@@ -45851,9 +45672,9 @@ async function writeMarker(folder, marker) {
 async function writeSkill(folder, skill) {
   await rm2(folder, { recursive: true, force: true });
   await mkdir2(folder, { recursive: true });
-  await writeFile(join37(folder, "SKILL.md"), skillMarkdown(skill));
+  await writeFile(join36(folder, "SKILL.md"), skillMarkdown(skill));
   for (const file of skill.files) {
-    const target2 = join37(folder, file.path);
+    const target2 = join36(folder, file.path);
     await mkdir2(dirname20(target2), { recursive: true });
     await writeFile(target2, file.content);
   }
@@ -45881,7 +45702,7 @@ async function placeSkills(root, sessionId, skills, now = /* @__PURE__ */ new Da
       result2.warnings.push(refusal);
       continue;
     }
-    const folder = join37(root, skill.name);
+    const folder = join36(root, skill.name);
     if (taken.has(skill.name)) {
       result2.skipped.push(skill.name);
       result2.warnings.push(
@@ -45948,7 +45769,7 @@ async function removeSkills(root, sessionId, now = /* @__PURE__ */ new Date()) {
     throw error;
   }
   for (const name of names2.sort(compareText)) {
-    const folder = join37(root, name);
+    const folder = join36(root, name);
     const found = await readMarker(folder);
     if (found.state !== "ours") continue;
     const sessions = liveSessions(found.marker, now);
@@ -48944,7 +48765,7 @@ var init_model_proxy_listener = __esm({
 import {
   createServer as createServer5
 } from "node:http";
-import { chmodSync as chmodSync8, existsSync as existsSync19, statSync as statSync11, unlinkSync as unlinkSync12 } from "node:fs";
+import { chmodSync as chmodSync8, existsSync as existsSync19, statSync as statSync10, unlinkSync as unlinkSync12 } from "node:fs";
 import { randomBytes as randomBytes11 } from "node:crypto";
 import { createConnection } from "node:net";
 function readBody(req) {
@@ -49227,7 +49048,7 @@ function createRequestHandler(api, log, options = {}) {
 }
 async function removeStaleSocket(socketPath) {
   if (!existsSync19(socketPath)) return;
-  if (!statSync11(socketPath).isSocket()) {
+  if (!statSync10(socketPath).isSocket()) {
     throw new Error(`collector socket path is not a socket: ${socketPath}`);
   }
   const stale = await new Promise((resolve23, reject) => {
@@ -49335,7 +49156,7 @@ var init_server = __esm({
 
 // ../../packages/tacho/src/collector/spool.ts
 import { existsSync as existsSync20, readFileSync as readFileSync18 } from "node:fs";
-import { join as join38 } from "node:path";
+import { join as join37 } from "node:path";
 function sessionOwnedElsewhere(error) {
   return error.status === 403 && error.body.includes(SESSION_OWNED_ELSEWHERE);
 }
@@ -49495,7 +49316,7 @@ var init_spool = __esm({
        * gone for good.
        */
       stash(event, reason3, body2) {
-        const path2 = join38(
+        const path2 = join37(
           this.options.quarantineDir,
           `${event.session_uuid}-${String(event.seq).padStart(8, "0")}.json`
         );
@@ -49513,7 +49334,7 @@ var init_spool = __esm({
       }
       /** Add a body to a quarantine record that was written without one. */
       stashBodyBeside(event, body2) {
-        const path2 = join38(
+        const path2 = join37(
           this.options.quarantineDir,
           `${event.session_uuid}-${String(event.seq).padStart(8, "0")}.json`
         );
@@ -50019,14 +49840,14 @@ import {
   existsSync as existsSync21,
   readdirSync as readdirSync12,
   readFileSync as readFileSync19,
-  renameSync as renameSync5,
-  statSync as statSync12,
+  renameSync as renameSync4,
+  statSync as statSync11,
   unlinkSync as unlinkSync13,
   writeFileSync as writeFileSync4
 } from "node:fs";
 import { readdir as readdir3, readFile as readFile3, stat as stat2 } from "node:fs/promises";
 import { homedir as homedir7, hostname as osHostname2 } from "node:os";
-import { dirname as dirname21, join as join39 } from "node:path";
+import { dirname as dirname21, join as join38 } from "node:path";
 import { execFile as execFile4, spawnSync as spawnSync7 } from "node:child_process";
 function cloudGatewayUpstreams(origin = CLOUD_GATEWAY_ORIGIN) {
   const base2 = new URL(origin).origin;
@@ -50316,7 +50137,7 @@ async function initializeDaemon(options, server, port, ready) {
     processStarts: hookProcessStarts,
     adoptedChain: (sessionUuid2) => backfillLedger.chainHead(sessionUuid2)
   });
-  const priorStateWrittenAt = existsSync21(paths.daemonState) ? statSync12(paths.daemonState).mtimeMs : void 0;
+  const priorStateWrittenAt = existsSync21(paths.daemonState) ? statSync11(paths.daemonState).mtimeMs : void 0;
   const sealedState = parseSealedState(
     readJsonStateFile(
       paths.daemonSealedState,
@@ -50653,7 +50474,7 @@ async function initializeDaemon(options, server, port, ready) {
       controlReachable: lastControlAt !== void 0 && now() - lastControlAt < 2 * timers.bundleRefreshMs
     };
   }
-  const bodyPurgeOwedPath = join39(paths.wal, "body-purge-owed");
+  const bodyPurgeOwedPath = join38(paths.wal, "body-purge-owed");
   function markBodyPurgeOwed(retention, dropped) {
     try {
       ensureDir(paths.wal);
@@ -51392,7 +51213,7 @@ async function initializeDaemon(options, server, port, ready) {
         let sessionId;
         try {
           const file = JSON.parse(
-            readFileSync19(join39(paths.spool, name), "utf8")
+            readFileSync19(join38(paths.spool, name), "utf8")
           );
           const named = file.payload?.session_id;
           sessionId = typeof named === "string" ? named : void 0;
@@ -51537,7 +51358,7 @@ async function initializeDaemon(options, server, port, ready) {
   function setAsideConflictingTerminal(uuid, pending, conflict) {
     const name = `${uuid}-terminal-conflict-${String(conflict.seq).padStart(8, "0")}.json`;
     writeSensitiveFileAtomic(
-      join39(paths.quarantine, name),
+      join38(paths.quarantine, name),
       JSON.stringify(
         {
           reason: conflict.message,
@@ -51616,8 +51437,8 @@ async function initializeDaemon(options, server, port, ready) {
   function moveToFailedSpool(path2, name, reason3) {
     log(`spool file ${name} moved to spool/failed/: ${reason3}`);
     try {
-      ensureDir(join39(paths.spool, "failed"));
-      renameSync5(path2, join39(paths.spool, "failed", name));
+      ensureDir(join38(paths.spool, "failed"));
+      renameSync4(path2, join38(paths.spool, "failed", name));
     } catch (error) {
       log(
         `spool file ${name} could not be moved to spool/failed/: ${error instanceof Error ? error.message : String(error)}`
@@ -51666,7 +51487,7 @@ async function initializeDaemon(options, server, port, ready) {
         continue;
       }
       reads += 1;
-      const path2 = join39(paths.spool, name);
+      const path2 = join38(paths.spool, name);
       let file;
       try {
         file = JSON.parse(readFileSync19(path2, "utf8"));
@@ -51879,7 +51700,7 @@ async function initializeDaemon(options, server, port, ready) {
         let requested;
         try {
           const file = JSON.parse(
-            await readFile3(join39(paths.spool, name), "utf8")
+            await readFile3(join38(paths.spool, name), "utf8")
           );
           const payload = file.payload;
           requested = payload?.hook_event_name === "PreToolUse" && typeof payload.tool_use_id === "string" ? payload.tool_use_id : void 0;
@@ -52420,9 +52241,9 @@ async function initializeDaemon(options, server, port, ready) {
     let removed = 0;
     for (const name of readdirSync12(paths.quarantine)) {
       if (!name.endsWith(".json")) continue;
-      const file = join39(paths.quarantine, name);
+      const file = join38(paths.quarantine, name);
       try {
-        if (at - statSync12(file).mtimeMs < retainMs) continue;
+        if (at - statSync11(file).mtimeMs < retainMs) continue;
         unlinkSync13(file);
         removed += 1;
       } catch {
@@ -52732,7 +52553,7 @@ async function initializeDaemon(options, server, port, ready) {
   let memoryTimer;
   if (options.listen ?? true) {
     const codexMemories = createCodexMemoryStore({
-      path: join39(dirname21(paths.codexHooks), CODEX_MEMORY_STORE_FILE),
+      path: join38(dirname21(paths.codexHooks), CODEX_MEMORY_STORE_FILE),
       stat: (path2) => stat2(path2),
       log
     });
@@ -53106,17 +52927,6 @@ async function runDaemonProcess(options = {}) {
     process.stderr.write(line);
   };
   guardDaemonProcess({ stop: stopOnce, exit, log });
-  try {
-    const moved = migrateLegacyLayout(paths);
-    if (moved !== void 0)
-      log(`tachod: moved this machine's enrollment into agents/${moved}
-`);
-  } catch (error) {
-    log(
