@uzysjung/agent-harness 26.175.0 → 26.176.0

package/dist/index.js

@@ -126,6 +126,7 @@ import {
   resolveBundleRoot,
   resolveRules,
   resolveScope,
+  resolveWriteTarget,
   retiredMcpNames,
   scaffoldBanner,
   selectableMcpServers,
@@ -144,7 +145,7 @@ import {
   withoutAppleDouble,
   wrapHarnessBlock,
   writeInstallLog
-} from "./chunk-44H2VEXJ.js";
+} from "./chunk-HB6UJWC6.js";
 
 // node_modules/sisteransi/src/index.js
 var require_src = __commonJS({
@@ -1097,6 +1098,9 @@ var LINES = {
   removed: "removed",
   noChecksumRemoved: "no checksum on record \u2014 saved a copy, removed from live",
   editedRemoved: "you edited it \u2014 saved as <file>.backup-<time>, removed from live",
+  // #902 — 옛 판이 파일 목록 없이 깐 외부 스킬 폴더의 파일: 소유를 몰라 되살리지 않고 백업만(update 마다 같은 판정이라 폴더 밖을 권한다)
+  noFileList: "no file list on record (an older version installed this skill) \u2014 saved as <file>.backup-<time>",
+  noFileListRemoved: "no file list on record (an older version installed this skill) \u2014 saved as <file>.backup-<time>, removed from live (if it was yours, keep it outside this skill folder)",
   sharedCreated: "wrote (harness part only)",
   upsert: "wrote the harness part \u2014 yours stays",
   strip: "removed the harness part \u2014 yours stays",
@@ -1685,7 +1689,14 @@ function withRecordedExclusions(spec, previous) {
     ],
     []
   );
-  return { spec: specWithExclusions(spec, excluded), excluded };
+  const keyExclude = [...excluded].filter(isKeyId);
+  return {
+    spec: {
+      ...specWithExclusions(spec, excluded),
+      ...keyExclude.length > 0 ? { keyExclude } : {}
+    },
+    excluded
+  };
 }
 function thisRunExclusions(spec, previous, accepts) {
   const excluded = /* @__PURE__ */ new Set([
@@ -1938,7 +1949,7 @@ function legacyGitignoreSeed(text, render, previous) {
 // src/installer.ts
 init_esm_shims();
 import { chmodSync as chmodSync3, existsSync as existsSync20, readdirSync as readdirSync5, readFileSync as readFileSync21, writeFileSync as writeFileSync7 } from "fs";
-import { basename as basename6, join as join28, relative as relative6, resolve, sep as sep7 } from "path";
+import { basename as basename6, join as join29, relative as relative7, resolve, sep as sep8 } from "path";
 
 // src/anchor-seed.ts
 init_esm_shims();
@@ -3326,6 +3337,11 @@ function trackDefaultMcpAssetIds(harnessRoot, tracks) {
     return id !== void 0 && anyTrack(tracks, r.pattern) ? [id] : [];
   });
 }
+function droppedMcpAssetIds(harnessRoot, excluded) {
+  const rows = trackRows(harnessRoot);
+  const assetOf = selectableMcpServers(rows);
+  return droppedMcpServers(rows, excluded).flatMap((name) => assetOf.get(name) ?? []);
+}
 function trackDefaultMcpNames(harnessRoot, tracks) {
   const { templateMcpPath } = mcpSources(harnessRoot);
   const base = existsSync15(templateMcpPath) ? Object.keys(JSON.parse(readFileSync14(templateMcpPath, "utf8")).mcpServers) : [];
@@ -3535,7 +3551,50 @@ function runCliTransforms(params) {
 // src/displaced.ts
 init_esm_shims();
 import { lstatSync as lstatSync3, mkdirSync as mkdirSync5, readFileSync as readFileSync15, renameSync } from "fs";
-import { basename as basename3, dirname as dirname5, join as join20, posix } from "path";
+import { basename as basename3, dirname as dirname5, join as join21, posix as posix2 } from "path";
+
+// src/harness-slot.ts
+init_esm_shims();
+import { isAbsolute, join as join20, posix, relative as relative4, sep as sep5 } from "path";
+var ownedOf = (...kinds) => [
+  ...new Set(
+    Object.values(CLI_OWNERSHIP).flat().filter((o) => kinds.includes(o.kind)).map((o) => o.path)
+  )
+];
+var HARNESS_FILES = {
+  places: [
+    ...ownedOf("recorded", "anchor"),
+    ...buildManifest({ tracks: [] }).map((e2) => e2.target).filter(isCliNeutralTarget)
+  ],
+  except: new Set(Object.keys(SHARED_FILES))
+};
+var ANCHOR_FILES = { places: ownedOf("anchor", "import-block") };
+function skillFolders(roots) {
+  return { places: roots.map((r) => `${r}/`) };
+}
+function within(rel, slots) {
+  if (slots.except?.has(rel) === true) return false;
+  return slots.places.some((p2) => p2.endsWith("/") ? rel.startsWith(p2) : rel === p2);
+}
+function realRel(projectDir, norm, follow) {
+  const target = follow ? resolveWriteTarget(join20(projectDir, norm)) : (() => {
+    const dir = resolveWriteTarget(join20(projectDir, posix.dirname(norm)));
+    return dir === null ? null : join20(dir, posix.basename(norm));
+  })();
+  if (target === null) return null;
+  const rel = relative4(resolveWriteTarget(projectDir) ?? projectDir, target);
+  if (rel === "" || isAbsolute(rel)) return null;
+  const slash = rel.split(sep5).join("/");
+  return slash === ".." || slash.startsWith("../") ? null : slash;
+}
+function inHarnessSlot(projectDir, path, slots = HARNESS_FILES, opts = {}) {
+  const norm = posix.normalize(path);
+  if (!within(norm, slots)) return false;
+  const real = realRel(projectDir, norm, opts.follow === true);
+  return real !== null && within(real, slots);
+}
+
+// src/displaced.ts
 function exists(abs) {
   try {
     lstatSync3(abs);
@@ -3545,12 +3604,12 @@ function exists(abs) {
   }
 }
 function outsideBackup(projectDir, backup) {
-  const abs = join20(projectDir, backup);
+  const abs = join21(projectDir, backup);
   const hit = outsideProjectTarget(projectDir, dirname5(abs));
-  return hit === null ? null : join20(hit.target, basename3(abs));
+  return hit === null ? null : join21(hit.target, basename3(abs));
 }
 function isBackupOf(path, backup) {
-  return backupOriginal(posix.normalize(backup)) === posix.normalize(path);
+  return backupOriginal(posix2.normalize(backup)) === posix2.normalize(path);
 }
 function isLegacyDisplaced(log, projectDir, f) {
   if (f.change !== "displaced") return false;
@@ -3558,7 +3617,7 @@ function isLegacyDisplaced(log, projectDir, f) {
   if (outsideBackup(projectDir, at2) !== null) return false;
   let original;
   try {
-    original = readFileSync15(join20(projectDir, at2), "utf8");
+    original = readFileSync15(join21(projectDir, at2), "utf8");
   } catch {
     return false;
   }
@@ -3568,8 +3627,18 @@ function restoreDisplaced(log, projectDir, opts) {
   const out = [];
   for (const f of log.rootFiles ?? []) {
     if (f.change !== "displaced" || !opts.has(f.path)) continue;
-    const slot = join20(projectDir, f.path);
+    const slot = join21(projectDir, f.path);
     if (outsideProjectTarget(projectDir, slot) !== null) continue;
+    if (!inHarnessSlot(projectDir, f.path)) {
+      out.push({
+        path: f.path,
+        backup: f.notes[0] ?? null,
+        verdict: "advise",
+        line: "not put back \u2014 the install record says this tool moved a file of yours aside here, but this is (or leads) outside the places this tool installs to; left it as is",
+        forget: true
+      });
+      continue;
+    }
     const backup = isLegacyDisplaced(log, projectDir, f) ? null : f.notes[0] ?? null;
     const away = backup === null ? null : outsideBackup(projectDir, backup);
     if (away !== null) {
@@ -3594,12 +3663,12 @@ function restoreDisplaced(log, projectDir, opts) {
     }
     const d2 = judgeDisplaced({
       backup,
-      backupExists: backup !== null && exists(join20(projectDir, backup)),
+      backupExists: backup !== null && exists(join21(projectDir, backup)),
       slotEmpty: !exists(slot) || !opts.write && opts.willBeGone?.has(f.path) === true
     });
     if (opts.write && d2.verdict === "restore" && backup !== null) {
       mkdirSync5(dirname5(slot), { recursive: true });
-      renameSync(join20(projectDir, backup), slot);
+      renameSync(join21(projectDir, backup), slot);
     }
     out.push({
       path: f.path,
@@ -3619,7 +3688,7 @@ function withoutRestored(rootFiles, outcomes) {
 // src/excluded-still-there.ts
 init_esm_shims();
 import { existsSync as existsSync16 } from "fs";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 function excludedStillThere(projectDir, excluded, baselineOnDisk, previousLog) {
   const out = [];
   const add = (id, catalog) => {
@@ -3632,7 +3701,7 @@ function excludedStillThere(projectDir, excluded, baselineOnDisk, previousLog) {
   for (const id of excluded) {
     if (INTERNAL_BUNDLED_SKILL_IDS.includes(id)) {
       const there = [".claude/skills", ".agents/skills"].some(
-        (d2) => existsSync16(join21(projectDir, d2, id))
+        (d2) => existsSync16(join22(projectDir, d2, id))
       );
       if (there) add(id, false);
     } else {
@@ -3646,9 +3715,9 @@ function excludedStillThere(projectDir, excluded, baselineOnDisk, previousLog) {
 function assetStillThere(projectDir, asset) {
   if (asset.method !== "skill" || asset.scope === "global") return true;
   if (asset.files !== void 0)
-    return asset.files.some((f) => existsSync16(join21(projectDir, f.path)));
+    return asset.files.some((f) => existsSync16(join22(projectDir, f.path)));
   const dir = asset.detail.skill ?? asset.id;
-  return [".claude/skills", ".agents/skills"].some((d2) => existsSync16(join21(projectDir, d2, dir)));
+  return [".claude/skills", ".agents/skills"].some((d2) => existsSync16(join22(projectDir, d2, dir)));
 }
 
 // src/external-installer.ts
@@ -3669,7 +3738,7 @@ import {
   rmSync as rmSync3
 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename4, dirname as dirname6, join as join22, relative as relative4, sep as sep5 } from "path";
+import { basename as basename4, dirname as dirname6, join as join23, relative as relative5, sep as sep6 } from "path";
 var SKILL_ROOTS = [".claude/skills", ".agents/skills"];
 function skillRootOf(cli) {
   return cli === "claude" ? ".claude/skills" : ".agents/skills";
@@ -3677,11 +3746,11 @@ function skillRootOf(cli) {
 function snapshotSkillRoots(projectDir) {
   const out = /* @__PURE__ */ new Map();
   for (const root of SKILL_ROOTS) {
-    if (outsideProjectTarget(projectDir, join22(projectDir, root)) !== null) continue;
-    for (const rel of listFilesRecursive(join22(projectDir, root))) {
+    if (outsideProjectTarget(projectDir, join23(projectDir, root)) !== null) continue;
+    for (const rel of listFilesRecursive(join23(projectDir, root))) {
       const path = `${root}/${rel}`;
       try {
-        out.set(path, hashContent(readFileSync16(join22(projectDir, path), "utf8")));
+        out.set(path, hashContent(readFileSync16(join23(projectDir, path), "utf8")));
       } catch {
       }
     }
@@ -3699,8 +3768,8 @@ function homeSkillDirs(roots) {
     }
     for (const name of names) {
       try {
-        const st2 = lstatSync4(join22(root, name), { bigint: true });
-        if (st2.isDirectory()) out.set(join22(root, name), `${st2.ino}:${st2.ctimeNs}`);
+        const st2 = lstatSync4(join23(root, name), { bigint: true });
+        if (st2.isDirectory()) out.set(join23(root, name), `${st2.ino}:${st2.ctimeNs}`);
       } catch {
       }
     }
@@ -3713,7 +3782,7 @@ function writtenSkillNames(before, after) {
 }
 function lockedSkillNames(source) {
   const xdg = process.env.XDG_STATE_HOME;
-  const path = xdg ? join22(xdg, "skills", ".skill-lock.json") : join22(homedir2(), ".agents", ".skill-lock.json");
+  const path = xdg ? join23(xdg, "skills", ".skill-lock.json") : join23(homedir2(), ".agents", ".skill-lock.json");
   try {
     const lock = JSON.parse(readFileSync16(path, "utf8"));
     if (typeof lock.version !== "number" || lock.version < 3) return null;
@@ -3816,7 +3885,7 @@ function installOne(asset, ctx) {
         return { ...result2, skills: written.filter((n) => locked.has(n)) };
       }
       const outside = SKILL_ROOTS.flatMap((root) => {
-        const hit = outsideProjectTarget(cwd, join22(cwd, root));
+        const hit = outsideProjectTarget(cwd, join23(cwd, root));
         return hit === null ? [] : [{ root, target: hit.target }];
       });
       const outRoots = new Set(outside.map((o) => o.root));
@@ -3898,16 +3967,19 @@ function refreshExternalSkills(projectDir, deps = {}) {
   if (targets.length === 0) {
     return { ...none, notInCatalog, unknown: false, ...copies };
   }
+  const scopeOf = (a) => resolveScope(log.assets.find((r) => r.id === a.id)?.scope ?? log.scope);
   const targetIds = new Set(targets.map((a) => a.id));
