@tea-agent/loop-agent 0.44.0-next.12 → 0.44.0-next.14

package/dist/commands/init.js

@@ -1,13 +1,13 @@
 import { createHash } from "node:crypto";
-import { access, copyFile, mkdir, readdir, readFile, rename, rm, rmdir, stat, writeFile, } from "node:fs/promises";
-import os from "node:os";
+import { access, copyFile, lstat, mkdir, readdir, readFile, realpath, rename, rm, rmdir, stat, writeFile, } from "node:fs/promises";
 import path from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { fileURLToPath } from "node:url";
 import { isInitRuntimeActive, } from "../shared/runtime-activity.js";
 import { loadHarnessManifest } from "../governance/harness.js";
-import { OPENCODE_CONTEXT_OVERFLOW_COMPACT_PLUGIN_PATH, OPENCODE_TRANSIENT_RETRY_PLUGIN_PATH, PI_CONTEXT_OVERFLOW_EXTENSION_PATH, PI_PROJECT_SETTINGS_PATH, applyPiRetryMerge, applyProjectPiSettingsMerge, buildOpenCodeContextOverflowCompactPluginSource, buildProjectPiSettingsSource, buildOpenCodeTransientRetryPluginSource, buildPiContextOverflowExtensionSource, inspectProjectPiSettings, parseClientRecoveryMode, runClientRecovery, } from "./client-recovery.js";
+import { OPENCODE_CONTEXT_OVERFLOW_COMPACT_PLUGIN_PATH, OPENCODE_TRANSIENT_RETRY_PLUGIN_PATH, PI_CONTEXT_OVERFLOW_EXTENSION_PATH, PI_PROJECT_SETTINGS_PATH, applyProjectPiSettingsMerge, buildOpenCodeContextOverflowCompactPluginSource, buildProjectPiSettingsSource, buildOpenCodeTransientRetryPluginSource, buildPiContextOverflowExtensionSource, inspectProjectPiSettings, } from "./client-recovery.js";
 import { assessInitPiModelReadiness, discoverInitModelCatalog, validateInitModelMatrixAgainstCatalog, } from "./init-model-catalog.js";
+import { auditLegacyInitSurface, inspectContainedRegularFile, legacyAuditReceipt, removeContainedRegularFileWithSha256Cas, } from "./init-legacy-audit.js";
 const MANAGED_BLOCK_START = "<!-- LOOP_AGENT_INIT_START -->";
 const MANAGED_BLOCK_END = "<!-- LOOP_AGENT_INIT_END -->";
 const GITIGNORE_BLOCK_START = "# LOOP_AGENT_INIT_START";
@@ -817,6 +817,18 @@ function mergeRecord(base, patch) {
         ...patch,
     };
 }
+function normalizeLegacyWorkflowPolicy(value) {
+    if (!isRecord(value))
+        return {};
+    const normalized = { ...value };
+    if (isRecord(normalized.dag)) {
+        const dag = { ...normalized.dag };
+        if (dag.defaultEntry === "dag run-task")
+            dag.defaultEntry = "task advance";
+        normalized.dag = dag;
+    }
+    return normalized;
+}
 async function loadManagedAgentsTemplate(assetRoot) {
     if (managedAgentsTemplateCache !== undefined)
         return managedAgentsTemplateCache;
@@ -853,8 +865,13 @@ function mergeGitignoreManagedBlock(existing, block) {
     const start = existing.indexOf(GITIGNORE_BLOCK_START);
     const end = existing.indexOf(GITIGNORE_BLOCK_END);
     if (start >= 0 && end > start) {
-        return (`${existing.slice(0, start).trimEnd()}\n\n${block}\n${existing.slice(end + GITIGNORE_BLOCK_END.length).trimStart()}`.trimEnd() +
-            "\n");
+        return `${[
+            existing.slice(0, start).trimEnd(),
+            block,
+            existing.slice(end + GITIGNORE_BLOCK_END.length).trimStart(),
+        ]
+            .filter((part) => part.length > 0)
+            .join("\n\n")}\n`;
     }
     if (!existing.trim())
         return `${block}\n`;
@@ -867,16 +884,14 @@ function mergeGitignoreManagedBlock(existing, block) {
  * commit surface (they carry the governance handoff and are not ignored);
  * `.opencode/` and `.pi/` project adapters are left to the user's discretion.
  */
-export function buildManagedGitignoreBlock(governanceRoot = DEFAULT_GOVERNANCE_ROOT) {
+export function buildManagedGitignoreBlock(_governanceRoot = DEFAULT_GOVERNANCE_ROOT) {
     return [
         GITIGNORE_BLOCK_START,
-        "# loop-agent init surface: rebuildable outputs; AGENTS.md and README.md stay shared",
+        "# loop-agent local runtime and machine-specific execution config",
         ".harness/",
-        ".agents/",
+        ".playwright-cli/",
         ".task-pool/",
         ".worktrees/",
-        `${governanceRoot}/`,
-        "scripts/",
         "harness.json",
         GITIGNORE_BLOCK_END,
     ].join("\n");
@@ -922,16 +937,8 @@ function buildHarness(input) {
             delete pi.defaultModel;
         mergedExecutors.pi = pi;
     }
-    const harness = {
-        ...input.existing,
-        $schema: expectedHarnessSchemaRef(input.governanceRoot),
-        version: 1,
-        project: input.projectName,
-        adapter: "loop-agent",
-        governanceRoot: input.governanceRoot,
-        features: mergeRecord(input.template.features, input.existing.features),
-        workflowPolicy: mergeRecord(input.template.workflowPolicy, input.existing.workflowPolicy),
-        entrypoints: mergeRecord(input.existing.entrypoints, {
+    const legacyControllerMaps = {
+        entrypoints: {
             readme: "README.md",
             agents: "AGENTS.md",
             governanceIndex: `${input.governanceRoot}/README.md`,
@@ -939,16 +946,16 @@ function buildHarness(input) {
             workflow: `${input.governanceRoot}/feature-workflow.md`,
             verificationMatrix: `${input.governanceRoot}/verification-matrix.md`,
             loopAgentHarness: `${input.governanceRoot}/loop-agent-harness.md`,
-        }),
-        artifacts: mergeRecord(input.existing.artifacts, {
+        },
+        artifacts: {
             templatesDir: `${input.governanceRoot}/templates`,
             execPlansDir: `${input.governanceRoot}/exec-plans`,
             progressDir: `${input.governanceRoot}/progress`,
             reportsDir: `${input.governanceRoot}/reports`,
             decisionsDir: `${input.governanceRoot}/decisions`,
             taskPoolDir: ".harness/task-pool",
-        }),
-        scripts: mergeRecord(input.existing.scripts, {
+        },
+        scripts: {
             checkEngineeringStructure: "scripts/check-engineering-structure.sh",
             checkDocIndex: "scripts/check-doc-index.sh",
             checkDocLinks: "scripts/check-doc-links.sh",
@@ -964,7 +971,38 @@ function buildHarness(input) {
             quickVerify: "bash scripts/check-repo.sh",
             standardVerify: "bash scripts/ci-governance.sh",
             fullVerify: "bash scripts/ci.sh",
-        }),
+        },
+    };
+    const preserveCustomMap = (name) => {
+        const current = isRecord(input.existing[name]) ? input.existing[name] : {};
+        return Object.fromEntries(Object.entries(current).filter(([key, value]) => legacyControllerMaps[name]?.[key] !== value));
+    };
+    const harness = {
+        version: 2,
+        project: input.projectName,
+        adapter: "loop-agent",
+        ...(isRecord(input.existing.features)
+            ? { features: input.existing.features }
+            : {}),
+        workflowPolicy: mergeRecord(input.template.workflowPolicy, normalizeLegacyWorkflowPolicy(input.existing.workflowPolicy)),
+        ...(Object.keys(preserveCustomMap("entrypoints")).length > 0
+            ? { entrypoints: preserveCustomMap("entrypoints") }
+            : {}),
+        ...(Object.keys(preserveCustomMap("artifacts")).length > 0
+            ? { artifacts: preserveCustomMap("artifacts") }
+            : {}),
+        ...(Object.keys(preserveCustomMap("scripts")).length > 0
+            ? { scripts: preserveCustomMap("scripts") }
+            : {}),
+        ...(isRecord(input.existing.verification)
+            ? { verification: input.existing.verification }
+            : {}),
+        ...(isRecord(input.existing.workerPolicy)
+            ? { workerPolicy: input.existing.workerPolicy }
+            : {}),
+        ...(isRecord(input.existing.worktree)
+            ? { worktree: input.existing.worktree }
+            : {}),
         executors: mergedExecutors,
     };
     // Fresh init owns only the current DAG-facing surface. Legacy step routing is
@@ -1001,6 +1039,16 @@ async function writeText(input) {
     await writeFile(target, input.content, "utf-8");
     input.written.push(input.relativePath);
 }
+async function writeTextIfChanged(input) {
+    const target = path.join(input.repoRoot, input.relativePath);
+    await mkdir(path.dirname(target), { recursive: true });
+    if ((await exists(target)) && (await readFile(target, "utf-8")) === input.content) {
+        input.skipped.push(input.relativePath);
+        return;
+    }
+    await writeFile(target, input.content, "utf-8");
+    input.written.push(input.relativePath);
+}
 async function copyFileIfMissing(input) {
     const source = path.join(input.assetRoot, input.sourceRelativePath);
     const target = path.join(input.repoRoot, input.targetRelativePath);
@@ -1202,38 +1250,21 @@ async function readPackageVersion(assetRoot) {
 async function readInitSurfaceManifest(assetRoot) {
     const manifestPath = path.join(assetRoot, "docs", "init-surface.manifest.json");
     const raw = await readFile(manifestPath, "utf-8");
-    const manifest = JSON.parse(raw);
-    const initFullRequired = manifest.initFullRequired ?? [];
-    const initSurface = manifest.initSurface ?? {};
-    const seenPaths = new Set();
-    const entries = [];
-    for (const relativePath of initFullRequired) {
-        if (seenPaths.has(relativePath))
-            continue;
-        seenPaths.add(relativePath);
-        entries.push({
-            path: relativePath,
-            mode: initSurface[relativePath] ?? inferInitSurfaceMode(relativePath),
-        });
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== 2 || !isRecord(parsed.initSurface)) {
+        throw new Error("INIT_SURFACE_MANIFEST_INVALID: expected version 2 initSurface contract");
     }
-    // Fresh `init --profile full` copies the entire `docs/templates/` and
-    // `skills/` directories via copyDirMerge. Every file actually projected to a
-    // target project must be represented in the desired init surface so that
-    // check-update can detect missing or stale copies during controller upgrades.