-      `tachod: could not move the enrollment into agents/: ${error instanceof Error ? error.message : String(error)}
-`
-    );
-  }
   writeDaemonPid(paths.pid, /* @__PURE__ */ new Date(), process.execPath, ownProcStart());
   try {
     await startAgents(daemonAgents(paths), daemons, log);
@@ -53163,53 +52973,6 @@ var init_run2 = __esm({
   }
 });
 
-// ../../packages/tacho/src/cli/alias.ts
-function aliasNotice(executable, argv, stdinIsTTY, env = {}) {
-  if (env["OXAGEN_DESKTOP_SIDECAR"] === "1") return void 0;
-  if (executable === "tachod")
-    return "tachod is now `oxagen daemon`. Run `oxagen agent status` to move this machine's service to the new name.";
-  if (executable === "tacho-hook")
-    return stdinIsTTY ? "tacho-hook is now `oxagen hook`." : void 0;
-  const command2 = argv[2];
-  const replacement = command2 === void 0 ? void 0 : OXAGEN_COMMAND_FOR[command2];
-  if (command2 === void 0 || replacement === void 0)
-    return "tacho is now the `oxagen` CLI. Run `oxagen agent --help` for the commands that replaced it.";
-  if (MACHINE_COMMANDS.has(command2) && !stdinIsTTY) return void 0;
-  return `\`tacho ${command2}\` is now \`${replacement}\`. The old name still works.`;
-}
-function printAliasNotice(executable, argv = process.argv, stdinIsTTY = process.stdin.isTTY === true, write = (text5) => {
-  process.stderr.write(text5);
-}, env = process.env) {
-  const notice = aliasNotice(executable, argv, stdinIsTTY, env);
-  if (notice !== void 0) write(`${notice}
-`);
-}
-var OXAGEN_COMMAND_FOR, MACHINE_COMMANDS;
-var init_alias = __esm({
-  "../../packages/tacho/src/cli/alias.ts"() {
-    "use strict";
-    OXAGEN_COMMAND_FOR = {
-      enroll: "oxagen agent enroll",
-      status: "oxagen agent status",
-      unenroll: "oxagen agent unenroll",
-      uninstall: "oxagen agent uninstall",
-      reassign: "oxagen agent reassign",
-      export: "oxagen agent export",
-      backfill: "oxagen agent backfill",
-      verify: "oxagen agent verify",
-      run: "oxagen agent run",
-      detect: "oxagen agent detect",
-      daemon: "oxagen daemon",
-      hook: "oxagen hook",
-      "mcp-stdio": "oxagen mcp-stdio",
-      credential: "oxagen credential",
-      github: "oxagen github",
-      arp: "oxagen arp"
-    };
-    MACHINE_COMMANDS = /* @__PURE__ */ new Set(["hook", "mcp-stdio", "credential", "github"]);
-  }
-});
-
 // ../../packages/tacho/src/arp/schema.ts
 function safeRelativePath(path2) {
   if (!path2 || path2.length > 4096 || /[\\:\x00-\x1f\x7f<>"|?*]/u.test(path2)) {
@@ -53346,16 +53109,16 @@ import {
   constants as constants3,
   fstatSync as fstatSync2,
   lstatSync as lstatSync7,
-  mkdirSync as mkdirSync9,
+  mkdirSync as mkdirSync8,
   openSync as openSync7,
   readSync as readSync4,
   realpathSync as realpathSync5,
   writeFileSync as writeFileSync5
 } from "node:fs";
-import { dirname as dirname22, join as join40, resolve as resolve15 } from "node:path";
+import { dirname as dirname22, join as join39, resolve as resolve15 } from "node:path";
 function bundlePath(root, relative10, create2 = false) {
   const absolute = resolve15(root);
-  if (create2) mkdirSync9(absolute, { recursive: true, mode: 448 });
+  if (create2) mkdirSync8(absolute, { recursive: true, mode: 448 });
   if (lstatSync7(absolute).isSymbolicLink() || !lstatSync7(absolute).isDirectory()) {
     throw new Error("ARP bundle root must be a directory, not a symlink");
   }
@@ -53363,7 +53126,7 @@ function bundlePath(root, relative10, create2 = false) {
   let current = base2;
   const parts = relative10.split("/");
   for (let i2 = 0; i2 < parts.length; i2++) {
-    current = join40(current, parts[i2]);
+    current = join39(current, parts[i2]);
     try {
       const stat6 = lstatSync7(current);
       if (stat6.isSymbolicLink() || i2 < parts.length - 1 && !stat6.isDirectory()) {
@@ -53371,7 +53134,7 @@ function bundlePath(root, relative10, create2 = false) {
       }
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
-      if (create2 && i2 < parts.length - 1) mkdirSync9(current, { mode: 448 });
+      if (create2 && i2 < parts.length - 1) mkdirSync8(current, { mode: 448 });
       else if (i2 < parts.length - 1) throw error;
     }
   }
@@ -54241,14 +54004,14 @@ import {
   constants as constants4,
   fstatSync as fstatSync3,
   lstatSync as lstatSync8,
-  mkdirSync as mkdirSync10,
+  mkdirSync as mkdirSync9,
   openSync as openSync8,
   readSync as readSync5,
   realpathSync as realpathSync6,
   rmSync as rmSync8,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { dirname as dirname23, isAbsolute as isAbsolute11, join as join41, relative as relative5, resolve as resolve16, sep as sep6 } from "node:path";
+import { dirname as dirname23, isAbsolute as isAbsolute11, join as join40, relative as relative5, resolve as resolve16, sep as sep6 } from "node:path";
 function fail2(message) {
   throw new Error(`ARP: ${message}`);
 }
@@ -54291,7 +54054,7 @@ function within2(root, path2) {
 }
 function newPath(path2) {
   const full = resolve16(path2);
-  return join41(
+  return join40(
     realpathSync6(dirname23(full)),
     full.slice(dirname23(full).length + 1)
   );
@@ -54307,7 +54070,7 @@ function sourcePath(root, path2) {
   }
   let current = root;
   for (const part2 of path2.split("/")) {
-    current = join41(current, part2);
+    current = join40(current, part2);
     if (lstatSync8(current).isSymbolicLink())
       fail2("Symlinks require a resource adapter.");
   }
@@ -54371,7 +54134,7 @@ function captureCheckpoint(options) {
       executable: (file.mode & 73) !== 0
     });
   }
-  mkdirSync10(out, { mode: 448 });
+  mkdirSync9(out, { mode: 448 });
   try {
     const blob = (value) => storeBlob(out, Buffer.from(jcs(value)), "application/json");
     const entries2 = [];
@@ -54558,16 +54321,16 @@ function prepareCheckpoint(options) {
     }
     return { entry: entry2, bytes: null };
   });
-  mkdirSync10(destination, { mode: 448 });
+  mkdirSync9(destination, { mode: 448 });
   try {
-    const restored = join41(destination, "workspace");
-    mkdirSync10(restored, { mode: 448 });
+    const restored = join40(destination, "workspace");
+    mkdirSync9(restored, { mode: 448 });
     for (const { entry: entry2, bytes } of files3) {
-      const path2 = join41(restored, entry2.path);
+      const path2 = join40(restored, entry2.path);
       if (entry2.kind === "directory")
-        mkdirSync10(path2, { recursive: true, mode: 448 });
+        mkdirSync9(path2, { recursive: true, mode: 448 });
       else {
-        mkdirSync10(dirname23(path2), { recursive: true, mode: 448 });
+        mkdirSync9(dirname23(path2), { recursive: true, mode: 448 });
         if (bytes === null) fail2("Workspace file has no bytes.");
         writeFileSync6(path2, bytes, {
           flag: "wx",
@@ -54575,9 +54338,9 @@ function prepareCheckpoint(options) {
         });
       }
     }
-    const promptDir = join41(restored, ".arp");
-    mkdirSync10(promptDir, { mode: 448 });
-    const promptFile = join41(promptDir, "handoff.json");
+    const promptDir = join40(restored, ".arp");
+    mkdirSync9(promptDir, { mode: 448 });
+    const promptFile = join40(promptDir, "handoff.json");
     const prompt = {
       checkpoint_digest: checkpointDigest,
       task: task.request,
@@ -54594,7 +54357,7 @@ function prepareCheckpoint(options) {
       flag: "wx",
       mode: 384
     });
-    const reportPath = join41(destination, "report.json");
+    const reportPath = join40(destination, "report.json");
     writeFileSync6(
       reportPath,
       jcs({
@@ -55124,7 +54887,6 @@ var init_main = __esm({
     init_paths();
     init_wire();
     init_github();
-    init_alias();
     init_arp();
     init_credential();
     init_backfill3();
@@ -55140,7 +54902,6 @@ var init_main = __esm({
     init_uninstall();
     init_verify();
     if (!isNativeBuild() && process.argv[1] !== void 0 && /tacho(\.mjs|\/main\.ts)?$/.test(process.argv[1])) {
-      printAliasNotice("tacho");
       main().catch((error) => {
         process.stderr.write(
           `tacho: ${error instanceof Error ? error.message : String(error)}
@@ -55176,7 +54937,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@oxagen/cli",
-      version: "2.1.4-672",
+      version: "2.1.4-684",
       description: "Oxagen governance CLI \u2014 spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
       type: "module",
       main: "./dist/index.js",
@@ -55241,39 +55002,18 @@ var init_package = __esm({
   }
 });
 
-// src/commands/retired.ts
-function printRetiredNotice(what) {
-  process.stderr.write(
-    `${what} was retired when Oxagen became a pure governance plane (docs/adr/ADR-043-runtime-excision.md). Use the \`stella\` CLI with the oxagen MCP server instead.