   const clis = [...installedClis(log)];
+  const inProject = targets.filter((a) => scopeOf(a) === "project");
+  const slotCtx = { log, scope: "project" };
   const settle = holdSkillSlots(projectDir, {
     recorded: log.assets.filter((a) => targetIds.has(a.id)),
-    slots: skillSlotsFor(targets, clis, { log, scope: log.scope }),
+    slots: skillSlotsFor(inProject, clis, slotCtx),
+    unlisted: unlistedSkillSlots(inProject, clis, slotCtx),
     log,
     clis,
-    scope: log.scope
+    scope: "project"
   });
-  const scopeOf = (a) => resolveScope(log.assets.find((r) => r.id === a.id)?.scope ?? log.scope);
   const run = deps.run ?? runExternalInstall;
   let ran;
   try {
@@ -3975,10 +4047,10 @@ function holdSkillSlots(projectDir, hold) {
       const root = dirname6(f.slot);
       let dir = asides.get(root);
       if (dir === void 0) {
-        dir = claimBackupDir(join22(projectDir, root), now);
+        dir = claimBackupDir(join23(projectDir, root), now);
         asides.set(root, dir);
       }
-      const aside = join22(dir, f.rel.slice(root.length + 1));
+      const aside = join23(dir, f.rel.slice(root.length + 1));
       mkdirSync6(dirname6(aside), { recursive: true });
       renameSync2(f.abs, aside);
       moved.push({ ...f, aside });
@@ -4001,12 +4073,17 @@ function holdSkillSlots(projectDir, hold) {
       displaced: [],
       judged: []
     };
+    const rewritten = new Set(
+      (report?.attempted ?? []).flatMap(
+        (r) => r.ok ? (r.files?.created ?? []).map((x) => skillFolderOf(x.path)) : []
+      )
+    );
     const back = /* @__PURE__ */ new Set();
     const failed = [];
     for (const f of moved) {
       const restore = failedSlots === null || failedSlots.some((s) => f.rel === s || f.rel.startsWith(`${s}/`));
       try {
-        const r = settleAside(projectDir, f, restore);
+        const r = settleAside(projectDir, f, restore, rewritten.has(skillFolderOf(f.rel)));
         if (r === "back") {
           back.add(f.rel);
           continue;
@@ -4014,11 +4091,11 @@ function holdSkillSlots(projectDir, hold) {
         out.backups.push(r.backup);
         if (r.displaced !== null) out.displaced.push(r.displaced);
         const backup = toProjectRel(projectDir, r.backup);
-        const line = !f.recorded ? LINES.hadFile : r.gone ? LINES.editedRemoved : LINES.edited;
+        const line = f.unlisted ? r.gone ? LINES.noFileListRemoved : LINES.noFileList : !f.recorded ? LINES.hadFile : r.gone ? LINES.editedRemoved : LINES.edited;
         out.judged.push({
           path: f.rel,
           verdict: r.gone ? "backup+remove" : "backup+overwrite",
-          recorded: f.recorded ? "sha" : "none",
+          recorded: f.recorded ? "sha" : f.unlisted ? "no-sha" : "none",
           line: withBackup(line, backup),
           backup,
           backupAbs: r.backup
@@ -4043,13 +4120,18 @@ function skillSlotsFor(assets, clis, ctx) {
   const out = /* @__PURE__ */ new Set();
   for (const a of assets) {
     if (a.method.kind !== "skill") continue;
-    const prior = ctx.log?.assets.find((r) => r.id === a.id);
-    if (prior !== void 0 && prior.files === void 0) continue;
     const skill = a.method.skill;
     for (const root of roots) out.add(skill === void 0 ? root : `${root}/${skill}`);
   }
   return [...out];
 }
+function unlistedSkillSlots(assets, clis, ctx) {
+  const unlisted = assets.filter((a) => {
+    const prior = ctx.log?.assets.find((r) => r.id === a.id);
+    return prior !== void 0 && prior.files === void 0;
+  });
+  return skillSlotsFor(unlisted, clis, ctx);
+}
 function reclaimGlobalSkillCopies(projectDir, log, opts) {
   const clis = installedClis(log);
   const roots = clis.length === 0 ? [...SKILL_ROOTS] : [...new Set(clis.map(skillRootOf))];
@@ -4062,17 +4144,19 @@ function reclaimGlobalSkillCopies(projectDir, log, opts) {
     if (a.method !== "skill" || a.scope !== "global" || excluded.has(a.id)) continue;
     if (opts.ids !== void 0 && !opts.ids.has(a.id)) continue;
     const skill = a.detail.skill;
-    const names = skill !== void 0 ? [skill] : (Array.isArray(a.skills) ? a.skills : []).filter(isSkillName);
+    const names = (skill !== void 0 ? [skill] : Array.isArray(a.skills) ? a.skills : []).filter(
+      isSkillName
+    );
     for (const name of names) {
       for (const root of roots) {
         const slot = `${root}/${name}`;
-        const real = realOrNull(join22(projectDir, slot));
+        const real = realOrNull(join23(projectDir, slot));
         if (real !== null) {
           if (seen.has(real)) continue;
           seen.add(real);
         }
         const ctx = { log, others, write: opts.write, rm, id: a.id };
-        const r = reclaimCopy(projectDir, slot, join22(globalSkillRoot(root), name), ctx);
+        const r = reclaimCopy(projectDir, slot, join23(globalSkillRoot(root), name), ctx);
         if (r !== null) out.push(r);
       }
     }
@@ -4081,15 +4165,15 @@ function reclaimGlobalSkillCopies(projectDir, log, opts) {
 }
 function globalSkillRoot(root) {
   if (root === ".claude/skills") {
-    return join22(process.env.CLAUDE_CONFIG_DIR?.trim() || join22(homedir2(), ".claude"), "skills");
+    return join23(process.env.CLAUDE_CONFIG_DIR?.trim() || join23(homedir2(), ".claude"), "skills");
   }
-  return join22(homedir2(), ".agents/skills");
+  return join23(homedir2(), ".agents/skills");
 }
 function isSkillName(name) {
   return typeof name === "string" && name !== "" && name !== "." && name !== ".." && !/[\\/]/.test(name);
 }
 function reclaimCopy(projectDir, slot, home, ctx) {
-  const abs = join22(projectDir, slot);
+  const abs = join23(projectDir, slot);
   try {
     if (lstatSync4(abs, { throwIfNoEntry: false })?.isDirectory() !== true) return null;
     if (outsideProjectTarget(projectDir, abs) !== null) return null;
@@ -4097,8 +4181,15 @@ function reclaimCopy(projectDir, slot, home, ctx) {
   } catch {
     return null;
   }
-  const homeExists = existsSync17(home);
   const res = { id: ctx.id, slot, removed: [], judged: [], left: [] };
+  if (!inHarnessSlot(projectDir, slot, skillFolders(SKILL_ROOTS))) {
+    res.left.push({
+      path: slot,
+      why: "it leads outside the skill folders this tool installs to \u2014 not touched"
+    });
+    return res;
+  }
+  const homeExists = existsSync17(home);
   const now = /* @__PURE__ */ new Date();
   let entries;
   try {
@@ -4115,15 +4206,15 @@ function reclaimCopy(projectDir, slot, home, ctx) {
       res.left.push({ path, why: "a link \u2014 not part of the copy the tool put here" });
       continue;
     }
-    const file = join22(abs, rel);
+    const file = join23(abs, rel);
     try {
       const mine = readFileSync16(file);
-      const same = homeExists && readOrNull(join22(home, rel))?.equals(mine) === true;
+      const same = homeExists && readOrNull(join23(home, rel))?.equals(mine) === true;
       const backupAbs = !same && ctx.write ? backupFile(file, now) : void 0;
       if (ctx.write) ctx.rm(file);
       res.removed.push(path);
       if (same) continue;
-      const line = homeExists ? `not the same as the global copy (${join22(home, rel)}) \u2014 saved as <file>.backup-<time>, removed from live` : `no global copy at ${home} to compare \u2014 saved as <file>.backup-<time>, removed from live`;
+      const line = homeExists ? `not the same as the global copy (${join23(home, rel)}) \u2014 saved as <file>.backup-<time>, removed from live` : `no global copy at ${home} to compare \u2014 saved as <file>.backup-<time>, removed from live`;
       const judged = {
         path,
         verdict: "backup+remove",
@@ -4151,7 +4242,7 @@ function realOrNull(abs) {
 }
 function realFileOrNull(abs) {
   const dir = realOrNull(dirname6(abs));
-  return dir === null ? null : join22(dir, basename4(abs));
+  return dir === null ? null : join23(dir, basename4(abs));
 }
 function readOrNull(abs) {
   try {
@@ -4168,7 +4259,7 @@ function slotFilesToKeep(projectDir, hold) {
   const sha = new Map(mine.map((f) => [f.path, f.sha256]));
   const realSha = new Map(
     mine.flatMap((f) => {
-      const real = realFileOrNull(join22(projectDir, f.path));
+      const real = realFileOrNull(join23(projectDir, f.path));
       return real === null ? [] : [[real, f.sha256]];
     })
   );
@@ -4180,17 +4271,23 @@ function slotFilesToKeep(projectDir, hold) {
     ...mine.map((f) => f.path.split("/")).filter((parts) => parts.length > 3).map((parts) => parts.slice(0, 3).join("/")),
     ...hold.slots
   ]);
+  const unlisted = new Set(hold.unlisted ?? []);
+  const unlistedAt = (path) => {
+    let owner = "";
+    for (const s of slots) if (path.startsWith(`${s}/`) && s.length > owner.length) owner = s;
+    return unlisted.has(owner);
+  };
   const out = /* @__PURE__ */ new Map();
   const realProject = realpathSync3(projectDir);
   for (const slot of slots) {
-    if (outsideProjectTarget(projectDir, join22(projectDir, slot)) !== null) continue;
-    for (const { rel, link } of listEntriesRecursive(join22(projectDir, slot))) {
+    if (outsideProjectTarget(projectDir, join23(projectDir, slot)) !== null) continue;
+    for (const { rel, link } of listEntriesRecursive(join23(projectDir, slot))) {
       const path = `${slot}/${rel}`;
       if (link && SKILL_ROOTS.includes(dirname6(path))) continue;
-      const abs = join22(projectDir, path);
-      const real = join22(realpathSync3(dirname6(abs)), basename4(abs));
+      const abs = join23(projectDir, path);
+      const real = join23(realpathSync3(dirname6(abs)), basename4(abs));
       const prev = out.get(real);
-      if (prev !== void 0 && (prev.rel === path || real !== join22(realProject, path))) continue;
+      if (prev !== void 0 && (prev.rel === path || real !== join23(realProject, path))) continue;
       const recordedSha = sha.get(path) ?? realSha.get(real);
       if (recordedSha === void 0 && (others.has(path) || recorded(hold.log, path).state !== "none"))
         continue;
@@ -4203,12 +4300,20 @@ function slotFilesToKeep(projectDir, hold) {
       } catch {
         continue;
       }
-      out.set(real, { abs, rel: path, slot, recorded: recordedSha !== void 0, link });
+      const listed = recordedSha !== void 0;
+      out.set(real, {
+        abs,
+        rel: path,
+        slot,
+        recorded: listed,
+        unlisted: !listed && unlistedAt(path) && backupOriginal(path) === null,
+        link
+      });
     }
   }
   return [...out.values()];
 }
-function settleAside(projectDir, f, restore) {
+function settleAside(projectDir, f, restore, folderRewritten) {
   let now = null;
   let vacant = false;
   try {
@@ -4219,7 +4324,7 @@ function settleAside(projectDir, f, restore) {
     if (code !== "ENOENT" && code !== "ENOTDIR") throw e2;
     vacant = true;
   }
-  const keep = vacant ? f.link || !f.recorded : f.link ? lstatSync4(f.abs).isSymbolicLink() && readlinkSync(f.abs) === readlinkSync(f.aside) : now?.equals(readFileSync16(f.aside)) === true;
+  const keep = vacant ? f.unlisted ? !folderRewritten : f.link || !f.recorded : f.link ? lstatSync4(f.abs).isSymbolicLink() && readlinkSync(f.abs) === readlinkSync(f.aside) : now?.equals(readFileSync16(f.aside)) === true;
   if (restore || keep) {
     mkdirSync6(dirname6(f.abs), { recursive: true });
     renameSync2(f.aside, f.abs);
@@ -4227,13 +4332,16 @@ function settleAside(projectDir, f, restore) {
   }
   const backup = f.link ? backupLink(f.abs, f.aside) : backupFromCopy(f.abs, f.aside);
   rmSync3(f.aside, { force: true });
-  if (f.recorded || vacant) return { backup, gone: vacant, displaced: null };
+  if (f.recorded || f.unlisted || vacant) return { backup, gone: vacant, displaced: null };
   return {
     backup,
     gone: false,
     displaced: { path: f.rel, change: "displaced", notes: [toProjectRel(projectDir, backup)] }
   };
 }
+function skillFolderOf(path) {
+  return path.split("/").slice(0, 3).join("/");
+}
 function withoutCreated(report, paths) {
   if (paths.size === 0) return report;
   return {
@@ -4249,13 +4357,13 @@ function withoutCreated(report, paths) {
 function pruneEmptyDirs(dir) {
   try {
     for (const e2 of readdirSync3(dir, { withFileTypes: true }))
-      if (e2.isDirectory()) pruneEmptyDirs(join22(dir, e2.name));
