@raidiant/notifai 7.0.2 → 9.0.0

package/src/commands.test.ts

@@ -42,6 +42,7 @@ import {
   configUnsetCommand,
   contradictingAnswer,
   describeHookFailure,
+  devicesCommand,
   doctorCommand,
   EXIT,
   hooksInstallCommand,
@@ -62,17 +63,26 @@ import {
 import {
   applyPlan,
   buildHookConfig,
+  hookCommand,
   codexHookIdentityHash,
   codexTrustKey,
   findInstallations,
+  handlerEvent,
+  settingsFile,
 } from './install-hooks.js'
 import { readSessionState, writeProjectSession, writeSessionState } from './hooks.js'
 import { nativeSkills as realNativeSkills, type NativeSkill, type NativeSkills, type SkillScope } from './native-skills.js'
 import { CONFIG_KEYS, loadConfig, personalProjectConfigPath, stateDir } from './config.js'
-import { createLogger, logsDiskUsage, readLogRecords } from './logging.js'
+import { SETUP_PROOF_STALE_MS, writeSetupProof } from './commands-setup-proof.js'
+import { resetLatestPublishedCliVersionForTest } from './cli-release.js'
+import { activeLogPath, createLogger, logsDiskUsage, readLogRecords } from './logging.js'
 import { hookAdapterPath, inspectHookAdapter } from './hook-adapter.js'
 import type { Tone } from './ui/theme.js'
 
+afterEach(() => {
+  resetLatestPublishedCliVersionForTest()
+})
+
 /**
  * The release tag this build pins the agent skill to.
  *
@@ -129,6 +139,17 @@ const currentCompatibility: CompatibilityResponse = {
       replacement_available: false,
       rollout_complete: false,
     },
+    {
+      platform: 'android',
+      recommended_version: null,
+      recommended_build: null,
+      minimum_receive_build: null,
+      minimum_answer_build: null,
+      deprecation: null,
+      sunset: null,
+      replacement_available: false,
+      rollout_complete: false,
+    },
   ],
   server_capabilities: ['answer', 'agent_acknowledgement'],
 }
@@ -316,6 +337,7 @@ function makeDeps(io: CapturedIo, client: ApiClient): CommandDeps {
     hookAdapterHome: path.join(testRoot, 'home'),
     cwd: os.tmpdir(),
     clientFactory: () => withCompatibilityDefaults(client),
+    fetchImpl: async () => new Response('{}', { status: 503 }),
   }
 }
 
@@ -370,6 +392,8 @@ const reply: ReplyView = {
   device_id: 'dev_test',
   device_name: 'iPhone',
   text: 'yes, after the migration',
+  answers: [],
+  source: null,
   created_at: '2026-08-01T18:01:00.000Z',
 }
 
@@ -453,6 +477,93 @@ describe('command contracts', () => {
     expect(io.outLines[0]).toBe('macos capability contract v1 (payload limit 4096 bytes)')
   })
 
+  it('passes the selected Android platform through to the capability client', async () => {
+    const io = new CapturedIo()
+    let requestedPlatform: string | undefined
+    const document = CAPABILITIES_V1.describe('android')!
+    const client = {
+      capabilities: async (platform?: string) => {
+        requestedPlatform = platform
+        return document
+      },
+    } as unknown as ApiClient
+
+    expect(await capabilitiesCommand(makeDeps(io, client), { platform: 'android' })).toBe(
+      EXIT.ok,
+    )
+    expect(requestedPlatform).toBe('android')
+    expect(io.outLines[0]).toBe(
+      'android capability contract v1 (payload limit 4096 bytes)',
+    )
+  })
+
+  it('filters Device Installations by Android in human and JSON output', async () => {
+    const devices = [
+      {
+        device_id: 'dev_ios',
+        display_name: 'iPhone',
+        platform: 'ios' as const,
+        permission_status: 'authorized',
+        registration_healthy: true,
+        app_version: '1.0.0',
+        app_build: '1',
+        os_version: '19',
+        capabilities: ['answer'] as const,
+        support: currentSupport,
+        support_state: 'current' as const,
+        derived_status: 'working' as const,
+        status_message: null,
+        last_seen_at: null,
+      },
+      {
+        device_id: 'dev_android',
+        display_name: 'Pixel',
+        platform: 'android' as const,
+        permission_status: 'authorized',
+        registration_healthy: true,
+        app_version: '1.0.0',
+        app_build: '2',
+        os_version: '16',
+        capabilities: ['answer'] as const,
+        support: currentSupport,
+        support_state: 'current' as const,
+        derived_status: 'working' as const,
+        status_message: null,
+        last_seen_at: null,
+      },
+    ]
+    const client = { listDevices: async () => ({ devices }) } as unknown as ApiClient
+
+    const human = new CapturedIo()
+    expect(
+      await devicesCommand(makeDeps(human, client), { platform: 'android' }),
+    ).toBe(EXIT.ok)
+    expect(human.outLines).toEqual(['dev_android  Pixel  android  Working'])
+
+    const json = new CapturedIo()
+    expect(
+      await devicesCommand(makeDeps(json, client), { platform: 'android', json: true }),
+    ).toBe(EXIT.ok)
+    expect(JSON.parse(json.outLines[0]!)['devices']).toEqual([devices[1]])
+  })
+
+  it('rejects an unknown Device Installation platform filter locally', async () => {
+    const io = new CapturedIo()
+    let calls = 0
+    const client = {
+      listDevices: async () => {
+        calls += 1
+        return { devices: [] }
+      },
+    } as unknown as ApiClient
+
+    expect(await devicesCommand(makeDeps(io, client), { platform: 'linux' })).toBe(
+      EXIT.usage,
+    )
+    expect(calls).toBe(0)
+    expect(io.errLines.join('\n')).toContain('ios or macos or android')
+  })
+
   it('rejects an invalid draft before calling submit', async () => {
     const io = new CapturedIo()
     let submitCalls = 0
@@ -474,6 +585,188 @@ describe('command contracts', () => {
     expect(io.errLines.join('\n')).toContain('project')
   })
 
+  it('prints the exact idempotency key needed after an ambiguous submit failure', async () => {
+    const io = new CapturedIo()
+    let attemptedKey = ''
+    const client = {
+      submit: async (body: SubmitNotificationRequestT) => {
+        attemptedKey = body.idempotency_key
+        throw new NetworkError('Connection closed before a response arrived')
+      },
+    } as unknown as ApiClient
+
+    const root = mkdtempSync(path.join(os.tmpdir(), 'notifai-send-attempt-'))
+    const deps = makeDeps(io, client)
+    deps.env = {
+      XDG_CONFIG_HOME: path.join(root, 'config'),
+      XDG_STATE_HOME: path.join(root, 'state'),
+    }
+    deps.logger = createLogger({ env: deps.env, cmd: 'send' })
+    expect(
+      await sendCommand(deps, {
+        kind: 'done',
+        title: 'Checks finished',
+        body: 'All checks passed.',
+      }),
+    ).toBe(EXIT.network)
+
+    expect(attemptedKey).toMatch(/^cli-/)
+    expect(io.errLines.join('\n')).toContain(`--idempotency-key ${attemptedKey}`)
+    expect(
+      readLogRecords(deps.env, { event: ['send.attempt'] }).records.at(-1)?.data,
+    ).toMatchObject({
+      idempotency_key: attemptedKey,
+      kind: 'done',
+      title_chars: 'Checks finished'.length,
+      session_id: null,
+    })
+    rmSync(root, { recursive: true, force: true })
+  })
+
+  it('prints the same generated key for an ambiguous server failure', async () => {
+    const io = new CapturedIo()
+    let attemptedKey = ''
+    const client = {
+      submit: async (body: SubmitNotificationRequestT) => {
+        attemptedKey = body.idempotency_key
+        throw new ApiCallError(503, 'temporarily_unavailable', 'Try again later.')
+      },
+    } as unknown as ApiClient
+
+    expect(
+      await sendCommand(makeDeps(io, client), {
+        kind: 'failed',
+        title: 'Validation could not finish',
+        body: 'The service failed while accepting the result.',
+      }),
+    ).toBe(EXIT.network)
+    expect(io.errLines.join('\n')).toContain(`--idempotency-key ${attemptedKey}`)
+  })
+
+  it('routes a send with no active Companion devices into the setup coordinator', async () => {
+    const io = new CapturedIo()
+    let attemptedKey = ''
+    const client = {
+      submit: async (body: SubmitNotificationRequestT) => {
+        attemptedKey = body.idempotency_key
+        throw new ApiCallError(
+          409,
+          'no_active_devices',
+          'No enabled active Device Installation can receive this request.',
+          'Open the Companion App and enable notifications.',
+        )
+      },
+    } as unknown as ApiClient
+
+    expect(
+      await sendCommand(makeDeps(io, client), {
+        kind: 'done',
+        title: 'Checks finished',
+        body: 'All checks passed.',
+      }),
+    ).toBe(EXIT.failed)
+
+    expect(io.errLines.join('\n')).toMatch(/next:.*`notifai init`.*Companion/i)
+    expect(io.errLines.join('\n')).toContain(`--idempotency-key ${attemptedKey}`)
+    expect(io.errLines.join('\n')).toMatch(/verification request does not replace this Agent Event/i)
+  })
+
+  it('routes a send from an unpaired machine into the same setup coordinator', async () => {
+    const io = new CapturedIo()
+    const deps = makeDeps(io, {} as ApiClient)
+    deps.store.load = () => null
+
+    expect(
+      await sendCommand(deps, {
+        kind: 'done',
+        title: 'Checks finished',
+        body: 'All checks passed.',
+      }),
+    ).toBe(EXIT.auth)
+
+    expect(io.errLines.join('\n')).toMatch(/`notifai init`.*login.*device setup/i)
+  })
+
+  it('authors and validates an Android-specific Notification Request', async () => {
+    const io = new CapturedIo()
+    let submitted: SubmitNotificationRequestT | undefined
+    const client = {
+      submit: async (body: SubmitNotificationRequestT) => {
+        submitted = body
+        return receipt
+      },
+    } as unknown as ApiClient
+
+    expect(
+      await sendCommand(makeDeps(io, client), {
+        kind: 'done',
+        title: 'Android build finished',
+        body: 'All checks passed.',
+        platform: 'android',
+        sound: 'none',
+        data: ['run_id=42'],
+      }),
+    ).toBe(EXIT.ok)
+    expect(submitted?.draft.platform).toEqual({
+      android: { sound: null, custom_data: { run_id: '42' } },
+    })
+    expect(io.errLines).toEqual([])
+  })
+
+  it('prints Android downgrade warnings before submitting', async () => {
+    const io = new CapturedIo()
+    let submitCalls = 0
+    const client = {
+      submit: async () => {
+        submitCalls += 1
+        return receipt
+      },
+    } as unknown as ApiClient
+
+    expect(
+      await sendCommand(makeDeps(io, client), {
+        kind: 'update',
+        title: 'Android evidence',
+        body: 'See the attached result.',
+        platform: 'android',
+        image: ['med_result'],
+        threadId: 'android-results',
+      }),
+    ).toBe(EXIT.ok)
+    expect(submitCalls).toBe(1)
+    expect(io.errLines).toEqual(
+      expect.arrayContaining([
+        expect.stringContaining('presentation.media'),
+        expect.stringContaining('platform.android.thread_id'),
+      ]),
+    )
+  })
+
+  it('rejects an Android interruption level before submission', async () => {
+    const io = new CapturedIo()
+    let submitCalls = 0
+    const client = {
+      submit: async () => {
+        submitCalls += 1
+        return receipt
+      },
+    } as unknown as ApiClient
+
+    expect(
+      await sendCommand(makeDeps(io, client), {
+        kind: 'update',
+        title: 'Android update',
+        body: 'Ready.',
+        platform: 'android',
+        level: 'active',
+      }),
+    ).toBe(EXIT.usage)
+    expect(submitCalls).toBe(0)
+    expect(io.errLines.join('\n')).toContain(
+      'Android does not support caller-selected interruption levels',
+    )
+  })
+
   it('infers Project and exact Claude Source Context without printing the opaque id', async () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'Notifai Project '))
     const io = new CapturedIo()
@@ -557,6 +850,48 @@ describe('command contracts', () => {
     })
   })
 
