projectstore-claude 0.30.4 → 0.30.6

package/node_modules/projectstore/scripts/install-harness.mjs

@@ -79,6 +79,12 @@
 // status-line flag, the keep's record and the mark — each a set of keys
 // merged into the binding at apply time, after the layout item.
 //
+// What never reads the registry, fetches a shell or runs a host command is in
+// three leaf modules, moved as it was: install-handlers.mjs (the format-keyed
+// planners, setup's items, the plan helpers), install-layout.mjs (the layout
+// migration) and install-preview.mjs (PLAN and the APPLY lines). None imports
+// this file, and every name this file exported, it still exports.
+//
 // Direction: installer → surfaces ← doctor; installer → provenance ← doctor.
 // Doctor never imports this file.
 //
@@ -97,10 +103,9 @@ import {
   readFileSync,
   openSync,
   closeSync,
-  statSync,
   realpathSync,
 } from "node:fs";
-import { join, resolve, dirname, relative, isAbsolute, basename } from "node:path";
+import { join, resolve, dirname } from "node:path";
 import { homedir } from "node:os";
 import { randomUUID } from "node:crypto";
 import { fileURLToPath } from "node:url";
@@ -110,14 +115,9 @@ import {
   painter,
   icon as termIcon,
   duration,
-  stepReporter,
   liveLine,
   wrap,
   askApply,
-  plain,
-  badge as badgeText,
-  heading,
-  rowLines,
   kv,
   commandBlock,
   PLAIN,
@@ -139,17 +139,10 @@ import {
   configPath,
   childEnv,
 } from "./harness.mjs";
-import { FOREIGN_TEXT, GRAMMAR_VERSION } from "./provenance.mjs";
+import { GRAMMAR_VERSION } from "./provenance.mjs";
 import {
-  analyseBlock,
-  analyseJsonEntry,
-  analyseStampedFile,
   analyseRegistration,
   analysePortableRegistration,
-  analyseLayout,
-  analyseHarnessState,
-  isOurFile,
-  readText,
   registrationRenderRoot,
   registrationPaths,
 } from "./surfaces.mjs";
@@ -184,6 +177,8 @@ import {
   updateCheckOff,
   channelChoices,
   switchConsequence,
+  directoryConsequence,
+  copyOrigin,
   switchReason,
   noCopyToKeep,
   keepArgv,
@@ -201,7 +196,7 @@ import {
   READ_TIMEOUT_MS,
   MIN_READ_MS,
 } from "./convergence.mjs";
-import { applyBind, bindPlanSteps, recheckBind, bindResult } from "./binding.mjs";
+import { applyBind, recheckBind, bindResult } from "./binding.mjs";
 import {
   pluginRoot,
   channelMark,
@@ -212,25 +207,15 @@ import {
   writeExclusiveMetadata,
   ensureStateDir,
   ensureStateRoot,
-  ensureRuntimeDir,
-  removeAgentsBlock,
-  replaceAgentsBlock,
   readConfigAt,
-  isPluginCacheRoot,
+  isHostInstallRoot,
   isEphemeralRoot,
-  statusLineIsOurWiring,
   claudeHome,
   packageDigest,
   writeOwnTree,
   removeOwnTree,
   cmpPrecedence,
-  importsLine,
   whichOnPath as whichOnPathFromLib,
-  moveStateDir,
-  mergeEntryLog,
-  movePath,
-  removeInside,
-  statusLineScriptPath,
   layoutPaths,
   stagePortableMarketplace,
   finishPortableMarketplace,
@@ -238,30 +223,52 @@ import {
   removeTreeUnder,
   projectDirRefusal,
   fromTerminalIn,
-  newerBlockWords,
   registrationProvenance,
   envFlag,
   selectCopy,
   copyUpdateAdvice,
   takesVerbose,
 } from "./lib.mjs";
+import {
+  rel,
+  inside,
+  planAgentsBlock,
+  consequenceStep,
+  planStatuslineFlag,
+  planVault,
+  planStateDir,
+  STAMP,
+  stamped,
+  bindingItem,
+  planJsonEntry,
+  planStampedFile,
+  surfaceExcluded,
+  oneAddPerFile,
+  hostManagedReport,
+  isWrite,
+} from "./install-handlers.mjs";
+import { planLayout, planHarnessState, applyLayout, stepResult } from "./install-layout.mjs";
+import {
+  surfaceWords,
+  rowTarget,
+  VAULT_GROUP,
+  displayName,
+  badgeLine,
+  noticeText,
+  renderPreview,
+  applyReporter,
+} from "./install-preview.mjs";
 
 import { GENERATOR } from "./surfaces.mjs";
 export { GENERATOR };
 