+      if (e2.isDirectory()) pruneEmptyDirs(join23(dir, e2.name));
     rmdirSync(dir);
   } catch {
   }
 }
 function toProjectRel(projectDir, abs) {
-  return relative4(projectDir, abs).split(sep5).join("/");
+  return relative5(projectDir, abs).split(sep6).join("/");
 }
 function recordRefreshedFiles(projectDir, log, report, displaced, writeLog) {
   const next = new Map(
@@ -4382,7 +4490,7 @@ function detectVersion(method, spawn, scope, projectDir) {
       case "plugin":
         return detectPluginVersion(method.pluginId, scope, projectDir);
       case "npm": {
-        const pkgJson = scope === "global" ? detectGlobalNpmPackageJsonPath(method.pkg, spawn) : join22(projectDir, "node_modules", method.pkg, "package.json");
+        const pkgJson = scope === "global" ? detectGlobalNpmPackageJsonPath(method.pkg, spawn) : join23(projectDir, "node_modules", method.pkg, "package.json");
         if (!pkgJson || !existsSync17(pkgJson)) return void 0;
         const parsed = JSON.parse(readFileSync16(pkgJson, "utf8"));
         return parsed.version;
@@ -4396,7 +4504,7 @@ function detectVersion(method, spawn, scope, projectDir) {
 }
 function detectPluginVersion(pluginId, scope, projectDir) {
   const claudeScope = scope === "global" ? "user" : "project";
-  const path = join22(homedir2(), ".claude/plugins/installed_plugins.json");
+  const path = join23(homedir2(), ".claude/plugins/installed_plugins.json");
   if (!existsSync17(path)) return void 0;
   const data = JSON.parse(readFileSync16(path, "utf8"));
   const entries = data.plugins?.[pluginId] ?? [];
@@ -4411,7 +4519,7 @@ function detectPluginVersion(pluginId, scope, projectDir) {
 }
 function detectGlobalNpmPackageJsonPath(pkg, spawn) {
   const npmRoot = getNpmGlobalRoot(spawn);
-  return npmRoot ? join22(npmRoot, pkg, "package.json") : void 0;
+  return npmRoot ? join23(npmRoot, pkg, "package.json") : void 0;
 }
 var npmGlobalRootCache;
 function getNpmGlobalRoot(spawn) {
@@ -4431,7 +4539,7 @@ function getNpmGlobalRoot(spawn) {
 // src/key-ids.ts
 init_esm_shims();
 import { readFileSync as readFileSync17 } from "fs";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 function renderedKeyIds(harnessRoot, input, clis) {
   const out = /* @__PURE__ */ new Set();
   const add = (path, key) => {
@@ -4454,7 +4562,7 @@ function renderedKeyIds(harnessRoot, input, clis) {
   for (const name of Object.keys(mcp.mcpServers)) add(".mcp.json", `mcpServers.${name}`);
   for (const key of gitignoreRender().keys()) add(".gitignore", key);
   if (clis.includes("claude")) {
-    const template = readFileSync17(join23(harnessRoot, "templates/settings.json"), "utf8");
+    const template = readFileSync17(join24(harnessRoot, "templates/settings.json"), "utf8");
     for (const key of renderSettingsPortion(template, () => true).keys()) {
       add(".claude/settings.json", key);
     }
@@ -4495,7 +4603,7 @@ function withoutAccepts(harnessRoot, spec, previous) {
 
 // src/linked-skill-bodies.ts
 init_esm_shims();
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 function refreshLinkedSkillBodies(params) {
   const { harnessRoot, projectDir, ids, baseline, journal } = params;
   const bodyKey = (id) => `.agents/skills/${id}/SKILL.md`;
@@ -4506,7 +4614,7 @@ function refreshLinkedSkillBodies(params) {
   );
   const result = writer.result();
   return {
-    updated: ours.filter((id) => written.has(join24(projectDir, bodyKey(id)))),
+    updated: ours.filter((id) => written.has(join25(projectDir, bodyKey(id)))),
     notOurs: ids.filter((id) => !baseline.has(bodyKey(id))),
     files: result.files,
     backupPaths: result.backupPaths,
@@ -4521,7 +4629,7 @@ function refreshLinkedSkillBodies(params) {
 // src/out-of-track.ts
 init_esm_shims();
 import { lstatSync as lstatSync5, readFileSync as readFileSync18, rmSync as rmSync4 } from "fs";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 var AGENTS_RULE = /^\.agents\/rules\/([^/]+)\.md$/;
 var ANCHOR_RULE = "uzys-harness";
 function reclaimOutOfTrack(args) {
@@ -4541,8 +4649,9 @@ function reclaimOutOfTrack(args) {
     const name = AGENTS_RULE.exec(f.path)?.[1];
     if (name === void 0 || name === ANCHOR_RULE || rendered.has(name)) continue;
     if (isBaselineExcluded(`.claude/rules/${name}.md`, args.excluded)) continue;
-    const abs = join25(projectDir, f.path);
+    const abs = join26(projectDir, f.path);
     if (args.outside.skip(abs)) continue;
+    if (!inHarnessSlot(projectDir, f.path)) continue;
     const stat = lstatSync5(abs, { throwIfNoEntry: false });
     if (stat !== void 0 && !stat.isFile()) continue;
     if (stat !== void 0 && claudeCopy.has(`rules/${name}.md`)) {
@@ -4583,14 +4692,14 @@ function tracksBringing(rule) {
 // src/state.ts
 init_esm_shims();
 import { existsSync as existsSync18, readFileSync as readFileSync19 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 var META_FILE = ".claude/.installed-tracks";
 var LEGACY_ANCHOR_FILE = ".claude/CLAUDE.md";
 var TRACE_RULES = ["htmx", "nextjs", "data-analysis", "pyside6", "cli-development"].map(
   (r) => `.claude/rules/${r}.md`
 );
 function detectInstallState(projectDir) {
-  const hasClaudeDir = existsSync18(join26(projectDir, ".claude"));
+  const hasClaudeDir = existsSync18(join27(projectDir, ".claude"));
   const read = readInstallLogStatus(projectDir);
   if (read.status === "ok") {
     return {
@@ -4610,7 +4719,7 @@ function tracksFromLog(tracks) {
   return [...new Set(tracks.filter(isTrack))].sort();
 }
 function collectTraces(projectDir) {
-  const at2 = (rel) => join26(projectDir, rel);
+  const at2 = (rel) => join27(projectDir, rel);
   const text = (rel) => {
     try {
       return readFileSync19(at2(rel), "utf8");
@@ -4684,7 +4793,7 @@ import {
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync6
 } from "fs";
-import { basename as basename5, dirname as dirname7, join as join27, relative as relative5, sep as sep6 } from "path";
+import { basename as basename5, dirname as dirname7, join as join28, relative as relative6, sep as sep7 } from "path";
 var LEGACY_ANCHOR_FILE2 = ".claude/CLAUDE.md";
 function buildUpdateSpec(projectDir, tracks, only) {
   const log = readInstallLog(projectDir);
@@ -4706,7 +4815,7 @@ function parseUpdateOnly(raw) {
   return { ok: true, groups: [...new Set(raw)] };
 }
 function runUpdateMode(projectDir, templatesDir, harnessRoot, deps = {}, only) {
-  const claudeDir = join27(projectDir, ".claude");
+  const claudeDir = join28(projectDir, ".claude");
   const startedAt = Date.now();
   const backupsAtStart = new Set(
     collectRunBackups(projectDir, Number.NEGATIVE_INFINITY).map((b2) => b2.backup)
@@ -4777,7 +4886,7 @@ function runUpdateMode(projectDir, templatesDir, harnessRoot, deps = {}, only) {
     harnessMcp,
     harnessWrote: harness.wrote
   });
-  const settingsPath = join27(claudeDir, "settings.json");
+  const settingsPath = join28(claudeDir, "settings.json");
   if (claudeManaged && wants("hooks") && existsSync19(settingsPath) && !outside.skip(settingsPath)) {
     report.retiredHookRefsRemoved = removeRetiredHookRefs(
       settingsPath,
@@ -4924,7 +5033,7 @@ function runUpdateMode(projectDir, templatesDir, harnessRoot, deps = {}, only) {
     judged.filter((j4) => j4.recorded === "no-sha" && j4.backup !== void 0).map((j4) => j4.path)
   );
   report.backups = collectRunBackups(projectDir, startedAt, backupsAtStart).map(
-    (b2) => existsSync19(join27(projectDir, b2.path)) ? b2 : { ...b2, removed: true }
+    (b2) => existsSync19(join28(projectDir, b2.path)) ? b2 : { ...b2, removed: true }
   );
   const noChecksum = report.backups.map((b2) => b2.path).filter((p2) => unmeasured.has(p2));
   if (noChecksum.length > 0) report.noChecksum = noChecksum;
@@ -5007,7 +5116,7 @@ function reclaimOutOfTrackRecorded(projectDir, outside) {
 function deadMcpLeft(projectDir) {
   let servers;
   try {
-    servers = JSON.parse(readFileSync20(join27(projectDir, ".mcp.json"), "utf8")).mcpServers;
+    servers = JSON.parse(readFileSync20(join28(projectDir, ".mcp.json"), "utf8")).mcpServers;
   } catch {
     return [];
   }
@@ -5022,7 +5131,7 @@ function retiredFeaturesPart(projectDir, f) {
 }
 function legacyHookOnDisk(projectDir, rel) {
   try {
-    return hasLegacyHarnessHook(readFileSync20(join27(projectDir, rel), "utf8"));
+    return hasLegacyHarnessHook(readFileSync20(join28(projectDir, rel), "utf8"));
   } catch {
     return false;
   }
@@ -5048,7 +5157,7 @@ function writeUpdateSharedFiles(args) {
     excluded: adapterExcluded(harnessRoot, excluded)
   });
   const tracks = installedTracks(projectDir);
-  const settingsSource = join27(templatesDir, "settings.json");
+  const settingsSource = join28(templatesDir, "settings.json");
   if (args.claudeManaged && wants("hooks") && existsSync19(settingsSource)) {
     const spec = buildAssetSpec({ tracks, options: DEFAULT_OPTIONS });
     const manifest = buildManifest(spec);
@@ -5123,8 +5232,8 @@ function catalogRemovedOnRecord(log) {
 }
 function staleSkillDirs(projectDir, claudeDir, clis) {
   const stale = (id) => RENAMED_SKILL_IDS[id] !== void 0 || RETIRED_SKILL_IDS.includes(id);
-  const dirs = [join27(claudeDir, "skills")];
-  if (clis.some((cli) => cli !== "claude")) dirs.push(join27(projectDir, ".agents", "skills"));
+  const dirs = [join28(claudeDir, "skills")];
+  if (clis.some((cli) => cli !== "claude")) dirs.push(join28(projectDir, ".agents", "skills"));
   const ids = /* @__PURE__ */ new Set();
   for (const dir of dirs) {
     if (!existsSync19(dir)) continue;
@@ -5135,13 +5244,13 @@ function staleSkillDirs(projectDir, claudeDir, clis) {
   return [...ids];
 }
 function staleAgentFiles(claudeDir) {
-  const dir = join27(claudeDir, "agents");
+  const dir = join28(claudeDir, "agents");
   if (!existsSync19(dir)) return [];
   return readdirSync4(dir, { withFileTypes: true }).filter((e2) => e2.isFile() && e2.name.endsWith(".md")).map((e2) => basename5(e2.name, ".md")).filter((id) => RETIRED_AGENT_IDS.includes(id));
 }
 function demotedAgentFiles(claudeDir, tracks) {
   if (tracks.length === 0) return [];
-  const dir = join27(claudeDir, "agents");
+  const dir = join28(claudeDir, "agents");
   if (!existsSync19(dir)) return [];
   const demoted = TRACK_AGENTS.filter(([, pattern]) => !anyTrack(tracks, pattern)).map(
     ([id]) => id
@@ -5157,19 +5266,19 @@ function updateHarnessTargets(projectDir, templatesDir, log, wants, report, fore
     if (!wants(e2.target.startsWith(".claude/hooks/") ? "hooks" : "rules")) continue;
     if (e2.target.startsWith(".claude/") && !claude) continue;
     if (isBaselineExcluded(e2.target, excluded)) continue;
-    const source = join27(templatesDir, e2.source);
+    const source = join28(templatesDir, e2.source);
     if (!existsSync19(source)) continue;
     const policy = POLICY_DIRS.find((d2) => e2.target.startsWith(`.claude/${d2.dir}/`));
     files.push({
       path: e2.target,
       source,
       unit: e2.target,
-      unitExisted: existsSync19(join27(projectDir, e2.target)),
+      unitExisted: existsSync19(join28(projectDir, e2.target)),
       label: policy === void 0 ? e2.target : `.claude/${policy.dir}`
     });
   }
   const refreshedSkills = [];
-  const skillsSource = join27(templatesDir, "skills");
+  const skillsSource = join28(templatesDir, "skills");
   if (!claude || !(wants("skills") || wants("new-skills")) || !existsSync19(skillsSource)) {
     return { files, refreshedSkills };
   }
@@ -5179,20 +5288,20 @@ function updateHarnessTargets(projectDir, templatesDir, log, wants, report, fore
   for (const d2 of readdirSync4(skillsSource, { withFileTypes: true })) {
     if (!d2.isDirectory()) continue;
     const unit = `.claude/skills/${d2.name}`;
-    if (occupiedByNonDirectory(join27(projectDir, unit))) {
+    if (occupiedByNonDirectory(join28(projectDir, unit))) {
       report.skillsSkippedLinks.push(d2.name);
       continue;
     }
     if (!ids.has(d2.name) || excludedSkill(d2.name)) continue;
-    const existed = existsSync19(join27(projectDir, unit));
+    const existed = existsSync19(join28(projectDir, unit));
     if (existed ? !wants("skills") : !wants("new-skills") || !creatable.has(d2.name)) continue;