+  it('uses the exact Orca worktree title for an active Codex session send', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-orca-codex-title-'))
+    const io = new CapturedIo()
+    let submitted: SubmitNotificationRequestT | undefined
+    const client = {
+      submit: async (body: SubmitNotificationRequestT) => {
+        submitted = body
+        return receipt
+      },
+    } as unknown as ApiClient
+    const worktreeId = `repo-123::${cwd}`
+    const deps = {
+      ...makeDeps(io, client),
+      cwd,
+      env: {
+        XDG_CONFIG_HOME: path.join(cwd, 'config'),
+        XDG_STATE_HOME: path.join(cwd, 'state'),
+        CODEX_THREAD_ID: 'orca-codex-thread',
+        TERM_PROGRAM: 'Orca',
+        ORCA_WORKTREE_ID: worktreeId,
+      },
+      orcaSessionTitle: (lookupEnv: NodeJS.ProcessEnv) => {
+        expect(lookupEnv['ORCA_WORKTREE_ID']).toBe(worktreeId)
+        return 'Worker - semantic session implementation'
+      },
+    }
+
+    expect(
+      await sendCommand(deps, {
+        title: 'Resolver implemented',
+        body: 'The worktree title belongs to every harness Orca starts in it.',
+        kind: 'done',
+      }),
+    ).toBe(EXIT.ok)
+
+    expect(submitted?.draft.source).toMatchObject({
+      session_id: 'orca-codex-thread',
+      session_label: 'Worker - semantic session implementation',
+      harness: 'codex',
+    })
+  })
+
   it('falls back safely when Orca returns a private path as its title', async () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-orca-private-title-'))
     const io = new CapturedIo()
@@ -801,7 +1136,7 @@ describe('command contracts', () => {
   })
 
   it('keeps only the current public notification-authoring flags', () => {
-    const source = readFileSync(new URL('./main.ts', import.meta.url), 'utf8')
+    const source = readFileSync(new URL('./program.ts', import.meta.url), 'utf8')
     expect(source).not.toContain(".option('--badge")
     expect(source).not.toContain(".option('--relevance")
     expect(source).not.toContain(".option('--target-content-id")
@@ -823,33 +1158,6 @@ describe('command contracts', () => {
     expect(source).not.toContain('Kind profiles apply automatically')
   })
 
-  it('rejects a question nobody will wait for', async () => {
-    // --reply asks; --no-block declares nothing will wait. The answer would be
-    // captured server-side and then reachable only by hand, so the user taps a
-    // real button and nothing happens — worse than never asking, because it
-    // spends their attention and their trust in the channel.
-    const io = new CapturedIo()
-    let submitCalls = 0
-    const client = {
-      submit: async () => {
-        submitCalls += 1
-        return receipt
-      },
-    } as unknown as ApiClient
-
-    expect(
-      await sendCommand(makeDeps(io, client), {
-        title: 'Question',
-        body: 'Deploy?',
-        reply: true,
-        replyWindow: 3_600,
-        noBlock: true,
-      }),
-    ).toBe(EXIT.usage)
-    expect(submitCalls).toBe(0)
-    expect(io.errLines.join('\n')).toContain('notifai ask')
-  })
-
   it('maps reply flags into the draft and waits for the answer', async () => {
     const io = new CapturedIo()
     let submitted: SubmitNotificationRequestT | undefined
@@ -907,7 +1215,7 @@ describe('command contracts', () => {
 
     expect(await sendCommand(makeDeps(io, client), flags)).toBe(EXIT.ok)
     expect(io.errLines).toEqual([
-      'Heads up: this notification ends with a question but has no reply action. Add --reply (and optionally --reply-choice) so it can be answered from the notification.',
+      'Heads up: this notification ends with a question but has no reply action. Add --reply (and optionally --choice) so it can be answered from the notification.',
     ])
   })
 
@@ -929,7 +1237,7 @@ describe('command contracts', () => {
     expect(io.errLines).toEqual([])
   })
 
-  it('rejects --reply-choice without the --reply action it configures', async () => {
+  it('rejects --choice without the --reply action it configures', async () => {
     const io = new CapturedIo()
     let submitCalls = 0
     const client = {
@@ -943,12 +1251,12 @@ describe('command contracts', () => {
       await sendCommand(makeDeps(io, client), { kind: 'update',
         title: 'Deploy?',
         body: 'Choose when ready.',
-        replyChoice: ['Now', 'Later'],
+        choice: ['Now', 'Later'],
       }),
     ).toBe(EXIT.usage)
     expect(submitCalls).toBe(0)
     expect(io.errLines).toEqual([
-      'Use --reply with --reply-timeout, --reply-window, --reply-choice, or --no-block.',
+      'Use --reply with --reply-timeout, --reply-window, or --choice.',
     ])
   })
 
@@ -1015,8 +1323,11 @@ describe('command contracts', () => {
       request_id: receipt.request_id,
       sequence: reply.seq,
       device: reply.device_name,
-      text: reply.text,
+      text_chars: reply.text.length,
+      answers_count: reply.answers.length,
     })
+    const raw = readFileSync(activeLogPath(deps.env), 'utf8')
+    expect(raw).not.toContain(reply.text)
   })
 
   it('backs off and retries a transient network error while waiting', async () => {
@@ -1148,13 +1459,14 @@ describe('command contracts', () => {
     })
   })
 
-  it('prints an NDJSON receipt before waiting and a result record on exit 3', async () => {
+  it('prints one combined reply_result object on exit 3, nothing before the wait', async () => {
     const io = new CapturedIo()
     let now = 0
     const client = {
       submit: async () => receipt,
       replies: async (_requestId: string, options: { waitSeconds: number }) => {
-        expect(JSON.parse(io.outLines[0] ?? '{}')).toEqual({ type: 'receipt', receipt })
+        // Nothing on stdout mid-wait: the single object arrives at the end.
+        expect(io.outLines).toHaveLength(0)
         now += options.waitSeconds * 1_000
         return replyResponse()
       },
@@ -1170,11 +1482,12 @@ describe('command contracts', () => {
         json: true,
       }),
     ).toBe(EXIT.noReply)
-    expect(io.outLines).toHaveLength(2)
+    expect(io.outLines).toHaveLength(1)
     // `degraded` is part of the shape on every reply wait, not only when it is
     // true: an agent must be able to read it without knowing it might be absent.
-    expect(JSON.parse(io.outLines[1] ?? '{}')).toEqual({
+    expect(JSON.parse(io.outLines[0] ?? '{}')).toEqual({
       type: 'reply_result',
+      receipt,
       request_id: receipt.request_id,
       reply_expires_at: '2026-08-02T18:00:00.000Z',
       replies: [],
@@ -1189,7 +1502,7 @@ describe('command contracts', () => {
     expect(io.errLines.join('\n')).toContain(`notifai close ${receipt.request_id}`)
   })
 
-  it('prints the receipt and reply result as two NDJSON records when answered', async () => {
+  it('prints one combined reply_result object with the receipt when answered', async () => {
     const io = new CapturedIo()
     const client = {
       submit: async () => receipt,
@@ -1205,10 +1518,10 @@ describe('command contracts', () => {
         json: true,
       }),
     ).toBe(EXIT.ok)
-    expect(io.outLines).toHaveLength(2)
-    expect(JSON.parse(io.outLines[0] ?? '{}')).toEqual({ type: 'receipt', receipt })
-    expect(JSON.parse(io.outLines[1] ?? '{}')).toEqual({
+    expect(io.outLines).toHaveLength(1)
+    expect(JSON.parse(io.outLines[0] ?? '{}')).toEqual({
       type: 'reply_result',
+      receipt,
       request_id: receipt.request_id,
       reply_expires_at: '2026-08-02T18:00:00.000Z',
       replies: [reply],
@@ -1220,6 +1533,41 @@ describe('command contracts', () => {
     })
   })
 
+  it('still prints the one reply_result object when the wait itself faults', async () => {
+    const io = new CapturedIo()
+    const client = {
+      submit: async () => receipt,
+      replies: async () => {
+        throw new ApiCallError(404, 'not_found', 'no such request')
+      },
+    } as unknown as ApiClient
+
+    expect(
+      await sendCommand(makeDeps(io, client), {
+        title: 'Question',
+        body: 'Deploy?',
+        reply: true,
+        replyTimeout: 10,
+        json: true,
+      }),
+    ).toBe(EXIT.failed)
+    expect(io.outLines).toHaveLength(1)
+    // The send is durable even though the wait failed; `degraded: true` says
+    // "could not find out", not "no answer".
+    expect(JSON.parse(io.outLines[0] ?? '{}')).toEqual({
+      type: 'reply_result',
+      receipt,
+      request_id: receipt.request_id,
+      replies: [],
+      agent_acknowledgement_required: true,
+      agent_acknowledgement_text_required: true,
+      agent_acknowledgement: null,
+      acknowledgement_command: null,
+      degraded: true,
+    })
+    expect(io.errLines.join('\n')).toContain('reply wait failed')
+  })
+
   it('acknowledges non-interactively, trims text, emits JSON, and logs request identity', async () => {
     const io = new CapturedIo()
     let submitted: { requestId: string; text: string } | undefined
@@ -1270,6 +1618,10 @@ describe('command contracts', () => {
       'acknowledgement.attempted',
       'acknowledgement.outcome',
     ])
+    const raw = readFileSync(activeLogPath(deps.env), 'utf8')
+    expect(raw).not.toContain('I will deploy staging now.')
+    expect(events[0]?.data).toMatchObject({ characters: 'I will deploy staging now.'.length })
+    expect(events[1]?.data).toMatchObject({ text_chars: 'I will deploy staging now.'.length })
   })
 
   it('clears a matching active-session obligation after acknowledgement success', async () => {
@@ -1488,6 +1840,113 @@ describe('command contracts', () => {
     })
   })
 