-    // The static manifest intentionally only pins explicit modes for the subset
-    // that needs them; the rest are auto-discovered here as "copied" entries.
-    for (const discovered of await discoverCopiedSurfaceFiles(assetRoot)) {
-        if (seenPaths.has(discovered))
-            continue;
-        seenPaths.add(discovered);
-        entries.push({
-            path: discovered,
-            mode: initSurface[discovered] ?? inferInitSurfaceMode(discovered),
-        });
+    const entries = [];
+    for (const [entryPath, mode] of Object.entries(parsed.initSurface)) {
+        if (!["generated", "copied", "managed-block", "directory", "state"].includes(String(mode))) {
+            throw new Error(`INIT_SURFACE_MANIFEST_INVALID: unsupported mode for ${entryPath}`);
+        }
+        entries.push({ path: normalizeRelativePath(entryPath), mode: mode });
     }
-    if (!entries.some((entry) => entry.path === INIT_SURFACE_STATE_PATH)) {
-        entries.push({ path: INIT_SURFACE_STATE_PATH, mode: "state" });
+    if (entries.length === 0 || !entries.some((entry) => entry.path === INIT_SURFACE_STATE_PATH)) {
+        throw new Error("INIT_SURFACE_MANIFEST_INVALID: state entry is required");
     }
+    const manifest = parsed;
     return { manifest, raw, sha256: sha256Text(raw), entries };
 }
 /**
@@ -1295,6 +1326,15 @@ function inferInitSurfaceMode(relativePath) {
     return "copied";
 }
 async function buildDesiredSurfaceContent(input) {
+    if (input.entry.path === ".agents/skills/loop-agent/SKILL.md") {
+        const bridgePath = path.join(input.assetRoot, "resources", "agent-bridge", "loop-agent", "SKILL.md");
+        const fallbackPath = path.join(input.assetRoot, "skills", "loop-agent", "SKILL.md");
+        const sourcePath = (await exists(bridgePath)) ? bridgePath : fallbackPath;
+        return {
+            content: await readFile(sourcePath, "utf-8"),
+            sourcePath,
+        };
+    }
     const manifestPath = targetPathToManifestPath(input.entry.path, input.governanceRoot);
     if (input.entry.mode === "directory" || input.entry.mode === "state")
         return {};
@@ -1399,7 +1439,9 @@ async function readExistingSurfaceState(repoRoot) {
     if (!(await exists(filePath)))
         return undefined;
     const parsed = JSON.parse(await readFile(filePath, "utf-8"));
-    if (!isRecord(parsed) || parsed.schemaVersion !== 1)
+    if (!isRecord(parsed) ||
+        (parsed.schemaVersion !== 1 && parsed.schemaVersion !== 2) ||
+        !isRecord(parsed.files))
         return undefined;
     return parsed;
 }
@@ -1634,21 +1676,37 @@ async function buildCurrentSurfaceState(input) {
         };
     }
     return {
-        schemaVersion: 1,
+        schemaVersion: 2,
         controllerVersion,
         stateKind: input.stateKind,
         generatedAt: input.generatedAt ?? new Date().toISOString(),
         manifestSha256: manifest.sha256,
         files,
+        dispositions: [],
+        actionReceipts: [],
     };
 }
 async function writeInitSurfaceState(input) {
     const state = await buildCurrentSurfaceState(input);
-    if (input.stateKind === "recorded" && input.preserveOwnershipFrom) {
+    state.dispositions = [
+        ...(input.preserveOwnershipFrom?.dispositions ?? []),
+        ...(input.dispositions ?? []),
+    ];
+    state.actionReceipts = [
+        ...(input.preserveOwnershipFrom?.actionReceipts ?? []),
+        ...(input.actionReceipts ?? []),
+    ];
+    state.legacyAudit = input.legacyAudit ?? input.preserveOwnershipFrom?.legacyAudit;
+    if (input.preserveOwnershipFrom) {
         for (const [pathName, file] of Object.entries(state.files)) {
             if (file.relationship !== "local-existing-unknown")
                 continue;
             const priorFile = input.preserveOwnershipFrom.files[pathName];
+            if (priorFile?.acceptedMerge) {
+                file.acceptedMerge = { ...priorFile.acceptedMerge };
+            }
+            if (input.stateKind !== "recorded")
+                continue;
             const priorHash = priorFile?.currentSha256;
             if (priorHash !== undefined) {
                 file.currentSha256 = priorHash;
@@ -1656,10 +1714,9 @@ async function writeInitSurfaceState(input) {
             else {
                 delete file.currentSha256;
             }
-            if (priorFile?.acceptedMerge) {
-                file.acceptedMerge = { ...priorFile.acceptedMerge };
-            }
         }
+    }
+    if (input.stateKind === "recorded" && input.preserveOwnershipFrom) {
         for (const [pathName, priorFile] of Object.entries(input.preserveOwnershipFrom.files)) {
             if (state.files[pathName] || priorFile.mode === "state")
                 continue;
@@ -1684,6 +1741,13 @@ async function writeInitSurfaceState(input) {
     }
     const target = path.join(input.repoRoot, INIT_SURFACE_STATE_PATH);
     await mkdir(path.dirname(target), { recursive: true });
+    const previous = await readExistingSurfaceState(input.repoRoot);
+    if (previous?.schemaVersion === 2) {
+        const previousComparable = { ...previous, generatedAt: "" };
+        const nextComparable = { ...state, generatedAt: "" };
+        if (JSON.stringify(previousComparable) === JSON.stringify(nextComparable))
+            return previous;
+    }
     await writeFile(target, `${JSON.stringify(state, null, 2)}\n`, "utf-8");
     return state;
 }
@@ -1902,7 +1966,10 @@ async function collectRetiredLayoutActions(input) {
     const retiredOwnedPaths = [];
     const currentPaths = new Set(Object.keys(input.currentState.files));
     const recordedPaths = new Set(Object.keys(input.recordedState.files));
+    const disposedPaths = new Set((input.recordedState.dispositions ?? []).map((receipt) => receipt.path));
     for (const [oldPath, oldState] of Object.entries(input.recordedState.files)) {
+        if (disposedPaths.has(oldPath))
+            continue;
         const targetPath = normalizeRelativePath(manifestPathToTargetPath(oldPath, input.governanceRoot));
         if (targetPath === oldPath || !currentPaths.has(targetPath))
             continue;
@@ -1968,6 +2035,8 @@ async function collectRetiredLayoutActions(input) {
     for (const legacyRoot of ["docs", "skills"]) {
         for (const relativePath of await listRelativeFiles(path.join(input.repoRoot, legacyRoot))) {
             const oldPath = `${legacyRoot}/${relativePath}`;
+            if (disposedPaths.has(oldPath))
+                continue;
             if (recordedPaths.has(oldPath))
                 continue;
             const targetPath = normalizeRelativePath(manifestPathToTargetPath(oldPath, input.governanceRoot));
@@ -2522,84 +2591,45 @@ function buildGovernanceDirectoryReadme(input) {
 }
 export function buildInitInstructions(input) {
     const projectName = input.projectName ?? path.basename(path.resolve(input.repoRoot));
-    const governanceRoot = input.governanceRoot ?? DEFAULT_GOVERNANCE_ROOT;
     return [
         "# loop-agent Initialization Instructions",
         "",
-        `Initialize the target repository as a loop-agent harness project: \`${input.repoRoot}\`.`,
+        `Initialize the target repository as a minimal loop-agent project: \`${input.repoRoot}\`.`,
         "",
-        "## Confirm With User",
+        "## Project Inputs",
         "",
         `- Project name: default \`${projectName}\`.`,
-        `- Governance root: default \`${governanceRoot}\`.`,
         "- Discover a credential-safe Pi/OpenCode model catalog with `loop-agent init model-catalog --repo-root <target> --json`. The command exposes only allowlisted model metadata, Pi setup status, and credential-readiness booleans, never raw config or credentials.",
         "- Preserve every existing LOW/MED/HIGH reference that still resolves in Pi. Select only missing or removed tiers from `eligibleForHarness=true`, then apply the complete matrix with `--low-model`, `--med-model`, and `--high-model`; update code keeps valid tiers unchanged.",
-        "- If `piSetup.status` is `model-definition-required`, ask only for the missing provider/model id, API/base URL, context window, maximum output, inputs/reasoning, cost constraints, and credential method. Help merge Pi models.json without exposing credential values, rerun the catalog, and only then initialize. If definitions exist but credentials are missing, configure auth instead of rewriting harness tiers.",
-        "- Default: merge existing AGENTS.md, harness.json, and loop-agent governance docs instead of overwriting user content.",
+        "- Ask only when credentials, cost/compliance constraints, a bridge-path conflict, or an ownership decision cannot be inferred safely.",
         "",
         "## Initialization Upgrade Routing",
         "",
         "When the user says `loop-agent初始化更新`, `loop-agent 初始化更新`, `更新 loop-agent 初始化内容`, or an equivalent write request, run `loop-agent init upgrade --repo-root . --json` as the single controller-owned entry. Complete returned single-file allowedPaths merge tasks and call `--continue` until a stable terminal result; do not stop at check-update, needs-safe-update, needs-model-merge, or verification-pending.",
         "Explicit `检查初始化更新`, `初始化更新校验`, or `只检查，不要修改` stays strictly read-only: run only `loop-agent init check-update --repo-root . --markdown` and do not create an upgrade run.",
-        "Upgrade manages project `.opencode/plugins/`, `.pi/extensions/`, and `.pi/settings.json` by nested merge. Pi must trust the project before loading these settings; do not read or write `~/.pi/agent/settings.json` by default.",
-        "The upgrade also writes a read-only gitignore migration assessment (`.harness/init-upgrades/<run-id>/gitignore-migration.json`): tracked `.harness/**` and `.agents/**` get index-only `git rm -r --cached --ignore-unmatch` guidance (working-tree files are kept). Pause for human review when `.agents` content is tracked or when staged changes / git query failures block safe guidance; never run git rm yourself.",