-    for (const rel of listFilesRecursive(join27(skillsSource, d2.name))) {
+    for (const rel of listFilesRecursive(join28(skillsSource, d2.name))) {
       const foreign = foreignOwnedTarget(projectDir, `${unit}/${rel}`);
       if (foreign !== null) {
         if (!foreignOwned.includes(foreign)) foreignOwned.push(foreign);
         continue;
       }
-      const source = join27(skillsSource, d2.name, rel);
+      const source = join28(skillsSource, d2.name, rel);
       files.push({
         path: `${unit}/${rel}`,
         source,
@@ -5230,8 +5339,8 @@ function updateHarnessFiles(args) {
     report.updated[label] = 0;
     const ctx = { prefix: dir, outside, recordOf, projectDir, judged };
     report.pruned[label] = pruneOrphans(
-      join27(projectDir, label),
-      join27(templatesDir, dir),
+      join28(projectDir, label),
+      join28(templatesDir, dir),
       ext,
       ctx,
       now
@@ -5299,7 +5408,7 @@ function updateHarnessFiles(args) {
 function removedRow(projectDir, path, why, judged, backupAbs) {
   const { line, recorded: recorded2 } = judged;
   if (backupAbs === null) return { path, verdict: "remove", recorded: recorded2, line: `${why} \u2014 ${line}` };
-  const backup = relative5(projectDir, backupAbs).split(sep6).join("/");
+  const backup = relative6(projectDir, backupAbs).split(sep7).join("/");
   return {
     path,
     verdict: "backup+remove",
@@ -5315,12 +5424,12 @@ function pruneSkillExtras(projectDir, templatesDir, ids, outside, recordOf, now,
   const backedUp = [];
   const failed = [];
   for (const id of ids) {
-    const targetSkill = join27(projectDir, ".claude/skills", id);
-    const bundled = new Set(listFilesRecursive(join27(templatesDir, "skills", id)));
+    const targetSkill = join28(projectDir, ".claude/skills", id);
+    const bundled = new Set(listFilesRecursive(join28(templatesDir, "skills", id)));
     for (const rel of listFilesRecursive(targetSkill)) {
       if (bundled.has(rel) || basename5(rel).includes(".backup-")) continue;
       if (foreignOwnedTarget(projectDir, `.claude/skills/${id}/${rel}`) !== null) continue;
-      const targetFile = join27(targetSkill, rel);
+      const targetFile = join28(targetSkill, rel);
       if (outside.skip(targetFile)) continue;
       const path = `.claude/skills/${id}/${rel}`;
       const rec = recordOf(path);
@@ -5395,20 +5504,20 @@ function collectRunBackups(projectDir, startedAt, exclude) {
   const consider = (rel) => {
     if (!BACKUP_SUFFIX.test(rel)) return;
     if (exclude?.has(rel)) return;
-    const abs = join27(projectDir, rel);
+    const abs = join28(projectDir, rel);
     if (lstatSync6(abs).mtimeMs < startedAt - 1e3) return;
     out.push({ path: rel.replace(BACKUP_SUFFIX, ""), backup: rel });
   };
   for (const e2 of withoutAppleDouble(readdirSync4(projectDir, { withFileTypes: true })))
     if (e2.isFile()) consider(e2.name);
   for (const dir of BACKUP_SCAN_DIRS) {
-    for (const { rel } of listEntriesRecursive(join27(projectDir, dir))) consider(`${dir}/${rel}`);
+    for (const { rel } of listEntriesRecursive(join28(projectDir, dir))) consider(`${dir}/${rel}`);
   }
   return out.sort((a, b2) => a.path.localeCompare(b2.path));
 }
 function writeBackupList(projectDir, backups, noChecksum = /* @__PURE__ */ new Set()) {
-  const dir = join27(projectDir, ".uzys-agent-harness");
-  const file = join27(dir, "update-backups.json");
+  const dir = join28(projectDir, ".uzys-agent-harness");
+  const file = join28(dir, "update-backups.json");
   try {
     if (backups.length === 0) {
       if (existsSync19(file)) unlinkSync2(file);
@@ -5440,12 +5549,12 @@ function trackOnlyFileAssets(tracks) {
   );
 }
 function syncHarnessAnchor(projectDir, templatesDir, report, outside, judged, now = /* @__PURE__ */ new Date()) {
-  if (existsSync19(join27(projectDir, LEGACY_ANCHOR_FILE2))) {
+  if (existsSync19(join28(projectDir, LEGACY_ANCHOR_FILE2))) {
     report.legacyAnchor = LEGACY_ANCHOR_FILE2;
   }
-  const templateMd = join27(templatesDir, "CLAUDE.md");
+  const templateMd = join28(templatesDir, "CLAUDE.md");
   if (!existsSync19(templateMd)) return;
-  const anchor = join27(projectDir, HARNESS_ANCHOR_FILE);
+  const anchor = join28(projectDir, HARNESS_ANCHOR_FILE);
   if (outside.skip(anchor)) return;
   const existed = existsSync19(anchor);
   if (existed) {
@@ -5456,7 +5565,7 @@ function syncHarnessAnchor(projectDir, templatesDir, report, outside, judged, no
       if (!owned) {
         const backup = backupFile(anchor, now);
         report.anchorBackedUp = true;
-        const rel = relative5(projectDir, backup).split(sep6).join("/");
+        const rel = relative6(projectDir, backup).split(sep7).join("/");
         const rec = recorded2?.path === HARNESS_ANCHOR_FILE ? { state: "sha", sha256: recorded2.sha256 } : { state: "no-sha" };
         const next = readFileSync20(templateMd, "utf8");
         const { line } = judge({ op: "write", kind: "harness", rec, disk: current, next });
@@ -5483,7 +5592,7 @@ function syncHarnessAnchor(projectDir, templatesDir, report, outside, judged, no
   recordAnchorBaseline(projectDir, anchor);
 }
 function upsertRootImport(projectDir, outside) {
-  const target = join27(projectDir, "CLAUDE.md");
+  const target = join28(projectDir, "CLAUDE.md");
   if (outside.skip(target)) return false;
   const existing = existsSync19(target) ? readFileSync20(target, "utf8") : null;
   const next = upsertHarnessImport(existing, {
@@ -5491,7 +5600,7 @@ function upsertRootImport(projectDir, outside) {
     // ADR-085 — update 는 선택 목록을 인자로 받지 않는다. 앞 단계(하네스 파일 쓰기)가 지나간 디스크로 판정한다:
     // `.claude/skills/<id>` 가 있으면 그 스킬은 이 설치가 고른 것이다.
     continuousSkills: CONTINUOUS_SKILLS.map((s) => s.id).filter(
-      (id) => existsSync19(join27(projectDir, ".claude/skills", id))
+      (id) => existsSync19(join28(projectDir, ".claude/skills", id))
     )
   });
   if (next === existing) return false;
@@ -5526,7 +5635,7 @@ function excludedBaselineOnDisk(projectDir, log) {
   if (excluded.size === 0) return [];
   const spec = buildAssetSpec({ tracks: installedTracks(projectDir), options: DEFAULT_OPTIONS });
   return buildManifest(spec).filter(
-    (e2) => e2.applies(spec) && isBaselineExcluded(e2.target, excluded) && existsSync19(join27(projectDir, e2.target))
+    (e2) => e2.applies(spec) && isBaselineExcluded(e2.target, excluded) && existsSync19(join28(projectDir, e2.target))
   ).map((e2) => e2.target);
 }
 function excludedSkillOf(log) {
@@ -5554,7 +5663,7 @@ function recordedRenderInputs(projectDir, log, tracks = installedTracks(projectD
 function recordedBundledSkills(projectDir, log) {
   if (log === null) {
     return INTERNAL_BUNDLED_SKILL_IDS.filter(
-      (id) => existsSync19(join27(projectDir, ".claude/skills", id)) || existsSync19(join27(projectDir, ".agents/skills", id))
+      (id) => existsSync19(join28(projectDir, ".claude/skills", id)) || existsSync19(join28(projectDir, ".agents/skills", id))
     );
   }
   const ids = recordedSkillIds(projectDir, log);
@@ -5605,9 +5714,9 @@ var SHARED_SKILLS_DIR = ".agents/skills";
 var SHARED_SKILL_FILE = /^\.agents\/skills\/([^/]+)\//;
 var SHARED_SKILL_MD = /^\.agents\/skills\/([^/]+)\/SKILL\.md$/;
 function sharedSkillIdsOnDisk(projectDir) {
-  const root = join27(projectDir, SHARED_SKILLS_DIR);
+  const root = join28(projectDir, SHARED_SKILLS_DIR);
   if (!existsSync19(root)) return /* @__PURE__ */ new Set();
-  return new Set(readdirSync4(root).filter((id) => existsSync19(join27(root, id, "SKILL.md"))));
+  return new Set(readdirSync4(root).filter((id) => existsSync19(join28(root, id, "SKILL.md"))));
 }
 var CREATED_SHARED_HOW = {
   "opencode.json": "created from template (harness part + template defaults)",
@@ -5634,14 +5743,14 @@ function refreshExternalCli(projectDir, harnessRoot, droppedKeys, harnessMcp, li
   const log = readInstallLog(projectDir);
   const presentBefore = sharedSkillIdsOnDisk(projectDir);
   const rulesBefore = /* @__PURE__ */ new Set();
-  const rulesDir = join27(projectDir, ".agents", "rules");
+  const rulesDir = join28(projectDir, ".agents", "rules");
   if (existsSync19(rulesDir)) {
     try {
       for (const f of readdirSync4(rulesDir)) rulesBefore.add(f);
     } catch {
     }
   }
-  const agentsMdBefore = existsSync19(join27(projectDir, "AGENTS.md"));
+  const agentsMdBefore = existsSync19(join28(projectDir, "AGENTS.md"));
   const result = runCliTransforms({
     harnessRoot,
     projectDir,
@@ -5780,7 +5889,7 @@ function refreshExternalCli(projectDir, harnessRoot, droppedKeys, harnessMcp, li
     ],
     anchorRetired: result.anchorRetired,
     retiredCommands: (result.opencode?.retiredCommands ?? []).map(
-      (p2) => relative5(projectDir, p2).split(sep6).join("/")
+      (p2) => relative6(projectDir, p2).split(sep7).join("/")
     ),
     anchorDisplaced,
     agentsMd: agentsMdNews(result.agentsMd, agentsMdBefore, priorPaths),
@@ -5818,14 +5927,15 @@ function pruneOrphans(target, source, ext, ctx, now) {
   if (!existsSync19(target) || !existsSync19(source)) return [];
   const removed = [];
   for (const file of readdirSync4(target)) {
-    if (!file.endsWith(ext) || existsSync19(join27(source, file))) continue;
-    const targetFile = join27(target, file);
+    if (!file.endsWith(ext) || existsSync19(join28(source, file))) continue;
+    const targetFile = join28(target, file);
     const path = `.claude/${ctx.prefix}/${file}`;
     const rec = ctx.recordOf(path);
     try {
       const disk = readFileSync20(targetFile, "utf8");
       const { verdict, line } = judge({ op: "remove", kind: "harness", rec, disk, next: null });
       if (verdict === "leave" || ctx.outside.skip(targetFile)) continue;
+      if (!inHarnessSlot(ctx.projectDir, path, HARNESS_FILES, { follow: true })) continue;
       const backupAbs = verdict === "backup+remove" ? backupFile(targetFile, now) : null;
       unlinkSync2(targetFile);
       removed.push(file);
@@ -5844,7 +5954,7 @@ function pruneOrphans(target, source, ext, ctx, now) {
   return removed;
 }
 function retireMcpAllowlist(projectDir, now = /* @__PURE__ */ new Date()) {
-  const target = join27(projectDir, ".mcp-allowlist");
+  const target = join28(projectDir, ".mcp-allowlist");
   if (!existsSync19(target)) return null;
   try {
     const backup = backupFile(target, now);
@@ -5866,11 +5976,11 @@ function recordClaudeCommand(log, tracks) {
 function runInstall(ctx) {
   const { harnessRoot, projectDir } = ctx;
   const mode = ctx.mode ?? "fresh";
-  const templatesDir = join28(harnessRoot, "templates");
+  const templatesDir = join29(harnessRoot, "templates");
   if (!existsSync20(templatesDir)) {
     throw new Error(`Templates dir not found: ${templatesDir}`);
   }
-  const claudeDir = join28(projectDir, ".claude");
+  const claudeDir = join29(projectDir, ".claude");
   const previousLog = readInstallLog(projectDir);
   const legacyAnchor = mode === "update" ? null : legacyAnchorTrace(projectDir, ctx.spec);
   if (mode === "update" && previousLog === null) {
@@ -5895,13 +6005,13 @@ function runInstall(ctx) {
   const manifestSpec = buildManifestSpec(spec);
   const baselineExcluded = new Set(spec.baselineExclude ?? []);
   if (spec.cli.includes("claude")) {
-    const settingsPath = join28(projectDir, ".claude", "settings.json");
+    const settingsPath = join29(projectDir, ".claude", "settings.json");
     if (existsSync20(settingsPath)) {
       try {
         JSON.parse(readFileSync21(settingsPath, "utf8"));
       } catch {
         throw new Error(
-          `${relative6(process.cwd(), settingsPath)} is not valid JSON \u2014 left untouched, so no hooks were wired. Fix or delete that file, then run the install again`
+          `${relative7(process.cwd(), settingsPath)} is not valid JSON \u2014 left untouched, so no hooks were wired. Fix or delete that file, then run the install again`
         );
       }
     }
@@ -6195,7 +6305,7 @@ function releasedThisRun(args) {
     }
     if (id.startsWith(BASELINE_PREFIX)) {
       const again2 = manifest.some(
-        (e2) => e2.applies(manifestSpec) && classifyBaselineTarget(e2.target)?.id === id && existsSync20(join28(projectDir, e2.target))