-`
-  );
-  process.exitCode = 1;
-}
-function printTachoAliasNotice(subcommand, env = process.env) {
-  if (env["OXAGEN_DESKTOP_SIDECAR"] === "1") return;
-  process.stderr.write(
-    // tacho-command-check: alias (this line names the old spelling on purpose)
-    `\`oxagen tacho ${subcommand}\` is now \`oxagen agent ${subcommand}\`. The old name still works.
-`
-  );
-}
-var init_retired = __esm({
-  "src/commands/retired.ts"() {
-  }
-});
-
 // src/lib/atomic-write.ts
-import { writeFileSync as writeFileSync7, renameSync as renameSync6, unlinkSync as unlinkSync15, existsSync as existsSync22 } from "node:fs";
-import { dirname as dirname24, join as join42 } from "node:path";
+import { writeFileSync as writeFileSync7, renameSync as renameSync5, unlinkSync as unlinkSync15, existsSync as existsSync22 } from "node:fs";
+import { dirname as dirname24, join as join41 } from "node:path";
 function atomicWriteFileSync(path2, data) {
   const dir = dirname24(path2);
-  const tmp = join42(
+  const tmp = join41(
     dir,
     `.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`
   );
   try {
     writeFileSync7(tmp, data, "utf8");
-    renameSync6(tmp, path2);
+    renameSync5(tmp, path2);
   } catch (err2) {
     try {
       if (existsSync22(tmp)) unlinkSync15(tmp);
@@ -55289,8 +55029,8 @@ var init_atomic_write = __esm({
 
 // src/lib/config.ts
 import { homedir as homedir8 } from "os";
-import { join as join43 } from "path";
-import { readFileSync as readFileSync22, mkdirSync as mkdirSync11, existsSync as existsSync23 } from "fs";
+import { join as join42 } from "path";
+import { readFileSync as readFileSync22, mkdirSync as mkdirSync10, existsSync as existsSync23 } from "fs";
 function getConfigDir() {
   return CONFIG_DIR;
 }
@@ -55311,7 +55051,7 @@ Run \`oxagen login\` to re-authenticate.
 function writeConfig(patch) {
   const current = readConfig();
   const next = { ...current, ...patch };
-  if (!existsSync23(CONFIG_DIR)) mkdirSync11(CONFIG_DIR, { recursive: true });
+  if (!existsSync23(CONFIG_DIR)) mkdirSync10(CONFIG_DIR, { recursive: true });
   atomicWriteFileSync(CONFIG_FILE, JSON.stringify(next, null, 2));
 }
 function clearConfig() {
@@ -55340,8 +55080,8 @@ var CONFIG_DIR, CONFIG_FILE;
 var init_config = __esm({
   "src/lib/config.ts"() {
     init_atomic_write();
-    CONFIG_DIR = join43(homedir8(), ".config", "oxagen");
-    CONFIG_FILE = join43(CONFIG_DIR, "config.json");
+    CONFIG_DIR = join42(homedir8(), ".config", "oxagen");
+    CONFIG_FILE = join42(CONFIG_DIR, "config.json");
   }
 });
 
@@ -55373,16 +55113,16 @@ import {
   writeFile as writeFile2
 } from "node:fs/promises";
 import { homedir as homedir9 } from "node:os";
-import { join as join44 } from "node:path";
+import { join as join43 } from "node:path";
 function isDebugEnabled() {
   const v = process.env[DEBUG_ENV];
   return v === "1" || v === "true";
 }
 function logsDir() {
-  return join44(homedir9(), ".oxagen", "logs");
+  return join43(homedir9(), ".oxagen", "logs");
 }
 function debugLogFile() {
-  return join44(logsDir(), "cli.output");
+  return join43(logsDir(), "cli.output");
 }
 function sanitize(value, depth = 0) {
   if (value === null || value === void 0) return value;
@@ -55894,30 +55634,6 @@ var init_add_claude_code_mcp = __esm({
   }
 });
 
-// src/commands/move-off-tacho.ts
-async function moveOffTacho(writer) {
-  const { defaultCliDeps: defaultCliDeps2, moveOffTachoNames: moveOffTachoNames2, oxagenRuntimeCommands: oxagenRuntimeCommands2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
-  const moved = await moveOffTachoNames2(
-    defaultCliDeps2({
-      out: () => void 0,
-      err: (line) => writer.writeErr(line),
-      runtime: oxagenRuntimeCommands2()
-    })
-  );
-  for (const agent of moved)
-    writer.writeErr(
-      agent.ok ? `Moved ${agent.agentKey}'s hooks and service from ${agent.from} to the oxagen CLI.` : agent.skipped === "harness_files_elsewhere" ? (
-        // The recorder already said which shell to run it from. Running
-        // enroll again from this one would leave the agent again.
-        `Left ${agent.agentKey}'s hooks and service on ${agent.from}; they keep working. The line above says how to move them.`
-      ) : `Could not move ${agent.agentKey}'s hooks and service off ${agent.from}; they keep working. Run \`oxagen agent enroll\` to try again.`
-    );
-}
-var init_move_off_tacho = __esm({
-  "src/commands/move-off-tacho.ts"() {
-  }
-});
-
 // src/commands/tacho.ts
 var tacho_exports = {};
 __export(tacho_exports, {
@@ -55983,7 +55699,6 @@ async function handleTachoEnroll(opts, writer = stdoutWriter) {
   );
   if (!result2.ok) return false;
   const shipping = result2.shipping?.healthy !== false;
-  if (opts.printManaged !== true) await moveOffTacho(writer);
   if (opts.verify === true) {
     const wrapped2 = harnesses?.find((harness) => harness !== "claude-desktop");
     const verified = await verify6(
@@ -55999,7 +55714,6 @@ async function handleTachoEnroll(opts, writer = stdoutWriter) {
 }
 async function handleTachoStatus(opts, writer = stdoutWriter) {
   const { status: status2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
-  await moveOffTacho(writer);
   await addClaudeCodeMcp(writer);
   const report = await status2(opts, await tachoDeps(writer));
   const reports = [report, ...report.enrollments ?? []];
@@ -56225,7 +55939,6 @@ var init_tacho = __esm({
     init_capture_writer();
     init_api();
     init_add_claude_code_mcp();
-    init_move_off_tacho();
     getuid = () => process.getuid?.();
   }
 });
@@ -58753,9 +58466,9 @@ var init_git = __esm({
 
 // ../../packages/steering-freshness/src/cache.ts
 import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname25, join as join45 } from "node:path";
+import { dirname as dirname25, join as join44 } from "node:path";
 function stampPath(gitCommonDir) {
-  return join45(gitCommonDir, "oxagen", "steering-freshness.json");
+  return join44(gitCommonDir, "oxagen", "steering-freshness.json");
 }
 async function readFetchStamp(gitCommonDir, io = defaultIo) {
   try {
@@ -58809,24 +58522,24 @@ var init_cache = __esm({
 // ../../packages/steering-freshness/src/hooks.ts
 import { mkdir as mkdir5, readFile as readFile7, writeFile as writeFile5 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { dirname as dirname26, join as join46 } from "node:path";
+import { dirname as dirname26, join as join45 } from "node:path";
 function hookCommand(harness) {
   return `oxagen steering gate --harness ${harness}`;
 }
 function hookConfigPath(projectRoot, harness, env = process.env, home = homedir10()) {
   switch (harness) {
     case "claude-code":
-      return join46(projectRoot, ".claude", "settings.json");
+      return join45(projectRoot, ".claude", "settings.json");
     case "codex":
-      return join46(env["CODEX_HOME"] ?? join46(home, ".codex"), "hooks.json");
+      return join45(env["CODEX_HOME"] ?? join45(home, ".codex"), "hooks.json");
     case "cursor":
-      return join46(home, ".cursor", "hooks.json");
+      return join45(home, ".cursor", "hooks.json");
     case "stella":
-      return join46(env["STELLA_HOME"] ?? join46(home, ".stella"), "stella.toml");
+      return join45(env["STELLA_HOME"] ?? join45(home, ".stella"), "stella.toml");
   }
 }
 function stellaJsonPath(env, home) {
-  return join46(env["STELLA_HOME"] ?? join46(home, ".stella"), "settings.json");
+  return join45(env["STELLA_HOME"] ?? join45(home, ".stella"), "settings.json");
 }
 function isRecord8(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v);
@@ -59555,7 +59268,7 @@ var init_policy = __esm({
 // ../../packages/steering-freshness/src/settings.ts
 import { readFile as readFile8 } from "node:fs/promises";
 import { homedir as homedir11 } from "node:os";