+        "The upgrade removes only controller-owned bytes that still match their recorded hash. Modified or unproven legacy files are preserved for an explicit bounded decision.",
+        "Do not change the Git index implicitly. Follow only the path-specific migration guidance returned by the controller.",
+        "",
+        "## Minimal Managed Surface",
         "",
-        "## Apply Defaults",
+        "Fresh init manages only `.gitignore`, `harness.json`, `.agents/skills/loop-agent/SKILL.md`, and `.harness/init-surface.json`.",
+        "Do not create or modify root `README.md`, `AGENTS.md`, project `docs/`, project `scripts/`, client adapters, or mirrored built-in Skills.",
+        "General governance, templates, checks, and built-in Skills come from the installed loop-agent package. Project facts continue to come from the repository's own files.",
+        "The bridge Skill is the only default repo-local integration for external Agents. It routes them to `loop-agent --repo-root . operator guide --json`; it is not a copy of the controller policy.",
         "",
-        '- Use the current loop-agent harness.json as the default template, but write target project name plus `adapter: "loop-agent"` and a Pi-only `executors.pi.LOW/MED/HIGH` matrix. Do not write `defaultModel` when all three tiers exist, and never project `model`, `models`, `modelProfiles`, `modelRouting`, `verify`, or `sequentialWorkflowRole`.',
+        "## Verification And DAG",
+        "",
+        "Project verification comes from `.loop-agent/project.json`, additive local `harness.json` commands, or bounded capability scanning. Never assume deleted projected scripts still exist.",
         `- ${DAG_HARD_GATE_TRIGGER}`,
-        "- Generate the target project's loop-agent script matrix from templates: structure check, docs index/link checks, active plan status, exec-plan index sync, harness runtime cleanliness, architecture boundaries, skill entry integrity, governance CI, project-test CI, and full CI.",
-        "- Copy or project only stack-agnostic governance scripts. For project-specific verification, packaging, release, or maintenance commands, generate the target-project version from templates plus the target repository's actual files instead of copying loop-agent's own TypeScript-specific scripts.",
-        "- Do not assume the target project is TypeScript, Node.js, frontend, backend, or any other specific stack.",
-        "- `scripts/ci-tests.sh` must be language-neutral: detect common project verification entrypoints conservatively, run only commands that exist, and clearly report when project-specific verification needs model/user adaptation.",
-        "- Default verification entries: quick `bash scripts/check-repo.sh`, standard `bash scripts/ci-governance.sh`, full `bash scripts/ci.sh`.",
-        `- Generate target-project versions of \`${governanceRoot}/README.md\`, \`${governanceRoot}/development-principles.md\`, \`${governanceRoot}/architecture/runtime-boundaries.md\`, \`${governanceRoot}/feature-workflow.md\`, \`${governanceRoot}/verification-matrix.md\`, and \`${governanceRoot}/loop-agent-harness.md\`; copy only generic methodology/template material as-is.`,
-        "- After deterministic initialization, inspect README/config/build files (for example package.json, pyproject.toml, go.mod, Cargo.toml, pom.xml, Gradle files, Makefile, .sln/.csproj, or project-specific scripts) and adapt `scripts/ci-tests.sh` plus the verification matrix to the real project.",
-        "- Enrich the root `README.md`: keep the deterministic project title and the loop-agent managed block intact, and fill the human-authored sections (项目概览, 技术栈与目录结构, 开发与验证) from the target project's actual files. The root README must serve both as a human-first project entry and as an agent work entry; replace the initialization-model supplement comments when the project files provide the information.",
-        `- Populate \`${governanceRoot}/verification-matrix.md\` with the target project's actual quick, standard, and full verification commands derived from its real language and toolchain, keeping the governance rows intact.`,
-        "- Project repo-local skills live in `.agents/skills/`. Do not create a root `skills/` directory in the target project; the package's bundled `skills/` remains the built-in fallback.",
-        "- Merge a loop-agent managed block into `.gitignore` that ignores the full rebuildable init surface (`.harness/`, `.agents/`, `.task-pool/`, `.worktrees/`, `ai_workspace/loop-agent/`, `scripts/`, `harness.json`); keep `AGENTS.md` and `README.md` on the shared commit surface and keep all user rules outside the block untouched.",
-        "- Do not copy examples by default; examples stay bundled in the tool and are available through `loop-agent examples`.",
-        "- Add or update a loop-agent managed block in AGENTS.md.",
-        "- The generated AGENTS.md must include documentation convergence and structured DAG write-boundary rules so target projects keep the same working discipline as this repository.",
-        "- The generated target docs must surface the production readiness checklist and the operator recovery path: `dag report`, `dag doctor --run-id --markdown`, and failed-run `dag closeout-draft` failure handoff.",
-        "- Create `.harness/` runtime directories but do not create historical run facts.",
-        "",
-        "## Automatic Workflow For Model-Executed Init",
-        "",
-        "When a model/agent is asked to initialize a target project, treat initialization as one automated workflow. Do not run deterministic init and then wait for another user turn to fill project-specific content.",
-        "",
-        "1. Run `init model-catalog` and inspect `piSetup`. When Pi has no usable model setup, collect only the missing provider/model metadata or credential method, help configure Pi, and rerun the catalog before writing harness.json.",
-        "2. Inspect the target repository. Preserve existing tiers that still resolve in Pi and select only missing/removed tiers from credential-ready Pi-compatible entries. OpenCode-only entries are context, not proof that the Pi executor can use them.",
-        "3. Resolve with the user only inputs that remain genuinely unsafe to assume: material credential/cost/compliance choices, non-default governance root, overwrite policy, or deployment side effects.",
-        "4. Run deterministic init with all three tier flags and merge defaults.",
-        "5. Continue immediately into project inspection and adaptation.",
-        "6. Finish by running the init health checks and quick verification; `init doctor` must confirm the Pi model matrix before any DAG is started.",
-        "",
-        "A model reference that remains in Pi is project-owned and must not be reset merely because init templates changed. If its credentials are missing, preserve the tier and repair authentication. If a reference has left Pi, replace only that tier. Ask the user only when required model metadata, credentials, cost, compliance, or availability cannot be inferred. An ambiguous old model configuration stays in a bounded harness.json model merge/human decision; never silently reinterpret it.",
-        "",
-        "## Required Model Adaptation",
-        "",
-        "Do not stop after the deterministic `loop-agent init` command. When these instructions are executed by an agent/model, the initialization is not complete until the target project has been inspected and the generated scaffolding has been adapted.",
-        "",
-        "Required post-init steps:",
-        "",
-        "1. Read the target project's existing README, manifest/build/config files, and top-level source/module directories.",
-        "2. Replace the root README's `初始化模型补充` comments when the information can be inferred from files. At minimum, fill project overview, technology stack/directory structure, and development/verification commands.",
-        `3. Update \`${governanceRoot}/verification-matrix.md\` with the target project's actual quick, standard, and full verification commands.`,
-        `4. Confirm the generated docs expose \`${governanceRoot}/templates/production-readiness-checklist.md\` plus the operator recovery path: \`dag report\`, \`dag doctor --run-id --markdown\`, and failed-run \`dag closeout-draft\` failure handoff.`,
-        "5. Update `scripts/ci-tests.sh` only when the conservative generated detector is insufficient for the target project.",
-        "6. Run `loop-agent init doctor`, `loop-agent inspect`, `loop-agent docs audit`, and the quick verification command.",
-        "",
-        "Completion rule: if target files provide enough evidence, the final README should not leave generic `初始化模型补充` comments in the sections that can be filled. If a section truly cannot be inferred, write a short explicit note such as `尚未从仓库文件中识别到 ...` instead of asking the user to fill it later.",
+        "- A real DAG must be owned by Console operation or another durable foreground controller. Do not launch a long-running DAG from a transient Agent shell.",
+        "- Run `loop-agent init doctor`, `loop-agent --repo-root . operator guide --json`, and the selected project verification before starting new governed work.",
         "",
         "## Suggested Command",
         "",
         "```bash",
-        `loop-agent init --repo-root ${input.repoRoot} --profile full --merge`,
+        `loop-agent init --repo-root ${input.repoRoot} --merge`,
         "loop-agent init doctor --repo-root <target>",
-        "loop-agent inspect --repo-root <target>",
-        "loop-agent docs audit --repo-root <target>",
+        "loop-agent --repo-root <target> operator guide --json",
         "```",
     ].join("\n");
 }
@@ -2607,8 +2637,6 @@ export async function initializeLoopAgentProject(options) {
     const repoRoot = path.resolve(options.repoRoot);
     const projectName = options.projectName ?? path.basename(repoRoot);
