overlane 0.1.153 → 0.1.155

package/dist/overlane-full.mjs

@@ -20650,11 +20650,11 @@ var init_clients = __esm({
 // ../contracts/src/code-map.ts
 function codeMapDefault(setting, results = GATE_07_LATEST) {
   const result = results[setting];
-  if (result.verdict === "failed") return { setting, on: false, basis: "gate-07-failed", reason: `off: ${result.summary} (${result.evidence})`, gate07: "failed" };
-  if (result.verdict === "passed") return { setting, on: true, basis: "gate-07-passed", reason: `on: ${result.summary} (${result.evidence})`, gate07: "passed" };
+  if (result.verdict === "failed") return { setting, on: false, basis: "gate-07-failed", reason: `off: ${result.summary}`, gate07: "failed" };
+  if (result.verdict === "passed") return { setting, on: true, basis: "gate-07-passed", reason: `on: ${result.summary}`, gate07: "passed" };
   const on = SPEC_DEFAULT[setting];
   if (result.verdict === "pending") {
-    return { setting, on, basis: "spec-default-provisional", reason: `${on ? "on" : "off"} by the spec default, provisional: ${result.summary} (${result.evidence})`, gate07: "pending" };
+    return { setting, on, basis: "spec-default-provisional", reason: `${on ? "on" : "off"} by the spec default, provisional: ${result.summary}`, gate07: "pending" };
   }
   return { setting, on, basis: "spec-default", reason: `${on ? "on" : "off"} by the spec default: ${result.summary}`, gate07: "not-applicable" };
 }
@@ -20672,22 +20672,19 @@ var init_code_map = __esm({
     GATE_07_LATEST = {
       "local-agent-with-grep": {
         verdict: "failed",
-        summary: "GATE-07 failed with a local checkout and grep: cueline 115% and afltables 109% of the native-search token cost",
-        evidence: "ADR 0018, docs/findings/gate-07-preliminary.md, docs/findings/gate-07-realism-afltables.md"
+        summary: "measured with a local checkout and grep, the code tools cost more tokens (109% to 115%) than the agent's own search"
       },
       "cloud-session": {
         verdict: "pending",
-        summary: "re-run for agents without a checkout: the mechanical leg is recorded, the agent leg waits on a model",
-        evidence: "docs/findings/MS-A5-results.md (MS-A5.6)"
+        summary: "re-run for agents without a checkout: the mechanical leg is recorded, the agent leg waits on a model"
       },
       bot: {
         verdict: "pending",
-        summary: "re-run for agents without a checkout: the mechanical leg is recorded, the agent leg waits on a model",
-        evidence: "docs/findings/MS-A5-results.md (MS-A5.6)"
+        summary: "re-run for agents without a checkout: the mechanical leg is recorded, the agent leg waits on a model"
       },
-      "review-service": { verdict: "not-applicable", summary: "the review service has no grep to compare with; it uses the map as context", evidence: "ADR 0032 decision 3" },
-      "cross-repo": { verdict: "not-applicable", summary: "cross-repository questions have no single checkout to search", evidence: "ADR 0032 decision 2" },
-      wiki: { verdict: "not-applicable", summary: "the generated wiki is built from the map", evidence: "ADR 0032 decision 3" }
+      "review-service": { verdict: "not-applicable", summary: "the review service has no grep to compare with; it uses the map as context" },
+      "cross-repo": { verdict: "not-applicable", summary: "cross-repository questions have no single checkout to search" },
+      wiki: { verdict: "not-applicable", summary: "the generated wiki is built from the map" }
     };
     SPEC_DEFAULT = {
       "local-agent-with-grep": false,
@@ -23755,7 +23752,7 @@ var init_wording = __esm({
 });
 
 // ../contracts/src/code-map-context.ts
-var CodeMapDigest, CODE_MAP_DIGEST_PATH, CODE_INDEX_PATH;
+var CodeMapDigest;
 var init_code_map_context = __esm({
   "../contracts/src/code-map-context.ts"() {
     "use strict";
@@ -23772,8 +23769,6 @@ var init_code_map_context = __esm({
       /** Qualified names of the symbols the ranking put first. */
       seeds: external_exports.array(external_exports.string())
     }).strict();
-    CODE_MAP_DIGEST_PATH = ".harness/code-map.json";
-    CODE_INDEX_PATH = ".harness/code-index.json";
   }
 });
 
@@ -27285,6 +27280,38 @@ var init_observability = __esm({
   }
 });
 
+// ../contracts/src/overlane-paths.ts
+function isStatePath(path) {
+  const p2 = path.replace(/\\/g, "/");
+  return p2 === STATE_DIR || p2.startsWith(`${STATE_DIR}/`);
+}
+var OVERLANE_DIR, STATE_DIR, PLAN_DIR, STATE_GITIGNORE, STATE_FILES;
+var init_overlane_paths = __esm({
+  "../contracts/src/overlane-paths.ts"() {
+    "use strict";
+    OVERLANE_DIR = ".overlane";
+    STATE_DIR = ".overlane/state";
+    PLAN_DIR = ".overlane/plan";
+    STATE_GITIGNORE = "# Written by overlane (ADR 0067): this folder is local state and is never committed.\n*\n";
+    STATE_FILES = {
+      binding: "project.json",
+      owned: "owned.json",
+      task: "task.json",
+      taskPolicy: "task-policy.json",
+      run: "run.json",
+      release: "release.json",
+      codeMap: "code-map.json",
+      codeIndex: "code-index.json",
+      codeMapSetting: "code-map-setting.json",
+      codemapSessions: "codemap-sessions",
+      overlay: "overlay",
+      misses: "misses.log",
+      ledger: "token-ledger.jsonl",
+      logs: "logs"
+    };
+  }
+});
+
 // ../contracts/src/index.ts
 var init_src = __esm({
   "../contracts/src/index.ts"() {
@@ -27338,6 +27365,36 @@ var init_src = __esm({
     init_enterprise();
     init_observability();
     init_code_nav();
+    init_overlane_paths();
+  }
+});
+
+// ../contracts/src/overlane-paths-node.ts
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { join } from "node:path";
+function stateDir(root) {
+  return join(root, STATE_DIR);
+}
+function statePath(root, file2, ...rest) {
+  return join(root, STATE_DIR, STATE_FILES[file2], ...rest);
+}
+function ensureStateDir(root) {
+  const dir = stateDir(root);
+  mkdirSync2(dir, { recursive: true });
+  const path = join(dir, ".gitignore");
+  let current2;
+  try {
+    current2 = readFileSync2(path, "utf8");
+  } catch {
+    current2 = null;
+  }
+  if (current2 !== STATE_GITIGNORE) writeFileSync2(path, STATE_GITIGNORE);
+  return dir;
+}
+var init_overlane_paths_node = __esm({
+  "../contracts/src/overlane-paths-node.ts"() {
+    "use strict";
+    init_overlane_paths();
   }
 });
 
@@ -34672,7 +34729,7 @@ var require_dist = __commonJS({
 });
 
 // src/assets.ts
-import { basename as basename5, join as join32, resolve as resolve17 } from "node:path";
+import { basename as basename5, join as join28, resolve as resolve17 } from "node:path";
 import { fileURLToPath } from "node:url";
 function packageRoot(env = process.env) {
   const override = env["OVERLANE_PACKAGE_ROOT"];
@@ -34681,16 +34738,16 @@ function packageRoot(env = process.env) {
 }
 function assetDir(env = process.env) {
   const override = env["OVERLANE_ASSET_DIR"];
-  return override !== void 0 && override !== "" ? override : join32(packageRoot(env), "assets");
+  return override !== void 0 && override !== "" ? override : join28(packageRoot(env), "assets");
 }
 function assetFile(name2) {
-  return join32(assetDir(), basename5(name2));
+  return join28(assetDir(), basename5(name2));
 }
 var VERSION;
 var init_assets = __esm({
   "src/assets.ts"() {
     "use strict";
-    VERSION = true ? "0.1.153" : "0.0.0-dev";
+    VERSION = true ? "0.1.155" : "0.0.0-dev";
   }
 });
 
@@ -42634,7 +42691,7 @@ var init_treesitter = __esm({
 import { execFile as execFile2 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
 import { lstat, readFile as readFile4 } from "node:fs/promises";
-import { join as join33 } from "node:path";
+import { join as join29 } from "node:path";
 import { promisify } from "node:util";
 function shardKeyOf(shard) {
   return `sha256:${sha256Hex2(Buffer.from(`${shard.path}\0${shard.contentHash}\0${shard.precision}`, "utf8"))}`;
@@ -42661,7 +42718,7 @@ async function mapLimit(items, limit, task) {
   return results;
 }
 async function hashRegularFile(repoRoot, path) {
-  const absolute = join33(repoRoot, path);
+  const absolute = join29(repoRoot, path);
   try {
     const stats = await lstat(absolute);
     if (!stats.isFile()) return null;
@@ -42699,7 +42756,7 @@ async function buildSnapshot(options) {
   const needParse = [...hashes.keys()].filter((path) => !byPath.has(path));
   const parsed = await mapLimit(needParse, 8, async (path) => {
     if (languageForPath(path) === null) return { path, shard: null };
-    const bytes = await readFile4(join33(options.repoRoot, path));
+    const bytes = await readFile4(join29(options.repoRoot, path));
     if (bytes.byteLength > MAX_PARSE_BYTES) return { path, shard: null };
     const hash2 = `sha256:${sha256Hex2(bytes)}`;
     if (hash2 !== hashes.get(path)) throw new Error(`${path} changed while the snapshot was being built`);
@@ -43255,7 +43312,7 @@ var init_context_map = __esm({
 // ../index-builder/src/context-map-build.ts
 import { execFile as execFile3 } from "node:child_process";
 import { mkdir as mkdir3, readFile as readFile5, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname11, join as join34 } from "node:path";
+import { dirname as dirname8, join as join30 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 async function git5(root, args2) {
   const { stdout } = await execFileAsync2("git", args2, { cwd: root, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
@@ -43268,7 +43325,7 @@ async function buildArtifactsForCheckout(options) {
   for (const path of tracked) {
     if (languageForPath(path) === null) continue;
     try {
-      const bytes = await readFile5(join34(options.root, path));
+      const bytes = await readFile5(join30(options.root, path));
       if (bytes.byteLength > MAX_PARSE_BYTES) {
         uncovered += 1;
         continue;
@@ -43292,15 +43349,16 @@ async function buildArtifactsForCheckout(options) {
   return { digest, indexFile };
 }
 async function writeIndexFile(root, indexFile) {
-  const path = join34(root, CODE_INDEX_PATH);
-  await mkdir3(dirname11(path), { recursive: true });
+  ensureStateDir(root);
+  const path = statePath(root, "codeIndex");
   await writeFile3(path, `${JSON.stringify(indexFile)}
 `);
   return path;
 }
 async function writeDigest(root, digest, out2) {
-  const path = out2 ?? join34(root, CODE_MAP_DIGEST_PATH);
-  await mkdir3(dirname11(path), { recursive: true });
+  if (out2 === void 0) ensureStateDir(root);
+  const path = out2 ?? statePath(root, "codeMap");
+  await mkdir3(dirname8(path), { recursive: true });
   await writeFile3(path, `${JSON.stringify(digest)}
 `);
   return path;
@@ -43310,6 +43368,7 @@ var init_context_map_build = __esm({
   "../index-builder/src/context-map-build.ts"() {
     "use strict";
     init_src();
+    init_overlane_paths_node();
     init_context_map();
     init_languages();
     init_snapshot();
@@ -43320,7 +43379,7 @@ var init_context_map_build = __esm({
 // ../index-builder/src/run.ts
 import { execFile as execFile4 } from "node:child_process";
 import { mkdir as mkdir4, readdir as readdir4, rm as rm2, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join35, resolve as resolve18 } from "node:path";
+import { join as join31, resolve as resolve18 } from "node:path";
 import { parseArgs as parseArgs2 } from "node:util";
 import { promisify as promisify3 } from "node:util";
 function originOf(url2) {
@@ -43411,13 +43470,13 @@ ${USAGE}`);
   }
 }
 async function writeSnapshot(dir, built) {
-  await mkdir4(join35(dir, "shards"), { recursive: true });
-  for (const name2 of await readdir4(join35(dir, "shards"))) await rm2(join35(dir, "shards", name2));
-  await writeFile4(join35(dir, "manifest.json"), JSON.stringify(built.manifest, null, 2));
-  await writeFile4(join35(dir, "uncovered.json"), JSON.stringify(built.uncovered, null, 2));
+  await mkdir4(join31(dir, "shards"), { recursive: true });
+  for (const name2 of await readdir4(join31(dir, "shards"))) await rm2(join31(dir, "shards", name2));
+  await writeFile4(join31(dir, "manifest.json"), JSON.stringify(built.manifest, null, 2));
+  await writeFile4(join31(dir, "uncovered.json"), JSON.stringify(built.uncovered, null, 2));
   for (const shard of built.shards) {
     const name2 = shardKeyOf(shard).slice("sha256:".length);
-    await writeFile4(join35(dir, "shards", `${name2}.json`), JSON.stringify(shard));
+    await writeFile4(join31(dir, "shards", `${name2}.json`), JSON.stringify(shard));
   }
 }
 var execFileAsync3, USAGE, UsageError2, OPTIONS;
@@ -43435,7 +43494,7 @@ var init_run = __esm({
   overlane-index map    [--root DIR] [--out FILE] [--task TEXT]
   overlane-index upload --service URL --tenant ID (--project ID | --repo owner/name) --commit SHA [--branch B] [--scip FILE ...] [--root DIR] [--audience URL]
 
-map writes the ranked code map digest (default .harness/code-map.json in the root) that the session-start hook delivers as context (ADR 0055). No model; --task ranks by the words of a task.
+map writes the ranked code map digest (default .overlane/state/code-map.json in the root) that the session-start hook delivers as context (ADR 0055). No model; --task ranks by the words of a task.
 --project indexes an Overlane project (no GitHub repository needed) and uploads with OVERLANE_TOKEN.
 --repo names a GitHub repository; in GitHub Actions the OIDC token is used when ACTIONS_ID_TOKEN_REQUEST_URL is set.
 Authentication for upload: OVERLANE_TOKEN (always for --project), or the GitHub Actions OIDC token for --repo.
@@ -58263,8 +58322,8 @@ var init_cloud = __esm({
 
 // ../code-shim/src/git.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync14 } from "node:fs";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync15 } from "node:fs";
+import { join as join35 } from "node:path";
 function git7(root, args2) {
   try {
     return execFileSync2("git", args2, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 64 * 1024 * 1024, timeout: 1e4 });
@@ -58326,7 +58385,7 @@ function readWorkingCopyState(root) {
   const head = headCommit2(root);
   const raw = git7(root, ["status", "--porcelain=v2", "-z", "--untracked-files=all"]);
   if (raw === null) return { head, dirty: /* @__PURE__ */ new Set(), deleted: /* @__PURE__ */ new Set(), renamed: /* @__PURE__ */ new Map() };
-  return { head, ...parseStatus(raw, (path) => existsSync14(join39(root, path))) };
+  return { head, ...parseStatus(raw, (path) => existsSync15(join35(root, path))) };
 }
 var init_git2 = __esm({
   "../code-shim/src/git.ts"() {
@@ -58335,18 +58394,18 @@ var init_git2 = __esm({
 });
 
 // ../code-shim/src/config.ts
-import { readFileSync as readFileSync22 } from "node:fs";
+import { readFileSync as readFileSync23 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join40 } from "node:path";
+import { join as join36 } from "node:path";
 function configDir2(env) {
-  const base5 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join40(homedir3(), ".config");
-  return join40(base5, "overlane");
+  const base5 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join36(homedir3(), ".config");
+  return join36(base5, "overlane");
 }
 function findToken2(env, serviceUrl, now) {
   const fromEnv = env["OVERLANE_TOKEN"];
   if (fromEnv !== void 0 && fromEnv.length > 0) return fromEnv;
   try {
-    const file2 = JSON.parse(readFileSync22(join40(configDir2(env), "credentials.json"), "utf8"));
+    const file2 = JSON.parse(readFileSync23(join36(configDir2(env), "credentials.json"), "utf8"));
     const stored = file2[serviceUrl];
     if (stored === void 0 || typeof stored.accessToken !== "string" || stored.accessToken.length === 0) return null;
     if (typeof stored.expiresAt === "number" && stored.expiresAt <= now) return null;
@@ -58358,7 +58417,7 @@ function findToken2(env, serviceUrl, now) {
 function resolveCloudConfig(root, env, now) {
   let binding;
   try {
-    const parsed = ProjectBinding.safeParse(JSON.parse(readFileSync22(join40(root, ".harness", "project.json"), "utf8")));
+    const parsed = ProjectBinding.safeParse(JSON.parse(readFileSync23(statePath(root, "binding"), "utf8")));
     if (!parsed.success) return null;
     binding = parsed.data;
   } catch {
@@ -58376,11 +58435,12 @@ var init_config = __esm({
     "use strict";
     init_src();
     init_git2();
+    init_overlane_paths_node();
   }
 });
 