-import { join as join47 } from "node:path";
+import { join as join46 } from "node:path";
 async function readLayer(scope, path2, read2) {
   let text5;
   try {
@@ -59607,14 +59320,14 @@ function parseLayer(scope, path2, text5) {
 }
 async function loadSteeringSettings({
   projectRoot,
-  userSettingsPath = join47(homedir11(), USER_SETTINGS_RELATIVE),
+  userSettingsPath = join46(homedir11(), USER_SETTINGS_RELATIVE),
   read: read2 = readFile8,
   workspacePolicy = null
 }) {
   const targets = [
     ["user", userSettingsPath],
-    ["project", join47(projectRoot, PROJECT_DIR_NAME, PROJECT_SETTINGS_FILE)],
-    ["local", join47(projectRoot, PROJECT_DIR_NAME, LOCAL_SETTINGS_FILE)]
+    ["project", join46(projectRoot, PROJECT_DIR_NAME, PROJECT_SETTINGS_FILE)],
+    ["local", join46(projectRoot, PROJECT_DIR_NAME, LOCAL_SETTINGS_FILE)]
   ];
   const layers = [];
   const warnings = [];
@@ -59662,7 +59375,7 @@ var init_settings = __esm({
     "use strict";
     init_git();
     init_policy();
-    USER_SETTINGS_RELATIVE = join47(
+    USER_SETTINGS_RELATIVE = join46(
       ".config",
       "oxagen",
       "settings.json"
@@ -59675,7 +59388,7 @@ var init_settings = __esm({
 
 // ../../packages/steering-freshness/src/check.ts
 import { lstat as lstat3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute12, join as join48, resolve as resolve17 } from "node:path";
+import { isAbsolute as isAbsolute12, join as join47, resolve as resolve17 } from "node:path";
 function publishedCommits(platform) {
   if (platform.headCommits && platform.headCommits.length > 0)
     return platform.headCommits;
@@ -59989,7 +59702,7 @@ async function absentFromDisk(root, paths) {
   const flags = await Promise.all(
     paths.map(async (path2) => {
       try {
-        await lstat3(join48(root, path2));
+        await lstat3(join47(root, path2));
         return false;
       } catch {
         return true;
@@ -60637,14 +60350,14 @@ var init_src2 = __esm({
 // src/commands/workspace-link.ts
 import {
   existsSync as existsSync24,
-  mkdirSync as mkdirSync12,
+  mkdirSync as mkdirSync11,
   readFileSync as readFileSync23,
   rmSync as rmSync9,
   writeFileSync as writeFileSync8
 } from "node:fs";
-import { join as join49 } from "node:path";
+import { join as join48 } from "node:path";
 function workspaceLinkPath(cwd) {
-  return join49(cwd, ".oxagen", "workspace.json");
+  return join48(cwd, ".oxagen", "workspace.json");
 }
 function readWorkspaceLink(cwd) {
   const filePath = workspaceLinkPath(cwd);
@@ -60661,8 +60374,8 @@ function readWorkspaceLink(cwd) {
   }
 }
 function writeWorkspaceLink(cwd, link) {
-  const dir = join49(cwd, ".oxagen");
-  mkdirSync12(dir, { recursive: true });
+  const dir = join48(cwd, ".oxagen");
+  mkdirSync11(dir, { recursive: true });
   writeFileSync8(workspaceLinkPath(cwd), JSON.stringify(link, null, 2), "utf8");
 }
 var init_workspace_link = __esm({
@@ -60687,7 +60400,7 @@ __export(steering_exports, {
 });
 import { execFileSync } from "node:child_process";
 import { existsSync as existsSync25, realpathSync as realpathSync7 } from "node:fs";
-import { dirname as dirname27, join as join50, normalize, parse as parsePath } from "node:path";
+import { dirname as dirname27, join as join49, normalize, parse as parsePath } from "node:path";
 function findProjectRoot(start) {
   const { root } = parsePath(start);
   const rawGitRoot = gitRootOr(start);
@@ -60696,7 +60409,7 @@ function findProjectRoot(start) {
   if (gitRoot !== null) return gitRoot;
   let dir = from;
   for (; ; ) {
-    if (existsSync25(join50(dir, PROJECT_DIR_NAME))) return dir;
+    if (existsSync25(join49(dir, PROJECT_DIR_NAME))) return dir;
     if (dir === root) return from;
     const parent = dirname27(dir);
     if (parent === dir) return from;
@@ -72026,7 +71739,7 @@ function recordLineageFromPath(path2) {
     return parts[parts.length - 1].slice(0, -3);
   return null;
 }
-var AGENTS_MD_PATH, CLAUDE_MD_PATH, README_PATH, GITATTRIBUTES_PATH, WORKSPACE_TOML_PATH, AGENTS_DIR, STEERING_DIR, GOVERNANCE_TOML_PATH, SKILLS_DIR, TOOLS_DIR, TOOL_SERVERS_DIR, POLICY_DIR, CEDAR_SCHEMA_PATH, CODEGRAPH_SETTINGS_DIR, SKILL_FILE_NAME, SERVER_TOML_NAME, TOOLS_TOML_NAME, TOOLS_LOCK_NAME, LEDGER_FILE, ROOT_FILES, SERVER_FILES, LEGACY_OXAGEN_DIR, WORKSPACE_LINK_PATH;
+var AGENTS_MD_PATH, CLAUDE_MD_PATH, README_PATH, GITATTRIBUTES_PATH, WORKSPACE_TOML_PATH, AGENTS_DIR, STEERING_DIR, GOVERNANCE_TOML_PATH, SKILLS_DIR, TOOLS_DIR, TOOL_SERVERS_DIR, POLICY_DIR, CEDAR_SCHEMA_PATH, CODEGRAPH_SETTINGS_DIR, SKILL_FILE_NAME, SERVER_TOML_NAME, TOOLS_TOML_NAME, TOOLS_LOCK_NAME, LEDGER_FILE, ROOT_FILES, SERVER_FILES, WORKSPACE_LINK_PATH;
 var init_paths2 = __esm({
   "../../packages/oxagen/src/steering-repo/paths.ts"() {
     "use strict";
@@ -72066,7 +71779,6 @@ var init_paths2 = __esm({
       "overlay.yaml": "server-definition",
       "schema.graphql": "server-definition"
     };
-    LEGACY_OXAGEN_DIR = ".oxagen";
     WORKSPACE_LINK_PATH = ".oxagen/workspace.json";
   }
 });
@@ -73643,7 +73355,7 @@ var init_run_shared = __esm({
 });
 
 // ../../packages/oxagen/src/contracts/run.list.ts
-var runPublicIdSchema, runSourceSchema, runStatusSchema, runOutcomeSchema, runCostSchema, replayGradeSchema, generatedRunSummarySchema, editedRunSummarySchema, runSummarySchema, operatorKindSchema, RUN_OPERATOR_ROLES, runOperatorRoleSchema, runModelSchema, runMachineSnapshotSchema, runMachineSchema, COMMAND_BLOCKS, STEER_BLOCKS, HOST_POLL_WINDOW_MS, RUN_PULL_REQUEST_MAX, runPullRequestSchema, runDiffSchema, RUN_PULL_REQUEST_FILTERS, RUN_PAUSE_STATES, runPauseSchema, RUN_REPLAY_FILTERS, RUN_SORT_KEYS, RUN_LIST_TOTAL_BOUND, RUN_LABEL_MAX, runItemSchema, runList;
+var runPublicIdSchema, runSourceSchema, runStatusSchema, runOutcomeSchema, runCostSchema, replayGradeSchema, generatedRunSummarySchema, editedRunSummarySchema, runSummarySchema, operatorKindSchema, RUN_OPERATOR_ROLES, runOperatorRoleSchema, runModelSchema, runMachineSnapshotSchema, runMachineSchema, COMMAND_BLOCKS, STEER_BLOCKS, HOST_POLL_WINDOW_MS, RUN_PULL_REQUEST_MAX, runPullRequestSchema, runDiffSchema, runAttributionSchema, RUN_PULL_REQUEST_FILTERS, RUN_PAUSE_STATES, runPauseSchema, RUN_REPLAY_FILTERS, RUN_SORT_KEYS, RUN_LIST_TOTAL_BOUND, RUN_LABEL_MAX, runItemSchema, runList;
 var init_run_list = __esm({
   "../../packages/oxagen/src/contracts/run.list.ts"() {
     "use strict";
@@ -73753,6 +73465,13 @@ var init_run_list = __esm({
       removed: external_exports.number().int().nonnegative(),
       basis: external_exports.enum(["harness_reported", "git_observed"])
     }).strict();
+    runAttributionSchema = external_exports.object({
+      commits: external_exports.number().int().nonnegative(),
+      merges: external_exports.number().int().nonnegative(),
+      written: external_exports.object({ added: external_exports.number().int().nonnegative(), removed: external_exports.number().int().nonnegative() }),
+      shipped: external_exports.object({ added: external_exports.number().int().nonnegative(), removed: external_exports.number().int().nonnegative() }).nullable(),
+      uncommitted: external_exports.object({ added: external_exports.number().int().nonnegative(), removed: external_exports.number().int().nonnegative() }).nullable()
+    });
     RUN_PULL_REQUEST_FILTERS = ["any", "with", "without"];
     RUN_PAUSE_STATES = ["pausing", "paused", "resuming"];
     runPauseSchema = external_exports.object({
@@ -74098,6 +73817,7 @@ var init_run_list = __esm({
       pullRequestsOpened: external_exports.number().int().nonnegative().optional(),
       /** Lines added and removed; null when neither the harness nor git reported any. */
       diff: runDiffSchema.nullable().optional(),
+      attribution: runAttributionSchema.nullable().optional(),