+        (e2) => e2.applies(manifestSpec) && classifyBaselineTarget(e2.target)?.id === id && existsSync20(join29(projectDir, e2.target))
       );
       return { id, again: again2, tail: "the harness manages it again" };
     }
@@ -6204,7 +6314,7 @@ function releasedThisRun(args) {
       options: spec.options,
       ...spec.userOverride ? { userOverride: spec.userOverride } : {}
     });
-    const recorded2 = (previousLog?.assets.some((a) => a.id === id) ?? false) || [".claude/skills", ".agents/skills"].some((d2) => existsSync20(join28(projectDir, d2, id)));
+    const recorded2 = (previousLog?.assets.some((a) => a.id === id) ?? false) || [".claude/skills", ".agents/skills"].some((d2) => existsSync20(join29(projectDir, d2, id)));
     return {
       id,
       again,
@@ -6216,10 +6326,10 @@ function pendingKeyExcludes(projectDir, keyExclude, touched) {
   const done = new Set(touched);
   return keyExclude.flatMap((id) => {
     const path = sharedPathOfKeyId(id);
-    if (path === null || done.has(path) || !existsSync20(join28(projectDir, path))) return [];
+    if (path === null || done.has(path) || !existsSync20(join29(projectDir, path))) return [];
     const name = adapterFor(path);
     const keys = [...excludedKeys(path, [id])];
-    const present = name === null ? null : ADAPTERS[name].read(readFileSync21(join28(projectDir, path), "utf8"), keys, projectDir);
+    const present = name === null ? null : ADAPTERS[name].read(readFileSync21(join29(projectDir, path), "utf8"), keys, projectDir);
     return present !== null && present.size === 0 ? [] : [{ id, path }];
   });
 }
@@ -6263,7 +6373,7 @@ function installCliNeutralAssets(manifestSpec, templatesDir, baselineExcluded, w
       continue;
     }
     if (!isCliNeutralTarget(entry.target)) continue;
-    const source = join28(templatesDir, entry.source);
+    const source = join29(templatesDir, entry.source);
     if (!existsSync20(source)) {
       result.skipped += 1;
       continue;
@@ -6284,13 +6394,13 @@ function installClaudeBaseline(manifestSpec, projectDir, templatesDir, baselineE
     if (!entry.applies(manifestSpec)) {
       continue;
     }
-    const target = join28(projectDir, entry.target);
+    const target = join29(projectDir, entry.target);
     if (isBaselineExcluded(entry.target, baselineExcluded)) {
       result.excluded.push(entry.target);
       if (existsSync20(target)) result.excludedOnDisk.push(entry.target);
       continue;
     }
-    const source = join28(templatesDir, entry.source);
+    const source = join29(templatesDir, entry.source);
     if (!existsSync20(source)) {
       result.skipped += 1;
       continue;
@@ -6321,18 +6431,18 @@ function installClaudeBaseline(manifestSpec, projectDir, templatesDir, baselineE
           if (!result.foreignOwned.includes(slot)) result.foreignOwned.push(slot);
           continue;
         }
-        if (writer.skipOutside(join28(projectDir, entry.target, rel))) {
+        if (writer.skipOutside(join29(projectDir, entry.target, rel))) {
           leftOutside += 1;
           continue;
         }
-        writer.harness(`${entry.target}/${rel}`, { source: join28(source, rel) });
+        writer.harness(`${entry.target}/${rel}`, { source: join29(source, rel) });
       }
       if (leftOutside > 0) continue;
       result.dirsCopied += 1;
     }
     accumulateCategory(result.categories, entry);
   }
-  const hookDir = join28(projectDir, ".claude/hooks");
+  const hookDir = join29(projectDir, ".claude/hooks");
   if (existsSync20(hookDir)) {
     chmodHooksSync(hookDir, projectDir);
   }
@@ -6354,8 +6464,8 @@ function installClaudeBaseline(manifestSpec, projectDir, templatesDir, baselineE
     });
     result.keptHookRefs.push(
       ...findStaleHookRefs(
-        join28(projectDir, ".claude", "settings.json"),
-        join28(projectDir, ".claude")
+        join29(projectDir, ".claude", "settings.json"),
+        join29(projectDir, ".claude")
       )
     );
   }
@@ -6364,7 +6474,7 @@ function installClaudeBaseline(manifestSpec, projectDir, templatesDir, baselineE
     // ADR-085 · update(`upsertRootImport`)와 같은 판정 — 실제로 깔린 스킬만 안내한다. 밖 링크라 쓰지 않은
     // 스킬(ADR-098)을 "installed" 라 적으면 다음 update 가 그 절을 걷어 내 두 동작이 서로 반대로 쓴다.
     (manifestSpec.selectedInternalSkills ?? []).filter(
-      (id) => existsSync20(join28(projectDir, ".claude", "skills", id))
+      (id) => existsSync20(join29(projectDir, ".claude", "skills", id))
     ),
     harnessRoot,
     writer
@@ -6430,9 +6540,12 @@ function runExternalPhase(ctx, previousLog) {
   ctx.onProgress?.({ type: "external-start", assetCount: targets.length });
   const skills = targets.filter((a) => a.method.kind === "skill");
   const skillIds = new Set(skills.map((a) => a.id));
+  const slotCtx = { log: previousLog, scope: spec.scope };
   const settle = holdSkillSlots(projectDir, {
     recorded: (previousLog?.assets ?? []).filter((a) => a.method === "skill" && skillIds.has(a.id)),
-    slots: skillSlotsFor(skills, spec.cli, { log: previousLog, scope: spec.scope }),
+    slots: skillSlotsFor(skills, spec.cli, slotCtx),
+    // #902 — 옛 판이 파일 목록 없이 깐 자산의 자리 — 그 안 파일은 되살리지 않고 백업만 남긴다
+    unlisted: unlistedSkillSlots(skills, spec.cli, slotCtx),
     log: previousLog,
     clis: spec.cli,
     scope: spec.scope
@@ -6451,7 +6564,7 @@ function runExternalPhase(ctx, previousLog) {
     throw e2;
   }
   const { report: external, backups, displaced } = settle(ran);
-  const displacedBackups = new Set(displaced.map((f) => join28(projectDir, f.notes[0] ?? "")));
+  const displacedBackups = new Set(displaced.map((f) => join29(projectDir, f.notes[0] ?? "")));
   const editBackups = backups.filter((b2) => !displacedBackups.has(b2));
   ctx.onProgress?.({
     type: "external-complete",
@@ -6524,7 +6637,7 @@ function recordInterruptedInstall(ctx, error, run) {
   const codexTrust = registeredTrust(journal.codexOptIn, ctx.projectDir);
   const written = writtenSoFar(ledger, cliFiles, rootFiles, stage.rootImportWritten);
   if (codexTrust) written.push(`${codexTrust.configPath} (Codex trust entry for this folder)`);
-  const projectRel = (abs) => relative6(ctx.projectDir, abs).split(sep7).join("/");
+  const projectRel = (abs) => relative7(ctx.projectDir, abs).split(sep8).join("/");
   const writtenSet = new Set(written);
   const backups = [...own.backups, ...journal.backups].map((abs) => {
     const original = projectRel(backupOriginal(abs) ?? abs);
@@ -6664,7 +6777,7 @@ function accumulateCategory(cats, entry) {
   }
 }
 function writeRootClaudeMd(projectDir, continuousSkills, harnessRoot, writer) {
-  const target = join28(projectDir, "CLAUDE.md");
+  const target = join29(projectDir, "CLAUDE.md");
   if (writer.skipOutside(target)) return null;
   const existing = existsSync20(target) ? readFileSync21(target, "utf-8") : null;
   const seeded = existing === null ? seedRootClaudeProjectContext(projectDir, harnessRoot) : null;
@@ -6699,7 +6812,7 @@ function listHookFiles(hookDir) {
 // src/commands/install-render.ts
 init_esm_shims();
 import { existsSync as existsSync22, readdirSync as readdirSync6, readFileSync as readFileSync23 } from "fs";
-import { join as join30, relative as relative7 } from "path";
+import { join as join31, relative as relative8 } from "path";
 
 // src/preset-recommend.ts
 init_esm_shims();
@@ -6721,16 +6834,21 @@ function trackDefaultAssets(tracks) {
     ])
   ];
 }
-function finalSelectedAssets(tracks, userOverride) {
+function finalSelectedAssets(tracks, userOverride, keyExclude = []) {
   const selected = new Set(trackDefaultAssets(tracks));
   if (userOverride) {
     for (const id of userOverride.forceExclude) selected.delete(id);
     for (const id of userOverride.forceInclude) selected.add(id);
   }
+  if (keyExclude.length > 0) {
+    for (const id of droppedMcpAssetIds(resolveBundleRoot(), new Set(keyExclude))) {
+      selected.delete(id);
+    }
+  }
   return [...selected].sort();
 }
 function residentSelectedAssets(spec) {
-  return finalSelectedAssets(spec.tracks, spec.userOverride).filter((id) => {
+  return finalSelectedAssets(spec.tracks, spec.userOverride, spec.keyExclude).filter((id) => {
     const asset = EXTERNAL_ASSETS.find((a) => a.id === id);
     return asset === void 0 || assetReachesCli(asset, spec.cli);
   });
@@ -6750,9 +6868,9 @@ function groupAssetsByCategory(assetIds) {
 // src/resident-entries.ts
 init_esm_shims();
 import { existsSync as existsSync21, readFileSync as readFileSync22 } from "fs";
-import { basename as basename7, join as join29 } from "path";
+import { basename as basename7, join as join30 } from "path";
 function residentEntries(spec) {
-  const skillThere = (id) => INTERNAL_BUNDLED_SKILL_IDS.includes(id) && [".claude/skills", ".agents/skills"].some((d2) => existsSync21(join29(spec.projectDir, d2, id)));
+  const skillThere = (id) => INTERNAL_BUNDLED_SKILL_IDS.includes(id) && [".claude/skills", ".agents/skills"].some((d2) => existsSync21(join30(spec.projectDir, d2, id)));
   const forceExclude = (spec.userOverride?.forceExclude ?? []).filter((id) => !skillThere(id));
   const assetSpec = buildManifestSpec(
     spec.userOverride ? { ...spec, userOverride: { ...spec.userOverride, forceExclude } } : spec
@@ -6778,7 +6896,7 @@ function residentEntries(spec) {
 function residentCostFor(spec, entries = residentEntries(spec), contextFiles) {
   if (contextFiles !== void 0) return residentCost(entries, void 0, spec.cli, contextFiles);
   const cost = residentCost(entries, void 0, spec.cli, plannedClaudeContext(spec));
-  if (anchorSurface(spec.cli).scaffold === "agents-md" && existsSync21(join29(spec.projectDir, "AGENTS.md"))) {
+  if (anchorSurface(spec.cli).scaffold === "agents-md" && existsSync21(join30(spec.projectDir, "AGENTS.md"))) {
     return makeResidentCost({
       ...cost,
       contextNote: "planned, not counting text already in AGENTS.md"
@@ -6789,7 +6907,7 @@ function residentCostFor(spec, entries = residentEntries(spec), contextFiles) {
 function plannedClaudeContext(spec) {
   if (!spec.cli.includes("claude")) return void 0;
   const root = resolveBundleRoot();
-  const rootClaude = join29(spec.projectDir, "CLAUDE.md");
+  const rootClaude = join30(spec.projectDir, "CLAUDE.md");
   const existing = existsSync21(rootClaude) ? readFileSync22(rootClaude, "utf-8") : null;
   const seeded = existing === null ? seedRootClaudeProjectContext(spec.projectDir, root) : null;
   if (existing === null && seeded === null) return void 0;
@@ -6799,14 +6917,14 @@ function plannedClaudeContext(spec) {
     continuousSkills: manifestSpec.selectedInternalSkills ?? [],
     ...seeded === null ? {} : { projectContext: seeded }
   });
-  return [join29(root, "templates", "CLAUDE.md"), { text }];
+  return [join30(root, "templates", "CLAUDE.md"), { text }];
 }
 function onDiskTargets(spec, assetSpec) {
   const out = /* @__PURE__ */ new Set();
   for (const e2 of buildManifest(assetSpec)) {
     if (!e2.applies(assetSpec)) continue;
     const t = classifyBaselineTarget(e2.target);
-    if (t !== null && existsSync21(join29(spec.projectDir, e2.target))) out.add(t.id);
+    if (t !== null && existsSync21(join30(spec.projectDir, e2.target))) out.add(t.id);
   }
   return out;
 }
@@ -6831,7 +6949,7 @@ function renderInstallHeader(log, spec, mode) {
     );
   }
   log(infoRow("OPTIONS", formatOptions(spec)));
-  const finalAssets = finalSelectedAssets(spec.tracks, spec.userOverride);
+  const finalAssets = finalSelectedAssets(spec.tracks, spec.userOverride, spec.keyExclude);
   if (finalAssets.length > 0) {
     const unreachable = finalAssets.filter((id) => {
       const asset = EXTERNAL_ASSETS.find((a) => a.id === id);
@@ -6993,23 +7111,23 @@ function residentEntriesOnDisk(spec) {
   const hasClaude = spec.cli.includes("claude");
   const surface = anchorSurface(spec.cli).scaffold;
   const mdFiles = (dir, kind, skip) => {
-    const abs = join30(spec.projectDir, dir);
+    const abs = join31(spec.projectDir, dir);
     return existsSync22(abs) ? readdirSync6(abs, { withFileTypes: true }).filter((e2) => e2.isFile() && e2.name.endsWith(".md") && e2.name !== skip).map((e2) => ({
       source: `${kind}/${e2.name}`,
       // `target` 은 `residentCost` 의 분류 키다 — 실제 자리는 `file` 이 말한다.