 // ../code-shim/src/local.ts
-import { readFileSync as readFileSync23, statSync as statSync4 } from "node:fs";
+import { readFileSync as readFileSync24, statSync as statSync4 } from "node:fs";
 import { isAbsolute as isAbsolute2, relative as relative5, resolve as resolve19, sep as sep2 } from "node:path";
 function resolveInside(root, path) {
   const absolute = resolve19(root, path);
@@ -58500,7 +58560,7 @@ var init_local = __esm({
         let shard;
         try {
           this.parses += 1;
-          shard = await this.parse(path, readFileSync23(absolute, "utf8"));
+          shard = await this.parse(path, readFileSync24(absolute, "utf8"));
         } catch {
           shard = null;
         }
@@ -58512,7 +58572,7 @@ var init_local = __esm({
         const absolute = resolveInside(this.root, path);
         if (absolute === null) return null;
         try {
-          return readFileSync23(absolute, "utf8");
+          return readFileSync24(absolute, "utf8");
         } catch {
           return null;
         }
@@ -58522,7 +58582,7 @@ var init_local = __esm({
         const absolute = resolveInside(this.root, path);
         if (absolute === null) return void 0;
         try {
-          const lines = readFileSync23(absolute, "utf8").split("\n");
+          const lines = readFileSync24(absolute, "utf8").split("\n");
           const start2 = range[0];
           if (start2 >= lines.length) return void 0;
           const end = Math.min(Math.max(range[2], start2), start2 + maxLines - 1, lines.length - 1);
@@ -58749,7 +58809,7 @@ var init_nav = __esm({
 
 // ../code-shim/src/edit.ts
 import { createHash as createHash8 } from "node:crypto";
-import { readFileSync as readFileSync24, writeFileSync as writeFileSync11 } from "node:fs";
+import { readFileSync as readFileSync25, writeFileSync as writeFileSync12 } from "node:fs";
 function lineStarts(text2) {
   const starts = [0];
   for (let i2 = 0; i2 < text2.length; i2 += 1) if (text2[i2] === "\n") starts.push(i2 + 1);
@@ -58790,7 +58850,7 @@ async function editSymbol(index, args2) {
   if (!found.ok) return found;
   const absolute = resolveInside(index.root, args2.path);
   if (absolute === null) return { ok: false, reason: `path ${args2.path} is outside the repository` };
-  const original = readFileSync24(absolute, "utf8");
+  const original = readFileSync25(absolute, "utf8");
   const starts = lineStarts(original);
   const range = found.symbol.enclosingRange ?? found.symbol.range;
   const from = offsetOf(starts, original, range[0], range[1]);
@@ -58818,7 +58878,7 @@ ${args2.content.replace(/\n+$/, "")}`;
   const before = positionAt(next, changedStart);
   const after = positionAt(next, insertAt + inserted.length);
   const bytes = Buffer.from(next, "utf8");
-  writeFileSync11(absolute, bytes);
+  writeFileSync12(absolute, bytes);
   return {
     ok: true,
     path: args2.path,
@@ -58857,7 +58917,7 @@ async function renameSymbol(deps, args2) {
     if (absolute === null) return { ok: false, reason: `reference path ${path} is outside the repository` };
     let text2;
     try {
-      text2 = readFileSync24(absolute, "utf8");
+      text2 = readFileSync25(absolute, "utf8");
     } catch {
       return { ok: false, reason: `cannot read ${path}` };
     }
@@ -58879,7 +58939,7 @@ async function renameSymbol(deps, args2) {
     let next = item.text;
     for (const offset of offsets) next = next.slice(0, offset) + args2.new_name + next.slice(offset + oldName.length);
     const bytes = Buffer.from(next, "utf8");
-    writeFileSync11(item.absolute, bytes);
+    writeFileSync12(item.absolute, bytes);
     filesChanged.push({ path: item.path, edits: offsets.length, sha256: sha2563(bytes) });
     edits += offsets.length;
   }
@@ -59165,7 +59225,6 @@ init_zod();
 
 // ../cli/src/binding.ts
 init_src();
-import { join as join2 } from "node:path";
 
 // ../cli/src/files.ts
 import { chmodSync, mkdirSync, readFileSync, rmdirSync, rmSync, writeFileSync } from "node:fs";
@@ -59211,52 +59270,10 @@ function jsonText(value) {
 `;
 }
 
-// ../cli/src/owned.ts
-init_zod();
-import { join } from "node:path";
-var BINDING_FILE = join(".harness", "project.json");
-var OWNED_FILE = join(".harness", "owned.json");
-var CODEX_CONFIG_FILE = join(".codex", "config.toml");
-var OwnedAgent = external_exports.object({ marketplace: external_exports.boolean(), plugin: external_exports.boolean() }).strict();
-var OwnedConfigLines = external_exports.object({ text: external_exports.string().min(1), createdFile: external_exports.boolean() }).strict();
-var Owned = external_exports.object({
-  version: external_exports.literal(1),
-  serviceUrl: external_exports.string().min(1),
-  marketplaceRoot: external_exports.string().min(1),
-  claude: OwnedAgent.optional(),
-  codex: OwnedAgent.extend({ configLines: OwnedConfigLines.optional() }).strict().optional(),
-  binding: external_exports.boolean(),
-  excludeLine: external_exports.boolean()
-}).strict();
-function readOwned(root) {
-  const parsed = Owned.safeParse(readJson(join(root, OWNED_FILE)));
-  return parsed.success ? parsed.data : null;
-}
-function writeOwned(root, owned) {
-  const ordered = {
-    version: owned.version,
-    serviceUrl: owned.serviceUrl,
-    marketplaceRoot: owned.marketplaceRoot,
-    ...owned.claude === void 0 ? {} : { claude: { marketplace: owned.claude.marketplace, plugin: owned.claude.plugin } },
-    ...owned.codex === void 0 ? {} : {
-      codex: {
-        marketplace: owned.codex.marketplace,
-        plugin: owned.codex.plugin,
-        ...owned.codex.configLines === void 0 ? {} : { configLines: owned.codex.configLines }
-      }
-    },
-    binding: owned.binding,
-    excludeLine: owned.excludeLine
-  };
-  return writeIfDifferent(join(root, OWNED_FILE), jsonText(ordered));
-}
-function removeOwned(root) {
-  removeFile(join(root, OWNED_FILE));
-}
-
 // ../cli/src/binding.ts
+init_overlane_paths_node();
 function readBindingFile(root) {
-  const text2 = readText(join2(root, BINDING_FILE));
+  const text2 = readText(statePath(root, "binding"));
   if (text2 === null) return { kind: "missing" };
   let raw;
   try {
@@ -59276,6 +59293,8 @@ function bindingText(binding) {
 
 // ../cli/src/connect.ts
 init_src();
+init_src();
+init_overlane_paths_node();
 import { existsSync as existsSync2 } from "node:fs";
 import { join as join6, resolve } from "node:path";
 
@@ -59537,7 +59556,7 @@ async function detectAgents(deps, agents, cwd) {
 
 // ../cli/src/credentials.ts
 init_zod();
-import { join as join3 } from "node:path";
+import { join as join2 } from "node:path";
 var KEYCHAIN_SERVICE = "overlane";
 var StoredTokens = external_exports.object({ accessToken: external_exports.string().min(1), refreshToken: external_exports.string().min(1).optional(), expiresAt: external_exports.number().optional() }).strict();
 var ClientCache = external_exports.object({ clientId: external_exports.string().min(1), port: external_exports.number().int().min(1).max(65535) }).strict();
@@ -59547,10 +59566,10 @@ var AuthState = external_exports.object({
 }).strict();
 var CredentialFile = external_exports.record(external_exports.string(), StoredTokens);
 function authStatePath(deps) {
-  return join3(deps.paths.configDir, "auth.json");
+  return join2(deps.paths.configDir, "auth.json");
 }
 function credentialsPath(deps) {
-  return join3(deps.paths.configDir, "credentials.json");
+  return join2(deps.paths.configDir, "credentials.json");
 }
 function readAuthState(deps) {
   const parsed = AuthState.safeParse(readJson(authStatePath(deps)));
@@ -59675,6 +59694,49 @@ init_zod();
 import { existsSync } from "node:fs";
 import { join as join4 } from "node:path";
 
+// ../cli/src/owned.ts
+init_zod();
+import { join as join3 } from "node:path";
+init_overlane_paths_node();
+var BINDING_FILE = ".overlane/state/project.json";
+var OWNED_FILE = ".overlane/state/owned.json";
+var CODEX_CONFIG_FILE = join3(".codex", "config.toml");
+var OwnedAgent = external_exports.object({ marketplace: external_exports.boolean(), plugin: external_exports.boolean() }).strict();
+var OwnedConfigLines = external_exports.object({ text: external_exports.string().min(1), createdFile: external_exports.boolean() }).strict();
+var Owned = external_exports.object({
+  version: external_exports.literal(1),
+  serviceUrl: external_exports.string().min(1),
+  marketplaceRoot: external_exports.string().min(1),
+  claude: OwnedAgent.optional(),
+  codex: OwnedAgent.extend({ configLines: OwnedConfigLines.optional() }).strict().optional(),
+  binding: external_exports.boolean()
+}).strict();
+function readOwned(root) {
+  const parsed = Owned.safeParse(readJson(statePath(root, "owned")));
+  return parsed.success ? parsed.data : null;
+}
+function writeOwned(root, owned) {
+  const ordered = {
+    version: owned.version,
+    serviceUrl: owned.serviceUrl,
+    marketplaceRoot: owned.marketplaceRoot,
+    ...owned.claude === void 0 ? {} : { claude: { marketplace: owned.claude.marketplace, plugin: owned.claude.plugin } },
+    ...owned.codex === void 0 ? {} : {
+      codex: {
+        marketplace: owned.codex.marketplace,
+        plugin: owned.codex.plugin,
+        ...owned.codex.configLines === void 0 ? {} : { configLines: owned.codex.configLines }
+      }
+    },
+    binding: owned.binding
+  };
+  ensureStateDir(root);
+  return writeIfDifferent(statePath(root, "owned"), jsonText(ordered));
+}
+function removeOwned(root) {
+  removeFile(statePath(root, "owned"));
+}
+
 // ../cli/src/toml.ts
 function parseKeyPath(source) {
   const parts2 = [];
@@ -60101,7 +60163,7 @@ async function requireToken(deps, serviceUrl) {
 
 // ../cli/src/project.ts
 init_src();
-import { basename, join as join5 } from "node:path";
+import { basename } from "node:path";
 var REMOTE_PATTERNS = [
   /^(?:https?|git|ssh):\/\/(?:[^@/]+@)?github\.com(?::\d+)?\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/i,
   /^(?:[^@/]+@)?github\.com:([^/]+)\/([^/]+?)(?:\.git)?\/?$/i
@@ -60165,37 +60227,6 @@ async function headCommit(deps, root) {
   const sha = head.stdout.trim();
   return head.code === 0 && sha.length > 0 ? sha : null;
 }
-var EXCLUDE_LINE = ".harness/";
-async function excludePath(deps, root) {
-  const result = await deps.exec("git", ["rev-parse", "--path-format=absolute", "--git-path", "info/exclude"], { cwd: root });
-  if (result.code !== 0 || result.stdout.trim().length === 0) {
-    return join5(root, ".git", "info", "exclude");
-  }
-  return result.stdout.trim();
-}
-async function isHarnessIgnored(deps, root) {
-  const result = await deps.exec("git", ["check-ignore", "-q", ".harness/project.json"], { cwd: root });
-  return result.code === 0;
-}
-async function addExclude(deps, root) {
-  const path = await excludePath(deps, root);
-  const text2 = readText(path) ?? "";
-  if (text2.split("\n").includes(EXCLUDE_LINE)) return false;
-  const prefix = text2.length === 0 || text2.endsWith("\n") ? "" : "\n";
-  writeIfDifferent(path, `${text2}${prefix}${EXCLUDE_LINE}
-`);
-  return true;
-}
-async function removeExclude(deps, root) {
-  const path = await excludePath(deps, root);
-  const text2 = readText(path);
-  if (text2 === null) return;
-  const lines = text2.split("\n");
-  const index = lines.indexOf(EXCLUDE_LINE);
-  if (index === -1) return;
-  lines.splice(index, 1);
-  writeIfDifferent(path, lines.join("\n"));
-}
 
 // ../cli/src/readiness.ts
 function report(agent, state, detail, action) {
@@ -60219,7 +60250,7 @@ async function assessAgent(deps, input2) {
     return report(agent, "incompatible", input2.info.detail, `install ${label2} (\`${agent}\`) and run \`overlane doctor\` again`);
   }
   if (input2.binding.kind !== "ok") {
-    const why = input2.binding.kind === "missing" ? "no .harness/project.json" : `invalid .harness/project.json (${input2.binding.detail})`;
+    const why = input2.binding.kind === "missing" ? "no .overlane/state/project.json" : `invalid .overlane/state/project.json (${input2.binding.detail})`;
     return report(agent, "blocked", why, "run `overlane connect`");
   }
   if (!input2.hasToken) return report(agent, "blocked", "no stored token for the service", "run `overlane connect` to sign in");
@@ -60436,7 +60467,7 @@ function normaliseServiceUrl(value) {
   return url2.toString().replace(/\/+$/, "");
 }
 function emptyOwned(serviceUrl, marketplaceRoot2) {
-  return { version: 1, serviceUrl, marketplaceRoot: marketplaceRoot2, binding: false, excludeLine: false };
+  return { version: 1, serviceUrl, marketplaceRoot: marketplaceRoot2, binding: false };
 }
 async function connect(deps, options) {
   const infos = await detectAgents(deps, options.agents, deps.paths.cwd);
@@ -60490,7 +60521,7 @@ async function connect(deps, options) {
       }
     }
   }
-  const excludeNeeded = !await isHarnessIgnored(deps, root);
+  const gitignoreNeeded = !existsSync2(join6(root, STATE_DIR, ".gitignore"));
   const bindingMissing = existing.kind !== "ok";
   const existingToken = await findToken(deps, serviceUrl);
   say(deps);
@@ -60506,21 +60537,21 @@ async function connect(deps, options) {
   }
   for (const line3 of present) say(deps, `  skip: ${line3}`);
   say(deps, `  write ${BINDING_FILE}: project ID, tenant ID, service URL, release digest and the release-signing public key from the service`);
-  say(deps, "  write .harness/owned.json: the entries overlane added, so `overlane disconnect` removes only those");
-  if (excludeNeeded) say(deps, `  append ${EXCLUDE_LINE} to ${await excludePath(deps, root)}`);
+  say(deps, `  write ${OWNED_FILE}: the entries overlane added, so \`overlane disconnect\` removes only those`);
+  if (gitignoreNeeded) say(deps, `  write ${STATE_DIR}/.gitignore (\`*\`): local state is never committed`);
   for (const info2 of active) {
     say(deps, `  hook (${info2.agent}, SessionStart): node ${hookScript(marketplaceRoot2, info2.agent)}`);
   }
-  say(deps, "    It runs at session start and reads .harness/project.json and git. When a harness token is available (OVERLANE_TOKEN, the OS");
+  say(deps, "    It runs at session start and reads .overlane/state/project.json and git. When a harness token is available (OVERLANE_TOKEN, the OS");
   say(deps, `    keychain or the 0600 file) it calls ${serviceUrl}/v1/tenants/<tenant>/projects/<project>/context?commit=<sha>`);
   say(deps, "    with the token as a Bearer header, sending only the tenant, project and commit SHA. It never sends source code.");
   say(deps);
   if (options.dryRun) {
     say(deps, "Dry run: no command was run and no file was written.");
     const writes = [{ path: BINDING_FILE, action: "write", description: "project ID, tenant ID, service URL, release digest and the release-signing public key" }];
-    writes.push({ path: ".harness/owned.json", action: "write", description: "the entries overlane added, so `overlane disconnect` removes only those" });
+    writes.push({ path: OWNED_FILE, action: "write", description: "the entries overlane added, so `overlane disconnect` removes only those" });
     if (codexEdit !== null) writes.push({ path: CODEX_CONFIG_FILE, action: "append", description: `enable the plugin for this project (${codexEdit.block.trim().split("\n").join("; ")})` });
-    if (excludeNeeded) writes.push({ path: await excludePath(deps, root), action: "append", description: EXCLUDE_LINE });
+    if (gitignoreNeeded) writes.push({ path: `${STATE_DIR}/.gitignore`, action: "write", description: "`*`: the state folder ignores itself (ADR 0067)" });
     const plan3 = dryRunPlan({
       service: serviceUrl,
       requests: [
@@ -60537,7 +60568,7 @@ async function connect(deps, options) {
     });
     return { data: plan3 };
   }
-  const pending = steps.length > 0 || codexEdit !== null || excludeNeeded || bindingMissing;
+  const pending = steps.length > 0 || codexEdit !== null || gitignoreNeeded || bindingMissing;
   if (pending && !options.yes) {
     if (!deps.isTTY) {
       const hint = `overlane connect${options.service === void 0 ? "" : ` --service ${options.service}`}${options.agents.length === AGENT_NAMES.length ? "" : ` --agents ${options.agents.join(",")}`}${options.marketplaceRoot === void 0 ? "" : ` --marketplace-root ${options.marketplaceRoot}`} --yes`;
@@ -60564,6 +60595,7 @@ async function connect(deps, options) {
     releaseDigest: record3.releaseDigest,
     ...servicePublicKey === null ? {} : { servicePublicKey }
   });
+  ensureStateDir(root);
   const previousOwned = readOwned(root);
   const owned = previousOwned === null ? emptyOwned(serviceUrl, marketplaceRoot2) : { ...previousOwned, serviceUrl, marketplaceRoot: marketplaceRoot2 };
   try {
@@ -60585,13 +60617,12 @@ async function connect(deps, options) {
     verify(deps, root, active);
     say(deps, `[agents] ${CONNECT_STEPS.agents}: done`);
     await reportStep(deps, serviceUrl, token.token, me.tenantId, "agents", { agents: active.map((info2) => info2.agent === "claude" ? "claude-code" : info2.agent) });
-    if (writeIfDifferent(join6(root, BINDING_FILE), bindingText(binding))) {
+    if (writeIfDifferent(statePath(root, "binding"), bindingText(binding))) {
       say(deps, `Wrote ${BINDING_FILE}`);
       wrote.push(BINDING_FILE);
     }
     if (codexEdit !== null) wrote.push(CODEX_CONFIG_FILE);
     owned.binding = true;
-    if (excludeNeeded && await addExclude(deps, root)) owned.excludeLine = true;
     say(deps, `[repo] ${CONNECT_STEPS.repo}: done`);
     const next = await reportStep(deps, serviceUrl, token.token, me.tenantId, "repo", { repo: repoChoice(project) });
     if (next !== null) say(deps, `Next in onboarding: ${next === "repo" ? "first-task" : next} (${CONNECT_STEPS[next === "repo" ? "first-task" : next]})`);
@@ -60791,7 +60822,7 @@ var authStatusCommand = defineCommand({
 });
 