+  it('close --pending withdraws an unpushed registration so a later Stop cannot send it', async () => {
+    const io = new CapturedIo()
+    const client = {
+      closeReplies: async () => {
+        throw new Error('unpushed questions must not call the server')
+      },
+    } as unknown as ApiClient
+    const deps = makeDeps(io, client)
+    const root = mkdtempSync(path.join(os.tmpdir(), 'notifai-close-unpushed-'))
+    deps.cwd = root
+    deps.env = {
+      XDG_CONFIG_HOME: path.join(root, 'config'),
+      XDG_STATE_HOME: path.join(root, 'state'),
+    }
+    writeSessionState('close-unpushed', deps.env, {
+      pending: [{ question: 'Ship it?', question_id: 'q_local' }],
+    })
+    writeProjectSession(root, deps.env, 'close-unpushed', Date.now(), 'codex')
+
+    expect(await closeCommand(deps, undefined, { pending: true, json: true })).toBe(EXIT.ok)
+    expect(JSON.parse(io.outLines[0] ?? '{}')).toEqual({
+      session_id: 'close-unpushed',
+      withdrawn: [{ question: 'Ship it?', question_id: 'q_local' }],
+      closed: [],
+    })
+    expect(readSessionState('close-unpushed', deps.env).pending).toBeUndefined()
+  })
+
+  it('close withdraws one unpushed question by the ask id', async () => {
+    const io = new CapturedIo()
+    const client = {
+      closeReplies: async () => {
+        throw new Error('unpushed questions must not call the server')
+      },
+    } as unknown as ApiClient
+    const deps = makeDeps(io, client)
+    const root = mkdtempSync(path.join(os.tmpdir(), 'notifai-close-one-unpushed-'))
+    deps.cwd = root
+    deps.env = {
+      XDG_CONFIG_HOME: path.join(root, 'config'),
+      XDG_STATE_HOME: path.join(root, 'state'),
+    }
+    writeSessionState('close-one', deps.env, {
+      pending: [
+        { question: 'Ship it?', question_id: 'q_local' },
+        { question: 'Keep this?', question_id: 'q_keep' },
+      ],
+    })
+    writeProjectSession(root, deps.env, 'close-one', Date.now(), 'codex')
+
+    expect(await closeCommand(deps, 'q_local', { json: true })).toBe(EXIT.ok)
+    expect(JSON.parse(io.outLines[0] ?? '{}')).toEqual({
+      session_id: 'close-one',
+      withdrawn: [{ question: 'Ship it?', question_id: 'q_local' }],
+      closed: [],
+    })
+    expect(readSessionState('close-one', deps.env).pending?.map((entry) => entry.question_id)).toEqual([
+      'q_keep',
+    ])
+  })
+
+  it('close --pending closes live questions and leaves nothing for a later Stop to push', async () => {
+    const io = new CapturedIo()
+    const closed: string[] = []
+    const client = {
+      closeReplies: async (requestId: string) => {
+        closed.push(requestId)
+        return replyResponse([])
+      },
+    } as unknown as ApiClient
+    const deps = makeDeps(io, client)
+    const root = mkdtempSync(path.join(os.tmpdir(), 'notifai-close-pending-mix-'))
+    deps.cwd = root
+    deps.env = {
+      XDG_CONFIG_HOME: path.join(root, 'config'),
+      XDG_STATE_HOME: path.join(root, 'state'),
+    }
+    writeSessionState('close-mix', deps.env, {
+      pending: [
+        { question: 'Unpushed?', question_id: 'q_local' },
+        {
+          question: 'Already on a device?',
+          request_id: receipt.request_id,
+          collapse_key: 'question-live',
+          device_ids: ['dev_iphone'],
+        },
+      ],
+    })
+    writeProjectSession(root, deps.env, 'close-mix', Date.now(), 'codex')
+
+    expect(await closeCommand(deps, undefined, { pending: true, json: true })).toBe(EXIT.ok)
+    expect(closed).toEqual([receipt.request_id])
+    expect(JSON.parse(io.outLines[0] ?? '{}')).toMatchObject({
+      session_id: 'close-mix',
+      withdrawn: [{ question: 'Unpushed?', question_id: 'q_local' }],
+      closed: [receipt.request_id],
+    })
+    expect(readSessionState('close-mix', deps.env).pending).toBeUndefined()
+  })
+
+  it('close requires a request id or --pending', async () => {
+    const io = new CapturedIo()
+    const client = {} as unknown as ApiClient
+    expect(await closeCommand(makeDeps(io, client), undefined, {})).toBe(EXIT.usage)
+    expect(io.errLines.join('\n')).toContain('Pass a request id or --pending.')
+  })
+
   it('passes the replies cursor and prints replies for later retrieval', async () => {
     const io = new CapturedIo()
     let requested: { waitSeconds: number; afterSeq: number } | undefined
@@ -1566,8 +2025,9 @@ describe('command contracts', () => {
     writeProjectSession(root, deps.env, 'pending-multi', Date.now(), 'codex')
 
     expect(await repliesCommand(deps, undefined, { pending: true })).toBe(EXIT.ok)
-    expect(io.outLines[0]).toBe('pending request req_first')
-    expect(io.outLines[1]).toContain('yes, after the migration')
+    expect(io.outLines[0]).toBe('unpushed question: Not yet asked?')
+    expect(io.outLines.join('\n')).toContain('pending request req_first')
+    expect(io.outLines.join('\n')).toContain('yes, after the migration')
     expect(io.outLines.join('\n')).toContain('req_second')
   })
 
@@ -1764,13 +2224,188 @@ describe('command contracts', () => {
   })
 })
 
+describe('credential origin pinning', () => {
+  it('never sends the machine bearer to a flag or env origin override', async () => {
+    const io = new CapturedIo()
+    const seen: { baseUrl: string; bearer: string | null }[] = []
+    const client = {
+      submit: async () => receipt,
+    } as unknown as ApiClient
+    const deps = makeDeps(io, client)
+    deps.env = { ...deps.env, NOTIFAI_BASE_URL: 'https://attacker.example' }
+    deps.clientFactory = (baseUrl, bearer) => {
+      seen.push({ baseUrl, bearer })
+      return withCompatibilityDefaults(client)
+    }
+
+    expect(
+      await sendCommand(deps, {
+        kind: 'update',
+        title: 'T',
+        body: 'B',
+        baseUrl: 'https://attacker.flag',
+      }),
+    ).toBe(EXIT.ok)
+
+    expect(seen).toEqual([
+      {
+        baseUrl: 'https://test.notifai.invalid',
+        bearer: 'Bearer nfm_mac_test.test-secret',
+      },
+    ])
+    expect(io.errLines.join('\n')).toContain('Ignoring base_url from flag')
+    expect(io.errLines.join('\n')).not.toContain('test-secret')
+    expect(io.errLines.join('\n')).not.toContain('nfm_')
+    expect(io.errLines.join('\n')).not.toContain('https://attacker.example')
+    expect(io.errLines.join('\n')).not.toContain('https://attacker.flag')
+  })
+
+  it('lets unsigned-in login target an origin override', async () => {
+    const io = new CapturedIo()
+    const seen: { baseUrl: string; bearer: string | null }[] = []
+    let beginBody: Parameters<ApiClient['beginPairing']>[0] | null = null
+    let now = 0
+    const client = {
+      beginPairing: async (body: Parameters<ApiClient['beginPairing']>[0]) => {
+        beginBody = body
+        return {
+          pairing_id: 'pair_test',
+          code: 'ABCD-EFGH',
+          approve_url: 'https://selfhost.example/pair/ABCD-EFGH',
+          expires_at: new Date(10_000).toISOString(),
+          poll_interval_seconds: 1,
+        }
+      },
+      pollPairing: async () => ({ status: 'approved', machine_id: 'mac_new' }),
+    } as unknown as ApiClient
+    const saved: { baseUrl?: string } = {}
+    const deps: CommandDeps = {
+      ...makeDeps(io, client),
+      now: () => now,
+      sleep: async (milliseconds: number) => {
+        now += milliseconds
+      },
+      store: {
+        load: () => null,
+        save: (credential) => {
+          saved.baseUrl = credential.baseUrl
+        },
+        clear: () => {},
+        describe: () => 'test credential store',
+      },
+      clientFactory: (baseUrl, bearer) => {
+        seen.push({ baseUrl, bearer })
+        return withCompatibilityDefaults(client)
+      },
+    }
+
+    expect(await loginCommand(deps, { baseUrl: 'https://selfhost.example', open: false })).toBe(
+      EXIT.ok,
+    )
+    expect(seen[0]).toEqual({ baseUrl: 'https://selfhost.example', bearer: null })
+    expect(saved.baseUrl).toBe('https://selfhost.example')
+    expect(beginBody).toMatchObject({
+      machine_name: expect.any(String),
+      credential_hash: expect.stringMatching(/^[a-f0-9]{64}$/),
+      poll_verifier_hash: expect.stringMatching(/^[a-f0-9]{64}$/),
+      confirmation_hash: expect.stringMatching(/^[a-f0-9]{64}$/),
+    })
+    expect(io.outLines[1]).toMatch(
+      /^Approve this machine at: https:\/\/selfhost\.example\/pair\/ABCD-EFGH#confirmation_secret=[A-Za-z0-9_-]{43}$/,
+    )
+  })
+
+  it('stops login when the approving account has no product access', async () => {
+    const io = new CapturedIo()
+    let now = 0
+    const client = {
+      beginPairing: async () => ({
+        pairing_id: 'pair_test',
+        code: 'ABCD-EFGH',
+        approve_url: 'https://app.notifai.sh/pair/ABCD-EFGH',
+        expires_at: new Date(10_000).toISOString(),
+        poll_interval_seconds: 1,
+      }),
+      pollPairing: async () => ({
+        status: 'no_active_plan',
+        next_action: 'Ask the account owner for Alpha access.',
+      }),
+    } as unknown as ApiClient
+    const deps: CommandDeps = {
+      ...makeDeps(io, client),
+      now: () => now,
+      sleep: async (milliseconds: number) => {
+        now += milliseconds
+      },
+    }
+
+    expect(await loginCommand(deps, { open: false })).toBe(EXIT.auth)
+    expect(io.errLines).toEqual([
+      'This account has no active plan or temporary Alpha access.',
+      'next: Ask the account owner for Alpha access.',
+      'After access is granted, run `notifai login` again.',
+    ])
+  })
+
+  it('keeps notification titles out of send logs', async () => {
+    const io = new CapturedIo()
+    const root = mkdtempSync(path.join(os.tmpdir(), 'notifai-send-log-'))
+    const client = { submit: async () => receipt } as unknown as ApiClient
+    const deps = makeDeps(io, client)
+    deps.env = {
+      XDG_CONFIG_HOME: path.join(root, 'config'),
+      XDG_STATE_HOME: path.join(root, 'state'),
+    }
+    deps.logger = createLogger({ env: deps.env, cmd: 'send', settings: { level: 'debug' } })
+
+    expect(
+      await sendCommand(deps, {
+        kind: 'update',
+        title: 'SECRET_SEND_TITLE',
+        body: 'SECRET_SEND_BODY',
+      }),
+    ).toBe(EXIT.ok)
+    const raw = readFileSync(activeLogPath(deps.env), 'utf8')
+    expect(raw).not.toContain('SECRET_SEND_TITLE')
+    expect(raw).not.toContain('SECRET_SEND_BODY')
+    const submitted = readLogRecords(deps.env, { event: ['send.submitted'] }).records
+    expect(submitted[0]?.data).toMatchObject({
+      request_id: receipt.request_id,
+      title_chars: 'SECRET_SEND_TITLE'.length,
+    })
+  })
+
+  it('refuses a shell-escaped backslash-n body unless the literal flag is set', async () => {
+    const io = new CapturedIo()
+    expect(
+      await sendCommand(makeDeps(io, {} as ApiClient), {
+        kind: 'update',
+        title: 'Escaped',
+        body: 'line1\\nline2',
+      }),
+    ).toBe(EXIT.usage)
+    expect(io.errLines.join('\n')).toContain('--body-file -')
+    expect(io.errLines.join('\n')).toContain('--literal-backslash-n')
+
+    io.errLines = []
+    const client = { submit: async () => receipt } as unknown as ApiClient
+    expect(
+      await sendCommand(makeDeps(io, client), {
+        kind: 'update',
+        title: 'Escaped',
+        body: 'line1\\nline2',
+        literalBackslashN: true,
+      }),
+    ).toBe(EXIT.ok)
+  })
+})
+
 describe('delivery evidence status', () => {
   function snapshot(
     companionReceipt: EvidenceSnapshot['deliveries'][number]['companion_receipt'],
   ): EvidenceSnapshot {
     return {
       request_id: 'req_status_test',
-      event: 'tests_passed',
       accepted_at: '2026-08-05T13:05:48.000Z',
       overall: 'provider_accepted_all',
       deliveries: [
@@ -1866,6 +2501,53 @@ describe('delivery evidence status', () => {
     expect(said).toContain('Reply received: yes')
     expect(said).toContain('answers are on the server')
   })
+
+  it('treats an ordinary status Companion Receipt as doctor delivery proof', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-status-proof-'))
+    const evidence = snapshot({
+      state: 'observed',
+      observed_at: '2026-08-05T13:17:17.000Z',
+      latency_ms: 1_000,
+    })
+    const device = {
+      device_id: evidence.deliveries[0]!.device_id,
+      display_name: 'iPhone',
+      platform: 'ios' as const,
+      permission_status: 'authorized',
+      registration_healthy: true,
+      app_version: '0.1.0',
+      app_build: '42',
+      os_version: '19.0',
+      capabilities: ['answer'] as const,
+      support: currentSupport,
+      support_state: 'current' as const,
+      derived_status: 'working' as const,
+      status_message: null,
+      last_seen_at: '2026-08-05T18:00:00.000Z',
+    }
+    const client = {
+      health: async () => true,
+      listDevices: async () => ({ devices: [device] }),
+      accessStatus: async () => ({
+        status: 'active',
+        reason: 'alpha_grant',
+        expires_at: null,
+        email: 'proof@example.com',
+      }),
+      evidence: async () => evidence,
+    } as unknown as ApiClient
+    const io = new CapturedIo()
+    const deps = { ...makeDeps(io, client), cwd, env: isolatedEnv(cwd) }
+
+    expect(await statusCommand(deps, evidence.request_id, { json: true })).toBe(EXIT.ok)
+
+    const doctorIo = new CapturedIo()
+    expect(await doctorCommand({ ...deps, io: doctorIo }, { json: true })).toBe(EXIT.ok)
+    const report = JSON.parse(doctorIo.outLines.join('\n')) as {
+      states: { id: string; status: string }[]
+    }
+    expect(report.states.find((state) => state.id === 'proof')).toMatchObject({ status: 'ready' })
+  })
 })
 