     const governanceRoot = options.governanceRoot ?? DEFAULT_GOVERNANCE_ROOT;
-    const profile = options.profile ?? "full";
-    const merge = options.merge ?? true;
     const model = normalizeInitModelReference(options);
     const modelMatrix = options.modelMatrix;
     const written = [];
@@ -2626,21 +2654,6 @@ export async function initializeLoopAgentProject(options) {
         }
     }
     await mkdir(repoRoot, { recursive: true });
-    const readmePath = path.join(repoRoot, "README.md");
-    const existingReadme = (await exists(readmePath))
-        ? await readFile(readmePath, "utf-8")
-        : undefined;
-    const readmeContent = existingReadme
-        ? mergeManagedBlock(existingReadme, buildManagedReadmeBlock({ projectName, governanceRoot }))
-        : buildTargetReadme({ projectName, governanceRoot });
-    await writeText({
-        repoRoot,
-        relativePath: "README.md",
-        content: readmeContent,
-        merge: true,
-        written,
-        skipped,
-    });
     const harness = buildHarness({
         existing: existingHarness,
         template,
@@ -2649,27 +2662,10 @@ export async function initializeLoopAgentProject(options) {
         model,
         modelMatrix,
     });
-    await writeText({
+    await writeTextIfChanged({
         repoRoot,
         relativePath: "harness.json",
         content: `${JSON.stringify(harness, null, 2)}\n`,
-        merge: true,
-        written,
-        skipped,
-    });
-    const agentsPath = path.join(repoRoot, "AGENTS.md");
-    const existingAgents = (await exists(agentsPath))
-        ? await readFile(agentsPath, "utf-8")
-        : `# AGENTS.md\n`;
-    await writeText({
-        repoRoot,
-        relativePath: "AGENTS.md",
-        content: mergeManagedBlock(existingAgents, await buildManagedAgentsBlock({
-            assetRoot,
-            projectName,
-            governanceRoot,
-        })),
-        merge: true,
         written,
         skipped,
     });
@@ -2677,122 +2673,45 @@ export async function initializeLoopAgentProject(options) {
     const existingGitignore = (await exists(gitignorePath))
         ? await readFile(gitignorePath, "utf-8")
         : "";
-    await writeText({
+    await writeTextIfChanged({
         repoRoot,
         relativePath: ".gitignore",
         content: mergeGitignoreManagedBlock(existingGitignore, buildManagedGitignoreBlock(governanceRoot)),
-        merge: true,
         written,
         skipped,
     });
-    for (const doc of CORE_DOC_FILES) {
-        const generated = buildGeneratedCoreDoc({
-            doc: doc.target,
-            projectName,
-            governanceRoot,
-        });
-        if (generated) {
-            await writeTextIfMissing({
-                repoRoot,
-                relativePath: path.join(governanceRoot, doc.target),
-                content: generated,
-                merge,
-                written,
-                skipped,
-            });
-            continue;
-        }
-        await copyFileIfMissing({
-            assetRoot,
-            repoRoot,
-            sourceRelativePath: path.join("docs", doc.source),
-            targetRelativePath: path.join(governanceRoot, doc.target),
-            merge,
-            written,
-            skipped,
-        });
-    }
-    for (const dir of GOVERNANCE_README_DIRS) {
-        await writeTextIfMissing({
-            repoRoot,
-            relativePath: path.join(governanceRoot, dir, "README.md"),
-            content: buildGovernanceDirectoryReadme({ dir, projectName }),
-            merge,
-            written,
-            skipped,
-        });
-    }
-    await copyDirMerge({
+    const bridgeEntry = {
+        path: ".agents/skills/loop-agent/SKILL.md",
+        mode: "copied",
+    };
+    const bridge = await buildDesiredSurfaceContent({
         assetRoot,
         repoRoot,
-        sourceRelativePath: "docs/templates",
-        targetRelativePath: path.join(governanceRoot, "templates"),
-        written,
-    });
-    await writeTextIfMissing({
-        repoRoot,
-        relativePath: path.join(governanceRoot, "spec-registry.json"),
-        content: buildSpecRegistry(),
-        merge,
-        written,
-        skipped,
+        projectName,
+        governanceRoot,
+        entry: bridgeEntry,
     });
-    if (profile === "full") {
-        // Project repo-local skills live only under `.agents/skills/`.
-        // The package still ships `skills/` as the built-in fallback source.
-        await copyDirMerge({
-            assetRoot,
-            repoRoot,
-            sourceRelativePath: "skills",
-            targetRelativePath: ".agents/skills",
-            written,
-        });
+    if (bridge.content === undefined) {
+        throw new Error("AGENT_BRIDGE_RESOURCE_MISSING: bundled loop-agent bridge is unavailable");
+    }
+    const bridgeTarget = path.join(repoRoot, bridgeEntry.path);
+    if (await exists(bridgeTarget)) {
+        const existingBridge = await readFile(bridgeTarget, "utf-8");
+        if (existingBridge !== bridge.content) {
+            throw new Error("BRIDGE_PATH_CONFLICT: .agents/skills/loop-agent/SKILL.md already contains user or legacy content; run init upgrade to resolve it explicitly");
+        }
+        skipped.push(bridgeEntry.path);
     }
     else {
-        skipped.push(".agents/skills/");
-    }
-    skipped.push("examples/");
-    for (const [relativePath, content] of Object.entries(buildInitScriptFiles(governanceRoot))) {
-        await writeText({
+        await writeTextIfChanged({
             repoRoot,
-            relativePath,
-            content,
-            merge: true,
+            relativePath: bridgeEntry.path,
+            content: bridge.content,
             written,
             skipped,
         });
     }
-    await ensureHarnessDirs(repoRoot, written);
-    await writeCompatPrompts({ repoRoot, merge, written, skipped });
-    const clientRecoveryMode = options.clientRecovery ?? "auto";
-    const clientRecovery = clientRecoveryMode === "off"
-        ? undefined
-        : await runClientRecovery({
-            repoRoot,
-            mode: clientRecoveryMode,
-        });
-    const clientRecoveryPaths = [
-        OPENCODE_TRANSIENT_RETRY_PLUGIN_PATH,
-        OPENCODE_CONTEXT_OVERFLOW_COMPACT_PLUGIN_PATH,
-        PI_CONTEXT_OVERFLOW_EXTENSION_PATH,
-        PI_PROJECT_SETTINGS_PATH,
-    ];
-    if (clientRecoveryMode === "off") {
-        for (const recoveryPath of clientRecoveryPaths)
-            skipped.push(recoveryPath);
-    }
-    else if (clientRecovery) {
-        const installResults = [
-            clientRecovery.plugin,
-            clientRecovery.overflowPlugin,
-            clientRecovery.piExtension,
-            { written: clientRecovery.pi?.wrote === true },
-        ];
-        for (const [index, recoveryPath] of clientRecoveryPaths.entries()) {
-            if (installResults[index]?.written)
-                written.push(recoveryPath);
-        }
-    }
+    const stateBefore = await fileSha256IfExists(path.join(repoRoot, INIT_SURFACE_STATE_PATH));
     await writeInitSurfaceState({
         repoRoot,
         projectName,
@@ -2800,15 +2719,18 @@ export async function initializeLoopAgentProject(options) {
         stateKind: "recorded",
         acceptCurrentHarnessAsMerge: model !== undefined || modelMatrix !== undefined,
     });
-    written.push(INIT_SURFACE_STATE_PATH);
+    const stateAfter = await fileSha256IfExists(path.join(repoRoot, INIT_SURFACE_STATE_PATH));
+    if (stateBefore !== stateAfter)
+        written.push(INIT_SURFACE_STATE_PATH);
+    else
+        skipped.push(INIT_SURFACE_STATE_PATH);
     return {
         repoRoot,
         projectName,
         governanceRoot,
-        profile,
+        profile: "minimal",
         written,
         skipped,
-        clientRecovery,
     };
 }
 function actionForMissing(pathName, state) {
@@ -2877,13 +2799,17 @@ function recommendedNextFor(report) {
         next.push("loop-agent init update --repo-root <target> --bootstrap-surface");
     }
     if (report.deterministicActions.some((action) => action.type !== "bootstrap-surface")) {
-        next.push("loop-agent init update --repo-root <target> --apply-safe");
+        next.push(report.legacyAudit
+            ? "loop-agent init update --repo-root <target> --apply-safe --legacy-audit"
+            : "loop-agent init update --repo-root <target> --apply-safe");
     }
     if (report.modelMergeTasks.length > 0) {
         next.push("loop-agent init check-update --repo-root <target> --markdown");
     }
     if (report.humanDecisions.length > 0) {
-        next.push("Review humanDecisions before applying semantic or policy-sensitive changes.");
+        next.push(report.humanDecisions.some((decision) => decision.candidateId)
+            ? "Invoke /skill:init-update to review hash-bound legacy candidates."
+            : "Review humanDecisions before applying semantic or policy-sensitive changes.");
     }
     if (next.length === 0)
         next.push("No init update actions are needed.");
@@ -2905,9 +2831,8 @@ export async function checkInitUpdate(input) {
         projectName: input.projectName,
         governanceRoot: input.governanceRoot,
     });
-    const clientRecoveryMode = input.clientRecovery ?? "auto";
-    const skipClientRecoverySurfaces = clientRecoveryMode === "off";
     const recordedState = await readExistingSurfaceState(repoRoot);
+    const disposedPaths = new Set((recordedState?.dispositions ?? []).map((receipt) => receipt.path));
     const assetRoot = await findPackageRoot();
     const surfaceState = recordedState?.stateKind ?? "missing";
     const currentState = await buildCurrentSurfaceState({
@@ -2946,10 +2871,6 @@ export async function checkInitUpdate(input) {
         });
     }
     for (const [pathName, state] of Object.entries(currentState.files)) {
-        // Mirror fresh init: client-recovery=off never reinstalls recovery surfaces.