 // ../cli/src/commands/client.ts
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 import { join as join8, resolve as resolve3 } from "node:path";
 
 // ../plugin-builder/src/adapters/plan.ts
@@ -60808,7 +60839,7 @@ function contextInstructions(client) {
   return [
     "## Overlane",
     "",
-    `This project shares context between coding agents through Overlane (${CLIENT_LABELS[client]} is one of them). Project and team IDs are in \`.harness/project.json\`.`,
+    `This project shares context between coding agents through Overlane (${CLIENT_LABELS[client]} is one of them). Project and team IDs are in \`.overlane/state/project.json\`.`,
     "",
     "- At the start of every task, call the `harness_context` tool of the `overlane` MCP server (or run `overlane context`).",
     "- Claim work with `harness_task` before you change files, checkpoint before you stop or hand over, and submit with evidence. A task is done only when `harness_task get` shows it `verified`; saying so in chat is not enough.",
@@ -60873,7 +60904,7 @@ function planAdapter(client, surface, options = {}) {
 }
 
 // ../plugin-builder/src/adapters/install.ts
-import { chmodSync as chmodSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname2, isAbsolute, join as join7, relative, resolve as resolve2 } from "node:path";
 function safePath(root, path) {
   const full = resolve2(root, path);
@@ -60944,7 +60975,7 @@ function applyPlan(root, ops, options = {}) {
   const applied = [];
   for (const op of ops) {
     const full = safePath(root, op.path);
-    const existing = existsSync3(full) ? readFileSync2(full, "utf8") : null;
+    const existing = existsSync3(full) ? readFileSync3(full, "utf8") : null;
     let next;
     try {
       next = render(op, existing);
@@ -60954,8 +60985,8 @@ function applyPlan(root, ops, options = {}) {
     }
     const action = existing === null ? "created" : existing === next ? "unchanged" : "updated";
     if (action !== "unchanged" && options.dryRun !== true) {
-      mkdirSync2(dirname2(full), { recursive: true });
-      writeFileSync2(full, next);
+      mkdirSync3(dirname2(full), { recursive: true });
+      writeFileSync3(full, next);
       if (op.kind === "write" && op.executable === true) chmodSync2(full, 493);
     }
     applied.push({ path: join7(op.path), action });
@@ -60964,7 +60995,7 @@ function applyPlan(root, ops, options = {}) {
 }
 
 // ../plugin-builder/src/adapters/cloud.ts
-var FALLBACK_DIR = ".harness/hooks";
+var FALLBACK_DIR = ".overlane/hooks";
 var CLAUDE_PLUGIN_SCRIPTS = ["claude", "plugins", "overlane", "scripts"];
 var FALLBACK_SCRIPTS = ["harness-context.mjs", "harness-stop.mjs"];
 function claudeFallbackSettings() {
@@ -61000,7 +61031,7 @@ function planCloudRecipe(client, options = {}) {
           "3. `overlane task submit <id>` with evidence when done. The completion gate is advisory on this path: the server still refuses to mark an unverified task verified."
         ].join("\n")
       },
-      { kind: "write", path: ".harness/codex-cloud-setup.sh", content: CODEX_SETUP_SCRIPT, executable: true }
+      { kind: "write", path: `${FALLBACK_DIR}/codex-cloud-setup.sh`, content: CODEX_SETUP_SCRIPT, executable: true }
     ];
   }
   const ops = [];
@@ -61039,8 +61070,8 @@ var NEXT = {
   grok: ["Start Grok Build in this project; run `grok inspect` to see the overlane MCP server, then approve its sign-in."],
   cursor: ["Open the project in Cursor, enable the overlane server under Settings > MCP, and sign in when asked."],
   gemini: ["Run `gemini` in this project; the workspace extension `overlane` loads on start. Sign in when the MCP server asks."],
-  claude: ["Commit .claude/settings.json, .harness/hooks and CLAUDE.md. In the Claude Code on the web environment, add the secret OVERLANE_TOKEN (an agent token from `overlane token create`)."],
-  codex: ["Commit AGENTS.md and .harness/codex-cloud-setup.sh. In the Codex cloud environment, run the setup script and add the secret OVERLANE_TOKEN (an agent token from `overlane token create`). Completion gating is advisory on Codex cloud."]
+  claude: ["Commit .claude/settings.json, .overlane/hooks and CLAUDE.md. In the Claude Code on the web environment, add the secret OVERLANE_TOKEN (an agent token from `overlane token create`)."],
+  codex: ["Commit AGENTS.md and .overlane/hooks/codex-cloud-setup.sh. In the Codex cloud environment, run the setup script and add the secret OVERLANE_TOKEN (an agent token from `overlane token create`). Completion gating is advisory on Codex cloud."]
 };
 var clientInstallCommand = defineCommand({
   path: ["client", "install"],
@@ -61074,7 +61105,7 @@ var clientInstallCommand = defineCommand({
       const scripts = {};
       for (const script of FALLBACK_SCRIPTS) {
         try {
-          scripts[script] = readFileSync3(join8(root, ...CLAUDE_PLUGIN_SCRIPTS, script), "utf8");
+          scripts[script] = readFileSync4(join8(root, ...CLAUDE_PLUGIN_SCRIPTS, script), "utf8");
         } catch {
           throw new UsageError(`the built Claude plugin was not found under ${root}`, { hint: "build it with the plugin builder or pass --marketplace-root" });
         }
@@ -61102,8 +61133,8 @@ init_zod();
 
 // ../cli/src/release/installed.ts
 init_src();
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname3, join as join9 } from "node:path";
+import { readFileSync as readFileSync5, renameSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join9 } from "node:path";
 
 // ../cli/src/release/verify.ts
 init_src();
@@ -61160,21 +61191,22 @@ function diffDigestOf(diff) {
 }
 
 // ../cli/src/release/installed.ts
-var RELEASE_FILE = join9(".harness", "release.json");
+init_overlane_paths_node();
+var RELEASE_FILE = ".overlane/state/release.json";
 function readInstalled(root) {
-  const parsed = ReleaseManifest.safeParse(readJson(join9(root, RELEASE_FILE)));
+  const parsed = ReleaseManifest.safeParse(readJson(statePath(root, "release")));
   return parsed.success ? parsed.data : null;
 }
 function writeInstalled(root, manifest) {
-  const path = join9(root, RELEASE_FILE);
-  mkdirSync3(dirname3(path), { recursive: true });
+  ensureStateDir(root);
+  const path = statePath(root, "release");
   const temp = `${path}.${process.pid}.tmp`;
-  writeFileSync3(temp, jsonText(manifest));
+  writeFileSync4(temp, jsonText(manifest));
   renameSync(temp, path);
 }
 function diskDigest(marketplaceRoot2, file2) {
   try {
-    return sha256Of(readFileSync4(join9(marketplaceRoot2, file2.path)));
+    return sha256Of(readFileSync5(join9(marketplaceRoot2, file2.path)));
   } catch {
     return null;
   }
@@ -61199,14 +61231,13 @@ function mismatchedFiles(marketplaceRoot2, target2) {
 
 // ../cli/src/release/update.ts
 init_src();
-import { join as join13, resolve as resolve4 } from "node:path";
+import { join as join12, resolve as resolve4 } from "node:path";
 
 // ../cli/src/task/state.ts
 init_src();
+import { renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "node:fs";
 init_zod();
-import { mkdirSync as mkdirSync4, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname4, join as join10 } from "node:path";
-var TASK_STATE_PATH = join10(".harness", "task.json");
+init_overlane_paths_node();
 var LocalTaskState = external_exports.object({
   taskId: TaskId,
   fencingToken: external_exports.number().int().nonnegative(),
@@ -61218,7 +61249,7 @@ var LocalTaskState = external_exports.object({
 }).strict();
 function readTaskState(root) {
   try {
-    const text2 = readText(join10(root, TASK_STATE_PATH));
+    const text2 = readText(statePath(root, "task"));
     if (text2 === null) return null;
     const parsed = LocalTaskState.safeParse(JSON.parse(text2));
     return parsed.success ? parsed.data : null;
@@ -61227,27 +61258,27 @@ function readTaskState(root) {
   }
 }
 function writeTaskState(root, state) {
-  const path = join10(root, TASK_STATE_PATH);
-  mkdirSync4(dirname4(path), { recursive: true });
+  ensureStateDir(root);
+  const path = statePath(root, "task");
   const temp = `${path}.${process.pid}.tmp`;
-  writeFileSync4(temp, `${JSON.stringify(state, null, 2)}
+  writeFileSync5(temp, `${JSON.stringify(state, null, 2)}
 `);
   renameSync2(temp, path);
 }
 function removeTaskState(root) {
-  rmSync2(join10(root, TASK_STATE_PATH), { force: true });
+  rmSync2(statePath(root, "task"), { force: true });
 }
 
 // ../cli/src/release/approvals.ts
 init_src();
 init_zod();
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync5, renameSync as renameSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync6, renameSync as renameSync3, writeFileSync as writeFileSync6 } from "node:fs";
 import { hostname as hostname3 } from "node:os";
-import { dirname as dirname5, join as join11 } from "node:path";
+import { dirname as dirname4, join as join10 } from "node:path";
 var APPROVALS_FILE = "approvals.json";
 var Approvals = external_exports.array(ReleaseApproval);
 function approvalsPath(deps) {
-  return join11(deps.paths.configDir, APPROVALS_FILE);
+  return join10(deps.paths.configDir, APPROVALS_FILE);
 }
 function readApprovals(deps) {
   const parsed = Approvals.safeParse(readJson(approvalsPath(deps)));
@@ -61260,29 +61291,29 @@ function recordApproval(deps, approval) {
   const full = ReleaseApproval.parse({ ...approval, machine: hostname3() || "unknown", approvedAt: new Date(deps.now()).toISOString() });
   const path = approvalsPath(deps);
   const all = [...readApprovals(deps).filter((existing) => existing.digest !== full.digest), full];
-  mkdirSync5(dirname5(path), { recursive: true });
+  mkdirSync6(dirname4(path), { recursive: true });
   const temp = `${path}.${process.pid}.tmp`;
-  writeFileSync5(temp, jsonText(all), { mode: 384 });
+  writeFileSync6(temp, jsonText(all), { mode: 384 });
   chmodSync3(temp, 384);
   renameSync3(temp, path);
   return full;
 }
 
 // ../cli/src/release/source.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync5 } from "node:fs";
-import { join as join12 } from "node:path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync6 } from "node:fs";
+import { join as join11 } from "node:path";
 var SIDECAR_DIR = ".release";
 function sourceUrl(deps, source) {
   const override = deps.env["OVERLANE_RELEASE_SOURCE_URL"];
   return override !== void 0 && override.length > 0 ? override : `https://github.com/${source.repository}.git`;
 }
 async function git(deps, root, args2, quiet = false) {
-  const result = await deps.exec("git", [`--git-dir=${join12(root, ".git")}`, `--work-tree=${root}`, "-c", "advice.detachedHead=false", ...args2], { cwd: root });
+  const result = await deps.exec("git", [`--git-dir=${join11(root, ".git")}`, `--work-tree=${root}`, "-c", "advice.detachedHead=false", ...args2], { cwd: root });
   if (result.code !== 0 && !quiet) throw new CliError(`\`git ${args2.join(" ")}\` failed (exit ${result.code}): ${(result.stderr || result.stdout).trim().slice(0, 400)}`);
   return { code: result.code, text: result.stdout.trim() };
 }
 async function fetchReleaseSource(deps, marketplaceRoot2, source) {
-  mkdirSync6(marketplaceRoot2, { recursive: true });
+  mkdirSync7(marketplaceRoot2, { recursive: true });
   const url2 = sourceUrl(deps, source);
   if ((await git(deps, marketplaceRoot2, ["rev-parse", "--git-dir"], true)).code !== 0) await git(deps, marketplaceRoot2, ["init", "-q"]);
   say(deps, `Fetching ${source.repository}@${source.commit.slice(0, 12)} (${source.ref})`);
@@ -61302,7 +61333,7 @@ async function verifySourceTree(deps, marketplaceRoot2, files, digest) {
   for (const file2 of files) {
     let actual = null;
     try {
-      actual = sha256Of(readFileSync5(join12(marketplaceRoot2, file2.path)));
+      actual = sha256Of(readFileSync6(join11(marketplaceRoot2, file2.path)));
     } catch {
     }
     if (actual === null) problems.push(`${file2.path} is missing`);
@@ -61462,7 +61493,7 @@ async function installRelease(deps, ctx, targetDigest, options, isPin) {
 }
 function syncBinding(root, binding, digest) {
   if (binding.releaseDigest === digest) return;
-  writeIfDifferent(join13(root, BINDING_FILE), bindingText({ ...binding, releaseDigest: digest }));
+  writeIfDifferent(join12(root, BINDING_FILE), bindingText({ ...binding, releaseDigest: digest }));
 }
 
 // ../cli/src/kit/api.ts
@@ -61556,10 +61587,9 @@ function kitClient(deps, serviceUrl, binding, token) {
 
 // ../cli/src/kit/run-state.ts
 init_src();
+import { renameSync as renameSync4, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "node:fs";
 init_zod();
-import { mkdirSync as mkdirSync7, renameSync as renameSync4, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname6, join as join14 } from "node:path";
-var RUN_STATE_PATH = join14(".harness", "run.json");
+init_overlane_paths_node();
 var LocalRunState = external_exports.object({
   runId: external_exports.string().min(1),
   executor: external_exports.enum(["claude-code", "codex"]),
@@ -61570,7 +61600,7 @@ var LocalRunState = external_exports.object({
 }).strict();
 function readRunState(root) {
   try {
-    const text2 = readText(join14(root, RUN_STATE_PATH));
+    const text2 = readText(statePath(root, "run"));
     if (text2 === null) return null;
     const parsed = LocalRunState.safeParse(JSON.parse(text2));
     return parsed.success ? parsed.data : null;
@@ -61579,15 +61609,15 @@ function readRunState(root) {
   }
 }
 function writeRunState(root, state) {
-  const path = join14(root, RUN_STATE_PATH);
-  mkdirSync7(dirname6(path), { recursive: true });
+  ensureStateDir(root);
+  const path = statePath(root, "run");
   const temp = `${path}.${process.pid}.tmp`;
-  writeFileSync6(temp, `${JSON.stringify(state, null, 2)}
+  writeFileSync7(temp, `${JSON.stringify(state, null, 2)}
 `);
   renameSync4(temp, path);
 }
 function removeRunState(root) {
-  rmSync3(join14(root, RUN_STATE_PATH), { force: true });
+  rmSync3(statePath(root, "run"), { force: true });
 }
 
 // ../cli/src/kit/run.ts
@@ -61608,7 +61638,7 @@ ${issues.map((issue2) => `  - ${issue2}`).join("\n")}` : message);
 // ../kit/src/plan-files.ts
 init_src();
 import { mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";
-import { join as join15 } from "node:path";
+import { join as join13 } from "node:path";
 
 // ../kit/src/text.ts
 var import_yaml = __toESM(require_dist(), 1);
@@ -61687,10 +61717,10 @@ function slugify2(value) {
 }
 
