mover-os 4.7.7 → 4.7.9

package/install.js

@@ -4,8 +4,8 @@
 // Zero dependencies. Node.js 18+.
 //
 // Usage:
-//   npx moveros
-//   npx moveros --key YOUR_KEY --vault ~/vault
+//   npx mover-os
+//   npx mover-os --key YOUR_KEY --vault ~/vault
 // ══════════════════════════════════════════════════════════════════════════════
 
 const readline = require("readline");
@@ -13,7 +13,7 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 const crypto = require("crypto");
-const { execSync } = require("child_process");
+const { execSync, spawnSync } = require("child_process");
 
 const VERSION = "4";
 
@@ -43,7 +43,12 @@ function jsonOut(command, data, ok = true) {
 }
 
 // ─── TTY detection (must be before output budget check) ──────────────────────
-const IS_TTY = process.stdout.isTTY && process.stdin.isTTY;
+// --yes/-y forces the non-interactive default path everywhere. It also serves
+// as the escape hatch for Git Bash on Windows, where isTTY can read false at a
+// real terminal (npm shim indirection) — the documented flag must actually
+// work (R5-A: opts.yes was parsed but never read).
+const FORCE_DEFAULTS = process.argv.includes("--yes") || process.argv.includes("-y");
+const IS_TTY = !FORCE_DEFAULTS && process.stdout.isTTY && process.stdin.isTTY;
 
 // ─── Output budget (30K chars = Anthropic bash tool truncation limit) ────────
 const MAX_OUTPUT_CHARS = 28000; // Leave 2K buffer below 30K limit
@@ -270,7 +275,9 @@ async function printHeader(animate = IS_TTY) {
 
 // Progress bar with label and percentage
 function progressBar(current, total, width = 30, label = "") {
-  const pct = Math.min(1, current / total);
+  // terra read F6: total===0 made current/total NaN, rendered as "NaN%". A valid
+  // empty (no-tasks) state is 0%, not corrupt.
+  const pct = total > 0 ? Math.min(1, current / total) : 0;
   const filled = Math.round(pct * width);
   const empty = width - filled;
   const bar = `${S.green}${"█".repeat(filled)}${S.gray}${"░".repeat(empty)}${S.reset}`;
@@ -465,8 +472,15 @@ function textInput({ label = "", initial = "", mask = null, placeholder = "" })
     question(label);
 
     if (!IS_TTY) {
+      // --yes: never wait for input, take the default outright.
+      if (FORCE_DEFAULTS) { resolve(initial); return; }
       const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-      rl.question(`${BAR_COLOR}│${S.reset}  `, (ans) => { rl.close(); resolve(ans || initial); });
+      let settled = false;
+      const settle = (ans) => { if (settled) return; settled = true; try { rl.close(); } catch {} resolve(ans || initial); };
+      rl.question(`${BAR_COLOR}│${S.reset}  `, settle);
+      // A closed/empty stdin (CI, scripts) fires 'close' with no answer —
+      // resolve the default instead of hanging forever (R5-A).
+      rl.on("close", () => settle(""));
       return;
     }
 
@@ -730,6 +744,30 @@ async function validateKey(key) {
   }
 }
 
+function persistActivationId(moverDir, activationId) {
+  if (typeof activationId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(activationId)) {
+    return false;
+  }
+  try {
+    fs.mkdirSync(moverDir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(path.join(moverDir, ".activation-id"), activationId, { encoding: "utf8", mode: 0o600 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function readActivationId(moverDir) {
+  try {
+    const activationId = fs.readFileSync(path.join(moverDir, ".activation-id"), "utf8").trim();
+    return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(activationId)
+      ? activationId
+      : null;
+  } catch {
+    return null;
+  }
+}
+
 async function activateKey(key) {
   if (!key) return;
   try {
@@ -743,7 +781,7 @@ async function activateKey(key) {
     let label = os.hostname();
     try { label = getMachineId(moverDir) || label; } catch {}
     const body = JSON.stringify({ key: key.trim(), organization_id: POLAR_ORG_ID, label });
-    await new Promise((resolve, reject) => {
+    const result = await new Promise((resolve, reject) => {
       const req = https.request({
         hostname: "api.polar.sh",
         path: "/v1/customer-portal/license-keys/activate",
@@ -753,13 +791,20 @@ async function activateKey(key) {
       }, (res) => {
         let data = "";
         res.on("data", (chunk) => data += chunk);
-        res.on("end", () => resolve(data));
+        res.on("end", () => resolve({ statusCode: res.statusCode, data }));
       });
       req.on("error", reject);
       req.on("timeout", () => { req.destroy(); reject(new Error("Timeout")); });
       req.write(body);
       req.end();
     });
+    if (result.statusCode >= 200 && result.statusCode < 300) {
+      try {
+        const data = JSON.parse(result.data);
+        persistActivationId(moverDir, data.id);
+      } catch {}
+    }
+    return result;
   } catch { /* Activation failure is non-blocking */ }
 }
 
@@ -812,6 +857,8 @@ async function downloadPayload(key) {
       headers: { "X-License-Key": key.trim(), "X-Machine-Id": machineId },
       timeout: 60000,
     }, (res) => {
+      const activationId = res.headers["x-mover-activation-id"];
+      if (typeof activationId === "string") persistActivationId(moverDir, activationId);
       if (res.statusCode === 301 || res.statusCode === 302) {
         // Follow redirect — only to trusted domains
         const redirectUrl = new URL(res.headers.location);
@@ -944,8 +991,30 @@ async function downloadPayload(key) {
   // The ordering of -tvzf and -tzf output is identical (tar walks the
   // archive in the same order), so we zip them by line index for the
   // type/path correlation.
-  const pathsListing = execSync(`tar -tzf "${tarPath}"`, { encoding: 'utf8' });
-  const verboseListing = execSync(`tar -tvzf "${tarPath}"`, { encoding: 'utf8' });
+  // v4.7.9 (S4 ship-blocker): tar preflight. Both listing calls were outside
+  // any try/catch, so on a Windows box without tar on PATH the raw spawn threw
+  // `Error: spawnSync /bin/sh ENOENT` (or `'tar' is not recognized`) with no
+  // hint about what the user must install. Check tar is present first, then
+  // wrap the listings so a genuinely corrupt payload reports differently from a
+  // missing-tar host. cmdExists() is the same probe used elsewhere in install.
+  if (!cmdExists('tar')) {
+    throw new Error(
+      "tar is required to install Mover OS but was not found on PATH. " +
+      "Install tar and re-run (Git Bash and WSL both ship it; on bare Windows run `choco install tartool` " +
+      "or use the bsdtar bundled with Windows 10+ by adding C:\\\\Windows\\\\System32 to PATH)."
+    );
+  }
+  let pathsListing, verboseListing;
+  try {
+    pathsListing = execSync(`tar -tzf "${tarPath}"`, { encoding: 'utf8' });
+    verboseListing = execSync(`tar -tvzf "${tarPath}"`, { encoding: 'utf8' });
+  } catch (e) {
+    throw new Error(
+      `tar could not read the downloaded payload at ${tarPath}. ` +
+      "The download is likely corrupt or incomplete — delete that file and re-run. " +
+      `(tar reported: ${e.message})`
+    );
+  }
   const pathLines = pathsListing.split('\n').filter(Boolean);
   const verboseLines = verboseListing.split('\n').filter(Boolean);
   const badPaths = [];
@@ -988,6 +1057,41 @@ async function downloadPayload(key) {
   // Clean up tarball
   try { fs.unlinkSync(tarPath); } catch {}
 
+  // v4.7.9 (S5 ship-blocker): post-extract assert. A silently-truncated tarball
+  // can pass the listing/type checks above yet extract to nothing useful. If the
+  // canonical payload root (~/.mover/src/workflows) is absent after extraction,
+  // every downstream installer would copy from nonexistent dirs and the install
+  // would "succeed" while shipping no workflows. Fail loudly here instead.
+  const extractedWorkflows = path.join(moverDir, "src", "workflows");
+  if (!fs.existsSync(extractedWorkflows)) {
+    throw new Error(
+      `Payload extracted but ${extractedWorkflows} is missing — the download is corrupt or incomplete. ` +
+      `Delete ${path.join(moverDir, "payload.tar.gz")} and re-run.`
+    );
+  }
+  // Existence alone is too weak: a tarball carrying just an empty src/workflows/
+  // dir passes the check above, then installWorkflows() finds zero .md files and
+  // returns 0 commands while the install reports success — the exact silent-empty
+  // failure S5 exists to stop. Require at least one workflow .md to be present.
+  let extractedWfCount = 0;
+  try {
+    // Require a real .md FILE — not just any entry ending in ".md". A corrupt
+    // payload containing a directory literally named "x.md" would otherwise pass.
+    extractedWfCount = fs.readdirSync(extractedWorkflows, { withFileTypes: true })
+      .filter((d) => d.isFile() && d.name.endsWith(".md")).length;
+  } catch (e) {
+    throw new Error(
+      `Payload extracted but ${extractedWorkflows} is unreadable (${e.message}) — ` +
+      `the download is corrupt or incomplete. Delete ${path.join(moverDir, "payload.tar.gz")} and re-run.`
+    );
+  }
+  if (extractedWfCount === 0) {
+    throw new Error(
+      `Payload extracted but ${extractedWorkflows} contains no workflow (.md) files — ` +
+      `the download is corrupt or incomplete. Delete ${path.join(moverDir, "payload.tar.gz")} and re-run.`
+    );
+  }
+
   return moverDir;
 }
 
@@ -1026,8 +1130,12 @@ function loadCliUsage() {
 
 function recordCliUsage(cmd) {
   const cfgPath = path.join(os.homedir(), ".mover", "config.json");
+  // Do NOT create config.json just to log a usage counter (terra P2): a user
+  // with no install running a stray `moveros who` should leave zero trace.
+  // Usage tracking is for actual installs, which already have this file.
+  if (!fs.existsSync(cfgPath)) return;
   try {
-    const cfg = fs.existsSync(cfgPath) ? JSON.parse(fs.readFileSync(cfgPath, "utf8")) : {};
+    const cfg = JSON.parse(fs.readFileSync(cfgPath, "utf8"));
     if (!cfg.cli_usage) cfg.cli_usage = {};
     const entry = cfg.cli_usage[cmd] || { count: 0, last: 0 };
     entry.count++;
@@ -1052,7 +1160,11 @@ const CLI_COMMANDS = {
   update:    { desc: "Comprehensive update — agents, rules, skills", alias: ["-u"] },
   uninstall: { desc: "Remove Mover OS from vault and agents",     alias: [] },
   doctor:   { desc: "Health check across all installed agents",  alias: [] },
-  pulse:    { desc: "Terminal dashboard — energy, tasks, streaks",alias: [] },
+  pulse:    { desc: "Browser dashboard — Suggested Now, patterns, drift (use --terminal for TUI)",alias: ["dashboard"] },
+  open:     { desc: "Open the dashboard in your browser (starts it in the background if needed)", alias: [] },
+  shortcut: { desc: "Desktop launcher (double-clickable dashboard icon)", alias: [] },
+  menubar:  { desc: "Native macOS menu-bar status app (macOS only)",       alias: [] },
+  menu:     { desc: "Classic terminal launcher (install, update, doctor…)", alias: [] },
   // warm removed — hooks + rules + /morning already handle session priming
   capture:  { desc: "Quick capture — tasks, links, ideas",       alias: [] },
   who:      { desc: "Entity memory lookup",                      alias: [] },
@@ -1067,6 +1179,7 @@ const CLI_COMMANDS = {
   status:   { desc: "Full system state (vault, agents, version)",  alias: [] },
   help:     { desc: "Interactive guide to Mover OS",              alias: ["-h"] },
   test:     { desc: "Run integration tests (dev)",               alias: [], hidden: true },
+  inventory: { desc: "Bundle facts as JSON (docs are generated from this)", alias: [], hidden: true },
 };
 
 function parseArgs() {
@@ -1085,6 +1198,7 @@ function parseArgs() {
     if (a === "--json") { opts.json = true; continue; }
     if (a === "--quiet" || a === "-q") { opts.quiet = true; continue; }
     if (a === "--dry-run") { opts.dryRun = true; continue; }
+    if (a === "--no-open") { opts.noOpen = true; continue; }
     if (a === "--help" || a === "-h") {
       ln();
       ln(`  ${bold("moveros")} ${dim("— the Mover OS companion CLI")}`);
@@ -1104,9 +1218,10 @@ function parseArgs() {
       ln(`    --json          Structured JSON output (for status command)`);
       ln(`    --quiet, -q     Minimal output, one value per line`);
       ln(`    --dry-run       Show what would change without doing it`);
+      ln(`    --no-open       Skip the browser launch (automation / headless)`);
       ln(`    --update, -u    Quick update (backward compat)`);
       ln();
-      ln(`  ${dim("Run")} moveros ${dim("with no args for interactive menu")}`);
+      ln(`  ${dim("Run")} moveros ${dim("with no args to open the dashboard — installs on first run")}`);
       ln();
       process.exit(0);
     }
@@ -1333,6 +1448,157 @@ function savePristineCopy(category, srcFile, relPath) {
   fs.writeFileSync(destPath, content, "utf8");
 }
 
+// ── Update State Machine (journal) ──────────────────────────────────────────
+// One transactional, resumable record of an update run, shared by the CLI and
+// the /update workflow (sol part 10: CLI plus /update must be ONE state
+// machine, not a prose handoff). Stages: preflight, backup, stage, apply,
+// migrate, verify, stamp. The CLI owns the mechanical stages (through apply,
+// plus verify+stamp on --quick where there is no AI migration); the /update
+// workflow owns migrate and finishes with `moveros update --finalize`, which
+// verifies the applied files and stamps the version ONLY on a pass. Every
+// stage is idempotent: after a crash at any point, re-running `moveros update`
+// resumes (the journal keeps the ORIGINAL backup dir, so rollback always
+// points at the true pre-update state, never a mid-update snapshot).
+const UPDATE_STAGES = ["preflight", "backup", "stage", "apply", "migrate", "verify", "stamp"];
+
+function updateJournalPath() {
+  return path.join(os.homedir(), ".mover", "update-state.json");
+}
+
+function loadUpdateJournal() {
+  try { return JSON.parse(fs.readFileSync(updateJournalPath(), "utf8")); } catch { return null; }
+}
+
+function saveUpdateJournal(journal) {
+  const p = updateJournalPath();
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  journal.updatedAt = new Date().toISOString();
+  // Atomic same-dir temp+rename: a crash mid-save leaves the old journal
+  // intact, never a torn one (same discipline as linkOrCopy's F6 fix).
+  const tmp = p + ".tmp-" + process.pid;
+  fs.writeFileSync(tmp, JSON.stringify(journal, null, 2), "utf8");
+  fs.renameSync(tmp, p);
+}
+
+function newUpdateJournal(mode, fromVersion, toVersion, vaultPath) {
+  const stages = {};
+  for (const s of UPDATE_STAGES) stages[s] = { status: "pending" };
+  return {
+    runId: `upd-${new Date().toISOString().replace(/[:.]/g, "-")}-${Math.random().toString(36).slice(2, 8)}`,
+    mode,
+    fromVersion: fromVersion || null,
+    toVersion,
+    vaultPath,
+    startedAt: new Date().toISOString(),
+    completedAt: null,
+    stages,
+  };
+}
+
+function journalStage(journal, name, status, extra) {
+  journal.stages[name] = { ...(journal.stages[name] || {}), ...(extra || {}), status, at: new Date().toISOString() };
+  saveUpdateJournal(journal);
+}
+
+// Deterministic crash injection for the update-machine tests: kills THIS
+// process at a named stage boundary so crash-at-each-stage recoverability is
+// provable, not timing-dependent. Inert unless MOVER_TEST_CRASH_STAGE is set.
+function maybeCrashForTest(stage) {
+  if (process.env.MOVER_TEST_CRASH_STAGE === stage) process.kill(process.pid, "SIGKILL");
+}
+
+// ── Verify stage ─────────────────────────────────────────────────────────────
+// The version stamp is a claim ("this install IS at version X"); verify makes
+// the claim earned, not assumed. Re-classify every workflow and template
+// against the saved manifest and fail on any state where upstream content is
+// missing from disk (install / safe-overwrite / legacy-overwrite) or a
+// conflict is unresolved. PASS states: "skip" (current) and "user-only-skip"
+// (a deliberate user customization, respected by design; transformed workflows
+// land here too because the pristine base is the raw source). Hooks are
+// Mover-owned and force-synced, so when a Claude hooks dir exists every bundle
+// hook must be present with matching content.
+// options.templates: "content" (full three-way check, interactive/finalize) or
+// "presence" (file exists; quick mode does not force-overwrite vault scaffold
+// files, so content drift there is not a quick-mode failure).
+function verifyUpdateApplied(bundleDir, vaultPath, options = {}) {
+  const templatesMode = options.templates || "content";
+  const failures = [];
+  const home = os.homedir();
+
+  // Unresolved conflicts block the stamp outright.
+  const conflictsPath = path.join(home, ".mover", "conflicts.json");
+  if (fs.existsSync(conflictsPath)) {
+    try {
+      const data = JSON.parse(fs.readFileSync(conflictsPath, "utf8"));
+      for (const f of data.files || []) failures.push({ file: f.file, reason: "unresolved-conflict" });
+    } catch {
+      failures.push({ file: "conflicts.json", reason: "unreadable" });
+    }
+  }
+
+  const manifest = loadUpdateManifest();
+  const FAIL_ACTIONS = new Set(["install", "safe-overwrite", "legacy-overwrite", "conflict"]);
+
+  const wfSrcDir = path.join(bundleDir, "src", "workflows");
+  const wfDestDir = path.join(home, ".claude", "commands");
+  if (fs.existsSync(wfSrcDir) && fs.existsSync(wfDestDir)) {
+    for (const file of fs.readdirSync(wfSrcDir).filter((f) => f.endsWith(".md"))) {
+      const destFile = path.join(wfDestDir, file);
+      if (file === "update.md") {
+        // Force-synced with a transform on every update; presence + non-empty
+        // is its contract, not hash equality.
+        try {
+          if (fs.statSync(destFile).size === 0) failures.push({ file: "workflows/update.md", reason: "empty" });
+        } catch {
+          failures.push({ file: "workflows/update.md", reason: "missing" });
+        }
+        continue;
+      }
+      const r = compareForUpdate("workflows", path.join(wfSrcDir, file), destFile, manifest);
+      if (FAIL_ACTIONS.has(r.action)) failures.push({ file: `workflows/${file}`, reason: r.action });
+    }
+  }
+
+  const tmplSrcDir = path.join(bundleDir, "src", "structure");
+  if (fs.existsSync(tmplSrcDir) && vaultPath) {
+    const walk = (dir, rel) => {
+      for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const srcPath = path.join(dir, entry.name);
+        const entryRel = path.join(rel, entry.name);
+        if (entry.isDirectory()) { walk(srcPath, entryRel); continue; }
+        const relNorm = entryRel.replace(/\\/g, "/");
+        // Engine files are user data; never verified against templates.
+        if (relNorm.includes("02_Areas") && relNorm.includes("Engine")) continue;
+        const destFile = path.join(vaultPath, entryRel);
+        if (templatesMode === "presence") {
+          if (!fs.existsSync(destFile)) failures.push({ file: `templates/${relNorm}`, reason: "missing" });
+          continue;
+        }
+        const r = compareForUpdate("templates", srcPath, destFile, manifest, relNorm);
+        if (FAIL_ACTIONS.has(r.action)) failures.push({ file: `templates/${relNorm}`, reason: r.action });
+      }
+    };
+    walk(tmplSrcDir, "");
+  }
+
+  // Hooks: force-synced, Mover-owned. Only checked when a Claude hooks dir
+  // exists (a cursor-only install has no ~/.claude/hooks and owes none).
+  const hooksSrcDir = path.join(bundleDir, "src", "hooks");
+  const hooksDestDir = path.join(home, ".claude", "hooks");
+  if (fs.existsSync(hooksSrcDir) && fs.existsSync(hooksDestDir)) {
+    for (const f of fs.readdirSync(hooksSrcDir).filter((x) => x.endsWith(".sh") || x.endsWith(".js") || x.endsWith(".md"))) {
+      const destFile = path.join(hooksDestDir, f);
+      if (!fs.existsSync(destFile)) {
+        failures.push({ file: `hooks/${f}`, reason: "missing" });
+      } else if (fileContentHash(destFile) !== fileContentHash(path.join(hooksSrcDir, f))) {
+        failures.push({ file: `hooks/${f}`, reason: "stale" });
+      }
+    }
+  }
+
+  return { ok: failures.length === 0, failures };
+}
+
 function compareForUpdate(category, srcFile, destFile, manifest, relPath) {
   const fileName = relPath ? `${category}/${relPath}` : `${category}/${path.basename(srcFile)}`;
   const newHash = fileContentHash(srcFile);
@@ -1516,11 +1782,28 @@ function autoBackupBeforeUpdate(changes, selectedAgentIds, vaultPath) {
   const backupRoot = path.join(home, ".mover", "backups", `pre-update-${ts}`);
   let backed = 0;
 
+  // Rollback manifest: every entry records the ABSOLUTE original path plus
+  // whether the file existed before the update. `moveros update --rollback`
+  // replays it: existedBefore -> restore bytes; created-by-update -> remove.
+  // This is the npm-correct rollback target (vault + agent artifacts), never a
+  // git checkout of the bundle dir, which on npm installs is a read-only
+  // global package (sol part 10: rollback assumptions vs npm installs).
+  const entries = [];
+
   const backup = (src, relPath) => {
     if (!fs.existsSync(src)) return;
     const dest = path.join(backupRoot, relPath);
     fs.mkdirSync(path.dirname(dest), { recursive: true });
-    try { fs.copyFileSync(src, dest); backed++; } catch {}
+    try {
+      fs.copyFileSync(src, dest);
+      backed++;
+      entries.push({ original: src, backup: relPath, existedBefore: true });
+    } catch {}
+  };
+  // A file the update will CREATE: nothing to copy, but rollback must remove it.
+  const willCreate = (dest) => {
+    if (fs.existsSync(dest)) return;
+    entries.push({ original: dest, backup: null, existedBefore: false });
   };
 
   // Workflows
@@ -1534,12 +1817,18 @@ function autoBackupBeforeUpdate(changes, selectedAgentIds, vaultPath) {
       backup(path.join(dir, f.file), path.join("workflows", path.basename(dir), f.file));
     }
   }
+  for (const f of changes.workflows.filter((x) => x.status === "new")) {
+    for (const dir of wfDests) willCreate(path.join(dir, f.file));
+  }
 
   // Hooks
   if (targetIds.includes("claude-code")) {
     for (const f of changes.hooks.filter((x) => x.status === "changed")) {
       backup(path.join(home, ".claude", "hooks", f.file), path.join("hooks", f.file));
     }
+    for (const f of changes.hooks.filter((x) => x.status === "new")) {
+      willCreate(path.join(home, ".claude", "hooks", f.file));
+    }
   }
 
   // Rules
@@ -1572,17 +1861,45 @@ function autoBackupBeforeUpdate(changes, selectedAgentIds, vaultPath) {
   // Statusline
   if (changes.statusline === "changed" && targetIds.includes("claude-code")) {
     backup(path.join(home, ".claude", "statusline.js"), "statusline.js");
+  } else if (changes.statusline === "new" && targetIds.includes("claude-code")) {
+    willCreate(path.join(home, ".claude", "statusline.js"));
   }
 
   // Templates
   for (const f of changes.templates.filter((x) => x.status === "changed")) {
     backup(path.join(vaultPath, f.file), path.join("templates", f.file));
   }
+  for (const f of changes.templates.filter((x) => x.status === "new")) {
+    willCreate(path.join(vaultPath, f.file));
+  }
+
+  // ~/.mover state that the apply stage rewrites: the update manifest and the
+  // pristine base snapshots. Without these, rolled-back files would be
+  // classified against post-update bases and mis-read as user edits or
+  // conflicts on the next run. Text files only; cheap.
+  try {
+    const mfstPath = path.join(home, ".mover", "manifest.json");
+    if (fs.existsSync(mfstPath)) backup(mfstPath, path.join("mover-state", "manifest.json"));
+    const installedDir = path.join(home, ".mover", "installed");
+    if (fs.existsSync(installedDir)) {
+      fs.cpSync(installedDir, path.join(backupRoot, "mover-state", "installed"), { recursive: true });
+    }
+  } catch {}
+
+  // Write the rollback manifest LAST so its presence implies a complete backup.
+  try {
+    fs.mkdirSync(backupRoot, { recursive: true });
+    fs.writeFileSync(path.join(backupRoot, "backup-manifest.json"), JSON.stringify({
+      createdAt: new Date().toISOString(),
+      vaultPath,
+      entries,
+    }, null, 2), "utf8");
+  } catch {}
 
   if (backed > 0) {
     statusLine("ok", "Auto-backup", `${backed} files → ${dim(backupRoot)}`);
   }
-  return backed;
+  return { backupRoot, backed };
 }
 
 function countChanges(changes) {
@@ -1689,6 +2006,19 @@ async function runUninstall(vaultPath) {
 
   const home = os.homedir();
 
+  // terra uninstall F3: only touch VAULT-relative artifacts (AGENTS.md, SOUL.md,
+  // .clinerules, .roo/skills, the PARA structure) when the vault is a REAL Mover
+  // install. resolveVaultPath trusts an explicit --vault without existsSync, so a
+  // typo'd/wrong/stale path could otherwise delete an unrelated project's files.
+  // isInstalledVault is stricter than the old inline stat (it also rejects
+  // an EMPTY marker file) — for a destructive command, stricter is safer.
+  const vaultOwned = isInstalledVault(vaultPath);
+
+  // terra uninstall F1: uninstall is DESTRUCTIVE (it removes agent commands/hooks/
+  // skills, some of which live in shared dirs). A piped/non-TTY run must NOT
+  // silently auto-select and delete — require an explicit confirmation flag.
+  const uninstallConfirmed = process.argv.includes("--yes") || process.argv.includes("--confirm") || process.env.MOVER_UNINSTALL_YES === "1";
+
   // ── Build category map (only include categories that actually exist on disk) ──
   const categories = [];
 
@@ -1700,7 +2030,7 @@ async function runUninstall(vaultPath) {
     { label: "Codex instructions", path: path.join(home, ".codex", "instructions.md") },
     { label: "Windsurf rules", path: path.join(home, ".windsurfrules") },
   ];
-  if (vaultPath) {
+  if (vaultOwned) {
     rulesPaths.push(
       { label: "AGENTS.md", path: path.join(vaultPath, "AGENTS.md") },
       { label: "SOUL.md", path: path.join(vaultPath, "SOUL.md") },
@@ -1728,30 +2058,88 @@ async function runUninstall(vaultPath) {
     { label: "Windsurf skills (legacy)", path: path.join(home, ".windsurf", "skills"), dir: true },
     { label: "Windsurf skills", path: path.join(home, ".codeium", "windsurf", "skills"), dir: true },
     { label: "Cline skills", path: path.join(home, ".cline", "skills"), dir: true },
-    { label: "Roo Code skills (vault-relative)", path: vaultPath && path.join(vaultPath, ".roo", "skills"), dir: true },
+    { label: "Roo Code skills (vault-relative)", path: vaultOwned && path.join(vaultPath, ".roo", "skills"), dir: true },
     { label: "Cross-agent shared skills", path: path.join(home, ".agents", "skills"), dir: true },
   ].filter(p => p.path);
   const skillsExist = skillsPaths.some(p => fs.existsSync(p.path));
   if (skillsExist) categories.push({ id: "skills", name: "Skills", description: "61 curated skill packs", items: skillsPaths });
 
