@rubytech/create-maxy-code 0.1.33 → 0.1.34

package/dist/index.js

@@ -38,7 +38,7 @@ const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
 const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.configDir);
 const LOG_DIR = join(PERSIST_DIR, "logs");
 const LOG_FILE = join(LOG_DIR, `install-${new Date().toISOString().replace(/[:.]/g, "-")}.log`);
-// Task 048 — every `claude plugin` shellout must read/write the per-brand
+// every `claude plugin` shellout must read/write the per-brand
 // CLAUDE_CONFIG_DIR that the systemd unit at port-resolution.ts:229,286 uses
 // at runtime. Without this override, the installer writes marketplaces and
 // enabledPlugins to $HOME/.claude/settings.json (user-default), and the
@@ -49,8 +49,9 @@ function claudePluginEnv() {
     return { ...process.env, CLAUDE_CONFIG_DIR };
 }
 /** Known brand hostnames in the Maxy ecosystem. Each brand ships a main unit
- *  (`<hostname>.service`) and a per-brand edge unit (`<hostname>-edge.service`,
- *  Task 662). Peer-brand detection matches only these filenames — stale units,
+ *  (`<hostname>.service`) and a per-brand edge unit
+ *  (`<hostname>-edge.service`). Peer-brand detection matches only these
+ *  filenames — stale units,
  *  gnome-keyring disable markers, and unrelated user services are not peer
  *  evidence. When a third brand is added under `brands/`, append its hostname
  *  here AND in the matching constant in `uninstall.ts` (intentional duplication
@@ -59,7 +60,7 @@ const KNOWN_BRAND_HOSTNAMES = ["maxy", "realagent", "maxy-2", "maxy-3", "maxy-4"
 // The device's actual hostname — may differ from BRAND.hostname if the user customized it.
 // Updated by installSystemDeps() after hostname setup; used for user-facing URLs.
 let DEVICE_HOSTNAME = BRAND.hostname;
-// Task 929 — absolute path to the non-snap Chromium binary chosen during
+// absolute path to the non-snap Chromium binary chosen during
 // installSystemDeps(). Defaults to /usr/bin/chromium so non-Linux installs
 // (which never call ensureNonSnapChromium) and the systemd unit's
 // PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH still see a sensible value. On Linux,
@@ -162,7 +163,7 @@ function shell(command, args, options) {
     const cmd = options?.sudo ? "sudo" : command;
     const cmdArgs = options?.sudo ? [command, ...args] : args;
     const start = Date.now();
-    // Redaction (Task 744): callers handling secrets pass redact: true so the
+    // Redaction: callers handling secrets pass redact: true so the
     // wrapper records the command name only, not the secret-bearing args. The
     // child process still receives the real args via spawnSync below; only the
     // install log line is sanitised. The grep-able audit shape stays:
@@ -178,7 +179,7 @@ function shell(command, args, options) {
         env: options?.env,
     });
     const dur = ((Date.now() - start) / 1000).toFixed(1);
-    // bestEffort (Task 787): tear-down ops on units/state that may or may not
+    // bestEffort: tear-down ops on units/state that may or may not
     // exist (stop/disable a system service we may never have started, reset-failed
     // a freshly-created unit) log the non-zero exit but do not throw. Reserved
     // for the "may not exist" pattern only — never use for ops that must succeed.
@@ -269,12 +270,12 @@ function canSudo() {
     const result = spawnSync("sudo", ["-n", "true"], { stdio: "pipe", timeout: 5_000 });
     return result.status === 0;
 }
-// Task 634 — verified-not-asserted apt-dep reconciliation.
-// Task 637 — resolve package-name aliases before probing dpkg, so the
+// verified-not-asserted apt-dep reconciliation.
+// resolve package-name aliases before probing dpkg, so the
 // post-install check no longer false-negatives when apt resolves a virtual
 // name (e.g. Noble's `chromium` → `chromium-browser`).
 // UBUNTU_ALIASES, parseOsRelease, isUbuntuLike, and decideAptResolution moved
-// to ./apt-resolve.ts (Task 638). The pure logic lives there so a unit test
+// to./apt-resolve.ts. The pure logic lives there so a unit test
 // can hit every branch without spawning real apt/dpkg or reading
 // /etc/os-release. The thin wrappers below feed real spawn + fs results into
 // that pure decision.
@@ -297,7 +298,7 @@ function aptCachePolicySummary(pkg) {
     return cand === "(none)" ? "candidate-none" : `candidate=${cand}`;
 }
 /**
- * Task 637 — map an apt-level package name to the concrete name dpkg will
+ * map an apt-level package name to the concrete name dpkg will
  * record after install. Resolution order:
  *   1. `dpkg -s pkg` exits 0 → name is concrete and installed; return pkg.
  *   2. `apt-cache policy pkg` reports a real Candidate → concrete-but-missing;
@@ -306,7 +307,7 @@ function aptCachePolicySummary(pkg) {
  *      UBUNTU_ALIASES on an Ubuntu-like host → return the alias. Log the
  *      resolution so the install log answers "what did apt resolve this to?".
  *   4. Otherwise return pkg unchanged — the post-check will throw loudly,
- *      preserving Task 634's fail-loud contract for genuinely missing packages.
+ *      preserving the fail-loud contract for genuinely missing packages.
  */
 function resolveAptName(pkg) {
     const dpkg = spawnSync("dpkg", ["-s", pkg], { stdio: "pipe", timeout: 5_000 });
@@ -371,7 +372,7 @@ function pkgsMissing(pkgs) {
  * surface at runtime when the binary is missing.
  *
  * Resolves each package through `resolveAptName` before both the install
- * command and the post-check, so alias packages (Task 637) pass through
+ * command and the post-check, so alias packages pass through
  * cleanly on distros where the apt-level name differs from the dpkg-recorded
  * name (e.g. Noble's chromium → chromium-browser). Resolution is computed
  * once per package and reused across install, post-check, and error
@@ -396,7 +397,7 @@ function installAptGroup(label, pkgs) {
 // ---------------------------------------------------------------------------
 const TOTAL = "11";
 /**
- * Task 840 — set macOS hostname via scutil. Three sequential `sudo scutil
+ * set macOS hostname via scutil. Three sequential `sudo scutil
  * --set` calls (HostName, LocalHostName, ComputerName) — `hostnamectl` is
  * Linux-only and `--hostname <h>` silently no-ops on darwin. All-or-nothing
  * rollback within the 3-call batch: if any call fails, we restore the
@@ -430,7 +431,7 @@ function setMacosHostnameViaScutil(hostname) {
     console.log(`  [scutil] HostName=${hostname} LocalHostName=${hostname} ComputerName=${hostname} set ok`);
 }
 /**
- * Task 929 — detect snap-confined Chromium on Linux and install Google Chrome
+ * detect snap-confined Chromium on Linux and install Google Chrome
  * stable as the non-snap replacement. Runs after `installAptGroup("VNC stack")`
  * inside `installSystemDeps`. Resolution rules live in `snap-chromium.ts`
  * (pure decision); this wrapper does the spawnSync + apt-repo writes + post-
@@ -452,7 +453,7 @@ function setMacosHostnameViaScutil(hostname) {
  *
  * Post-install gate: spawn the resolved binary headless against a throwaway
  * profile dir under persistDir, assert exit 0. The AppArmor denial that
- * triggered Task 929 was on SingletonLock writes which `--headless=new` still
+ * triggered the original denial was on SingletonLock writes which `--headless=new` still
  * attempts, so the headless probe fires the same EACCES path that production
  * VNC headed launches do — closing the post-fix-sibling-audit-skipped gap.