-function rel(projectDir, p) {
-  const r = relative(projectDir, p);
-  return r && !r.startsWith("..") && !isAbsolute(r) ? r : p;
-}
-
 // isEphemeralRoot lives in lib.mjs beside the channel classifier that uses it;
 // re-exported here under the name the installer's callers already import.
 export { isEphemeralRoot };
 
-function inside(dir, parent) {
-  const r = relative(parent, dir);
-  return r !== "" && !r.startsWith("..") && !isAbsolute(r);
-}
+// PLAN, the badge, the notice and the APPLY lines live in install-preview.mjs;
+// re-exported here under the names the installer's callers already import.
+export { renderPreview, badgeLine, noticeText, applyReporter };
 
 // ─── Surface handlers, keyed by format ─────────────────────────────────
 //
@@ -282,386 +289,6 @@ const HANDLERS = {
 // line slot) decides whether the exclusive launcher is written at all.
 const KIND_ORDER = { registration: 0, shared: 1, exclusive: 2 };
 
-// Planned once per RUN by plan(), never once per harness (the story "One run
-// plans the agents block once, and a bare uninstall selects every harness the
-// project uses", rule 1). `s` carries the run's common file list as `files`;
-// `ctx.run` is every harness of the run that has a block, `ctx.harness` the
-// first of them, `ctx.readers` set when the run names more than one, and
-// `ctx.layout` the roster's layout name (rule 3).
-function planAgentsBlock(ctx, key, s) {
-  const { projectDir, mode, root } = ctx;
-  const run = ctx.run || [ctx.harness];
-  const a = analyseBlock(projectDir, s, { root, layout: ctx.layout || null, readers: ctx.readers || null });
-  const { withBlock, preferred, importLine, FALLBACK } = a;
-  const items = [];
-  if (a.refusal)
-    return [
-      {
-        surface: key,
-        kind: "shared",
-        path: a.files[0].path,
-        entry: "projectstore:agents",
-        state: "refused",
-        action: "refuse",
-        reason: a.refusal,
-      },
-    ];
-
-  const hasImport = (text) => importsLine(text, importLine);
-  // A CLAUDE.md that is nothing but the import registration added is ours to
-  // delete when the block goes (ADR-002 decision 4); anything else stays.
-  const onlyImport = (text) =>
-    String(text ?? "")
-      .split("\n")
-      .every((l) => !l.trim() || l.trim() === importLine);
-  // A file the removal leaves empty is deleted when it held only the block
-  // (rule 4) — and the fallback file, as before. Keyed on the fallback alone,
-  // a run's common list (whose last entry is AGENTS.md) and Claude Code alone
-  // both left a 0-byte AGENTS.md (measured 2026-10-08).
-  const removal = (e, extra = {}) => {
-    const after = removeAgentsBlock(e.text);
-    return {
-      surface: key,
-      kind: "shared",
-      path: e.path,
-      entry: `projectstore:agents v${e.block.v}`,
-      state: "ours-current",
-      action: "remove",
-      reason: null,
-      before: e.text,
-      after,
-      deleteIfEmpty: e.file === FALLBACK || !after.trim(),
-      ...extra,
-    };
-  };
-
-  if (mode === "uninstall") {
-    if (!withBlock.length)
-      return [
-        {
-          surface: key,
-          kind: "shared",
-          path: preferred.path,
-          entry: "projectstore:agents",
-          state: "ours-absent",
-          action: "skip",
-          reason: "no block to remove",
-        },
-      ];
-    // The agents block is the one surface the PROJECT owns rather than a
-    // harness: several harnesses read the same file. So disowning one harness
-    // may not remove it, and measurably did — `uninstall --harness <other>`
-    // deleted AGENTS.md while the source harness was still reading it through
-    // an @AGENTS.md import, and the reverse stripped the block Codex reads
-    // (both measured 2026-09-09). Either way, disowning one harness silently
-    // disabled the other.
-    //
-    // The test is static manifest data, not detection: is the file the block
-    // lives in one that ANOTHER manifest also names? No project state is read,
-    // so there is no circularity — and the single-harness case is untouched,
-    // because a file only one manifest names is that harness's to clear.
-    // Over-conservative on purpose: a block left behind is a marked,
-    // self-describing region a user can delete, where a deleted file another
-    // harness reads is silent breakage. `--surface agents_block` still removes
-    // it, which is the confirmation the gate asks for everywhere else.
-    //
-    // "Another" means a manifest OUTSIDE this run (rule 4): a run that names
-    // every harness reading the file is the last one, and removes the block
-    // once. Excluding only the planning harness kept the block for a harness
-    // that was in the same run.