 describe('Cursor hook commands', () => {
@@ -1891,12 +2573,17 @@ describe('Cursor hook commands', () => {
     expect(Object.keys(installed.hooks).sort()).toEqual([
       'beforeSubmitPrompt',
       'sessionEnd',
+      'sessionStart',
       'stop',
     ])
     expect(installed.hooks['beforeSubmitPrompt']?.[0]?.command).toContain(
       'hook user-prompt-submit --owner notifai --harness cursor',
     )
     expect(installed.hooks['stop']?.[0]).toMatchObject({
+      command: expect.stringContaining('hook activation-stop --owner notifai --harness cursor'),
+      loop_limit: 1,
+    })
+    expect(installed.hooks['stop']?.[1]).toMatchObject({
       command: expect.stringContaining('hook stop --owner notifai --harness cursor'),
       loop_limit: 3,
     })
@@ -1932,7 +2619,7 @@ describe('Cursor hook commands', () => {
     expect(io.outLines).toContain(
       `ok    Question routing: cursor project (${path.join(cwd, '.cursor', 'hooks.json')})`,
     )
-    expect(io.outLines.some((line) => line.includes('Cursor: send one prompt'))).toBe(true)
+    expect(io.outLines.some((line) => line.includes('Cursor: start one fresh conversation'))).toBe(true)
   })
 
   it('uninstalls only Notifai Cursor hooks and preserves foreign hooks', () => {
@@ -2011,13 +2698,7 @@ describe('Codex hook representation', () => {
     expect(io.outLines.join('\n')).toMatch(/Stop and the existing one will both fire/i)
   })
 
-  /**
-   * The foreign `hooks.json` stays byte-identical and Notifai lands inline.
-   * Codex will now warn that the layer uses both representations; the install
-   * output says why, because that warning is Codex reporting a merge, not a
-   * fault, and a silent one would read as Notifai's bug.
-   */
-  it('leaves a foreign hooks.json alone and installs inline instead', () => {
+  it('joins a populated hooks.json without introducing a second representation', () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-codex-json-install-'))
     const layer = path.join(cwd, '.codex')
     const json = path.join(layer, 'hooks.json')
@@ -2035,17 +2716,12 @@ describe('Codex hook representation', () => {
 
     expect(hooksInstallCommand(deps, { harness: 'codex', execPath, scriptPath })).toBe(EXIT.ok)
 
-    const beforeJson = readFileSync(json, 'utf8')
-    expect(beforeJson).toContain('gdh-stop')
-    expect(beforeJson).not.toContain('--owner notifai')
-    const after = readFileSync(toml, 'utf8')
-    // The user's file arrives back as the file they wrote, plus our hooks.
-    expect(after).toContain(beforeToml.trimEnd())
-    expect(after).toContain('--owner notifai')
-    expect(io.outLines.join('\n')).toContain(toml)
-    expect(io.outLines.join('\n')).toMatch(/Notifai will not modify it/)
-    expect(io.outLines.join('\n')).toMatch(/not a Notifai fault/)
-    expect(io.outLines.join('\n')).not.toMatch(/installed in both/i)
+    const afterJson = readFileSync(json, 'utf8')
+    expect(afterJson).toContain('gdh-stop')
+    expect(afterJson).toContain('--owner notifai')
+    expect(readFileSync(toml, 'utf8')).toBe(beforeToml)
+    expect(io.outLines.join('\n')).toContain(json)
+    expect(io.outLines.join('\n')).not.toMatch(/both representations|not a Notifai fault/i)
   })
 
   it('leaves config.toml byte-identical when uninstall finds no Notifai hooks', () => {
@@ -2062,6 +2738,50 @@ describe('Codex hook representation', () => {
     expect(io.outLines.join('\n')).toContain('No Notifai hooks found')
   })
 
+  it('leaves config.toml byte-identical on a no-op reinstall', () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-codex-noop-install-'))
+    const io = new CapturedIo()
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env: isolatedEnv(cwd) }
+    expect(hooksInstallCommand(deps, { harness: 'codex', execPath, scriptPath })).toBe(EXIT.ok)
+    const toml = path.join(cwd, '.codex', 'config.toml')
+    const before = readFileSync(toml, 'utf8')
+    io.outLines = []
+    expect(hooksInstallCommand(deps, { harness: 'codex', execPath, scriptPath })).toBe(EXIT.ok)
+    expect(readFileSync(toml, 'utf8')).toBe(before)
+  })
+
+  it('deletes an emptied hooks.json instead of leaving an empty residue', () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-codex-empty-json-'))
+    const layer = path.join(cwd, '.codex')
+    const json = path.join(layer, 'hooks.json')
+    mkdirSync(layer, { recursive: true })
+    applyPlan(json, {
+      hooks: {
+        Stop: [{ hooks: [{ type: 'command', command: hookCommand(scriptPath, 'stop', 'codex') }] }],
+      },
+    })
+    const io = new CapturedIo()
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env: isolatedEnv(cwd) }
+    expect(hooksUninstallCommand(deps, { harness: 'codex', scriptPath })).toBe(EXIT.ok)
+    expect(existsSync(json)).toBe(false)
+  })
+
+  it('global install does not leave a dead project .codex after uninstalling that layer', () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-codex-global-migrate-'))
+    const io = new CapturedIo()
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env: isolatedEnv(cwd) }
+    expect(hooksInstallCommand(deps, { harness: 'codex', execPath, scriptPath })).toBe(EXIT.ok)
+    expect(existsSync(path.join(cwd, '.codex'))).toBe(true)
+    expect(hooksInstallCommand(deps, { harness: 'codex', global: true, execPath, scriptPath })).toBe(
+      EXIT.ok,
+    )
+    expect(existsSync(path.join(cwd, '.codex', 'hooks.json'))).toBe(false)
+    const leftover = existsSync(path.join(cwd, '.codex'))
+      ? readdirSync(path.join(cwd, '.codex'))
+      : []
+    expect(leftover.every((name) => name !== 'hooks.json')).toBe(true)
+  })
+
   /**
    * Notifai in one file, someone else's hooks in the other: every handler
    * fires once, so doctor has nothing to report and the foreign file is not
@@ -2155,7 +2875,7 @@ describe('harness activation guidance', () => {
   const execPath = process.execPath
   const scriptPath = fileURLToPath(import.meta.url)
 
-  it('does not require a Claude Code restart for project hook files', () => {
+  it('requires a fresh Claude Code session so SessionStart can activate it', () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-claude-activation-'))
     const io = new CapturedIo()
     const deps = { ...makeDeps(io, {} as ApiClient), cwd, env: isolatedEnv(cwd) }
@@ -2166,11 +2886,11 @@ describe('harness activation guidance', () => {
 
     const output = io.outLines.join('\n')
     expect(output).toContain('Installed claude-code hooks in')
-    expect(output).toContain('Send one Claude Code prompt, then check `notifai doctor`.')
+    expect(output).toContain('Start one fresh Claude Code session, send one prompt, then run `notifai doctor`.')
     expect(output).not.toMatch(/timeout|asynchronous|600s/i)
   })
 
-  it('does not invent a Codex hook trust gate', () => {
+  it('names Codex trust and fresh-session activation in the correct order', () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-codex-activation-'))
     const io = new CapturedIo()
     const deps = { ...makeDeps(io, {} as ApiClient), cwd, env: isolatedEnv(cwd) }
@@ -2180,8 +2900,8 @@ describe('harness activation guidance', () => {
     )
 
     const output = io.outLines.join('\n')
-    expect(output).toContain('Send one Codex prompt, then check `notifai doctor`.')
-    expect(output).not.toMatch(/trust|approve/i)
+    expect(output).toContain('Approve the Notifai handlers in `/hooks` if Codex asks')
+    expect(output).toMatch(/approve[\s\S]*start one fresh Codex session[\s\S]*`notifai doctor`/i)
   })
 
   it('names the installed harness in the close, never a different one', () => {
@@ -2193,7 +2913,7 @@ describe('harness activation guidance', () => {
 
     const output = io.outLines.join('\n')
     expect(output).toContain('Installed cursor hooks in')
-    expect(output).toContain('Send one Cursor prompt, then check `notifai doctor`.')
+    expect(output).toContain('Start one fresh Cursor conversation, send one prompt, finish its first turn, then run `notifai doctor`.')
     expect(output).not.toMatch(/Codex|Claude Code|OpenCode/)
     expect(output).not.toMatch(/timeout|worktree|fails closed/i)
   })
@@ -2256,7 +2976,7 @@ describe('harness activation guidance', () => {
     )
 