  */
@@ -544,7 +545,7 @@ function ensureNonSnapChromium() {
     runChromiumPostInstallGate(RESOLVED_CHROMIUM_BIN);
 }
 /**
- * Task 929 post-install gate. Spawns the resolved Chromium binary headless
+ * post-install gate. Spawns the resolved Chromium binary headless
  * against a throwaway profile dir under persistDir (`~/.{brand}/chromium-
  * gate-profile/`). The AppArmor denial that triggered the task was on
  * SingletonLock writes which `--headless=new` still attempts, so this probe
@@ -556,7 +557,7 @@ function runChromiumPostInstallGate(chromiumBin) {
     const persistDir = resolve(process.env.HOME ?? "/root", BRAND.configDir);
     const gateProfileDir = join(persistDir, "chromium-gate-profile");
     mkdirSync(gateProfileDir, { recursive: true });
-    console.log(`  Verifying ${chromiumBin} can write to ${gateProfileDir} (Task 929 post-install gate)...`);
+    console.log(`  Verifying ${chromiumBin} can write to ${gateProfileDir} (post-install gate)...`);
     const r = spawnSync(chromiumBin, [
         `--user-data-dir=${gateProfileDir}`,
         "--headless=new",
@@ -575,7 +576,7 @@ function runChromiumPostInstallGate(chromiumBin) {
         const stderr = (r.stderr ?? "").slice(-2000);
         const eaccesHit = /Permission denied/i.test(stderr) || /EACCES/i.test(stderr);
         const taskRef = eaccesHit
-            ? "Task 929: chromium-profile not writable (likely AppArmor denial on snap-confined binary). "
+            ? "chromium-profile not writable (likely AppArmor denial on snap-confined binary). "
             : "";
         throw new Error(`${taskRef}Chromium post-install gate failed: ${chromiumBin} exited ${r.status} signal=${r.signal ?? "none"}. stderr:\n${stderr}`);
     }
@@ -583,7 +584,7 @@ function runChromiumPostInstallGate(chromiumBin) {
     logFile(`  [snap-chromium] post-install gate ok: ${chromiumBin} exit=0`);
 }
 /**
- * Task 929 — write the resolved Chromium absolute path to
+ * write the resolved Chromium absolute path to
  * `<INSTALL_DIR>/platform/config/chromium-binary.path` so vnc.sh,
  * writeChromiumWrapper, and setup-tunnel.sh all read the same value. Called
  * after deployPayload so the platform/config/ directory exists. Idempotent:
@@ -606,7 +607,7 @@ function installSystemDeps() {
     log("1", TOTAL, "System dependencies and network...");
     const platform = requireSupportedPlatform(process.platform);
     if (platform === "darwin") {
-        // Task 840 — darwin hostname via scutil when --hostname is supplied,
+        // darwin hostname via scutil when --hostname is supplied,
         // otherwise preserve the existing system hostname.
         if (HOSTNAME_FLAG) {
             console.log(`  Hostname: ${HOSTNAME_FLAG} (from --hostname flag)`);
@@ -625,8 +626,8 @@ function installSystemDeps() {
             }
             catch { /* fallback to brand — set at declaration */ }
         }
-        // Task 839 — macOS has no apt analogue for the VNC/WiFi-AP stacks
-        // (kiosk display + hostapd/dnsmasq are Pi-specific per Task 836's
+        // macOS has no apt analogue for the VNC/WiFi-AP stacks
+        // (kiosk display + hostapd/dnsmasq are Pi-specific's
         // out-of-scope note). mDNS is provided by the OS, so avahi-* drop out.
         // Translate the remaining apt names through decideBrewResolution and
         // let installAllBrewPackages handle the install + verify pattern.
@@ -636,25 +637,25 @@ function installSystemDeps() {
     }
     const BASE_DEPS = ["curl", "git", "unzip", "jq", "avahi-daemon", "avahi-utils", "poppler-utils", "ffmpeg", "bind9-dnsutils"];
     // xterm is the *preferred* terminal-emulator binary for the VNC-rendered
-    // Terminal surface (Task 632 — gnome-terminal is a D-Bus launcher that
+    // Terminal surface
     // delegates window creation to the session's gnome-terminal-server,
     // opening windows on the wrong display; xterm has no IPC layer and
     // honours DISPLAY directly). Kept in the apt list unconditionally so
     // vnc.sh's resolve_terminal_bin has a display-safe binary on every
     // supported distro (Ubuntu 24.04 noble/universe, Debian 12 bookworm/main
-    // verified). xdotool (Task 632) backs the post-spawn display-membership
+    // verified). xdotool backs the post-spawn display-membership
     // assertion in vnc.sh check_window_on_display, closing the silent-fail
     // class where PID is alive but no window is mapped on the target display.
     const VNC_DEPS = ["tigervnc-standalone-server", "python3-websockify", "novnc", "xdg-utils", "chromium", "xterm", "xdotool"];
-    // Task 664 retired the ttyd/tmux admin terminal stack — upgrades run via
+    // retired the ttyd/tmux admin terminal stack — upgrades run via
     // the action runner (systemd-run --user transient units) and no longer
     // need a shared tmux session. `tmux` was only required by the retired
     // byte-stream terminal; removing it shrinks the apt footprint.
     const WIFI_DEPS = ["hostapd", "dnsmasq"];
     const ALL_APT_DEPS = [...BASE_DEPS, ...VNC_DEPS, ...WIFI_DEPS];
-    // Task 634 — verify the "deps are present" assumption with `dpkg -s` instead
+    // verify the "deps are present" assumption with `dpkg -s` instead
     // of asserting it (feedback_loud_failures.md). The previous silent-skip
-    // branch was benign until Task 632 added xdotool (the first new apt dep
+    // branch was benign added xdotool (the first new apt dep
     // since the skip path became load-bearing on user-password-sudo devices).
     const missing = pkgsMissing(ALL_APT_DEPS);
     if (missing.length === 0) {
@@ -680,7 +681,7 @@ function installSystemDeps() {
         installAptGroup("VNC stack", VNC_DEPS);
         installAptGroup("WiFi AP", WIFI_DEPS);
     }
-    // Task 929 — replace snap-confined Chromium with Google Chrome stable on
+    // replace snap-confined Chromium with Google Chrome stable on
     // Linux laptops (Ubuntu Noble) where `/usr/bin/chromium` realpaths to the
     // snap launcher. The snap AppArmor profile denies writes to hidden top-level
     // paths under $HOME, so any write to `~/.{brand}/chromium-profile/SingletonLock`
@@ -733,11 +734,11 @@ function installSystemDeps() {
         // set by the user or the first installer — subsequent brands must not overwrite it.
         const systemdUserDir = resolve(process.env.HOME ?? "/root", ".config/systemd/user");
         const serviceExists = existsSync(join(systemdUserDir, BRAND.serviceName));
-        // Task 690: narrow peer detection to KNOWN_BRAND_HOSTNAMES. The previous
+        // narrow peer detection to KNOWN_BRAND_HOSTNAMES. The previous
         // predicate ("any *.service that isn't ours") matched stray user units
         // such as a `gnome-keyring-daemon.service -> /dev/null` disable marker,
         // silently flipping single-brand fresh installs into the "preserve hostname"
-        // branch. Mirrors Task 683's `peerBrandPresent` allowlist in `uninstall.ts`.