+  // sol #2 (Installer-to-10): commands and hooks live in SHARED agent dirs that can
+  // also hold the user's OWN files (a hand-written slash command, a personal hook).
+  // Uninstall must remove only what Mover installed, never a co-resident user file.
+  // The running installer ships its own source tree, so its basenames ARE the
+  // ownership manifest — precise and always available. Union with the on-disk
+  // install manifest so files renamed away from the current bundle (but still
+  // installed from an older version) are also reclaimed.
+  const moverOwnedNames = (kind) => {
+    const names = new Set();
+    try {
+      const dir = path.join(__dirname, "src", kind === "commands" ? "workflows" : "hooks");
+      for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+        if (!e.isFile()) continue;
+        if (kind === "commands" && !e.name.endsWith(".md")) continue;
+        names.add(e.name);
+      }
+    } catch { /* bundle source unavailable — manifest below may still populate */ }
+    try {
+      const man = JSON.parse(fs.readFileSync(path.join(home, ".mover", "manifest.json"), "utf8"));
+      for (const k of Object.keys((man && man.files) || {})) {
+        const seg = String(k).split("/");
+        const base = seg.pop();
+        const prefix = seg[0] || "";
+        if (!base) continue;
+        // Only union keys whose prefix matches the kind, so a hook name can never
+        // leak into the command owned-set (or vice versa). A flat manifest (no
+        // prefix) contributes nothing here; bundle enumeration already covers it.
+        if (kind === "commands" && (prefix === "workflows" || prefix === "commands") && base.endsWith(".md")) names.add(base);
+        if (kind === "hooks" && prefix === "hooks") names.add(base);
+      }
+    } catch { /* no manifest / unreadable — bundle enumeration stands alone */ }
+    return names;
+  };
+  const ownedCommandNames = moverOwnedNames("commands");
+  const ownedHookNames = moverOwnedNames("hooks");
+
   // Commands / Workflows
   const commandsPaths = [
-    { label: "Claude Code commands", path: path.join(home, ".claude", "commands"), dir: true },
-    { label: "Cursor commands", path: path.join(home, ".cursor", "commands"), dir: true },
-    { label: "Antigravity workflows", path: path.join(home, ".gemini", "antigravity", "global_workflows"), dir: true },
+    { label: "Claude Code commands", path: path.join(home, ".claude", "commands"), dir: true, ownedNames: ownedCommandNames },
+    { label: "Cursor commands", path: path.join(home, ".cursor", "commands"), dir: true, ownedNames: ownedCommandNames },
+    { label: "Antigravity workflows", path: path.join(home, ".gemini", "antigravity", "global_workflows"), dir: true, ownedNames: ownedCommandNames },
   ];
   const commandsExist = commandsPaths.some(p => fs.existsSync(p.path));
   if (commandsExist) categories.push({ id: "commands", name: "Commands & Workflows", description: "22 slash commands / workflows", items: commandsPaths });
 
   // Hooks
   const hooksPaths = [
-    { label: "Claude Code hooks", path: path.join(home, ".claude", "hooks"), dir: true },
+    { label: "Claude Code hooks", path: path.join(home, ".claude", "hooks"), dir: true, ownedNames: ownedHookNames },
   ];
   const hooksExist = hooksPaths.some(p => fs.existsSync(p.path));
   if (hooksExist) categories.push({ id: "hooks", name: "Hooks", description: "6 Claude Code lifecycle hooks", items: hooksPaths });
 
+  // Desktop launcher (Mover Studio shortcut) — previously orphaned on uninstall
+  // (terra 2026-07-11): the .app/symlink/.desktop/.lnk that `moveros shortcut`
+  // and the onboarding checkbox create were never listed here, so they lingered
+  // after uninstall. Reuse the same name logic the creator uses.
+  try {
+    const { studioName, fileSafeName } = require("./src/dashboard/shortcut");
+    let scCfg = {};
+    try { scCfg = JSON.parse(fs.readFileSync(path.join(home, ".mover", "config.json"), "utf8")); } catch {}
+    const fname = fileSafeName(studioName(scCfg));
+    const shortcutPaths = [
+      { label: "macOS app (~/Applications)", path: path.join(home, "Applications", `${fname}.app`), dir: true },
+      { label: "macOS Desktop link", path: path.join(home, "Desktop", `${fname}.app`) },
+      { label: "Linux app entry", path: path.join(home, ".local", "share", "applications", "mover-studio.desktop") },
+      { label: "Linux Desktop entry", path: path.join(home, "Desktop", `${fname}.desktop`) },
+      { label: "Windows launcher (.bat)", path: path.join(home, ".mover", "launcher", `${fname}.bat`) },
+      { label: "Windows Desktop shortcut", path: path.join(home, "Desktop", `${fname}.lnk`) },
+      { label: "Windows Desktop .bat fallback", path: path.join(home, "Desktop", `${fname}.bat`) },
+    ];
+    const shortcutExist = shortcutPaths.some(p => { try { return fs.lstatSync(p.path) && true; } catch { return false; } });
+    if (shortcutExist) categories.push({ id: "shortcut", name: "Desktop launcher", description: "Mover Studio app / desktop shortcut", items: shortcutPaths });
+  } catch { /* shortcut module unavailable — skip this category */ }
+
   // Vault structure (only if vault has Mover OS structure)
-  if (vaultPath) {
+  if (vaultOwned) {
     const vaultStructurePaths = [
       { label: "00_Inbox/", path: path.join(vaultPath, "00_Inbox"), dir: true },
       { label: "01_Projects/", path: path.join(vaultPath, "01_Projects"), dir: true },
@@ -1765,7 +2153,7 @@ async function runUninstall(vaultPath) {
   }
 
   // Mover OS source folder (if cloned into vault)
-  if (vaultPath) {
+  if (vaultOwned) {
     const moverBundlePath = path.join(vaultPath, "01_Projects", "Mover OS Bundle");
     if (fs.existsSync(moverBundlePath)) {
       categories.push({ id: "bundle", name: "Mover OS Bundle", description: "01_Projects/Mover OS Bundle/ source folder", items: [
@@ -1774,16 +2162,18 @@ async function runUninstall(vaultPath) {
     }
   }
 
-  // Config files
+  // Config files. ONLY files Mover itself created: {vault}/.claude/settings.json
+  // is Claude Code's (or the user's) project config — Mover never writes it,
+  // so uninstall must never delete it (R5-A: default-selected category was
+  // silently removing a file we don't own).
   const configPaths = [];
   if (vaultPath) {
     configPaths.push(
       { label: ".mover-version", path: path.join(vaultPath, ".mover-version") },
-      { label: "Claude settings", path: path.join(vaultPath, ".claude", "settings.json") },
     );
   }
   const configExists = configPaths.some(p => fs.existsSync(p.path));
-  if (configExists) categories.push({ id: "config", name: "Config Files", description: ".mover-version, settings.json", items: configPaths });
+  if (configExists) categories.push({ id: "config", name: "Config Files", description: ".mover-version", items: configPaths });
 
   if (categories.length === 0) {
     barLn(dim("Nothing to remove — Mover OS not detected."));
@@ -1793,6 +2183,16 @@ async function runUninstall(vaultPath) {
   }
 
   // ── Multi-select: what to uninstall ──
+  // F1: in a non-TTY run interactiveSelect returns the pre-selected defaults with
+  // no human in the loop, silently deleting them (including shared agent dirs that
+  // may hold USER commands/hooks/skills). Refuse unless explicitly confirmed
+  // (--yes / --confirm / MOVER_UNINSTALL_YES=1).
+  if (!IS_TTY && !uninstallConfirmed) {
+    barLn(red("  Uninstall is destructive and this session is non-interactive."));
+    barLn(dim("  Re-run in a terminal, or pass --yes to remove the detected Mover OS components."));
+    outro("Uninstall cancelled.");
+    return;
+  }
   barLn(bold("What do you want to uninstall?"));
   barLn();
 
@@ -1842,15 +2242,50 @@ async function runUninstall(vaultPath) {
     const cat = categories.find(c => c.id === catId);
     if (!cat) continue;
     for (const item of cat.items) {
-      if (!fs.existsSync(item.path)) continue;
+      // lstat, not existsSync: existsSync FOLLOWS symlinks, so once a target is
+      // removed a dangling symlink (e.g. the Desktop .app pointing at the now-gone
+      // ~/Applications app) reads as non-existent and gets orphaned. lstat sees
+      // the link itself. (terra shortcut-orphan fix, 2026-07-11)
+      let lst = null;
+      try { lst = fs.lstatSync(item.path); } catch { lst = null; }
+      if (!lst) continue;
       try {
         if (item.dir) {
-          if (item.keepBuiltins) {
+          // terra uninstall F2: a SYMLINKED category root (e.g. ~/.claude/skills ->
+          // an external repo) must never be traversed — readdirSync would follow
+          // it and rmSync would delete the user's out-of-tree files. rmSync on the
+          // symlink itself removes only the link (recursive:true does NOT follow a
+          // final-component symlink for deletion). Skip a symlinked keepBuiltins
+          // root entirely (user-configured); remove a symlinked plain dir as a link.
+          if (lst.isSymbolicLink()) {
+            if (item.keepBuiltins) { continue; } // do not touch a user-symlinked skills root
+            fs.rmSync(item.path, { recursive: true, force: true }); // removes the link, not the target
+          } else if (item.keepBuiltins) {
             for (const entry of fs.readdirSync(item.path, { withFileTypes: true })) {
+              // Skip a symlinked child skill dir too — only remove real Mover skill dirs.
+              if (entry.isSymbolicLink()) continue;
               if (entry.isDirectory() && fs.existsSync(path.join(item.path, entry.name, "SKILL.md"))) {
                 fs.rmSync(path.join(item.path, entry.name), { recursive: true, force: true });
               }
             }
+          } else if (item.ownedNames) {
+            // sol #2: a SHARED command/hook dir — remove only Mover-installed
+            // entries, never a co-resident user file. If we could not determine
+            // Mover's file set, leave the dir untouched (orphaning Mover files is
+            // the safe failure direction; deleting the user's files is not).
+            if (item.ownedNames.size === 0) {
+              barLn(`${yellow("!")} ${dim(item.label + " — left in place (could not determine Mover's file list)")}`);
+              continue;
+            }
+            let userLeft = 0;
+            for (const entry of fs.readdirSync(item.path, { withFileTypes: true })) {
+              if (entry.isSymbolicLink()) { userLeft++; continue; } // never follow a link out of the dir
+              if (item.ownedNames.has(entry.name)) {
+                try { fs.rmSync(path.join(item.path, entry.name), { recursive: true, force: true }); }
+                catch { userLeft++; }
+              } else { userLeft++; }
+            }
+            if (userLeft === 0) { try { fs.rmdirSync(item.path); } catch {} } // dir held only Mover files
           } else {
             fs.rmSync(item.path, { recursive: true, force: true });
           }
@@ -1872,37 +2307,48 @@ async function runUninstall(vaultPath) {
         barLn(dim("Deactivating license..."));
         try {
           const https = require("https");
-          // v4.7.6: match activateKey's label scheme (machine_id) so deactivate
-          // actually frees the activation slot. v4.7.5 deactivated by hostname,
-          // which only worked if the user hadn't renamed their machine since
-          // install. Fallback: if machine_id read fails, try hostname (covers
-          // pre-v4.7.3 activations that stored hostname).
           const moverDir = path.join(os.homedir(), ".mover");
-          let label = os.hostname();
-          try { label = getMachineId(moverDir) || label; } catch {}
-          const body = JSON.stringify({ key: cfg.licenseKey, organization_id: POLAR_ORG_ID, label });
-          await new Promise((resolve, reject) => {
-            const req = https.request({
-              hostname: "api.polar.sh",
-              path: "/v1/customer-portal/license-keys/deactivate",
-              method: "POST",
-              headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) },
-              timeout: 10000,
-            }, (res) => {
-              let data = "";
-              res.on("data", (chunk) => data += chunk);
-              res.on("end", () => resolve(data));
+          const activationId = readActivationId(moverDir);
+          if (!activationId) {
+            barLn(dim("No saved activation ID. Open your Polar customer portal to free the device slot."));
+          } else {
+            const body = JSON.stringify({ key: cfg.licenseKey, organization_id: POLAR_ORG_ID, activation_id: activationId });
+            const result = await new Promise((resolve, reject) => {
+              const req = https.request({
+                hostname: "api.polar.sh",
+                path: "/v1/customer-portal/license-keys/deactivate",
+                method: "POST",
+                headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) },
+                timeout: 10000,
+              }, (res) => {
+                let data = "";
+                res.on("data", (chunk) => data += chunk);
+                res.on("end", () => resolve({ statusCode: res.statusCode, data }));
+              });
+              req.on("error", reject);
+              req.on("timeout", () => { req.destroy(); reject(new Error("Timeout")); });
+              req.write(body);
+              req.end();
             });
-            req.on("error", reject);
-            req.on("timeout", () => { req.destroy(); reject(new Error("Timeout")); });
-            req.write(body);
-            req.end();
-          });
-          barLn(`${green("\u2713")} ${dim("License deactivated — activation slot freed")}`);
+            if (result.statusCode === 204) {
+              try { fs.unlinkSync(path.join(moverDir, ".activation-id")); } catch {}
+              barLn(`${green("\u2713")} ${dim("License deactivated - activation slot freed")}`);
+            } else {
+              barLn(dim(`Polar did not deactivate this device (HTTP ${result.statusCode}). Open your customer portal to free the slot.`));
+            }
+          }
         } catch {
-          barLn(`${dim("Could not reach Polar — license not deactivated")}`);
+          barLn(`${dim("Could not reach Polar - license not deactivated")}`);
         }
       }
+      // terra uninstall F5: reducing the config to just the license key silently
+      // discards the user's settings (review_day, osName, cli_usage history). Save
+      // a full copy first so a reinstall can recover their personalization.
+      try {
+        const bak = configPath + ".pre-uninstall-bak";
+        fs.copyFileSync(configPath, bak);
+        barLn(`${green("\u2713")} ${dim("~/.mover/config.json.pre-uninstall-bak (settings saved)")}`);
+      } catch {}
       // Remove config file but preserve license key for reinstall
       if (cfg.licenseKey) {
         fs.writeFileSync(configPath, JSON.stringify({ licenseKey: cfg.licenseKey }, null, 2), "utf8");
@@ -1947,7 +2393,9 @@ const AGENT_REGISTRY = {
   "claude-code": {
     name: "Claude Code",
     tier: "full",
-    tierDesc: "Rules, 23 commands, skills, 6 hooks",
+    // No counts in tierDesc strings — they rot (this one said "23 commands, 6
+    // hooks" while the product shipped 25/18). docs-generated.test.mjs guards.
+    tierDesc: "Rules, commands, skills, hooks",
     detect: () => cmdExists("claude") || fs.existsSync(path.join(H, ".claude")),
     rules: { type: "link", dest: () => path.join(H, ".claude", "CLAUDE.md"), header: "# Mover OS Global Rules" },
     skills: { dest: () => path.join(H, ".claude", "skills") },
@@ -1972,7 +2420,7 @@ const AGENT_REGISTRY = {
   "cline": {
     name: "Cline",
     tier: "full",
-    tierDesc: "Rules, skills, hooks",
+    tierDesc: "Rules, skills",
     detect: () => globDirExists(path.join(H, ".vscode", "extensions"), "saoudrizwan.claude-dev-*"),
     rules: { type: "copy", dest: (vault) => path.join(vault || ".", ".clinerules", "mover-os.md") },
     skills: { dest: (vault) => path.join(vault || ".", ".cline", "skills") },
@@ -2017,7 +2465,7 @@ const AGENT_REGISTRY = {
   "amazon-q": {
     name: "Amazon Q Developer",
     tier: "full",
-    tierDesc: "Rules, JSON agent commands, hooks",
+    tierDesc: "Rules, JSON agent commands",
     detect: () => cmdExists("q") || fs.existsSync(path.join(H, ".aws", "amazonq")),
     rules: { type: "copy", dest: (vault) => path.join(vault || ".", ".amazonq", "rules", "mover-os.md") },
     skills: null,
@@ -2027,18 +2475,22 @@ const AGENT_REGISTRY = {
   "opencode": {
     name: "OpenCode",
     tier: "full",
-    tierDesc: "AGENTS.md, agents, commands",
+    tierDesc: "AGENTS.md, skills",
     detect: () => cmdExists("opencode") || fs.existsSync(path.join(".", "opencode.json")),
     sharedRulesFile: "agents-md",
     rules: { type: "agents-md", dest: (vault) => path.join(vault || ".", "AGENTS.md") },
     skills: { dest: (vault) => path.join(vault || ".", ".opencode", "skills") },
-    commands: { format: "opencode-json", dest: (vault) => path.join(vault || ".", "opencode.json") },
+    // The opencode-json command writer is a stub (installFromRegistry skips
+    // it: "requires config file merge logic"). Declared null so the docs,
+    // menus, and inventory can't sell commands that never install. Restore
+    // the field WITH the merge writer, together.
+    commands: null,
     hooks: null,
   },
   "kilo-code": {
     name: "Kilo Code",
     tier: "full",
-    tierDesc: "Rules, skills, commands, modes",
+    tierDesc: "Rules, skills, commands",
     detect: () => globDirExists(path.join(H, ".vscode", "extensions"), "kilocode.kilo-code-*"),
     rules: { type: "copy", dest: (vault) => path.join(vault || ".", ".kilocode", "rules", "mover-os.md") },
     skills: { dest: (vault) => path.join(vault || ".", ".kilocode", "skills") },
@@ -2050,7 +2502,7 @@ const AGENT_REGISTRY = {
   "codex": {
     name: "Codex",
     tier: "full",
-    tierDesc: "AGENTS.md, skills (skills = commands), 5 hooks",
+    tierDesc: "AGENTS.md, skills (skills = commands), hooks",
     detect: () => cmdExists("codex") || fs.existsSync(path.join(H, ".codex")),
     rules: { type: "agents-md", dest: () => path.join(H, ".codex", "AGENTS.md") },
     skills: { dest: () => path.join(H, ".codex", "skills") },
@@ -2177,15 +2629,46 @@ function globDirExists(dir, pattern) {
 }
 
 let linkFallbackWarned = false;
+// Back up a rules/instructions file we are about to overwrite when it was NOT
+// authored by Mover (no Mover signature in the content) — a user's own
+// AGENTS.md / copilot-instructions.md / CLAUDE.md must never be silently
+// destroyed (R5-A). The .bak is written once: repeated installs never
+// overwrite the original backup with Mover's own content.
+function backupForeignFile(filePath) {
+  try {
+    if (!fs.existsSync(filePath)) return false;
+    const content = fs.readFileSync(filePath, "utf8");
+    if (!content.trim()) return false;
+    const moverAuthored = /Mover OS|MOVER_OS_RULES|## My Customizations/.test(content);
+    if (moverAuthored) return false;
+    const bak = filePath + ".bak";
+    if (!fs.existsSync(bak)) {
+      fs.copyFileSync(filePath, bak);
+      console.log(`  ${dim(`Existing ${path.basename(filePath)} backed up to ${path.basename(bak)}`)}`);
+    }
+    return true;
+  } catch { return false; }
+}
+
 function linkOrCopy(src, dest) {
+  // Atomic replace: stage into a same-directory temp name, then rename over the
+  // destination. rename(2) within one directory is atomic, so a kill/power-loss
+  // mid-operation leaves the ORIGINAL dest intact. The old unlink-then-link left
+  // a window where dest did not exist and the command file went missing (terra
+  // F6). The temp link shares src's inode, so the hard-link architecture holds.
+  const tmp = `${dest}.mover-tmp-${process.pid}`;
   try {
     fs.mkdirSync(path.dirname(dest), { recursive: true });
-    if (fs.existsSync(dest)) fs.unlinkSync(dest);
-    fs.linkSync(src, dest);
+    if (fs.existsSync(dest)) backupForeignFile(dest);
+    try { if (fs.existsSync(tmp)) fs.unlinkSync(tmp); } catch {}
+    fs.linkSync(src, tmp);
+    fs.renameSync(tmp, dest);
     return "linked";
   } catch {
+    try { if (fs.existsSync(tmp)) fs.unlinkSync(tmp); } catch {}
     try {
-      fs.copyFileSync(src, dest);
+      fs.copyFileSync(src, tmp);
+      fs.renameSync(tmp, dest);
       if (!linkFallbackWarned) {
         console.log(`\n  ${dim("Note: Hard links unavailable — using copies. Edits won't auto-propagate.")}`);
         console.log(`  ${dim("Run link.sh after editing source files to re-sync.")}\n`);
@@ -2193,6 +2676,7 @@ function linkOrCopy(src, dest) {
       }
       return "copied";
     } catch {
+      try { if (fs.existsSync(tmp)) fs.unlinkSync(tmp); } catch {}
       return null;
     }
   }
@@ -2381,9 +2865,11 @@ Stuck: /debug-resistance
 // ─── Claude Code hooks (settings.json) ──────────────────────────────────────
 // ─── Codex hook config generator ────────────────────────────────────────────
 // v4.7.5: Codex hooks invoked through mover-hook-adapter.js for schema
-// translation. MVP scope: session-start, engine-protection, git-safety,
-// plan-sync-reminder, dirty-tree-guard (no session-log-reminder under Codex
-// — that script is Claude-transcript-specific).
+// translation.
+//
+// v4.7.8: expanded coverage — was 5 hooks across 4 events, now 13 hooks across
+// 5 events. Brings Codex to Claude Code parity on every event Codex supports.
+// PermissionRequest deferred until adapter handles nested decision schema.
 //
 // IMPORTANT: Codex runs hook commands through cmd.exe on Windows, which does
 // NOT expand $HOME. We resolve absolute paths at install time so the same
@@ -2413,6 +2899,28 @@ function generateCodexHooks() {
                 command: `node ${adapter} codex SessionStart ${hookDir}/session-start.sh" resume`,
                 timeout: 15,
               },
+              {
+                // v4.7.8: Engine Health surface on session boot — matches the
+                // PreCompact-equivalent hook Claude Code runs.
+                type: "command",
+                command: `node ${adapter} codex SessionStart ${hookDir}/engine-health.sh" full`,
+                timeout: 15,
+              },
+            ],
+          },
+        ],
+        // v4.7.8 NEW: per-prompt enforcement (Single Test reminder, friction floor)
+        UserPromptSubmit: [
+          {
+            hooks: [
+              {
+                type: "command",
+                command: `node ${adapter} codex UserPromptSubmit ${hookDir}/user-prompt-enforce.sh"`,
+                // v4.7.8 audit fix: 4s undercut adapter's 4500ms fallback (mover-hook-adapter.js:65),
+                // host would SIGTERM adapter before its internal timeout fired. 5s gives the
+                // adapter room to surface its own timeout error cleanly.
+                timeout: 5,
+              },
             ],
           },
         ],
@@ -2433,6 +2941,32 @@ function generateCodexHooks() {
               {
                 type: "command",
                 command: `node ${adapter} codex PreToolUse ${hookDir}/engine-protection.sh"`,
+                // Packet #2 rider (dev/plan.md T-PACKET2-RIDER-1): approval
+                // wait budget. This is a CEILING, not a delay: the adapter
+                // answers in milliseconds on every write, except during a
+                // real dashboard-approval wait (MOVER_STUDIO_RUN=1 + live
+                // daemon), where it blocks up to 45s for a human yes/no in
+                // Mover Studio before failing closed to deny. 60s = 45s wait
+                // + 4.5s bash-hook spawn + node startup + kill-precision margin.
+                timeout: 60,
+              },
+            ],
+          },
+        ],
+        // v4.7.8: PermissionRequest event. Schema verified against
+        // https://developers.openai.com/codex/hooks — Codex expects nested
+        // {decision:{behavior,message?}} shape, which engine-permission-request.sh
+        // already emits. Adapter (mover-hook-adapter.js v4.7.8) recognizes the
+        // shape via isPermissionBehavior and passes through with allowlisting.
+        // Strategy.md and Identity_Prime.md pass through to manual dialog;
+        // Daily Notes and non-Engine files auto-allow.
+        PermissionRequest: [
+          {
+            matcher: "Edit|Write|apply_patch",
+            hooks: [
+              {
+                type: "command",
+                command: `node ${adapter} codex PermissionRequest ${hookDir}/engine-permission-request.sh"`,
                 timeout: 5,
               },
             ],
@@ -2447,16 +2981,50 @@ function generateCodexHooks() {
                 command: `node ${adapter} codex PostToolUse ${hookDir}/plan-sync-reminder.sh"`,
                 timeout: 5,
               },
+              {
+                // v4.7.8: auto-commit Engine edits. Multi-agent safe via flock
+                // (see engine-auto-commit.sh:62-89). Silent on non-Engine files.
+                type: "command",
+                command: `node ${adapter} codex PostToolUse ${hookDir}/engine-auto-commit.sh"`,
+                timeout: 10,
+              },
             ],
           },
         ],
         Stop: [
           {
+            // v4.7.8: 6 sequential hooks. Order matters — cheap/important first
+            // so they complete before any per-event budget exhausts.
             hooks: [
               {
                 type: "command",
                 command: `node ${adapter} codex Stop ${hookDir}/dirty-tree-guard.sh"`,
-                timeout: 10,
+                timeout: 8,
+              },
+              {
+                type: "command",
+                command: `node ${adapter} codex Stop ${hookDir}/session-log-reminder.sh"`,
+                timeout: 8,
+              },
+              {
+                type: "command",
+                command: `node ${adapter} codex Stop ${hookDir}/context-staleness.sh"`,
+                timeout: 5,
+              },
+              {
+                type: "command",
+                command: `node ${adapter} codex Stop ${hookDir}/iteration-check.sh"`,
+                timeout: 5,
+              },
+              {
+                type: "command",
+                command: `node ${adapter} codex Stop ${hookDir}/engine-health.sh" summary`,
+                timeout: 8,
+              },
+              {
+                type: "command",
+                command: `node ${adapter} codex Stop ${hookDir}/clock.sh"`,
+                timeout: 2,
               },
             ],
           },
@@ -2505,7 +3073,13 @@ function generateGeminiHooks() {
             name: "mover-engine-protection",
             type: "command",
             command: `node ${adapter} gemini BeforeTool ${hookDir}/engine-protection.sh"`,
-            timeout: 5000,
+            // Packet #2 rider (dev/plan.md T-PACKET2-RIDER-1): approval wait
+            // budget, mirrors the Codex PreToolUse engine-protection entry.
+            // A ceiling, not a delay: the adapter answers in milliseconds
+            // except during a real dashboard-approval wait (MOVER_STUDIO_RUN=1
+            // + live daemon), where it blocks up to 45s for a human yes/no
+            // before failing closed to deny. Gemini timeouts are milliseconds.
+            timeout: 60000,
           },
         ],
       },
@@ -2550,64 +3124,121 @@ function generateGeminiHooks() {
 }
 