-        if (skipClientRecoverySurfaces && isClientRecoverySurfacePath(pathName)) {
-            continue;
-        }
         // `.pi/settings.json` is a structured project configuration: fill only
         // absent nested recovery fields and preserve every explicit project value.
         if (pathName === PI_PROJECT_SETTINGS_PATH &&
@@ -2984,6 +2905,30 @@ export async function checkInitUpdate(input) {
             continue;
         }
         if (state.relationship === "local-existing-unknown") {
+            if (pathName === ".agents/skills/loop-agent/SKILL.md") {
+                const recordedBridge = recordedState?.files[pathName];
+                const decisionOwnedBridge = recordedState?.actionReceipts?.some((receipt) => receipt.type === "replace-owned-file" &&
+                    receipt.path === pathName &&
+                    receipt.afterSha256 === state.currentSha256);
+                if ((recordedState?.stateKind === "recorded" &&
+                    recordedBridge?.currentSha256 === state.currentSha256) ||
+                    decisionOwnedBridge) {
+                    deterministicActions.push({
+                        type: "replace-owned-file",
+                        path: pathName,
+                        expectedSha256: state.currentSha256,
+                        mode: state.mode,
+                        reason: "replace the unchanged controller-owned loop-agent Skill with the current external Agent bridge",
+                    });
+                }
+                else {
+                    humanDecisions.push({
+                        path: pathName,
+                        reason: "bridge-path-conflict: existing loop-agent Skill is not proven controller-owned and unchanged",
+                    });
+                }
+                continue;
+            }
             const acceptedMerge = recordedState?.files[pathName]?.acceptedMerge;
             if (acceptedMerge) {
                 // Generated acceptance is bound to the stable source anchor so that
@@ -3038,11 +2983,29 @@ export async function checkInitUpdate(input) {
     if (recordedState) {
         for (const [pathName, recordedFile] of Object.entries(recordedState.files)) {
             if (currentState.files[pathName] ||
+                disposedPaths.has(pathName) ||
                 retiredActionPaths.has(pathName) ||
                 recordedFile.mode === "state" ||
                 recordedFile.mode === "directory") {
                 continue;
             }
+            if (recordedFile.mode === "managed-block") {
+                const target = path.join(repoRoot, pathName);
+                if (!(await exists(target)))
+                    continue;
+                const content = await readFile(target, "utf-8");
+                const block = pathName === ".gitignore"
+                    ? extractGitignoreManagedBlock(content)
+                    : extractManagedBlock(content);
+                if (block) {
+                    deterministicActions.push({
+                        type: "strip-managed-block",
+                        path: pathName,
+                        reason: "remove the retired loop-agent managed block while preserving surrounding project content",
+                    });
+                }
+                continue;
+            }
             const currentSha256 = await fileSha256IfExists(path.join(repoRoot, pathName));
             if (!currentSha256)
                 continue;
@@ -3073,15 +3036,6 @@ export async function checkInitUpdate(input) {
             const harness = JSON.parse(await readFile(harnessPath, "utf-8"));
             if (isRecord(harness))
                 currentHarness = harness;
-            if (recordedState &&
-                isRecord(harness) &&
-                harness.$schema !== expectedHarnessSchemaRef(governanceRoot)) {
-                deterministicActions.push({
-                    type: "add-harness-schema-ref",
-                    path: "harness.json",
-                    reason: "harness.json is missing or has a stale IDE JSON Schema reference",
-                });
-            }
             if (recordedState &&
                 isRecord(harness) &&
                 governanceRoot !== "docs" &&
@@ -3121,7 +3075,6 @@ export async function checkInitUpdate(input) {
                     mergeTask.verification = [
                         "loop-agent init check-update --repo-root . --json",
                         "loop-agent inspect --repo-root .",
-                        "bash scripts/check-repo.sh",
                     ];
                     const existingTask = modelMergeTasks.findIndex((task) => task.path === "harness.json");
                     if (existingTask >= 0)
@@ -3141,8 +3094,13 @@ export async function checkInitUpdate(input) {
                     entry: { path: "harness.json", mode: "generated" },
                 });
                 if (desired.content !== undefined) {
-                    const desiredHarness = JSON.parse(desired.content);
-                    const reconciled = reconcileHarnessStructure(harness, desiredHarness);
+                    const template = await readJsonIfExists(path.join(assetRoot, "harness.json"));
+                    const reconciled = buildHarness({
+                        existing: harness,
+                        template,
+                        projectName,
+                        governanceRoot,
+                    });
                     if (!isDeepStrictEqual(reconciled, harness)) {
                         deterministicActions.push({
                             type: "reconcile-harness-structure",
@@ -3170,6 +3128,7 @@ export async function checkInitUpdate(input) {
         modelReadiness?.status === "reselection-required") {
         const state = currentState.files["harness.json"];
         const task = modelMergeTaskFor("harness.json", state, allPaths, recordedState);
+        task.purpose = "pi-model-matrix-selection";
         task.reason =
             modelReadiness.status === "selection-required"
                 ? "harness.json has no complete Pi model matrix that resolves against the current Pi model catalog"
@@ -3178,14 +3137,13 @@ export async function checkInitUpdate(input) {
             `Preserve these currently resolvable tiers byte-for-byte: ${modelReadiness.preserveTiers.join(", ") || "none"}.`,
             `Select replacements only for: ${modelReadiness.reselectTiers.join(", ")}.`,
             "Choose replacements from eligibleReferences using target-project needs, capability, context window, latency, and cost; tiers may intentionally share a model.",
-            "Apply the complete matrix through init update --apply-safe with all three tier flags so code can revalidate it; valid existing tiers must keep their current effective reference.",
+            "Write the complete matrix directly to harness.json; do not run init update because this task authorizes only harness.json. The controller will revalidate all three tiers on continue.",
             "Do not add credentials or raw Pi configuration to harness.json.",
         ];
         task.verification = [
             "loop-agent init model-catalog --repo-root . --json",
             "loop-agent init check-update --repo-root . --json",
             "loop-agent init doctor --repo-root .",
-            "bash scripts/check-repo.sh",
         ];
         const existingTask = modelMergeTasks.findIndex((candidate) => candidate.path === "harness.json");
         if (existingTask >= 0)
@@ -3207,6 +3165,34 @@ export async function checkInitUpdate(input) {
             reason,
         });
     }
+    let legacyAudit;
+    if (input.legacyAudit && recordedState) {
+        legacyAudit = await auditLegacyInitSurface({
+            repoRoot,
+            assetRoot,
+            surface: recordedState,
+        });
+        for (const candidate of legacyAudit.candidates) {
+            if (candidate.automaticAction && !deterministicActions.some((action) => action.path === candidate.path)) {
+                deterministicActions.push({
+                    type: "remove-owned-file",
+                    path: candidate.path,
+                    expectedSha256: candidate.rawSha256,
+                    candidateId: candidate.candidateId,
+                    evidenceClass: candidate.evidenceClass,
+                    reason: candidate.reason,
+                });
+            }
+            else if (!candidate.terminalDisposition && !candidate.automaticAction && !humanDecisions.some((decision) => decision.path === candidate.path)) {
+                humanDecisions.push(legacyDecision(candidate));
+            }
+        }
+    }
+    const legacyCandidatePaths = new Set(legacyAudit?.candidates.map((candidate) => candidate.path) ?? []);
+    const blockingModelMerge = modelMergeTasks.some((task) => task.path !== "harness.json" || modelReadiness?.status !== "ready");
+    const coreBlocked = deterministicActions.some((action) => !legacyCandidatePaths.has(action.path)) ||
+        blockingModelMerge ||
+        humanDecisions.some((decision) => !decision.candidateId);
     const partial = {
         repoRoot,
         controllerVersion: currentState.controllerVersion,
@@ -3214,6 +3200,9 @@ export async function checkInitUpdate(input) {
         deterministicActions,
         modelMergeTasks,
         humanDecisions,
+        coreState: coreBlocked ? "blocked" : "ready",
+        migrationState: legacyAudit?.migrationState ?? recordedState?.legacyAudit?.migrationState ?? "clean",
+        ...(legacyAudit ? { legacyAudit } : {}),
         ...(modelReadiness ? { modelReadiness } : {}),
         summary: {
             missing: deterministicActions.filter((action) => action.type !== "bootstrap-surface").length,
@@ -3238,6 +3227,16 @@ export async function checkInitUpdate(input) {
         },
     };
 }
+function legacyDecision(candidate) {
+    return {
+        path: candidate.path,
+        reason: candidate.reason,
+        candidateId: candidate.candidateId,
+        expectedSha256: candidate.rawSha256,
+        evidenceClass: candidate.evidenceClass,
+        consumers: candidate.consumers,
+    };
+}
 async function applySafeAction(input) {
     if (input.action.type === "merge-pi-project-settings") {
         return (await applyProjectPiSettingsMerge({ repoRoot: input.repoRoot })).wrote === true;
@@ -3333,6 +3332,13 @@ async function applySafeAction(input) {
         return true;
     }
     if (input.action.type === "remove-owned-file") {
+        if (input.action.candidateId && input.action.expectedSha256) {
+            return ((await removeContainedRegularFileWithSha256Cas({
+                repoRoot: input.repoRoot,
+                relativePath: input.action.path,
+                expectedSha256: input.action.expectedSha256,
+            })) === "removed");
+        }
         const target = path.join(input.repoRoot, input.action.path);
         if (!(await exists(target)))
             return false;
@@ -3343,6 +3349,28 @@ async function applySafeAction(input) {
         await rm(target, { force: true });
         return true;
     }
+    if (input.action.type === "strip-managed-block") {
+        const target = path.join(input.repoRoot, input.action.path);
+        if (!(await exists(target)))
+            return false;
+        const current = await readFile(target, "utf-8");
+        const startMarker = input.action.path === ".gitignore"
+            ? GITIGNORE_BLOCK_START
+            : MANAGED_BLOCK_START;
+        const endMarker = input.action.path === ".gitignore"
+            ? GITIGNORE_BLOCK_END
+            : MANAGED_BLOCK_END;
+        const start = current.indexOf(startMarker);
+        const end = current.indexOf(endMarker, start + startMarker.length);
+        if (start < 0 || end < start)
+            return false;
+        const next = `${current.slice(0, start)}${current.slice(end + endMarker.length)}`;
+        if (next.trim().length === 0)
+            await rm(target, { force: true });
+        else
+            await writeFile(target, next, "utf-8");
+        return true;
+    }
     if (input.action.type === "reconcile-harness-structure") {
         const target = path.join(input.repoRoot, "harness.json");
         if (!(await exists(target)))
@@ -3360,7 +3388,13 @@ async function applySafeAction(input) {
         });
         if (desired.content === undefined)
             return false;
-        const next = reconcileHarnessStructure(current, JSON.parse(desired.content));
+        const template = await readJsonIfExists(path.join(assetRoot, "harness.json"));
+        const next = buildHarness({
+            existing: current,
+            template,
+            projectName: input.projectName,
+            governanceRoot: input.governanceRoot,
+        });
         if (isDeepStrictEqual(next, current))
             return false;
         await writeFile(target, `${JSON.stringify(next, null, 2)}\n`, "utf-8");
@@ -3425,6 +3459,13 @@ async function applySafeAction(input) {
         await writeFile(target, desired.content, "utf-8");
         return true;
     }
+    if (input.action.type === "replace-owned-file") {
+        if (input.action.expectedSha256 &&
+            (await fileSha256IfExists(target)) !== input.action.expectedSha256)
+            return false;
+        await writeFile(target, desired.content, "utf-8");
+        return true;
+    }
     if (await exists(target))
         return false;
     await writeFile(target, desired.content, "utf-8");
@@ -3439,7 +3480,6 @@ export async function applyInitUpdate(input) {
     });
     const applied = [];
     const skipped = [];
-    const clientRecoveryMode = input.clientRecovery ?? "auto";
     const requestedModelMatrix = input.modelMatrix ??