+        // branch. Mirrors the `peerBrandPresent` allowlist in `uninstall.ts`.
         let otherBrandService = false;
         if (!serviceExists) {
             const peerUnits = KNOWN_BRAND_HOSTNAMES
@@ -876,7 +877,7 @@ function installNodejs() {
     if (platform === "darwin") {
         // Pass the apt-side `nodejs` name; decideBrewResolution maps it to
         // `node@22` per DARWIN_ALIASES so the cellar formula matches Maxy's
-        // pinned-binaries floor (Task 836).
+        // pinned-binaries floor.
         installAllBrewPackages(["nodejs"], logFile);
         return;
     }
@@ -931,14 +932,14 @@ function installClaudeCode() {
         }
     }
     console.log("  Registering Claude plugin marketplaces...");
-    // Task 048 — pre-create the per-brand CLAUDE_CONFIG_DIR so the first
+    // pre-create the per-brand CLAUDE_CONFIG_DIR so the first
     // `claude plugin marketplace add` has a directory to write into.
     mkdirSync(CLAUDE_CONFIG_DIR, { recursive: true });
     const marketplaceList = spawnSync("claude", ["plugin", "marketplace", "list"], { stdio: "pipe", encoding: "utf-8", env: claudePluginEnv() });
     if (marketplaceList.stderr)
         process.stderr.write(marketplaceList.stderr);
     const listed = marketplaceList.stdout ?? "";
-    // Task 976: register three Anthropic marketplaces uniformly with
+    // register three Anthropic marketplaces uniformly with
     // [plugin-marketplace] observability. Each slug is grep-checked against
     // `marketplace list` for idempotence; failures log exit + first stderr
     // line but do not abort the installer (one marketplace's outage must not
@@ -1052,7 +1053,7 @@ function resetNeo4jAuth(port = DEFAULT_NEO4J_PORT, dataDir = "/var/lib/neo4j") {
     return password;
 }
 /**
- * Task 744 — scrub plaintext neo4j passwords from pre-fix install-*.log files.
+ * scrub plaintext neo4j passwords from pre-fix install-*.log files.
  * Calls platform/scripts/redact-install-logs.sh against the installer's LOG_DIR.
  * The script is idempotent; re-running on clean logs is a no-op. Failures here
  * are non-fatal — credential redaction is best-effort cleanup, not a blocker
@@ -1099,7 +1100,7 @@ function ensureNeo4jPassword() {
         }
     }
     // 2. Fresh install or recovery: no working same-brand password. Generate and set a new one.
-    //    Brand isolation (Task 659): never read another brand's .neo4j-password.
+    //    Brand isolation: never read another brand's.neo4j-password.
     if (!existsSync(passwordFile)) {
         console.log("  No Neo4j password file found. Setting initial password...");
     }
@@ -1135,7 +1136,7 @@ function installNeo4j() {
     if (platform === "darwin") {
         // Homebrew's neo4j formula declares openjdk as a runtime dependency, so
         // Java is pulled in transitively — no separate openjdk install step.
-        // Process supervision (launchd LaunchAgent) is owned by Task 838; this
+        // Process supervision (launchd LaunchAgent) is owned; this
         // step ends after `brew install neo4j` + initial-password seeding so the
         // payload deploy step finds the shared password file.
         installAllBrewPackages(["neo4j"], logFile);
@@ -1190,7 +1191,7 @@ function installNeo4j() {
     console.log("  Neo4j started. Password stored securely.");
 }
 /**
- * Task 800 — does any peer brand on this host pin `NEO4J_URI=bolt://localhost:<default>`
+ * does any peer brand on this host pin `NEO4J_URI=bolt://localhost:<default>`
  * in its `.env`? If yes, the apt-installed `neo4j.service` is its database and the
  * dedicated-unit installer must NOT stop+disable it. Returns the first matching
  * peer's hostname, or `null` when no peer pins the default port.
@@ -1200,7 +1201,7 @@ function installNeo4j() {
  * (permissions, transient I/O), the wrapper treats that peer as a *potential*
  * dependency and short-circuits to the kept-active path. Disabling the system
  * unit on faulty evidence would silently kill the peer's database (the exact
- * failure Task 800 prevents); a conservatively-skipped disable is recoverable
+ * failure mode the kept-active path prevents); a conservatively-skipped disable is recoverable
  * because the dedicated-unit bind check at the end of `setupDedicatedNeo4j`
  * fails loud if the system unit is actually free.
  */
@@ -1235,12 +1236,12 @@ function peerBrandUsingSystemUnit() {
  * Create a dedicated Neo4j instance for this brand when NEO4J_DEDICATED is true.
  * Produces: separate config dir, data dir, log dir, systemd service, and password.
  * On upgrade (config already exists), skips conf creation — but always runs the
- * Task 787 state-remediation block (stop/disable system unit, reset-failed
+ * state-remediation block (stop/disable system unit, reset-failed
  * dedicated, start, verify) so a half-installed Pi recovers in-place without
  * manual systemctl. ensureNeo4jPassword() handles password verification on the
  * recovery path.
  *
- * Task 800: on multi-brand hosts where a peer brand still depends on the apt
+ * on multi-brand hosts where a peer brand still depends on the apt
  * `neo4j.service` (port 7687), the stop+disable step is skipped — disabling
  * the system unit would kill the peer's database.
  */
@@ -1255,8 +1256,8 @@ function setupDedicatedNeo4j() {
     const httpPort = NEO4J_PORT - 213; // Preserve standard 7687/7474 offset
     // Per-brand state (sed, mkdir, chown, unit-write) is idempotent and runs on
     // every install. Only the base-config copy and initial-password rotation are
-    // gated to first install — Task 787 established that state remediation must
-    // run every install; Task 979 extended the same principle to the conf and
+    // gated to first install established that state remediation must
+    // run every install extended the same principle to the conf and
     // unit emission so a half-installed host (broken unit missing NEO4J_HOME)
     // recovers on retry without an out-of-band manual reset.
     const confExists = spawnSync("test", ["-f", `${confDir}/neo4j.conf`], { stdio: "pipe" }).status === 0;
@@ -1279,12 +1280,12 @@ function setupDedicatedNeo4j() {
         console.log("  [privileged] cp -r");
         shell("cp", ["-r", "/etc/neo4j", confDir], { sudo: true });
     }
-    // Idempotent per-brand state — runs on every install (Task 979).
+    // Idempotent per-brand state — runs on every install.
     // sed `s|^#?key=.*|key=value|` no-ops when the file already has the target
     // value; mkdir -p, chown -R, and unit-write are idempotent by definition.
     // NEO4J_HOME=${dataDir} makes server.directories.run resolve per-brand to
     // ${dataDir}/run, so the launcher's pre-flight does not collide with the
-    // system unit's /var/lib/neo4j/run/neo4j.pid (Task 979 root cause). Plugins
+    // system unit's /var/lib/neo4j/run/neo4j.pid (root cause). Plugins
     // and import are sed-overridden because the apt base conf pins them to
     // absolute /var/lib/neo4j/plugins and /var/lib/neo4j/import (shared).
     console.log("  [privileged] sed -i");
@@ -1347,7 +1348,7 @@ WantedBy=multi-user.target
         });
     }
     // ============================================================================
-    // Task 787 — unified state remediation + start + verify.
+    // unified state remediation + start + verify.