       /**
        * The run's token counts by class, from its `cost.run_totals` row. Null
        * when the run has no rollup row. The column is NOT NULL, so an unpriced
@@ -75937,7 +75657,7 @@ function agentFindings(tree, context) {
           field: "runtime",
           message: `No runtime named ${runtime} is enrolled in Oxagen.${didYouMean(runtime, context.runtimes)}`,
           expected: "A runtime enrolled in Oxagen.",
-          fix: `Enroll ${runtime} with tacho enroll, or name an enrolled runtime.`
+          fix: `Enroll ${runtime} with oxagen agent enroll, or name an enrolled runtime.`
         })
       );
     }
@@ -77181,7 +76901,7 @@ var init_memory_client = __esm({
 // src/lib/markdown-import.ts
 import { readFile as readFile9 } from "node:fs/promises";
 import {
-  basename as basename8,
+  basename as basename7,
   dirname as dirname28,
   isAbsolute as isAbsolute13,
   relative as relative6,
@@ -77196,8 +76916,8 @@ function importFilename(path2, folder) {
   if (!inside(rel) && folder !== void 0) {
     rel = relative6(dirname28(resolve18(folder)), resolve18(path2));
   }
-  const name = inside(rel) ? rel.split(sep7).join("/") : basename8(path2);
-  return name.length > 256 ? basename8(path2).slice(-256) : name;
+  const name = inside(rel) ? rel.split(sep7).join("/") : basename7(path2);
+  return name.length > 256 ? basename7(path2).slice(-256) : name;
 }
 async function readImportDocuments(sources, target2, writer) {
   const documents = [];
@@ -77433,7 +77153,7 @@ __export(steering_import_exports, {
   handleSteeringImport: () => handleSteeringImport
 });
 import { readdir as readdir4, realpath as realpath2, stat as stat4 } from "node:fs/promises";
-import { basename as basename9, extname, join as join51 } from "node:path";
+import { basename as basename8, extname, join as join50 } from "node:path";
 function byName(a, b5) {
   return a.name < b5.name ? -1 : 1;
 }
@@ -77462,7 +77182,7 @@ async function findMarkdownFiles(paths) {
     entries2.sort(byName);
     const extensions2 = place2 === "rules" ? CURSOR_RULE_EXTENSIONS : MARKDOWN_EXTENSIONS;
     for (const entry2 of entries2) {
-      const path2 = join51(dir, entry2.name);
+      const path2 = join50(dir, entry2.name);
       if (entry2.isDirectory()) {
         if (place2 === "cursor") {
           if (entry2.name === CURSOR_RULES_FOLDER) {
@@ -77491,7 +77211,7 @@ async function findMarkdownFiles(paths) {
       continue;
     }
     if (isFolder) {
-      const place2 = basename9(path2) === CURSOR_FOLDER ? "cursor" : "plain";
+      const place2 = basename8(path2) === CURSOR_FOLDER ? "cursor" : "plain";
       await walk2(path2, path2, place2);
     } else await take(path2);
   }
@@ -79083,11 +78803,11 @@ __export(verify_exports, {
   readBundle: () => readBundle,
   verifyBundle: () => verifyBundle3
 });
-import { existsSync as existsSync26, readFileSync as readFileSync24, statSync as statSync13 } from "node:fs";
-import { join as join52 } from "node:path";
+import { existsSync as existsSync26, readFileSync as readFileSync24, statSync as statSync12 } from "node:fs";
+import { join as join51 } from "node:path";
 function readDirectory(dir) {
   const read2 = (name) => {
-    const path2 = join52(dir, name);
+    const path2 = join51(dir, name);
     return existsSync26(path2) ? readFileSync24(path2, "utf8") : void 0;
   };
   return assemble(read2, dir);
@@ -79129,7 +78849,7 @@ function readBundle(path2) {
   if (!existsSync26(path2)) {
     throw new BundleReadError(`${path2} does not exist.`);
   }
-  return statSync13(path2).isDirectory() ? readDirectory(path2) : readZip(path2);
+  return statSync12(path2).isDirectory() ? readDirectory(path2) : readZip(path2);
 }
 function digestLabel(state) {
   return state === "not_carried" ? "not carried" : state;
@@ -80174,14 +79894,14 @@ import {
   appendFileSync as appendFileSync4,
   existsSync as existsSync27,
   lstatSync as lstatSync9,
-  mkdirSync as mkdirSync13,
+  mkdirSync as mkdirSync12,
   readFileSync as readFileSync25,
   readdirSync as readdirSync13,
   realpathSync as realpathSync8,
   writeFileSync as writeFileSync10
 } from "node:fs";
 import { homedir as homedir12, hostname as osHostname3 } from "node:os";
-import { join as join53, relative as relative7, resolve as resolve20, sep as sep8 } from "node:path";
+import { join as join52, relative as relative7, resolve as resolve20, sep as sep8 } from "node:path";
 function git4(cwd, args) {
   return new Promise((done) => {
     try {
@@ -80228,7 +79948,7 @@ function parseRemoteRepository(url) {
 }
 function oxagenPresent(root) {
   try {
-    return readdirSync13(join53(root, ".oxagen")).some(
+    return readdirSync13(join52(root, ".oxagen")).some(
       (name) => name !== "workspace.json"
     );
   } catch {
@@ -80237,18 +79957,18 @@ function oxagenPresent(root) {
 }
 function symlinkState(root) {
   try {
-    if (!lstatSync9(join53(root, ".stella")).isDirectory()) return "none";
+    if (!lstatSync9(join52(root, ".stella")).isDirectory()) return "none";
   } catch {
     return "none";
   }
   let oxagenReal;
   try {
-    oxagenReal = realpathSync8(join53(root, ".oxagen"));
+    oxagenReal = realpathSync8(join52(root, ".oxagen"));
   } catch {
     return "missing";
   }
   for (const link of STELLA_LINKS) {
-    const at = join53(root, link);
+    const at = join52(root, link);
     try {
       if (!lstatSync9(at).isSymbolicLink()) return "missing";
       const target2 = realpathSync8(at);
@@ -80262,7 +79982,7 @@ function symlinkState(root) {
   return "linked";
 }
 function machineId(configDir = getConfigDir()) {
-  const file = join53(configDir, MACHINE_ID_FILE);
+  const file = join52(configDir, MACHINE_ID_FILE);
   let secret = null;
   try {
     if (existsSync27(file)) {
@@ -80271,7 +79991,7 @@ function machineId(configDir = getConfigDir()) {
     }
     if (secret === null) {
       secret = randomBytes12(32).toString("hex");
-      mkdirSync13(configDir, { recursive: true });
+      mkdirSync12(configDir, { recursive: true });
       writeFileSync10(file, `${secret}
 `, { encoding: "utf8", mode: 384 });
     }
@@ -80344,12 +80064,12 @@ async function ensureWorkspaceLinkIgnored(root) {
   const topDir = resolve20(top);
   const entry2 = relative7(
     topDir,
-    join53(realpathOr2(root), ".oxagen", "workspace.json")
+    join52(realpathOr2(root), ".oxagen", "workspace.json")
   ).split(sep8).join("/");
   if (entry2.startsWith("../")) return null;
   const rule = await git4(topDir, ["check-ignore", "--no-index", "-v", entry2]);
   if (rule !== null) return null;
-  const gitignore = join53(resolve20(top), ".gitignore");
+  const gitignore = join52(resolve20(top), ".gitignore");
   let existing = "";
   try {
     existing = readFileSync25(gitignore, "utf8");
@@ -80823,19 +80543,19 @@ __export(pull_exports, {
 import { createHash as createHash20 } from "node:crypto";
 import {
   lstatSync as lstatSync10,
-  mkdirSync as mkdirSync14,
+  mkdirSync as mkdirSync13,
   readFileSync as readFileSync26,
   readdirSync as readdirSync14,
   realpathSync as realpathSync9,
   rmSync as rmSync10,
-  rmdirSync as rmdirSync8
+  rmdirSync as rmdirSync7
 } from "node:fs";
 import {
   dirname as dirname29,
   isAbsolute as isAbsolute14,
-  join as join54,
+  join as join53,
   parse as parsePath2,
-  posix as posix5,
+  posix as posix4,
   sep as sep9
 } from "node:path";
 function checkSteeringPath(path2) {
@@ -80846,10 +80566,10 @@ function checkSteeringPath(path2) {
   if (path2.includes("\\")) {
     return { ok: false, reason: "contains a backslash" };
   }
-  if (posix5.isAbsolute(path2) || isAbsolute14(path2) || /^[A-Za-z]:/.test(path2)) {
+  if (posix4.isAbsolute(path2) || isAbsolute14(path2) || /^[A-Za-z]:/.test(path2)) {