         (input.model
             ? { LOW: input.model, MED: input.model, HIGH: input.model }
@@ -3501,6 +3541,8 @@ export async function applyInitUpdate(input) {
     }
     if (input.applySafe) {
         const existingSurface = await readExistingSurfaceState(repoRoot);
+        const actionReceipts = [];
+        const dispositions = [];
         // Preserve source strength: recorded stays recorded so unchanged owned files
         // remain deterministic refresh candidates; bootstrap/inferred stays inferred.
         const preservedStateKind = existingSurface?.stateKind === "recorded"
@@ -3510,9 +3552,8 @@ export async function applyInitUpdate(input) {
             repoRoot,
             projectName,
             governanceRoot,
-            clientRecovery: clientRecoveryMode,
-            homeDir: input.homeDir,
             modelCatalog: input.modelCatalog,
+            legacyAudit: input.legacyAudit,
         });
         for (const action of report.deterministicActions) {
             if (action.type === "bootstrap-surface") {
@@ -3522,8 +3563,35 @@ export async function applyInitUpdate(input) {
             // The report was produced immediately before this batch. Each action also
             // performs its own target check; missing-file writes refuse existing paths,
             // while managed blocks merge into the latest user-authored content.
-            if (await applySafeAction({ repoRoot, projectName, governanceRoot, action }))
+            const beforeSha256 = await fileSha256IfExists(path.join(repoRoot, action.path));
+            if (await applySafeAction({ repoRoot, projectName, governanceRoot, action })) {
                 applied.push(action);
+                const afterSha256 = await fileSha256IfExists(path.join(repoRoot, action.path));
+                actionReceipts.push({
+                    type: action.type,
+                    path: action.path,
+                    ...(beforeSha256 ? { beforeSha256 } : {}),
+                    ...(afterSha256 ? { afterSha256 } : {}),
+                    appliedAt: new Date().toISOString(),
+                });
+                if (action.type === "remove-owned-file" ||
+                    action.type === "strip-managed-block") {
+                    const previous = existingSurface?.files[action.path];
+                    if ((previous || action.candidateId) && existingSurface) {
+                        dispositions.push({
+                            path: action.path,
+                            disposition: "removed",
+                            previousMode: previous?.mode ?? "copied",
+                            ...(previous?.currentSha256 || action.expectedSha256
+                                ? { recordedSha256: previous?.currentSha256 ?? action.expectedSha256 }
+                                : {}),
+                            ...(afterSha256 ? { resultSha256: afterSha256 } : {}),
+                            controllerVersion: existingSurface.controllerVersion,
+                            recordedAt: new Date().toISOString(),
+                        });
+                    }
+                }
+            }
             else
                 skipped.push(action);
         }
@@ -3533,14 +3601,11 @@ export async function applyInitUpdate(input) {
             governanceRoot,
             stateKind: preservedStateKind,
             preserveOwnershipFrom: existingSurface,
-        });
-    }
-    // Pi user config is only mutated with explicit --client-recovery=user.
-    // Do not reinstall the project plugin here — that would bypass ownership and
-    // clobber user-modified plugins; plugin updates stay on deterministic actions.
-    if (clientRecoveryMode === "user") {
-        await applyPiRetryMerge({
-            homeDir: input.homeDir ?? os.homedir(),
+            dispositions,
+            actionReceipts,
+            ...(report.legacyAudit
+                ? { legacyAudit: legacyAuditReceipt(report.legacyAudit, applied.filter((action) => Boolean(action.candidateId)).length) }
+                : {}),
         });
     }
     return {
@@ -3550,12 +3615,313 @@ export async function applyInitUpdate(input) {
             repoRoot,
             projectName,
             governanceRoot,
-            clientRecovery: clientRecoveryMode,
-            homeDir: input.homeDir,
             modelCatalog: input.modelCatalog,
+            legacyAudit: input.legacyAudit,
         }),
     };
 }
+function canonicalInitAuthorityJson(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalInitAuthorityJson).join(",")}]`;
+    }
+    const record = value;
+    return `{${Object.keys(record)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${canonicalInitAuthorityJson(record[key])}`)
+        .join(",")}}`;
+}
+async function assertInitDecisionResumeAuthority(input) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(input.authority.runId) ||
+        !/^[a-f0-9]{64}$/.test(input.authority.pendingSha256)) {
+        throw new Error("init decision resume authority is invalid");
+    }
+    const repoRoot = await realpath(input.repoRoot).catch(() => {
+        throw new Error("init decision resume authority requires a readable Git repository");
+    });
+    const marker = path.join(repoRoot, ".git");
+    const markerStat = await lstat(marker).catch(() => undefined);
+    let gitDirectory;
+    if (markerStat?.isDirectory()) {
+        gitDirectory = await realpath(marker);
+    }
+    else if (markerStat?.isFile()) {
+        const text = await readFile(marker, "utf-8").catch(() => "");
+        const match = /^gitdir:\s*(.+?)\s*\r?\n?$/.exec(text);
+        if (!match?.[1]) {
+            throw new Error("init decision resume authority rejected an invalid Git worktree file");
+        }
+        gitDirectory = await realpath(path.resolve(path.dirname(marker), match[1]));
+    }
+    else {
+        throw new Error("init decision resume authority requires a Git repository");
+    }
+    const anchorRoot = await realpath(path.join(gitDirectory, "loop-agent-init-upgrades")).catch(() => {
+        throw new Error("init decision resume authority anchor is missing");
+    });
+    const relativeAnchorRoot = path.relative(gitDirectory, anchorRoot);
+    if (relativeAnchorRoot === "" ||
+        relativeAnchorRoot === ".." ||
+        relativeAnchorRoot.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relativeAnchorRoot)) {
+        throw new Error("init decision resume authority anchor escapes Git directory");
+    }
+    const anchorPath = path.join(anchorRoot, `${sha256Text(`${repoRoot}\0${input.authority.runId}`)}.json`);
+    let anchor;
+    try {
+        anchor = JSON.parse(await readFile(anchorPath, "utf-8"));
+    }
+    catch {
+        throw new Error("init decision resume authority anchor is missing or invalid");
+    }
+    if (!isRecord(anchor) || anchor.schemaVersion !== 1) {
+        throw new Error("init decision resume authority anchor is invalid");
+    }
+    const decisionAuthority = anchor.decisionAuthority;
+    if (!isRecord(decisionAuthority) || !isRecord(decisionAuthority.pending)) {
+        throw new Error("init decision resume authority is not pending");
+    }
+    const pending = decisionAuthority.pending;
+    if (anchor.repoRoot !== repoRoot ||
+        anchor.runId !== input.authority.runId ||
+        decisionAuthority.pendingSha256 !== input.authority.pendingSha256 ||
+        sha256Text(canonicalInitAuthorityJson(pending)) !==
+            input.authority.pendingSha256 ||
+        pending.schemaVersion !== 1 ||
+        pending.repoRoot !== repoRoot ||
+        pending.runId !== input.authority.runId ||
+        !isRecord(pending.document) ||
+        pending.document.schemaVersion !== 1 ||
+        pending.document.runId !== input.authority.runId ||
+        !Array.isArray(pending.document.decisions) ||
+        !isDeepStrictEqual(pending.document.decisions, input.actions)) {
+        throw new Error("init decision resume authority does not match pending actions");
+    }
+}
+export async function applyInitDecisionBoundActions(input) {
+    const repoRoot = path.resolve(input.repoRoot);
+    if (input.resumeAuthority) {
+        await assertInitDecisionResumeAuthority({
+            repoRoot,
+            actions: input.actions,
+            authority: input.resumeAuthority,
+        });
+    }
+    const { projectName, governanceRoot } = await resolveInitProjectContext({
+        repoRoot,
+    });
+    const existingSurface = await readExistingSurfaceState(repoRoot);
+    if (!existingSurface) {
+        throw new Error("init decision-bound actions require an existing init surface");
+    }
+    const report = await checkInitUpdate({ repoRoot, legacyAudit: true });
+    const pending = new Map(report.humanDecisions.map((decision) => [decision.path, decision]));
+    const seen = new Set();
+    const validated = [];
+    const assetRoot = await findPackageRoot();
+    for (const action of input.actions) {
+        const normalized = normalizeRelativePath(action.path);
+        if (normalized !== action.path ||
+            path.isAbsolute(action.path) ||
+            action.path.startsWith("../") ||
+            action.path.includes("/../")) {
+            throw new Error(`invalid init decision path: ${action.path}`);
+        }
+        if (seen.has(action.path)) {
+            throw new Error(`duplicate init decision path: ${action.path}`);
+        }
+        seen.add(action.path);
+        const pendingDecision = pending.get(action.path);
+        if (!pendingDecision && !input.resumeAuthority) {