     //
     // Runs on both fresh and recovery paths. The dedicated unit and the apt
     // package's system unit both exec /usr/bin/neo4j console without overriding
@@ -1360,9 +1361,9 @@ WantedBy=multi-user.target
     spawnSync("sudo", ["systemctl", "daemon-reload"], { stdio: "inherit" });
     console.log("  [privileged] systemctl enable");
     shell("systemctl", ["enable", serviceName], { sudo: true });
-    // Task 800: skip stop+disable when a peer brand on this host still depends
+    // skip stop+disable when a peer brand on this host still depends
     // on the apt `neo4j.service` (port 7687). Disabling it would kill the peer's
-    // database — Task 797 reproducer on Neo's laptop. The kept-active path is
+    // database reproducer on Neo's laptop. The kept-active path is
     // mutually exclusive with the disable path: exactly one log line per install.
     const peerOnSystemUnit = peerBrandUsingSystemUnit();
     if (peerOnSystemUnit !== null) {
@@ -1397,7 +1398,7 @@ WantedBy=multi-user.target
         spawnSync("sleep", ["2"]);
     }
     if (!listening) {
-        // Loud failure — no silent fallback to the system instance (Task 787).
+        // Loud failure — no silent fallback to the system instance.
         const portCheck = spawnSync("ss", ["-tlnp"], { stdio: "pipe", timeout: 5000 });
         const portLines = (portCheck.stdout?.toString() ?? "").split("\n").filter((l) => l.includes(String(NEO4J_PORT)));
         const diagnostic = portLines.length > 0 ? portLines.join("; ") : "nothing listening on port";
@@ -1477,7 +1478,7 @@ function installOllama(embedModel) {
     logFile(`  Pulling embedding model: ${embedModel}`);
     shellRetry("ollama", ["pull", embedModel], { timeout: 600_000 }, 3, 15);
 }
-// Task 557 — uv/uvx bootstrap. Required by the `graph` MCP server which
+// uv/uvx bootstrap. Required by the `graph` MCP server which
 // spawns `uvx mcp-neo4j-cypher@0.6.0 --transport stdio`. Idempotent: when
 // uvx is already on PATH (or under $HOME/.local/bin) we skip. Non-fatal on
 // failure — the installer continues; the graph server will loudly fail
@@ -1524,7 +1525,7 @@ function installCloudflared() {
         // Homebrew's `cloudflared` formula tracks the Cloudflare release stream;
         // tunnel-login flow stays unchanged (`feedback_no_api_token_route.md`).
         // `cloudflared service install` is invoked by the launchd supervisor in
-        // Task 838 — out of scope here.
+        // out of scope here.
         installAllBrewPackages(["cloudflared"], logFile);
         return;
     }
@@ -1573,7 +1574,7 @@ function installWhisperCpp() {
 }
 /**
  * Provision the shared HMAC secret used to sign remote-session cookies
- * (Task 653). Both `maxy-edge` and `maxy-ui` read this file; without it
+ *. Both `maxy-edge` and `maxy-ui` read this file; without it
  * they independently mint ephemeral secrets on first use and the
  * cross-process session namespace silently diverges again.
  *
@@ -1593,7 +1594,7 @@ function provisionRemoteSessionSecret() {
     writeFileSync(secretFile, randomBytes(32).toString("hex"), { mode: 0o600 });
     console.log(`  [install] remote-session-secret provisioned path=${secretFile}`);
 }
-// Task 904 — install-time admin-auth invariant. Walks every account.json
+// install-time admin-auth invariant. Walks every account.json
 // under accountsDir and compares its admins[] to the persistent users.json,
 // emitting one [install-invariant] line per divergence and one summary line.
 // Log-only (no install abort) so pre-Task-904 devices with already-divergent
@@ -1697,7 +1698,7 @@ function deployPayload() {
         mkdirSync(persistentDir, { recursive: true });
         cpSync(oldAccountsDir, persistentAccountsDir, { recursive: true });
     }
-    // Task 904 — users.json lives at <persistentDir>/users.json. Pre-Task-904
+    // users.json lives at <persistentDir>/users.json. earlier
     // installs wrote to <INSTALL_DIR>/platform/config/users.json (the wipe zone)
     // and relied on a one-shot copy-up at first install plus a copy-back after
     // every wipe. The copy-back overwrote LIVE with the FROZEN-AT-FIRST-INSTALL
@@ -1707,7 +1708,7 @@ function deployPayload() {
     //
     // Legacy pickup: if a pre-Task-904 install left users.json inside the wipe
     // zone, copy it up once. Idempotent — guarded by !existsSync(persistentUsersFile).
-    // Safe to delete this block one release after Task 904 has been deployed
+    // Safe to delete this block one release has been deployed
     // everywhere; until then it absorbs upgrades from any pre-Task-904 version.
     const persistentUsersFile = join(persistentDir, "users.json");
     const oldUsersFile = join(INSTALL_DIR, "platform/config/users.json");
@@ -1716,7 +1717,7 @@ function deployPayload() {
         cpSync(oldUsersFile, persistentUsersFile);
         console.log("  Migrated pre-Task-904 users.json to persistent storage.");
     }
-    // Task 923 — Claude Code OAuth credentials legacy pickup. Pre-Task-923
+    // Claude Code OAuth credentials legacy pickup. earlier
     // installs shared `~/.claude/.credentials.json` across brands; the brand
     // main service's `claude` SDK subprocess and admin server now read from
     // `${persistDir}/.claude/.credentials.json` per the new
@@ -1750,7 +1751,7 @@ function deployPayload() {
         }
         writeFileSync(credsMigratedStamp, new Date().toISOString() + "\n");
     }
-    // Task 019 — pre-populate the brand `.claude.json` so the manager's
+    // pre-populate the brand `.claude.json` so the manager's
     // PTY-spawned `claude --verbose --remote-control` boots straight into the
     // session URL without stopping at the first-run theme picker or the
     // workspace-trust dialog. Both prompts ate the manager's 30 s url-capture
@@ -1783,11 +1784,11 @@ function deployPayload() {
     console.log(`  [install] claude-state primed: ${claudeStateFile} hasCompletedOnboarding=true trustedWorkspace=${homeWorkspace}`);
     // Brand isolation: installer does not read ~/.maxy/, ~/.cloudflared/, or
     // ~/.cloudflare/ on non-default brands. These are peer-brand or shared-singleton
-    // paths (Task 659). Pre-Task-659 installs that need to recover legacy state
+    // paths. earlier installs that need to recover legacy state
     // follow the manual recovery paragraph in .docs/deployment.md.
     // Stop the running service before wiping directories (upgrade path).
     // The server holds open files in platform/ — rmSync fails with ENOTEMPTY if it's running.
-    // Task 838 — darwin uses `launchctl bootout` instead of systemctl; bootout
+    // darwin uses `launchctl bootout` instead of systemctl; bootout
     // returns synchronously when the agent has exited.
     if (requireSupportedPlatform(process.platform) === "darwin") {
         spawnSync("launchctl", ["bootout", `${gui()}/${launchdLabel()}`], { stdio: "pipe", timeout: 15_000 });
@@ -1858,7 +1859,7 @@ function deployPayload() {
         cpSync(persistentPasswordFile, join(configDir, ".neo4j-password"));
         console.log("  Restored Neo4j password.");
     }
-    // Task 904 — users.json is read directly from persistentDir by both
+    // users.json is read directly from persistentDir by both
     // platform/ui/app/lib/paths.ts (USERS_FILE = MAXY_DIR/users.json) and the
     // admin MCP plugin (USERS_FILE = CONFIG_DIR/users.json). No copy into the
     // wipe zone — the pre-Task-904 cpSync to platform/config/users.json was the
@@ -1883,7 +1884,7 @@ function deployPayload() {
     else {
         console.log("  [install] users.json: no persistent file (fresh install — set-pin will create it)");
     }
-    // Task 904 item 3 — install-time admin-auth invariant check. Walks every
+    // install-time admin-auth invariant check. Walks every
     // data/accounts/*/account.json admins[] and compares to the persistent
     // users.json. Log-only (does NOT refuse install) so pre-Task-904 devices
     // with already-divergent state still upgrade; the [install-invariant]
@@ -1897,7 +1898,7 @@ function deployPayload() {
     writeFileSync(join(configDir, `.${BRAND.hostname}-version`), PKG_VERSION, "utf-8");
     console.log(`  Deployed to ${INSTALL_DIR}`);
 }
-// Task 030 — register the local + external Claude Code plugins after the
+// register the local + external Claude Code plugins after the
 // payload is on disk. The bundler stamps `.claude-plugin/marketplace.json`
 // at each plugin-tree root (platform/plugins/, premium-plugins/real-agent/
 // plugins/, premium-plugins/) so this function discovers them generically
@@ -1940,7 +1941,7 @@ function registerLocalAndExternalPlugins() {
         }
     }
     // Add each local marketplace. Idempotence via `marketplace list` grep.