 // ../kit/src/plan-files.ts
-var PLAN_DIR = ".harness/plan";
+var PLAN_DIR2 = PLAN_DIR;
 var planPaths = (repoDir) => {
-  const root = join15(repoDir, PLAN_DIR);
-  return { root, project: join15(root, "project.md"), milestones: join15(root, "milestones.md"), tasks: join15(root, "tasks"), task: (id2) => join15(root, "tasks", `${id2}.md`) };
+  const root = join13(repoDir, PLAN_DIR2);
+  return { root, project: join13(root, "project.md"), milestones: join13(root, "milestones.md"), tasks: join13(root, "tasks"), task: (id2) => join13(root, "tasks", `${id2}.md`) };
 };
 function parsePlan(input2, where2) {
   const result = Plan.safeParse(input2);
@@ -61749,11 +61779,11 @@ async function writePlan(repoDir, plan3) {
   ]);
   await mkdir(paths.tasks, { recursive: true });
   const keep = new Set(canonical.tasks.map((task) => `${task.id}.md`));
-  for (const entry of await readdir(paths.tasks)) if (entry.endsWith(".md") && !keep.has(entry)) await rm(join15(paths.tasks, entry));
+  for (const entry of await readdir(paths.tasks)) if (entry.endsWith(".md") && !keep.has(entry)) await rm(join13(paths.tasks, entry));
   for (const [file2, text2] of files) await writeFile(file2, text2, "utf8");
   return [...files.keys()].map((file2) => file2.slice(repoDir.length).replace(/^\/+/, ""));
 }
-async function readText2(file2) {
+async function readText3(file2) {
   try {
     return await readFile(file2, "utf8");
   } catch (error62) {
@@ -61815,8 +61845,8 @@ function parseTask(text2, where2) {
 }
 async function readPlan(repoDir) {
   const paths = planPaths(repoDir);
-  const { schemaVersion, project } = parseProject(await readText2(paths.project), paths.project);
-  const milestones = parseMilestones(await readText2(paths.milestones), paths.milestones);
+  const { schemaVersion, project } = parseProject(await readText3(paths.project), paths.project);
+  const milestones = parseMilestones(await readText3(paths.milestones), paths.milestones);
   let entries;
   try {
     entries = (await readdir(paths.tasks)).filter((entry) => entry.endsWith(".md"));
@@ -61825,8 +61855,8 @@ async function readPlan(repoDir) {
   }
   const tasks = [];
   for (const entry of entries.sort(naturalCompare)) {
-    const file2 = join15(paths.tasks, entry);
-    const task = parseTask(await readText2(file2), file2);
+    const file2 = join13(paths.tasks, entry);
+    const task = parseTask(await readText3(file2), file2);
     if (`${task.id}.md` !== entry) throw new KitError(`${file2}: file name must be ${task.id}.md`);
     tasks.push(task);
   }
@@ -61837,13 +61867,13 @@ async function readPlan(repoDir) {
 init_src();
 init_zod();
 import { mkdir as mkdir2, readdir as readdir3, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename3, dirname as dirname7, join as join17, resolve as resolve6 } from "node:path";
+import { basename as basename3, dirname as dirname5, join as join15, resolve as resolve6 } from "node:path";
 
 // ../kit/src/detect.ts
 var import_yaml2 = __toESM(require_dist(), 1);
 init_src();
 import { readdir as readdir2, readFile as readFile2 } from "node:fs/promises";
-import { basename as basename2, join as join16, resolve as resolve5 } from "node:path";
+import { basename as basename2, join as join14, resolve as resolve5 } from "node:path";
 var KINDS = ["typecheck", "lint", "build", "test"];
 async function readOptional(file2) {
   try {
@@ -61888,7 +61918,7 @@ async function detectCommands(repoDir) {
     if (!sources.includes(source)) sources.push(source);
   };
   const scriptBodies = /* @__PURE__ */ new Map();
-  const packageText = await readOptional(join16(root, "package.json"));
+  const packageText = await readOptional(join14(root, "package.json"));
   if (packageText !== void 0) {
     let pkg;
     try {
@@ -61910,13 +61940,13 @@ async function detectCommands(repoDir) {
     install = pm === "npm" ? lock ? "npm ci" : "npm install" : `${pm} install`;
     if (!sources.includes("package.json")) sources.push("package.json");
   }
-  const makefile = await readOptional(join16(root, "Makefile")) ?? await readOptional(join16(root, "makefile"));
+  const makefile = await readOptional(join14(root, "Makefile")) ?? await readOptional(join14(root, "makefile"));
   if (makefile !== void 0) {
     const targets = new Set([...makefile.matchAll(/^([A-Za-z0-9_.-]+)\s*:(?!=)/gm)].map((m) => m[1] ?? ""));
     const names = { typecheck: ["typecheck"], lint: ["lint"], build: ["build"], test: ["test", "tests"] };
     for (const kind of KINDS) for (const name2 of names[kind]) if (targets.has(name2)) add(kind, `make ${name2}`, "Makefile");
   }
-  const pyproject = await readOptional(join16(root, "pyproject.toml"));
+  const pyproject = await readOptional(join14(root, "pyproject.toml"));
   if (pyproject !== void 0) {
     const files = await readdir2(root).catch(() => []);
     const runner = files.includes("uv.lock") ? "uv run " : files.includes("poetry.lock") || /\[tool\.poetry\]/.test(pyproject) ? "poetry run " : "";
@@ -61928,13 +61958,13 @@ async function detectCommands(repoDir) {
       else if (/^\[project\]/m.test(pyproject)) install = "pip install -e .";
     }
   }
-  const workflowDir = join16(root, ".github", "workflows");
+  const workflowDir = join14(root, ".github", "workflows");
   const workflows = (await readdir2(workflowDir).catch(() => [])).filter((f) => /\.ya?ml$/.test(f)).sort();
   for (const file2 of workflows) {
     const source = `.github/workflows/${file2}`;
     let doc;
     try {
-      doc = (0, import_yaml2.parse)(await readOptional(join16(workflowDir, file2)) ?? "");
+      doc = (0, import_yaml2.parse)(await readOptional(join14(workflowDir, file2)) ?? "");
     } catch {
       continue;
     }
@@ -61979,7 +62009,7 @@ async function draftPlanForExisting(repoDir, opts = {}) {
   const detected = await detectCommands(root);
   let pkgName;
   let pkgDescription;
-  const packageText = await readOptional(join16(root, "package.json"));
+  const packageText = await readOptional(join14(root, "package.json"));
   if (packageText !== void 0) {
     try {
       const pkg = JSON.parse(packageText);
@@ -62139,13 +62169,13 @@ function parseConstitution(text2) {
 }
 async function findConstitution(repoDir) {
   for (const rel of CONSTITUTION_PATHS) {
-    const text2 = await readOptional2(join17(repoDir, rel));
+    const text2 = await readOptional2(join15(repoDir, rel));
     if (text2 !== void 0) return { file: rel, text: text2 };
   }
   return void 0;
 }
 async function discoverFeatures(repoDir) {
-  const specsDir = join17(repoDir, "specs");
+  const specsDir = join15(repoDir, "specs");
   let dirs;
   try {
     dirs = (await readdir3(specsDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
@@ -62154,10 +62184,10 @@ async function discoverFeatures(repoDir) {
   }
   const features = [];
   for (const dir of dirs.sort(naturalCompare)) {
-    const tasksText = await readOptional2(join17(specsDir, dir, "tasks.md"));
+    const tasksText = await readOptional2(join15(specsDir, dir, "tasks.md"));
     if (tasksText === void 0) continue;
-    const { phases, block: block2 } = parseTasksFile(tasksText, join17("specs", dir, "tasks.md"));
-    const specText = await readOptional2(join17(specsDir, dir, "spec.md")) ?? "";
+    const { phases, block: block2 } = parseTasksFile(tasksText, join15("specs", dir, "tasks.md"));
+    const specText = await readOptional2(join15(specsDir, dir, "spec.md")) ?? "";
     const number4 = /^(\d+)(?:-|$)/.exec(dir)?.[1];
     features.push({ dir, key: number4 ?? slugify2(dir).replace(/-/g, ""), phases, block: block2, stories: parseStories(specText), specText });
   }
@@ -62267,7 +62297,7 @@ async function gitRoot(deps, label2) {
 function boundProject(deps, root) {
   const bound = readBindingFile(root);
   if (bound.kind !== "ok") {
-    throw new CliError(bound.kind === "missing" ? "this project is not connected; run `overlane connect` first" : `.harness/project.json is invalid (${bound.detail}); run \`overlane connect\``, {
+    throw new CliError(bound.kind === "missing" ? "this project is not connected; run `overlane connect` first" : `.overlane/state/project.json is invalid (${bound.detail}); run \`overlane connect\``, {
       code: "not_connected",
       exit: EXIT.conflict,
       hint: "overlane connect"
@@ -62304,7 +62334,7 @@ function otherAgent(name2) {
 }
 
 // ../cli/src/task/usage.ts
-import { join as join18 } from "node:path";
+import { join as join16 } from "node:path";
 var FIVE_HOUR_WARN_PERCENT = 85;
 var WEEKLY_WARN_PERCENT = 90;
 var UNDATED_MAX_AGE_MS = 60 * 60 * 1e3;
@@ -62316,7 +62346,7 @@ function window2(value) {
 }
 function readUsage(deps) {
   try {
-    const text2 = readText(join18(deps.paths.configDir, "usage.json"));
+    const text2 = readText(join16(deps.paths.configDir, "usage.json"));
     if (text2 === null) return null;
     const raw = JSON.parse(text2);
     if (typeof raw.updatedAt !== "number") return null;
@@ -62412,17 +62442,18 @@ function summarizeTask(view) {
 }
 