+            throw new Error(`init decision is not currently pending: ${action.path}`);
+        }
+        const isBridge = action.path === ".agents/skills/loop-agent/SKILL.md";
+        const isLegacyCandidate = Boolean(action.candidateId);
+        if (isLegacyCandidate) {
+            if (!input.resumeAuthority &&
+                (!pendingDecision?.candidateId ||
+                    pendingDecision.candidateId !== action.candidateId ||
+                    pendingDecision.expectedSha256 !== action.expectedSha256)) {
+                throw new Error(`stale or mismatched legacy init candidate decision: ${action.path}`);
+            }
+            if (action.disposition !== "retain-project-content" &&
+                action.disposition !== "preserve-unproven" &&
+                action.disposition !== "delete-listed-file") {
+                throw new Error(`unsupported legacy init disposition for ${action.path}: ${action.disposition}`);
+            }
+            if (action.disposition === "delete-listed-file" &&
+                (pendingDecision?.consumers?.length ?? 0) > 0) {
+                throw new Error(`legacy init candidate still has consumers and cannot be deleted: ${action.path}`);
+            }
+        }
+        else if ((isBridge && action.disposition !== "replace-with-bridge") ||
+            (!isBridge && action.disposition !== "detach-as-project-content")) {
+            throw new Error(`unsupported init decision disposition for ${action.path}: ${action.disposition}`);
+        }
+        const absolutePath = path.resolve(repoRoot, action.path);
+        const relative = path.relative(repoRoot, absolutePath);
+        if (relative.length === 0 ||
+            relative.startsWith(`..${path.sep}`) ||
+            path.isAbsolute(relative)) {
+            throw new Error(`init decision path escapes the repository: ${action.path}`);
+        }
+        const inspected = await inspectContainedRegularFile(repoRoot, action.path);
+        if (!inspected &&
+            input.resumeAuthority &&
+            isLegacyCandidate &&
+            action.disposition === "delete-listed-file") {
+            validated.push({
+                action,
+                absolutePath,
+                currentSha256: action.expectedSha256,
+                alreadyAbsent: true,
+            });
+            continue;
+        }
+        if (!inspected || "conflict" in inspected) {
+            throw new Error(`init decision target is not a regular file: ${action.path}`);
+        }
+        const currentSha256 = sha256Buffer(inspected.bytes);
+        let desiredBridgeContent;
+        let desiredBridgeSha256;
+        if (isBridge) {
+            const desired = await buildDesiredSurfaceContent({
+                assetRoot,
+                repoRoot,
+                projectName,
+                governanceRoot,
+                entry: {
+                    path: ".agents/skills/loop-agent/SKILL.md",
+                    mode: "copied",
+                },
+            });
+            if (desired.content === undefined) {
+                throw new Error("AGENT_BRIDGE_RESOURCE_MISSING: bundled loop-agent bridge is unavailable");
+            }
+            desiredBridgeContent = desired.content;
+            desiredBridgeSha256 = sha256Text(desired.content);
+        }
+        if (currentSha256 !== action.expectedSha256 &&
+            !(input.resumeAuthority && desiredBridgeSha256 === currentSha256)) {
+            throw new Error(`stale init decision for ${action.path}: expected ${action.expectedSha256}, observed ${currentSha256}`);
+        }
+        validated.push({
+            action,
+            absolutePath,
+            currentSha256,
+            desiredBridgeContent,
+            desiredBridgeSha256,
+        });
+    }
+    const dispositionReceipts = [];
+    const actionReceipts = [];
+    const results = [];
+    for (const entry of validated) {
+        let resultSha256 = entry.currentSha256;
+        if (entry.action.disposition === "replace-with-bridge") {
+            if (!entry.desiredBridgeContent || !entry.desiredBridgeSha256) {
+                throw new Error("AGENT_BRIDGE_RESOURCE_MISSING: bundled loop-agent bridge is unavailable");
+            }
+            resultSha256 = entry.desiredBridgeSha256;
+            if (entry.currentSha256 !== resultSha256) {
+                await writeFile(entry.absolutePath, entry.desiredBridgeContent, "utf-8");
+            }
+            const alreadyRecorded = existingSurface.actionReceipts?.some((receipt) => receipt.type === "replace-owned-file" &&
+                receipt.path === entry.action.path &&
+                receipt.beforeSha256 === entry.action.expectedSha256 &&
+                receipt.afterSha256 === resultSha256);
+            if (!alreadyRecorded) {
+                actionReceipts.push({
+                    type: "replace-owned-file",
+                    path: entry.action.path,
+                    beforeSha256: entry.action.expectedSha256,
+                    afterSha256: resultSha256,
+                    appliedAt: new Date().toISOString(),
+                });
+            }
+        }
+        else if (entry.action.disposition === "delete-listed-file") {
+            if (!entry.alreadyAbsent) {
+                const removal = await removeContainedRegularFileWithSha256Cas({
+                    repoRoot,
+                    relativePath: entry.action.path,
+                    expectedSha256: entry.action.expectedSha256,
+                });
+                if (removal === "rejected") {
+                    throw new Error(`legacy init decision target changed or escaped containment before deletion: ${entry.action.path}`);
+                }
+            }
+            dispositionReceipts.push({
+                path: entry.action.path,
+                disposition: "removed",
+                previousMode: existingSurface.files[entry.action.path]?.mode ?? "copied",
+                recordedSha256: entry.action.expectedSha256,
+                controllerVersion: existingSurface.controllerVersion,
+                recordedAt: new Date().toISOString(),
+            });
+            actionReceipts.push({
+                type: "remove-owned-file",
+                path: entry.action.path,
+                beforeSha256: entry.action.expectedSha256,
+                appliedAt: new Date().toISOString(),
+            });
+        }
+        else {
+            const disposition = entry.action.disposition === "retain-project-content"
+                ? "retained-project-content"
+                : entry.action.disposition === "preserve-unproven"
+                    ? "preserved-unproven-legacy"
+                    : "detached-as-project-content";
+            const alreadyRecorded = existingSurface.dispositions?.some((receipt) => receipt.path === entry.action.path &&
+                receipt.disposition === disposition &&
+                receipt.recordedSha256 === entry.action.expectedSha256 &&
+                receipt.resultSha256 === resultSha256);
+            if (!alreadyRecorded) {
+                dispositionReceipts.push({
+                    path: entry.action.path,
+                    disposition,
+                    previousMode: existingSurface.files[entry.action.path]?.mode ?? "copied",
+                    recordedSha256: entry.action.expectedSha256,
+                    resultSha256,
+                    controllerVersion: existingSurface.controllerVersion,
+                    recordedAt: new Date().toISOString(),
+                });
+            }
+        }
+        results.push({
+            path: entry.action.path,
+            disposition: entry.action.disposition,
+            expectedSha256: entry.action.expectedSha256,
+            resultSha256,
+            ...(entry.action.candidateId
+                ? { candidateId: entry.action.candidateId }
+                : {}),
+        });
+    }
+    await writeInitSurfaceState({
+        repoRoot,
+        projectName,
+        governanceRoot,
+        stateKind: existingSurface.stateKind,
+        preserveOwnershipFrom: existingSurface,
+        dispositions: dispositionReceipts,
+        actionReceipts,
+    });
+    const postDecisionReport = await checkInitUpdate({ repoRoot, legacyAudit: true });
+    if (postDecisionReport.legacyAudit) {
+        const updatedSurface = await readExistingSurfaceState(repoRoot);
+        await writeInitSurfaceState({
+            repoRoot,
+            projectName,
+            governanceRoot,
+            stateKind: existingSurface.stateKind,
+            preserveOwnershipFrom: updatedSurface,
+            legacyAudit: legacyAuditReceipt(postDecisionReport.legacyAudit, validated.filter((entry) => entry.action.disposition === "delete-listed-file").length),
+        });
+    }
+    return results;
+}
 function formatClientRecoverySummary(report) {
     if (!report.clientRecovery?.pi)
         return [];
@@ -3581,6 +3947,8 @@ function formatCheckUpdateText(report) {
         `loop-agent init update check for ${report.repoRoot}`,
         `controllerVersion: ${report.controllerVersion}`,
         `surfaceState: ${report.surfaceState}`,
+        `coreState: ${report.coreState}`,
+        `migrationState: ${report.migrationState}`,
         `deterministicActions: ${report.deterministicActions.length}`,
         `modelMergeTasks: ${report.modelMergeTasks.length}`,
         `humanDecisions: ${report.humanDecisions.length}`,
@@ -3598,6 +3966,8 @@ function formatCheckUpdateMarkdown(report) {