-    // Task 048 — every `claude plugin …` call carries CLAUDE_CONFIG_DIR so
+    // every `claude plugin …` call carries CLAUDE_CONFIG_DIR so
     // marketplaces register into the per-brand config dir that the runtime
     // session-manager unit reads from.
     const mkList = spawnSync("claude", ["plugin", "marketplace", "list"], { stdio: "pipe", encoding: "utf-8", env: claudePluginEnv() });
@@ -2030,7 +2031,7 @@ function registerLocalAndExternalPlugins() {
             logFile(`[plugin-configure] ERROR ${action.plugin.name} exit=${configure.status} stderr=${JSON.stringify(stderrShort)}`);
         }
     }
-    // Task 048 — post-install assertion. The per-brand CLAUDE_CONFIG_DIR is the
+    // post-install assertion. The per-brand CLAUDE_CONFIG_DIR is the
     // only surface the runtime session-manager reads from; if any expected
     // marketplace is missing under .claude/plugins/marketplaces/, the operator
     // will hit "Unknown skill: onboarding" at step 6 of the bring-up. Fail the
@@ -2045,7 +2046,7 @@ function registerLocalAndExternalPlugins() {
         "claude-for-financial-services",
         ...localTrees.map(t => t.name),
     ]);
-    // Task 057: `claude plugin marketplace list` is the authoritative source.
+    // `claude plugin marketplace list` is the authoritative source.
     // The `.claude/plugins/marketplaces/` directory only contains subdirs for
     // remote (git-cloned) marketplaces — local-source marketplaces registered
     // via `claude plugin marketplace add <directory-path>` live in user
@@ -2111,7 +2112,7 @@ function buildPlatform() {
     }
     console.log(`  Installing server dependencies (${join(INSTALL_DIR, "server")})...`);
     shellRetry("npm", ["install", "--omit=dev", ...NPM_NET_FLAGS], { cwd: join(INSTALL_DIR, "server") }, 3, 15);
-    // Task 001 (maxy-code) — claude-session-manager has its own package.json
+    // (maxy-code) — claude-session-manager has its own package.json
     // declaring hono + @hono/node-server + node-pty. node-pty is a native
     // binding; it MUST be installed on the Pi, not shipped pre-built (different
     // architecture between the build host and the Pi). Wipe + reinstall on
@@ -2231,7 +2232,7 @@ function setupVncViewer() {
       } catch (e) { /* swallow */ }
     }
 
-    // Layer-6 beacon (Task 958): emit event=rfb-connected and
+    // Layer-6 beacon: emit event=rfb-connected and
     // event=rfb-error to the operator-grep lifecycle endpoint so
     // server.log shows the noVNC outcome alongside [setup-tunnel] /
     // [cloudflare-setup] / [device-url:click] / [http] / [websockify].
@@ -2351,7 +2352,7 @@ function setupVncViewer() {
 }
 function setupAccount() {
     log("10", TOTAL, "Setting up...");
-    // Task 787 — seed-neo4j.sh hard-exits without NEO4J_URI. The installer
+    // seed-neo4j.sh hard-exits without NEO4J_URI. The installer
     // owns the brand-correct URI and password, so we derive them once.
     // Missing password file is a hard error: ensureNeo4jPassword() ran
     // upstream and would have thrown already if it couldn't reach the
@@ -2369,11 +2370,11 @@ function setupAccount() {
         logFile(`  [neo4j] passing NEO4J_URI=${neo4jUri} to seed`);
         shell("bash", [seedScript], { cwd: INSTALL_DIR, env: neo4jEnv });
     }
-    // Task 068 — install-time defaults. Stamp `account.json` with the
+    // install-time defaults. Stamp `account.json` with the
     // brand's default plugin set + default outputStyle / thinkingView, and
     // write a minimal admin SOUL.md. The agent boots into a working state
     // with no onboarding state machine; the operator builds personality up
-    // through use. The graph-write gate (Task 685) blocks user-domain writes
+    // through use. The graph-write gate blocks user-domain writes
     // until AdminUser + LocalBusiness/personal-profile Person exist, so the
     // persona is elicited the first time the operator triggers a write.
     const accountId = resolveInstallAccountId();
@@ -2410,6 +2411,29 @@ function writeInstallDefaults(accountId) {
     writeFileSync(soulPath, `You are ${BRAND.productName}, an AI operations manager.\n`);
     console.log(`  [install-defaults] soul-md path=${soulPath}`);
     logFile(`  [install-defaults] soul-md path=${soulPath}`);
+    // Public agent files — IDENTITY.md is always overwritten (Rubytech-controlled);
+    // SOUL.md and config.json are created if missing (user-controlled). All three
+    // are sourced from the payload templates under
+    // <INSTALL_DIR>/platform/templates/agents/public/.
+    const publicDir = join(accountDir, "agents/public");
+    mkdirSync(publicDir, { recursive: true });
+    const publicTemplatesDir = join(INSTALL_DIR, "platform/templates/agents/public");
+    const publicIdentityDst = join(publicDir, "IDENTITY.md");
+    cpSync(join(publicTemplatesDir, "IDENTITY.md"), publicIdentityDst);
+    console.log(`  [install-defaults] public-identity path=${publicIdentityDst}`);
+    logFile(`  [install-defaults] public-identity path=${publicIdentityDst}`);
+    const publicSoulDst = join(publicDir, "SOUL.md");
+    if (!existsSync(publicSoulDst)) {
+        cpSync(join(publicTemplatesDir, "SOUL.md"), publicSoulDst);
+        console.log(`  [install-defaults] public-soul path=${publicSoulDst}`);
+        logFile(`  [install-defaults] public-soul path=${publicSoulDst}`);
+    }
+    const publicConfigDst = join(publicDir, "config.json");
+    if (!existsSync(publicConfigDst)) {
+        cpSync(join(publicTemplatesDir, "config.json"), publicConfigDst);
+        console.log(`  [install-defaults] public-config path=${publicConfigDst}`);
+        logFile(`  [install-defaults] public-config path=${publicConfigDst}`);
+    }
 }
 // ---------------------------------------------------------------------------
 // Tunnel script shortcuts
@@ -2418,9 +2442,9 @@ function writeInstallDefaults(accountId) {
 // invocation `~/setup-tunnel.sh` (and `~/reset-tunnel.sh`). The filesystem
 // reality is <INSTALL_DIR>/platform/plugins/cloudflare/scripts/*.sh. Without
 // the symlink the agent's first SKILL-compliant invocation fails with exit
-// 127 — the discipline-violation loop Task 555 exists to close.
+// 127 — the discipline-violation loop the symlink exists to close.