     expect(io.outLines.join('\n')).toContain('Installed opencode hooks in')
-    expect(io.outLines.join('\n')).toContain('Send one OpenCode prompt, then check `notifai doctor`.')
+    expect(io.outLines.join('\n')).toContain('Restart OpenCode, start one fresh session, send one prompt, then run `notifai doctor`.')
     expect(io.outLines.join('\n')).not.toMatch(/Permission prompts|exactly-once continuation/)
     const pluginFile = path.join(cwd, '.opencode', 'plugins', 'notifai.js')
     const plugin = readFileSync(pluginFile, 'utf8')
@@ -2401,6 +3121,141 @@ describe('stable hook installation', () => {
       findInstallations(cwd, env, deps.hookAdapterHome).filter((item) => item.harness === 'codex'),
     ).toEqual([expect.objectContaining({ global: true })])
   })
+
+  it('refreshes stale global lifecycle coverage instead of declining a project install', () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-hooks-global-stale-'))
+    const io = new CapturedIo()
+    const env = isolatedEnv(cwd)
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env }
+    const execPath = process.execPath
+    const scriptPath = fileURLToPath(import.meta.url)
+
+    expect(
+      hooksInstallCommand(deps, {
+        harness: 'cursor',
+        global: true,
+        execPath,
+        scriptPath,
+      }),
+    ).toBe(EXIT.ok)
+    const globalFile = settingsFile('cursor', true, cwd, env)
+    const settings = JSON.parse(readFileSync(globalFile, 'utf8')) as {
+      hooks: { stop: Array<{ command?: string }> }
+    }
+    settings.hooks.stop = settings.hooks.stop.filter(
+      (handler) => !handler.command?.includes(' hook activation-stop '),
+    )
+    writeFileSync(globalFile, `${JSON.stringify(settings, null, 2)}\n`)
+
+    io.outLines = []
+    expect(hooksInstallCommand(deps, { harness: 'cursor', execPath, scriptPath })).toBe(EXIT.ok)
+    expect(existsSync(path.join(cwd, '.cursor', 'hooks.json'))).toBe(false)
+    const installation = findInstallations(cwd, env, deps.hookAdapterHome).find(
+      (item) => item.harness === 'cursor' && item.global,
+    )
+    expect(installation?.handlers.map((handler) => handlerEvent(handler.command))).toContain(
+      'activation-stop',
+    )
+    expect(io.outLines.join('\n')).toMatch(/Installed cursor hooks/)
+  })
+
+  it('refreshes a stale global Stop shape instead of declining a project install', () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-hooks-global-shape-'))
+    const io = new CapturedIo()
+    const env = isolatedEnv(cwd)
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env }
+    const execPath = process.execPath
+    const scriptPath = fileURLToPath(import.meta.url)
+
+    expect(
+      hooksInstallCommand(deps, {
+        harness: 'cursor',
+        global: true,
+        execPath,
+        scriptPath,
+      }),
+    ).toBe(EXIT.ok)
+    const globalFile = settingsFile('cursor', true, cwd, env)
+    const settings = JSON.parse(readFileSync(globalFile, 'utf8')) as {
+      hooks: { stop: Array<{ command?: string; timeout?: number }> }
+    }
+    const stop = settings.hooks.stop.find((handler) => handler.command?.includes(' hook stop '))
+    expect(stop).toBeDefined()
+    stop!.timeout = 1
+    writeFileSync(globalFile, `${JSON.stringify(settings, null, 2)}\n`)
+
+    io.outLines = []
+    expect(hooksInstallCommand(deps, { harness: 'cursor', execPath, scriptPath })).toBe(EXIT.ok)
+    expect(existsSync(path.join(cwd, '.cursor', 'hooks.json'))).toBe(false)
+    const refreshed = JSON.parse(readFileSync(globalFile, 'utf8')) as {
+      hooks: { stop: Array<{ command?: string; timeout?: number }> }
+    }
+    expect(
+      refreshed.hooks.stop.find((handler) => handler.command?.includes(' hook stop '))?.timeout,
+    ).toBeGreaterThan(1)
+    expect(io.outLines.join('\n')).toMatch(/Installed cursor hooks/)
+  })
+
+  it('consolidates duplicate global Codex representations before declining a project install', () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-hooks-global-codex-duplicate-'))
+    const io = new CapturedIo()
+    const env = isolatedEnv(cwd)
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env }
+    const execPath = process.execPath
+    const scriptPath = fileURLToPath(import.meta.url)
+
+    expect(
+      hooksInstallCommand(deps, { harness: 'codex', global: true, execPath, scriptPath }),
+    ).toBe(EXIT.ok)
+    const json = path.join(env.CODEX_HOME!, 'hooks.json')
+    applyPlan(json, {
+      hooks: {
+        ...buildHookConfig({ adapterPath: hookAdapterPath(deps.hookAdapterHome), harness: 'codex' }),
+        PostToolUse: [{ hooks: [{ type: 'command', command: 'foreign-post-tool' }] }],
+      },
+    })
+
+    io.outLines = []
+    expect(hooksInstallCommand(deps, { harness: 'codex', execPath, scriptPath })).toBe(EXIT.ok)
+    expect(existsSync(path.join(cwd, '.codex', 'config.toml'))).toBe(false)
+    expect(readFileSync(json, 'utf8')).toContain('foreign-post-tool')
+    expect(readFileSync(json, 'utf8')).not.toContain('--owner notifai')
+    expect(
+      findInstallations(cwd, env, deps.hookAdapterHome).filter(
+        (installation) => installation.harness === 'codex',
+      ),
+    ).toEqual([expect.objectContaining({ global: true })])
+    expect(io.outLines.join('\n')).toMatch(/Installed codex hooks/)
+  })
+
+  it('refreshes an obsolete global OpenCode plugin instead of treating empty event requirements as coverage', () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-hooks-global-opencode-stale-'))
+    const io = new CapturedIo()
+    const env = isolatedEnv(cwd)
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env }
+    const execPath = process.execPath
+    const scriptPath = fileURLToPath(import.meta.url)
+
+    expect(
+      hooksInstallCommand(deps, {
+        harness: 'opencode',
+        global: true,
+        execPath,
+        scriptPath,
+      }),
+    ).toBe(EXIT.ok)
+    const globalFile = settingsFile('opencode', true, cwd, env)
+    const current = readFileSync(globalFile, 'utf8')
+    writeFileSync(globalFile, current.replace('const ADAPTER_VERSION = 10', 'const ADAPTER_VERSION = 8'))
+
+    io.outLines = []
+    expect(hooksInstallCommand(deps, { harness: 'opencode', execPath, scriptPath })).toBe(EXIT.ok)
+    expect(existsSync(path.join(cwd, '.opencode', 'plugins', 'notifai.js'))).toBe(false)
+    const refreshed = readFileSync(globalFile, 'utf8')
+    expect(refreshed).toContain('const ADAPTER_VERSION = 10')
+    expect(refreshed).toContain('experimental.chat.system.transform')
+    expect(io.outLines.join('\n')).toMatch(/Installed opencode hooks/)
+  })
 })
 
 describe('projectSlugFrom', () => {
@@ -2736,7 +3591,7 @@ describe('interactive command UX', () => {
       beginPairing: async () => ({
         pairing_id: 'pair_test',
         code: 'ABCD-EFGH',
-        approve_url: 'https://test.notifai.invalid/pair/ABCD-EFGH',
+        approve_url: 'https://app.notifai.sh/pair/ABCD-EFGH',
         expires_at: new Date(10_000).toISOString(),
         poll_interval_seconds: 1,
       }),
@@ -2766,7 +3621,9 @@ describe('interactive command UX', () => {
     expect(io.notes).toEqual([
       {
         title: 'Approve this machine',
-        message: 'Code: ABCD-EFGH\nhttps://test.notifai.invalid/pair/ABCD-EFGH',
+        message: expect.stringMatching(
+          /^Code: ABCD-EFGH\nhttps:\/\/app\.notifai\.sh\/pair\/ABCD-EFGH#confirmation_secret=[A-Za-z0-9_-]{43}$/,
+        ),
       },
     ])
     expect(io.spinnerEvents).toEqual([
@@ -2785,7 +3642,7 @@ describe('interactive command UX', () => {
       beginPairing: async () => ({
         pairing_id: 'pair_test',
         code: 'ABCD-EFGH',
-        approve_url: 'https://test.notifai.invalid/pair/ABCD-EFGH',
+        approve_url: 'https://app.notifai.sh/pair/ABCD-EFGH',
         expires_at: new Date(10_000).toISOString(),
         poll_interval_seconds: 1,
       }),
@@ -2802,7 +3659,9 @@ describe('interactive command UX', () => {
     expect(await loginCommand(deps, { open: false })).toBe(EXIT.ok)
     expect(io.outLines.slice(0, 3)).toEqual([
       'Pairing code: ABCD-EFGH',
-      'Approve this machine at: https://test.notifai.invalid/pair/ABCD-EFGH',
+      expect.stringMatching(
+        /^Approve this machine at: https:\/\/app\.notifai\.sh\/pair\/ABCD-EFGH#confirmation_secret=[A-Za-z0-9_-]{43}$/,
+      ),
       'Waiting for approval…',
     ])
   })
@@ -2943,6 +3802,26 @@ describe('interactive command UX', () => {
     expect(io.intros).toEqual([])
     expect(io.checks).toEqual([])
   })
+
+  it('consults npm latest from an interactive doctor without failing the run', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-doctor-registry-'))
+    const io = new InteractiveIo()
+    const client = {
+      health: async () => true,
+      capabilities: async () => ({ schema_version: 1, platform: 'ios' }),
+    } as unknown as ApiClient
+    const deps: CommandDeps = {
+      ...makeDeps(io, client),
+      cwd,
+      env: isolatedEnv(cwd),
+      store: { load: () => null, save: () => {}, clear: () => {}, describe: () => 'empty store' },
+      fetchImpl: async () => new Response(JSON.stringify({ latest: '99.0.0' }), { status: 200 }),
+    }
+
+    expect(await doctorCommand(deps, {})).toBe(EXIT.failed)
+    expect(io.outLines).toContain('A newer Notifai is available.')
+    expect(io.outLines).toContain('npm install -g @raidiant/notifai')
+  })
 })
 
 describe('compatibility-first update guidance', () => {
@@ -3175,15 +4054,21 @@ describe('init', () => {
     display_name: 'Mac',
     platform: 'macos' as const,
   }
+  const readyAndroid = {
+    ...readyIphone,
+    device_id: 'dev_android',
+    display_name: 'Pixel',
+    platform: 'android' as const,
+    os_version: '16',
+  }
 
   function setupEvidence(
     requestId: string,
     companionReceipt: EvidenceSnapshot['deliveries'][number]['companion_receipt'],
-    device = readyIphone,
+    device: typeof readyIphone | typeof readyAndroid = readyIphone,
   ): EvidenceSnapshot {
     return {
       request_id: requestId,
-      event: 'setup_verified',
       accepted_at: '2026-08-05T18:00:00.000Z',
       overall: 'provider_accepted_all',
       deliveries: [
@@ -3215,15 +4100,18 @@ describe('init', () => {
     }
   }
 
-  function setupReceipt(requestId = 'req_setup'): SubmissionReceipt {
+  function setupReceipt(
+    requestId = 'req_setup',
+    device: typeof readyIphone | typeof readyAndroid = readyIphone,
+  ): SubmissionReceipt {
     return {
       ...receipt,
       request_id: requestId,
       deliveries: [
         {
           ...receipt.deliveries[0]!,
-          device_id: readyIphone.device_id,
-          device_name: readyIphone.display_name,
+          device_id: device.device_id,
+          device_name: device.display_name,
         },
       ],
     }
@@ -3418,18 +4306,22 @@ describe('init', () => {
     } as unknown as ApiClient
     const nativeSkills: NativeSkills = {
       add: async () => 0,
+      remove: async () => 0,
       list: async (scope) => ({
-        skills: [
-          {
-            name: 'notifai',
-            scope,
-            path: path.join(cwd, '.agents', 'skills', 'notifai'),
-            source: 'Raidiant-io/notifai',
-            sourceType: 'github',
-            sourceUrl: 'https://github.com/Raidiant-io/notifai.git',
-            ref: RELEASE_REF,
-          },
-        ],
+        skills:
+          scope === 'project'
+            ? [
+                {
+                  name: 'notifai',
+                  scope,
+                  path: path.join(cwd, '.agents', 'skills', 'notifai'),
+                  source: 'Raidiant-io/notifai',
+                  sourceType: 'github',
+                  sourceUrl: 'https://github.com/Raidiant-io/notifai.git',
+                  ref: RELEASE_REF,
+                },
+              ]
+            : [],
       }),
     }
     const readiness = await assessReadiness(
@@ -3455,51 +4347,242 @@ describe('init', () => {
       const calls: SkillScope[] = []
       const nativeSkills: NativeSkills = {
         add: async () => 0,
+        remove: async () => 0,
         list: async (selected) => {
           calls.push(selected)
-          return { skills: [managedSkill(selected, cwd)] }
+          return { skills: selected === scope ? [managedSkill(selected, cwd)] : [] }
         },
       }
 