 function generateClaudeSettings() {
+  // v4.7.9 (S3 ship-blocker): resolve absolute, forward-slash hook paths at
+  // install time instead of the literal `$HOME`. On Windows, Claude Code runs
+  // Stop/PreToolUse hooks through cmd.exe, which does NOT expand `$HOME` — so
+  // `bash "$HOME/.claude/hooks/X.sh"` resolved to a nonexistent literal path
+  // and EVERY guardrail hook (engine-protection, git-safety, session-start…)
+  // was silently dead on Windows. This is the SAME fix already proven in
+  // generateCodexHooks/generateGeminiHooks (see comment above generateCodexHooks):
+  // forward slashes work for `bash` on macOS/Linux/Windows, and an absolute
+  // path removes the cmd.exe `$HOME` dependency. The settings-merge dedup
+  // (basename-based, see line ~3372) is unaffected because it compares the
+  // hook script basename, which is identical for `$HOME/...` and absolute paths.
+  const home = os.homedir();
+  const fwd = (p) => p.split(path.sep).join("/");
+  const hooksRoot = fwd(path.join(home, ".claude", "hooks"));
   return JSON.stringify(
     {
       hooks: {
-        Stop: [
+        // ── SessionStart ── full P0-P5 load on startup|clear|resume, volatile reload on
+        //    compact. engine-health runs AFTER session-start and self-dedups: on `full`,
+        //    session-start.sh emits the staleness summary INLINE and drops a fresh
+        //    `mover_health_emitted` marker, so the trailing engine-health.sh exits 0; on
+        //    compact/precompact there is no fresh full-marker so it emits. (See the dedup
+        //    guard in engine-health.sh — added with the inline emission in 95ed8b40.)
+        SessionStart: [
           {
+            matcher: "startup|clear|resume",
+            hooks: [
+              { type: "command", command: `bash "${hooksRoot}/session-start.sh" full`, timeout: 30 },
+              { type: "command", command: `bash "${hooksRoot}/engine-health.sh" full`, timeout: 20 },
+            ],
+          },
+          {
+            matcher: "compact",
             hooks: [
-              { type: "command", command: 'bash "$HOME/.claude/hooks/session-log-reminder.sh"', timeout: 10 },
-              { type: "command", command: 'bash "$HOME/.claude/hooks/dirty-tree-guard.sh"', timeout: 10 },
-              { type: "command", command: 'bash "$HOME/.claude/hooks/context-staleness.sh"', timeout: 5 },
+              { type: "command", command: `bash "${hooksRoot}/session-start.sh" volatile`, timeout: 15 },
+              { type: "command", command: `bash "${hooksRoot}/engine-health.sh" full`, timeout: 20 },
             ],
           },
         ],
+        // ── UserPromptSubmit ── per-prompt anti-drift enforcement (the [MOVER] status line).
+        //    memory-recall.sh / skill-recall.sh are DELIBERATELY NOT wired here: the memory
+        //    & recall engine ships DORMANT for new installs (opt-in). Do not "fix" this by
+        //    adding them — that absence is intentional, unlike user-prompt-enforce.sh which
+        //    was an oversight this generator missed when v4.7.8 added it (wired for Codex +
+        //    Gemini but not Claude). Reconciled in v4.8.0.
+        UserPromptSubmit: [
+          {
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/user-prompt-enforce.sh"`, timeout: 5 }],
+          },
+        ],
         PreToolUse: [
           {
             matcher: "Write|Edit",
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/engine-protection.sh"', timeout: 5 }],
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/engine-protection.sh"`, timeout: 5 }],
           },
           {
             matcher: "Bash",
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/git-safety.sh"', timeout: 5 }],
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/git-safety.sh"`, timeout: 5 }],
           },
         ],
         PostToolUse: [
           {
             matcher: "Write|Edit",
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/plan-sync-reminder.sh"', timeout: 5 }],
+            hooks: [
+              { type: "command", command: `bash "${hooksRoot}/plan-sync-reminder.sh"`, timeout: 5 },
+              { type: "command", command: `bash "${hooksRoot}/engine-auto-commit.sh"`, timeout: 10 },
+            ],
           },
         ],
-        PreCompact: [
+        Stop: [
           {
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/pre-compact-backup.sh"', timeout: 15 }],
+            hooks: [
+              { type: "command", command: `bash "${hooksRoot}/session-log-reminder.sh"`, timeout: 10 },
+              { type: "command", command: `bash "${hooksRoot}/dirty-tree-guard.sh"`, timeout: 10 },
+              { type: "command", command: `bash "${hooksRoot}/context-staleness.sh"`, timeout: 10 },
+              { type: "command", command: `bash "${hooksRoot}/iteration-check.sh"`, timeout: 10 },
+              { type: "command", command: `bash "${hooksRoot}/engine-health.sh" summary`, timeout: 10 },
+              { type: "command", command: `bash "${hooksRoot}/clock.sh"`, timeout: 2 },
+            ],
           },
         ],
-        SessionEnd: [
+        SubagentStart: [
           {
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/session-end.sh"', timeout: 10 }],
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/subagent-context.sh"`, timeout: 5 }],
           },
         ],
-        PermissionRequest: [
+        SubagentStop: [
           {
-            matcher: "Write|Edit",
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/engine-permission-request.sh"', timeout: 5 }],
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/subagent-validate.sh"`, timeout: 5 }],
           },
         ],
-        SessionStart: [
+        PreCompact: [
           {
-            matcher: "startup|clear",
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/session-start.sh" full', timeout: 5 }],
+            hooks: [
+              { type: "command", command: `bash "${hooksRoot}/pre-compact-backup.sh"`, timeout: 30 },
+              { type: "command", command: `bash "${hooksRoot}/engine-health.sh" full`, timeout: 10 },
+            ],
           },
+        ],
+        // SessionEnd: memory-index-session.js DELIBERATELY omitted (dormant memory engine).
+        SessionEnd: [
           {
-            matcher: "compact",
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/session-start.sh" volatile', timeout: 5 }],
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/session-end.sh"`, timeout: 10 }],
+          },
+        ],
+        PermissionRequest: [
+          {
+            matcher: "Write|Edit",
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/engine-permission-request.sh"`, timeout: 5 }],
           },
         ],
         ConfigChange: [
           {
             matcher: "user_settings",
-            hooks: [{ type: "command", command: 'bash "$HOME/.claude/hooks/config-guard.sh"', timeout: 5 }],
+            hooks: [{ type: "command", command: `bash "${hooksRoot}/config-guard.sh"`, timeout: 5 }],
           },
         ],
       },
@@ -2883,6 +3514,70 @@ function installTemplateFiles(bundleDir, vaultPath) {
   return { count, hashes };
 }
 
+// S1: install a single Markdown workflow to a Claude-style destination with the
+// config-first vault-resolution transform applied. Claude Code normally
+// hard-links workflows so editing src/ propagates live to ~/.claude/commands,
+// but the bare-git-rev-parse Pre-Flight block (see fixVaultResolution) must be
+// rewritten to a config-first resolver, and we MUST NOT mutate the shared inode.
+// So: if the body contains the bare block, write a transformed COPY (live-edit
+// hard-link is traded for a correct Pre-Flight on those files only); every other
+// workflow keeps the hard link. The transform is idempotent, so re-running is
+// safe. Shared by the fresh-install path (installWorkflows) AND the /update path
+// (direct update.md sync + smart-update loop) so updated workflows get the same
+// correct Pre-Flight as fresh installs.
+//
+// `presetContent` (optional): write/transform THIS string instead of reading
+// srcPath from disk — used by the smart-update conflict path, where the body to
+// install is an in-memory auto-merge result that may differ from the source file.
+//
+// Gap-3 fail-loud contract: if the body MATCHED the bare block (i.e. it NEEDS
+// the transform) we MUST emit the corrected copy. If reading/transforming throws
+// for a body that needs the fix, we DO NOT silently fall back to linkOrCopy
+// (which would ship the known-broken Pre-Flight) — the error propagates. Bodies
+// that don't match fall through safely: return false so the caller linkOrCopies.
+//
+// Returns true when a transformed copy was written; false when the file does not
+// need the transform and should be hard-linked/copied verbatim by the caller.
+function writeWorkflowTransformed(srcPath, destPath, presetContent) {
+  let raw;
+  if (presetContent !== undefined) {
+    raw = presetContent;
+  } else {
+    // A read failure on a real source file is a hard error: we cannot prove the
+    // file doesn't need the transform, so we must not silently linkOrCopy it.
+    raw = fs.readFileSync(srcPath, "utf8");
+  }
+  let fixed;
+  try {
+    fixed = fixVaultResolution(raw);
+  } catch (e) {
+    // Transform itself threw. If the body needs the fix, fail loud; else no-op.
+    if (workflowNeedsVaultFix(raw)) {
+      throw new Error(`Vault-resolution transform failed for ${path.basename(destPath)}: ${e.message}`);
+    }
+    return false;
+  }
+  if (fixed === raw) {
+    // No bare block (or already fixed). If preset content was supplied we still
+    // own the write; otherwise the caller hard-links/copies the source verbatim.
+    if (presetContent !== undefined) {
+      fs.mkdirSync(path.dirname(destPath), { recursive: true });
+      fs.writeFileSync(destPath, fixed, "utf8");
+      return true;
+    }
+    return false;
+  }
+  // Defensive: if the transform claims to have changed the body but the bare
+  // block somehow survives, refuse to ship it rather than emit a broken file.
+  if (workflowNeedsVaultFix(fixed)) {
+    throw new Error(`Vault-resolution transform did not remove the bare git-rev-parse block in ${path.basename(destPath)}`);
+  }
+  fs.mkdirSync(path.dirname(destPath), { recursive: true });
+  if (fs.existsSync(destPath)) fs.unlinkSync(destPath);
+  fs.writeFileSync(destPath, fixed, "utf8");
+  return true;
+}
+
 function installWorkflows(bundleDir, destDir, selectedWorkflows) {
   const srcDir = path.join(bundleDir, "src", "workflows");
   if (!fs.existsSync(srcDir)) return 0;
@@ -2892,8 +3587,14 @@ function installWorkflows(bundleDir, destDir, selectedWorkflows) {
   let count = 0;
   for (const file of srcFiles) {
     if (selectedWorkflows && !selectedWorkflows.has(file)) continue;
-    if (linkOrCopy(path.join(srcDir, file), path.join(destDir, file))) {
-      savePristineCopy("workflows", path.join(srcDir, file));
+    const srcPath = path.join(srcDir, file);
+    const destPath = path.join(destDir, file);
+    // Gap-3: writeWorkflowTransformed throws if a workflow that NEEDS the
+    // Pre-Flight fix fails to transform — we surface that instead of shipping
+    // the broken source via linkOrCopy. Only unmatched workflows fall through.
+    const wrote = writeWorkflowTransformed(srcPath, destPath);
+    if (wrote || linkOrCopy(srcPath, destPath)) {
+      savePristineCopy("workflows", srcPath);
       count++;
     }
   }
@@ -3059,6 +3760,49 @@ function parseWorkflowMd(filePath) {
   return { name, description, body, filePath };
 }
 
+// v4.7.9 (S1 ship-blocker): workflow Pre-Flight blocks resolve the vault root
+// with a bare `git rev-parse --show-toplevel`. A LIVE vault is NOT a git repo,
+// so that command exits non-zero and the agent never learns VAULT_ROOT — every
+// subsequent `{VAULT_ROOT}/...` read silently fails. The canonical resolution
+// (mirrored from resolveVaultPath) reads ~/.mover/config.json `vaultPath`
+// FIRST, then falls back to git, then walks up for 02_Areas/Engine. This
+// transform rewrites the bare fenced block at INSTALL time so we never mutate
+// the shared-inode source .md (Claude path uses copy-with-transform; the
+// converted agents already write copies). Idempotent: returns body unchanged
+// if the bare block isn't present (already fixed, or a workflow that doesn't
+// resolve the vault this way).
+const VAULT_RESOLVE_SNIPPET = [
+  "```bash",
+  "# Resolve VAULT_ROOT — config first (a live vault is NOT a git repo).",
+  'VAULT_ROOT="$(node -e \'try{console.log(JSON.parse(require("fs").readFileSync(require("os").homedir()+"/.mover/config.json","utf8")).vaultPath||"")}catch(e){}\' 2>/dev/null)"',
+  '[ -z "$VAULT_ROOT" ] && VAULT_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)"',
+  'if [ -z "$VAULT_ROOT" ]; then d="$PWD"; while [ "$d" != "/" ]; do [ -d "$d/02_Areas/Engine" ] && VAULT_ROOT="$d" && break; d="$(dirname "$d")"; done; fi',
+  'echo "$VAULT_ROOT"',
+  "```",
+].join("\n");
+
+// Match the exact bare Pre-Flight block:  ```bash\n git rev-parse --show-toplevel \n```
+// Tolerate surrounding blank lines / trailing whitespace inside the fence. Built
+// fresh on each call (no shared lastIndex) so .test() is stateless across callers.
+function bareVaultBlockRe() {
+  return /```bash\s*\n[ \t]*git rev-parse --show-toplevel[ \t]*\n```/;
+}
+
+// True when `body` still ships the bare git-rev-parse Pre-Flight block — i.e. it
+// NEEDS the config-first rewrite. Used by the install paths to decide between a
+// transformed copy and a verbatim hard-link, and to enforce the Gap-3 fail-loud
+// contract (a body that needs the fix must never ship untransformed).
+function workflowNeedsVaultFix(body) {
+  if (typeof body !== "string") return false;
+  return bareVaultBlockRe().test(body);
+}
+
+function fixVaultResolution(body) {
+  if (typeof body !== "string") return body;
+  if (!workflowNeedsVaultFix(body)) return body;
+  return body.replace(bareVaultBlockRe(), VAULT_RESOLVE_SNIPPET);
+}
+
 // Gemini CLI: .md → .toml
 function mdToToml(wf) {
   const desc = wf.description.replace(/"/g, '\\"');
@@ -3125,6 +3869,10 @@ function installWorkflowsConverted(bundleDir, destDir, format, selectedWorkflows
   for (const file of fs.readdirSync(srcDir).filter((f) => f.endsWith(".md"))) {
     if (selectedWorkflows && !selectedWorkflows.has(file)) continue;
     const wf = parseWorkflowMd(path.join(srcDir, file));
+    // S1: config-first vault resolution. Safe — these agents always get a
+    // freshly-written copy (no shared inode), so transforming the body here
+    // only changes the emitted file, never the source .md.
+    wf.body = fixVaultResolution(wf.body);
     const converted = conv.fn(wf);
     if (conv.dir) {
       // Directory-based output (e.g., Codex: morning/SKILL.md)
@@ -3196,7 +3944,22 @@ function installSkillPacks(bundleDir, destDir, selectedCategories) {
       continue;
     }
 
-    if (fs.existsSync(dest)) fs.rmSync(dest, { recursive: true, force: true });
+    // terra CLI F4: only recursively delete a same-named dir that Mover OS OWNS
+    // (its `.mover-installed` stamp, or a manifest entry). A user's custom skill
+    // that happens to share a bundled name must NOT be erased — park it at
+    // `.user-backup` first; if it can't be moved safely, skip rather than clobber.
+    if (fs.existsSync(dest)) {
+      const owned = fs.existsSync(path.join(dest, ".mover-installed")) || !!manifest.skills[skill.name];
+      if (owned) {
+        fs.rmSync(dest, { recursive: true, force: true });
+      } else {
+        const bak = `${dest}.user-backup`;
+        try {
+          if (fs.existsSync(bak)) fs.rmSync(bak, { recursive: true, force: true });
+          fs.renameSync(dest, bak);
+        } catch { continue; } // could not preserve the user's skill safely — do NOT delete it
+      }
+    }
     copyDirRecursive(skill.path, dest);
     // v4.7.6: stamp file proves Mover OS owns this skill. Used by orphan
     // cleanup below — only stamped skills are deletable on update. User-
@@ -3261,6 +4024,9 @@ function installHooksForClaude(bundleDir, vaultPath) {
     // Read, strip \r (CRLF→LF), write — prevents "command not found" on macOS/Linux
     const content = fs.readFileSync(path.join(hooksSrc, file), "utf8").replace(/\r\n/g, "\n").replace(/\r/g, "\n");
     fs.writeFileSync(dst, content, { mode: 0o755 });
+    // writeFileSync's mode only applies when the file is CREATED — a hook
+    // already on disk at 644 stayed 644 and was silently dead (R5-A).
+    try { fs.chmodSync(dst, 0o755); } catch {}
     savePristineCopy("hooks", path.join(hooksSrc, file));
     count++;
   }
@@ -3279,23 +4045,105 @@ function installHooksForClaude(bundleDir, vaultPath) {
     try {
       const existing = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
       if (!existing.hooks) existing.hooks = {};
-      // Merge each hook event (Stop, PreToolUse, PreCompact)
+
+      // Gap-3 (S3 update path): repair existing Windows-broken hook commands.
+      // A pre-v4.7.9 install wrote `bash "$HOME/.claude/hooks/X.sh" [args]` (the
+      // form cmd.exe can't expand). The basename-only dedup below treats that as
+      // "already present" and would neither add the corrected command NOR fix the
+      // old one — leaving the hook dead on Windows forever. So FIRST rewrite any
+      // existing command that targets one of OUR hook scripts via a $HOME/~/
+      // relative path into the exact absolute-forward-slash form generateClaudeSettings
+      // now emits (matched on the script + trailing-arg tail so the two
+      // session-start variants map to their correct full/volatile replacements).
+      // After rewriting in place, the dedup sees the new form and won't duplicate.
+      const canonicalCmds = [];
+      for (const entries of Object.values(newHooks)) {
+        for (const grp of entries) for (const h of grp.hooks) canonicalCmds.push(h.command);
+      }
+      // Normalized tail signature: `<script>.sh<rest>` with quotes stripped and
+      // backslashes normalized, so a QUOTED canonical command and an UNQUOTED (or
+      // backslash-pathed) old command map to the SAME key. `<rest>` keeps the
+      // trailing arg (` full` / ` volatile`) so the two session-start variants
+      // stay distinct. Matching on the basename (after the last slash, either
+      // direction) means $HOME / %USERPROFILE% / ~ / absolute prefixes all collapse
+      // to the same signature.
+      const tailSig = (cmd) => {
+        if (typeof cmd !== "string") return null;
+        const norm = cmd.replace(/["']/g, "").replace(/\\/g, "/");
+        const m = norm.match(/([^\/\s]+\.sh)(.*)$/);
+        return m ? (m[1] + m[2]).trim() : null;
+      };
+      const canonicalByTail = new Map();
+      for (const cmd of canonicalCmds) {
+        const t = tailSig(cmd);
+        if (t) canonicalByTail.set(t, cmd);
+      }
+      // An "old form" is a command pointing at a .claude/hooks/<script>.sh via a
+      // HOME-relative prefix ($HOME, %USERPROFILE%, or ~), in either slash
+      // direction, quoted or not. Absolute paths and non-Mover commands are NOT
+      // old forms (so they're left untouched).
+      const isOldHomeForm = (cmd) =>
+        typeof cmd === "string" &&
+        /\.claude[\\/]+hooks[\\/]+[^"\\/]*\.sh/.test(cmd) &&
+        /(\$HOME|\$\{HOME\}|%USERPROFILE%|(^|["'\s])~[\\/])/.test(cmd);
+      const rewriteCmd = (cmd) => {
+        if (!isOldHomeForm(cmd)) return cmd;
+        const t = tailSig(cmd);
+        const canon = t && canonicalByTail.get(t);
+        return canon || cmd; // only rewrite scripts we actually own/emit
+      };
+      for (const event of Object.keys(existing.hooks)) {
+        const groups = existing.hooks[event];
+        if (!Array.isArray(groups)) continue;
+        for (const grp of groups) {
+          if (!grp || !Array.isArray(grp.hooks)) continue;
+          for (const h of grp.hooks) {
+            if (h && typeof h.command === "string") h.command = rewriteCmd(h.command);
+          }
+        }
+      }
+
+      // Merge each hook event (Stop, PreToolUse, PreCompact).
+      // Dedup runs AFTER the old-form rewrite above, so a repaired command is now
+      // seen as present and is not re-added.
+      //
+      // v4.7.9: HOOK-LEVEL dedup keyed on a signature = script basename + trailing
+      // args (quotes stripped, slash direction normalized). Three fixes over the
+      // old basename-only check:
+      //   • Dedup per individual hook, not per group: a new group is appended with
+      //     only the hooks the event is MISSING. The old code (and an interim
+      //     group-level version) re-added an entire multi-hook group — e.g. Stop's
+      //     3 hooks — whenever any single hook was absent, duplicating the ones
+      //     already present.
+      //   • Include the trailing arg in the signature so `session-start.sh full`
+      //     and `session-start.sh volatile` are distinct (multi-group event safe).
+      //   • Strip ALL quotes from both sides so `…session-start.sh" full` matches
+      //     `session-start.sh full` (the old single-quote .replace left the needle
+      //     unmatchable → duplicates).
+      const cmdSig = (cmd) => {
+        if (typeof cmd !== "string") return "";
+        const m = cmd.match(/([^\\/"]+\.sh)("?.*)$/);
+        const tail = m ? m[1] + m[2] : cmd;
+        return tail.replace(/["']/g, "").replace(/\\/g, "/").trim();
+      };
       for (const [event, entries] of Object.entries(newHooks)) {
         if (!existing.hooks[event]) {
           existing.hooks[event] = entries;
         } else {
-          // Check if our hooks are already registered (by command substring).
-          // v4.7.6: split on both / and \\ so the basename extraction works on
-          // Windows where command paths use backslashes. The forward-slash-only
-          // split returned the entire command string on Windows, which never
-          // matched the substring check, leading to duplicate hooks accumulating
-          // on every install.
-          const existingCmds = JSON.stringify(existing.hooks[event]);
-          const alreadyHas = entries[0].hooks.every(
-            (h) => existingCmds.includes(h.command.split(/[\\/]/).pop().replace('"', ""))
-          );
-          if (!alreadyHas) {
-            existing.hooks[event].push(...entries);
+          const existingSigs = new Set();
+          for (const grp of existing.hooks[event]) {
+            if (grp && Array.isArray(grp.hooks)) for (const h of grp.hooks) existingSigs.add(cmdSig(h.command));
+          }
+          for (const grp of entries) {
+            // Keep only hooks whose signature isn't already registered for this event.
+            const missing = (grp.hooks || []).filter((h) => !existingSigs.has(cmdSig(h.command)));
+            if (missing.length === 0) continue; // every hook in this group already present
+            // Append a group carrying only the missing hooks (preserve matcher if any).
+            const toAdd = grp.matcher !== undefined
+              ? { matcher: grp.matcher, hooks: missing }
+              : { hooks: missing };
+            existing.hooks[event].push(toAdd);
+            for (const h of missing) existingSigs.add(cmdSig(h.command));
           }
         }
       }
@@ -3339,16 +4187,40 @@ function installHooksForClaude(bundleDir, vaultPath) {
   return count;
 }
 
-// ─── Multi-agent hook installer (v4.7.5) ────────────────────────────────────
-// Copies the MVP hook set (5 enforcement hooks + adapter + shared lib) to the
-// agent's hook directory and writes its hook config. Used by Codex and Gemini.
+// ─── Multi-agent hook installer (v4.7.5 + v4.7.8 expansion) ─────────────────
+// Copies the MVP hook set + adapter + shared lib to the agent's hook directory
+// and writes its hook config. Used by Codex and Gemini.
+//
+// v4.7.8: expanded from 5 → 12 hook scripts to bring Codex to Claude Code
+// parity on UserPromptSubmit (per-prompt anti-drift), PostToolUse
+// engine-auto-commit, and Stop multi-script coverage (session-log-reminder,
+// context-staleness, iteration-check, engine-health, clock).
+//
+// PermissionRequest deferred: engine-permission-request.sh emits a nested
+// decision shape that mover-hook-adapter.js:isValidOutput rejects. Wiring it
+// would silently drop the decision. Adapter extension required first.
 const MVP_HOOK_SCRIPTS = [
+  // SessionStart (2)
   "session-start.sh",
+  "engine-health.sh", // also fires under Stop
+  // UserPromptSubmit (1) — v4.7.8 NEW: per-prompt enforcement injection
+  "user-prompt-enforce.sh",
+  // PreToolUse (2)
   "engine-protection.sh",
   "git-safety.sh",
+  // PermissionRequest (1) — v4.7.8 NEW: nested decision-shape via adapter
+  "engine-permission-request.sh",
+  // PostToolUse (2)
   "plan-sync-reminder.sh",
+  "engine-auto-commit.sh", // v4.7.8 NEW: micro-commit Engine edits
+  // Stop (6) — v4.7.8 NEW: session-log-reminder, context-staleness, iteration-check, clock
   "dirty-tree-guard.sh",
-  "mover-lib.sh", // sourced by the others
+  "session-log-reminder.sh",
+  "context-staleness.sh",
+  "iteration-check.sh",
+  "clock.sh",
+  // Shared library (sourced by the others)
+  "mover-lib.sh",
 ];
 
 // Section-aware TOML upsert. Sets [section] key = value, preserving comments,
@@ -3435,6 +4307,9 @@ function copyMvpHooks(bundleDir, destDir) {
       .replace(/\r\n/g, "\n")
       .replace(/\r/g, "\n");
     fs.writeFileSync(dst, content, { mode: 0o755 });
+    // mode only applies on create — chmod so a pre-existing 644 copy
+    // becomes executable again (R5-A exec-bit fix).
+    try { fs.chmodSync(dst, 0o755); } catch {}
     count++;
   }
   // Adapter (Node script — copy preserving binary mode)
@@ -3446,12 +4321,46 @@ function copyMvpHooks(bundleDir, destDir) {
       .replace(/\r\n/g, "\n")
       .replace(/\r/g, "\n");
     fs.writeFileSync(dst, content, { mode: 0o755 });
+    try { fs.chmodSync(dst, 0o755); } catch {}
     count++;
   }
   return count;
 }
 
-function installHooksForCodex(bundleDir) {
+function enableCodexMemoryRecall(bundleDir, vaultPath) {
+  if (!vaultPath) return false;
+  const memoryDir = path.join(os.homedir(), ".mover", "memory");
+  const manifestPath = path.join(memoryDir, "manifest.json");
+  const markerPath = path.join(memoryDir, "recall-enabled");
+  const indexScript = path.join(bundleDir, "src", "dashboard", "lib", "memory-index.js");
+  if (!fs.existsSync(indexScript)) return false;
+
+  const manifestMatchesVault = () => {
+    try {
+      const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+      return !!manifest.vault && path.resolve(manifest.vault) === path.resolve(vaultPath);
+    } catch { return false; }
+  };
+
+  if (!manifestMatchesVault()) {
+    const result = spawnSync(process.execPath, [indexScript, "--backfill"], {
+      cwd: bundleDir,
+      env: { ...process.env, MOVER_VAULT: vaultPath },
+      stdio: "ignore",
+      timeout: 60000,
+    });
+    if (result.status !== 0 || !manifestMatchesVault()) return false;
+  }
+
+  try {
+    fs.mkdirSync(memoryDir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(markerPath, "enabled\n", { mode: 0o600 });
+    try { fs.chmodSync(markerPath, 0o600); } catch {}
+    return true;
+  } catch { return false; }
+}
+
+function installHooksForCodex(bundleDir, vaultPath) {
   const home = os.homedir();
   const codexDir = path.join(home, ".codex");
   const hooksDst = path.join(codexDir, "hooks");
@@ -3493,6 +4402,26 @@ function installHooksForCodex(bundleDir) {
   const configToml = path.join(codexDir, "config.toml");
   upsertTomlKey(configToml, "features", "codex_hooks", "true");
 