       target: `.claude/${kind}/${e2.name}`,
       // 배포판이 아니라 **이 프로젝트의 파일**을 잰다 — 사용자가 고친 본문도,
       // 배포판에 더는 없는 파일도 실제로 상주하는 것은 이쪽이다.
-      file: join30(abs, e2.name)
+      file: join31(abs, e2.name)
     })) : [];
   };
-  const rules = surface === "claude" ? mdFiles(join30(".claude", "rules"), "rules") : rulesInline(spec.cli) ? planned.filter((e2) => e2.target.startsWith(".claude/rules/")) : mdFiles(join30(".agents", "rules"), "rules", "uzys-harness.md");
-  const slot = hasClaude ? join30(".claude", "skills") : join30(".agents", "skills");
+  const rules = surface === "claude" ? mdFiles(join31(".claude", "rules"), "rules") : rulesInline(spec.cli) ? planned.filter((e2) => e2.target.startsWith(".claude/rules/")) : mdFiles(join31(".agents", "rules"), "rules", "uzys-harness.md");
+  const slot = hasClaude ? join31(".claude", "skills") : join31(".agents", "skills");
   const skills = planned.filter((e2) => e2.target.startsWith(".claude/skills/")).map((e2) => ({
     ...e2,
-    file: join30(spec.projectDir, slot, e2.target.slice(".claude/skills/".length))
+    file: join31(spec.projectDir, slot, e2.target.slice(".claude/skills/".length))
   })).filter((e2) => existsSync22(e2.file));
-  const agents = hasClaude ? mdFiles(join30(".claude", "agents"), "agents") : [];
+  const agents = hasClaude ? mdFiles(join31(".claude", "agents"), "agents") : [];
   return [
     ...planned.filter(
       (e2) => !e2.target.startsWith(".claude/rules/") && !e2.target.startsWith(".claude/agents/") && !e2.target.startsWith(".claude/skills/")
@@ -7021,8 +7139,8 @@ function residentEntriesOnDisk(spec) {
 }
 function contextFilesOnDisk(spec) {
   const surface = anchorSurface(spec.cli).scaffold;
-  const files = surface === "claude" ? [HARNESS_ANCHOR_FILE, "CLAUDE.md", join30(".claude", "CLAUDE.md")] : ["AGENTS.md"];
-  return files.map((f) => join30(spec.projectDir, f));
+  const files = surface === "claude" ? [HARNESS_ANCHOR_FILE, "CLAUDE.md", join31(".claude", "CLAUDE.md")] : ["AGENTS.md"];
+  return files.map((f) => join31(spec.projectDir, f));
 }
 function rulesInsideAgentsMd(spec, cost) {
   if (anchorSurface(spec.cli).scaffold !== "agents-md" || !rulesInline(spec.cli)) return cost;
@@ -7314,7 +7432,7 @@ function renderFinalSummary(log, spec, report, fromWizard) {
   const remote = (report.shared ?? []).find((f) => f.path === ".mcp.json")?.remote ?? [];
   for (const line of remoteMcpNextLines(remote, spec.cli)) log(`${" ".repeat(16)} ${line}`);
   const scaffoldFiles = scaffoldFilesForCli(spec.cli).filter(
-    (f) => f === "CLAUDE.md" && report.rootClaudeMd?.created === true || hasFillPrompt(join30(spec.projectDir, f))
+    (f) => f === "CLAUDE.md" && report.rootClaudeMd?.created === true || hasFillPrompt(join31(spec.projectDir, f))
   );
   if (scaffoldFiles.length > 0) {
     const auditInstalled = buildManifestSpec(spec).selectedInternalSkills?.includes("audit-harness-fit");
@@ -8080,7 +8198,7 @@ function renderInterruptedInstall(err, e2, cwd = process.cwd()) {
   }
   const { path, error } = e2.record;
   err(
-    path !== null ? `  Already in place before it stopped \u2014 recorded in ${relative7(cwd, path) || path}:` : "  Already in place before it stopped:"
+    path !== null ? `  Already in place before it stopped \u2014 recorded in ${relative8(cwd, path) || path}:` : "  Already in place before it stopped:"
   );
   for (const [key, n] of groups) {
     err(`    ${key.endsWith("/") ? `${key} (${n} file${n === 1 ? "" : "s"})` : key}`);
@@ -8404,7 +8522,7 @@ function registerInstallCommand(cli) {
 // src/commands/list.ts
 init_esm_shims();
 import { existsSync as existsSync23, readFileSync as readFileSync24 } from "fs";
-import { join as join31, resolve as resolve3 } from "path";
+import { join as join32, resolve as resolve3 } from "path";
 function listAction(options = {}, deps = {}) {
   const log = deps.log ?? console.log;
   const err = deps.err ?? console.error;
@@ -8508,7 +8626,7 @@ function formatHarnessFileRows(log, projectDir) {
   const rows = [`    ${c.dim(tops.length > 0 ? tops.join("  ") : "(none recorded)")}`];
   const rootMd = log.templates.rootClaudeMd;
   if (rootMd) {
-    const path = join31(projectDir, rootMd.path);
+    const path = join32(projectDir, rootMd.path);
     const modified = existsSync23(path) && hashContent(readFileSync24(path, "utf8")) !== rootMd.sha256;
     rows.push(
       modified ? `    ${c.dim(rootMd.path)}  ${c.yellow("(\uC218\uC815\uB428 \u2014 uninstall \uC2DC \uBCF4\uC874)")}` : `    ${c.dim(rootMd.path)}`
@@ -8523,7 +8641,7 @@ var ROOT_FILE_CHANGE = {
   displaced: "\uBE44\uCF1C \uB460"
 };
 function formatRootFileRows(rootFiles, projectDir) {
-  const present = rootFiles.filter((f) => existsSync23(join31(projectDir, f.path)));
+  const present = rootFiles.filter((f) => existsSync23(join32(projectDir, f.path)));
   const width = Math.max(0, ...present.map((f) => f.path.length));
   return present.map(
     (f) => `    ${c.dim(padDisplay(f.path, width))}  ${c.dim(ROOT_FILE_CHANGE[f.change])}  ${c.dim(f.notes.join(" / "))}`
@@ -8554,7 +8672,7 @@ import {
   statSync as statSync4,
   writeFileSync as writeFileSync8
 } from "fs";
-import { dirname as dirname8, join as join32, relative as relative8, resolve as resolve4, sep as sep8 } from "path";
+import { dirname as dirname8, join as join33, relative as relative9, resolve as resolve4, sep as sep9 } from "path";
 
 // src/track-removal.ts
 init_esm_shims();
@@ -10493,7 +10611,7 @@ function unwritablePaths(ctx) {
   const project = ctx.targetAssets.filter((a) => a.scope === "project");
   if (project.some((a) => a.method === "npm")) need.add(".");
   const parentOf = (path) => {
-    const abs = join32(projectDir, path);
+    const abs = join33(projectDir, path);
     if (!safeExists(abs)) return;
     const real = safeRealpath(abs);
     if (real !== null && isOutsideProject(projectDir, real)) return;
@@ -10505,7 +10623,7 @@ function unwritablePaths(ctx) {
     const recordedShared = new Set((installLog.portions ?? []).map((p2) => p2.path));
     const made = new Set((installLog.externalFiles ?? []).map((f) => f.path));
     for (const p2 of UNINSTALL_SHARED) {
-      if (recordedShared.has(p2) && existsSync24(join32(projectDir, p2))) need.add(p2);
+      if (recordedShared.has(p2) && existsSync24(join33(projectDir, p2))) need.add(p2);
       if (made.has(p2)) parentOf(p2);
     }
     for (const p2 of harnessCandidates(installLog)) parentOf(p2);
@@ -10515,7 +10633,7 @@ function unwritablePaths(ctx) {
   }
   return [...need].filter((p2) => {
     try {
-      accessSync2(join32(projectDir, p2), fsConstants2.W_OK);
+      accessSync2(join33(projectDir, p2), fsConstants2.W_OK);
       return false;
     } catch (e2) {
       return e2.code !== "ENOENT";
@@ -10618,15 +10736,15 @@ function settleLog(ctx, io) {
       return true;
     }
   } else {
-    const recordDir = join32(projectDir, INSTALL_LOG_DIR);
+    const recordDir = join33(projectDir, INSTALL_LOG_DIR);
     if (outsideLinkAt(projectDir, INSTALL_LOG_DIR) !== null) io.rm(recordDir);
     else {
-      for (const rel of RECORD_FILES) io.rm(join32(projectDir, rel));
+      for (const rel of RECORD_FILES) io.rm(join33(projectDir, rel));
       pruneEmptyDirsUpward(projectDir, recordDir);
     }
     if (outsideLinkAt(projectDir, LEGACY_INSTALL_LOG_DIR) === null) {
       io.rm(legacyInstallLogPath(projectDir));
-      pruneEmptyDirsUpward(projectDir, join32(projectDir, LEGACY_INSTALL_LOG_DIR));
+      pruneEmptyDirsUpward(projectDir, join33(projectDir, LEGACY_INSTALL_LOG_DIR));
     }
     io.log(`  ${status.success("install log removed")}`);
   }
@@ -10730,7 +10848,7 @@ function backupArtifactAdvisoryLines(projectDir) {
     }
   }
   for (const dir of BACKUP_SCAN_DIRS) {
-    const abs = join32(projectDir, dir);
+    const abs = join33(projectDir, dir);
     if (!existsSync24(abs) || outsideLinkAt(projectDir, dir) !== null) continue;
     for (const rel of listFilesRecursive(abs)) {
       if (BACKUP_SUFFIX.test(rel)) found.push(`${dir}/${rel}`);
@@ -10746,11 +10864,11 @@ function backupArtifactAdvisoryLines(projectDir) {
 }
 function rootFileAdvisoryLines(rootFiles, projectDir) {
   const header = "[ROOT] `.claude/` \uBC16\uC5D0 \uB0A8\uB294 \uAC83 (\uC790\uB3D9\uC73C\uB85C \uC9C0\uC6B0\uC9C0 \uC54A\uB294\uB2E4):";
-  const present = rootFiles.filter((f) => existsSync24(join32(projectDir, f.path)));
+  const present = rootFiles.filter((f) => existsSync24(join33(projectDir, f.path)));
   if (present.length === 0) return [];
   const outside = /* @__PURE__ */ new Map();
   const inside = present.filter((f) => {
-    const o = outsideProjectTarget(projectDir, join32(projectDir, f.path));
+    const o = outsideProjectTarget(projectDir, join33(projectDir, f.path));
     if (o === null) return true;
     const group = outside.get(o.link) ?? { link: o, files: [] };
     group.files.push(f.path);
@@ -10789,7 +10907,7 @@ function rootFileMeaning(f, projectDir) {
     case "displaced": {
       const backup = f.notes[0];
       if (backup === void 0) return "\uD558\uB124\uC2A4 \uD310\uACFC \uAC19\uC740 \uC124\uCE58\uC790 \uD30C\uC77C\uC774 \uC788\uB358 \uC790\uB9AC (\uADF8\uB300\uB85C \uB450\uC5C8\uB2E4)";
-      return existsSync24(join32(projectDir, backup)) ? `\uD558\uB124\uC2A4\uAC00 \uC4F4 \uC790\uB9AC \u2014 \uC6D0\uB798 \uC788\uB358 \uC124\uCE58\uC790 \uD30C\uC77C\uC740 ${backup} \uC5D0 \uC788\uB2E4` : `\uD558\uB124\uC2A4\uAC00 \uC4F4 \uC790\uB9AC \u2014 \uC6D0\uB798 \uC788\uB358 \uC124\uCE58\uC790 \uD30C\uC77C\uC758 \uBC31\uC5C5(${backup})\uC774 \uB354\uB294 \uC5C6\uB2E4`;
+      return existsSync24(join33(projectDir, backup)) ? `\uD558\uB124\uC2A4\uAC00 \uC4F4 \uC790\uB9AC \u2014 \uC6D0\uB798 \uC788\uB358 \uC124\uCE58\uC790 \uD30C\uC77C\uC740 ${backup} \uC5D0 \uC788\uB2E4` : `\uD558\uB124\uC2A4\uAC00 \uC4F4 \uC790\uB9AC \u2014 \uC6D0\uB798 \uC788\uB358 \uC124\uCE58\uC790 \uD30C\uC77C\uC758 \uBC31\uC5C5(${backup})\uC774 \uB354\uB294 \uC5C6\uB2E4`;
     }
   }
 }
@@ -10871,8 +10989,8 @@ function agentsMdRerenderSet(target, remaining, log, projectDir) {
   const set = agentsMdClis(remaining);
   if (set.length === 0) return null;
   const recorded2 = (log.externalFiles ?? []).some((f) => f.path === AGENTS_MD2) || (log.portions ?? []).some((p2) => p2.path === AGENTS_MD2);
-  if (!existsSync24(join32(projectDir, AGENTS_MD2))) return null;
-  if (!recorded2 && !isLegacyHarnessAgentsMd(readTextOrEmpty(join32(projectDir, AGENTS_MD2)))) {
+  if (!existsSync24(join33(projectDir, AGENTS_MD2))) return null;
+  if (!recorded2 && !isLegacyHarnessAgentsMd(readTextOrEmpty(join33(projectDir, AGENTS_MD2)))) {
     return null;
   }
   return set;
@@ -11003,9 +11121,9 @@ function runScopedRemoval(ctx, io, plan) {
   }