 // ../cli/src/task/workcopy.ts
+init_src();
 import { createHash as createHash3 } from "node:crypto";
-import { lstatSync, readFileSync as readFileSync6, readlinkSync } from "node:fs";
-import { join as join19 } from "node:path";
-var isHarnessPath = (path) => path === ".harness" || path.startsWith(".harness/");
+import { lstatSync, readFileSync as readFileSync7, readlinkSync } from "node:fs";
+import { join as join17 } from "node:path";
+var isHarnessPath = (path) => isStatePath(path);
 var CONTENT_LIMIT = 16 * 1024 * 1024;
 function untrackedLine(root, path) {
   try {
-    const info2 = lstatSync(join19(root, path));
-    if (info2.isSymbolicLink()) return `${path}\0l:${readlinkSync(join19(root, path))}`;
+    const info2 = lstatSync(join17(root, path));
+    if (info2.isSymbolicLink()) return `${path}\0l:${readlinkSync(join17(root, path))}`;
     if (info2.isFile()) {
-      return info2.size <= CONTENT_LIMIT ? `${path}\0f:${createHash3("sha256").update(readFileSync6(join19(root, path))).digest("hex")}` : `${path}\0s:${info2.size}`;
+      return info2.size <= CONTENT_LIMIT ? `${path}\0f:${createHash3("sha256").update(readFileSync7(join17(root, path))).digest("hex")}` : `${path}\0s:${info2.size}`;
     }
   } catch {
   }
@@ -62521,7 +62552,7 @@ async function heldTask(ctx) {
   const lease = view.contract.lease;
   if (view.state === "paused" || lease === void 0 || lease.fencingToken !== state.fencingToken) {
     removeTaskState(ctx.root);
-    throw new CliError(`task ${state.taskId} is ${view.state} and this working copy no longer holds its lease; cleared .harness/task.json`, {
+    throw new CliError(`task ${state.taskId} is ${view.state} and this working copy no longer holds its lease; cleared .overlane/state/task.json`, {
       code: "lease_lost",
       exit: EXIT.conflict,
       hint: `overlane task resume ${state.taskId}`
@@ -62617,7 +62648,7 @@ async function startTask(deps, input2) {
             body: { requestId: "cli-<uuid>", expectedVersion: "<version from the first response>", holder: holderFor(executorName), executor, ttlSeconds: LEASE_TTL_SECONDS }
           }
         ],
-        writes: [{ path: ".harness/task.json", action: "write", description: "the lease and fencing token of the claimed task (never committed)" }]
+        writes: [{ path: ".overlane/state/task.json", action: "write", description: "the lease and fencing token of the claimed task (never committed)" }]
       })
     );
   }
@@ -62656,7 +62687,7 @@ async function taskStatus(deps) {
   const lease = view.contract.lease;
   const leaseHeld = lease !== void 0 && lease.fencingToken === state.fencingToken;
   if (!leaseHeld) {
-    say(deps, "This working copy no longer holds the lease; `.harness/task.json` is stale. Use `overlane task resume` to claim the task again.");
+    say(deps, "This working copy no longer holds the lease; `.overlane/state/task.json` is stale. Use `overlane task resume` to claim the task again.");
   } else {
     writeTaskState(ctx.root, { ...state, expectedVersion: view.version });
   }
@@ -62699,7 +62730,7 @@ async function writeCheckpoint(deps, input2) {
       dryRunPlan({
         service: project.serviceUrl,
         requests: [{ method: "POST", path: taskPaths.operation(tenantId, projectId, state2.taskId, "checkpoint"), body: request2, note: "expectedVersion is read from the service when this runs for real" }],
-        writes: input2.pause === void 0 ? [] : [{ path: ".harness/task.json", action: "delete", description: "the lease ends when the task is paused" }]
+        writes: input2.pause === void 0 ? [] : [{ path: ".overlane/state/task.json", action: "delete", description: "the lease ends when the task is paused" }]
       })
     );
     return { kind: "planned", outcome };
@@ -62763,7 +62794,7 @@ async function resumeTask(deps, input2) {
             note: "sent only if the working copy matches the latest checkpoint's recovery route"
           }
         ],
-        writes: [{ path: ".harness/task.json", action: "write", description: "the lease and fencing token of the claimed task (never committed)" }]
+        writes: [{ path: ".overlane/state/task.json", action: "write", description: "the lease and fencing token of the claimed task (never committed)" }]
       })
     );
   }
@@ -62821,7 +62852,7 @@ async function submitTask(deps, input2) {
       dryRunPlan({
         service: project.serviceUrl,
         requests: [{ method: "POST", path: taskPaths.operation(tenantId, projectId, state2.taskId, "submit"), body: request2, note: "expectedVersion is read from the service when this runs for real" }],
-        writes: [{ path: ".harness/task.json", action: "write", description: "the new task version" }]
+        writes: [{ path: ".overlane/state/task.json", action: "write", description: "the new task version" }]
       })
     );
   }
@@ -62892,7 +62923,7 @@ async function recordEvidence(deps, input2) {
   const checkId = checkIdFor(command);
   if (!view.contract.requiredChecks.some((check2) => check2.id === checkId)) {
     throw new CliError(
-      `no required check of task ${taskId} matches this command (check ${checkId}); pass the verification command exactly as written in .harness/plan/tasks/${taskId}.md. Required checks: ${view.contract.requiredChecks.map((check2) => check2.id).join(", ") || "none"}`,
+      `no required check of task ${taskId} matches this command (check ${checkId}); pass the verification command exactly as written in .overlane/plan/tasks/${taskId}.md. Required checks: ${view.contract.requiredChecks.map((check2) => check2.id).join(", ") || "none"}`,
       { code: "no_matching_check", exit: EXIT.notFound, hint: `overlane task status` }
     );
   }
@@ -63075,7 +63106,7 @@ async function startRun(deps, input2) {
           { method: "GET", path: kitPaths.policy(tenantId, projectId), note: "a paused policy or an executor outside executorsAllowed stops here with exit 6" },
           { method: "POST", path: kitPaths.runs(tenantId, projectId), body: StartRunRequest.parse({ requestId: requestId2(), executor: executorFor(executor2 === "codex" ? "codex" : "claude-code"), trigger }) }
         ],
-        writes: [{ path: ".harness/run.json", action: "write", description: "the run id, start time and policy snapshot (never committed)" }]
+        writes: [{ path: ".overlane/state/run.json", action: "write", description: "the run id, start time and policy snapshot (never committed)" }]
       })
     );
   }
@@ -63167,8 +63198,8 @@ async function claimTask(deps, input2) {
           }
         ],
         writes: [
-          { path: ".harness/task.json", action: "write", description: "the lease and fencing token of the claimed task" },
-          { path: ".harness/run.json", action: "write", description: "adds the task to the run's claimed list" }
+          { path: ".overlane/state/task.json", action: "write", description: "the lease and fencing token of the claimed task" },
+          { path: ".overlane/state/run.json", action: "write", description: "adds the task to the run's claimed list" }
         ]
       })
     );
@@ -63211,9 +63242,9 @@ async function claimTask(deps, input2) {
     for (const criterion of contract.acceptanceCriteria) say(deps, `  - ${criterion}`);
     const commands = await verificationCommands(ctx.root, taskId);
     if (commands === null) {
-      say(deps, `Verification commands: see .harness/plan/tasks/${taskId}.md`);
+      say(deps, `Verification commands: see .overlane/plan/tasks/${taskId}.md`);
     } else {
-      say(deps, `Verification commands (from .harness/plan/tasks/${taskId}.md; pass each one exactly as written to \`overlane task evidence\`):`);
+      say(deps, `Verification commands (from .overlane/plan/tasks/${taskId}.md; pass each one exactly as written to \`overlane task evidence\`):`);
       for (const command of commands) say(deps, `  $ ${command}`);
     }
     return {
@@ -63224,7 +63255,7 @@ async function claimTask(deps, input2) {
         allowedPaths: [...contract.scope.allowedPaths],
         acceptanceCriteria: [...contract.acceptanceCriteria],
         verificationCommands: commands === null ? null : [...commands],
-        planFile: `.harness/plan/tasks/${taskId}.md`
+        planFile: `.overlane/plan/tasks/${taskId}.md`
       }
     };
   } catch (error62) {
@@ -63271,7 +63302,7 @@ async function endRun(deps, input2) {
       dryRunPlan({
         service: project.serviceUrl,
         requests: [{ method: "POST", path: kitPaths.endRun(project.binding.tenantId, project.binding.projectId, run4.runId), body: EndRunRequest.parse({ requestId: requestId2(), stopReason: reason }) }],
-        writes: [{ path: ".harness/run.json", action: "delete", description: "the run ends" }]
+        writes: [{ path: ".overlane/state/run.json", action: "delete", description: "the run ends" }]
       })
     );
   }
@@ -63283,7 +63314,7 @@ async function endRun(deps, input2) {
   } catch (error62) {
     if (error62 instanceof ServiceError && error62.code === "run_not_found") {
       removeRunState(ctx.root);
-      throw new CliError(`${error62.message}; removed the stale .harness/run.json`, { code: "run_not_found", exit: EXIT.notFound, hint: "overlane run start" });
+      throw new CliError(`${error62.message}; removed the stale .overlane/state/run.json`, { code: "run_not_found", exit: EXIT.notFound, hint: "overlane run start" });
     }
     throw error62;
   }
@@ -63566,7 +63597,7 @@ var contextCommand = defineCommand({
 // ../cli/src/commands/lib.ts
 init_src();
 init_zod();
-import { existsSync as existsSync4, readFileSync as readFileSync7 } from "node:fs";
+import { existsSync as existsSync4, readFileSync as readFileSync8 } from "node:fs";
 import { basename as basename4, resolve as resolve7 } from "node:path";
 var SERVICE_FLAG = { name: "service", type: "string", value: "URL", description: "The service address (default: OVERLANE_SERVICE_URL, then the project's binding, then the hosted service)" };
 var TEAM_FLAG = { name: "team", type: "string", value: "TENANT_ID", description: "The team (tenant) to act on (default: the one your token belongs to)" };
@@ -63682,7 +63713,7 @@ function readLockfiles(paths) {
     const kind = LOCKFILES.find(([pattern]) => pattern.test(basename4(file2)))?.[1];
     if (kind === void 0) throw new UsageError(`${file2} is not a lockfile this command reads`, { hint: "supported: package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, uv.lock, Cargo.lock, go.sum" });
     try {
-      return { kind, content: readFileSync7(resolve7(file2), "utf8") };
+      return { kind, content: readFileSync8(resolve7(file2), "utf8") };
     } catch {
       throw new UsageError(`cannot read ${file2}`);
     }
@@ -63775,7 +63806,7 @@ var libAddCommand = defineCommand({
     if (version2 === void 0 || files.length === 0) throw new UsageError("add needs --version and at least one --file", { hint: "overlane lib add <library> --version 1.0.0 --file README.md" });
     const pages = files.map((file2) => {
       try {
-        return { title: basename4(file2), text: readFileSync7(resolve7(file2), "utf8") };
+        return { title: basename4(file2), text: readFileSync8(resolve7(file2), "utf8") };
       } catch {
         throw new UsageError(`cannot read ${file2}`);
       }
@@ -64478,7 +64509,7 @@ var billingCommands = [
 init_src();
 init_zod();
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { readFileSync as readFileSync8, statSync } from "node:fs";
+import { readFileSync as readFileSync9, statSync } from "node:fs";
 import { resolve as resolve8 } from "node:path";
 var common3 = { needsAuth: true, needsNetwork: true };
 var requestId4 = () => `cli-${randomUUID4()}`;
@@ -64691,7 +64722,7 @@ function readPushFiles(inv) {
     let content;
     try {
       if (statSync(absolute).size > 5e6) throw new UsageError(`${path} is larger than 5 MB; push it with git and a token instead`, { hint: `overlane repo token <repo> --scope write` });
-      content = readFileSync8(absolute, "utf8");
+      content = readFileSync9(absolute, "utf8");
     } catch (error62) {
       if (error62 instanceof UsageError) throw error62;
       throw new UsageError(`could not read ${path}`);
@@ -65075,7 +65106,7 @@ var repoCommands = [
 // ../cli/src/commands/ci.ts
 init_src();
 init_zod();
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 import { resolve as resolve9 } from "node:path";
 var RUN_ARG = { name: "run", required: true, description: "The run ID" };
 function arg2(inv, index, what, hint) {
@@ -65104,7 +65135,7 @@ var ciValidateCommand = defineCommand({
     const file2 = textFlag(inv, "file") ?? PIPELINE_CONFIG_PATH;
     let text2;
     try {
-      text2 = readFileSync9(resolve9(inv.deps.paths.cwd, file2), "utf8");
+      text2 = readFileSync10(resolve9(inv.deps.paths.cwd, file2), "utf8");
     } catch {
       throw new UsageError(`could not read ${file2}`, { hint: "overlane ci validate --file <path>" });
     }
@@ -65608,7 +65639,7 @@ var deployCommands = [deployTargetsCommand, deployTargetAddCommand, deployEnvCre
 init_src();
 init_zod();
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 import { resolve as resolve10 } from "node:path";
 var common4 = { needsAuth: true, needsNetwork: true };
 var requestId5 = () => `cli-${randomUUID5()}`;
@@ -65620,9 +65651,9 @@ async function planned3(inv, method, path, body2, note) {
   const project = await offlineProject(inv.deps, "guard");
   return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
 }
-function readText3(inv, path) {
+function readText4(inv, path) {
   try {
-    return readFileSync10(resolve10(inv.deps.paths.cwd, path), "utf8");
+    return readFileSync11(resolve10(inv.deps.paths.cwd, path), "utf8");
   } catch {
     throw new UsageError(`could not read ${path}`, { hint: "overlane guard rules test --file rules.json --tool git.push" });
   }
@@ -65697,7 +65728,7 @@ var guardRulesTestCommand = defineCommand({
     if (file2 === void 0) throw new UsageError("rules test needs --file", { hint: "overlane guard rules test --file rules.json --tool git.push" });
     let json2;
     try {
-      json2 = JSON.parse(readText3(inv, file2));
+      json2 = JSON.parse(readText4(inv, file2));
     } catch (error62) {
       if (error62 instanceof UsageError) throw error62;
       throw new UsageError(`${file2} is not valid JSON`);
@@ -65753,7 +65784,7 @@ var guardRulesPutCommand = defineCommand({
       const offline = await offlineProject(inv.deps, "guard");
       return planOutcome(inv.deps, dryRunPlan({ service: offline.serviceUrl, requests: [{ method: "PUT", path: guardPaths.rules(offline.binding.tenantId), body: { requestId: "<generated>", layer, ...layer === "project" ? { projectId: offline.binding.projectId } : {}, content: `<contents of ${file2}>`, ...reason === void 0 ? {} : { reason } }, note: "the file is validated and scanned for credentials on the server" }] }));
     }
-    const content = readText3(inv, file2);
+    const content = readText4(inv, file2);
     const { call: call2, tenantId, projectId } = await connected3(inv);
     return { data: await call2(GuardRuleFileRecord, "PUT", guardPaths.rules(tenantId), { requestId: requestId5(), layer, ...layer === "project" ? { projectId } : {}, content, ...reason === void 0 ? {} : { reason } }) };
   }
@@ -65765,7 +65796,7 @@ async function evaluate(inv, dryRun) {
     ...actionOf(inv),
     ...textFlag(inv, "task") === void 0 ? {} : { taskHeld: textFlag(inv, "task") === "held" },
     ...textFlag(inv, "summary") === void 0 ? {} : { summary: textFlag(inv, "summary") },
-    ...contentFile === void 0 ? {} : { content: readText3(inv, contentFile) },
+    ...contentFile === void 0 ? {} : { content: readText4(inv, contentFile) },
     ...dryRun ? { dryRun: true } : {}
   };
   const approval = textFlag(inv, "approval");
@@ -65826,7 +65857,7 @@ var guardScanCommand = defineCommand({
     const path = textFlag(inv, "path");
     if (path === void 0) throw new UsageError("scan needs --path", { hint: "overlane guard scan --path src/config.ts" });
     const { call: call2, tenantId } = await connected3(inv);
-    const result = await call2(SecretScanResult, "POST", guardPaths.scan(tenantId), { source: textFlag(inv, "source") ?? "push", content: readText3(inv, path), path });
+    const result = await call2(SecretScanResult, "POST", guardPaths.scan(tenantId), { source: textFlag(inv, "source") ?? "push", content: readText4(inv, path), path });
     return result.blocked ? { data: result, exit: EXIT.blocked, error: new CliError("a credential was found; nothing should be pushed until it is removed and rotated", { code: "secret_detected", exit: EXIT.blocked, hint: "overlane guard scan --path <file>" }) } : { data: result };
   }
 });
@@ -66147,7 +66178,7 @@ var memoryCommands = [memorySearchCommand, memoryAddCommand, memoryConfirmComman
 init_src();
 init_zod();
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 var common6 = { needsAuth: true, needsNetwork: true };
 var requestId7 = () => `cli-${randomUUID7()}`;
 var PRIORITIES = ["P0", "P1", "P2", "P3"];
@@ -66341,7 +66372,7 @@ var issueImportCommand = defineCommand({
     if (file2 === void 0) throw new UsageError("import needs the path of the export file");
     let data;
     try {
-      data = JSON.parse(readFileSync11(file2, "utf8"));
+      data = JSON.parse(readFileSync12(file2, "utf8"));
     } catch {
       throw new UsageError(`${file2} is not a readable JSON file`);
     }
@@ -67220,8 +67251,11 @@ var ConnectKitResult = external_exports.union([
 var ConnectAny = external_exports.union([ConnectResult, DryRunResult]);
 
 // ../cli/src/disconnect.ts
-import { join as join20 } from "node:path";
+import { join as join18 } from "node:path";
 init_zod();
+init_src();
+init_overlane_paths_node();
+import { existsSync as existsSync5, readdirSync } from "node:fs";
 var DisconnectResult = withDryRun(
   external_exports.object({
     /** False when the project had nothing overlane added. */
@@ -67240,14 +67274,14 @@ async function disconnect(deps, options) {
   const owned = readOwned(root);
   const binding = readBindingFile(root);
   if (owned === null) {
-    say(deps, "Nothing to disconnect: this project has no .harness/owned.json, so overlane added nothing here.");
-    return { data: { disconnected: false, commands: [], removed: [], tokenDeleted: false, note: "this project has no .harness/owned.json, so overlane added nothing here" } };
+    say(deps, "Nothing to disconnect: this project has no .overlane/state/owned.json, so overlane added nothing here.");
+    return { data: { disconnected: false, commands: [], removed: [], tokenDeleted: false, note: "this project has no .overlane/state/owned.json, so overlane added nothing here" } };
   }
   const steps = [];
   if (owned.claude !== void 0) steps.push(...claudeRemoveSteps(readClaudeState(root), owned.claude));
   const codexState = readCodexState(deps, root);
   if (owned.codex !== void 0) steps.push(...codexRemoveSteps(codexState, owned.codex));
-  const configPath = join20(root, CODEX_CONFIG_FILE);
+  const configPath = join18(root, CODEX_CONFIG_FILE);
   const lines = owned.codex?.configLines;
   const configText = readText(configPath);
   const configRemovable = lines !== void 0 && configText !== null && configText.includes(lines.text);
@@ -67256,14 +67290,12 @@ async function disconnect(deps, options) {
     $ ${formatCommand(step2)}`);
   if (configRemovable) say(deps, `  remove the lines overlane added to ${CODEX_CONFIG_FILE}`);
   say(deps, `  delete ${BINDING_FILE} and ${OWNED_FILE}`);
-  if (owned.excludeLine) say(deps, `  remove ${EXCLUDE_LINE} from ${await excludePath(deps, root)}`);
   say(deps, `  delete the stored token for ${owned.serviceUrl}`);
   if (options.dryRun) {
     say(deps, "Dry run: no command was run and no file was changed.");
     const writes = [];
     if (configRemovable) writes.push({ path: CODEX_CONFIG_FILE, action: "write", description: "remove the lines overlane added" });
     writes.push({ path: BINDING_FILE, action: "delete", description: "the project binding" }, { path: OWNED_FILE, action: "delete", description: "the record of what connect added" });
-    if (owned.excludeLine) writes.push({ path: await excludePath(deps, root), action: "write", description: `remove ${EXCLUDE_LINE}` });
     return {
       data: dryRunPlan({
         commands: steps.map((step2) => formatCommand(step2)),
@@ -67292,7 +67324,7 @@ async function disconnect(deps, options) {
     const without = configText.replace(lines.text, "");
     if (without.length === 0 && lines.createdFile) {
       removeFile(configPath);
-      removeDirIfEmpty(join20(root, ".codex"));
+      removeDirIfEmpty(join18(root, ".codex"));
     } else {
       writeIfDifferent(configPath, without);
     }
@@ -67302,17 +67334,21 @@ async function disconnect(deps, options) {
   if (failures.length > 0) {
     writeOwned(root, remaining);
     for (const failure4 of failures) warn(deps, failure4);
-    throw new CliError("some native commands failed; the connection is only partly removed, and .harness/owned.json keeps what is left. Fix the cause and run `overlane disconnect` again", {
+    throw new CliError("some native commands failed; the connection is only partly removed, and owned.json in the state folder keeps what is left. Fix the cause and run `overlane disconnect` again", {
       code: "partial_disconnect",
       hint: "overlane disconnect --force"
     });
   }
-  if (owned.excludeLine) await removeExclude(deps, root);
-  removeFile(join20(root, BINDING_FILE));
+  removeFile(statePath(root, "binding"));
   removed.push(BINDING_FILE, OWNED_FILE);
   removeOwned(root);
-  removeFile(join20(root, ".harness", "misses.log"));
-  removeDirIfEmpty(join20(root, ".harness"));
+  removeFile(statePath(root, "misses"));
+  const state = join18(root, STATE_DIR);
+  if (existsSync5(state) && readdirSync(state).every((name2) => name2 === ".gitignore")) {
+    removeFile(join18(state, ".gitignore"));
+    removeDirIfEmpty(state);
+  }
+  removeDirIfEmpty(join18(root, OVERLANE_DIR));
   const serviceUrl = binding.kind === "ok" ? binding.binding.serviceUrl : owned.serviceUrl;
   await deleteTokens(deps, serviceUrl);
   if (await loadTokens(deps, serviceUrl) !== null) {
@@ -67331,17 +67367,17 @@ init_zod();
 
 // ../cli/src/rules.ts
 init_src();
-import { existsSync as existsSync5, lstatSync as lstatSync2, mkdirSync as mkdirSync8, readFileSync as readFileSync12, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname8, join as join21 } from "node:path";
+import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync9, readFileSync as readFileSync13, renameSync as renameSync5, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname6, join as join19 } from "node:path";
 function readIfRegular(root, relative6, unsafe) {
-  const full = join21(root, relative6);
-  if (!existsSync5(full) && !isLink(full)) return null;
+  const full = join19(root, relative6);
+  if (!existsSync6(full) && !isLink(full)) return null;
   const stat = lstatSync2(full);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     unsafe.push(relative6);
     return null;
   }
-  return readFileSync12(full, "utf8");
+  return readFileSync13(full, "utf8");
 }
 function isLink(path) {
   try {
@@ -67380,10 +67416,10 @@ function applyPlan2(root, plan3) {
   const written = [];
   for (const step2 of plan3.steps) {
     if (step2.next === null) continue;
-    const full = join21(root, step2.path);
-    mkdirSync8(dirname8(full), { recursive: true });
+    const full = join19(root, step2.path);
+    mkdirSync9(dirname6(full), { recursive: true });
     const temp = `${full}.overlane-tmp`;
-    writeFileSync7(temp, step2.next, { encoding: "utf8", mode: 420 });
+    writeFileSync8(temp, step2.next, { encoding: "utf8", mode: 420 });
     renameSync5(temp, full);
     written.push(step2.path);
   }
@@ -67482,22 +67518,22 @@ async function doctor(deps, options) {
 // ../cli/src/kit/setup.ts
 init_src();
 import { randomUUID as randomUUID9 } from "node:crypto";
-import { existsSync as existsSync7, readdirSync as readdirSync2 } from "node:fs";
-import { join as join23 } from "node:path";
+import { existsSync as existsSync8, readdirSync as readdirSync3 } from "node:fs";
+import { join as join21 } from "node:path";
 