-      const readiness = await assessReadiness(
-        { ...makeDeps(io, client), cwd, nativeSkills },
-        { skillScope: scope },
-      )
-      expect(readiness.states.find((state) => state.id === 'skill')).toMatchObject({
-        status: 'ready',
-        detail: `installed from ${SKILLS_SOURCE} in the ${scope} scope`,
-      })
-      expect(calls).toEqual([scope])
-    },
-  )
+      const readiness = await assessReadiness(
+        { ...makeDeps(io, client), cwd, nativeSkills },
+        { skillScope: scope },
+      )
+      expect(readiness.states.find((state) => state.id === 'skill')).toMatchObject({
+        status: 'ready',
+        detail: `installed from ${SKILLS_SOURCE} in the ${scope} scope`,
+      })
+      expect(calls).toEqual(['project', 'global'])
+    },
+  )
+
+  it.each(['project', 'global'] as const)(
+    'does not trust unmanaged same-path content in the %s scope',
+    async (scope) => {
+      const cwd = mkdtempSync(path.join(os.tmpdir(), `init-unmanaged-${scope}-`))
+      const io = new CapturedIo()
+      const client = {
+        health: async () => true,
+        capabilities: async () => ({ schema_version: 1, platform: 'ios' }),
+        listDevices: async () => ({ devices: [] }),
+      } as unknown as ApiClient
+      const nativeSkills: NativeSkills = {
+        add: async () => 0,
+        remove: async () => 0,
+        list: async (selected) => ({
+          skills:
+            selected === scope
+              ? [{ ...managedSkill(selected, cwd), source: null, sourceType: null, ref: null }]
+              : [],
+        }),
+      }
+
+      const readiness = await assessReadiness(
+        { ...makeDeps(io, client), cwd, nativeSkills },
+        { skillScope: scope },
+      )
+      expect(readiness.states.find((state) => state.id === 'skill')).toMatchObject({
+        status: 'optional-gap',
+        detail: `not installed from ${SKILLS_SOURCE} in ${scope} scope`,
+      })
+    },
+  )
+
+  it('reports a duplicate notifai skill across project and global scope', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'assess-skill-duplicate-'))
+    const io = new CapturedIo()
+    const client = {
+      health: async () => true,
+      capabilities: async () => ({ schema_version: 1, platform: 'ios' }),
+      listDevices: async () => ({ devices: [] }),
+    } as unknown as ApiClient
+    const nativeSkills: NativeSkills = {
+      add: async () => 0,
+      remove: async () => 0,
+      list: async (scope) => ({
+        skills: [
+          {
+            ...managedSkill(scope, cwd),
+            ref: scope === 'project' ? RELEASE_REF : 'v0.2.1',
+            path:
+              scope === 'project'
+                ? path.join(cwd, '.agents', 'skills', 'notifai')
+                : path.join(cwd, 'home', '.agents', 'skills', 'notifai'),
+          },
+        ],
+      }),
+    }
+
+    const readiness = await assessReadiness({ ...makeDeps(io, client), cwd, nativeSkills })
+    const skill = readiness.states.find((state) => state.id === 'skill')
+    expect(skill).toMatchObject({
+      status: 'gap',
+      detail: `project (${RELEASE_REF}) and global (v0.2.1) are both installed, so the harness lists both. Keep either project or global and uninstall the other.`,
+      technical: {
+        project: {
+          ref: RELEASE_REF,
+          path: path.join(cwd, '.agents', 'skills', 'notifai'),
+          current: true,
+        },
+        global: {
+          ref: 'v0.2.1',
+          path: path.join(cwd, 'home', '.agents', 'skills', 'notifai'),
+          current: false,
+        },
+        resolution: 'both-listed',
+      },
+    })
+
+    expect(await doctorCommand({ ...makeDeps(io, client), cwd, nativeSkills }, { json: true })).toBe(
+      EXIT.failed,
+    )
+    const payload = JSON.parse(io.outLines[0] ?? '{}') as {
+      ok: boolean
+      states: Array<{ id: string; status: string; detail: string }>
+    }
+    expect(payload.ok).toBe(false)
+    expect(payload.states.find((state) => state.id === 'skill')).toMatchObject({
+      status: 'gap',
+      detail: expect.stringContaining('harness lists both'),
+    })
+  })
+
+  it('does not treat a current pin as ready when a stale duplicate is also installed', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'assess-skill-shadow-'))
+    const io = new CapturedIo()
+    const client = {
+      health: async () => true,
+      capabilities: async () => ({ schema_version: 1, platform: 'ios' }),
+      listDevices: async () => ({ devices: [] }),
+    } as unknown as ApiClient
+    const nativeSkills: NativeSkills = {
+      add: async () => 0,
+      remove: async () => 0,
+      list: async (scope) => ({
+        skills: [
+          {
+            ...managedSkill(scope, cwd),
+            ref: scope === 'global' ? RELEASE_REF : 'v0.2.1',
+          },
+        ],
+      }),
+    }
+
+    const readiness = await assessReadiness(
+      { ...makeDeps(io, client), cwd, nativeSkills },
+      { skillScope: 'global' },
+    )
+    expect(readiness.states.find((state) => state.id === 'skill')).toMatchObject({
+      status: 'gap',
+      detail: `project (v0.2.1) and global (${RELEASE_REF}) are both installed, so the harness lists both. Keep either project or global and uninstall the other.`,
+    })
+  })
+
+  it('uninstalls the other skill scope before installing the chosen one', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-skill-duplicate-prevented-'))
+    const io = new CapturedIo()
+    const removed: SkillScope[] = []
+    const added: Array<SkillScope | undefined> = []
+    let globalPresent = true
+    const nativeSkills: NativeSkills = {
+      add: async (options) => {
+        added.push(options.scope)
+        return 0
+      },
+      remove: async (options) => {
+        removed.push(options.scope)
+        if (options.scope === 'global') globalPresent = false
+        return 0
+      },
+      list: async (scope) => ({
+        skills: scope === 'global' && globalPresent ? [{ ...managedSkill('global', cwd), ref: 'v0.2.1' }] : [],
+      }),
+    }
+
+    expect(
+      await initCommand(setupReadyDeps(io, cwd, nativeSkills, { submit: 0 }), {
+        skills: true,
+        setupScope: 'project',
+        hooks: false,
+      }),
+    ).toBe(EXIT.ok)
+    expect(removed).toEqual(['global'])
+    expect(added).toEqual(['project'])
+  })
 
-  it.each(['project', 'global'] as const)(
-    'does not trust unmanaged same-path content in the %s scope',
-    async (scope) => {
-      const cwd = mkdtempSync(path.join(os.tmpdir(), `init-unmanaged-${scope}-`))
-      const io = new CapturedIo()
-      const client = {
-        health: async () => true,
-        capabilities: async () => ({ schema_version: 1, platform: 'ios' }),
-        listDevices: async () => ({ devices: [] }),
-      } as unknown as ApiClient
-      const nativeSkills: NativeSkills = {
-        add: async () => 0,
-        list: async (selected) => ({
-          skills: [{ ...managedSkill(selected, cwd), source: null, sourceType: null, ref: null }],
-        }),
-      }
+  it('clears a pre-existing skill duplicate by keeping the chosen setup scope', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-skill-duplicate-clear-'))
+    const io = new CapturedIo()
+    const removed: SkillScope[] = []
+    const present = new Set<SkillScope>(['project', 'global'])
+    const nativeSkills: NativeSkills = {
+      add: async (options) => {
+        if (options.scope !== undefined) present.add(options.scope)
+        return 0
+      },
+      remove: async (options) => {
+        removed.push(options.scope)
+        present.delete(options.scope)
+        return 0
+      },
+      list: async (scope) => ({
+        skills: present.has(scope)
+          ? [
+              {
+                ...managedSkill(scope, cwd),
+                ref: scope === 'project' ? RELEASE_REF : 'v0.2.1',
+              },
+            ]
+          : [],
+      }),
+    }
 
-      const readiness = await assessReadiness(
-        { ...makeDeps(io, client), cwd, nativeSkills },
-        { skillScope: scope },
-      )
-      expect(readiness.states.find((state) => state.id === 'skill')).toMatchObject({
-        status: 'optional-gap',
-        detail: `not installed from ${SKILLS_SOURCE} in ${scope} scope`,
-      })
-    },
-  )
+    expect(
+      await initCommand(setupReadyDeps(io, cwd, nativeSkills, { submit: 0 }), {
+        skills: true,
+        setupScope: 'project',
+        hooks: false,
+      }),
+    ).toBe(EXIT.ok)
+    expect(removed).toEqual(['global'])
+    expect([...present]).toEqual(['project'])
+  })
+
+  it('updates the existing skill scope instead of adding a second copy', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-skill-update-existing-'))
+    const io = new InteractiveIo()
+    const received: Array<SkillScope | undefined> = []
+    const installed = true
+    const nativeSkills: NativeSkills = {
+      add: async (options) => {
+        received.push(options.scope)
+        return 0
+      },
+      remove: async () => 0,
+      list: async (scope) => ({
+        skills: installed && scope === 'global' ? [{ ...managedSkill('global', cwd), ref: 'v0.2.1' }] : [],
+      }),
+    }
+
+    expect(
+      await initCommand(setupReadyDeps(io, cwd, nativeSkills, { submit: 0 }), {
+        skills: true,
+        hooks: false,
+      }),
+    ).toBe(EXIT.ok)
+    expect(received).toEqual(['global'])
+    expect(io.outLines.join('\n')).toContain('global scope')
+  })
 
   it('requires an explicit skill scope before unattended installation', async () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-skill-scope-required-'))
@@ -3510,6 +4593,7 @@ describe('init', () => {
         addCalls += 1
         return 0
       },
+      remove: async () => 0,
       list: async () => ({ skills: [] }),
     }
 
@@ -3517,7 +4601,7 @@ describe('init', () => {
       EXIT.usage,
     )
     expect(addCalls).toBe(0)
-    expect(io.errLines.join('\n')).toContain('--skills-scope project')
+    expect(io.errLines.join('\n')).toContain('--setup-scope project')
   })
 
   it('rejects an invalid unattended skill scope instead of guessing', async () => {
@@ -3545,6 +4629,7 @@ describe('init', () => {
           installed = true
           return 0
         },
+        remove: async () => 0,
         list: async (selected) => ({
           skills: installed && selected === scope ? [managedSkill(scope, cwd)] : [],
         }),
@@ -3561,27 +4646,82 @@ describe('init', () => {
     },
   )
 
-  it('lets the native interactive flow choose scope and resumes after cancellation', async () => {
-    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-skill-cancelled-'))
+  it('asks one setup-scope question and passes that scope to the native installer', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-skill-setup-scope-ask-'))
     const io = new InteractiveIo()
+    io.selectAnswer = 'project'
     const calls: { submit: number } = { submit: 0 }
-    let receivedScope: SkillScope | undefined = 'global'
+    let receivedScope: SkillScope | undefined
     const nativeSkills: NativeSkills = {
       add: async (options) => {
         receivedScope = options.scope
         return 0
       },
+      remove: async () => 0,
       list: async () => ({ skills: [] }),
     }
 
     expect(await initCommand(setupReadyDeps(io, cwd, nativeSkills, calls), { skills: true, hooks: false })).toBe(
       EXIT.ok,
     )
-    expect(receivedScope).toBeUndefined()
+    expect(io.prompts[0]).toContain('this project only, or to every project on this machine')
+    expect(receivedScope).toBe('project')
     expect(calls.submit).toBe(1)
     expect(io.outLines.join('\n')).toContain('All set.')
   })
 