     return { ok: false, reason: "absolute path" };
   }
-  const normalized = posix5.normalize(path2);
+  const normalized = posix4.normalize(path2);
   if (normalized !== path2 || normalized.split("/").some((s4) => s4 === ".." || s4 === ".")) {
     return { ok: false, reason: "not a canonical path" };
   }
@@ -80946,7 +80666,7 @@ function findLinkedRoot(start) {
 }
 function fsReader(root) {
   return (path2) => {
-    const abs = join54(root, ...path2.split("/"));
+    const abs = join53(root, ...path2.split("/"));
     try {
       const st = lstatSync10(abs);
       if (!st.isFile()) return Buffer.from(`\0not-a-file:${abs}`);
@@ -80957,14 +80677,14 @@ function fsReader(root) {
   };
 }
 function assertInsideOxagen(root, path2) {
-  const oxagenAbs = join54(root, OXAGEN_DIR);
+  const oxagenAbs = join53(root, OXAGEN_DIR);
   let oxagenReal;
   try {
     oxagenReal = realpathSync9(oxagenAbs);
   } catch {
     return;
   }
-  const abs = join54(root, ...path2.split("/"));
+  const abs = join53(root, ...path2.split("/"));
   try {
     if (lstatSync10(abs).isSymbolicLink()) {
       throw new Error(
@@ -80994,12 +80714,12 @@ function assertInsideOxagen(root, path2) {
   }
 }
 function pruneEmptyDirs(root, path2) {
-  const stop = join54(root, OXAGEN_DIR);
-  let dir = dirname29(join54(root, ...path2.split("/")));
+  const stop = join53(root, OXAGEN_DIR);
+  let dir = dirname29(join53(root, ...path2.split("/")));
   while (dir.startsWith(stop + sep9)) {
     try {
       if (readdirSync14(dir).length > 0) return;
-      rmdirSync8(dir);
+      rmdirSync7(dir);
     } catch {
       return;
     }
@@ -81010,12 +80730,12 @@ function applyPlan(root, plan) {
   for (const w of plan.writes) assertInsideOxagen(root, w.path);
   for (const d of plan.deletes) assertInsideOxagen(root, d);
   for (const w of plan.writes) {
-    const abs = join54(root, ...w.path.split("/"));
-    mkdirSync14(dirname29(abs), { recursive: true });
+    const abs = join53(root, ...w.path.split("/"));
+    mkdirSync13(dirname29(abs), { recursive: true });
     atomicWriteFileSync(abs, w.content);
   }
   for (const d of plan.deletes) {
-    rmSync10(join54(root, ...d.split("/")), { force: true });
+    rmSync10(join53(root, ...d.split("/")), { force: true });
     pruneEmptyDirs(root, d);
   }
 }
@@ -81184,7 +80904,7 @@ var init_pull = __esm({
     init_output();
     init_working_copy();
     init_workspace_link();
-    OXAGEN_DIR = LEGACY_OXAGEN_DIR;
+    OXAGEN_DIR = ".oxagen";
     LINK_PATH = WORKSPACE_LINK_PATH;
     NOT_LINKED = "This directory is not linked to a workspace. Run `oxagen init --org <org> --workspace <workspace>` first.";
     BINDING_ID = /^rpb_[0-9A-Za-z]+$/;
@@ -124308,12 +124028,12 @@ import { execFileSync as execFileSync2 } from "node:child_process";
 import { createHash as createHash22 } from "node:crypto";
 import {
   lstatSync as lstatSync11,
-  mkdirSync as mkdirSync15,
+  mkdirSync as mkdirSync14,
   readFileSync as readFileSync27,
   readlinkSync as readlinkSync4,
-  statSync as statSync14
+  statSync as statSync13
 } from "node:fs";
-import { dirname as dirname30, isAbsolute as isAbsolute15, join as join55, relative as relative8, resolve as resolve22, sep as sep10 } from "node:path";
+import { dirname as dirname30, isAbsolute as isAbsolute15, join as join54, relative as relative8, resolve as resolve22, sep as sep10 } from "node:path";
 function git5(cwd, args, input) {
   try {
     return execFileSync2("git", args, {
@@ -124345,7 +124065,7 @@ function commitOf(root, ref2) {
   return sha2.length > 0 ? sha2 : null;
 }
 function readWorkingFile(root, path2) {
-  const abs = join55(root, ...path2.split("/"));
+  const abs = join54(root, ...path2.split("/"));
   try {
     const stat6 = lstatSync11(abs);
     if (stat6.isSymbolicLink()) return readlinkSync4(abs, "utf8");
@@ -124424,14 +124144,14 @@ function chooseBase(root, ref2) {
 }
 function isFile(path2) {
   try {
-    return statSync14(path2).isFile();
+    return statSync13(path2).isFile();
   } catch {
     return false;
   }
 }
 function isDir(path2) {
   try {
-    return statSync14(path2).isDirectory();
+    return statSync13(path2).isDirectory();
   } catch {
     return false;
   }
@@ -124439,7 +124159,7 @@ function isDir(path2) {
 function findSteeringRoot(start) {
   let dir = resolve22(start);
   for (; ; ) {
-    if (isFile(join55(dir, WORKSPACE_TOML_PATH)) || isFile(join55(dir, AGENTS_MD_PATH)) && isDir(join55(dir, STEERING_DIR))) {
+    if (isFile(join54(dir, WORKSPACE_TOML_PATH)) || isFile(join54(dir, AGENTS_MD_PATH)) && isDir(join54(dir, STEERING_DIR))) {
       return dir;
     }
     const parent = dirname30(dir);
@@ -124519,7 +124239,7 @@ function cacheFile(cacheDir, root) {
     key: token === void 0 ? null : createHash22("sha256").update(token).digest("hex").slice(0, 16)
   };
   const key = createHash22("sha256").update(JSON.stringify([root, identity])).digest("hex").slice(0, 32);
-  return join55(cacheDir, `${key}.json`);
+  return join54(cacheDir, `${key}.json`);
 }
 function readCache(file, now) {
   let entry2;
@@ -124547,7 +124267,7 @@ async function publishedInputs(root, deps, refresh, out) {
   }
   if (file !== null) {
     try {
-      mkdirSync15(dirname30(file), { recursive: true });
+      mkdirSync14(dirname30(file), { recursive: true });
       atomicWriteFileSync(
         file,
         JSON.stringify({
@@ -124633,7 +124353,7 @@ function defaultDeps2() {
   return {
     fetchPublished: fetchSteeringIndex,
     cedar: cedarHooks,
-    cacheDir: join55(getConfigDir(), "cache", "steering-check"),
+    cacheDir: join54(getConfigDir(), "cache", "steering-check"),
     now: () => Date.now()
   };
 }
@@ -126487,7 +126207,7 @@ var init_common2 = __esm({
 function call(name, request3, result2) {
   return { call: name, request: request3, result: result2, response: responseSchema(result2) };
 }
-var unit3, count10, names, excluded, withinSchema, testRefSchema, SEARCH_GROUPS, searchHitSchema, searchCodeGraphRequest, searchCodeGraphResult, blastTargetSchema, blastGroupsSchema, getBlastRadiusRequest, getBlastRadiusResult, listUnitTestsRequest, listUnitTestsResult, flowDataSchema, flowNodeSchema, jobStepSchema, getExecutionFlowRequest, getExecutionFlowResult, traceSpecRequest, traceSpecResult, listGoverningDecisionsRequest, listGoverningDecisionsResult, getEnvVarsRequest, getEnvVarsResult, connectionSchema, getInfraRequest, getInfraResult, listCiJobsRequest, listCiJobsResult, scriptEffectSchema, listScriptsRequest, listScriptsResult, getApiDocsRequest, getApiDocsResult, exportOpenapiDraftRequest, exportOpenapiDraftResult, listCoChangesRequest, listCoChangesResult, rankSymbolsRequest, rankSymbolsResult, getRepoMapRequest, getRepoMapResult, getDomainBriefRequest, getDomainBriefResult, checkChangeRequest, checkChangeResult, findDefinitionRequest, findDefinitionResult, findReferencesRequest, findReferencesResult, findImplementationsRequest, findImplementationsResult, listNeighborsRequest, listNeighborsResult, CODEGRAPH_CALLS;
+var unit3, count10, names, excluded, withinSchema, testRefSchema, SEARCH_GROUPS, searchHitSchema, searchCodeGraphRequest, searchCodeGraphResult, blastTargetSchema, decisionItemSchema, blastGroupsSchema, getBlastRadiusRequest, getBlastRadiusResult, listUnitTestsRequest, listUnitTestsResult, flowDataSchema, flowNodeSchema, jobStepSchema, getExecutionFlowRequest, getExecutionFlowResult, traceSpecRequest, traceSpecResult, listGoverningDecisionsRequest, listGoverningDecisionsResult, getEnvVarsRequest, getEnvVarsResult, connectionSchema, getInfraRequest, getInfraResult, listCiJobsRequest, listCiJobsResult, scriptEffectSchema, listScriptsRequest, listScriptsResult, getApiDocsRequest, getApiDocsResult, exportOpenapiDraftRequest, exportOpenapiDraftResult, listCoChangesRequest, listCoChangesResult, rankSymbolsRequest, rankSymbolsResult, getRepoMapRequest, getRepoMapResult, getDomainBriefRequest, getDomainBriefResult, checkChangeRequest, checkChangeResult, findDefinitionRequest, findDefinitionResult, findReferencesRequest, findReferencesResult, findImplementationsRequest, findImplementationsResult, listNeighborsRequest, listNeighborsResult, CODEGRAPH_CALLS;