 // ../cli/src/kit/ci.ts
-import { existsSync as existsSync6, readdirSync } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync7, readdirSync as readdirSync2 } from "node:fs";
+import { join as join20 } from "node:path";
 var ACTION_PINS = {
   checkout: "actions/checkout@v7.0.1",
   setupNode: "actions/setup-node@v7.0.0",
   pnpm: "pnpm/action-setup@v6.1.0",
   setupPython: "actions/setup-python@v7.0.0"
 };
-var CI_FILE = join22(".github", "workflows", "ci.yml");
+var CI_FILE = join20(".github", "workflows", "ci.yml");
 function hasCi(root) {
   try {
-    return readdirSync(join22(root, ".github", "workflows")).some((name2) => /\.ya?ml$/.test(name2));
+    return readdirSync2(join20(root, ".github", "workflows")).some((name2) => /\.ya?ml$/.test(name2));
   } catch {
     return false;
   }
@@ -67509,12 +67545,12 @@ function ciWorkflow(root, detected) {
   for (const run3 of detected.typecheck ?? []) commands.push({ name: "Typecheck", run: run3 });
   for (const run3 of detected.test) commands.push({ name: "Test", run: run3 });
   if (!commands.some((command) => command.name !== "Install")) return null;
-  const node2 = existsSync6(join22(root, "package.json"));
-  const python = existsSync6(join22(root, "pyproject.toml"));
+  const node2 = existsSync7(join20(root, "package.json"));
+  const python = existsSync7(join20(root, "pyproject.toml"));
   const steps = [`      - uses: ${ACTION_PINS.checkout}`];
   if (node2) {
     if (detected.install?.startsWith("pnpm")) steps.push(`      - uses: ${ACTION_PINS.pnpm}`);
-    const version2 = existsSync6(join22(root, ".nvmrc")) ? "node-version-file: .nvmrc" : "node-version: 22";
+    const version2 = existsSync7(join20(root, ".nvmrc")) ? "node-version-file: .nvmrc" : "node-version: 22";
     steps.push(`      - uses: ${ACTION_PINS.setupNode}`, "        with:", `          ${version2}`);
   }
   if (python) {
@@ -67532,7 +67568,7 @@ var BLOCK_END = "<!-- overlane-kit:run-step:end -->";
 var BLOCK_BODY = [
   "## Autonomous runs",
   "",
-  "The plan is in `.harness/plan/`. To work on it, use the run-step skill: one bounded run, one task at a time, within the task's allowed paths.",
+  "The plan is in `.overlane/plan/`. To work on it, use the run-step skill: one bounded run, one task at a time, within the task's allowed paths.",
   AGENTS_LINE,
   "Decide questions yourself and record the decision with `overlane run decide`; do not wait for an answer."
 ].join("\n");
@@ -67556,7 +67592,7 @@ var INSTRUCTION_FILES = ["CLAUDE.md", "AGENTS.md"];
 var runPrompt = (projectId) => `Run one bounded step with the run-step skill for project ${projectId}.`;
 function hasSpecKit(root) {
   try {
-    return readdirSync2(join23(root, "specs"), { withFileTypes: true }).some((entry) => entry.isDirectory() && existsSync7(join23(root, "specs", entry.name, "tasks.md")));
+    return readdirSync3(join21(root, "specs"), { withFileTypes: true }).some((entry) => entry.isDirectory() && existsSync8(join21(root, "specs", entry.name, "tasks.md")));
   } catch {
     return false;
   }
@@ -67613,15 +67649,15 @@ async function connectKit(deps, options) {
   const project = await detectProject(deps, { name: options.name, provider: options.provider });
   const { root } = project;
   if (await headCommit(deps, root) === null) throw new CliError("the repository has no commit yet; make an initial commit first");
-  const planDir = join23(root, PLAN_DIR);
-  const planExists = existsSync7(join23(planDir, "project.md"));
+  const planDir = join21(root, PLAN_DIR2);
+  const planExists = existsSync8(join21(planDir, "project.md"));
   const ciExists = hasCi(root);
   let plan3;
   let planSource;
   try {
     if (planExists) {
       plan3 = await readPlan(root);
-      planSource = `${PLAN_DIR}/ already exists; kept as it is`;
+      planSource = `${PLAN_DIR2}/ already exists; kept as it is`;
     } else if (options.mode === "new") {
       plan3 = newPlan(project.name, options.goal ?? "", !ciExists);
       planSource = "minimal plan from --goal";
@@ -67638,7 +67674,7 @@ async function connectKit(deps, options) {
   }
   const detected = await detectCommands(root);
   const workflow = ciExists ? null : ciWorkflow(root, detected);
-  const blocks = INSTRUCTION_FILES.map((file2) => ({ file: file2, before: readText(join23(root, file2)) })).map((entry) => ({ ...entry, after: withBlock2(entry.before) }));
+  const blocks = INSTRUCTION_FILES.map((file2) => ({ file: file2, before: readText(join21(root, file2)) })).map((entry) => ({ ...entry, after: withBlock2(entry.before) }));
   const blockChanges = blocks.filter((entry) => entry.after !== entry.before);
   const firstMilestone = plan3.milestones[0]?.id ?? DEFAULT_RUN_POLICY.buildAheadLimit;
   const branchExists = (await gitOut(deps, root, "rev-parse", "--verify", "--quiet", `refs/heads/${KIT_BRANCH}`)).code === 0;
@@ -67648,10 +67684,10 @@ async function connectKit(deps, options) {
   if (unsaved.length > 0 && !options.dryRun) throw new CliError(`uncommitted changes in ${unsaved.join(", ")}; commit or stash them so the kit commit holds only its own lines`);
   say(deps, `Kit setup (${options.mode}) for ${projectLabel(project)}`);
   say(deps, `  branch: create ${KIT_BRANCH}`);
-  say(deps, `  plan: ${planSource} (${plan3.milestones.length} milestone(s), ${plan3.tasks.length} task(s))${planExists ? "" : `, written to ${PLAN_DIR}/`}`);
+  say(deps, `  plan: ${planSource} (${plan3.milestones.length} milestone(s), ${plan3.tasks.length} task(s))${planExists ? "" : `, written to ${PLAN_DIR2}/`}`);
   say(deps, ciExists ? "  ci: a workflow already exists; left alone" : workflow === null ? "  ci: no install, typecheck or test command detected, so no workflow is written (the plan task adds it)" : `  ci: write ${CI_FILE} (pinned actions; runs ${[detected.install, ...detected.typecheck ?? [], ...detected.test].filter((c2) => c2 !== void 0).join("; ")})`);
   for (const entry of blocks) say(deps, `  ${entry.file}: ${entry.after === entry.before ? "block already present" : entry.before === null ? "create with the run-step block" : "append the run-step block (your text is untouched)"}`);
-  say(deps, "  binding: the normal connect flow (plugins, .harness/project.json)");
+  say(deps, "  binding: the normal connect flow (plugins, .overlane/state/project.json)");
   say(deps, `  policy: default run policy, build-ahead limit ${firstMilestone}`);
   say(deps, "  sync: send the plan to the service");
   say(deps, "  review: commit on the branch and open one pull request (or print the exact commands)");
@@ -67664,7 +67700,7 @@ async function connectKit(deps, options) {
     say(deps, "Dry run: no file was written and no branch, commit or service change was made.");
     const base5 = inner.data !== void 0 && "dryRun" in inner.data ? inner.data : dryRunPlan({});
     const writes = [
-      ...planExists ? [] : [{ path: `${PLAN_DIR}/`, action: "write", description: planSource }],
+      ...planExists ? [] : [{ path: `${PLAN_DIR2}/`, action: "write", description: planSource }],
       ...workflow === null ? [] : [{ path: CI_FILE, action: "write", description: "CI workflow with pinned actions" }],
       ...blockChanges.map((entry) => ({ path: entry.file, action: entry.before === null ? "write" : "append", description: "the run-step block" })),
       ...base5.writes
@@ -67693,22 +67729,22 @@ async function connectKit(deps, options) {
   await gitOk(deps, root, "switch", "-c", KIT_BRANCH);
   if (!planExists) await writePlan(root, plan3);
   const written = [];
-  if (workflow !== null && writeIfDifferent(join23(root, CI_FILE), workflow)) written.push(CI_FILE);
-  for (const entry of blockChanges) if (writeIfDifferent(join23(root, entry.file), entry.after)) written.push(entry.file);
-  const agentConfig = [join23(".claude", "settings.json"), join23(".codex", "config.toml")];
+  if (workflow !== null && writeIfDifferent(join21(root, CI_FILE), workflow)) written.push(CI_FILE);
+  for (const entry of blockChanges) if (writeIfDifferent(join21(root, entry.file), entry.after)) written.push(entry.file);
+  const agentConfig = [join21(".claude", "settings.json"), join21(".codex", "config.toml")];
   const preDirty = new Set(await dirty(deps, root, agentConfig));
-  const preExisting = new Set(agentConfig.filter((file2) => existsSync7(join23(root, file2))));
+  const preExisting = new Set(agentConfig.filter((file2) => existsSync8(join21(root, file2))));
   const connected11 = await connect(deps, { ...options, yes: true });
   if (connected11.error !== void 0 || readBindingFile(root).kind !== "ok") {
     throw new CliError(`connect did not finish; the kit files are on ${KIT_BRANCH}, uncommitted. Fix the cause and run \`overlane connect\`, then commit`, { code: "connect_incomplete", hint: "overlane connect --yes" });
   }
   const connectData = connected11.data !== void 0 && !("dryRun" in connected11.data) ? connected11.data : void 0;
   for (const file2 of agentConfig) {
-    if (!existsSync7(join23(root, file2)) || preDirty.has(file2) || preExisting.has(file2) && (await dirty(deps, root, [file2])).length === 0) continue;
+    if (!existsSync8(join21(root, file2)) || preDirty.has(file2) || preExisting.has(file2) && (await dirty(deps, root, [file2])).length === 0) continue;
     if ((await gitOut(deps, root, "check-ignore", "-q", "--", file2)).code === 0) continue;
     written.push(file2);
   }
-  await gitOk(deps, root, "add", "-f", "--", PLAN_DIR);
+  await gitOk(deps, root, "add", "-f", "--", PLAN_DIR2);
   if (written.length > 0) await gitOk(deps, root, "add", "--", ...written);
   await gitOk(deps, root, "commit", "-m", "Set up the project kit", "-m", `Plan files, ${workflow === null ? "no new CI" : "CI"} and the run-step block. Review, merge, then the scheduler runs bounded steps.`);
   const sha = (await gitOk(deps, root, "rev-parse", "HEAD")).trim();
@@ -67770,7 +67806,7 @@ var ROOT_FLAG = { name: "marketplace-root", type: "string", value: "DIR", descri
 var connectCommand = defineCommand({
   path: ["connect"],
   summary: "Connect this project (native Overlane, or your GitHub repository): sign in, bind it, register the plugin; --kit also sets up a plan",
-  description: "Works in any git project, with no GitHub account: without a GitHub origin the project is a native Overlane project named after the folder (--name renames it). With a github.com origin it binds that repository instead (--provider overlane keeps it native). Detects the installed agents, previews the plan, then (with --yes) signs in through the browser, creates or looks up the project on the service, runs the agents' native plugin commands, writes .harness/project.json and records what it added in .harness/owned.json so `overlane disconnect` removes only that. With --kit existing|new it also drafts the plan files, CI and a pull request. Without a terminal it never prompts: pass --yes, or --dry-run to preview.",
+  description: "Works in any git project, with no GitHub account: without a GitHub origin the project is a native Overlane project named after the folder (--name renames it). With a github.com origin it binds that repository instead (--provider overlane keeps it native). Detects the installed agents, previews the plan, then (with --yes) signs in through the browser, creates or looks up the project on the service, runs the agents' native plugin commands, writes .overlane/state/project.json and records what it added in .overlane/state/owned.json so `overlane disconnect` removes only that. With --kit existing|new it also drafts the plan files, CI and a pull request. Without a terminal it never prompts: pass --yes, or --dry-run to preview.",
   flags: [
     { name: "service", type: "string", value: "URL", description: "Service address (https); default is the hosted service or OVERLANE_SERVICE_URL" },
     ROOT_FLAG,
@@ -67822,7 +67858,7 @@ var doctorCommand = defineCommand({
 var disconnectCommand = defineCommand({
   path: ["disconnect"],
   summary: "Remove what connect added to this project and delete the stored token",
-  description: "Removes only what .harness/owned.json records: the native plugin entries, the Codex config lines connect appended, the binding, and the stored token. Hosted history is untouched. Destructive: without a terminal it needs --force.",
+  description: "Removes only what .overlane/state/owned.json records: the native plugin entries, the Codex config lines connect appended, the binding, and the stored token. Hosted history is untouched. Destructive: without a terminal it needs --force.",
   examples: ["overlane disconnect --dry-run", "overlane disconnect --force"],
   effect: "destructive",
   keywords: ["remove", "uninstall", "unlink", "detach", "undo connect", "leave", "delete binding", "forget", "sign out", "logout", "clean up"],
@@ -67925,7 +67961,7 @@ async function updateRelease(deps, input2) {
             { method: "GET", path: input2.to === void 0 ? releasePaths.one(tenantId, "<pinned digest>") : releasePaths.one(tenantId, input2.to) }
           ],
           commands: [...updateSteps("claude"), ...updateSteps("codex")].map((step2) => `${step2.command} ${step2.args.join(" ")}`),
-          writes: [{ path: ".harness/release.json", action: "write", description: "the installed release record, written only after the commands succeed" }],
+          writes: [{ path: ".overlane/state/release.json", action: "write", description: "the installed release record, written only after the commands succeed" }],
           notes: ["No credentials were found, so the release was not read and no diff is shown."]
         })
       );
@@ -67945,7 +67981,7 @@ async function rollbackRelease(deps, input2) {
         service: project.serviceUrl,
         requests: [{ method: "POST", path: releasePaths.rollback(project.binding.tenantId, project.binding.projectId), body: {}, note: "moves the project's pin back to the previous release" }],
         commands: [...updateSteps("claude"), ...updateSteps("codex")].map((step2) => `${step2.command} ${step2.args.join(" ")}`),
-        writes: [{ path: ".harness/release.json", action: "write", description: "the installed release record, written only after the commands succeed" }],
+        writes: [{ path: ".overlane/state/release.json", action: "write", description: "the installed release record, written only after the commands succeed" }],
         notes: ["After the pin moves, the previous release is installed the way `overlane release update` installs it."]
       })
     );
@@ -68025,7 +68061,7 @@ var releaseListCommand = defineCommand({
 var releaseStatusCommand = defineCommand({
   path: ["release", "status"],
   summary: "Show the installed release against the project's pin",
-  description: `Compares the installed release (.harness/release.json) with the project binding and the service's pin, and lists approvals recorded on this machine. Works when the service is down (the pin then reads "unreachable").`,
+  description: `Compares the installed release (.overlane/state/release.json) with the project binding and the service's pin, and lists approvals recorded on this machine. Works when the service is down (the pin then reads "unreachable").`,
   examples: ["overlane release status"],
   effect: "read",
   ...common9,
@@ -68124,7 +68160,7 @@ var EXECUTOR = { name: "executor", type: "string", enum: ["claude-code", "codex"
 var STOP_NOTE = "A stop (policy paused, a budget spent, nothing runnable) exits 6 with the reason in the error code and the exact `overlane run end --reason ...` as the hint.";
 var runStartCommand = defineCommand({
   path: ["run", "start"],
-  summary: "Start a bounded run and record it in .harness/run.json",
+  summary: "Start a bounded run and record it in .overlane/state/run.json",
   description: `Starts one bounded run for this working copy after checking the run policy. ${STOP_NOTE}`,
   flags: [{ name: "trigger", type: "string", enum: ["schedule", "interactive", "event"], default: "interactive", description: "What started the run" }, EXECUTOR],
   examples: ["overlane run start --trigger schedule", "overlane run start --dry-run"],
@@ -68178,7 +68214,7 @@ var runDecideCommand = defineCommand({
 var runEndCommand = defineCommand({
   path: ["run", "end"],
   summary: "End the active run and release its leases",
-  description: "Ends the run with a stop reason, removes .harness/run.json and reports how many tasks were claimed and verified. Run it even when stopping early. Exit 1 when the service reports leases that were not released.",
+  description: "Ends the run with a stop reason, removes .overlane/state/run.json and reports how many tasks were claimed and verified. Run it even when stopping early. Exit 1 when the service reports leases that were not released.",
   flags: [{ name: "reason", type: "string", required: true, enum: RUN_STOP_REASONS, description: "Why the run ended" }],
   examples: ["overlane run end --reason nothing_runnable", "overlane run end --reason error"],
   effect: "write",
@@ -68224,17 +68260,17 @@ var runResumeCommand = defineCommand({
 var runCommands = [runStartCommand, runNextCommand, runClaimCommand, runDecideCommand, runEndCommand, runStatusCommand, runPauseCommand, runResumeCommand];
 