+  // Codex delegates recall through its already-registered prompt/Stop hooks. Build the
+  // selected vault's initial index before writing the opt-in marker so a fresh bundle
+  // never enables a permanently silent hook.
+  enableCodexMemoryRecall(bundleDir, vaultPath);
+
+  // v4.7.8: Stash a marker so the post-install summary can show the
+  // one-time "trust hooks in Codex IDE" hint. Codex IDE prompts users to
+  // review/trust newly installed or modified hooks (security feature —
+  // hooks run outside the sandbox). There is NO config-level bypass per
+  // https://developers.openai.com/codex/hooks. CLI uses hooks.json
+  // directly without the trust gate, so Mover OS works fine via CLI.
+  // The trust prompt only affects users running Codex IDE.
+  try {
+    fs.writeFileSync(
+      path.join(codexDir, ".mover-hook-install-stamp"),
+      new Date().toISOString() + "\n",
+      "utf8"
+    );
+  } catch {}
+
   return count;
 }
 
@@ -3618,16 +4547,20 @@ function installClaudeCode(bundleDir, vaultPath, skillOpts) {
     if (fs.existsSync(statusSrc)) {
       fs.copyFileSync(statusSrc, statusDst);
       const globalSettings = path.join(home, ".claude", "settings.json");
+      // Absolute forward-slash path, never `~` — cmd.exe on Windows does not
+      // expand tildes, so `node ~/.claude/statusline.js` was silently dead
+      // there (same bug class the hook commands already fixed via fwd()).
+      const statusCmd = `node "${statusDst.replace(/\\/g, "/")}"`;
       try {
         const settings = fs.existsSync(globalSettings)
           ? JSON.parse(fs.readFileSync(globalSettings, "utf8"))
           : {};
-        settings.statusLine = { type: "command", command: "node ~/.claude/statusline.js" };
+        settings.statusLine = { type: "command", command: statusCmd };
         fs.writeFileSync(globalSettings, JSON.stringify(settings, null, 2), "utf8");
       } catch {
         fs.writeFileSync(
           globalSettings,
-          JSON.stringify({ statusLine: { type: "command", command: "node ~/.claude/statusline.js" } }, null, 2),
+          JSON.stringify({ statusLine: { type: "command", command: statusCmd } }, null, 2),
           "utf8"
         );
       }
@@ -3724,8 +4657,12 @@ function installCodex(bundleDir, vaultPath, skillOpts) {
 
   const codexDir = path.join(home, ".codex");
   fs.mkdirSync(codexDir, { recursive: true });
-  // Codex CLI uses AGENTS.md (not instructions.md, not raw Global Rules)
-  fs.writeFileSync(path.join(codexDir, "AGENTS.md"), generateAgentsMd(), "utf8");
+  // Codex CLI uses AGENTS.md (not instructions.md, not raw Global Rules).
+  // A pre-existing AGENTS.md the user wrote is backed up once before the
+  // first overwrite — never silently clobbered (R5-A).
+  const agentsMdPath = path.join(codexDir, "AGENTS.md");
+  backupForeignFile(agentsMdPath);
+  fs.writeFileSync(agentsMdPath, generateAgentsMd(), "utf8");
   steps.push("AGENTS.md");
 
   // V5 FIX: In Codex, skills ARE commands — install workflows as SKILL.md dirs
@@ -3740,7 +4677,7 @@ function installCodex(bundleDir, vaultPath, skillOpts) {
 
   // v4.7.5: Native Codex hook support via mover-hook-adapter.js
   if (!skillOpts?.skipHooks) {
-    const hkCount = installHooksForCodex(bundleDir);
+    const hkCount = installHooksForCodex(bundleDir, vaultPath);
     if (hkCount > 0) steps.push(`${hkCount} hooks`);
   }
 
@@ -3936,6 +4873,9 @@ function installCopilot(bundleDir, vaultPath, skillOpts) {
     fs.mkdirSync(ghDir, { recursive: true });
     const src = path.join(bundleDir, "src", "system", "Mover_Global_Rules.md");
     if (fs.existsSync(src)) {
+      // copilot-instructions.md is often team-authored and git-tracked —
+      // back a foreign one up before the first overwrite (R5-A).
+      backupForeignFile(path.join(ghDir, "copilot-instructions.md"));
       fs.copyFileSync(src, path.join(ghDir, "copilot-instructions.md"));
       steps.push("rules");
     }
@@ -3987,6 +4927,7 @@ function installFromRegistry(bundleDir, vaultPath, skillOpts, writtenFiles, id)
       const sharedKey = reg.sharedRulesFile || id;
       if (!writtenFiles || !writtenFiles.has(destPath)) {
         fs.mkdirSync(path.dirname(destPath), { recursive: true });
+        backupForeignFile(destPath);
         fs.writeFileSync(destPath, generateAgentsMd(), "utf8");
         if (writtenFiles) writtenFiles.add(destPath);
         steps.push("AGENTS.md");
@@ -4003,6 +4944,7 @@ function installFromRegistry(bundleDir, vaultPath, skillOpts, writtenFiles, id)
         const s5idx = content.indexOf("\n## 5.");
         if (s5idx > 0) content = content.substring(0, s5idx);
         content = "# CONVENTIONS.md\n\n" + content.replace(/^# Mover OS Global Rules/m, "").trim() + "\n";
+        backupForeignFile(destPath);
         fs.writeFileSync(destPath, content, "utf8");
         steps.push("CONVENTIONS.md");
       }
@@ -4093,6 +5035,11 @@ function preflight() {
 // ─── CLI Command Handlers (stubs — implemented progressively) ────────────────
 const CLI_HANDLERS = {
   pulse:    async (opts) => { await cmdPulse(opts); },
+  dashboard: async (opts) => { await cmdPulse(opts); }, // alias — opens browser dashboard
+  open:     async (opts) => { await cmdOpen(opts); },
+  shortcut: async (opts) => { await cmdShortcut(opts); },
+  menubar:  async (opts) => { await cmdMenubar(opts); },
+  inventory: async (opts) => { cmdInventory(opts); },
   // warm removed
   capture:  async (opts) => { await cmdCapture(opts); },
   who:      async (opts) => { await cmdWho(opts); },
@@ -4180,7 +5127,15 @@ async function cmdDoctor(opts) {
   for (const f of engineFiles) {
     if (fs.existsSync(path.join(engineDir, f))) engOk++;
   }
-  statusLine(engOk >= 4 ? "ok" : engOk >= 2 ? "warn" : "fail", "Engine files", `${engOk}/${engineFiles.length} present`);
+  // terra read F1: `engOk >= 4` reported OK even with the two CORE sentinels
+  // (Identity_Prime, Strategy) missing — a broken Engine shown as healthy. OK only
+  // when all present; FAIL if a core file is missing; WARN otherwise.
+  const missingCore = ["Identity_Prime.md", "Strategy.md"].filter((f) => !fs.existsSync(path.join(engineDir, f)));
+  statusLine(
+    engOk === engineFiles.length ? "ok" : missingCore.length ? "fail" : "warn",
+    "Engine files",
+    `${engOk}/${engineFiles.length} present${missingCore.length ? ` — missing core: ${missingCore.join(", ")}` : ""}`
+  );
 
   // Version
   const vf = path.join(vault, ".mover-version");
@@ -4203,26 +5158,41 @@ async function cmdDoctor(opts) {
   for (const agentId of installedAgents) {
     const reg = AGENT_REGISTRY[agentId];
     if (!reg) { statusLine("warn", `  ${agentId}`, "unknown agent"); continue; }
+    // terra read F2: status was inferred from ANSI STYLING of the label text
+    // (styled = problem) — fragile and it certified broken installs as green in
+    // non-TTY (no styling). Derive from STRUCTURED booleans instead.
     const checks = [];
-    // Rules
+    let agentOk = true;
     if (reg.rules) {
-      const rp = reg.rules.dest(vault);
-      checks.push(fs.existsSync(rp) ? "rules" : dim("rules missing"));
+      const has = fs.existsSync(reg.rules.dest(vault));
+      agentOk = agentOk && has;
+      checks.push(has ? "rules" : dim("rules missing"));
     }
-    // Skills
     if (reg.skills) {
       const sp = reg.skills.dest(vault);
-      const hasSkills = fs.existsSync(sp) && fs.readdirSync(sp).length > 0;
-      checks.push(hasSkills ? "skills" : dim("no skills"));
+      const has = fs.existsSync(sp) && fs.readdirSync(sp).length > 0;
+      agentOk = agentOk && has;
+      checks.push(has ? "skills" : dim("no skills"));
     }
-    // Commands
     if (reg.commands) {
       const cp = reg.commands.dest(vault);
-      const hasCmds = fs.existsSync(cp) && fs.readdirSync(cp).length > 0;
-      checks.push(hasCmds ? "commands" : dim("no commands"));
+      const has = fs.existsSync(cp) && fs.readdirSync(cp).length > 0;
+      agentOk = agentOk && has;
+      checks.push(has ? "commands" : dim("no commands"));
+    }
+    // terra read F3: hooks were NEVER inspected — a deleted hooks config read as
+    // healthy. Check the agent's hook destination (settings.json for Claude, a
+    // hooks.json for the others).
+    if (reg.hooks) {
+      const hp = reg.hooks.dest ? reg.hooks.dest(vault)
+        : (reg.hooks.type === "claude-settings" ? path.join(home, ".claude", "settings.json") : null);
+      if (hp) {
+        const has = fs.existsSync(hp);
+        agentOk = agentOk && has;
+        checks.push(has ? "hooks" : dim("hooks missing"));
+      }
     }
-    const allOk = checks.every((c) => c === strip(c)); // styled text = problem
-    statusLine(allOk ? "ok" : "warn", `  ${reg.name}`, checks.join(", "));
+    statusLine(agentOk ? "ok" : "warn", `  ${reg.name}`, checks.join(", "));
   }
 
   // ── Claude Code skill listing budget (v4.7.7) ────────────────────────
@@ -4273,6 +5243,138 @@ async function cmdDoctor(opts) {
     );
   }
 
+  // ── Runtime drift check (sol #7 part 6) ───────────────────────────────
+  // The hook runtime is a COPY (link.sh copies hooks; workflows are hard
+  // links). A copy can silently drift from the bundle after git ops — the
+  // 2026-07-12 live find: runtime session-start.sh was 11 hours stale and
+  // log.md 3 DAYS stale, so recent fixes simply were not running. Detect it
+  // mechanically: content-hash every bundle hook against its runtime copy,
+  // and check workflow hard-link integrity (a broken link is current TODAY
+  // but drifts on the next bundle edit). Dev-checkout concern only: npm-
+  // global installs have no src/ on disk and skip silently.
+  (() => {
+    let bundleDir = null;
+    for (const c of [process.cwd(), path.join(vault, "01_Projects", "Mover OS Bundle"), __dirname]) {
+      if (fs.existsSync(path.join(c, "src", "hooks"))) { bundleDir = c; break; }
+    }
+    if (!bundleDir) return;
+    const sha = (p) => crypto.createHash("sha256").update(fs.readFileSync(p)).digest("hex");
+    barLn();
+    barLn(dim("  Runtime sync (bundle -> agent copies):"));
+
+    const hookSrcDir = path.join(bundleDir, "src", "hooks");
+    // Every agent runtime that receives hook COPIES (sol #8 partial
+    // refutation 1: only ~/.claude was inspected, and a DELETED runtime file
+    // was skipped silently — absence is drift too, and Codex/Gemini have
+    // their own copy directories via installHooksForCodex/Gemini).
+    const runtimes = [
+      { label: "Claude hooks", dir: path.join(home, ".claude", "hooks") },
+      { label: "Codex hooks", dir: path.join(home, ".codex", "hooks") },
+      { label: "Gemini hooks", dir: path.join(home, ".gemini", "hooks") },
+    ];
+    let anyHookDrift = false;
+    for (const rt of runtimes) {
+      if (!fs.existsSync(rt.dir)) continue; // agent not installed: nothing to drift
+      const runtimeNames = new Set(fs.readdirSync(rt.dir).filter((n) => /\.(sh|js)$/.test(n)));
+      const drifted = [];
+      const missing = [];
+      let checked = 0;
+      for (const name of fs.readdirSync(hookSrcDir)) {
+        if (!/\.(sh|js)$/.test(name)) continue;
+        const dst = path.join(rt.dir, name);
+        if (!runtimeNames.has(name)) continue; // this agent never installs it — but see the deletion check below
+        checked++;
+        try { if (sha(path.join(hookSrcDir, name)) !== sha(dst)) drifted.push(name); } catch { /* unreadable = skip */ }
+      }
+      // Deletion detection: a runtime file the agent's OWN settings still
+      // reference but which no longer exists on disk. For Claude the
+      // settings.json registrations are the truth; a lighter proxy that
+      // needs no per-agent settings parser: mover-lib.sh is the shared
+      // library every shipped hook sources — if any hooks are present but
+      // the library is gone, every one of them is broken at run time.
+      if (checked > 0 && !runtimeNames.has("mover-lib.sh") && fs.existsSync(path.join(hookSrcDir, "mover-lib.sh"))) {
+        missing.push("mover-lib.sh");
+      }
+      if (drifted.length || missing.length) {
+        anyHookDrift = true;
+        const parts = [];
+        if (drifted.length) parts.push(`${drifted.length}/${checked} DRIFTED: ${drifted.slice(0, 4).join(", ")}${drifted.length > 4 ? ", ..." : ""}`);
+        if (missing.length) parts.push(`MISSING: ${missing.join(", ")}`);
+        statusLine("warn", `  ${rt.label}`, parts.join("; "));
+      } else if (checked > 0) {
+        statusLine("ok", `  ${rt.label}`, `${checked} current`);
+      }
+    }
+
+    const wfSrcDir = path.join(bundleDir, "src", "workflows");
+    const wfDstDir = path.join(home, ".claude", "commands");
+    const brokenLinks = [];
+    const staleContent = [];
+    let wfChecked = 0;
+    if (fs.existsSync(wfDstDir) && fs.existsSync(wfSrcDir)) {
+      for (const name of fs.readdirSync(wfSrcDir)) {
+        if (!name.endsWith(".md")) continue;
+        const src = path.join(wfSrcDir, name);
+        const dst = path.join(wfDstDir, name);
+        if (!fs.existsSync(dst)) continue;
+        wfChecked++;
+        try {
+          const sIno = fs.statSync(src).ino;
+          const dIno = fs.statSync(dst).ino;
+          if (sIno !== dIno) {
+            if (sha(src) !== sha(dst)) staleContent.push(name);
+            else brokenLinks.push(name); // current bytes, but the link is gone: drifts on the next edit
+          }
+        } catch { /* skip */ }
+      }
+      if (staleContent.length) {
+        statusLine("warn", "  Workflow links", `${staleContent.length}/${wfChecked} STALE content: ${staleContent.slice(0, 4).join(", ")}${staleContent.length > 4 ? ", ..." : ""}`);
+      } else if (brokenLinks.length) {
+        statusLine("warn", "  Workflow links", `${brokenLinks.length}/${wfChecked} content current but hard link broken (will drift on next edit)`);
+      } else {
+        statusLine("ok", "  Workflow links", `${wfChecked} hard-linked`);
+      }
+    }
+    if (anyHookDrift || staleContent.length || brokenLinks.length) {
+      barLn(dim(`    Fix: bash "${path.join(bundleDir, "src", "install", "link.sh")}"`));
+    }
+  })();
+
+  // ── Codex CLI / MCP plugin conflict check (v4.7.8) ────────────────────
+  // Unauthenticated MCP plugins in ~/.codex/config.toml cause codex exec to
+  // hang or exit empty on complex prompts (the Vercel "claude-plugins-official"
+  // plugin is the most common offender — it requires Bearer auth that's never
+  // set, so the MCP transport errors and blocks the LLM response path).
+  // We don't auto-disable user plugins, just surface the issue.
+  const codexConfig = path.join(home, ".codex", "config.toml");
+  if (fs.existsSync(codexConfig)) {
+    barLn();
+    barLn(dim("  Codex:"));
+    const codexToml = fs.readFileSync(codexConfig, "utf8");
+    // Find all [plugins."NAME"] sections with enabled = true
+    const pluginRe = /\[plugins\."([^"]+)"\]\s*\nenabled\s*=\s*true/g;
+    const enabledPlugins = [];
+    let m;
+    while ((m = pluginRe.exec(codexToml)) !== null) enabledPlugins.push(m[1]);
+    // Known plugins that require auth and break Codex CLI when unauthenticated.
+    // Add more here as users report similar issues.
+    const KNOWN_BROKEN_AUTH = new Set([
+      "vercel@claude-plugins-official",
+    ]);
+    const broken = enabledPlugins.filter(p => KNOWN_BROKEN_AUTH.has(p));
+    if (broken.length > 0) {
+      statusLine("warn", "  MCP plugin auth", `${broken.length} plugin(s) likely unauthenticated`);
+      for (const p of broken) {
+        barLn(dim(`    [plugins."${p}"] enabled=true — auth not configured`));
+      }
+      barLn(dim(`    Symptom: codex exec hangs or returns empty on complex prompts.`));
+      barLn(dim(`    Fix: edit ~/.codex/config.toml, flip enabled=false for the above plugins`));
+      barLn(dim(`    (or configure the missing auth). Mover OS does NOT auto-disable plugins.`));
+    } else if (enabledPlugins.length > 0) {
+      statusLine("ok", "  MCP plugin auth", `${enabledPlugins.length} plugin(s), none flagged`);
+    }
+  }
+
   // Engine Git
   barLn();
   const engineGit = fs.existsSync(path.join(engineDir, ".git"));
@@ -4295,8 +5397,396 @@ async function cmdDoctor(opts) {
   barLn(dim("  Fix any issues above, then run /mover-check in your AI agent for deeper validation."));
 }
 