         `- repoRoot: \`${report.repoRoot}\``,
         `- controllerVersion: \`${report.controllerVersion}\``,
         `- surfaceState: \`${report.surfaceState}\``,
+        `- coreState: \`${report.coreState}\``,
+        `- migrationState: \`${report.migrationState}\``,
         ...(report.modelReadiness
             ? [
                 "",
@@ -3639,7 +4009,6 @@ export async function runInitDoctor(input) {
     try {
         const manifest = await loadHarnessManifest(repoRoot);
         add("harness.json", manifest.adapter === "loop-agent" || manifest.project === "loop-agent", `project=${manifest.project}`);
-        add("governance root", await exists(path.join(repoRoot, manifest.governanceRoot, "README.md")), manifest.governanceRoot);
         if (input.modelCatalog) {
             const readiness = assessInitPiModelReadiness(isRecord(manifest.executors?.pi)
                 ? manifest.executors.pi
@@ -3652,31 +4021,14 @@ export async function runInitDoctor(input) {
     catch (error) {
         add("harness.json", false, error instanceof Error ? error.message : String(error));
     }
-    const agents = path.join(repoRoot, "AGENTS.md");
-    add("AGENTS.md loop-agent block", (await exists(agents)) &&
-        (await readFile(agents, "utf-8")).includes(MANAGED_BLOCK_START), "managed block present");
-    const readme = path.join(repoRoot, "README.md");
-    add("README loop-agent block", (await exists(readme)) &&
-        (await readFile(readme, "utf-8")).includes(MANAGED_BLOCK_START), "managed block present");
-    add("repo-local skills", await exists(path.join(repoRoot, ".agents", "skills", "loop-agent", "SKILL.md")), ".agents/skills/loop-agent/SKILL.md");
+    add("external Agent bridge", await exists(path.join(repoRoot, ".agents", "skills", "loop-agent", "SKILL.md")), ".agents/skills/loop-agent/SKILL.md");
     const gitignorePath = path.join(repoRoot, ".gitignore");
     const gitignoreContent = (await exists(gitignorePath))
         ? await readFile(gitignorePath, "utf-8")
         : "";
     add("gitignore loop-agent block", gitignoreContent.includes(GITIGNORE_BLOCK_START) &&
         gitignoreContent.includes(".harness/"), ".gitignore managed runtime ignores");
-    const requiredScripts = Object.keys(INIT_SCRIPT_FILES);
-    const missingScripts = [];
-    for (const script of requiredScripts) {
-        if (!(await exists(path.join(repoRoot, script))))
-            missingScripts.push(script);
-    }
-    add("script matrix", missingScripts.length === 0, missingScripts.length === 0
-        ? `${requiredScripts.length} scripts`
-        : `missing: ${missingScripts.join(", ")}`);
-    add("compat prompts", (await exists(path.join(repoRoot, ".harness", "prompts", "analyze.md"))) &&
-        (await exists(path.join(repoRoot, ".harness", "prompts", "plan.md"))), ".harness/prompts/analyze.md");
-    add("harness runtime dirs", await exists(path.join(repoRoot, ".harness", "dag-runs", "active")), ".harness/dag-runs/active");
+    add("init surface state", await exists(path.join(repoRoot, INIT_SURFACE_STATE_PATH)), INIT_SURFACE_STATE_PATH);
     return {
         ok: checks.every((check) => check.ok),
         repoRoot,
@@ -3728,23 +4080,23 @@ function parseInitArgs(repoRoot, args) {
     let subcommand;
     let projectName;
     let governanceRoot;
-    let profile = "full";
     let merge = true;
     let provider;
     let model;
     let lowModel;
     let medModel;
     let highModel;
-    let clientRecovery = "auto";
     let json = false;
     let markdown = false;
     let bootstrapSurface = false;
     let applySafe = false;
+    let legacyAudit = false;
     let runId;
     let upgradeStatus = false;
     let upgradeContinue = false;
     let upgradeReport = false;
     let versionChoice;
+    let decisionFile;
     for (let i = 0; i < args.length; i += 1) {
         const arg = args[i];
         if (arg === undefined)
@@ -3768,10 +4120,8 @@ function parseInitArgs(repoRoot, args) {
             governanceRoot = args[++i] ?? governanceRoot;
         else if (arg.startsWith("--governance-root="))
             governanceRoot = arg.slice("--governance-root=".length);
-        else if (arg === "--profile")
-            profile = args[++i] ?? profile;
-        else if (arg.startsWith("--profile="))
-            profile = arg.slice("--profile=".length);
+        else if (arg === "--profile" || arg.startsWith("--profile="))
+            throw new Error("INIT_PROFILE_REMOVED: minimal initialization is now the only init architecture; remove --profile");
         else if (arg === "--merge")
             merge = true;
         else if (arg === "--no-merge")
@@ -3796,10 +4146,9 @@ function parseInitArgs(repoRoot, args) {
             highModel = args[++i];
         else if (arg.startsWith("--high-model="))
             highModel = arg.slice("--high-model=".length);
-        else if (arg === "--client-recovery")
-            clientRecovery = parseClientRecoveryMode(args[++i]);
-        else if (arg.startsWith("--client-recovery="))
-            clientRecovery = parseClientRecoveryMode(arg.slice("--client-recovery=".length));
+        else if (arg === "--client-recovery" ||
+            arg.startsWith("--client-recovery="))
+            throw new Error("INIT_CLIENT_RECOVERY_REMOVED: default init no longer installs client recovery files; remove --client-recovery (explicit client adapters are not available in this release)");
         else if (arg === "--json")
             json = true;
         else if (arg === "--markdown")
@@ -3808,6 +4157,8 @@ function parseInitArgs(repoRoot, args) {
             bootstrapSurface = true;
         else if (arg === "--apply-safe")
             applySafe = true;
+        else if (arg === "--legacy-audit")
+            legacyAudit = true;
         else if (arg === "--run-id")
             runId = args[++i];
         else if (arg.startsWith("--run-id="))
@@ -3822,13 +4173,15 @@ function parseInitArgs(repoRoot, args) {
             versionChoice = args[++i];
         else if (arg.startsWith("--version-choice="))
             versionChoice = arg.slice("--version-choice=".length);
+        else if (arg === "--decision-file")
+            decisionFile = args[++i];
+        else if (arg.startsWith("--decision-file="))
+            decisionFile = arg.slice("--decision-file=".length);
         else if (arg.startsWith("-"))
             throw new Error(`unknown init flag: ${arg}`);
         else
             throw new Error(`unexpected init argument: ${arg}`);
     }
-    if (profile !== "full" && profile !== "minimal")
-        throw new Error("init --profile must be full or minimal");
     if (versionChoice && !["current", "upgrade", "cancel", "retry"].includes(versionChoice)) {
         throw new Error("init upgrade --version-choice must be current|upgrade|cancel|retry");
     }
@@ -3844,22 +4197,23 @@ function parseInitArgs(repoRoot, args) {
         repoRoot,
         projectName,
         governanceRoot,
-        profile,
+        profile: "minimal",
         merge,
         provider,
         model: normalizedModel,
         modelMatrix,
-        clientRecovery,
         subcommand,
         json,
         markdown,
         bootstrapSurface,
         applySafe,
+        legacyAudit,
         runId,
         upgradeStatus,
         upgradeContinue,
         upgradeReport,
         versionChoice,
+        decisionFile,
     };
 }
 async function discoverInitCatalogForRepo(repoRoot) {
@@ -3947,6 +4301,7 @@ export async function runInit(repoRoot, rawArgs, dependencies) {
             runId: parsed.runId,
             mode,
             versionChoice: parsed.versionChoice,
+            decisionFile: parsed.decisionFile,
             readRuntimeActivity: dependencies.readRuntimeActivity,
             modelCatalog,
         });
@@ -4003,6 +4358,8 @@ function formatInitUpgradeResult(result) {
         `phase: ${result.phase}`,
         `modelMergeTasks: ${result.modelMergeTasks.length}`,
         `humanDecisions: ${result.humanDecisions.length}`,
+        `coreState: ${result.coreState}`,
+        `migrationState: ${result.migrationState}`,
         `next: ${result.nextAction}`,
     ].join("\n");
 }
@@ -4013,6 +4370,8 @@ function formatInitUpdateResult(result) {
         `skipped: ${result.skipped.length}`,
         `remaining deterministicActions: ${result.report.deterministicActions.length}`,
         `remaining modelMergeTasks: ${result.report.modelMergeTasks.length}`,
+        `coreState: ${result.report.coreState}`,
+        `migrationState: ${result.report.migrationState}`,
         "recommendedNext:",
         ...result.report.recommendedNext.map((item) => `- ${item}`),
     ].join("\n");
@@ -4036,14 +4395,11 @@ function formatReconcileResult(result) {
 }
 function formatInitResult(result) {
     return [
-        `Initialized loop-agent harness at ${result.repoRoot}`,
+        `Initialized minimal loop-agent project surface at ${result.repoRoot}`,
         `project: ${result.projectName}`,
-        `governanceRoot: ${result.governanceRoot}`,
-        `profile: ${result.profile}`,
         `written: ${result.written.length}`,
         `skipped: ${result.skipped.length}`,
         "next: loop-agent init doctor --repo-root <target>",
-        `model-executed init: continue automatically by inspecting the target project, adapting README.md, ${result.governanceRoot}/verification-matrix.md, and scripts/ci-tests.sh when needed, then run inspect/docs audit/quick verification.`,
     ].join("\n");
 }
 export async function listInitializedFiles(repoRoot) {