   for (const line of lines) io.log(line);
   const settled = plan.settle(done);
-  const agentsBefore = readTextOrEmpty(join32(projectDir, AGENTS_MD2));
+  const agentsBefore = readTextOrEmpty(join33(projectDir, AGENTS_MD2));
   const rerender = plan.rerenderSet === null ? null : rerenderAgentsMd(ctx, plan.rerenderSet, settled);
-  const rewrote = rerender !== null && readTextOrEmpty(join32(projectDir, AGENTS_MD2)) !== agentsBefore;
+  const rewrote = rerender !== null && readTextOrEmpty(join33(projectDir, AGENTS_MD2)) !== agentsBefore;
   if (rewrote) for (const line of rerenderLines(rerender)) io.log(line);
   const next = rerender === null ? settled : withRerender(settled, rerender);
   try {
@@ -11078,7 +11196,7 @@ function removeTrackAction(ctx, io) {
 }
 var TRACK_SCOPE = { shared: [], skeleton: [], folders: [], importBlock: false, anchor: false };
 function trackNotes(ctx, r, d2, write) {
-  const md = join32(ctx.projectDir, "CLAUDE.md");
+  const md = join33(ctx.projectDir, "CLAUDE.md");
   const block = rootBlockNext(ctx, new Set(d2.removed));
   if (write && block !== null) {
     backupIfLossyUtf8(md);
@@ -11106,11 +11224,11 @@ function previewTrackRemoval(ctx, target) {
 }
 function rootBlockNext({ installLog, projectDir }, gone) {
   const anchor = installLog.templates?.rootClaudeMd?.path;
-  const md = join32(projectDir, "CLAUDE.md");
+  const md = join33(projectDir, "CLAUDE.md");
   const text = safeExists(md) && outsideProjectTarget(projectDir, md) === null ? readTextOrEmpty(md) : "";
-  if (anchor === void 0 || !safeExists(join32(projectDir, anchor))) return null;
+  if (anchor === void 0 || !safeExists(join33(projectDir, anchor))) return null;
   if (stripHarnessImport(text) === null) return null;
-  const stays = (id) => listFilesRecursive(join32(projectDir, SKILLS_DIR3, id)).some(
+  const stays = (id) => listFilesRecursive(join33(projectDir, SKILLS_DIR3, id)).some(
     (f) => !gone.has(`${SKILLS_DIR3}${id}/${f}`)
   );
   const continuousSkills = CONTINUOUS_SKILLS.map((s) => s.id).filter(stays);
@@ -11121,7 +11239,7 @@ function settleTrackLog(ctx, target, remaining, done) {
   const { installLog, projectDir } = ctx;
   const tracks = installLog.spec.tracks.filter((t) => t !== target);
   const next = forgetRemoved({ ...installLog, spec: { ...installLog.spec, tracks } }, done);
-  const abs = join32(projectDir, INSTALLED_TRACKS);
+  const abs = join33(projectDir, INSTALLED_TRACKS);
   const key = INSTALLED_TRACKS.slice(CLAUDE_DIR3.length);
   const prior = installLog.policyFiles?.find((f) => f.path === key)?.sha256 ?? hashContent(installedTracksText(installLog.spec.tracks.filter(isTrack)));
   const edited = safeExists(abs) && hashContent(readTextOrEmpty(abs)) !== prior;
@@ -11148,7 +11266,7 @@ var SKILLS_LOCK = "skills-lock.json";
 function withSkillsLock(rootFiles, assets, projectDir) {
   const out = [...rootFiles];
   const skills = assets.some((a) => a.method === "skill" && a.scope === "project");
-  if (skills && !out.some((f) => f.path === SKILLS_LOCK) && existsSync24(join32(projectDir, SKILLS_LOCK))) {
+  if (skills && !out.some((f) => f.path === SKILLS_LOCK) && existsSync24(join33(projectDir, SKILLS_LOCK))) {
     out.push({ path: SKILLS_LOCK, change: "advisory", notes: [] });
   }
   return out;
@@ -11159,7 +11277,7 @@ function remnantFor(path, log, harnessRoot, projectDir, wiringGone = []) {
     const gone = (k2) => wiringGone.includes(`hooks/${k2.split("#")[1] ?? ""}`);
     return (disk) => {
       try {
-        const template = readFileSync25(join32(harnessRoot, "templates", "settings.json"), "utf8");
+        const template = readFileSync25(join33(harnessRoot, "templates", "settings.json"), "utf8");
         const render = renderSettingsPortion(template, () => true);
         return [...legacySettingsSeed(disk, render, projectDir, { edited: true }).keys()].filter(
           (k2) => !k2.endsWith("{}") && !gone(k2)
@@ -11298,7 +11416,7 @@ function noReverseHints(asset, ctx) {
   }
   if (asset.method !== "skill") return [];
   const name = asset.detail.skill;
-  const left = name === void 0 ? [] : [".claude/skills", ".agents/skills"].map((root) => `${root}/${name}/`).filter((p2) => existsSync24(join32(ctx.projectDir, p2)));
+  const left = name === void 0 ? [] : [".claude/skills", ".agents/skills"].map((root) => `${root}/${name}/`).filter((p2) => existsSync24(join33(ctx.projectDir, p2)));
   return [
     left.length > 0 ? `files it put down are not on record (installed by an older version) \u2014 left: ${left.join(" \xB7 ")} (delete by hand if the harness installed it)` : "files it put down are not on record (installed by an older version) \u2014 nothing removed"
   ];
@@ -11408,6 +11526,7 @@ function removeHarnessFiles(log, projectDir, scope, io) {
     legacyAgentsMd: [],
     unjudged: [],
     outside: [],
+    offSlot: [],
     displaced: [],
     shared: [],
     retiredWiring: [],
@@ -11424,7 +11543,7 @@ function removeHarnessFiles(log, projectDir, scope, io) {
   }
   const judged = new Set(candidates);
   for (const path of legacyFileCandidates()) {
-    if (judged.has(path) || !scope.has(path) || !safeExists(join32(projectDir, path))) continue;
+    if (judged.has(path) || !scope.has(path) || !safeExists(join33(projectDir, path))) continue;
     if (recorded(log, path, { isTarget }).state !== "none") continue;
     removeRecordedFile(path, { log, projectDir, io, out, isTarget, pruneFrom });
   }
@@ -11450,9 +11569,9 @@ function removeHarnessFiles(log, projectDir, scope, io) {
     write: io.write
   });
   if (io.write) {
-    for (const p2 of pruneFrom) pruneEmptyDirsUpward(projectDir, dirname8(join32(projectDir, p2)));
+    for (const p2 of pruneFrom) pruneEmptyDirsUpward(projectDir, dirname8(join33(projectDir, p2)));
     for (const d2 of scope.skeleton) {
-      const abs = join32(projectDir, d2);
+      const abs = join33(projectDir, d2);
       if (outsideProjectTarget(projectDir, abs) !== null) continue;
       pruneEmptyDirsUpward(projectDir, abs);
     }
@@ -11491,14 +11610,14 @@ function templateNext(harnessRoot, log, path) {
   if (helper === void 0 && !path.startsWith(CLAUDE_DIR3)) return null;
   try {
     const source = helper ?? path.slice(CLAUDE_DIR3.length);
-    return readFileSync25(join32(harnessRoot, "templates", source), "utf8");
+    return readFileSync25(join33(harnessRoot, "templates", source), "utf8");
   } catch {
     return null;
   }
 }
 function removeRecordedFile(path, ctx) {
   const { log, projectDir, io, out } = ctx;
-  const abs = join32(projectDir, path);
+  const abs = join33(projectDir, path);
   let foreign;
   try {
     foreign = foreignOwnedTarget(projectDir, path);
@@ -11515,6 +11634,11 @@ function removeRecordedFile(path, ctx) {
     out.outside.push(outside);
     return;
   }
+  if (!inHarnessSlot(projectDir, path, HARNESS_FILES, { follow: true })) {
+    out.offSlot.push(path);
+    out.forgotten.add(path);
+    return;
+  }
   let st2;
   try {
     st2 = lstatSync7(abs, { throwIfNoEntry: false });
@@ -11553,7 +11677,7 @@ function removeRecordedFile(path, ctx) {
   if (verdict.verdict !== "remove" && verdict.verdict !== "backup+remove") return;
   let backup = null;
   if (verdict.verdict === "backup+remove") {
-    backup = io.write ? relative8(projectDir, backupFile(effective)).split(sep8).join("/") : `${relative8(projectDir, effective).split(sep8).join("/")}.backup-<time>`;
+    backup = io.write ? relative9(projectDir, backupFile(effective)).split(sep9).join("/") : `${relative9(projectDir, effective).split(sep9).join("/")}.backup-<time>`;
   }
   if (io.write) {
     if (effective !== abs) io.rm(abs);
@@ -11582,11 +11706,11 @@ function mayReclaimLegacy(log, projectDir, path) {
 function removeLegacyHookWiring(log, projectDir, scope, io, removed) {
   if (!scope.has(SETTINGS_TARGET) || !installedClis(log).includes("claude")) return [];
   if ((log.portions ?? []).some((p2) => p2.path === SETTINGS_TARGET)) return [];
-  const abs = join32(projectDir, SETTINGS_TARGET);
+  const abs = join33(projectDir, SETTINGS_TARGET);
   if (!safeExists(abs) || outsideProjectTarget(projectDir, abs) !== null) return [];
-  const claudeDir = join32(projectDir, ".claude");
+  const claudeDir = join33(projectDir, ".claude");
   const gone = LEGACY_HOOK_REFS.filter(
-    (r) => !RETIRED_HOOK_WIRING_REFS.includes(r) && (removed.includes(`${CLAUDE_DIR3}${r}`) || !safeExists(join32(claudeDir, r)))
+    (r) => !RETIRED_HOOK_WIRING_REFS.includes(r) && (removed.includes(`${CLAUDE_DIR3}${r}`) || !safeExists(join33(claudeDir, r)))
   );
   return removeRetiredHookRefs(abs, claudeDir, gone, { evenIfScriptExists: true, write: io.write });
 }
@@ -11607,7 +11731,7 @@ function stripSharedFiles(log, projectDir, paths, io, out, pruneFrom) {
   };
   for (const path of paths) {
     if (!relevant(path)) continue;
-    const abs = join32(projectDir, path);
+    const abs = join33(projectDir, path);
     if (safeExists(abs)) {
       const o = outsideProjectTarget(projectDir, abs);
       if (o !== null) {
@@ -11618,7 +11742,7 @@ function stripSharedFiles(log, projectDir, paths, io, out, pruneFrom) {
     if (path === SETTINGS_TARGET && safeExists(abs)) {
       out.retiredWiring = removeRetiredHookRefs(
         abs,
-        join32(projectDir, ".claude"),
+        join33(projectDir, ".claude"),
         RETIRED_HOOK_WIRING_REFS,
         { evenIfScriptExists: true, write: io.write }
       );
@@ -11646,7 +11770,7 @@ function stripSharedFiles(log, projectDir, paths, io, out, pruneFrom) {
   }
 }
 function removeHarnessMadeShared(path, sha, projectDir, io, out, pruneFrom) {
-  const abs = join32(projectDir, path);
+  const abs = join33(projectDir, path);
   if (!existsSync24(abs)) {
     out.forgotten.add(path);
     return true;
@@ -11817,6 +11941,7 @@ function harnessRemovalLines(r, log, projectDir, scope, preview, alsoGone = [])
     );
   }
   lines.push(...outsideLines(r.outside, log));
+  lines.push(...offSlotLines(r.offSlot, projectDir));
   for (const path of r.kept) {
     lines.push(
       `  ${c.yellow("\u2298")} ${path} kept \u2014 modified since install. Remove manually if intended.`
@@ -11851,7 +11976,7 @@ function leftFolderLines(r, log, projectDir, scope, preview, alsoGone) {
     preview ? [...r.removed, ...r.shared.filter((s) => s.fileRemoved).map((s) => s.path), ...alsoGone] : []
   );
   const back = preview ? r.displaced.filter((d2) => d2.verdict === "restore").map((d2) => d2.path) : [];
-  const said = (full) => r.unjudged.includes(full) || r.kept.includes(full) || r.outside.some((o) => o.path === full || full.startsWith(`${o.link}/`));
+  const said = (full) => r.unjudged.includes(full) || r.kept.includes(full) || r.offSlot.includes(full) || r.outside.some((o) => o.path === full || full.startsWith(`${o.link}/`));