-// ─── moveros pulse ──────────────────────────────────────────────────────────
+// ─── moveros pulse / dashboard ───────────────────────────────────────────────
+// Default: opens browser dashboard at http://127.0.0.1:3737. Use `--terminal` for legacy TUI.
 async function cmdPulse(opts) {
+  const rest = opts.rest || [];
+  // `moveros pulse --bar` — a single glanceable status line for a menu-bar widget
+  // (SwiftBar/xbar plugin, a native Swift app, or a Node tray all consume the same
+  // line). No TUI, no browser. Kept path-independent on purpose so the menu-bar
+  // shell can be chosen later without touching this.
+  if (rest.includes("--bar")) { await cmdPulseBar(opts); return; }
+  const wantTerminal = rest.includes("--terminal");
+  if (!wantTerminal) {
+    const vault = resolveVaultPath(opts.vault);
+    if (!vault) {
+      // Never exit silently (R5-A): a fresh machine or a moved vault landed
+      // here and `moveros` just... stopped, with no clue why.
+      console.error(dim("  Could not find your vault. Point at it with --vault PATH, or run `moveros doctor` to diagnose."));
+      return;
+    }
+    try {
+      const dash = require("./src/dashboard");
+      await dash.run({
+        vault,
+        version: (() => { try { return require("./package.json").version; } catch { return "unknown"; } })(),
+        rest
+      });
+      return;
+    } catch (err) {
+      console.error(dim(`  dashboard module error: ${err.message}`));
+      console.error(dim("  falling back to terminal pulse — fix or run with --terminal explicitly"));
+    }
+  }
+  await cmdPulseTerminal(opts);
+}
+
+// ─── moveros open ────────────────────────────────────────────────────────────
+// Ensure the dashboard is running in the background, then open it in the
+// browser and exit. Used by the desktop launcher (shortcut.js → `node
+// install.js open`) and by anyone who wants the dashboard without holding a
+// terminal open. `pulse` is the foreground equivalent.
+async function cmdOpen(opts, { soft = false, route = "" } = {}) {
+  const vault = resolveVaultPath(opts.vault);
+  if (!vault) {
+    console.error(dim("  Could not resolve vault. Run `moveros doctor` to diagnose."));
+    return;
+  }
+  try {
+    const dash = require("./src/dashboard");
+    await dash.open({
+      vault,
+      version: (() => { try { return require("./package.json").version; } catch { return "unknown"; } })(),
+      rest: opts.rest || [],
+      soft,
+      noOpen: !!opts.noOpen,
+      route,
+    });
+  } catch (err) {
+    console.error(dim(`  dashboard module error: ${err.message}`));
+    console.error(dim("  open it manually with: moveros pulse"));
+  }
+}
+
+// ─── moveros shortcut ────────────────────────────────────────────────────────
+// Create the double-clickable desktop launcher (mac .app + Desktop symlink /
+// win .lnk / linux .desktop) for an existing install. Onboarding offers this
+// as a checkbox (/api/setup/shortcut); this is the retrofit path for installs
+// that predate it and the repair path when the launcher was deleted.
+// Optional positional overrides the name: `moveros shortcut My OS`.
+// Idempotent: re-running refreshes the same artifacts in place.
+async function cmdShortcut(opts) {
+  // A launcher that runs `moveros open` is a dead icon without an install.
+  // A launcher without an install is a dead icon — the one invariant
+  // (requireInstalledVault) covers the terra F1 typo'd --vault case.
+  const vault = requireInstalledVault(opts.vault);
+  if (!vault) return;
+
+  // Explicit arg wins, else the display name chosen at onboarding. An empty
+  // string is fine: createShortcut falls back to "Mover Studio". The 80-char
+  // cap matches the /api/setup/shortcut route. Unknown flags fall through
+  // parseArgs into rest; drop them so `moveros shortcut --remove` can never
+  // mint a launcher literally named "--remove".
+  const flagged = opts.rest.filter((a) => String(a).startsWith("-"));
+  if (flagged.length) statusLine("warn", "Ignoring", flagged.join(" ") + " (no such option)");
+  let name = opts.rest.filter((a) => !String(a).startsWith("-")).join(" ").trim().slice(0, 80);
+  if (!name) {
+    try {
+      const cfg = JSON.parse(fs.readFileSync(path.join(os.homedir(), ".mover", "config.json"), "utf8"));
+      name = String(cfg.osName || cfg.os_name || "");
+    } catch { /* no config yet — createShortcut handles the fallback */ }
+  }
+
+  const { createShortcut } = require("./src/dashboard/shortcut");
+  const result = createShortcut({
+    name,
+    nodeBin: process.execPath, // fast path only — the launcher re-resolves node at click time
+    entry: __filename,         // realpath of the moveros bin; npx-cache paths share server.js's exposure
+  });
+
+  for (const p of result.created) statusLine("ok", "Created", p);
+  if (result.skipped) {
+    statusLine("warn", "Shortcut skipped", result.skipped);
+    barLn();
+    return;
+  }
+  barLn();
+  const label =
+    result.platform === "darwin" ? "Desktop icon" :
+    result.platform === "win32" ? "Desktop shortcut" : "desktop entry";
+  barLn(dim(`  Double-click the ${label} to open your dashboard.`));
+  barLn();
+}
+
+// ─── moveros inventory ───────────────────────────────────────────────────────
+// Emits the bundle's derived facts as JSON by EVALUATING the same source the
+// installer runs (AGENT_REGISTRY, generateClaudeSettings/Codex/Gemini), never
+// by re-typing numbers. scripts/generate-docs.mjs consumes this to stamp
+// README.md/MANUAL.md, and test/docs-generated.test.mjs fails the suite when
+// the stamped docs drift from these facts (sol part 12: docs must be
+// generated copies, not authored ones). Needs no vault — the subject is the
+// bundle itself.
+function collectInventory() {
+  const bundle = __dirname;
+  const workflows = fs.readdirSync(path.join(bundle, "src", "workflows"))
+    .filter((n) => n.endsWith(".md")).map((n) => n.replace(/\.md$/, "")).sort();
+
+  // Same production filter the installer and inventory-counts test apply.
+  const DEV_SUFFIXES = ["-workspace", "-benchmark", "-sandbox"];
+  const isDev = (n) => DEV_SUFFIXES.some((s) => n.endsWith(s));
+  const skills = [];
+  (function walk(dir) {
+    for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+      if (!e.isDirectory() || isDev(e.name)) continue;
+      const full = path.join(dir, e.name);
+      if (fs.existsSync(path.join(full, "SKILL.md"))) skills.push(e.name);
+      else walk(full);
+    }
+  })(path.join(bundle, "src", "skills"));
+  skills.sort();
+
+  const hookFiles = fs.readdirSync(path.join(bundle, "src", "hooks"))
+    .filter((f) => f.endsWith(".sh")).sort();
+
+  // Claude Code: walk the actual generated settings for script + event + matcher.
+  const claudeRegistered = [];
+  const claudeSettings = JSON.parse(generateClaudeSettings());
+  for (const [event, entries] of Object.entries(claudeSettings.hooks || {})) {
+    for (const entry of entries) {
+      for (const h of entry.hooks || []) {
+        const m = String(h.command || "").match(/([a-z0-9-]+\.sh)/);
+        if (m) claudeRegistered.push({ script: m[1], event, matcher: entry.matcher || "" });
+      }
+    }
+  }
+
+  const scriptsIn = (jsonText) => {
+    const set = new Set();
+    for (const m of String(jsonText).matchAll(/([a-z0-9-]+\.sh)/g)) set.add(m[1]);
+    return [...set].sort();
+  };
+  const codexScripts = scriptsIn(generateCodexHooks());
+  const geminiScripts = scriptsIn(JSON.stringify(generateGeminiHooks()));
+
+  let version = `V${VERSION}`;
+  try {
+    version = JSON.parse(fs.readFileSync(path.join(bundle, "package.json"), "utf8")).version || version;
+  } catch {}
+
+  // Engine-protection approval routing, read from the adapter's own constant
+  // so the documented wait budget can never drift from the shipped one.
+  let approvalWaitMs = null;
+  try {
+    const adapterSrc = fs.readFileSync(path.join(bundle, "src", "hooks", "mover-hook-adapter.js"), "utf8");
+    const m = adapterSrc.match(/MOVER_APPROVAL_WAIT_MS\s*\|\|\s*"(\d+)"/);
+    if (m) approvalWaitMs = parseInt(m[1], 10);
+  } catch {}
+
+  const agents = AGENT_SELECTIONS.map((s) => {
+    const reg = AGENT_REGISTRY[s.targets[0]];
+    return {
+      id: s.id,
+      name: s.name,
+      tierDesc: reg.tierDesc,
+      rules: !!reg.rules,
+      commands: reg.commands ? reg.commands.format : null,
+      skills: !!reg.skills,
+      hooks: reg.hooks ? reg.hooks.type : null,
+    };
+  });
+
+  // TYPED approval routing (sol re-score #3 part 12 residual: "approval
+  // behavior is still authored prose with only its timeout derived"). Every
+  // field here is computed from the same sources the product runs:
+  // interactive = agents whose hooks integration is Claude's settings.json
+  // (real PreToolUse prompt); dashboardRider = agents whose GENERATED hook
+  // config routes engine-protection through the adapter (no native prompt,
+  // the Mover Studio dialog is the approval surface); failClosed points at
+  // the test file that pins ask-to-deny when the dashboard is absent.
+  const approval = {
+    waitMs: approvalWaitMs,
+    interactive: agents.filter((a) => a.hooks === "claude-settings").map((a) => a.name),
+    dashboardRider: [
+      codexScripts.includes("engine-protection.sh") ? "Codex" : null,
+      geminiScripts.includes("engine-protection.sh") ? "Gemini CLI" : null,
+    ].filter(Boolean),
+    failClosedPinnedBy: "test/hook-adapter.test.mjs",
+  };
+
+  // User-facing CLI subcommands, evaluated from the CLI_COMMANDS registry so
+  // the docs command table cannot drift from what the binary actually
+  // dispatches (sol re-score #4 part 12: "more factual prose into typed
+  // blocks"). Hidden commands (test, inventory) are excluded, matching the
+  // menu and --help surfaces.
+  const cliCommands = Object.entries(CLI_COMMANDS)
+    .filter(([, meta]) => !meta.hidden)
+    .map(([name, meta]) => ({ name, desc: meta.desc, alias: meta.alias || [] }));
+
+  return {
+    version,
+    workflows,
+    skills,
+    cliCommands,
+    hooks: {
+      files: hookFiles,
+      claudeRegistered,
+      codexScripts,
+      geminiScripts,
+      approvalWaitMs,
+    },
+    approval,
+    agents,
+  };
+}
+
+function cmdInventory() {
+  // Pure JSON on stdout — no banner, no color — so callers can pipe it.
+  process.stdout.write(JSON.stringify(collectInventory(), null, 2) + "\n");
+}
+
+// ─── moveros menubar ─────────────────────────────────────────────────────────
+// Installs the native macOS menu-bar companion (src/menubar/, prebuilt at
+// src/menubar/prebuilt/MoverBar.app — zero third-party deps, no SwiftBar, no
+// brew). Owner-approved 2026-07-11 (qa/campaign-2026-07/OWNER-DECISIONS.md
+// RULINGS LANDED): "cleanest install-on-accept", same pattern as the desktop
+// shortcut (src/dashboard/shortcut.js) — a prebuilt artifact copied into
+// place on accept, not compiled on the user's machine.
+//
+// macOS-only. The .app polls ~/.mover/menubar.json every 60s and shells out
+// to the exact cmd this function writes: [node, install.js, "pulse", "--bar"]
+// — the same one-honest-line contract cmdPulseBar already guarantees, so the
+// menu bar never has to fabricate a status.
+// Idempotent: re-running replaces the installed .app in place (rsync-style —
+// remove then copy fresh) and rewrites the config.
+async function cmdMenubar(opts) {
+  if (process.platform !== "darwin") {
+    barLn(dim("  moveros menubar is macOS-only (native AppKit menu-bar app)."));
+    return;
+  }
+
+  const remove = (opts.rest || []).includes("--remove");
+  const appDest = path.join(os.homedir(), "Applications", "MoverBar.app");
+  const configPath = path.join(os.homedir(), ".mover", "menubar.json");
+
+  if (remove) {
+    try {
+      const { execFileSync } = require("child_process");
+      try { execFileSync("pkill", ["-f", "MoverBar"], { stdio: "ignore" }); } catch { /* not running — fine */ }
+    } catch { /* best-effort — never block removal on this */ }
+    try { if (fs.lstatSync(appDest)) fs.rmSync(appDest, { recursive: true, force: true }); statusLine("ok", "Removed", appDest); } catch { /* already absent */ }
+    try { if (fs.lstatSync(configPath)) fs.rmSync(configPath, { force: true }); statusLine("ok", "Removed", configPath); } catch { /* already absent */ }
+    barLn();
+    return;
+  }
+
+  // A MoverBar polling `moveros pulse --bar` is a dead icon without an
+  // install — the one invariant (requireInstalledVault) is the guard.
+  const vault = requireInstalledVault(opts.vault);
+  if (!vault) return;
+
+  const prebuiltSrc = path.join(path.resolve(__dirname), "src", "menubar", "prebuilt", "MoverBar.app");
+  if (!fs.existsSync(prebuiltSrc)) {
+    statusLine("warn", "Missing prebuilt app", `${prebuiltSrc} not found — reinstall mover-os.`);
+    barLn();
+    return;
+  }
+
+  try {
+    fs.mkdirSync(path.join(os.homedir(), "Applications"), { recursive: true });
+    fs.rmSync(appDest, { recursive: true, force: true }); // rsync-style replace
+    copyDirRecursive(prebuiltSrc, appDest);
+    statusLine("ok", "Installed", appDest);
+  } catch (err) {
+    statusLine("warn", "Install failed", err.message);
+    barLn();
+    return;
+  }
+
+  try {
+    fs.mkdirSync(path.join(os.homedir(), ".mover"), { recursive: true });
+    fs.writeFileSync(
+      configPath,
+      JSON.stringify({ cmd: [process.execPath, __filename, "pulse", "--bar"] }, null, 2),
+      "utf8"
+    );
+    statusLine("ok", "Wrote", configPath);
+  } catch (err) {
+    statusLine("warn", "Config write failed", err.message);
+    barLn();
+    return;
+  }
+
+  try {
+    const { spawn } = require("child_process");
+    spawn("open", [appDest], { stdio: "ignore", detached: true }).unref();
+    statusLine("ok", "Launched", "MoverBar");
+  } catch (err) {
+    statusLine("warn", "Launch failed", err.message);
+  }
+
+  barLn();
+  barLn(dim("  Look for the status line in your menu bar. It refreshes every 60s."));
+  barLn();
+}
+
+// One glanceable status line for a menu-bar widget. Plain text, no ANSI. Always
+// exits 0 with SOME line so a bar poller never renders an error. Shape:
+//   "▸ <next action>  ·  <done>/<total> today"
+// Falls back to the standing test, then a bare label, so the bar is never blank.
+async function cmdPulseBar(opts) {
+  const emit = (s) => { process.stdout.write(String(s).replace(/\s+/g, " ").trim() + "\n"); };
+  try {
+    const vault = resolveVaultPath(opts.vault);
+    if (!vault) { emit("Mover · not set up"); return; }
+    const engineDir = path.join(vault, "02_Areas", "Engine");
+
+    let done = 0, total = 0, next = "";
+    try {
+      const dailyPath = resolveDailyNotePath(engineDir);
+      if (dailyPath && fs.existsSync(dailyPath)) {
+        const daily = fs.readFileSync(dailyPath, "utf8");
+        const sec = daily.match(/##\s*Tasks[\s\S]*?(?=\n##|\n---|$)/i);
+        if (sec) {
+          const tasks = sec[0].split("\n").filter((l) => /^\s*-\s*\[[ x~]\]/.test(l));
+          total = tasks.length;
+          // Only [x] is complete; [~] is unverified/in-progress (global rule S5).
+          done = tasks.filter((t) => /^\s*-\s*\[x\]/.test(t)).length;
+          const firstOpen = tasks.find((t) => /^\s*-\s*\[[ ~]\]/.test(t));
+          if (firstOpen) next = firstOpen.replace(/^\s*-\s*\[[ x~]\]\s*/, "").replace(/\[[^\]]*\]/g, "").trim();
+        }
+      }
+    } catch (_) { /* no daily / unreadable — fall through to the standing test */ }
+
+    // Owner ruling (2026-07-11): the TITLE is a glance-number, never a sentence
+    // (the reference bar apps show "$12,345", not prose) — and the number is
+    // the MISSION (the bet: "4/15"), not the day's chore count. Contract:
+    // line 1 = compact title, line 2 = the full sentence for the click-menu.
+    // A one-line consumer (scripts, old pollers) still gets a meaningful line.
+    let st = "";
+    try {
+      const man = JSON.parse(fs.readFileSync(path.join(os.homedir(), ".mover", "pattern-manifest.json"), "utf8"));
+      st = String((man && man.single_test) || "").trim();
+    } catch (_) { /* no manifest */ }
+
+    // The bet count comes from the SAME parser the dashboard hero uses —
+    // never a second implementation that can drift from what Home shows.
+    let bet = null;
+    if (st) {
+      try {
+        const { parseGoalProgress } = require("./src/dashboard/lib/goal-forecast");
+        const acRaw = fs.readFileSync(path.join(engineDir, "Active_Context.md"), "utf8");
+        const g = parseGoalProgress({ singleTest: st, sourceText: acRaw, targetDate: null, now: new Date() });
+        // false-zero discipline: no parseable target = no fabricated "0/0".
+        if (g && g.target > 0) bet = { current: g.current || 0, target: g.target };
+      } catch (_) { /* unparseable bet — fall through to the day count */ }
+    }
+
+    const parts = [];
+    if (next) parts.push("▸ " + next.slice(0, 42));
+    if (total > 0) parts.push(`${done}/${total} today`);
+    if (bet || parts.length) {
+      emit(bet ? `▸ ${bet.current}/${bet.target}` : (total > 0 ? `▸ ${done}/${total}` : "▸ Mover"));
+      emit(parts.length ? parts.join("  ·  ") : "▸ " + st.slice(0, 48));
+      return;
+    }
+    emit("▸ Mover");
+    emit(st ? "▸ " + st.slice(0, 48) : "Mover · no tasks today");
+  } catch (_) {
+    emit("Mover"); // never fail a bar poll
+  }
+}
+
+async function cmdPulseTerminal(opts) {
   const vault = resolveVaultPath(opts.vault);
   if (!vault) {
     // handled by requireVault()
@@ -4340,7 +5830,9 @@ async function cmdPulse(opts) {
     const taskSection = daily.match(/##\s*Tasks[\s\S]*?(?=\n##|\n---)/i);
     if (taskSection) {
       const tasks = taskSection[0].split("\n").filter((l) => /^\s*-\s*\[[ x~]\]/.test(l));
-      const done = tasks.filter((t) => /\[x\]|\[~\]/.test(t)).length;
+      // terra read F10: only [x] is COMPLETE. [~] is unverified/in-progress — the
+      // whole point of the [~] state (global rule S5) — and must not count as done.
+      const done = tasks.filter((t) => /^\s*-\s*\[x\]/.test(t)).length;
       const total = tasks.length;
       barLn(`  ${progressBar(done, total, 25, "Tasks")}`);
     }
@@ -4394,9 +5886,13 @@ async function cmdPulse(opts) {
   if (fs.existsSync(acLogPath)) {
     try {
       const acContent = fs.readFileSync(acLogPath, "utf8");
-      const logMatch = acContent.match(/log_last_run:\s*(\S+)/);
-      if (logMatch) {
-        const agoMs = Date.now() - new Date(logMatch[1]).getTime();
+      // terra read F5: `(\S+)` captured the closing `**` of a Markdown-wrapped key
+      // (**log_last_run:** date), yielding "NaNh ago". Consume optional Markdown
+      // around the key and capture a date-shaped token, then reject an invalid date.
+      const logMatch = acContent.match(/\*{0,2}\s*log_last_run:\s*\*{0,2}\s*([0-9][0-9T:\-.Z+]*)/i);
+      const ts = logMatch ? new Date(logMatch[1]).getTime() : NaN;
+      if (logMatch && !Number.isNaN(ts)) {
+        const agoMs = Date.now() - ts;
         const agoMin = Math.round(agoMs / 60000);
         const agoH = Math.round(agoMs / 3600000);
         const agoStr = agoMin < 60 ? `${agoMin}m ago` : `${agoH}h ago`;
@@ -4414,7 +5910,11 @@ async function cmdPulse(opts) {
 
 // ─── moveros capture ────────────────────────────────────────────────────────
 async function cmdCapture(opts) {
-  const vault = requireVault(opts.vault);
+  // terra CLI F7: an explicit --vault is trusted without existsSync, so a
+  // typo'd path would get a whole 00_Inbox tree minted there and the note
+  // "lost" outside the real vault. The one invariant is the mutation gate.
+  const vault = requireInstalledVault(opts.vault);
+  if (!vault) return;
 
   const now = new Date();
   const ymd = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")}`;
@@ -4476,11 +5976,34 @@ async function cmdCapture(opts) {
   else if (type === "idea") entry = `- **Idea:** ${content}  *(${ts})*`;
   else entry = `- ${content}  *(${ts})*`;
 
+  // terra CLI F6: never follow a SYMLINKED capture file — appending through it
+  // would write outside the vault inbox. A path is unsafe if it is a symlink, or
+  // its real parent is not the real inbox. Fall back to a fresh file; if that is
+  // also unsafe (or the same path), refuse rather than write outside the vault.
+  const realInbox = (() => { try { return fs.realpathSync(inboxDir); } catch { return inboxDir; } })();
+  const isUnsafe = (p) => {
+    try {
+      const st = fs.lstatSync(p, { throwIfNoEntry: false });
+      if (!st) return false;                    // does not exist = safe to create
+      if (st.isSymbolicLink()) return true;      // never follow a link
+      return path.dirname(fs.realpathSync(p)) !== realInbox;
+    } catch { return false; }
+  };
+  let writeTarget = capturePath;
+  if (isUnsafe(writeTarget)) {
+    const fresh = path.join(inboxDir, `Capture - ${ymd}.md`);
+    if (path.resolve(fresh) === path.resolve(writeTarget) || isUnsafe(fresh)) {
+      barLn(red("  The inbox capture file is a symlink pointing outside the vault; refusing to write."));
+      return;
+    }
+    writeTarget = fresh;
+  }
+
   // Append to capture file
-  if (!fs.existsSync(capturePath)) {
-    fs.writeFileSync(capturePath, `# Capture — ${ymd}\n\n${entry}\n`, "utf8");
+  if (!fs.existsSync(writeTarget)) {
+    fs.writeFileSync(writeTarget, `# Capture — ${ymd}\n\n${entry}\n`, "utf8");
   } else {
-    fs.appendFileSync(capturePath, `${entry}\n`, "utf8");
+    fs.appendFileSync(writeTarget, `${entry}\n`, "utf8");
   }
 
   statusLine("ok", "Captured", `${type} → 00_Inbox/`);
@@ -4490,7 +6013,10 @@ async function cmdCapture(opts) {
 
 // ─── moveros who ────────────────────────────────────────────────────────────
 async function cmdWho(opts) {
-  const vault = requireVault(opts.vault);
+  // Can mint entity stubs — mutating commands go through the one install
+  // invariant (sol re-score #3: the invariant must cover EVERY mutating path).
+  const vault = requireInstalledVault(opts.vault);
+  if (!vault) return;
 
   const name = opts.rest.join(" ").trim();
   if (!name) { barLn(yellow("Usage: moveros who <name>")); return; }
@@ -4521,9 +6047,35 @@ async function cmdWho(opts) {
     if (create === "yes") {
       const peopleDir = path.join(entitiesDir, "People");
       fs.mkdirSync(peopleDir, { recursive: true });
-      const stub = `# ${name}\n\n**Type:** Person\n**Last Contact:** ${new Date().toISOString().split("T")[0]}\n\n## Context\n\n- \n\n## Notes\n\n- \n`;
-      fs.writeFileSync(path.join(peopleDir, `${name}.md`), stub, "utf8");
-      statusLine("ok", "Created", `${name}.md in Entities/People/`);
+      // The raw name went straight into the write path, so "../../x" escaped
+      // Entities entirely (terra-confirmed traversal). Strip separators and
+      // dot segments, then verify the target lands PHYSICALLY inside People/ —
+      // using realpath, since path.resolve is lexical and a symlinked People/
+      // dir would otherwise let the stub escape (terra round 2).
+      const safeName = name.replace(/[\/\\:*?"<>|\0]/g, "-").replace(/\.\.+/g, "-").trim();
+      const stubPath = path.resolve(peopleDir, `${safeName}.md`);
+      // Containment, three ways (terra P1, two rounds): lexical (blocks "../"
+      // names), realpath-consistent (dirname resolves to People), AND the
+      // resolved target must sit INSIDE the vault — so a People/ symlinked to
+      // an outside dir can't smuggle the stub out of the vault entirely.
+      let realParent, realPeople, realVault;
+      try {
+        realParent = fs.realpathSync(path.dirname(stubPath));
+        realPeople = fs.realpathSync(peopleDir);
+        realVault = fs.realpathSync(vault);
+      } catch { realParent = null; realPeople = null; realVault = null; }
+      const insideVault = realParent && realVault &&
+        (realParent === realVault || realParent.startsWith(realVault + path.sep));
+      if (!safeName ||
+          !stubPath.startsWith(path.resolve(peopleDir) + path.sep) ||
+          realParent !== realPeople ||
+          !insideVault) {
+        statusLine("warn", "Invalid location", "Entity stub would land outside the vault. Check the name and that Entities/People is inside your vault.");
+        return;
+      }
+      const stub = `# ${safeName}\n\n**Type:** Person\n**Last Contact:** ${new Date().toISOString().split("T")[0]}\n\n## Context\n\n- \n\n## Notes\n\n- \n`;
+      fs.writeFileSync(stubPath, stub, "utf8");
+      statusLine("ok", "Created", `${safeName}.md in Entities/People/`);
     }
     return;
   }
@@ -4545,9 +6097,12 @@ async function cmdWho(opts) {
 // ─── moveros diff ───────────────────────────────────────────────────────────
 async function cmdDiff(opts) {
   const vault = requireVault(opts.vault);
+  if (!vault) return;
   if (!cmdExists("git")) { barLn(red("Git required for moveros diff.")); return; }
 
-  const target = opts.rest[0] || "strategy";
+  // terra read F11: the target is the first NON-FLAG arg, so `diff --days=30 strategy`
+  // (flag first) doesn't try to diff a file literally named "--days=30".
+  const target = opts.rest.find((a) => !a.startsWith("--")) || "strategy";
   const days = parseInt(opts.rest.find((a) => a.startsWith("--days="))?.split("=")[1] || "30", 10);
 
   const fileMap = {
@@ -4571,8 +6126,11 @@ async function cmdDiff(opts) {
   const gitCwd = isEngineFile && fs.existsSync(path.join(engineDir, ".git"))
     ? engineDir
     : vault;
+  // terra read F8: path.basename dropped subdirectories, so a nested Engine file
+  // (02_Areas/Engine/Samples/Foo.md) was queried at the wrong git path and its
+  // history read as empty. Use the path RELATIVE to the Engine repo root.
   const gitRelPath = isEngineFile && gitCwd === engineDir
-    ? path.basename(relPath)
+    ? path.relative(engineDir, fullPath)
     : relPath;
 
   barLn(bold(`  ${path.basename(relPath)} — last ${days} days`));
@@ -4605,7 +6163,10 @@ async function cmdDiff(opts) {
 
 // ─── moveros sync ───────────────────────────────────────────────────────────
 async function cmdSync(opts) {
-  const vault = requireVault(opts.vault);
+  // --apply rewrites agent artifacts from the bundle — mutating, so the one
+  // install invariant gates it (sol re-score #3).
+  const vault = requireInstalledVault(opts.vault);
+  if (!vault) return;
   const apply = opts.rest.includes("--apply");
   const home = os.homedir();
 
@@ -4630,7 +6191,32 @@ async function cmdSync(opts) {
   for (const c of candidates) {
     if (fs.existsSync(path.join(c, "src", "workflows"))) { bundleDir = c; break; }
   }
-  if (!bundleDir) { barLn(yellow("  Can't find Mover OS source. Run from the bundle directory.")); return; }
+  // v4.7.9 (S6 ship-blocker): download fallback. `moveros sync` was disk-only —
+  // it resolved bundleDir from cwd / vault-bundle / __dirname and bailed if none
+  // had src/. npm-global installs have NO src/ on disk (the CLI is just the
+  // published install.js), so every npm-global user hit "Can't find Mover OS
+  // source" and could never sync. Mirror cmdUpdateComprehensive: if a license
+  // key is available, download the payload to ~/.mover and use that as the
+  // source. Only bail when there is no disk source AND no key to download with.
+  if (!bundleDir) {
+    const key = opts.key || cfg.licenseKey;
+    if (key) {
+      const dlSp = spinner("Downloading Mover OS");
+      try {
+        bundleDir = await downloadPayload(key);
+        dlSp.stop(green("Downloaded"));
+        barLn();
+      } catch (err) {
+        dlSp.stop(red("Download failed"));
+        barLn(yellow(`  ${err.message}`));
+        return;
+      }
+    } else {
+      barLn(yellow("  Can't find Mover OS source on disk, and no license key to download it."));
+      barLn(dim("  Run from the bundle directory, or set a license key (moveros install) so sync can fetch the payload."));
+      return;
+    }
+  }
 
   // Compare source hash vs installed for each agent
   const srcRulesHash = (() => {
@@ -4686,13 +6272,22 @@ async function cmdSync(opts) {
 // ─── moveros replay ─────────────────────────────────────────────────────────
 async function cmdReplay(opts) {
   const vault = requireVault(opts.vault);
+  if (!vault) return;
 
   const engineDir = path.join(vault, "02_Areas", "Engine");
   let dateStr = opts.rest.find((a) => a.startsWith("--date="))?.split("=")[1];
   let targetDate;
   if (dateStr) {
-    const [y, m, d] = dateStr.split("-").map(Number);
-    targetDate = new Date(y, m - 1, d);
+    // terra read F7: `new Date(2026, 1, 31)` rolls over to Mar 3, so an impossible
+    // date replayed a DIFFERENT day under a false label. Validate the round-trip
+    // and reject a rollover.
+    const m2 = /^(\d{4})-(\d{2})-(\d{2})$/.exec(dateStr);
+    const [y, mo, d] = m2 ? m2.slice(1).map(Number) : [NaN, NaN, NaN];
+    targetDate = m2 ? new Date(y, mo - 1, d) : new Date("invalid");
+    if (!m2 || targetDate.getFullYear() !== y || targetDate.getMonth() !== mo - 1 || targetDate.getDate() !== d) {
+      barLn(red(`  Invalid date: ${dateStr}. Use a real YYYY-MM-DD.`));
+      return;
+    }
   } else {
     targetDate = getSessionDate();
     const y = targetDate.getFullYear();
@@ -4738,7 +6333,8 @@ async function cmdReplay(opts) {
   const taskSection = daily.match(/##\s*Tasks[\s\S]*?(?=\n##)/i);
   if (taskSection) {
     const tasks = taskSection[0].split("\n").filter((l) => /^\s*-\s*\[[ x~]\]/.test(l));
-    const done = tasks.filter((t) => /\[x\]|\[~\]/.test(t)).length;
+    // terra read F10: only [x] is complete; [~] is unverified (global rule S5).
+    const done = tasks.filter((t) => /^\s*-\s*\[x\]/.test(t)).length;
     barLn(`  ${progressBar(done, tasks.length, 25, "Completion")}`);
     barLn();
   }
@@ -4748,15 +6344,38 @@ async function cmdReplay(opts) {
 }
 
 // ─── moveros context ────────────────────────────────────────────────────────
+// terra read F4: `reg.hooks.events` does not exist on the registry, so context
+// always showed "0 events" / "? hook events". Parse the agent's actual hook
+// config and return the event names. null = not found / unreadable.
+function agentHookEvents(reg, vault, home) {
+  try {
+    let p = null;
+    if (reg && reg.hooks && reg.hooks.dest) p = reg.hooks.dest(vault);
+    else if (reg && reg.hooks && reg.hooks.type === "claude-settings") p = path.join(home, ".claude", "settings.json");
+    if (!p || !fs.existsSync(p)) return null;
+    const obj = JSON.parse(fs.readFileSync(p, "utf8"));
+    // Hooks live at the top level (agent hooks.json) or under `.hooks` (settings.json).
+    const h = (obj && obj.hooks && typeof obj.hooks === "object") ? obj.hooks : obj;
+    if (!h || typeof h !== "object") return null;
+    return Object.keys(h).filter((k) => /^[A-Z][A-Za-z]/.test(k) && (Array.isArray(h[k]) || (h[k] && typeof h[k] === "object")));
+  } catch { return null; }
+}
+
 async function cmdContext(opts) {
   const vault = requireVault(opts.vault);
+  if (!vault) return;
 
   const target = opts.rest[0];
   const home = os.homedir();
   const cfgPath = path.join(home, ".mover", "config.json");
-  const agents = fs.existsSync(cfgPath)
-    ? (JSON.parse(fs.readFileSync(cfgPath, "utf8")).agents || [])
-    : [];
+  // terra read F9: a malformed config.json crashed `moveros context` (an unguarded
+  // JSON.parse) — exactly when config corruption most needs diagnosing. Degrade to
+  // an empty agent list, mirroring doctor.
+  let agents = [];
+  if (fs.existsSync(cfgPath)) {
+    try { agents = JSON.parse(fs.readFileSync(cfgPath, "utf8")).agents || []; }
+    catch { barLn(yellow("  ~/.mover/config.json is not valid JSON — showing no agents.")); }
+  }
 
   if (!target) {
     // Overview: show what each agent actually loads
@@ -4804,8 +6423,8 @@ async function cmdContext(opts) {
         }
       }
 
-      // Hooks
-      if (reg.hooks) parts.push(`${reg.hooks.events?.length || "?"} hook events`);
+      // Hooks (terra read F4: parse the real config)
+      if (reg.hooks) { const ev = agentHookEvents(reg, vault, home); parts.push(ev ? `${ev.length} hook events` : "no hooks"); }
 
       const tokens = Math.round(totalBytes / 4);
       const tokenWarn = tokens > 40000 ? red("heavy") : tokens > 20000 ? yellow("moderate") : green("lean");
@@ -4890,11 +6509,12 @@ async function cmdContext(opts) {
     }
   }
 
-  // Hooks
+  // Hooks (terra read F4: parse the real config, not the nonexistent reg.hooks.events)
   if (reg.hooks) {
     barLn();
-    statusLine("ok", "Hooks", `${reg.hooks.events?.length || 0} events`);
-    if (reg.hooks.events) barLn(dim(`         ${reg.hooks.events.join(", ")}`));
+    const ev = agentHookEvents(reg, vault, home);
+    statusLine(ev && ev.length ? "ok" : "warn", "Hooks", ev ? `${ev.length} events` : "not configured");
+    if (ev && ev.length) barLn(dim(`         ${ev.join(", ")}`));
   }
 
   // Token budget summary
@@ -5202,7 +6822,10 @@ async function cmdSettings(opts) {
 