 //
-// Collision discipline (Task 659 — last-writer-wins across brands):
+// Collision discipline (last-writer-wins across brands):
 //   - absent path                   → create
 //   - regular file                  → exit 1 (operator-owned file, do not clobber)
 //   - symlink → same target         → no-op
@@ -2458,7 +2482,7 @@ function createTunnelSymlink(linkPath, target) {
         console.error(`  Remove the file and re-run: npx -y @rubytech/create-maxy`);
         process.exit(1);
     }
-    // Brand isolation (Task 659): a symlink at this path is either stale-same-brand,
+    // Brand isolation: a symlink at this path is either stale-same-brand,
     // dangling, unreadable, or pointing at another brand. All four cases are resolved
     // by last-writer-wins overwrite — setup-tunnel.sh takes <brand> as argv, so
     // whichever brand's installer ran last owns the shortcut.
@@ -2505,13 +2529,13 @@ function installTunnelScripts() {
 // ---------------------------------------------------------------------------
 // Account discovery (shared by installService + the post-install summary)
 //
-// Task 955 — `installService` stamps `Environment=ACCOUNT_ID=` into the brand
+// `installService` stamps `Environment=ACCOUNT_ID=` into the brand
 // systemd unit so the writeNodeWithEdges gate has a non-undefined identity to
 // compare against. Pulled from `INSTALL_DIR/data/accounts/<uuid>/account.json`
 // written by seed-neo4j.sh during setupAccount(). One reader, one shape, one
 // source of truth.
 //
-// Task 039 retired the installer's cron registration — `resolveInstallAccountId`
+// retired the installer's cron registration — `resolveInstallAccountId`
 // kept its second consumer (installService) and is referenced again at print
 // time for the post-install banner.
 // ---------------------------------------------------------------------------
@@ -2528,26 +2552,26 @@ function resolveInstallAccountId() {
     catch { /* directory unreadable */ }
     return "";
 }
-// Task 039 — `installCrons()` and the `# BEGIN/END <BRAND> CRONS` block lived
+// `installCrons()` and the `# BEGIN/END <BRAND> CRONS` block lived
 // here. All such events must be user-driven, not scheduled by the installer.
 // The legacy block recreated `data/accounts/<accountId>/logs/` every 60s via
 // `mkdir -p`, which tripped seed-neo4j.sh's stub-account-dirs guard on every
 // reinstall after `rm -rf ~/<installDir>`. Uninstall now strips the legacy
 // block (uninstall.ts `removeLegacyCronBlock`) so older installs migrate
 // cleanly. Consumer-side dispatcher replacement is tracked separately.
-// Task 664 retired the ttyd/tmux/xterm admin terminal stack. Upgrades run
+// retired the ttyd/tmux/xterm admin terminal stack. Upgrades run
 // via the action runner — `systemd-run --user` transient units spawned by
 // POST /api/admin/actions/upgrade — whose lifetime is independent of
-// maxy-ui, achieving the Task 647 invariant structurally rather than via
+// maxy-ui, achieving the invariant structurally rather than via
 // a peer edge service proxying a ttyd process. The installer no longer
 // provisions the ttyd binary, writes a tmux conf, or installs a ttyd
 // systemd unit. The corresponding admin UI (RemoteTerminal, TerminalOverlay,
 // xterm.js) was deleted in the same task.
-// Task 838 — reverse-DNS LaunchAgent label. Becomes both the plist's
+// reverse-DNS LaunchAgent label. Becomes both the plist's
 // <key>Label</key> value and the file basename
 // (`~/Library/LaunchAgents/com.rubytech.<hostname>.plist`). Per-brand so
 // installing brand B never displaces brand A's agent (mirrors the per-brand
-// systemd unit invariant from Task 662).
+// systemd unit invariant).
 function launchdLabel() {
     return `com.rubytech.${BRAND.hostname}`;
 }
@@ -2563,12 +2587,12 @@ function gui() {
     const uid = typeof process.getuid === "function" ? process.getuid() : 0;
     return `gui/${uid}`;
 }
-// Task 838 — darwin LaunchAgent supervisor. Mirrors the systemd-user body
+// darwin LaunchAgent supervisor. Mirrors the systemd-user body
 // below at the success-criteria level: process registered with the user's
 // session manager, KeepAlive respawns on crash, RunAtLoad starts the agent
-// on every login. Out-of-scope today (Task 839): brew-resolved node path,
+// on every login. Out-of-scope today: brew-resolved node path,
 // dedicated Neo4j on a non-default port. Falls back to /usr/local/bin/node
-// (homebrew Intel + manual Apple-silicon installs) — Task 839 will replace
+// (homebrew Intel + manual Apple-silicon installs) will replace
 // this with the resolver.
 function installServiceDarwin() {
     const persistDir = resolve(process.env.HOME ?? "/", BRAND.configDir);
@@ -2617,7 +2641,7 @@ function installServiceDarwin() {
     const nodeBin = (nodeProbe.stdout ?? "").trim() || "/usr/local/bin/node";
     const wrapperBody = [
         "#!/bin/bash",
-        "# Task 838 — generated by create-maxy installService(). Reads .env then",
+        "# generated by create-maxy installService(). Reads.env then",
         "# execs node so launchd's child inherits PORT, NEO4J_URI, etc. Replaces",
         "# the systemd EnvironmentFile= directive that has no launchd analogue.",
         `set -a; [ -f "${envPath}" ] && . "${envPath}"; set +a`,
@@ -2679,7 +2703,7 @@ function installServiceDarwin() {
 }
 function installService() {
     log("11", TOTAL, `Starting ${BRAND.productName}...`);
-    // Task 838 — branch on the Task 836 ternary instead of the legacy
+    // branch ternary instead of the legacy
     // `isLinux()` boolean. Linux falls through to the systemd-user body
     // below; darwin renders + bootstraps a LaunchAgent and returns;
     // unsupported throws the literal refusal at requireSupportedPlatform.
@@ -2756,13 +2780,13 @@ function installService() {
     // Propagate to child processes — seed-neo4j.sh reads both variables.
     process.env.EMBED_DIMENSIONS = String(EMBED_DIMS);
     process.env.NEO4J_URI = `bolt://localhost:${NEO4J_PORT}`;
-    // Task 647: maxy-ui runs on an internal-only port so a restart does not
+    // maxy-ui runs on an internal-only port so a restart does not
     // drop the public TCP socket. maxy-edge.service owns the public port and
     // the VNC stack; maxy-ui sits behind it on 127.0.0.1:MAXY_UI_INTERNAL_PORT.
     // PORT + 1 (derived) avoids a fixed-port collision if the operator chose a
     // non-default --port.
     //
-    // Task 666 — PORT in maxy.service's Environment block is the PUBLIC port,
+    // PORT in maxy.service's Environment block is the PUBLIC port,
     // not the internal one. Previously we wrote `Environment=PORT=<internal>`,
     // which collided with the install-time reader further down, which
     // correctly treats Environment=PORT= as public. The overload caused +1
@@ -2772,10 +2796,10 @@ function installService() {
     const MAXY_UI_INTERNAL_PORT = PORT + 1;
     const edgeUnitShort = `${BRAND.hostname}-edge`;
     const edgeUnitName = `${edgeUnitShort}.service`;
-    // Per-brand X display (Task 553). Same value used for the edge unit's
+    // Per-brand X display. Same value used for the edge unit's
     // DISPLAY env (stamped via __VNC_DISPLAY__ a few lines down) so the main
     // brand service and the edge service agree on which display Chromium runs.