   const whose = "not on the install record \u2014 yours, or left by an older harness version; delete by hand any that are not yours";
   const lines = [];
   for (const dir of scope.folders) {
@@ -11884,19 +12009,19 @@ function yoursUnder(projectDir, dir) {
     }
     for (const e2 of entries) {
       const name = `${prefix}${e2.name}`;
-      if (e2.isDirectory()) walk(join32(abs2, e2.name), `${name}/`);
+      if (e2.isDirectory()) walk(join33(abs2, e2.name), `${name}/`);
       else if (BACKUP_SUFFIX.test(e2.name)) continue;
       else if (e2.isSymbolicLink()) {
         let target = "?";
         try {
-          target = readlinkSync2(join32(abs2, e2.name));
+          target = readlinkSync2(join33(abs2, e2.name));
         } catch {
         }
         out.push({ name, shown: `${name} (your link \u2192 ${target})` });
       } else out.push({ name, shown: name });
     }
   };
-  const abs = join32(projectDir, dir);
+  const abs = join33(projectDir, dir);
   try {
     if (!statSync4(abs).isDirectory()) return [];
   } catch {
@@ -11908,7 +12033,7 @@ function yoursUnder(projectDir, dir) {
 function assetsLeftLines(log, projectDir, scope) {
   const lines = [];
   for (const a of log.assets) {
-    const here = (a.files ?? []).map((f) => f.path).filter((p2) => scope.has(p2) && safeExists(join32(projectDir, p2)));
+    const here = (a.files ?? []).map((f) => f.path).filter((p2) => scope.has(p2) && safeExists(join33(projectDir, p2)));
     if (here.length === 0) continue;
     const slots = [...new Set(here.map((p2) => p2.split("/").slice(0, 3).join("/")))].sort();
     lines.push(
@@ -11920,10 +12045,13 @@ function assetsLeftLines(log, projectDir, scope) {
 function removeAnchor(log, projectDir, io) {
   const rootMd = log.templates?.rootClaudeMd;
   if (!rootMd) return { removed: false, lines: [] };
-  const abs = join32(projectDir, rootMd.path);
+  const abs = join33(projectDir, rootMd.path);
   if (!existsSync24(abs)) return { removed: false, lines: [] };
   const outside = outsideProjectTarget(projectDir, abs);
   if (outside !== null) return { removed: false, lines: outsideLines([outside], log) };
+  if (!inHarnessSlot(projectDir, rootMd.path, ANCHOR_FILES, { follow: true })) {
+    return { removed: false, lines: [offSlotLine(rootMd.path, "names it as the harness anchor")] };
+  }
   let disk;
   try {
     disk = readFileSync25(abs, "utf8");
@@ -11959,7 +12087,7 @@ function removeAnchor(log, projectDir, io) {
       ]
     };
   }
-  const backup = edited ? relative8(projectDir, backupFile(abs)).split(sep8).join("/") : null;
+  const backup = edited ? relative9(projectDir, backupFile(abs)).split(sep9).join("/") : null;
   io.rm(abs);
   return {
     removed: true,
@@ -11971,7 +12099,7 @@ function removeAnchor(log, projectDir, io) {
 var AGENTS_MD2 = "AGENTS.md";
 function readAgentsMdTemplate(harnessRoot) {
   try {
-    return readFileSync25(join32(harnessRoot, AGENTS_MD_TEMPLATE), "utf8");
+    return readFileSync25(join33(harnessRoot, AGENTS_MD_TEMPLATE), "utf8");
   } catch {
     return null;
   }
@@ -11997,7 +12125,7 @@ function agentsMdRemainder(current, harnessRoot) {
   return { ok: true, remainder: strip.remainder, strip };
 }
 function removeUnrecordedLegacyAgentsMd(path, projectDir, io, out, pruneFrom) {
-  const abs = join32(projectDir, path);
+  const abs = join33(projectDir, path);
   let effective = abs;
   let current;
   try {
@@ -12022,7 +12150,7 @@ function removeLegacyAgentsMd(path, abs, effective, strip, ctx) {
   let backup = `${path}.backup-<time>`;
   try {
     if (io.write) {
-      backup = relative8(projectDir, backupFile(effective)).split(sep8).join("/");
+      backup = relative9(projectDir, backupFile(effective)).split(sep9).join("/");
       if (strip.remainder !== null) {
         writeFileSync8(effective, neutralizeScaffoldBanner(strip.remainder), "utf8");
       } else {
@@ -12061,14 +12189,52 @@ function globalCopyLines(copies, preview) {
     ];
   });
 }
+var ASSET_SLOTS = skillFolders(SKILL_ROOTS);
+function offSlotLines(paths, projectDir) {
+  const lines = [];
+  const byLink = /* @__PURE__ */ new Map();
+  for (const path of paths) {
+    const link = linkOnPath(projectDir, path);
+    if (link === null) {
+      lines.push(offSlotLine(path, "lists it"));
+      continue;
+    }
+    const g = byLink.get(link.link) ?? { target: link.target, n: 0 };
+    g.n += 1;
+    byLink.set(link.link, g);
+  }
+  for (const [link, g] of byLink) {
+    lines.push(
+      `  ${c.yellow("\u2298")} ${link} \u2014 your link (\u2192 ${g.target}) leads outside the places this tool installs to; left ${g.n} file(s) on the install record under it. Not touched \u2014 remove by hand if intended.`
+    );
+  }
+  return lines;
+}
+function linkOnPath(projectDir, path) {
+  const parts = path.split("/");
+  for (let i = 1; i <= parts.length; i++) {
+    const rel = parts.slice(0, i).join("/");
+    try {
+      if (lstatSync7(join33(projectDir, rel), { throwIfNoEntry: false })?.isSymbolicLink() === true) {
+        return { link: rel, target: readlinkSync2(join33(projectDir, rel)) };
+      }
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function offSlotLine(path, what) {
+  return `  ${c.yellow("\u2298")} ${path} left \u2014 the install record ${what}, but it is (or leads) outside the places this tool installs to. Not touched.`;
+}
 function removeToolFiles(files, projectDir, rm) {
   const notes = [];
   const removed = [];
   let failed = 0;
-  const pairs = new Set(files.filter((f) => isAppleDoublePath(join32(projectDir, f.path))));
+  const pairs = new Set(files.filter((f) => isAppleDoublePath(join33(projectDir, f.path))));
   for (const file of files) {
     const { path, sha256 } = file;
-    const abs = join32(projectDir, path);
+    const abs = join33(projectDir, path);
     if (pairs.has(file)) {
       try {
         rm(abs);
@@ -12091,10 +12257,16 @@ function removeToolFiles(files, projectDir, rm) {
       notes.push(`left ${path} \u2014 it is a link now, not the copy that was installed`);
       continue;
     }
+    if (!inHarnessSlot(projectDir, path, ASSET_SLOTS)) {
+      notes.push(
+        `left ${path} \u2014 the install record lists it for this asset, but it is (or leads) outside the skill folders this asset installs to`
+      );
+      continue;
+    }
     try {
       if (hashContent(readFileSync25(abs, "utf8")) !== sha256) {
         const backup = backupFile(abs);
-        notes.push(`backed up ${path} \u2192 ${relative8(projectDir, backup)} (changed since install)`);
+        notes.push(`backed up ${path} \u2192 ${relative9(projectDir, backup)} (changed since install)`);
       }
       rm(abs);
       removed.push(path);
@@ -12103,14 +12275,14 @@ function removeToolFiles(files, projectDir, rm) {
       notes.push(`left ${path} \u2014 ${e2 instanceof Error ? e2.message : String(e2)}`);
     }
   }
-  for (const path of removed) pruneEmptyDirsUpward(projectDir, dirname8(join32(projectDir, path)));
+  for (const path of removed) pruneEmptyDirsUpward(projectDir, dirname8(join33(projectDir, path)));
   return failed > 0 ? { ok: false, message: `${failed} file(s) could not be removed`, notes } : { ok: true, notes };
 }
 function pruneEmptyDirsUpward(projectDir, startDir) {
   let cursor = startDir;
   while (true) {
-    const rel = relative8(projectDir, cursor);
-    if (rel === "" || rel.startsWith(`..${sep8}`) || rel === "..") return;
+    const rel = relative9(projectDir, cursor);
+    if (rel === "" || rel.startsWith(`..${sep9}`) || rel === "..") return;
     try {
       if (readdirSync7(cursor).length > 0) return;
       rmdirSync3(cursor);
@@ -12127,8 +12299,8 @@ function stripRootImport(projectDir) {
   if (withoutImport === null) return false;
   const stripped = neutralizeScaffoldBanner(withoutImport);
   try {
-    backupIfLossyUtf8(join32(projectDir, "CLAUDE.md"));
-    writeFileSync8(join32(projectDir, "CLAUDE.md"), stripped, "utf8");
+    backupIfLossyUtf8(join33(projectDir, "CLAUDE.md"));
+    writeFileSync8(join33(projectDir, "CLAUDE.md"), stripped, "utf8");
     return true;
   } catch {
     return false;
@@ -12150,10 +12322,10 @@ function importOutsideLine(o, anchorGone) {
   return `  ${c.yellow("\u2298")} CLAUDE.md kept \u2014 link target is outside the project (${o.target}). Not touched \u2014 its harness @import block (${HARNESS_IMPORT_LINE}) is left in it${pointing} \u2014 delete that block by hand.`;
 }
 function rootClaudeMdOutside(projectDir) {
-  return outsideProjectTarget(projectDir, join32(projectDir, "CLAUDE.md"));
+  return outsideProjectTarget(projectDir, join33(projectDir, "CLAUDE.md"));
 }
 function readRootClaudeMd(projectDir) {
-  const path = join32(projectDir, "CLAUDE.md");
+  const path = join33(projectDir, "CLAUDE.md");
   if (!existsSync24(path)) return null;
   try {
     return readFileSync25(path, "utf8");
@@ -12351,7 +12523,8 @@ function classifyUpdateIntent(log, confirmed, legacyTracks = []) {
   const recordClis = recordedClis(log);
   if (!sameSet(confirmed.tracks, recordTracks)) return "add";
   if (!sameSet(confirmed.cli, recordClis)) return "add";
-  const out = excludedIds(log);
+  const recordedOut = excludedIds(log);
+  const out = /* @__PURE__ */ new Set([...recordedOut, ...droppedMcpAssetIds(resolveBundleRoot(), recordedOut)]);
   const recorded2 = log?.assets ?? [];
   const covered = coveredByRecord(log, legacyTracks);
   const picked = new Set(confirmed.assetIds);
@@ -12699,7 +12872,8 @@ async function confirmUpdate(input) {
 function unchecked(log, tracks, assetIds, baselineIds) {
   const checked = /* @__PURE__ */ new Set([...assetIds, ...baselineIds]);
   const offered = new Set(listBaselineTargets({ tracks }).map((t) => t.id));
-  return [...excludedIds(log)].filter((id) => !checked.has(id)).filter((id) => !id.startsWith(BASELINE_PREFIX) || offered.has(id)).sort();
+  const rechecked = (id) => isKeyId(id) && droppedMcpAssetIds(resolveBundleRoot(), /* @__PURE__ */ new Set([id])).some((a) => checked.has(a));
+  return [...excludedIds(log)].filter((id) => !checked.has(id) && !rechecked(id)).filter((id) => !id.startsWith(BASELINE_PREFIX) || offered.has(id)).sort();
 }
 function annotate(summary, notes) {
   return summary.split("\n").map((line) => {
@@ -12734,7 +12908,7 @@ function formatSummary(spec) {
     `CLI:       ${spec.cli.join(" \xB7 ")}`,
     `Target:    ${spec.projectDir}`
   ];
-  const finalAssets = finalSelectedAssets(spec.tracks, spec.userOverride);
+  const finalAssets = finalSelectedAssets(spec.tracks, spec.userOverride, spec.keyExclude);
   if (finalAssets.length > 0) {
     const unreachable = finalAssets.filter((id) => {
       const asset = EXTERNAL_ASSETS.find((a) => a.id === id);