 // ─── moveros backup ─────────────────────────────────────────────────────────
 async function cmdBackup(opts) {
-  const vault = requireVault(opts.vault);
+  // Writes archives derived from the vault; backing up a non-install is a
+  // meaningless artifact from a possibly wrong --vault (sol re-score #3).
+  const vault = requireInstalledVault(opts.vault);
+  if (!vault) return;
   const home = os.homedir();
 
   barLn(bold("  Backup"));
@@ -5218,8 +6841,14 @@ async function cmdBackup(opts) {
   if (!choices || choices.length === 0) { barLn(dim("  Cancelled.")); return; }
 
   const now = new Date();
-  const ts = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")}_${String(now.getHours()).padStart(2, "0")}${String(now.getMinutes()).padStart(2, "0")}`;
+  // terra CLI F5: minute precision meant two backups in the same minute reused
+  // one dir and the second SILENTLY OVERWROTE the first snapshot (losing the only
+  // good restore point). Add seconds + a random suffix so every backup is a
+  // distinct dir, and fail closed if it somehow already exists.
+  const secs = String(now.getSeconds()).padStart(2, "0");
+  const ts = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")}_${String(now.getHours()).padStart(2, "0")}${String(now.getMinutes()).padStart(2, "0")}${secs}_${crypto.randomBytes(2).toString("hex")}`;
   const backupDir = path.join(vault, "04_Archives", `Backup_${ts}`);
+  if (fs.existsSync(backupDir)) { outro(red("Backup directory collision; try again.")); return; }
   fs.mkdirSync(backupDir, { recursive: true });
 
   const manifest = { timestamp: now.toISOString(), type: "manual", trigger: "moveros backup", categories: choices, files: {} };
@@ -5297,9 +6926,46 @@ async function cmdBackup(opts) {
   barLn();
 }
 
+// terra CLI F2: a restore that copies files in a loop with no rollback left
+// earlier files overwritten if a later copy failed (corrupt mixed state). Snapshot
+// each existing destination, copy all, and on ANY failure roll every destination
+// back to its snapshot (or remove a file we created). Returns the count restored.
+function restoreFilesTransactional(pairs) {
+  const snaps = [];
+  try {
+    for (const { src, dest } of pairs) {
+      fs.mkdirSync(path.dirname(dest), { recursive: true });
+      if (fs.existsSync(dest)) {
+        const bak = `${dest}.restore-bak`;
+        fs.copyFileSync(dest, bak);
+        snaps.push({ dest, bak, had: true });
+      } else {
+        snaps.push({ dest, bak: null, had: false });
+      }
+      fs.copyFileSync(src, dest);
+    }
+    for (const s of snaps) if (s.bak) { try { fs.unlinkSync(s.bak); } catch {} }
+    return pairs.length;
+  } catch (e) {
+    for (const s of snaps) {
+      try {
+        if (s.had && s.bak) fs.copyFileSync(s.bak, s.dest);
+        else if (!s.had) { try { fs.unlinkSync(s.dest); } catch {} }
+      } catch {}
+      if (s.bak) { try { fs.unlinkSync(s.bak); } catch {} }
+    }
+    throw e;
+  }
+}
+
 // ─── moveros restore ────────────────────────────────────────────────────────
 async function cmdRestore(opts) {
-  const vault = requireVault(opts.vault);
+  // Writes INTO the vault — a typo'd --vault would dump restored files into
+  // an unrelated directory, so the one install invariant gates it (sol
+  // re-score #3). Recovery of a vault whose marker itself was lost goes
+  // through moveros install first, which recreates the marker.
+  const vault = requireInstalledVault(opts.vault);
+  if (!vault) return;
 
   const archivesDir = path.join(vault, "04_Archives");
   if (!fs.existsSync(archivesDir)) { barLn(yellow("  No archives found.")); return; }
@@ -5331,8 +6997,21 @@ async function cmdRestore(opts) {
     return { id: b, name: b, tier: detail || dim("legacy backup") };
   });
 
-  const selected = await interactiveSelect(items, { multi: false });
-  if (!selected) { barLn(dim("  Cancelled.")); return; }
+  // terra CLI F1: a non-TTY restore must NOT silently pick the newest backup and
+  // overwrite live (possibly newer) files. Require an explicit backup name AND
+  // --confirm; otherwise refuse and show how.
+  let selected;
+  if (!IS_TTY) {
+    const explicit = opts.rest.find((a) => backups.includes(a));
+    if (!explicit || !opts.rest.includes("--confirm")) {
+      outro(red(`Non-interactive restore needs an explicit backup and --confirm:\n  moveros restore <${backups[0] || "Backup_..."}> --confirm`));
+      return;
+    }
+    selected = explicit;
+  } else {
+    selected = await interactiveSelect(items, { multi: false });
+    if (!selected) { barLn(dim("  Cancelled.")); return; }
+  }
 
   const backupPath = path.join(archivesDir, selected);
 
@@ -5375,28 +7054,42 @@ async function cmdRestore(opts) {
     statusLine("ok", "Agents", `${agentCount} items restored`);
     totalRestored = agentCount;
   } else {
-    // Engine backup (Engine_Backup_ or legacy Backup_)
+    // A Backup_* dir can hold engine/ (Engine backup), areas/ (Full Areas backup,
+    // terra CLI F3 — the old code knew only engine/ or loose .md and silently
+    // restored NOTHING for an areas/ backup), or loose .md (legacy). Build the
+    // src->dest pairs, then restore transactionally (F2).
+    const engineDir = path.join(vault, "02_Areas", "Engine");
+    const areasSrc = path.join(backupPath, "areas");
     const engPath = path.join(backupPath, "engine");
-    if (fs.existsSync(engPath)) {
-      const engineDir = path.join(vault, "02_Areas", "Engine");
-      let restored = 0;
+    const pairs = [];
+    let label = "Engine";
+    if (fs.existsSync(areasSrc)) {
+      const areasTarget = path.join(vault, "02_Areas");
+      const walk = (dir, rel) => {
+        for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+          if (e.isDirectory()) walk(path.join(dir, e.name), path.join(rel, e.name));
+          else pairs.push({ src: path.join(dir, e.name), dest: path.join(areasTarget, rel, e.name) });
+        }
+      };
+      walk(areasSrc, "");
+      label = "Areas";
+    } else if (fs.existsSync(engPath)) {
       for (const f of fs.readdirSync(engPath).filter((f) => fs.statSync(path.join(engPath, f)).isFile())) {
-        fs.copyFileSync(path.join(engPath, f), path.join(engineDir, f));
-        restored++;
+        pairs.push({ src: path.join(engPath, f), dest: path.join(engineDir, f) });
       }
-      statusLine("ok", "Engine", `${restored} files restored`);
-      totalRestored = restored;
     } else {
-      // Legacy backup format (files directly in backup dir)
-      const engineDir = path.join(vault, "02_Areas", "Engine");
-      let restored = 0;
       for (const f of fs.readdirSync(backupPath).filter((f) => f.endsWith(".md") && f !== ".backup-manifest.json")) {
-        fs.copyFileSync(path.join(backupPath, f), path.join(engineDir, f));
-        restored++;
+        pairs.push({ src: path.join(backupPath, f), dest: path.join(engineDir, f) });
       }
-      if (restored > 0) statusLine("ok", "Engine", `${restored} files restored`);
-      totalRestored = restored;
     }
+    try {
+      totalRestored = restoreFilesTransactional(pairs);
+    } catch (e) {
+      outro(red(`Restore failed and was rolled back (no partial state): ${e && e.message}`));
+      return;
+    }
+    if (totalRestored > 0) statusLine("ok", label, `${totalRestored} files restored`);
+    else { barLn(yellow("  This backup contained no restorable files.")); return; }
   }
 
   barLn();
@@ -5435,6 +7128,9 @@ async function cmdHelp(opts) {
     w("\n");
   };
 
+  // Counts computed, never typed: this screen shipped "23 commands / 61
+  // packs / 16 agents" while the bundle held 25/70/15.
+  const inv = collectInventory();
   const pages = [
     {
       title: "What is Mover OS?",
@@ -5449,10 +7145,10 @@ async function cmdHelp(opts) {
         "",
         `${dim("Three things make it work:")}`,
         `  ${cyan("1.")} The ${bold("Engine")} — files that store your identity, strategy, goals`,
-        `  ${cyan("2.")} ${bold("Workflows")} — 23 commands that run your day (plan, build, log, repeat)`,
-        `  ${cyan("3.")} ${bold("Skills")} — 61 packs that make your AI genuinely useful`,
+        `  ${cyan("2.")} ${bold("Workflows")} — ${inv.workflows.length} commands that run your day (plan, build, log, repeat)`,
+        `  ${cyan("3.")} ${bold("Skills")} — ${inv.skills.length} packs that make your AI genuinely useful`,
         "",
-        `Works across 16 agents. Claude Code, Cursor, Gemini, all of them.`,
+        `Works across ${inv.agents.length} agents. Claude Code, Cursor, Gemini, all of them.`,
         `Same context, every editor. ${dim("Press → to continue.")}`,
       ],
     },
@@ -5593,7 +7289,7 @@ async function cmdHelp(opts) {
         `                ${dim("moveros capture --task \"Fix the login bug\"")}`,
         "",
         `  ${cyan("who")}         Entity lookup — search People, Orgs, Places`,
-        `                ${dim("moveros who \"Ishaaq\" → everything you know about them")}`,
+        `                ${dim("moveros who \"Sarah\" → everything you know about them")}`,
         "",
         `  ${cyan("prayer")}      Mosque timetable — next prayer in your status line`,
         `                ${dim("Paste or fetch. Shows countdown. Optional.")}`,
@@ -5829,8 +7525,9 @@ async function cmdMainMenu() {
 
   // Context filter: hide irrelevant commands
   const contextFilter = (cmd) => {
-    if (!hasVault && ["pulse", "replay", "diff", "sync", "capture", "who", "context", "backup", "restore", "doctor"].includes(cmd)) return false;
+    if (!hasVault && ["pulse", "open", "shortcut", "menubar", "replay", "diff", "sync", "capture", "who", "context", "backup", "restore", "doctor"].includes(cmd)) return false;
     if (!hasPrayer && cmd === "prayer") return false;
+    if (cmd === "menubar" && process.platform !== "darwin") return false;
     return true;
   };
 
@@ -5886,7 +7583,430 @@ async function cmdMainMenu() {
 }
 
 // ─── Comprehensive Update (10-step interactive) ─────────────────────────────
+// ── Update machine subcommands (local state ops: no license, no network) ────
+
+// Resolve the bundle source to verify against: the journal's staged bundleDir
+// first (verify must check the SAME source the apply stage used), then this
+// CLI's own bundle, then a downloaded payload at ~/.mover/src.
+function resolveVerifyBundleDir(journal) {
+  const candidates = [
+    journal && journal.stages && journal.stages.stage && journal.stages.stage.bundleDir,
+    __dirname,
+    path.join(os.homedir(), ".mover"),
+  ].filter(Boolean);
+  for (const c of candidates) {
+    if (fs.existsSync(path.join(c, "src", "workflows"))) return c;
+  }
+  return null;
+}
+
+// Engine migrations DECLARED per release (src/system/engine-migrations.json in
+// the bundle). Finalize cross-checks the migration receipt against every
+// declaration in (fromVersion, toVersion]: an empty migrated list is only
+// valid when that window truly declares nothing (sol re-score #4 part 10:
+// "an empty migration list proves process completion rather than semantic
+// completeness"). With no journal, fromVersion is unknown and only the target
+// version's own declarations bind. MOVER_TEST_MIGRATIONS_FILE injects a
+// manifest for hermetic tests, same pattern as MOVER_TEST_CRASH_STAGE.
+function loadOwedEngineMigrations(journal, toVersion) {
+  const candidates = [];
+  if (process.env.MOVER_TEST_MIGRATIONS_FILE) candidates.push(process.env.MOVER_TEST_MIGRATIONS_FILE);
+  const bundleDir = resolveVerifyBundleDir(journal);
+  if (bundleDir) candidates.push(path.join(bundleDir, "src", "system", "engine-migrations.json"));
+  candidates.push(path.join(__dirname, "src", "system", "engine-migrations.json"));
+  for (const c of candidates) {
+    let decl;
+    try { decl = JSON.parse(fs.readFileSync(c, "utf8")).declarations; } catch { continue; }
+    if (!decl || typeof decl !== "object" || Array.isArray(decl)) continue;
+    const fromV = journal && journal.fromVersion ? String(journal.fromVersion).replace(/^[vV]/, "") : null;
+    const owed = [];
+    for (const [ver, entries] of Object.entries(decl)) {
+      const inWindow = fromV
+        ? compareVersions(ver, fromV) > 0 && compareVersions(ver, toVersion) <= 0
+        : compareVersions(ver, toVersion) === 0;
+      if (!inWindow || !Array.isArray(entries)) continue;
+      for (const e of entries) {
+        if (e && typeof e.path === "string" && e.path) owed.push({ version: ver, path: e.path, note: e.note });
+      }
+    }
+    return { owed, source: c };
+  }
+  // No manifest anywhere (an older staged payload AND a stripped CLI copy):
+  // the caller records this honestly in the journal instead of passing it
+  // off as a checked window.
+  return { owed: [], source: null };
+}
+
+// `moveros update --status`: print the journal (the machine-readable handoff
+// the /update workflow reads). Honest null when no update is in flight.
+function cmdUpdateStatus() {
+  const journal = loadUpdateJournal();
+  if (!journal) {
+    barLn(dim("  No update journal found. Nothing in progress."));
+    outro("No update in progress.");
+    return;
+  }
+  barLn(bold("  Update journal"));
+  barLn();
+  barLn(`  Run: ${journal.runId}  ${dim(`(${journal.mode})`)}`);
+  barLn(`  ${dim(journal.fromVersion || "?")} ${dim("->")} ${bold(journal.toVersion || "?")}  ${journal.completedAt ? green(journal.rolledBack ? "rolled back" : "completed") : yellow("in progress")}`);
+  barLn();
+  for (const s of UPDATE_STAGES) {
+    const st = (journal.stages && journal.stages[s]) || { status: "pending" };
+    const icon = st.status === "done" ? "ok" : st.status === "failed" ? "fail" : "warn";
+    statusLine(icon, `  ${s}`, st.status);
+  }
+  barLn();
+  barLn(dim(`  Journal: ${updateJournalPath()}`));
+  outro(journal.completedAt ? "Update complete." : "Update in progress. Finish with /update, then moveros update --finalize.");
+}
+
+// `moveros update --finalize`: the /update workflow calls this after Engine
+// migration. It records the migrate stage, VERIFIES the applied files against
+// the staged bundle, and stamps .mover-version ONLY on a pass. This is the
+// single place the interactive path is allowed to stamp, so the stamp always
+// means "verified", never "assumed".
+async function cmdUpdateFinalize(opts) {
+  const journal = loadUpdateJournal();
+  let vaultPath = journal && journal.vaultPath && fs.existsSync(journal.vaultPath) ? journal.vaultPath : resolveVaultPath(opts.vault);
+  if (!vaultPath) {
+    outro(red("No Mover OS vault found. Use: moveros update --finalize --vault /path"));
+    process.exit(EXIT.NOT_FOUND);
+  }
+  let markerOk = false;
+  try {
+    const mp = path.join(vaultPath, ".mover-version");
+    markerOk = fs.statSync(mp).isFile() && fs.readFileSync(mp, "utf8").trim().length > 0;
+  } catch {}
+  if (!markerOk) {
+    outro(red(`No Mover OS install found at ${vaultPath}. Nothing to finalize.`));
+    process.exit(EXIT.NOT_FOUND);
+  }
+
+  const j = journal || newUpdateJournal("finalize", null, require("./package.json").version, vaultPath);
+
+  // MIGRATION RECEIPT (sol re-score #3 refutation: finalize marked migrate
+  // done without verifying any Engine migration happened). The /update
+  // workflow writes ~/.mover/update-receipt.json AFTER its Engine steps:
+  //   { runId, toVersion, migrated: [{path, sha256}], checked: [paths], note }
+  // runId comes from the journal (~/.mover/update-state.json); null when no
+  // journal existed. migrated may be EMPTY (no migration owed this release)
+  // but the receipt itself is mandatory, and every migrated file must still
+  // be on disk with the recorded post-migration hash - proof the work
+  // happened and survived. Fail-closed: no receipt, no stamp.
+  const receiptPath = path.join(os.homedir(), ".mover", "update-receipt.json");
+  let receipt = null;
+  try { receipt = JSON.parse(fs.readFileSync(receiptPath, "utf8")); } catch {}
+  const expectVersion = (j.toVersion || require("./package.json").version).replace(/^V/i, "");
+  const receiptProblems = [];
+  const owedMigrations = loadOwedEngineMigrations(journal, expectVersion);
+  if (!receipt) {
+    receiptProblems.push(`missing or unreadable: ${receiptPath}`);
+  } else {
+    const expectedRunId = journal ? journal.runId : null;
+    if ((receipt.runId || null) !== expectedRunId) receiptProblems.push(`runId ${JSON.stringify(receipt.runId || null)} does not match this run ${JSON.stringify(expectedRunId)}`);
+    if (String(receipt.toVersion || "").replace(/^V/i, "") !== expectVersion) receiptProblems.push(`toVersion ${JSON.stringify(receipt.toVersion)} does not match ${expectVersion}`);
+    // Receipt paths must stay INSIDE the vault. Lexical checks (absolute,
+    // ..-traversal) are not enough: a symlink WITHIN the vault pointing
+    // outside would pass lexically but resolve elsewhere (sol re-score #5
+    // refutation). resolveContained realpath-resolves both the vault root and
+    // the entry and requires the entry to remain beneath the resolved root,
+    // so a symlink escape is rejected. Returns the real absolute path or null.
+    let realVaultRoot = null;
+    try { realVaultRoot = fs.realpathSync(vaultPath); } catch { realVaultRoot = path.resolve(vaultPath); }
+    const resolveContained = (rel) => {
+      if (typeof rel !== "string" || rel.length === 0) return { err: "path is empty" };
+      if (path.isAbsolute(rel) || rel.split(/[\\/]+/).includes("..")) return { err: "must be vault-relative without traversal" };
+      const joined = path.join(vaultPath, rel);
+      let real;
+      try { real = fs.realpathSync(joined); } catch (e) { return { err: e.code === "ENOENT" ? "does not exist in the vault" : "not resolvable on disk" }; }
+      const prefix = realVaultRoot.endsWith(path.sep) ? realVaultRoot : realVaultRoot + path.sep;
+      if (real !== realVaultRoot && !real.startsWith(prefix)) return { err: "resolves outside the vault (symlink escape)" };
+      return { abs: real };
+    };
+    if (!Array.isArray(receipt.migrated)) {
+      receiptProblems.push("migrated must be an array ([] is valid when no migration was owed)");
+    } else {
+      for (const m of receipt.migrated) {
+        const rel = m && m.path;
+        if (typeof rel !== "string" || !rel) { receiptProblems.push("a migrated entry has no path"); continue; }
+        const c = resolveContained(rel);
+        if (c.err) { receiptProblems.push(`${rel}: migrated path ${c.err}`); continue; }
+        try {
+          const actual = require("crypto").createHash("sha256").update(fs.readFileSync(c.abs, "utf8").replace(/\r\n/g, "\n")).digest("hex");
+          if (actual !== m.sha256) receiptProblems.push(`${rel}: on-disk hash does not match the receipt (file changed or migration reverted)`);
+        } catch {
+          receiptProblems.push(`${rel}: listed as migrated but not readable on disk`);
+        }
+      }
+      // SEMANTIC COMPLETENESS: the receipt must cover every Engine migration
+      // this release window DECLARES (src/system/engine-migrations.json). An
+      // empty migrated list stops meaning "the process ran" and starts
+      // meaning "this window declares nothing owed". FAIL-CLOSED when the
+      // manifest cannot be found (sol re-score #5 refutation: recording
+      // "unavailable" and proceeding with zero owed migrations let a stripped
+      // bundle skip the check silently; a missing declaration source is a
+      // refusal, not a pass).
+      if (!owedMigrations.source) {
+        receiptProblems.push("engine-migrations.json is unavailable in every bundle source: cannot prove the release owes no migration (fail-closed)");
+      }
+      const migratedPaths = new Set(receipt.migrated.map((m) => m && m.path).filter(Boolean));
+      for (const d of owedMigrations.owed) {
+        if (!migratedPaths.has(d.path)) {
+          receiptProblems.push(`${d.path}: declared as owed by release ${d.version}${d.note ? ` (${d.note})` : ""} but absent from the receipt's migrated list`);
+        }
+      }
+      // `checked` is the workflow's claim of what it INSPECTED - the basis for
+      // "no (further) migration owed". The inspection itself cannot be
+      // re-verified, but the claim can: every named file must actually exist
+      // in the vault, and an empty-migration receipt must name at least one
+      // inspected file (sol re-score #4: the field was counted in the journal
+      // but never validated, so a fabricated receipt passed the gate).
+      if (!Array.isArray(receipt.checked)) {
+        receiptProblems.push("checked must be an array of vault-relative paths");
+      } else {
+        if (receipt.migrated.length === 0 && receipt.checked.length === 0) {
+          receiptProblems.push("migrated is empty and checked is empty: name the files you inspected to conclude no migration was owed");
+        }
+        for (const rel of receipt.checked) {
+          const c = resolveContained(rel);
+          if (c.err) { receiptProblems.push(`${JSON.stringify(rel)}: checked path ${c.err}`); continue; }
+          try {
+            if (!fs.statSync(c.abs).isFile()) receiptProblems.push(`${rel}: listed as checked but is not a file`);
+          } catch {
+            receiptProblems.push(`${rel}: listed as checked but does not exist in the vault`);
+          }
+        }
+      }
+    }
+  }
+  if (receiptProblems.length) {
+    journalStage(j, "migrate", "failed", { problems: receiptProblems.slice(0, 20) });
+    barLn(red("  Migration receipt check failed:"));
+    for (const p of receiptProblems.slice(0, 8)) barLn(`    ${red("x")} ${p}`);
+    barLn();
+    barLn(dim("  /update must write ~/.mover/update-receipt.json after its Engine"));
+    barLn(dim("  migration steps: { runId (from ~/.mover/update-state.json, or null),"));
+    barLn(dim("  toVersion, migrated: [{path, sha256}], checked: [paths] }."));
+    barLn(dim("  An empty migrated array is valid when no migration was owed,"));
+    barLn(dim("  but then checked must name the real vault files you inspected."));
+    outro(red("Not stamped: no verifiable migration receipt."));
+    process.exit(EXIT.ERROR);
+  }
+  // MACHINE-DERIVED inspection evidence (sol re-score #6 part 10: "checked
+  // remains a workflow-authored inspection claim; make inspection evidence
+  // machine-derived"). Rather than trusting only the workflow's `checked`
+  // list, finalize independently OBSERVES the Engine directory: it lists the
+  // top-level Engine files (skipping Dailies and other subfolders) with a
+  // content hash each, and confirms every `checked` entry that lives under
+  // Engine is corroborated by that observation. The observed set is recorded
+  // in the journal, so the audit trail carries machine-witnessed evidence of
+  // the Engine state at stamp time, not a self-reported claim.
+  const engineObserved = (() => {
+    const engineDir = path.join(vaultPath, "02_Areas", "Engine");
+    // Origin classification (sol #8 part 10 residual: "checked records
+    // workflow-authored inspection evidence that cannot be reconstructed
+    // mechanically"). The shipped-default fingerprint set (every historical
+    // hash of each non-sentinel Engine default) lets the MACHINE reconstruct
+    // the inspection's basis: a file either matches a shipped default
+    // byte-for-byte (nothing to migrate), or is user-modified (migration
+    // decisions concern it), or is outside the shipped set entirely
+    // (sentinels + user-created files). Recorded per file in the journal, so
+    // the audit trail carries the machine's own classification, not only the
+    // workflow's word.
+    let fingerprints = null;
+    try { fingerprints = JSON.parse(fs.readFileSync(path.join(__dirname, "src", "dashboard", "lib", "engine-default-fingerprints.json"), "utf8")).files; } catch {}
+    const fpHash = (text) => require("crypto").createHash("sha256").update(String(text).replace(/\r\n/g, "\n").trim()).digest("hex");
+    try {
+      const files = fs.readdirSync(engineDir, { withFileTypes: true })
+        .filter((e) => e.isFile() && e.name.endsWith(".md"))
+        .map((e) => {
+          const rel = path.join("02_Areas", "Engine", e.name);
+          let sha = null;
+          let origin = "unclassified";
+          try {
+            const text = fs.readFileSync(path.join(engineDir, e.name), "utf8");
+            sha = require("crypto").createHash("sha256").update(text.replace(/\r\n/g, "\n")).digest("hex").slice(0, 16);
+            if (fingerprints) {
+              const known = fingerprints[e.name];
+              origin = Array.isArray(known)
+                ? (known.includes(fpHash(text)) ? "matches-shipped-default" : "user-modified")
+                : "not-a-shipped-default"; // sentinels + user-created files
+            }
+          } catch {}
+          return { path: rel, sha, origin };
+        });
+      return { present: true, count: files.length, files, fingerprintSource: fingerprints ? "engine-default-fingerprints.json" : "unavailable" };
+    } catch {
+      return { present: false, count: 0, files: [], fingerprintSource: fingerprints ? "engine-default-fingerprints.json" : "unavailable" };
+    }
+  })();
+  // Corroborate: any `checked` entry that claims an Engine file must appear in
+  // the machine-observed set. A claim about an Engine file the machine cannot
+  // see is a fabricated inspection, caught here rather than trusted.
+  const observedEngine = new Set(engineObserved.files.map((f) => f.path.split(path.sep).join("/")));
+  const uncorroborated = receipt.checked
+    .map((r) => String(r).split(path.sep).join("/"))
+    .filter((r) => r.startsWith("02_Areas/Engine/") && !r.includes("/Dailies/") && !observedEngine.has(r));
+  if (uncorroborated.length && engineObserved.present) {
+    journalStage(j, "migrate", "failed", { problems: uncorroborated.map((r) => `${r}: checked as an Engine file but not observed in the Engine directory (fabricated inspection)`) });
+    barLn(red("  Migration receipt check failed (machine corroboration):"));
+    for (const r of uncorroborated.slice(0, 8)) barLn(`    ${red("x")} ${r}: not observed in the Engine directory`);
+    outro(red("Not stamped: a checked Engine file was not machine-corroborated."));
+    process.exit(EXIT.ERROR);
+  }
+  journalStage(j, "migrate", "done", {
+    owner: "workflow",
+    finalizedBy: "moveros update --finalize",
+    receipt: { migrated: receipt.migrated.length, checked: receipt.checked.length },
+    // "unavailable" = no declarations manifest found in any bundle source;
+    // recorded rather than passed off as a checked window.
+    migrations: { manifest: owedMigrations.source ? "checked" : "unavailable", declaredOwed: owedMigrations.owed.length },
+    // Machine-witnessed Engine state at stamp time (independent of the
+    // workflow's `checked` claim).
+    engineObserved,
+  });
+  maybeCrashForTest("migrate");
+  journalStage(j, "verify", "started");
+  maybeCrashForTest("verify");
+
+  const bundleDir = resolveVerifyBundleDir(j);
+  let result;
+  let scope;
+  if (bundleDir) {
+    scope = "full";
+    result = verifyUpdateApplied(bundleDir, vaultPath, { templates: "content" });
+  } else {
+    // No source available to verify against (e.g. an Engine-only migration
+    // with no staged payload). Degrade honestly to the conflicts gate; never
+    // fabricate a full verification.
+    scope = "conflicts-only";
+    result = { ok: true, failures: [] };
+    const conflictsPath = path.join(os.homedir(), ".mover", "conflicts.json");
+    if (fs.existsSync(conflictsPath)) {
+      try {
+        const data = JSON.parse(fs.readFileSync(conflictsPath, "utf8"));
+        result.failures = (data.files || []).map((f) => ({ file: f.file, reason: "unresolved-conflict" }));
+      } catch {
+        result.failures = [{ file: "conflicts.json", reason: "unreadable" }];
+      }
+      result.ok = result.failures.length === 0;
+    }
+  }
+
+  if (!result.ok) {
+    journalStage(j, "verify", "failed", { scope, failures: result.failures.slice(0, 50) });
+    barLn(red(`  Verification failed: ${result.failures.length} file${result.failures.length > 1 ? "s" : ""} not at the updated version.`));
+    for (const f of result.failures.slice(0, 12)) barLn(`    ${red("x")} ${f.file} ${dim(`(${f.reason})`)}`);
+    if (result.failures.length > 12) barLn(dim(`    ...and ${result.failures.length - 12} more`));
+    barLn();
+    barLn(dim("  The version was NOT stamped. Resolve the files above"));
+    barLn(dim("  (usually: re-run moveros update, or finish /update conflict merges),"));
+    barLn(dim("  then run moveros update --finalize again."));
+    outro(red("Not stamped: verification failed."));
+    process.exit(EXIT.ERROR);
+  }
+
+  journalStage(j, "verify", "done", { scope, checkedAgainst: bundleDir || null });
+  journalStage(j, "stamp", "started");
+  maybeCrashForTest("stamp");
+  const version = (j.toVersion || require("./package.json").version).replace(/^V/i, "");
+  fs.writeFileSync(path.join(vaultPath, ".mover-version"), `${version}\n`, "utf8");
+  j.completedAt = new Date().toISOString();
+  journalStage(j, "stamp", "done", { version });
+  // Consume the receipt: a stamped run's receipt must never validate a
+  // FUTURE finalize (the null-journal path has no runId to collide on).
+  try { fs.renameSync(receiptPath, `${receiptPath.replace(/\.json$/, "")}.used.json`); } catch {}
+  statusLine("ok", "Verified", scope === "full" ? "workflows, templates, hooks all at the updated version" : "no unresolved conflicts");
+  statusLine("ok", "Stamped", `.mover-version -> ${version}`);
+  outro(green(`Update finalized: verified and stamped ${version}.`));
+}
+
+// `moveros update --rollback`: restore the vault + agent artifacts from the
+// backup recorded in the journal (or the newest rollback-capable backup).
+// Never touches the bundle dir: on npm installs that is a read-only global
+// package, and it is not the rollback target anyway. Engine files are never
+// in these backups, so they are never touched here either.
+async function cmdUpdateRollback(opts) {
+  const home = os.homedir();
+  const journal = loadUpdateJournal();
+  let backupDir = journal && journal.stages && journal.stages.backup && journal.stages.backup.backupDir;
+  const dirArg = opts.rest.find((a) => a.startsWith("--dir="));
+  if (dirArg) backupDir = path.resolve(dirArg.slice(6));
+  if (!backupDir || !fs.existsSync(path.join(backupDir, "backup-manifest.json"))) {
+    const root = path.join(home, ".mover", "backups");
+    const cands = fs.existsSync(root)
+      ? fs.readdirSync(root).filter((d) => d.startsWith("pre-update-") && fs.existsSync(path.join(root, d, "backup-manifest.json"))).sort()
+      : [];
+    if (cands.length) backupDir = path.join(root, cands[cands.length - 1]);
+  }
+  if (!backupDir || !fs.existsSync(path.join(backupDir, "backup-manifest.json"))) {
+    barLn(red("  No rollback-capable backup found (backup-manifest.json missing)."));
+    barLn(dim("  Backups made before this feature can be restored by hand from ~/.mover/backups/."));
+    outro(red("Rollback aborted: nothing to restore from."));
+    process.exit(EXIT.NOT_FOUND);
+  }
+
+  let bm;
+  try {
+    bm = JSON.parse(fs.readFileSync(path.join(backupDir, "backup-manifest.json"), "utf8"));
+  } catch {
+    outro(red("Rollback aborted: backup-manifest.json is unreadable."));
+    process.exit(EXIT.ERROR);
+  }
+
+  let restored = 0, removed = 0, failed = 0;
+  for (const e of bm.entries || []) {
+    try {
+      if (e.existedBefore && e.backup) {
+        const src = path.join(backupDir, e.backup);
+        if (!fs.existsSync(src)) { failed++; continue; }
+        fs.mkdirSync(path.dirname(e.original), { recursive: true });
+        // Unlink first: the original may be a hard link into the bundle
+        // source; copying through the link would write INTO the (possibly
+        // read-only, npm-owned) bundle. A fresh inode never can.
+        try { fs.rmSync(e.original, { force: true }); } catch {}
+        fs.copyFileSync(src, e.original);
+        restored++;
+      } else if (!e.existedBefore) {
+        if (fs.existsSync(e.original)) { fs.rmSync(e.original, { force: true }); removed++; }
+      }
+    } catch {
+      failed++;
+    }
+  }
+
+  // Restore the pristine base snapshots captured with the backup so the next
+  // update classifies the rolled-back files against the right bases.
+  try {
+    const snapInstalled = path.join(backupDir, "mover-state", "installed");
+    if (fs.existsSync(snapInstalled)) {
+      fs.cpSync(snapInstalled, path.join(home, ".mover", "installed"), { recursive: true, force: true });
+    }
+  } catch {}
+  // Conflicts recorded by the rolled-back run are void now.
+  try { fs.rmSync(path.join(home, ".mover", "conflicts.json"), { force: true }); } catch {}
+
+  if (journal && !journal.completedAt) {
+    journal.rolledBack = true;
+    journal.completedAt = new Date().toISOString();
+    saveUpdateJournal(journal);
+  }
+
+  statusLine("ok", "Rollback", `${restored} restored, ${removed} removed${failed ? `, ${red(`${failed} failed`)}` : ""}`);
+  barLn(dim(`  From: ${backupDir}`));
+  barLn(dim("  Engine files were never in this backup and were not touched."));
+  barLn(dim("  The version marker was not changed (interactive updates never stamp before verify)."));
+  outro(failed ? yellow(`Rollback finished with ${failed} failure${failed > 1 ? "s" : ""}.`) : green("Rollback complete."));
+  if (failed) process.exit(EXIT.ERROR);
+}
+
 async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
+  // ── State-machine subcommands: local, no license, no self-update hop ──
+  if (opts.rest.includes("--status")) return cmdUpdateStatus();
+  if (opts.rest.includes("--finalize")) return cmdUpdateFinalize(opts);
+  if (opts.rest.includes("--rollback")) return cmdUpdateRollback(opts);
+
   const isQuick = opts.rest.includes("--quick");
 