-    // Task 924 + 959 — brand.json (BRAND) is the single source of truth for
+    // brand.json (BRAND) is the single source of truth for
     // these fields at install time. The vncDisplay-derived offset rule lives
     // in the brand-creation tooling; at this point in the installer BRAND
     // already represents a parsed, validated brand manifest, and any missing
@@ -2796,13 +2820,13 @@ function installService() {
     const WEBSOCKIFY_PORT_BRAND = BRAND.websockifyPort;
     const CDP_PORT_BRAND = BRAND.cdpPort;
     const CLAUDE_SESSION_MANAGER_PORT_BRAND = BRAND.claudeSessionManagerPort;
-    // Task 924/938 pre-flight — refuse to write service files if any of the
+    // pre-flight — refuse to write service files if any of the
     // three brand-scoped ports is already held by a process that is NOT this
     // brand's own on-demand browser nor a peer brand's edge stack.
     //
-    // Classification (Task 938 chromium, Task 939 Xtigervnc + websockify) reads
-    // `/proc/<pid>/cmdline` and applies a holder-specific argv anchor. Task 938
-    // covered chromium-only via `--user-data-dir=`; Task 939 closed the gap on
+    // Classification (chromium Xtigervnc + websockify) reads
+    // `/proc/<pid>/cmdline` and applies a holder-specific argv anchor.
+    // covered chromium-only via `--user-data-dir=` closed the gap on
     // Xtigervnc (no such flag — anchor on the `:N` display literal) and
     // websockify (anchor on bind port). Brand identities (configDir,
     // vncDisplay, websockifyPort) come from brand-registry.json which the
@@ -2821,11 +2845,11 @@ function installService() {
         websockifyPort: WEBSOCKIFY_PORT_BRAND,
     };
     // Peer registry — load from payload/platform/config/brand-registry.json
-    // when present (Task 939+ bundles). Older bundles ship without the
+    // when present. Older bundles ship without the
     // registry; in that case peerBrands stays empty. PEER_BRAND classification
     // for Xtigervnc/websockify is a defence-in-depth case anyway (port sets
-    // are disjoint by Task 924), so the empty-list fallback is safe — peer
-    // chromium will fall through to UNRELATED, matching pre-Task 938 behaviour
+    // are disjoint), so the empty-list fallback is safe — peer
+    // chromium will fall through to UNRELATED, matching earlier behaviour
     // for the only realistic scenario (a stale peer browser on the wrong CDP
     // port).
     const peerBrands = (() => {
@@ -2892,7 +2916,7 @@ function installService() {
     const classify = (ssOutput) => classifyPortHolder({
         ssOutput, ownBrand, peerBrands, getCmdline: readCmdline,
     });
-    // Task 939 — log line varies by detected holder so the operator can see
+    // log line varies by detected holder so the operator can see
     // which OWN_BRAND stack is being killed. The kill loop is identical for
     // all three holders (SIGTERM → 300ms → recheck → SIGKILL → recheck), so
     // only the announce line differs.
@@ -2983,7 +3007,7 @@ function installService() {
     checkInstallPortFree("rfbPort", RFB_PORT);
     checkInstallPortFree("websockifyPort", WEBSOCKIFY_PORT_BRAND);
     checkInstallPortFree("cdpPort", CDP_PORT_BRAND);
-    // Task 955 — ACCOUNT_ID stamped into the brand unit so the writeNodeWithEdges
+    // ACCOUNT_ID stamped into the brand unit so the writeNodeWithEdges
     // gate at platform/lib/graph-write/src/index.ts:170 has a real identity to
     // compare against (instead of process.env.ACCOUNT_ID === undefined). Resolved
     // here AFTER setupAccount() ran upstream — seed-neo4j.sh wrote account.json,
@@ -3007,12 +3031,12 @@ function installService() {
         rfbPort: RFB_PORT,
         websockifyPort: WEBSOCKIFY_PORT_BRAND,
         cdpPort: CDP_PORT_BRAND,
-        claudeSessionManagerPort: CLAUDE_SESSION_MANAGER_PORT_BRAND, // Task 001 (maxy-code)
-        chromiumBin: RESOLVED_CHROMIUM_BIN, // Task 929
-        accountId: installAccountId, // Task 955
+        claudeSessionManagerPort: CLAUDE_SESSION_MANAGER_PORT_BRAND,
+        chromiumBin: RESOLVED_CHROMIUM_BIN,
+        accountId: installAccountId,
     });
     writeFileSync(join(serviceDir, BRAND.serviceName), serviceFile);
-    // Task 001 (maxy-code) — write the claude-session-manager unit. The main
+    // (maxy-code) — write the claude-session-manager unit. The main
     // brand unit Requires= + After= this one, so systemd starts it first.
     const claudeSessionManagerUnitName = `${BRAND.hostname}-claude-session-manager.service`;
     const claudeSessionManagerUnit = buildClaudeSessionManagerUnitFile({
@@ -3026,13 +3050,13 @@ function installService() {
     });
     writeFileSync(join(serviceDir, claudeSessionManagerUnitName), claudeSessionManagerUnit);
     logFile(`  ${claudeSessionManagerUnitName}: CLAUDE_SESSION_MANAGER_PORT=${CLAUDE_SESSION_MANAGER_PORT_BRAND}`);
-    // Task 647 — the edge service: always-on front door that owns the public
+    // the edge service: always-on front door that owns the public
     // port (PORT) and the VNC stack (Xtigervnc + websockify). Its lifecycle is
     // independent of the main brand service, so an in-place upgrade triggered
     // from the admin terminal can restart the main brand service without
     // disconnecting the browser's remote terminal WebSocket.
     //
-    // Task 662: the unit is per-brand so two brands on the same device each
+    // the unit is per-brand so two brands on the same device each
     // own their own edge listener on their own EDGE_PORT — installing brand B
     // never rewrites brand A's unit or steals brand A's public port. Upgrades
     // from pre-662 installs require the manual recovery paragraph in
@@ -3040,7 +3064,7 @@ function installService() {
     // intentionally scoped out.
     // VNC_DISPLAY (defined above for the main brand unit) is also stamped into
     // the edge unit so both services agree on the X display. Per-brand display
-    // closes the cross-brand cookie leak documented in Task 553.
+    // closes the cross-brand cookie leak documented.
     const edgeTemplatePath = resolve(INSTALL_DIR, "platform/templates/systemd/edge.service.template");
     if (existsSync(edgeTemplatePath)) {
         const edgeServiceContent = readFileSync(edgeTemplatePath, "utf-8")
@@ -3058,7 +3082,7 @@ function installService() {
     else {
         console.error(`  WARNING: edge.service.template missing at ${edgeTemplatePath} — VNC transport unavailable`);
     }
-    // Task 560: the unit declares Environment=PATH=%h/.local/bin:... so the graph
+    // the unit declares Environment=PATH=%h/.local/bin:... so the graph
     // MCP shim's spawn("uvx", ...) resolves against uv's install location. Without
     // this line, the service inherits the default systemd-user PATH — which
     // excludes ~/.local/bin — and the shim exits ENOENT before any query lands.
@@ -3113,7 +3137,7 @@ WantedBy=multi-user.target
     catch { /* not critical */ }
     // Reload and (re)start.
     //
-    // Task 647 ordering: on upgrades, the old main brand service still holds
+    // ordering: on upgrades, the old main brand service still holds
     // the public port (PORT). Stop it FIRST so the edge can bind that socket;
     // starting the edge first would race against the old main brand service
     // and fail with EADDRINUSE. Fresh installs: the stop is a no-op.
@@ -3184,7 +3208,7 @@ WantedBy=multi-user.target
     // Tunnel script smoke check — the cloudflare SKILL contract invokes
     // ~/setup-tunnel.sh directly. If the install-time symlink creation in
     // installTunnelScripts() didn't land, fail the install loudly here rather
-    // than shipping the exact Task 456 gap Task 555 exists to close.