+  it('accepts --setup-scope as the unattended skill, hooks, and config scope', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-setup-scope-flag-'))
+    const io = new CapturedIo()
+    let receivedScope: SkillScope | undefined
+    const nativeSkills: NativeSkills = {
+      add: async (options) => {
+        receivedScope = options.scope
+        return 0
+      },
+      remove: async () => 0,
+      list: async (scope) => ({
+        skills: receivedScope === scope ? [managedSkill(scope, cwd)] : [],
+      }),
+    }
+
+    expect(
+      await initCommand(setupReadyDeps(io, cwd, nativeSkills, { submit: 0 }), {
+        skills: true,
+        setupScope: 'project',
+        hooks: false,
+      }),
+    ).toBe(EXIT.ok)
+    expect(receivedScope).toBe('project')
+    expect(existsSync(path.join(cwd, '.notifai', 'config.toml'))).toBe(true)
+  })
+
+  it('stamps project identity outside the repo when setup-scope is global', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-setup-scope-global-config-'))
+    const io = new CapturedIo()
+    const deps: CommandDeps = {
+      ...makeDeps(io, {} as ApiClient),
+      cwd,
+      env: isolatedEnv(cwd),
+      store: { load: () => null, save: () => {}, clear: () => {}, describe: () => 'empty store' },
+    }
+
+    expect(await initCommand(deps, { setupScope: 'global', skills: false, hooks: false })).toBe(EXIT.failed)
+    expect(existsSync(path.join(cwd, '.notifai', 'config.toml'))).toBe(false)
+    expect(readFileSync(personalProjectConfigPath(cwd, deps.env), 'utf8')).toMatch(/project = "/)
+  })
+
+  it('rejects disagreeing --setup-scope and --skills-scope', async () => {
+    const io = new CapturedIo()
+    expect(
+      await initCommand(
+        { ...makeDeps(io, {} as ApiClient), cwd: mkdtempSync(path.join(os.tmpdir(), 'init-scope-conflict-')) },
+        { skills: true, setupScope: 'project', skillsScope: 'global' },
+      ),
+    ).toBe(EXIT.usage)
+    expect(io.errLines.join('\n')).toContain('disagree')
+  })
+
   it('installs every detected project harness when --hooks is set', async () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-hooks-all-detected-'))
     mkdirSync(path.join(cwd, '.claude'))
@@ -3590,6 +4730,7 @@ describe('init', () => {
     const calls = { submit: 0 }
     const nativeSkills: NativeSkills = {
       add: async () => 0,
+      remove: async () => 0,
       list: async () => ({ skills: [] }),
     }
     const deps = setupReadyDeps(io, cwd, nativeSkills, calls)
@@ -3614,6 +4755,7 @@ describe('init', () => {
     const calls = { submit: 0 }
     const nativeSkills: NativeSkills = {
       add: async () => 0,
+      remove: async () => 0,
       list: async () => ({ skills: [] }),
     }
     const deps = setupReadyDeps(io, cwd, nativeSkills, calls)
@@ -3631,6 +4773,7 @@ describe('init', () => {
     const calls: { submit: number } = { submit: 0 }
     const nativeSkills: NativeSkills = {
       add: async () => 1,
+      remove: async () => 0,
       list: async () => ({ skills: [] }),
     }
 
@@ -3735,7 +4878,9 @@ describe('init', () => {
     expect(out).toContain('Next: Your devices')
     expect(out).toContain('https://test.notifai.invalid/support')
     expect(out).toContain('sign in with the same email as this account (alpha@example.com)')
-    expect(out).toContain('install Notifai on iPhone via https://test.notifai.invalid/support')
+    expect(out).toContain(
+      'no active Companion device registered yet; install Notifai via https://test.notifai.invalid/support',
+    )
     expect(out.match(/^Next:/gm)).toHaveLength(1)
   })
 
@@ -3769,6 +4914,7 @@ describe('init', () => {
       nativeSkills: {
         list: async () => ({ skills: [] }),
         add: async () => 0,
+        remove: async () => 0,
       } satisfies NativeSkills,
     }
 
@@ -3784,7 +4930,7 @@ describe('init', () => {
   })
 
   it.each([
-    ['denied', 'iPhone Settings'],
+    ['denied', "the device's Settings"],
     ['not_determined', 'allow its notification prompt'],
   ])('gives one permission-specific next action for %s', async (permission, expected) => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), `init-permission-${permission}-`))
@@ -3804,12 +4950,12 @@ describe('init', () => {
 
     expect(await initCommand(deps, { hooks: false, skills: false })).toBe(EXIT.failed)
     const out = io.outLines.join('\n')
-    expect(out).toContain(`iPhone (${permission})`)
+    expect(out).toContain(`iPhone (ios, ${permission})`)
     expect(out).toContain(expected)
     expect(out.match(/^Next:/gm)).toHaveLength(1)
   })
 
-  it('ignores a dormant Mac installation while waiting for an iPhone, then proves the iPhone receipt', async () => {
+  it('ignores a dormant Mac installation while waiting for an active Companion, then proves the iPhone receipt', async () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-device-bridge-'))
     const io = new InteractiveIo()
     let now = 0
@@ -3856,7 +5002,9 @@ describe('init', () => {
     ])
     expect(io.openedUrls).toEqual(['https://test.notifai.invalid/support'])
     expect(io.notes.some((n) => n.message.includes('I will wait up to 10 minutes'))).toBe(true)
-    expect(io.spinnerEvents).toContain('message:Waiting for the iPhone app to sign in and register…')
+    expect(io.spinnerEvents).toContain(
+      'message:Waiting for a Companion App to sign in and register…',
+    )
     expect(io.spinnerEvents).toContain('stop:iPhone is ready to receive')
     expect(io.spinnerEvents).toContain('stop:Receipt observed from iPhone')
     expect(io.outLines.join('\n')).toContain(
@@ -3864,7 +5012,7 @@ describe('init', () => {
     )
     expect(io.outLines.join('\n')).toContain('All set.')
     expect(submitCalls).toBe(1)
-    expect(submittedDraft?.draft.event).toBe('setup_verified')
+    expect(submittedDraft?.draft).not.toHaveProperty('event')
     expect(submittedDraft?.draft.targets).toEqual({ mode: 'selected', device_ids: ['dev_iphone'] })
 
     io.outLines = []
@@ -4022,6 +5170,52 @@ describe('init', () => {
     expect(io.outLines.join('\n')).toContain('All set.')
   })
 
+  it('replaces a stale unknown setup proof instead of rechecking it forever', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-proof-stale-'))
+    const io = new CapturedIo()
+    let submitCalls = 0
+    const client = {
+      health: async () => true,
+      capabilities: async () => ({ schema_version: 1, platform: 'ios' }),
+      listDevices: async () => ({ devices: [readyIphone] }),
+      submit: async () => {
+        submitCalls += 1
+        return setupReceipt('req_fresh')
+      },
+      evidence: async (requestId: string) =>
+        setupEvidence(
+          requestId,
+          requestId === 'req_fresh'
+            ? {
+                state: 'observed',
+                observed_at: '2026-08-25T00:00:02.000Z',
+                latency_ms: 1_000,
+              }
+            : { state: 'unknown', observed_at: null, latency_ms: null },
+        ),
+    } as unknown as ApiClient
+    const now = Date.parse('2026-08-25T00:00:00.000Z')
+    mkdirSync(path.join(cwd, '.notifai'), { recursive: true })
+    writeFileSync(path.join(cwd, '.notifai', 'config.toml'), 'project = "stale-proof"\n')
+    const deps: CommandDeps = {
+      ...makeDeps(io, client),
+      cwd,
+      env: isolatedEnv(cwd),
+      now: () => now,
+    }
+    writeSetupProof(deps, {
+      request_id: 'req_old',
+      device_id: readyIphone.device_id,
+      project: 'stale-proof',
+      started_at: new Date(now - SETUP_PROOF_STALE_MS - 1).toISOString(),
+    })
+
+    expect(await initCommand(deps, { hooks: false, skills: false })).toBe(EXIT.ok)
+    expect(submitCalls).toBe(1)
+    expect(io.outLines.join('\n')).toContain('older than 24h without a Companion Receipt')
+    expect(io.outLines.join('\n')).toContain('All set.')
+  })
+
   it('reports a proof-state write failure instead of crashing or sending twice', async () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-proof-unwritable-'))
     const io = new CapturedIo()
@@ -4047,6 +5241,51 @@ describe('init', () => {
     expect(io.outLines.join('\n')).toContain('Next: Delivery proof')
   })
 
+  it('treats Android as active Companion readiness and sends a platform-correct proof', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-android-proof-'))
+    mkdirSync(path.join(cwd, '.notifai'), { recursive: true })
+    writeFileSync(
+      path.join(cwd, '.notifai', 'config.toml'),
+      'project = "android-project"\ninterruption_level = "passive"\n',
+    )
+    const io = new CapturedIo()
+    let submitted: SubmitNotificationRequestT | null = null
+    const client = {
+      health: async () => true,
+      listDevices: async () => ({ devices: [readyAndroid] }),
+      submit: async (body: SubmitNotificationRequestT) => {
+        submitted = body
+        return setupReceipt('req_android_setup', readyAndroid)
+      },
+      evidence: async (requestId: string) =>
+        setupEvidence(
+          requestId,
+          {
+            state: 'observed',
+            observed_at: '2026-08-05T18:00:02.000Z',
+            latency_ms: 1_000,
+          },
+          readyAndroid,
+        ),
+    } as unknown as ApiClient
+    const deps = {
+      ...makeDeps(io, client),
+      cwd,
+      env: isolatedEnv(cwd),
+    }
+
+    expect(await initCommand(deps, { hooks: false, skills: false })).toBe(EXIT.ok)
+    expect(submitted?.draft.targets).toEqual({
+      mode: 'selected',
+      device_ids: [readyAndroid.device_id],
+    })
+    expect(submitted?.draft.platform).toEqual({ android: { sound: null } })
+    expect(io.outLines.join('\n')).toContain(
+      "Companion Receipt (the app's delivery confirmation) observed from Pixel.",
+    )
+    expect(io.outLines.join('\n')).toContain('All set.')
+  })
+
   it('does not treat a macOS-only installation as active-release readiness', async () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-macos-proof-'))
     const io = new CapturedIo()
@@ -4072,11 +5311,11 @@ describe('init', () => {
     expect(submitCalls).toBe(0)
     const out = io.outLines.join('\n')
     expect(out).toContain('Next: Your devices')
-    expect(out).toContain('no iPhone registered yet')
+    expect(out).toContain('no active Companion device registered yet')
     expect(out).not.toContain('All set.')
     expect(out).not.toMatch(/Companion Receipt observed/i)
 