 var init_calls = __esm({
   "../../packages/codegraph/src/query/calls.ts"() {
     "use strict";
@@ -126564,6 +126284,10 @@ var init_calls = __esm({
       name: external_exports.string().min(1),
       id: external_exports.string().min(1).optional()
     }).strict();
+    decisionItemSchema = graphItemSchema.extend({
+      status: external_exports.string().optional(),
+      enforcedBy: external_exports.string().optional()
+    }).strict();
     blastGroupsSchema = external_exports.object({
       code: external_exports.array(graphItemSchema),
       data: external_exports.array(graphItemSchema),
@@ -126576,6 +126300,11 @@ var init_calls = __esm({
       entryPoints: names,
       buildTargets: names,
       deployables: names,
+      config: external_exports.array(graphItemSchema),
+      infrastructure: external_exports.array(graphItemSchema),
+      ci: external_exports.array(graphItemSchema),
+      scripts: external_exports.array(graphItemSchema),
+      packages: external_exports.array(graphItemSchema),
       tests: external_exports.array(testRefSchema),
       docs: external_exports.array(
         graphItemSchema.extend({ flag: external_exports.string().optional() }).strict()
@@ -126586,15 +126315,11 @@ var init_calls = __esm({
           status: specStatusSchema.optional()
         }).strict()
       ),
-      decisions: external_exports.array(
-        graphItemSchema.extend({
-          status: external_exports.string().optional(),
-          enforcedBy: external_exports.string().optional()
-        }).strict()
-      ),
+      decisions: external_exports.array(decisionItemSchema),
       historical: external_exports.array(
         graphItemSchema.extend({ coChangeConfidence: unit3.optional() }).strict()
-      )
+      ),
+      other: external_exports.array(graphItemSchema)
     }).partial().strict();
     getBlastRadiusRequest = requestSchema({ target: targetSchema });
     getBlastRadiusResult = external_exports.object({
@@ -126891,7 +126616,7 @@ var init_calls = __esm({
       seeds: external_exports.array(seedSchema),
       boundaryCrossings: external_exports.array(graphItemSchema),
       conventions: names,
-      decisions: external_exports.array(graphItemSchema),
+      decisions: external_exports.array(decisionItemSchema),
       needsDecisionRecord: external_exports.boolean(),
       env: external_exports.object({ added: names, missing: names }).strict(),
       infrastructure: external_exports.array(graphItemSchema),
@@ -128464,7 +128189,7 @@ var init_src9 = __esm({
 
 // src/commands/codegraph-upload/files.ts
 import { readdir as readdir5, stat as stat5 } from "node:fs/promises";
-import { join as join56, relative as relative9, sep as sep11 } from "node:path";
+import { join as join55, relative as relative9, sep as sep11 } from "node:path";
 function hasGlobChars(pattern) {
   return /[*?[\]{}]/.test(pattern);
 }
@@ -128476,7 +128201,7 @@ async function walk(root, dir, out) {
   const entries2 = await readdir5(dir, { withFileTypes: true });
   for (const entry2 of entries2) {
     if (entry2.isSymbolicLink()) continue;
-    const full = join56(dir, entry2.name);
+    const full = join55(dir, entry2.name);
     if (entry2.isDirectory()) {
       if (!SKIP_DIRS.has(entry2.name)) await walk(root, full, out);
     } else if (entry2.isFile()) {
@@ -128488,7 +128213,7 @@ async function expandPattern(root, pattern) {
   const wanted = normalize2(pattern.trim());
   if (!hasGlobChars(wanted)) {
     try {
-      const info = await stat5(join56(root, wanted));
+      const info = await stat5(join55(root, wanted));
       return info.isFile() ? [wanted] : [];
     } catch {
       return [];
@@ -128639,7 +128364,7 @@ var init_token = __esm({
 });
 
 // src/commands/codegraph-upload/run.ts
-import { join as join57 } from "node:path";
+import { join as join56 } from "node:path";
 function addDropped(into, more) {
   into.sensitiveValues += more.sensitiveValues;
   into.secretData += more.secretData;
@@ -128657,7 +128382,7 @@ async function uploadOne(deps, config, token, group, path2, totals2) {
   const label2 = `${group.kind}/${group.source} ${path2}`;
   let bytes;
   try {
-    bytes = await deps.readFile(join57(deps.cwd, path2));
+    bytes = await deps.readFile(join56(deps.cwd, path2));
   } catch (error) {
     totals2.failed += 1;
     deps.log(`error: ${label2}: cannot read the file: ${error.message}`);
@@ -128923,7 +128648,6 @@ var init_logs = __esm({
 var usage_exports = {};
 __export(usage_exports, {
   ALLOWED_KEYS: () => ALLOWED_KEYS,
-  addSteps: () => addSteps,
   buildUsageEvent: () => buildUsageEvent,
   classifyCommand: () => classifyCommand,
   classifyErrorType: () => classifyErrorType,
@@ -128931,14 +128655,10 @@ __export(usage_exports, {
   getOrCreateInstallId: () => getOrCreateInstallId,
   isTelemetryEnabled: () => isTelemetryEnabled,
   markGraphUsed: () => markGraphUsed,
-  markPipelineUsed: () => markPipelineUsed,
   recordModelTier: () => recordModelTier,
-  recordToolCall: () => recordToolCall,
   recordUsageEvent: () => recordUsageEvent,
   resetUsageSessionStats: () => resetUsageSessionStats,
   sendUsageEvent: () => sendUsageEvent,
-  setBestOfN: () => setBestOfN,
-  setByok: () => setByok,
   topLevelCommand: () => topLevelCommand
 });
 import { randomUUID as randomUUID6 } from "node:crypto";
@@ -128966,39 +128686,18 @@ function ensureDisclosureShown() {
 function emptyStats() {
   return {
     modelTiers: /* @__PURE__ */ new Set(),
-    bestOfN: 0,
-    graphUsed: false,
-    pipelineUsed: false,
-    byok: false,
-    toolCalls: {},
-    stepCount: 0
+    graphUsed: false
   };
 }
 function resetUsageSessionStats() {
   stats = emptyStats();
 }
-function recordToolCall(toolName3, count12 = 1) {
-  const key = toolName3.toLowerCase().replace(/[^a-z0-9_]/g, "_").slice(0, 32) || "unknown";
-  stats.toolCalls[key] = (stats.toolCalls[key] ?? 0) + count12;
-}
 function recordModelTier(tier) {
   if (tier) stats.modelTiers.add(tier);
 }
-function setBestOfN(n4) {
-  stats.bestOfN = Math.max(stats.bestOfN, Math.trunc(n4));
-}
 function markGraphUsed() {
   stats.graphUsed = true;
 }
-function markPipelineUsed(used = true) {
-  stats.pipelineUsed = used;
-}
-function setByok(byok) {
-  stats.byok = byok;
-}
-function addSteps(n4) {
-  stats.stepCount += Math.max(0, Math.trunc(n4));
-}
 function resolveModelTier() {
   if (stats.modelTiers.size === 0) return "";
   if (stats.modelTiers.size > 1) return "mixed";
@@ -129019,13 +128718,10 @@ function classifyErrorType(err2) {
   return "unknown";
 }
 function classifyCommand(argv, knownCommands) {
-  const rest = argv.slice(2);
-  const first = rest[0];
+  const first = argv.slice(2)[0];
   if (first && !first.startsWith("-") && knownCommands.includes(first))
     return first;
-  const hasPositional = rest.some((a) => !a.startsWith("-"));
-  if (hasPositional) return "prompt";
-  return process.stdout.isTTY ? "repl" : "stdin";
+  return "help";
 }
 function topLevelCommand(action, root) {
   let node2 = action;
@@ -129041,14 +128737,8 @@ function buildUsageEvent(input, installId) {
     arch: process.arch,
     command: input.command,
     model_tier: resolveModelTier(),
-    best_of_n: stats.bestOfN,
     graph_used: stats.graphUsed ? 1 : 0,
-    pipeline_used: stats.pipelineUsed ? 1 : 0,
-    tui: input.tui ? 1 : 0,