 // ../cli/src/task/queue.ts
+import { randomUUID as randomUUID10 } from "node:crypto";
+import { renameSync as renameSync6, writeFileSync as writeFileSync9 } from "node:fs";
 init_src();
 init_zod();
-import { randomUUID as randomUUID10 } from "node:crypto";
-import { mkdirSync as mkdirSync9, renameSync as renameSync6, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname9, join as join24 } from "node:path";
-var TASK_POLICY_PATH = join24(".harness", "task-policy.json");
+init_overlane_paths_node();
+var TASK_POLICY_PATH = ".overlane/state/task-policy.json";
 function writePolicyFile(root, policy, nowMs) {
-  const path = join24(root, TASK_POLICY_PATH);
-  mkdirSync9(dirname9(path), { recursive: true });
+  ensureStateDir(root);
+  const path = statePath(root, "taskPolicy");
   const temp = `${path}.${process.pid}.tmp`;
-  writeFileSync8(temp, `${JSON.stringify({ enforcement: policy.enforcement, ...policy.reason === void 0 ? {} : { reason: policy.reason }, checkedAt: new Date(nowMs).toISOString() }, null, 2)}
+  writeFileSync9(temp, `${JSON.stringify({ enforcement: policy.enforcement, ...policy.reason === void 0 ? {} : { reason: policy.reason }, checkedAt: new Date(nowMs).toISOString() }, null, 2)}
 `);
   renameSync6(temp, path);
 }
@@ -68433,7 +68469,7 @@ var taskPrioritiseCommand = defineCommand({
 var taskPolicyCommand = defineCommand({
   path: ["task", "policy"],
   summary: "Show whether changes need an active task, and refresh this working copy's copy",
-  description: "Reads the project's task requirement (default `required`: edits and mutating shell commands are refused without an active task) and writes it to .harness/task-policy.json for the hooks.",
+  description: "Reads the project's task requirement (default `required`: edits and mutating shell commands are refused without an active task) and writes it to .overlane/state/task-policy.json for the hooks.",
   examples: ["overlane task policy"],
   effect: "read",
   ...common11,
@@ -68823,7 +68859,7 @@ var TaskStartResult = withDryRun(
   external_exports.object({ taskId: external_exports.string(), version: external_exports.number(), state: external_exports.string(), holder: external_exports.string(), leaseExpiresAt: external_exports.string().optional(), next: external_exports.string() })
 );
 var TaskStatusResult = external_exports.object({
-  /** This working copy holds a task (`.harness/task.json`). */
+  /** This working copy holds a task (`.overlane/state/task.json`). */
   held: external_exports.boolean(),
   /** The held task still has this working copy's lease. */
   leaseHeld: external_exports.boolean().optional(),
@@ -68869,7 +68905,7 @@ var taskListCommand = defineCommand({
 var taskStartCommand = defineCommand({
   path: ["task", "start"],
   summary: "Claim an existing task, or create one with a contract and claim it",
-  description: "With a TASK_ID, claims that ready or paused task for this working copy (same checks as `task resume`). Without one, creates a task (outcome, acceptance criteria, required checks, allowed paths) at the current commit and claims it, writing the lease to .harness/task.json. Fails with exit 5 if this working copy already holds a task.",
+  description: "With a TASK_ID, claims that ready or paused task for this working copy (same checks as `task resume`). Without one, creates a task (outcome, acceptance criteria, required checks, allowed paths) at the current commit and claims it, writing the lease to .overlane/state/task.json. Fails with exit 5 if this working copy already holds a task.",
   args: [{ name: "task-id", required: false, description: "An existing task to claim; omit to create one from the flags" }],
   flags: [
     { name: "outcome", type: "string", value: "TEXT", description: "What the task must achieve (up to 500 characters)" },
@@ -69351,7 +69387,7 @@ var developerCommands = [
 // ../cli/src/commands/connector.ts
 init_src();
 init_zod();
-import { readFileSync as readFileSync13 } from "node:fs";
+import { readFileSync as readFileSync14 } from "node:fs";
 var Summary = external_exports.object({ provider: external_exports.string(), name: external_exports.string(), domain: external_exports.string(), auth: external_exports.string(), actions: external_exports.number(), nativeAlternative: external_exports.string() });
 var summary = (c2) => ({ provider: c2.provider, name: c2.displayName, domain: c2.domain, auth: c2.auth.type === "oauth" ? `OAuth (${c2.auth.scopes.join(" ")})` : `key (${c2.auth.keyLabel})`, actions: c2.actions.length, nativeAlternative: c2.nativeAlternative });
 var Action2 = external_exports.object({ name: external_exports.string(), summary: external_exports.string(), kind: external_exports.enum(["read", "write", "destructive"]), gateClass: external_exports.string().nullable() });
@@ -69546,7 +69582,7 @@ function inputOf(inv) {
   const inline = textFlag(inv, "input");
   const file2 = textFlag(inv, "input-file");
   if (inline !== void 0 && file2 !== void 0) throw new UsageError("give --input or --input-file, not both", { hint: "overlane schema connector run" });
-  const text2 = inline ?? (file2 === void 0 ? "{}" : readFileSync13(file2, "utf8"));
+  const text2 = inline ?? (file2 === void 0 ? "{}" : readFileSync14(file2, "utf8"));
   try {
     const parsed = JSON.parse(text2);
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("not an object");
@@ -70651,7 +70687,7 @@ var egressCommands = [egressPolicyShowCommand, egressPolicySetCommand, egressChe
 // ../cli/src/commands/enterprise.ts
 init_src();
 init_zod();
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "node:fs";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "node:fs";
 import { resolve as resolve13 } from "node:path";
 var common20 = { needsAuth: true, needsNetwork: true };
 async function connected9(inv) {
@@ -70742,8 +70778,8 @@ var enterpriseAuditExportCommand = defineCommand({
     const exported = await call2(AuditExport, "POST", enterprisePaths.auditExports(tenantId), {});
     const file2 = resolve13(inv.deps.paths.cwd, textFlag(inv, "out") ?? "audit.csv");
     const manifestFile = `${file2}.manifest.json`;
-    writeFileSync9(file2, exported.csv);
-    writeFileSync9(manifestFile, `${JSON.stringify(exported.manifest, null, 2)}
+    writeFileSync10(file2, exported.csv);
+    writeFileSync10(manifestFile, `${JSON.stringify(exported.manifest, null, 2)}
 `);
     return { data: { file: file2, manifestFile, manifest: exported.manifest } };
   }
@@ -70770,8 +70806,8 @@ var enterpriseAuditVerifyCommand = defineCommand({
     let manifest;
     let csv;
     try {
-      csv = readFileSync14(path, "utf8");
-      manifest = AuditExportManifest.parse(JSON.parse(readFileSync14(manifestPath, "utf8")));
+      csv = readFileSync15(path, "utf8");
+      manifest = AuditExportManifest.parse(JSON.parse(readFileSync15(manifestPath, "utf8")));
     } catch {
       throw new UsageError(`could not read ${file2} and its manifest`, { hint: "overlane enterprise audit export --out audit.csv" });
     }
@@ -71038,7 +71074,7 @@ var enterpriseDataExportCommand = defineCommand({
     const { call: call2, tenantId } = await connected9(inv);
     const report2 = await call2(DataExportReport, "POST", enterprisePaths.dataExport(tenantId), body2);
     const file2 = resolve13(inv.deps.paths.cwd, textFlag(inv, "out") ?? "export.ndjson");
-    writeFileSync9(file2, report2.ndjson);
+    writeFileSync10(file2, report2.ndjson);
     return { data: { file: file2, totalRows: report2.totalRows, stores: report2.stores } };
   }
 });
@@ -71655,13 +71691,13 @@ init_src();
 init_zod();
 
 // ../cli/src/token/brief.ts
-import { existsSync as existsSync9, readFileSync as readFileSync15 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync16 } from "node:fs";
+import { join as join23 } from "node:path";
 
 // ../cli/src/token/ctx.ts
 import { execFile } from "node:child_process";
-import { existsSync as existsSync8 } from "node:fs";
-import { dirname as dirname10, join as join25, relative as relative2, resolve as resolve14 } from "node:path";
+import { existsSync as existsSync9 } from "node:fs";
+import { dirname as dirname7, join as join22, relative as relative2, resolve as resolve14 } from "node:path";
 var CoreError = class extends Error {
   exit;
   hint;
@@ -71689,8 +71725,8 @@ function nodeCtx(cwd, env = process.env, now = Date.now) {
 function findRoot(cwd) {
   let dir = resolve14(cwd);
   for (; ; ) {
-    if (existsSync8(join25(dir, ".git")) || existsSync8(join25(dir, ".harness"))) return dir;
-    const up = dirname10(dir);
+    if (existsSync9(join22(dir, ".git")) || existsSync9(join22(dir, ".overlane"))) return dir;
+    const up = dirname7(dir);
     if (up === dir) return resolve14(cwd);
     dir = up;
   }
@@ -71746,9 +71782,9 @@ async function brief(ctx, input2) {
     lines.push(parsed === null ? "not a git repository" : formatGitBrief(parsed));
   }
   if (mode === "tasks" || mode === "all") {
-    const file2 = join26(root, "TASKS.md");
-    if (existsSync9(file2)) {
-      const open2 = openP0Lines(readFileSync15(file2, "utf8"));
+    const file2 = join23(root, "TASKS.md");
+    if (existsSync10(file2)) {
+      const open2 = openP0Lines(readFileSync16(file2, "utf8"));
       data.tasks = { source: "TASKS.md", open: open2.slice(0, MAX_TASKS), more: Math.max(0, open2.length - MAX_TASKS) };
       lines.push(...open2.length === 0 ? ["no open P0 lines in TASKS.md"] : [`${open2.length} open P0:`, ...data.tasks.open], ...data.tasks.more > 0 ? [`+${data.tasks.more} more in TASKS.md`] : []);
     } else {
@@ -71760,13 +71796,13 @@ async function brief(ctx, input2) {
 }
 
 // ../cli/src/token/code.ts
-import { existsSync as existsSync11, readFileSync as readFileSync17, statSync as statSync2 } from "node:fs";
-import { join as join28, relative as relative3, resolve as resolve15 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync18, statSync as statSync2 } from "node:fs";
+import { join as join24, relative as relative3, resolve as resolve15 } from "node:path";
 
 // ../cli/src/token/index-file.ts
-import { existsSync as existsSync10, readFileSync as readFileSync16 } from "node:fs";
-import { join as join27 } from "node:path";
-var INDEX_PATH = ".harness/code-index.json";
+import { existsSync as existsSync11, readFileSync as readFileSync17 } from "node:fs";
+init_overlane_paths_node();
+init_src();
 var BUILD_INDEX_COMMAND = "node packages/index-builder/dist/overlane-index.mjs map --root .";
 var LoadedIndex = class {
   constructor(sha, fileCount, uncovered, builtAt, rows, edges) {
@@ -71865,11 +71901,11 @@ function loadFreshIndex(ctx, root) {
   return pending;
 }
 async function loadFreshIndexUncached(ctx, root) {
-  const file2 = join27(root, INDEX_PATH);
-  if (!existsSync10(file2)) return { state: "missing" };
+  const file2 = statePath(root, "codeIndex");
+  if (!existsSync11(file2)) return { state: "missing" };
   let text2;
   try {
-    text2 = readFileSync16(file2, "utf8");
+    text2 = readFileSync17(file2, "utf8");
   } catch {
     return { state: "missing" };
   }
@@ -71882,7 +71918,7 @@ async function loadFreshIndexUncached(ctx, root) {
     ctx.git(["rev-list", "--count", `${index.sha}..HEAD`], root)
   ]);
   if (diff.code !== 0) return { state: "unusable", reason: `the index was built at ${index.sha.slice(0, 7)}, which this checkout does not have` };
-  const changed = new Set([...diff.stdout.split("\n"), ...untracked.code === 0 ? untracked.stdout.split("\n") : []].filter((p2) => p2 !== "" && !p2.startsWith(".harness/")));
+  const changed = new Set([...diff.stdout.split("\n"), ...untracked.code === 0 ? untracked.stdout.split("\n") : []].filter((p2) => p2 !== "" && !isStatePath(p2)));
   return { state: "ready", index, headSha: head.code === 0 ? head.stdout.trim() : "", behind: count.code === 0 ? Number.parseInt(count.stdout.trim(), 10) || 0 : 0, changed };
 }
 
@@ -71998,9 +72034,9 @@ var escapeRegex2 = (text2) => text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 var isTestPath = (path) => /(?:^|\/)(?:tests?|__tests__|fixtures)\/|\.(?:test|spec)\.[a-z]+$/.test(path);
 function readLines(root, path) {
   try {
-    const file2 = join28(root, path);
+    const file2 = join24(root, path);
     if (statSync2(file2).size > 4 * 1024 * 1024) return null;
-    return readFileSync17(file2, "utf8").split("\n");
+    return readFileSync18(file2, "utf8").split("\n");
   } catch {
     return null;
   }
@@ -72049,7 +72085,7 @@ function scanForDefinitions(root, files, name2) {
   return hits;
 }
 function indexProblem(fresh) {
-  if (fresh.state === "missing") return `no code index at .harness/code-index.json; build it with: ${BUILD_INDEX_COMMAND}`;
+  if (fresh.state === "missing") return `no code index at .overlane/state/code-index.json; build it with: ${BUILD_INDEX_COMMAND}`;
   if (fresh.state === "unusable") return `code index unusable (${fresh.reason}); rebuild with: ${BUILD_INDEX_COMMAND}`;
   return "";
 }
@@ -72112,7 +72148,7 @@ function numbered(lines, from, to) {
 function resolveFile(ctx, root, path) {
   for (const base5 of [root, ctx.cwd]) {
     const full = resolve15(base5, path);
-    if (existsSync11(full) && statSync2(full).isFile()) return relative3(root, full);
+    if (existsSync12(full) && statSync2(full).isFile()) return relative3(root, full);
   }
   return null;
 }
@@ -72306,19 +72342,19 @@ async function refsCore(ctx, input2) {
 }
 
 // ../cli/src/token/cloud.ts
+init_overlane_paths_node();
 import { execFileSync } from "node:child_process";
-import { readFileSync as readFileSync18 } from "node:fs";
+import { readFileSync as readFileSync19 } from "node:fs";
 import { homedir } from "node:os";
-import { join as join29 } from "node:path";
+import { join as join25 } from "node:path";
 var CLOUD_TIMEOUT_MS = 4e3;
-var BINDING_FILE2 = join29(".harness", "project.json");
 var KEYCHAIN_SERVICE2 = "overlane";
 var CloudUnavailable = class extends Error {
 };
 var text = (value) => typeof value === "string" && value.length > 0 ? value : void 0;
 function readCloudBinding(root) {
   try {
-    const raw = JSON.parse(readFileSync18(join29(root, BINDING_FILE2), "utf8"));
+    const raw = JSON.parse(readFileSync19(statePath(root, "binding"), "utf8"));
     const serviceUrl = text(raw["serviceUrl"]);
     const tenantId = text(raw["tenantId"]);
     const projectId = text(raw["projectId"]);
@@ -72329,8 +72365,8 @@ function readCloudBinding(root) {
   }
 }
 function configDir(env) {
-  const base5 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join29(homedir(), ".config");
-  return join29(base5, "overlane");
+  const base5 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join25(homedir(), ".config");
+  return join25(base5, "overlane");
 }
 function readKeychain(serviceUrl) {
   const commands = {
@@ -72365,7 +72401,7 @@ function findCloudToken(ctx, serviceUrl) {
     }
   }
   try {
-    const file2 = JSON.parse(readFileSync18(join29(configDir(ctx.env), "credentials.json"), "utf8"));
+    const file2 = JSON.parse(readFileSync19(join25(configDir(ctx.env), "credentials.json"), "utf8"));
     return usable(file2[serviceUrl], ctx.now());
   } catch {
     return null;
@@ -72373,7 +72409,7 @@ function findCloudToken(ctx, serviceUrl) {
 }
 function readOverlaySession(root) {
   try {
-    const id2 = readFileSync18(join29(root, ".harness", "overlay", "session"), "utf8").trim();
+    const id2 = readFileSync19(statePath(root, "overlay", "session"), "utf8").trim();
     return /^[A-Za-z0-9._-]{1,64}$/.test(id2) ? id2 : void 0;
   } catch {
     return void 0;
@@ -72576,8 +72612,8 @@ var codeShow = (ctx, input2) => cloudFirst(
 
 // ../cli/src/token/exec.ts
 import { spawn } from "node:child_process";
-import { createWriteStream, mkdirSync as mkdirSync10 } from "node:fs";
-import { join as join30 } from "node:path";
+import { createWriteStream, mkdirSync as mkdirSync11 } from "node:fs";
+import { join as join26 } from "node:path";
 
 // ../cli/src/token/parsers.ts
 var ANSI = /\u001b\[[0-9;?]*[A-Za-z]/g;
@@ -72918,6 +72954,7 @@ function summarise(command, output2, exit) {
 }
 
 // ../cli/src/token/exec.ts
+init_overlane_paths_node();
 var MAX_CAPTURE = 64 * 1024 * 1024;
 var SAFE_TOKEN = /^[A-Za-z0-9_@%+=:,./~-]+$/;
 var quote2 = (token) => SAFE_TOKEN.test(token) ? token : `'${token.replaceAll("'", "'\\''")}'`;
@@ -72940,10 +72977,11 @@ async function execCommand(ctx, input2) {
   }
   const command = commandLine(input2.tokens);
   const root = findRoot(ctx.cwd);
-  const dir = join30(root, ".harness", "logs");
-  mkdirSync10(dir, { recursive: true });
+  ensureStateDir(root);
+  const dir = statePath(root, "logs");
+  mkdirSync11(dir, { recursive: true });
   const started = ctx.now();
-  const logFile = join30(dir, `${utcStamp(started)}-${slugOf(input2.name, command)}.log`);
+  const logFile = join26(dir, `${utcStamp(started)}-${slugOf(input2.name, command)}.log`);
   const stream = createWriteStream(logFile);
   const chunks = [];
   let captured = 0;
@@ -72982,9 +73020,10 @@ function signalNumber(signal) {
 }
 