-    // A human doctor must render the same iPhone-readiness failure.
+    // A human doctor must render the same active-Companion readiness failure.
     const doctorIo = new PlainInteractiveIo()
     expect(
       await doctorCommand(
@@ -4090,43 +5329,9 @@ describe('init', () => {
     ).toBe(EXIT.failed)
     const doctorOut = doctorIo.outLines.join('\n')
     expect(doctorOut).toMatch(/FAIL\s+Your devices:/)
-    expect(doctorOut).toContain('no iPhone registered yet')
-    expect(doctorOut).toContain('Delivery proof: not checked — no iPhone is ready')
-  })
-
-  it('stops login when the approval page reports no Alpha access', async () => {
-    const io = new CapturedIo()
-    let now = 0
-    let polls = 0
-    const client = {
-      beginPairing: async () => ({
-        pairing_id: 'pair_no_plan',
-        code: 'NOPE-PLAN',
-        approve_url: 'https://test.notifai.invalid/approve?code=NOPE-PLAN',
-        expires_at: new Date(60_000).toISOString(),
-        poll_interval_seconds: 1,
-      }),
-      pollPairing: async () => {
-        polls += 1
-        return {
-          status: 'no_active_plan' as const,
-          next_action: 'Open https://test.notifai.invalid/support to request Alpha access, then retry.',
-        }
-      },
-    } as unknown as ApiClient
-    const deps = {
-      ...makeDeps(io, client),
-      now: () => now,
-      sleep: async (milliseconds: number) => {
-        now += milliseconds
-      },
-    }
-
-    expect(await loginCommand(deps, { open: false })).toBe(EXIT.auth)
-    expect(polls).toBe(1)
-    expect(io.errLines.join('\n')).toContain('no active plan or temporary Alpha access')
-    expect(io.errLines.join('\n')).toContain(
-      'Open https://test.notifai.invalid/support to request Alpha access, then retry.',
+    expect(doctorOut).toContain('no active Companion device registered yet')
+    expect(doctorOut).toContain(
+      'Delivery proof: not checked — no iPhone or Android Companion App is ready',
     )
   })
 
@@ -4308,6 +5513,54 @@ describe('readiness assessment cost', () => {
       detail: `installed from ${SKILLS_SOURCE} in the project scope`,
     })
   })
+
+  it('detects a lock-file duplicate across project and global scope', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'assess-lock-skill-duplicate-'))
+    const env = { ...isolatedEnv(cwd), PATH: '/nonexistent' }
+    writeFileSync(
+      path.join(cwd, 'skills-lock.json'),
+      `${JSON.stringify({
+        skills: {
+          notifai: {
+            source: 'Raidiant-io/notifai',
+            sourceType: 'github',
+            ref: RELEASE_REF,
+          },
+        },
+      })}\n`,
+    )
+    mkdirSync(path.join(env.XDG_STATE_HOME!, 'skills'), { recursive: true })
+    writeFileSync(
+      path.join(env.XDG_STATE_HOME!, 'skills', '.skill-lock.json'),
+      `${JSON.stringify({
+        skills: {
+          notifai: {
+            source: 'Raidiant-io/notifai',
+            sourceType: 'github',
+            ref: 'v0.2.1',
+          },
+        },
+      })}\n`,
+    )
+    const io = new CapturedIo()
+    const client = {
+      health: async () => true,
+      capabilities: async () => ({ schema_version: 1, platform: 'ios' }),
+      listDevices: async () => ({ devices: [] }),
+    } as unknown as ApiClient
+
+    const readiness = await assessReadiness({
+      ...makeDeps(io, client),
+      cwd,
+      env,
+      nativeSkills: realNativeSkills,
+    })
+    expect(readiness.states.find((state) => state.id === 'skill')).toMatchObject({
+      status: 'gap',
+      detail: `project (${RELEASE_REF}) and global (v0.2.1) are both installed, so the harness lists both. Keep either project or global and uninstall the other.`,
+      technical: { resolution: 'both-listed' },
+    })
+  })
 })
 
 describe('an outage is not an answer', () => {
@@ -4387,7 +5640,8 @@ describe('an outage is not an answer', () => {
       json: true,
     })
 
-    const payload = JSON.parse(io.outLines[1] ?? '{}') as { degraded: boolean }
+    expect(io.outLines).toHaveLength(1)
+    const payload = JSON.parse(io.outLines[0] ?? '{}') as { degraded: boolean }
     expect(payload.degraded).toBe(true)
   })
 
@@ -4507,9 +5761,7 @@ describe('asking before the hooks have ever run', () => {
     io.outLines = []
 
     expect(askCommand(deps, 'Ship it?', {})).toBe(EXIT.ok)
-    expect(io.outLines).toContain(
-      'Question registered. Ask it in the conversation, state the concrete work you will resume when the answer arrives, then end your turn.',
-    )
+    expect(io.outLines.some((line) => line.startsWith('Question registered (q_'))).toBe(true)
     expect(readSessionState('codex-current-thread', env).pending?.[0]?.source).toMatchObject({
       session_id: 'codex-current-thread',
       harness: 'codex',
@@ -4568,7 +5820,7 @@ describe('asking before the hooks have ever run', () => {
     const pending = readSessionState('codex-media-thread', env).pending?.[0]
     expect(uploaded).toEqual(['med_ask_1', 'med_ask_2'])
     expect(pending?.body).toBe(
-      'Which visual should I use?\n\nCompare ![first](media:med_ask_1) with ![second](media:med_ask_2).',
+      'Compare ![first](media:med_ask_1) with ![second](media:med_ask_2).',
     )
     expect(pending?.media).toEqual([
       { media_id: 'med_ask_1', alt: 'First option' },
@@ -4731,7 +5983,7 @@ describe('asking before the hooks have ever run', () => {
     const fired = readiness.states.find((state) => state.id === 'hooks-fired')
     expect(fired?.status).toBe('optional-gap')
     expect(fired?.detail).toMatch(/Claude Code/)
-    expect(fired?.detail).toMatch(/Codex: send one prompt/)
+    expect(fired?.detail).toMatch(/Codex: approve[\s\S]*start one fresh session/i)
 
     io.errLines = []
     expect(askCommand(deps, 'Ship it?', {})).toBe(EXIT.usage)
@@ -4851,6 +6103,7 @@ describe('asking before the hooks have ever run', () => {
     } as unknown as ApiClient
     const nativeSkills: NativeSkills = {
       add: async () => 0,
+      remove: async () => 0,
       list: async (scope) => ({
         skills:
           scope === 'global'
@@ -5154,6 +6407,28 @@ describe('asking before the hooks have ever run', () => {
     expect(io.outLines.join('\n')).toMatch(/ok\s+Turn\-end hook shape/)
   })
 
+  it('diagnoses an older hook install that lacks proactive lifecycle handlers', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-doctor-missing-lifecycle-'))
+    const io = new PlainInteractiveIo()
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env: isolatedEnv(cwd) }
+    expect(hooksInstallCommand(deps, { harness: 'claude-code', execPath, scriptPath })).toBe(
+      EXIT.ok,
+    )
+    const settingsPath = path.join(cwd, '.claude', 'settings.local.json')
+    const settings = JSON.parse(readFileSync(settingsPath, 'utf8')) as {
+      hooks: Record<string, unknown>
+    }
+    delete settings.hooks.SessionStart
+    delete settings.hooks.SubagentStart
+    writeFileSync(settingsPath, `${JSON.stringify(settings, null, 2)}\n`)
+
+    const readiness = await assessReadiness(deps)
+    const current = readiness.states.find((state) => state.id === 'hooks-stale')
+    expect(current?.status).toBe('gap')
+    expect(current?.detail).toMatch(/missing session-start, subagent-start/i)
+    expect(current?.detail).toMatch(/notifai hooks install/i)
+  })
+
   it('names an old blocking Claude Stop handler as the reason no wake can happen', async () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-doctor-stale-shape-'))
     const io = new PlainInteractiveIo()
@@ -5305,7 +6580,7 @@ describe('asking before the hooks have ever run', () => {
     expect(payload).toMatchObject({ ok: false, exit_code: EXIT.failed })
   })
 
-  it('tells Claude Code to send a prompt without falsely requiring a restart', () => {
+  it('tells Claude Code to start fresh so activation is model-visible', () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-firstrun-'))
     mkdirSync(path.join(cwd, '.claude'), { recursive: true })
     applyPlan(path.join(cwd, '.claude', 'settings.local.json'), {
@@ -5319,11 +6594,11 @@ describe('asking before the hooks have ever run', () => {
 
     expect(askCommand(deps, 'Ship it?', {})).toBe(EXIT.usage)
     const said = io.errLines.join(' ')
-    expect(said).toMatch(/project hook files reload without a restart/i)
+    expect(said).toMatch(/Claude Code: start one fresh session, send one prompt/i)
     expect(said).not.toMatch(/Run `notifai hooks install` and send one prompt/)
   })
 
-  it('gives Cursor its prompt-and-doctor activation path', () => {
+  it('gives Cursor its fresh-conversation and first-Stop activation path', () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-cursor-first-run-'))
     const io = new CapturedIo()
     const deps = {
@@ -5336,7 +6611,7 @@ describe('asking before the hooks have ever run', () => {
     io.outLines = []
 
     expect(askCommand(deps, 'Ship it?', {})).toBe(EXIT.usage)
-    expect(io.errLines.join(' ')).toMatch(/Cursor: send one prompt, then run `notifai doctor`/)
+    expect(io.errLines.join(' ')).toMatch(/Cursor: start one fresh conversation[\s\S]*finish its first turn[\s\S]*`notifai doctor`/)
   })
 
   it('keeps OpenCode activation separate from unsupported answer continuation', () => {
@@ -5591,7 +6866,7 @@ describe('command failures carrying server details', () => {
 })
 
 describe('question sets', () => {
-  it('maps --reply-multi into the single question', async () => {
+  it('maps --multi into the single question', async () => {
     const io = new CapturedIo()
     let submitted: SubmitNotificationRequestT | undefined
     const client = {
@@ -5608,8 +6883,8 @@ describe('question sets', () => {
         body: 'Which fronts?',
         reply: true,
         replyTimeout: 30,
-        replyChoice: ['CLI', 'Server', 'Apps'],
-        replyMulti: true,
+        choice: ['CLI', 'Server', 'Apps'],
+        multi: true,
       }),
     ).toBe(EXIT.ok)
     expect(submitted?.draft.reply?.questions?.[0]).toMatchObject({
@@ -5643,7 +6918,10 @@ describe('question sets', () => {
     expect(submitted?.draft.reply?.questions[0]?.text).toBe('Which environment?')
   })
 
-  it('composes one question before optional Markdown context', () => {
+  it('keeps the question out of a body that carries context', () => {
+    // The question already travels as the title and as structured questions;
+    // repeating it in the body showed it twice on the lock screen and the
+    // reply screen.
     expect(
       buildQuestions(
         { body: '## Why\nThe release window closes today.' },
@@ -5651,12 +6929,28 @@ describe('question sets', () => {
       ),
     ).toMatchObject({
       ok: true,
-      body: 'Which environment?\n\n## Why\nThe release window closes today.',
+      body: '## Why\nThe release window closes today.',
       questions: [{ text: 'Which environment?' }],
     })
   })
 
-  it('composes numbered form questions before form context', () => {
+  it('lets the question stand in for the body only when there is no context', () => {
+    expect(buildQuestions({}, 'Which environment?')).toMatchObject({
+      ok: true,
+      body: 'Which environment?',
+    })
+    expect(
+      buildQuestions(
+        { form: JSON.stringify({ questions: [{ text: 'Deploy where?' }, { text: 'What should I monitor?' }] }) },
+        undefined,
+      ),
+    ).toMatchObject({
+      ok: true,
+      body: '1. Deploy where?\n2. What should I monitor?',
+    })
+  })
+
+  it('keeps form questions out of a body that carries form context', () => {
     expect(
       buildQuestions(
         {
@@ -5669,8 +6963,7 @@ describe('question sets', () => {
       ),
     ).toMatchObject({
       ok: true,
-      body:
-        '1. Deploy where?\n2. What should I monitor?\n\n## Context\nTraffic is elevated.',
+      body: '## Context\nTraffic is elevated.',
     })
   })