   // Step 1: CLI Self-Update
@@ -5910,8 +8030,10 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
         try {
           try {
             execSync("npm i -g mover-os", { stdio: "ignore", timeout: 60000 });
-          } catch {
-            // Retry with sudo — use inherit so password prompt shows
+          } catch (err) {
+            // Retry with sudo — use inherit so password prompt shows.
+            // sudo does not exist on Windows; surface the real npm error there.
+            if (process.platform === "win32") throw err;
             sp.stop(dim("Needs elevated permissions..."));
             execSync("sudo npm i -g mover-os", { stdio: "inherit", timeout: 120000 });
           }
@@ -5946,6 +8068,22 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
   }
   statusLine("ok", "Vault", path.basename(vaultPath));
 
+  // An update must target an EXISTING install. resolveVaultPath trusts an
+  // explicit --vault without existsSync (terra F5), so a typo'd or wrong path
+  // would otherwise get a fresh structure minted and stamped as "current",
+  // shadowing the real install. Refuse unless a real, non-empty install marker
+  // is present (sol flaw #5: an empty file or a directory named .mover-version
+  // must not pass the guard).
+  let installMarkerOk = false;
+  try {
+    const mp = path.join(vaultPath, ".mover-version");
+    installMarkerOk = fs.statSync(mp).isFile() && fs.readFileSync(mp, "utf8").trim().length > 0;
+  } catch {}
+  if (!installMarkerOk) {
+    outro(red(`No Mover OS install found at ${vaultPath}. Run ${bold("moveros install")} first, or pass the correct --vault.`));
+    process.exit(EXIT.NOT_FOUND);
+  }
+
   // Step 3: Key Validation
   let updateKey = opts.key;
   if (!updateKey) {
@@ -6003,9 +8141,24 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
     newVer = pkg.version || newVer;
   } catch {}
 
-  // ── Stage only — no direct file overwrite ──
-  // Files are staged at ~/.mover/src/. The /update AI workflow handles
-  // the actual apply with merge support for user customizations.
+  // ── Update journal: ONE resumable state machine for CLI + /update ──
+  // Created here, after preflight facts (install marker, license, staged
+  // bundle) are established. Resumes an interrupted run of the same mode and
+  // target version so the original backup dir is preserved; every stage below
+  // is idempotent, so resume = re-run from the journal.
+  const journalMode = isQuick ? "quick" : "interactive";
+  let journal = loadUpdateJournal();
+  const resuming = !!(journal && !journal.completedAt && journal.toVersion === newVer && journal.mode === journalMode && journal.vaultPath === vaultPath);
+  if (!resuming) {
+    journal = newUpdateJournal(journalMode, installedVer, newVer, vaultPath);
+  } else {
+    barLn(dim(`  Resuming interrupted update (started ${journal.startedAt}).`));
+    barLn();
+  }
+  journalStage(journal, "preflight", "done", { installMarker: true });
+  maybeCrashForTest("preflight");
+  journalStage(journal, "stage", "done", { bundleDir });
+  maybeCrashForTest("stage");
 
   const detectedAgents = AGENTS.filter((a) => a.detect());
   const selectedIds = detectedAgents.map((a) => a.id);
@@ -6016,8 +8169,34 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
     const changes = detectChanges(bundleDir, vaultPath, selectedIds);
     const totalChanged = countChanges(changes);
     displayChangeSummary(changes, installedVer, newVer);
-    if (totalChanged === 0) { outro(green("Already up to date.")); return; }
-    autoBackupBeforeUpdate(changes, selectedIds, vaultPath);
+    if (totalChanged === 0 && !resuming) {
+      // Nothing to do and no interrupted run to finish: close the journal
+      // honestly rather than leave a phantom in-progress run.
+      for (const s of ["backup", "apply", "migrate", "verify", "stamp"]) journalStage(journal, s, "skipped", { reason: "no-changes" });
+      journal.completedAt = new Date().toISOString();
+      saveUpdateJournal(journal);
+      outro(green("Already up to date."));
+      return;
+    }
+    if (totalChanged === 0 && resuming) {
+      // Resume after a crash PAST the apply stage: the files are already on
+      // disk but verify/stamp never ran. Fall through to them; re-running
+      // backup/apply on zero changes would be a no-op anyway.
+      barLn(dim("  Files already applied by the interrupted run - verifying and stamping."));
+      barLn();
+      if (journal.stages.backup.status !== "done") journalStage(journal, "backup", "skipped", { reason: "resume-no-changes" });
+      journalStage(journal, "apply", "done", { updated: 0, resumed: true });
+    }
+    if (totalChanged > 0) {
+    journalStage(journal, "backup", "started");
+    maybeCrashForTest("backup");
+    const priorBackup = resuming && journal.stages.backup && journal.stages.backup.backupDir && fs.existsSync(journal.stages.backup.backupDir)
+      ? { backupRoot: journal.stages.backup.backupDir, backed: journal.stages.backup.backed || 0 }
+      : null;
+    const bkup = priorBackup || autoBackupBeforeUpdate(changes, selectedIds, vaultPath);
+    journalStage(journal, "backup", "done", { backupDir: bkup.backupRoot, backed: bkup.backed, reused: !!priorBackup });
+    journalStage(journal, "apply", "started");
+    maybeCrashForTest("apply");
     barLn(bold("Updating..."));
     barLn();
     createVaultStructure(vaultPath);
@@ -6038,11 +8217,118 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
         sp.stop(steps.length > 0 ? `${displayName}  ${dim(steps.join(", "))}` : `${displayName}  ${dim("configured")}`);
       }
     }
+
+    // Complete Claude hook-asset refresh (6b parity with the interactive path):
+    // the .js helpers and .md prompt templates must be on disk before anything
+    // records or verifies them as current.
+    const quickHooksSrc = path.join(bundleDir, "src", "hooks");
+    const quickClaudeDetected = detectedAgents.some((a) => a.id === "claude-code");
+    if (quickClaudeDetected && fs.existsSync(quickHooksSrc)) {
+      const hooksDstClaude = path.join(os.homedir(), ".claude", "hooks");
+      fs.mkdirSync(hooksDstClaude, { recursive: true });
+      for (const f of fs.readdirSync(quickHooksSrc).filter((x) => x.endsWith(".sh"))) {
+        const content = fs.readFileSync(path.join(quickHooksSrc, f), "utf8").replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+        fs.writeFileSync(path.join(hooksDstClaude, f), content, { mode: 0o755 });
+        try { fs.chmodSync(path.join(hooksDstClaude, f), 0o755); } catch {}
+      }
+      for (const f of fs.readdirSync(quickHooksSrc).filter((x) => x.endsWith(".md") || x.endsWith(".js"))) {
+        fs.copyFileSync(path.join(quickHooksSrc, f), path.join(hooksDstClaude, f));
+      }
+    }
+
+    // Rebuild the manifest to match what force-apply actually put on disk.
+    // record-if-current: an entry asserts "the install holds this base", so
+    // record the source hash only where the destination proves it (or, for
+    // workflows, where this run just force-wrote it); otherwise carry the
+    // prior base forward (F4 discipline) so nothing uncopied is marked current.
+    try {
+      const prior = loadUpdateManifest();
+      const mfst = { version: require("./package.json").version, installedAt: new Date().toISOString(), files: {} };
+      if (prior && prior.files) Object.assign(mfst.files, prior.files);
+      const wfDir = path.join(bundleDir, "src", "workflows");
+      if (fs.existsSync(wfDir)) {
+        // Quick force-applies EVERY workflow via the agent installers (which
+        // also advance the pristine snapshots), so the source hash IS the new
+        // base for all of them. Transformed copies still classify as
+        // user-only-skip against this base, same as fresh installs.
+        for (const f of fs.readdirSync(wfDir).filter((x) => x.endsWith(".md"))) {
+          mfst.files[`workflows/${f}`] = fileContentHash(path.join(wfDir, f));
+        }
+      }
+      const rulesPath2 = path.join(bundleDir, "src", "system", "Mover_Global_Rules.md");
+      if (fs.existsSync(rulesPath2)) mfst.files["system/Mover_Global_Rules.md"] = fileContentHash(rulesPath2);
+      if (quickClaudeDetected && fs.existsSync(quickHooksSrc)) {
+        for (const f of fs.readdirSync(quickHooksSrc).filter((x) => x.endsWith(".sh") || x.endsWith(".js") || x.endsWith(".md"))) {
+          const dst = path.join(os.homedir(), ".claude", "hooks", f);
+          if (fs.existsSync(dst) && fileContentHash(dst) === fileContentHash(path.join(quickHooksSrc, f))) {
+            mfst.files[`hooks/${f}`] = fileContentHash(path.join(quickHooksSrc, f));
+          }
+        }
+      }
+      // Templates: quick installs NEW files but never overwrites existing vault
+      // scaffold files, so only record entries the disk actually holds.
+      const structDir2 = path.join(bundleDir, "src", "structure");
+      if (fs.existsSync(structDir2)) {
+        const walkT = (dir, rel) => {
+          for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            const srcPath = path.join(dir, entry.name);
+            const entryRel = path.join(rel, entry.name);
+            if (entry.isDirectory()) { walkT(srcPath, entryRel); continue; }
+            const relNorm = entryRel.replace(/\\/g, "/");
+            if (relNorm.includes("02_Areas") && relNorm.includes("Engine")) continue;
+            const destFile = path.join(vaultPath, entryRel);
+            try {
+              if (fs.existsSync(destFile) && fileContentHash(destFile) === fileContentHash(srcPath)) {
+                mfst.files[`templates/${relNorm}`] = fileContentHash(srcPath);
+              }
+            } catch {}
+          }
+        };
+        walkT(structDir2, "");
+      }
+      saveUpdateManifest(mfst);
+    } catch {}
+
+    journalStage(journal, "apply", "done", { updated: totalChanged });
+    } // end totalChanged > 0
+    journalStage(journal, "migrate", "skipped", { reason: "quick mode: run /update for Engine migrations" });
+
+    // ── Verify BEFORE the stamp: the stamp is earned, never assumed ──
+    journalStage(journal, "verify", "started");
+    maybeCrashForTest("verify");
+    const quickVerify = verifyUpdateApplied(bundleDir, vaultPath, { templates: "presence" });
+    if (!quickVerify.ok) {
+      journalStage(journal, "verify", "failed", { failures: quickVerify.failures.slice(0, 50) });
+      barLn(red(`  Verification failed: ${quickVerify.failures.length} file${quickVerify.failures.length > 1 ? "s" : ""} not at the updated version.`));
+      for (const f of quickVerify.failures.slice(0, 12)) barLn(`    ${red("x")} ${f.file} ${dim(`(${f.reason})`)}`);
+      barLn(dim("  The version was NOT stamped. Re-run moveros update --quick once the cause is resolved."));
+      outro(red("Update incomplete: verification failed, version not stamped."));
+      process.exit(EXIT.ERROR);
+    }
+    journalStage(journal, "verify", "done", { scope: "quick" });
+
+    journalStage(journal, "stamp", "started");
+    maybeCrashForTest("stamp");
     fs.writeFileSync(path.join(vaultPath, ".mover-version"), `${require("./package.json").version}\n`, "utf8");
     writeMoverConfig(vaultPath, selectedIds, updateKey);
+    journal.completedAt = new Date().toISOString();
+    journalStage(journal, "stamp", "done", { version: require("./package.json").version });
     barLn();
     if (totalChanged > 0) {
       barLn(dim("  Restart your AI session to load updated rules and skills."));
+      // v4.7.8: If Codex hooks were just installed/updated, point users at
+      // the IDE trust step. Codex IDE shows new/modified hooks as "needs
+      // review" — a security feature. CLI fires hooks fine without trust.
+      try {
+        const codexStamp = path.join(os.homedir(), ".codex", ".mover-hook-install-stamp");
+        if (selectedIds.includes("codex") && fs.existsSync(codexStamp)) {
+          const stampedAt = new Date(fs.readFileSync(codexStamp, "utf8").trim()).getTime();
+          if (Date.now() - stampedAt < 5 * 60 * 1000) {
+            barLn(dim("  Codex IDE: open Settings → Hooks, click Trust on the new entries."));
+            barLn(dim("    (One-time per hook change. CLI fires them without the trust gate.)"));
+          }
+        }
+      } catch {}
       barLn();
     }
     const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
@@ -6064,6 +8350,11 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
   if (totalChanged === 0) {
     barLn(green("  Already up to date."));
     barLn();
+    // Mechanical stages are trivially complete; Engine migration may still be
+    // owed, so migrate stays pending and /update + --finalize own the stamp.
+    journalStage(journal, "backup", "skipped", { reason: "no-changes" });
+    journalStage(journal, "apply", "done", { updated: 0 });
+    journalStage(journal, "migrate", "pending", { owner: "workflow" });
     outro(green("No changes needed. Engine files may still need migration — run /update."));
     return;
   }
@@ -6078,11 +8369,31 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
     { multi: false, defaultIndex: 0 }
   );
   if (!updateConfirm || updateConfirm === "no") {
+    // Nothing was touched: close the journal so no phantom run lingers.
+    if (!resuming) {
+      journal.cancelled = true;
+      journal.completedAt = new Date().toISOString();
+      saveUpdateJournal(journal);
+    }
     outro("Update cancelled.");
     return;
   }
   barLn();
 
+  // ── Backup stage: full pre-apply backup of every file this run will touch ──
+  // (Previously quick-only, so an interactive safe-overwrite had NO restore
+  // source. The journal keeps the ORIGINAL dir across resumes so rollback
+  // always targets the true pre-update state.)
+  journalStage(journal, "backup", "started");
+  maybeCrashForTest("backup");
+  const priorBackupI = resuming && journal.stages.backup && journal.stages.backup.backupDir && fs.existsSync(journal.stages.backup.backupDir)
+    ? { backupRoot: journal.stages.backup.backupDir, backed: journal.stages.backup.backed || 0 }
+    : null;
+  const bkupI = priorBackupI || autoBackupBeforeUpdate(changes, selectedIds, vaultPath);
+  journalStage(journal, "backup", "done", { backupDir: bkupI.backupRoot, backed: bkupI.backed, reused: !!priorBackupI });
+  journalStage(journal, "apply", "started");
+  maybeCrashForTest("apply");
+
   // ── Apply safe system files directly (no user customizations in these) ──
   const home = os.homedir();
   let appliedCount = 0;
@@ -6108,14 +8419,18 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
   if (fs.existsSync(slSrc)) {
     const slContent = fs.readFileSync(slSrc, "utf8").replace(/\r\n/g, "\n");
     fs.writeFileSync(slDest, slContent, "utf8");
-    // Ensure settings.json has statusLine config
+    // Ensure settings.json has statusLine config. Absolute forward-slash
+    // path, never `~` — cmd.exe does not expand tildes (Windows dead-hook
+    // bug class). Also migrate an existing `~` form left by old installs.
     const globalSettings = path.join(home, ".claude", "settings.json");
+    const slCmd = `node "${slDest.replace(/\\/g, "/")}"`;
     try {
       const settings = fs.existsSync(globalSettings)
         ? JSON.parse(fs.readFileSync(globalSettings, "utf8"))
         : {};
-      if (!settings.statusLine) {
-        settings.statusLine = { type: "command", command: "node ~/.claude/statusline.js" };
+      const cur = settings.statusLine && settings.statusLine.command;
+      if (!settings.statusLine || /~\/\.claude\/statusline\.js/.test(String(cur || ""))) {
+        settings.statusLine = { type: "command", command: slCmd };
         fs.writeFileSync(globalSettings, JSON.stringify(settings, null, 2), "utf8");
       }
     } catch {}
@@ -6134,7 +8449,17 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
     for (const dir of cmdDirs) {
       const dest = path.join(dir, "update.md");
       if (fs.existsSync(dir)) {
-        fs.copyFileSync(updateSrc, dest);
+        // Gap-1: route through the vault-resolution transform. For bodies that
+        // don't need it (returns false), replace the dest ATOMICALLY via
+        // same-dir temp + rename: a plain copyFileSync would write THROUGH the
+        // install-time hard link into the bundle source, which on an npm
+        // global install is read-only (EACCES; caught by the update-machine
+        // read-only-bundle test) and on a repo install would corrupt src/.
+        if (!writeWorkflowTransformed(updateSrc, dest)) {
+          const tmp = dest + ".tmp-" + process.pid;
+          fs.copyFileSync(updateSrc, tmp);
+          fs.renameSync(tmp, dest);
+        }
       }
     }
     statusLine("ok", "/update", "workflow synced");
@@ -6152,7 +8477,7 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
   // ── Smart Update: hash-based change detection + auto-merge ──
   const manifest = loadUpdateManifest();
   const newManifest = { version: require("./package.json").version, installedAt: new Date().toISOString(), files: {} };
-  const updated = [], skippedFiles = [], autoMerged = [], conflicts = [], userOnly = [];
+  const updated = [], skippedFiles = [], autoMerged = [], conflicts = [], userOnly = [], writeFailed = [];
   let needsUpdate = false;
 
   if (!manifest) {
@@ -6170,13 +8495,26 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
       const srcFile = path.join(wfSrcDir, file);
       const destFile = path.join(wfDestDir, file);
       const result = compareForUpdate("workflows", srcFile, destFile, manifest);
+      let wroteFile = true; // false = left on disk unresolved (see manifest guard below)
 
       switch (result.action) {
         case "install":
         case "safe-overwrite":
-          linkOrCopy(srcFile, destFile);
-          savePristineCopy("workflows", srcFile);
-          updated.push(file);
+          // Gap-1: same config-first transform as the fresh-install path. The
+          // smart-update loop previously linkOrCopy'd the raw source, shipping the
+          // bare git-rev-parse Pre-Flight on update. writeWorkflowTransformed
+          // emits a corrected copy for matched files and returns false (→ linkOrCopy)
+          // for the rest, preserving the live-edit hard link where it's safe.
+          // sol flaw #3: linkOrCopy returns null on I/O failure. Do NOT advance
+          // the pristine snapshot or manifest for a file that was not actually
+          // written, or the next update treats an unapplied file as current.
+          if (writeWorkflowTransformed(srcFile, destFile) || linkOrCopy(srcFile, destFile)) {
+            savePristineCopy("workflows", srcFile);
+            updated.push(file);
+          } else {
+            writeFailed.push(file);
+            wroteFile = false;
+          }
           break;
         case "user-only-skip":
           userOnly.push(file);
@@ -6188,24 +8526,44 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
           const backupDir = path.join(home, ".mover", "backups", `pre-update-${new Date().toISOString().slice(0, 10)}`);
           fs.mkdirSync(backupDir, { recursive: true });
           if (fs.existsSync(destFile)) fs.copyFileSync(destFile, path.join(backupDir, file));
-          linkOrCopy(srcFile, destFile);
-          savePristineCopy("workflows", srcFile);
-          updated.push(file);
+          if (writeWorkflowTransformed(srcFile, destFile) || linkOrCopy(srcFile, destFile)) {
+            savePristineCopy("workflows", srcFile);
+            updated.push(file);
+          } else {
+            writeFailed.push(file); // sol flaw #3
+            wroteFile = false;
+          }
           break;
         }
         case "conflict": {
           const mergeResult = tryAutoMerge("workflows", srcFile, destFile);
           if (mergeResult.success) {
-            fs.writeFileSync(destFile, mergeResult.content, "utf8");
+            // Transform the MERGED body before writing: an auto-merge can carry the
+            // bare block over from the user's old copy, so a verbatim write would
+            // re-ship the broken Pre-Flight. presetContent feeds the in-memory merge.
+            writeWorkflowTransformed(srcFile, destFile, mergeResult.content);
             savePristineCopy("workflows", srcFile);
             autoMerged.push(file);
           } else {
-            conflicts.push({ name: file, reason: mergeResult.reason, conflictCount: mergeResult.conflictCount });
+            conflicts.push({
+              name: file, category: "workflows",
+              reason: mergeResult.reason, conflictCount: mergeResult.conflictCount,
+              pristine: path.join(home, ".mover", "installed", "workflows", file),
+              userVersion: destFile, newVersion: srcFile,
+            });
+            wroteFile = false;
           }
           break;
         }
       }
-      newManifest.files[`workflows/${file}`] = result.newHash;
+      // terra F4: an unresolved conflict leaves the user's file on disk untouched.
+      // Advancing the manifest to the new hash would make the NEXT update treat
+      // the un-applied upstream change as already-pristine and silently skip it,
+      // so a real bug/security fix never reaches a user who has a conflict. Keep
+      // the prior base hash so the conflict resurfaces until /update resolves it.
+      newManifest.files[`workflows/${file}`] = wroteFile
+        ? result.newHash
+        : (manifest?.files?.[`workflows/${file}`] ?? result.newHash);
     }
   }
 