     headless: input.headless ?? !process.stdout.isTTY ? 1 : 0,
-    byok: stats.byok ? 1 : 0,
-    tool_calls_json: JSON.stringify(stats.toolCalls),
-    step_count: stats.stepCount,
     duration_ms: Math.max(0, Math.trunc(input.durationMs)),
     error_type: input.errorType ?? "",
     exit_status: input.exitStatus
@@ -129094,14 +128784,8 @@ var init_usage = __esm({
       "arch",
       "command",
       "model_tier",
-      "best_of_n",
       "graph_used",
-      "pipeline_used",
-      "tui",
       "headless",
-      "byok",
-      "tool_calls_json",
-      "step_count",
       "duration_ms",
       "error_type",
       "exit_status"
@@ -130137,14 +129821,12 @@ async function handleAgentEnroll(opts, writer = stdoutWriter) {
     deps
   );
   if (!result2.ok) return false;
-  await moveOffTacho(writer);
   return result2.shipping?.healthy !== false;
 }
 var init_agent_enroll = __esm({
   "src/commands/agent-enroll.ts"() {
     init_config();
     init_capture_writer();
-    init_move_off_tacho();
   }
 });
 
@@ -130676,40 +130358,10 @@ function buildProgram() {
   const program2 = new Command();
   program2.name("oxagen").description(
     "Oxagen governance CLI \u2014 spend, traces, grounding, credentials, and audit"
-  ).version(version).argument("[prompt...]", "(retired) agent turns moved to the `stella` CLI").allowExcessArguments(true).option(
+  ).version(version).option(
     "-m, --model <slug>",
     "Model slug for subcommands that price or filter by model (e.g. cost)"
-  ).action(async () => {
-    printRetiredNotice("The oxagen coding agent (REPL / one-shot prompt)");
-  });
-  function retiredCommand(name, what) {
-    program2.command(name).description(`(retired) ${what} \u2014 use the \`stella\` CLI`).argument("[args...]").allowUnknownOption(true).allowExcessArguments(true).action(async () => {
-      printRetiredNotice(what);
-    });
-  }
-  retiredCommand("view", "The agent-work dashboard");
-  retiredCommand("agents", "The fleet agents screen");
-  retiredCommand("solve", "Best-of-N task solving");
-  retiredCommand("replay", "Local turn replay");
-  retiredCommand("fleet", "The session fleet");
-  retiredCommand("sandbox", "Agent sandbox sessions");
-  retiredCommand("sandbox-template", "Sandbox template management");
-  retiredCommand("code", "Local code diff/patch/format utilities");
-  retiredCommand("eval", "Eval datasets and runs");
-  retiredCommand("file-lock", "Agent file locks");
-  retiredCommand("a2a", "The Agent2Agent protocol surface");
-  retiredCommand("models", "On-device model runtime selection");
-  retiredCommand("skill", "Loadable skill bundles");
-  retiredCommand("prompt", "Saved prompt snippets");
-  retiredCommand("command", "User-defined slash commands");
-  retiredCommand("rules", "Local agent rule files");
-  retiredCommand("settings", "The local settings.json driver");
-  retiredCommand("config", "The local CLI config file");
-  retiredCommand("mcp", "Local MCP server configuration");
-  retiredCommand("import", "Foreign-platform artifact import");
-  retiredCommand("pr", "Pull-request CI watching and merging");
-  retiredCommand("recover", "Agent commit-ledger recovery");
-  retiredCommand("lineage", "The subagent dispatch-tree explorer");
+  );
   program2.command("hook", { hidden: true }).description(
     "The command hook a wrapped harness runs: reads the payload on stdin and prints the answer"
   ).helpOption(false).allowUnknownOption().allowExcessArguments().action(async () => {
@@ -131410,52 +131062,6 @@ function buildProgram() {
     const { handleTelemetry: handleTelemetry2 } = await Promise.resolve().then(() => (init_telemetry(), telemetry_exports));
     handleTelemetry2(subcommand);
   });
-  const tacho = program2.command("tacho", { hidden: true }).description(
-    "Deprecated. Wrap this machine's agent sessions: record and gate them through Oxagen"
-  );
-  tacho.hook("preSubcommand", (_group, subcommand) => {
-    printTachoAliasNotice(subcommand.name());
-  });
-  tacho.command("enroll").description(
-    "Enroll this machine: device key, host API key, collector service, Claude Code hooks"
-  ).option(
-    "--token <apiKey>",
-    "Platform API token (default: the logged-in session)"
-  ).option("--org <slug>", "Organization slug (default: the logged-in org)").option(
-    "--workspace <slug>",
-    "Workspace slug (default: the logged-in workspace)"
-  ).option(
-    "--port <n>",
-    "Loopback port for the collector daemon (1024 to 65535)",
-    parsePort2
-  ).option("--no-service", "Do not install the user service").option("--managed", "Also print the managed settings document for MDM").option(
-    "--print-managed",
-    "Only print the managed settings document; do not write user settings"
-  ).option("--force", "Enroll again even if already enrolled").option(
-    "--harness <list>",
-    "Harnesses to hook: claude-code, codex, cursor, stella, or a comma list such as claude-code,cursor"
-  ).option("--verify", "Run a headless Claude Code turn afterwards").option("--allow-root", "Enroll even when running as root").action(
-    async (opts) => {
-      const { handleTachoEnroll: handleTachoEnroll2 } = await Promise.resolve().then(() => (init_tacho(), tacho_exports));
-      if (!await handleTachoEnroll2(opts)) process.exitCode = 1;
-    }
-  );
-  addHostWrapCommands(tacho);
-  tacho.command("status").description("Enrollment, daemon, hooks, bundle, and spool status").option("--json", "Machine-readable output").action(async (opts) => {
-    const { handleTachoStatus: handleTachoStatus2 } = await Promise.resolve().then(() => (init_tacho(), tacho_exports));
-    if (!await handleTachoStatus2(opts)) process.exitCode = 1;
-  });
-  tacho.command("unenroll").description(
-    "Remove the hooks and the service, revoke the enrollment, delete the host key"
-  ).option("--token <apiKey>", "Operator token for the server-side revoke").option("--purge", "Also delete the local WAL, spool, and quarantine").option("--reason <text>", "Reason recorded with the revoke").option(
-    "--harness <name>",
-    "The agent to unenroll, by the harness it hooks, when this machine holds more than one enrollment"
-  ).option("--all", "Unenroll every agent on this machine").action(
-    async (opts) => {
-      const { handleTachoUnenroll: handleTachoUnenroll2 } = await Promise.resolve().then(() => (init_tacho(), tacho_exports));
-      if (!await handleTachoUnenroll2(opts)) process.exitCode = 1;
-    }
-  );
   program2.command("login").description(
     "Authenticate the CLI \u2014 opens a browser by default (interactive). Use --token for CI/headless."
   ).option(
@@ -131836,7 +131442,6 @@ var init_program = __esm({
   "src/program.ts"() {
     init_esm();
     init_package();
-    init_retired();
     ({ version } = package_default);
     ENROLLMENT_TOKEN_PREFIX = "oxe_1time_";
   }
@@ -131927,14 +131532,14 @@ var init_main2 = __esm({
 });
 
 // src/index.ts
-var MACHINE_COMMANDS2 = ["daemon", "mcp-stdio", "credential", "github", "arp"];
+var MACHINE_COMMANDS = ["daemon", "mcp-stdio", "credential", "github", "arp"];
 var command = process.argv[2];
 if (command === "hook") {
   Promise.resolve().then(() => (init_hook2(), hook_exports)).then(({ runHook: runHook2 }) => runHook2(process.argv)).catch(() => {
     process.stdout.write("{}\n");
     process.exitCode = 0;
   });
-} else if (command !== void 0 && MACHINE_COMMANDS2.includes(command)) {
+} else if (command !== void 0 && MACHINE_COMMANDS.includes(command)) {
   Promise.resolve().then(() => (init_recorder2(), recorder_exports)).then(({ runRecorderCommand: runRecorderCommand2 }) => runRecorderCommand2(process.argv)).catch((error) => {
     process.stderr.write(
       `oxagen ${command}: ${error instanceof Error ? error.message : String(error)}