+    // than shipping a missing-symlink gap that would loop the agent on exit 127.
     for (const linkPath of [
         resolve(process.env.HOME ?? "/root", "setup-tunnel.sh"),
         resolve(process.env.HOME ?? "/root", "reset-tunnel.sh"),
@@ -3204,7 +3228,7 @@ WantedBy=multi-user.target
     }
 }
 // ---------------------------------------------------------------------------
-// Task 034 — Samba provisioning. Runs after installService() so SMB never
+// Samba provisioning. Runs after installService() so SMB never
 // blocks the admin server starting; pure decisions live in samba-provision.ts.
 //
 // Four steps, each emitting one [install-invariant] samba-provision-<step>
@@ -3274,7 +3298,7 @@ function provisionSamba() {
         // the PIN. Scoped tight: only these two literal arg-vectors are
         // permitted; every other smbpasswd flavour still prompts.
         const SUDOERS = "/etc/sudoers.d/maxy-samba";
-        const sudoersBody = "# Task 034 — maxy-code Samba provisioning (smbpasswd sync from platform set-pin route).\n" +
+        const sudoersBody = "# maxy-code Samba provisioning (smbpasswd sync from platform set-pin route).\n" +
             "admin ALL=(root) NOPASSWD: /usr/bin/smbpasswd -a -s admin, /usr/bin/smbpasswd -x admin\n";
         const sudoersTee = spawnSync("sudo", ["tee", SUDOERS], { input: sudoersBody, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 5_000 });
         if (sudoersTee.status !== 0) {
@@ -3333,7 +3357,7 @@ if (_args.includes("--uninstall")) {
 // systemd applies EnvironmentFile=-~/.{brand}/.env AFTER Environment=PORT,
 // so .env is the final runtime truth and must be checked first on upgrade.
 //
-// Task 666 — this block also performs one-shot port-drift recovery against
+// this block also performs one-shot port-drift recovery against
 // maxy-edge.service's Environment=EDGE_PORT=. See port-resolution.ts for the
 // pure logic; unit tests live at __tests__/port-canonicalisation.test.mjs.
 // ---------------------------------------------------------------------------
@@ -3514,7 +3538,7 @@ else {
 //
 // Default Maxy brand: 7687 (shared system Neo4j instance). Branded builds ship
 // a dedicated port in brand.json (e.g. Real Agent = 7688) so installing a
-// second brand on the same device gets its own database by default — Task 659.
+// second brand on the same device gets its own database by default.
 //
 // Priority: --neo4j-port flag > .env NEO4J_URI (upgrade preserve) > BRAND.neo4jPort > 7687.
 // ---------------------------------------------------------------------------
@@ -3556,24 +3580,24 @@ else {
 // Dedicated = port differs from the default shared instance
 const NEO4J_DEDICATED = NEO4J_PORT !== DEFAULT_NEO4J_PORT;
 // ---------------------------------------------------------------------------
-// Task 664 removed the per-brand ttyd port — the admin terminal stack
+// removed the per-brand ttyd port — the admin terminal stack
 // (ttyd, tmux, xterm.js) was retired in favour of the action runner that
 // spawns transient `systemd-run --user` units per upgrade or setup-tunnel
 // invocation. No TCP listener on the device needs to be reserved for an
 // interactive-shell surface any more.
 const PKG_VERSION = JSON.parse(readFileSync(resolve(import.meta.dirname, "../package.json"), "utf-8")).version;
 // ---------------------------------------------------------------------------
-// Task 840 — pre-flight platform refusal.
+// pre-flight platform refusal.
 //
 // Runs BEFORE initLogging() (LOG_DIR creation), port resolution, and any
-// brew/scutil/hostnamectl probe. Only Linux + darwin are supported (Task 836);
+// brew/scutil/hostnamectl probe. Only Linux + darwin are supported;
 // on darwin, macOS major must be ≥ 14 (the floor required by Tasks 838/839).
 // Older macOS partially succeeds, then breaks at the supervisor or brew-cellar
 // layer with cryptic errors — refusing loudly here is the contract.
 //
 // Platform-header line is emitted on every install start so operators can grep
 // `[create-maxy] platform=` to confirm pre-flight ran. On darwin the line also
-// carries `macos=<v>` (Task 840 token) so the macOS-14 floor check is visible.
+// carries `macos=<v>` (token) so the macOS-14 floor check is visible.
 // ---------------------------------------------------------------------------
 const PLATFORM = requireSupportedPlatform(process.platform);
 let MACOS_VERSION = null;
@@ -3593,13 +3617,13 @@ if (PLATFORM === "darwin") {
     }
 }
 // Platform-header — first log line. Operators grep `[create-maxy] platform=`
-// to confirm pre-flight ran. The /* macos=<v> */ token is the Task 840 marker;
+// to confirm pre-flight ran. The /* macos=<v> */ token is the marker;
 // keep it on this same line so 3-way merges with parallel installer edits stay
 // mechanical (no rewrap, no split into two log lines).
 const PLATFORM_HEADER = `[create-maxy] platform=${PLATFORM} arch=${process.arch}` +
     (MACOS_VERSION ? ` macos=${MACOS_VERSION}` : ``) +
     ` version=${PKG_VERSION}`;
-// Task 062 — emit platform header and the resolved log/persist paths to
+// emit platform header and the resolved log/persist paths to
 // stdout BEFORE the log file is opened. If initLogging's mkdir or first
 // appendFileSync throws, the operator still sees brand/version/arch and the
 // exact path the log file SHOULD live at, instead of a silent exit between
@@ -3631,24 +3655,24 @@ try {
     installCloudflared();
     installWhisperCpp();
     deployPayload(); // Must happen before ensureNeo4jPassword — restores config backup
-    // Task 929: write the resolved Chromium absolute path into the deployed
+    // write the resolved Chromium absolute path into the deployed
     // platform/config/ so vnc.sh, writeChromiumWrapper, and setup-tunnel.sh
     // all read the same value. Must run after deployPayload (config dir is
     // a payload subdirectory). Linux-only; no-op on darwin/non-linux.
     writeChromiumBinaryPathFile();
-    // Task 744: scrub plaintext neo4j passwords from any pre-fix install-*.log.
+    // scrub plaintext neo4j passwords from any pre-fix install-*.log.
     // Idempotent — re-running on already-redacted logs is a no-op. Runs after
     // payload deploy so the bundled redact-install-logs.sh is on disk.
     redactInstallLogs();
     ensureNeo4jPassword(); // Now config/.neo4j-password is available if it existed before
-    provisionRemoteSessionSecret(); // Task 653: shared HMAC key readable by maxy-edge + maxy-ui
+    provisionRemoteSessionSecret(); // shared HMAC key readable by maxy-edge + maxy-ui
     buildPlatform();
-    registerLocalAndExternalPlugins(); // Task 030: install-time plugin registration
+    registerLocalAndExternalPlugins(); // install-time plugin registration
     setupVncViewer();
     setupAccount();
     installTunnelScripts(); // ~/setup-tunnel.sh, ~/reset-tunnel.sh — the SKILL contract
     installService();
-    // Task 034 — Samba on the LAN. Runs after the brand systemd unit is up so
+    // Samba on the LAN. Runs after the brand systemd unit is up so
     // SMB provisioning never blocks the admin server starting; loud-fail per
     // step. The smbpasswd `user` step is deferred at install time and synced
     // by the platform's /set-pin route when the operator sets a PIN.