@@ -6226,6 +8584,7 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
 
         const destFile = path.join(vaultPath, entryRel);
         const result = compareForUpdate("templates", srcPath, destFile, manifest, relNorm);
+        let wroteTmpl = true;
 
         switch (result.action) {
           case "install":
@@ -6262,12 +8621,22 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
               savePristineCopy("templates", srcPath, relNorm);
               autoMerged.push(relNorm);
             } else {
-              conflicts.push({ name: relNorm, reason: mergeResult.reason, conflictCount: mergeResult.conflictCount });
+              conflicts.push({
+                name: relNorm, category: "templates",
+                reason: mergeResult.reason, conflictCount: mergeResult.conflictCount,
+                pristine: path.join(os.homedir(), ".mover", "installed", "templates", relNorm),
+                userVersion: destFile, newVersion: srcPath,
+              });
+              wroteTmpl = false;
             }
             break;
           }
         }
-        newManifest.files[`templates/${relNorm}`] = result.newHash;
+        // terra F4 (templates): same rule as workflows — never advance a manifest
+        // entry for a file left unresolved on disk.
+        newManifest.files[`templates/${relNorm}`] = wroteTmpl
+          ? result.newHash
+          : (manifest?.files?.[`templates/${relNorm}`] ?? result.newHash);
       }
     };
     walkTmplUpdate(tmplSrcDir, "");
@@ -6317,11 +8686,17 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
 
   // ── Handle true conflicts → write conflicts.json for /update ──
   if (conflicts.length > 0) {
-    const conflictData = conflicts.map(({ name }) => ({
-      file: name,
-      pristine: path.join(home, ".mover", "installed", "workflows", name),
-      userVersion: path.join(home, ".claude", "commands", name),
-      newVersion: path.join(bundleDir, "src", "workflows", name),
+    // terra F3: each record now carries its own category + real paths. A template
+    // conflict (e.g. 00_Inbox/Quick_Capture.md, which lives in the vault) was
+    // previously serialized with workflow paths (.claude/commands, src/workflows),
+    // so /update read three non-existent files and could not resolve it. Fall
+    // back to the workflow layout only for legacy records without paths.
+    const conflictData = conflicts.map((c) => ({
+      file: c.name,
+      category: c.category || "workflows",
+      pristine: c.pristine || path.join(home, ".mover", "installed", "workflows", c.name),
+      userVersion: c.userVersion || path.join(home, ".claude", "commands", c.name),
+      newVersion: c.newVersion || path.join(bundleDir, "src", "workflows", c.name),
     }));
     const conflictPath = path.join(home, ".mover", "conflicts.json");
     fs.writeFileSync(conflictPath, JSON.stringify({
@@ -6330,12 +8705,14 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
       files: conflictData,
     }, null, 2), "utf8");
 
-    // Backup conflicted user files
+    // Backup conflicted user files (from their real location — template conflicts
+    // live in the vault, not ~/.claude/commands). Slashes in the relative name are
+    // flattened so the backup filename is valid.
     const backupDir = path.join(home, ".mover", "backups", `pre-update-${new Date().toISOString().slice(0, 10)}`);
     fs.mkdirSync(backupDir, { recursive: true });
-    for (const { name } of conflicts) {
-      const dest = path.join(home, ".claude", "commands", name);
-      if (fs.existsSync(dest)) fs.copyFileSync(dest, path.join(backupDir, name));
+    for (const c of conflicts) {
+      const dest = c.userVersion || path.join(home, ".claude", "commands", c.name);
+      if (fs.existsSync(dest)) fs.copyFileSync(dest, path.join(backupDir, c.name.replace(/[\/\\]/g, "__")));
     }
     needsUpdate = true;
   }
@@ -6359,6 +8736,31 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
     }
   }
 
+  // ── Refresh Claude's hook FILES before recording their hashes ──
+  // 6b (terra-confirmed): the multi-agent propagation loop above SKIPS
+  // claude-code, yet the manifest loop below records every hook .sh/.js/.md as
+  // current. So a Claude user's hook helpers (e.g. session-history-writer.js,
+  // used by pre-compact-backup.sh) and prompt templates were marked fresh in
+  // the manifest but never actually copied — they stayed stale, and the next
+  // update skipped them because the hashes "matched". Copy the complete Claude
+  // hook asset set (same files the fresh installer writes) BEFORE recording, so
+  // the manifest never claims a version the disk does not have. File copy only;
+  // settings.json is already established and is not touched here.
+  const hooksSrcForClaude = path.join(bundleDir, "src", "hooks");
+  const claudeDetected = detectedAgentsForProp.some((a) => a.id === "claude-code");
+  if (claudeDetected && fs.existsSync(hooksSrcForClaude)) {
+    const hooksDstClaude = path.join(home, ".claude", "hooks");
+    fs.mkdirSync(hooksDstClaude, { recursive: true });
+    for (const f of fs.readdirSync(hooksSrcForClaude).filter((x) => x.endsWith(".sh"))) {
+      const content = fs.readFileSync(path.join(hooksSrcForClaude, f), "utf8").replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+      fs.writeFileSync(path.join(hooksDstClaude, f), content, { mode: 0o755 });
+      try { fs.chmodSync(path.join(hooksDstClaude, f), 0o755); } catch {}
+    }
+    for (const f of fs.readdirSync(hooksSrcForClaude).filter((x) => x.endsWith(".md") || x.endsWith(".js"))) {
+      fs.copyFileSync(path.join(hooksSrcForClaude, f), path.join(hooksDstClaude, f));
+    }
+  }
+
   // ── Save updated manifest ──
   // Carry forward entries for files we didn't process (hooks, statusline, /update itself)
   if (manifest && manifest.files) {
@@ -6369,12 +8771,36 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
   const hooksDir = path.join(bundleDir, "src", "hooks");
   if (fs.existsSync(hooksDir)) {
     for (const f of fs.readdirSync(hooksDir).filter((x) => x.endsWith(".sh") || x.endsWith(".js") || x.endsWith(".md"))) {
-      newManifest.files[`hooks/${f}`] = fileContentHash(path.join(hooksDir, f));
+      // record-if-current (sol part 10: "interactive update records uncopied
+      // hook artifacts as current"): a manifest entry asserts the installed
+      // artifact holds this base. Record the fresh hash ONLY when the Claude
+      // hook file is actually on disk with matching content (the refresh block
+      // above guarantees that when Claude is detected); otherwise keep the
+      // prior base (carried forward below) so nothing uncopied is marked
+      // current and the next update still sees it as stale.
+      const dst = path.join(home, ".claude", "hooks", f);
+      if (claudeDetected && fs.existsSync(dst) && fileContentHash(dst) === fileContentHash(path.join(hooksDir, f))) {
+        newManifest.files[`hooks/${f}`] = fileContentHash(path.join(hooksDir, f));
+      }
     }
   }
   saveUpdateManifest(newManifest);
   writeMoverConfig(vaultPath, selectedIds, updateKey);
 
+  // ── Journal handoff: mechanical stages complete; /update owns the rest ──
+  // migrate (Engine migration + conflict merges) belongs to the /update
+  // workflow; verify + stamp happen in `moveros update --finalize`, which the
+  // workflow runs LAST. The journal is the machine-readable handoff, so the
+  // CLI and the workflow are one state machine instead of a prose baton pass.
+  journalStage(journal, "apply", writeFailed.length > 0 ? "failed" : "done", {
+    updated: updated.length,
+    autoMerged: autoMerged.length,
+    userOnly: userOnly.length,
+    conflicts: conflicts.length,
+    writeFailed: writeFailed.length,
+  });
+  journalStage(journal, "migrate", "pending", { owner: "workflow", conflicts: conflicts.length });
+
   // ── Summary ──
   barLn();
   if (updated.length > 0) statusLine("ok", "Updated", `${updated.length} files`);
@@ -6382,6 +8808,15 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
   if (userOnly.length > 0) statusLine("ok", "Preserved", `${userOnly.length} customized files`);
   if (skippedFiles.length > 0) statusLine("ok", "Current", `${skippedFiles.length} files unchanged`);
 
+  // sol flaw #3: a write that failed mid-update was silently reported as success.
+  // Surface it and force a non-clean outcome so the user (and the next run) retries.
+  if (writeFailed.length > 0) {
+    statusLine("warn", "Write failed", `${writeFailed.length} file${writeFailed.length > 1 ? "s" : ""} could not be written (kept prior version)`);
+    for (const f of writeFailed) barLn(`    ${yellow("!")} ${f}`);
+    barLn(dim("  Re-run moveros update once the cause is resolved (disk space / permissions)."));
+    needsUpdate = true;
+  }
+
   if (conflicts.length > 0) {
     barLn();
     barLn(yellow(`  ${conflicts.length} file${conflicts.length > 1 ? "s" : ""} need intelligent merge:`));
@@ -6395,13 +8830,26 @@ async function cmdUpdateComprehensive(opts, bundleDir, startTime) {
   barLn();
   if (updated.length > 0 || autoMerged.length > 0) {
     barLn(dim("  Restart your AI session to load updated rules and skills."));
+    // v4.7.8: Codex IDE hook-trust hint (same logic as install path above).
+    try {
+      const codexStamp = path.join(os.homedir(), ".codex", ".mover-hook-install-stamp");
+      if (selectedIds.includes("codex") && fs.existsSync(codexStamp)) {
+        const stampedAt = new Date(fs.readFileSync(codexStamp, "utf8").trim()).getTime();
+        if (Date.now() - stampedAt < 5 * 60 * 1000) {
+          barLn(dim("  Codex IDE: open Settings → Hooks, click Trust on the new entries."));
+          barLn(dim("    (One-time per hook change. CLI fires them without the trust gate.)"));
+        }
+      }
+    } catch {}
     barLn();
   }
   const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
-  if (needsUpdate) {
-    outro(`System updated. Run ${bold("/update")} to resolve ${conflicts.length} conflict${conflicts.length > 1 ? "s" : ""}. ${dim(`(${elapsed}s)`)}`);
+  if (conflicts.length > 0) {
+    outro(`System updated. Run ${bold("/update")} to resolve ${conflicts.length} conflict${conflicts.length > 1 ? "s" : ""} and finish (it verifies + stamps the version). ${dim(`(${elapsed}s)`)}`);
+  } else if (writeFailed.length > 0) {
+    outro(`${yellow("Update incomplete.")} ${writeFailed.length} file${writeFailed.length > 1 ? "s" : ""} could not be written. Re-run when resolved. ${dim(`(${elapsed}s)`)}`);
   } else {
-    outro(`${green("Done.")} All files up to date. ${dim(`(${elapsed}s)`)}`);
+    outro(`${green("Done.")} Files applied. Run ${bold("/update")} to finish: Engine migration, then verify + version stamp. ${dim(`(${elapsed}s)`)}`);
   }
 }
 
@@ -6437,23 +8885,95 @@ function requireVault(explicitVault) {
   return v;
 }
 
+// THE install invariant (sol re-score part 1: "Marker checks still occur
+// command-by-command instead of through one invariant"). A real install =
+// a `.mover-version` that is a non-empty regular FILE — an empty file or a
+// directory by that name is not an install (sol flaw #5), and requireVault
+// trusts an explicit --vault without checking, so a typo'd path would
+// otherwise get artifacts minted into it (terra F1/F7). Every command that
+// MUTATES the vault or mints install artifacts goes through
+// requireInstalledVault; read-only diagnostics (doctor, context, status)
+// deliberately do not — they must be able to examine a broken install.
+function isInstalledVault(vaultPath) {
+  if (!vaultPath) return false;
+  try {
+    const mp = path.join(vaultPath, ".mover-version");
+    if (!fs.statSync(mp).isFile()) return false;
+    return fs.readFileSync(mp, "utf8").trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+
+function requireInstalledVault(explicitVault) {
+  const v = requireVault(explicitVault);
+  if (!v) return null;
+  if (!isInstalledVault(v)) {
+    statusLine("warn", "No install", `${v} has no Mover OS install (.mover-version missing or empty). Run moveros install first, or pass the correct --vault.`);
+    barLn();
+    return null;
+  }
+  return v;
+}
+
 // ─── Main ───────────────────────────────────────────────────────────────────
 async function main() {
   const opts = parseArgs();
   let bundleDir = path.resolve(__dirname);
   const startTime = Date.now();
 
+  // ── Bare `moveros` — smart default (decided before the branded header so
+  //    launching the dashboard is instant, with no logo animation in the way).
+  //    Configured machine → open Mover Studio (soft: won't stack tabs on a
+  //    reflexive re-run). Fresh machine → fall through to the installer, which
+  //    lands the user on the dashboard's onboarding route when it finishes.
+  //    `moveros menu` restores the classic interactive launcher. ──
+  if (!opts.command) {
+    const configuredVault = resolveVaultPath(opts.vault);
+    if (configuredVault) {
+      recordCliUsage("open");
+      await cmdOpen(opts, { soft: true });
+      if (!opts.noOpen) ln(dim("  Tools: moveros menu · moveros doctor · moveros update"));
+      return;
+    }
+    opts.command = "install"; // no vault yet → first run goes straight to install
+  }
+
+  // `moveros pulse --bar` is polled by a menu-bar widget every few seconds — its
+  // stdout must be ONLY the status line, so intercept it here, before the alt-
+  // screen, logo, and update-notice chrome would pollute the output.
+  if ((opts.command === "pulse" || opts.command === "dashboard") && (opts.rest || []).includes("--bar")) {
+    await cmdPulseBar(opts);
+    return;
+  }
+
+  // `moveros inventory` is piped by the docs generator and CI — stdout must be
+  // ONLY the JSON, so it too skips the alt-screen and logo chrome.
+  if (opts.command === "inventory") {
+    cmdInventory();
+    return;
+  }
+
+  // `moveros status --json` is a machine-readable state probe (scripts, other
+  // agents). Its JSON must be the WHOLE stdout, so intercept it before the
+  // alt-screen and logo chrome that otherwise print ahead of jsonOut (sol
+  // re-score #6 part 1: --json still passed through header rendering).
+  if (opts.command === "status" && opts.json) {
+    await cmdStatus(opts);
+    return;
+  }
+
   // ── TUI: Enter alternate screen ──
   enterAltScreen();
 
   // ── Intro: Logo plays once ──
   await printHeader();
 
-  // ── Route: no command → interactive menu (persistent loop) ──
-  const lightCommands = ["pulse", "capture", "who", "diff", "sync", "replay", "context", "settings", "backup", "restore", "doctor", "prayer", "help", "uninstall", "test"];
+  const lightCommands = ["pulse", "dashboard", "open", "shortcut", "menubar", "inventory", "capture", "who", "diff", "sync", "replay", "context", "status", "settings", "backup", "restore", "doctor", "prayer", "help", "uninstall", "test"];
 
-  if (!opts.command) {
-    // Interactive loop — stay open like a real app
+  // ── `moveros menu` → classic interactive launcher (persistent loop) ──
+  if (opts.command === "menu") {
+    opts.command = "";
     while (true) {
       clearContent();
       ln(compactHeader());
@@ -7016,22 +9536,59 @@ async function main() {
 
   let totalSteps = 0;
 
-  // 0. Legacy cleanup (remove files from older installer versions)
+  // 0. Legacy cleanup (retire files from older installer versions).
+  // GUARDED, then made NON-DESTRUCTIVE (terra P0, two rounds 2026-07-11):
+  // this used to rm -rf vault-root src/ unconditionally. A weak fingerprint
+  // (any one hook filename / the prose "mover os") still destroyed a user's
+  // src/ that merely held a session-start.sh, and a personal SOUL.md that
+  // named the product. Two changes: (a) the signature is now STRONG and
+  // Mover-unique, and (b) even a match is BACKED UP, never hard-deleted, so a
+  // false positive can never lose data. The campaign DoD is byte-preservation
+  // of unowned files; a backup rename satisfies it even under a misfire.
+  const MOVER_UNIQUE_HOOKS = ["mover-lib.sh", "session-log-reminder.sh", "engine-protection.sh", "engine-auto-commit.sh"];
+  const isLegacyMoverSrc = (dir) => {
+    try {
+      const hooksDir = path.join(dir, "hooks");
+      if (!fs.existsSync(hooksDir) || !fs.statSync(hooksDir).isDirectory()) return false;
+      const present = new Set(fs.readdirSync(hooksDir));
+      // mover-lib.sh is a Mover-only filename; require it PLUS one more unique
+      // Mover hook. A user coincidentally naming a file session-start.sh will
+      // not also carry mover-lib.sh + engine-protection.sh.
+      if (!present.has("mover-lib.sh")) return false;
+      return MOVER_UNIQUE_HOOKS.filter((h) => present.has(h)).length >= 2;
+    } catch { return false; }
+  };
+  const isLegacyMoverSoul = (file) => {
+    // Match the OLD Mover SOUL template structure, not a prose mention. The
+    // shipped legacy SOUL led with an agent-identity header and the "The
+    // Architect" persona; a user writing "I tried Mover OS" prose has neither.
+    try {
+      const head = fs.readFileSync(file, "utf8").slice(0, 4000);
+      return /^#\s*(SOUL|THE SOUL|Mover OS SOUL)\b/im.test(head) &&
+             /(Architect|Agent Name|Global Rules|Identity_Prime)/.test(head);
+    } catch { return false; }
+  };
   const legacyPaths = [
-    path.join(vaultPath, "src"),           // hooks used to install here
-    path.join(vaultPath, "SOUL.md"),       // old soul file
+    { p: path.join(vaultPath, "src"), owned: isLegacyMoverSrc },     // hooks used to install here
+    { p: path.join(vaultPath, "SOUL.md"), owned: isLegacyMoverSoul }, // old soul file
   ];
-  for (const lp of legacyPaths) {
-    if (fs.existsSync(lp)) {
-      try {
-        const stat = fs.statSync(lp);
-        if (stat.isDirectory()) {
-          fs.rmSync(lp, { recursive: true, force: true });
-        } else {
-          fs.unlinkSync(lp);
-        }
-      } catch {}
-    }
+  for (const { p: lp, owned } of legacyPaths) {
+    if (!fs.existsSync(lp)) continue;
+    try {
+      if (!owned(lp)) {
+        statusLine("warn", "Preserved", `${path.basename(lp)} exists but is not a Mover artifact — left untouched`);
+        continue;
+      }
+      // Owned legacy artifact: back it up rather than delete. A stray false
+      // positive is then fully recoverable; a real legacy dir is out of the way.
+      const backup = `${lp}.pre-mover-backup`;
+      if (!fs.existsSync(backup)) {
+        fs.renameSync(lp, backup);
+        statusLine("ok", "Backed up", `legacy ${path.basename(lp)} → ${path.basename(backup)}`);
+      } else {
+        statusLine("warn", "Left as-is", `${path.basename(lp)} (backup already exists)`);
+      }
+    } catch {}
   }
 
   // 1. Vault structure
@@ -7196,15 +9753,54 @@ async function main() {
 
   const agentNames = selectedAgents.map((a) => a.name);
 
+  // `moveros` is only on PATH after a global npm install. An `npx mover-os`
+  // user has no bin — telling them to "Run moveros" dead-ends (sol, 2026-07-10).
+  // Detect the npx cache path and print the command that will actually work.
+  const viaNpx = /[\\/]_npx[\\/]/.test(process.argv[1] || "") || /[\\/]_npx[\\/]/.test(process.env.npm_execpath || "");
+  const cliCmd = viaNpx ? "npx mover-os" : "moveros";
+
   // ── What you got ──
   ln(gray("  ─────────────────────────────────────────────"));
   ln();
   ln(`  ${bold("What was installed")}`);
   ln();
-  ln(`  ${green("▸")} ${bold("23")} workflows    ${dim("slash commands for daily rhythm, projects, strategy")}`);
-  ln(`  ${green("▸")} ${bold("62")} skills        ${dim("curated packs for dev, marketing, CRO, design")}`);
-  if (selectedIds.includes("claude-code")) {
-    ln(`  ${green("▸")} ${bold("18")} hooks         ${dim("lifecycle guards (engine protection, git safety)")}`);
+  // Counted from the bundle at print time, never hardcoded. Sol's product
+  // review (2026-07-10) caught this banner claiming 23/62/18 while the
+  // install delivered 25/70/20 — a buyer couldn't tell which product they
+  // bought. Same filters as the installers: workflows = src/workflows/*.md,
+  // skills = findSkills + the category gate installSkillPacks applies,
+  // hooks = unique scripts in the generated Claude settings.
+  // Terra verify (2026-07-10): a null selectedCategories can mean "skills
+  // skipped entirely", not "all categories" — gate each line on whether that
+  // artifact class was actually installed, or the banner overstates again.
+  // Agents whose installers call installWorkflows/installWorkflowsConverted
+  // (see installClaudeCode..installCopilot). Cline/amazon-q/etc get rules+skills only.
+  const wfAgents = new Set(["claude-code", "cursor", "codex", "windsurf", "gemini-cli", "antigravity", "roo-code", "copilot"]);
+  const anyWorkflowAgent = selectedIds.some((id) => wfAgents.has(id));
+  let wfInstalled = 0;
+  try {
+    if (anyWorkflowAgent && skillOpts.workflows !== false) {
+      wfInstalled = fs.readdirSync(path.join(bundleDir, "src", "workflows")).filter((n) => n.endsWith(".md")).length;
+    }
+  } catch {}
+  let skInstalled = 0;
+  try {
+    if (skillOpts.install) {
+      skInstalled = findSkills(bundleDir).filter(
+        (s) => !selectedCategories || s.category === "tools" || selectedCategories.has(s.category)
+      ).length;
+    }
+  } catch {}
+  let hkInstalled = 0;
+  try {
+    const hookScripts = new Set();
+    for (const m of generateClaudeSettings().matchAll(/hooks\/([a-z0-9-]+\.sh)/g)) hookScripts.add(m[1]);
+    hkInstalled = hookScripts.size;
+  } catch {}
+  if (wfInstalled > 0) ln(`  ${green("▸")} ${bold(String(wfInstalled))} workflows    ${dim("slash commands for daily rhythm, projects, strategy")}`);
+  if (skInstalled > 0) ln(`  ${green("▸")} ${bold(String(skInstalled))} skills        ${dim("curated packs for dev, marketing, CRO, design")}`);
+  if (selectedIds.includes("claude-code") && hkInstalled > 0) {
+    ln(`  ${green("▸")} ${bold(String(hkInstalled))} hooks         ${dim("lifecycle guards (engine protection, git safety)")}`);
   }
   ln(`  ${green("▸")} ${bold(String(selectedAgents.length))}  agent${selectedAgents.length > 1 ? "s" : ""}        ${dim(agentNames.join(", "))}`);
   ln(`  ${green("▸")} PARA vault     ${dim("folders, templates, Engine scaffold")}`);
@@ -7213,21 +9809,23 @@ async function main() {
   // ── Next steps (animated slide-in) ──
   ln(gray("  ─────────────────────────────────────────────"));
   ln();
+  // Funnel v2 (owner spec): the dashboard IS the front door. Lead with
+  // moveros; Obsidian is the file viewer, /setup the terminal alternative.
   await slideIn([
     `  ${bold("Next steps")}`,
     "",
-    `  ${cyan("1")}  Open your vault in ${bold("Obsidian")}`,
-    `     ${dim("This is where you view and browse your files")}`,
+    `  ${cyan("1")}  Run ${bold(cliCmd)}`,
+    `     ${dim("Opens your dashboard; setup starts there, a few plain questions")}`,
     "",
-    `  ${cyan("2")}  Open the vault folder in your AI agent`,
-    `     ${dim("Installed: " + agentNames.join(", "))}`,
+    `  ${cyan("2")}  Open your vault in ${bold("Obsidian")} ${dim("(optional)")}`,
+    `     ${dim("For viewing and browsing your files. Not required to start.")}`,
     "",
   ]);
-  ln(`  ${cyan("3")}  Enable the Obsidian theme`);
+  ln(`  ${cyan("3")}  Enable the Obsidian theme ${dim("(if using Obsidian)")}`);
   ln(`     ${dim("Settings → Appearance → CSS snippets → minimal-theme")}`);
   ln();
-  ln(`  ${cyan("4")}  Run ${bold("/setup")}`);
-  ln(`     ${dim("Builds your Identity, Strategy, and Goals")}`);
+  ln(`  ${cyan("4")}  Prefer the terminal? Run ${bold("/setup")} in your agent instead`);
+  ln(`     ${dim("The same setup, full depth: Identity, Strategy, Goals, projects")}`);
   ln();
   ln(gray("  ─────────────────────────────────────────────"));
   ln();
@@ -7240,13 +9838,32 @@ async function main() {
   ln();
   ln(`  ${bold("CLI commands")}  ${dim("(run from any terminal)")}`);
   ln();
-  ln(`  ${green("▸")} ${bold("moveros pulse")}     ${dim("Dashboard — energy, tasks, streaks")}`);
-  ln(`  ${green("▸")} ${bold("moveros doctor")}    ${dim("Health check across all agents")}`);
-  ln(`  ${green("▸")} ${bold("moveros capture")}   ${dim("Quick inbox — tasks, links, ideas")}`);
-  ln(`  ${green("▸")} ${bold("moveros prayer")}    ${dim("Set up prayer time reminders")}`);
-  ln(`  ${green("▸")} ${bold("moveros update")}    ${dim("Update agents, rules, and skills")}`);
-  ln(`  ${green("▸")} ${bold("moveros")}           ${dim("Full menu with all commands")}`);
+  ln(`  ${green("▸")} ${bold(cliCmd)}           ${dim("Open your dashboard")}`);
+  ln(`  ${green("▸")} ${bold(cliCmd + " doctor")}    ${dim("Health check across all agents")}`);
+  ln(`  ${green("▸")} ${bold(cliCmd + " capture")}   ${dim("Quick inbox — tasks, links, ideas")}`);
+  ln(`  ${green("▸")} ${bold(cliCmd + " prayer")}    ${dim("Set up prayer time reminders")}`);
+  ln(`  ${green("▸")} ${bold(cliCmd + " update")}    ${dim("Update agents, rules, and skills")}`);
+  ln(`  ${green("▸")} ${bold(cliCmd + " menu")}      ${dim("All commands (classic launcher)")}`);
   ln();
+
+  // ── Land on the dashboard's onboarding route (the payoff) ──
+  // Engine is still templates pre-/setup, so force the cold-start Onboarding
+  // cascade explicitly (?onboarding=1). TTY-only + best-effort: a dashboard
+  // hiccup never fails or blocks the install. `--no-open` opts out (automation).
+  if (!opts.noOpen && process.stdout.isTTY) {
+    ln(gray("  ─────────────────────────────────────────────"));
+    ln();
+    try {
+      const dash = require("./src/dashboard");
+      await dash.open({ vault: vaultPath, version: VERSION, rest: [], soft: false, route: "/?onboarding=1" });
+      // Setup starts IN the browser that just opened. Pointing at /setup here
+      // contradicted the dashboard-first funnel (sol, 2026-07-10).
+      ln(`  ${dim("Opening onboarding in your browser — setup starts there.")}`);
+    } catch (err) {
+      ln(`  ${dim("Your dashboard is ready — open it anytime with")} ${bold(cliCmd)}.`);
+    }
+    ln();
+  }
 }
 
 main().catch((err) => {