 // ../cli/src/token/ledger.ts
-import { existsSync as existsSync12, readFileSync as readFileSync19 } from "node:fs";
-import { join as join31, resolve as resolve16 } from "node:path";
-var LEDGER_PATH = ".harness/token-ledger.jsonl";
+import { existsSync as existsSync13, readFileSync as readFileSync20 } from "node:fs";
+import { resolve as resolve16 } from "node:path";
+init_overlane_paths_node();
+var LEDGER_PATH = ".overlane/state/token-ledger.jsonl";
 var CATEGORY_RULES = [
   ["wrangler", /\bwrangler\b/],
   ["typecheck", /\btsc\b|\btypecheck\b/],
@@ -73116,16 +73155,16 @@ async function tokensReport(ctx, input2) {
   let read;
   if (input2.transcript !== void 0) {
     const file2 = resolve16(ctx.cwd, input2.transcript);
-    if (!existsSync12(file2)) return { data: { source: input2.transcript, since: input2.since ?? null, calls: 0, tokens: 0, skipped: 0, rows: [] }, lines: [`none: no transcript at ${input2.transcript}`], exit: 4 };
+    if (!existsSync13(file2)) return { data: { source: input2.transcript, since: input2.since ?? null, calls: 0, tokens: 0, skipped: 0, rows: [] }, lines: [`none: no transcript at ${input2.transcript}`], exit: 4 };
     source = input2.transcript;
-    read = readTranscript(readFileSync19(file2, "utf8"));
+    read = readTranscript(readFileSync20(file2, "utf8"));
   } else {
-    const file2 = join31(root, LEDGER_PATH);
-    if (!existsSync12(file2)) {
+    const file2 = statePath(root, "ledger");
+    if (!existsSync13(file2)) {
       return { data: { source: LEDGER_PATH, since: input2.since ?? null, calls: 0, tokens: 0, skipped: 0, rows: [] }, lines: [`none: no ledger at ${LEDGER_PATH}; the tool-call hook writes it, or pass --transcript <path.jsonl>`], exit: 4 };
     }
     source = LEDGER_PATH;
-    read = readLedger(readFileSync19(file2, "utf8"));
+    read = readLedger(readFileSync20(file2, "utf8"));
   }
   const calls = cutoff === null ? read.calls : read.calls.filter((c2) => c2.ts >= cutoff);
   const report2 = buildReport(calls, top, source, input2.since ?? null, read.skipped);
@@ -73147,7 +73186,7 @@ var TOKEN_COMMANDS = [
   {
     path: ["code", "find"],
     summary: "Find where a symbol is defined: one line each, kind, qualified name, path:line",
-    description: `Looks the name up in the local code index (.harness/code-index.json) and prints "kind qualified path:line", best match first, at most --limit lines (default 20). Entries in files that changed since the index was built are replaced by a pattern scan, and the output says so. With no index, or one this checkout does not have, it prints one line saying so and falls back to a bounded literal search (git grep -n -w, at most 20 lines). ${NOTE} Use this in place of grep for "where is X defined".`,
+    description: `Looks the name up in the local code index (.overlane/state/code-index.json) and prints "kind qualified path:line", best match first, at most --limit lines (default 20). Entries in files that changed since the index was built are replaced by a pattern scan, and the output says so. With no index, or one this checkout does not have, it prints one line saying so and falls back to a bounded literal search (git grep -n -w, at most 20 lines). ${NOTE} Use this in place of grep for "where is X defined".`,
     args: [{ name: "name", required: true, description: "Symbol name, or a qualified name such as Class.method" }],
     flags: [
       { name: "kind", type: "string", value: "KIND", description: "Only this kind: function, class, interface, type, constant, method, variable, property, namespace" },
@@ -73195,7 +73234,7 @@ var TOKEN_COMMANDS = [
   {
     path: ["exec"],
     summary: "Run a command; keep the full output in a log and print a short status and parsed summary",
-    description: `Runs the command after -- through the shell, streams nothing, saves stdout and stderr to .harness/logs/TIMESTAMP-NAME.log, and prints one line "ok|FAIL exit=N 12.3s log=PATH" followed by a summary parsed from the output: vitest (files and tests per package, each failing test with the first lines of its assertion), tsc (error count and the first 10 errors), esbuild and astro build errors, wrangler deploy (version id, routes, errors), wrangler d1 (bookmark, applied migrations), git push (ref updates or the rejection). A command it does not know prints nothing more on success and its last 20 lines on failure. The exit code is the command's. A failure always shows its cause; the full text is in the log.`,
+    description: `Runs the command after -- through the shell, streams nothing, saves stdout and stderr to .overlane/state/logs/TIMESTAMP-NAME.log, and prints one line "ok|FAIL exit=N 12.3s log=PATH" followed by a summary parsed from the output: vitest (files and tests per package, each failing test with the first lines of its assertion), tsc (error count and the first 10 errors), esbuild and astro build errors, wrangler deploy (version id, routes, errors), wrangler d1 (bookmark, applied migrations), git push (ref updates or the rejection). A command it does not know prints nothing more on success and its last 20 lines on failure. The exit code is the command's. A failure always shows its cause; the full text is in the log.`,
     args: [{ name: "command", required: true, variadic: true, description: "The command and its arguments, after --" }],
     flags: [{ name: "name", type: "string", value: "NAME", description: "Label used in the log file name" }],
     examples: ["overlane exec -- pnpm -r test", "overlane exec --name typecheck -- pnpm -r typecheck", "overlane exec -- 'git push -u origin wip/unit'"],
@@ -73219,7 +73258,7 @@ var TOKEN_COMMANDS = [
   {
     path: ["tokens", "report"],
     summary: "Where tool-call tokens went, by category, with the terse command that replaces each",
-    description: `Reads .harness/token-ledger.jsonl (one JSON object per tool call: ts, tool, category, inChars, outChars, command) or, with --transcript, a Claude Code transcript (tool_use and tool_result pairs, Bash calls categorised by command: test, typecheck, wrangler, build, git, grep/sed/cat, curl, other). Prints the top categories by estimated tokens (characters / 4) with calls, average and the suggested replacement: grep, cat and sed to overlane code find, show, outline and refs; test, typecheck, build and wrangler to overlane exec; git status and log to overlane brief git. ${NOTE}`,
+    description: `Reads .overlane/state/token-ledger.jsonl (one JSON object per tool call: ts, tool, category, inChars, outChars, command) or, with --transcript, a Claude Code transcript (tool_use and tool_result pairs, Bash calls categorised by command: test, typecheck, wrangler, build, git, grep/sed/cat, curl, other). Prints the top categories by estimated tokens (characters / 4) with calls, average and the suggested replacement: grep, cat and sed to overlane code find, show, outline and refs; test, typecheck, build and wrangler to overlane exec; git status and log to overlane brief git. ${NOTE}`,
     args: [],
     flags: [
       { name: "since", type: "string", value: "WINDOW", description: "Only calls in this window: 7d, 12h, 30m, 2w or a date" },
@@ -73253,7 +73292,7 @@ function tokenCommand(path, result, effect = "read") {
     handler: async (inv) => {
       if (inv.dryRun) {
         const line3 = inv.positionals.join(" ");
-        return planOutcome(inv.deps, dryRunPlan({ commands: [line3], writes: [{ path: ".harness/logs", action: "write", description: "the full output of the command, in a new log file" }] }));
+        return planOutcome(inv.deps, dryRunPlan({ commands: [line3], writes: [{ path: ".overlane/state/logs", action: "write", description: "the full output of the command, in a new log file" }] }));
       }
       const ctx = nodeCtx(inv.deps.paths.cwd, inv.deps.env, inv.deps.now);
       try {
@@ -73563,38 +73602,38 @@ init_src2();
 
 // src/data-dir.ts
 import { homedir as homedir2 } from "node:os";
-import { join as join36 } from "node:path";
+import { join as join32 } from "node:path";
 function dataDir(env = process.env, home = homedir2()) {
   const override = env["OVERLANE_DATA_DIR"];
   if (override !== void 0 && override !== "") return override;
-  const base5 = env["XDG_DATA_HOME"] ?? (process.platform === "win32" ? env["LOCALAPPDATA"] : void 0) ?? (process.platform === "darwin" ? join36(home, "Library", "Application Support") : join36(home, ".local", "share"));
-  return join36(base5, "overlane");
+  const base5 = env["XDG_DATA_HOME"] ?? (process.platform === "win32" ? env["LOCALAPPDATA"] : void 0) ?? (process.platform === "darwin" ? join32(home, "Library", "Application Support") : join32(home, ".local", "share"));
+  return join32(base5, "overlane");
 }
 function marketplaceRoot(env = process.env, home = homedir2()) {
-  return join36(dataDir(env, home), "marketplace");
+  return join32(dataDir(env, home), "marketplace");
 }
 
 // src/plugin.ts
-import { readFileSync as readFileSync21 } from "node:fs";
-import { join as join38 } from "node:path";
+import { readFileSync as readFileSync22 } from "node:fs";
+import { join as join34 } from "node:path";
 import { parseArgs as parseArgs3 } from "node:util";
 
 // src/marketplace.ts
 init_src();
 import { createHash as createHash7 } from "node:crypto";
-import { cpSync, existsSync as existsSync13, mkdirSync as mkdirSync11, readdirSync as readdirSync3, readFileSync as readFileSync20, renameSync as renameSync7, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname12, join as join37, relative as relative4, sep } from "node:path";
+import { cpSync, existsSync as existsSync14, mkdirSync as mkdirSync12, readdirSync as readdirSync4, readFileSync as readFileSync21, renameSync as renameSync7, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync11 } from "node:fs";
+import { dirname as dirname9, join as join33, relative as relative4, sep } from "node:path";
 var CLIENT_DIRS = ["claude", "codex"];
 var TREE_DIRS = [...CLIENT_DIRS, ".claude-plugin", ".agents"];
 var EMBEDDED_MANIFEST = "release-manifest.json";
-var INSTALLED_MANIFEST = join37(".release", "manifest.json");
+var INSTALLED_MANIFEST = join33(".release", "manifest.json");
 var MarketplaceError = class extends Error {
 };
 function loadEmbedded(packageRoot2) {
-  const dir = join37(packageRoot2, "plugins");
-  const path = join37(dir, EMBEDDED_MANIFEST);
-  if (!existsSync13(path)) throw new MarketplaceError(`this package has no embedded plugin release (${path} is missing)`);
-  const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync20(path, "utf8")));
+  const dir = join33(packageRoot2, "plugins");
+  const path = join33(dir, EMBEDDED_MANIFEST);
+  if (!existsSync14(path)) throw new MarketplaceError(`this package has no embedded plugin release (${path} is missing)`);
+  const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync21(path, "utf8")));
   if (!parsed.success) throw new MarketplaceError(`the embedded release manifest is invalid: ${parsed.error.message}`);
   return { dir, manifest: parsed.data };
 }
@@ -73602,10 +73641,10 @@ function sha2562(data) {
   return `sha256:${createHash7("sha256").update(data).digest("hex")}`;
 }
 function listFiles(root, dir = root) {
-  if (!existsSync13(dir)) return [];
+  if (!existsSync14(dir)) return [];
   const out2 = [];
-  for (const entry of readdirSync3(dir, { withFileTypes: true })) {
-    const full = join37(dir, entry.name);
+  for (const entry of readdirSync4(dir, { withFileTypes: true })) {
+    const full = join33(dir, entry.name);
     if (entry.isDirectory()) out2.push(...listFiles(root, full));
     else out2.push(relative4(root, full).split(sep).join("/"));
   }
@@ -73617,15 +73656,15 @@ async function verifyTree(treeRoot, manifest) {
   if (recomputed !== manifest.digest) problems.push(`manifest digest ${manifest.digest} does not match its file list (${recomputed})`);
   const listed = new Set(manifest.files.map((file2) => file2.path));
   for (const file2 of manifest.files) {
-    const path = join37(treeRoot, file2.path);
-    if (!existsSync13(path)) {
+    const path = join33(treeRoot, file2.path);
+    if (!existsSync14(path)) {
       problems.push(`missing: ${file2.path}`);
       continue;
     }
-    if (sha2562(readFileSync20(path)) !== file2.digest) problems.push(`modified: ${file2.path}`);
+    if (sha2562(readFileSync21(path)) !== file2.digest) problems.push(`modified: ${file2.path}`);
   }
   for (const client of TREE_DIRS) {
-    for (const found of listFiles(join37(treeRoot, client))) {
+    for (const found of listFiles(join33(treeRoot, client))) {
       if (!listed.has(`${client}/${found}`)) problems.push(`unlisted: ${client}/${found}`);
     }
   }
@@ -73633,7 +73672,7 @@ async function verifyTree(treeRoot, manifest) {
 }
 function readInstalledManifest(target2) {
   try {
-    const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync20(join37(target2, INSTALLED_MANIFEST), "utf8")));
+    const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync21(join33(target2, INSTALLED_MANIFEST), "utf8")));
     return parsed.success ? parsed.data : null;
   } catch {
     return null;
@@ -73658,23 +73697,23 @@ async function syncMarketplace(embedded, target2) {
   const staging = `${target2}.new-${process.pid}`;
   const previous = `${target2}.old-${process.pid}`;
   rmSync4(staging, { recursive: true, force: true });
-  mkdirSync11(staging, { recursive: true });
+  mkdirSync12(staging, { recursive: true });
   try {
     for (const client of TREE_DIRS) {
-      if (existsSync13(join37(embedded.dir, client))) cpSync(join37(embedded.dir, client), join37(staging, client), { recursive: true });
+      if (existsSync14(join33(embedded.dir, client))) cpSync(join33(embedded.dir, client), join33(staging, client), { recursive: true });
     }
-    mkdirSync11(join37(staging, ".release"), { recursive: true });
-    writeFileSync10(join37(staging, INSTALLED_MANIFEST), `${JSON.stringify(embedded.manifest, null, 2)}
+    mkdirSync12(join33(staging, ".release"), { recursive: true });
+    writeFileSync11(join33(staging, INSTALLED_MANIFEST), `${JSON.stringify(embedded.manifest, null, 2)}
 `);
     const after = await verifyTree(staging, embedded.manifest);
     if (after.length > 0) throw new MarketplaceError(`the copied plugin files do not match the release manifest:
   ${after.join("\n  ")}`);
-    mkdirSync11(dirname12(target2), { recursive: true });
-    if (existsSync13(target2)) renameSync7(target2, previous);
+    mkdirSync12(dirname9(target2), { recursive: true });
+    if (existsSync14(target2)) renameSync7(target2, previous);
     try {
       renameSync7(staging, target2);
     } catch (error62) {
-      if (existsSync13(previous)) renameSync7(previous, target2);
+      if (existsSync14(previous)) renameSync7(previous, target2);
       throw error62;
     }
     rmSync4(previous, { recursive: true, force: true });
@@ -73684,7 +73723,7 @@ async function syncMarketplace(embedded, target2) {
 }
 async function ensureMarketplace(embedded, target2) {
   const installed = readInstalledManifest(target2);
-  const present = existsSync13(target2) && statSync3(target2).isDirectory();
+  const present = existsSync14(target2) && statSync3(target2).isDirectory();
   if (installed !== null && present && !isNewer(embedded.manifest.version, installed.version)) return false;
   await syncMarketplace(embedded, target2);
   return true;
@@ -73696,8 +73735,8 @@ var PLUGIN_USAGE = `  overlane plugin install [--scope project|user] [--client c
 var PluginUsageError = class extends Error {
 };
 function readNames(treeRoot, client) {
-  const file2 = client === "claude" ? join38(treeRoot, "claude", ".claude-plugin", "marketplace.json") : join38(treeRoot, "codex", ".agents", "plugins", "marketplace.json");
-  const parsed = JSON.parse(readFileSync21(file2, "utf8"));
+  const file2 = client === "claude" ? join34(treeRoot, "claude", ".claude-plugin", "marketplace.json") : join34(treeRoot, "codex", ".agents", "plugins", "marketplace.json");
+  const parsed = JSON.parse(readFileSync22(file2, "utf8"));
   const record3 = parsed;
   const plugin = record3.plugins?.[0]?.name;
   if (typeof record3.name !== "string" || typeof plugin !== "string") throw new MarketplaceError(`${file2} names no marketplace or plugin`);
@@ -73743,7 +73782,7 @@ ${PLUGIN_USAGE}`);
       const key = `${names.plugin}@${names.marketplace}`;
       if (!await available(deps, client)) {
         if (explicit !== void 0) {
-          deps.stderr(`overlane: \`${client}\` was not found on PATH; the marketplace is at ${join38(root, client)}
+          deps.stderr(`overlane: \`${client}\` was not found on PATH; the marketplace is at ${join34(root, client)}
 `);
           failed = true;
         } else {
@@ -73755,7 +73794,7 @@ ${PLUGIN_USAGE}`);
       ranAny = true;
       deps.stdout(`${client}:
 `);
-      const dir = join38(root, client);
+      const dir = join34(root, client);
       const steps = client === "claude" ? [
         ["claude", ["plugin", "marketplace", "add", dir, "--scope", scope]],
         ["claude", ["plugin", "marketplace", "update", names.marketplace]],
@@ -73923,7 +73962,7 @@ var packageCommands = [indexBuildCommand, indexUploadCommand, shimCommand, plugi
 // src/deps.ts
 import { execFile as execFile5, spawn as spawn2 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
-import { join as join41 } from "node:path";
+import { join as join37 } from "node:path";
 import { createInterface } from "node:readline/promises";
 function exec(command, args2, options) {
   return new Promise((resolveResult) => {
@@ -73969,8 +74008,8 @@ async function confirm(question) {
   }
 }
 function configDir3(env) {
-  const base5 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join41(homedir4(), ".config");
-  return join41(base5, "overlane");
+  const base5 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join37(homedir4(), ".config");
+  return join37(base5, "overlane");
 }
 function createDeps2(env = process.env) {
   return {