-    const inRun = new Set(run.map((m) => m?.id));
-    const outside = [...loadHarnesses().values()].filter((m) => !inRun.has(m.id));
-    const alsoRead = (file) => outside.some((m) => (agentsBlockRow(m)?.[1].files || []).includes(file));
-    for (const e of withBlock) {
-      // Naming the surface removes it regardless: `--surface agents_block`
-      // is the confirmation without a terminal, and a terminal is asked
-      // (contract 9 as amended 2026-10-04).
-      if (!(ctx.surfaces || []).includes(key) && alsoRead(e.file)) {
-        items.push({
-          surface: key,
-          kind: "shared",
-          path: e.path,
-          entry: `projectstore:agents v${e.block.v}`,
-          state: "ours-current",
-          action: "skip",
-          reason: `${e.file} is read by another harness too — a per-harness uninstall leaves the project's block alone. Remove it with --surface ${key}`,
-        });
-        continue;
-      }
-      items.push(removal(e));
-    }
-    // An import that points at a file whose block has just gone is a pointer to
-    // nothing. Look across every file any manifest names, not just this one's:
-    // with a single-entry list PREFERRED and FALLBACK are the same file, which
-    // made the old condition — block in PREFERRED and not in FALLBACK —
-    // impossible to satisfy, so the import was never cleaned up at all.
-    // An import is dangling only when the file it names will be GONE — not
-    // merely when the block left it. A user's own AGENTS.md keeps its prose and
-    // survives, and importing it stays meaningful (install contract 13 /
-    // ADR-002 decision 4). The condition is therefore apply's own: marked for
-    // deletion and left holding nothing (`install-harness.mjs:760`).
-    const vanishing = new Set(
-      items
-        .filter((i) => i.action === "remove" && i.deleteIfEmpty && typeof i.after === "string" && !i.after.trim())
-        .map((i) => rel(projectDir, i.path)),
-    );
-    // Two independent reasons to take an import out, and the first version of
-    // this replaced one with the other:
-    //   (1) it is OURS and nothing else is there — the registration we added to
-    //       a file that held nothing else goes with the block (ADR-002
-    //       decision 4), whether or not its target survives;
-    //   (2) it DANGLES — the file it names will be gone, so it points at
-    //       nothing even though the reader's own prose keeps the file alive.
-    // A user's AGENTS.md that keeps its prose satisfies neither, and its import
-    // stays: that is install contract 13, and it is what caught the mistake.
-    //
-    // Over the UNION of every manifest's list, not this one's: the file holding
-    // the import need not be one this harness can read. Codex's list is a
-    // single entry, which also made the old condition — block in PREFERRED and
-    // not in FALLBACK — impossible to satisfy, so nothing was ever cleaned up.
-    //
-    // Except a BRIDGE (rule 4: a narrowed uninstall "leaves the block and the
-    // import in place"): the import in the file a harness outside this run
-    // reads by itself, pointing at a block this run keeps for that harness.
-    // It is the only way that harness sees the block; taking it out because it
-    // is ours kept the block and blinded its reader. The source harness's
-    // own uninstall still removes its own file's import, as before.
-    const blockGone = new Set(
-      items.filter((i) => i.action === "remove" && i.surface === key).map((i) => rel(projectDir, i.path)),
-    );
-    const blockKept = new Set(
-      items.filter((i) => i.action === "skip" && i.surface === key).map((i) => rel(projectDir, i.path)),
-    );
-    const outsideNatives = new Set(outside.map((m) => agentsBlockRow(m)?.[1].reads_natively).filter(Boolean));
-    const union = [...new Set([...loadHarnesses().values()].flatMap((m) => m.surfaces?.agents_block?.files || []))];
-    for (const file of union) {
-      if (blockGone.has(file)) continue;
-      const e = readText(join(projectDir, file));
-      if (!e.present || e.text === null || !hasImport(e.text)) continue;
-      const ours = onlyImport(e.text);
-      const dangles = vanishing.has(importLine.slice(1));
-      const bridge = blockKept.has(importLine.slice(1)) && outsideNatives.has(file);
-      if ((!ours && !dangles) || bridge) continue;
-      const after = e.text
-        .split("\n")
-        .filter((l) => l.trim() !== importLine)
-        .join("\n")
-        .replace(/^\n+/, "");
-      items.push({
-        surface: `${key}_import`,
-        kind: "shared",
-        path: join(projectDir, file),
-        entry: importLine,
-        state: "ours-current",
-        action: "remove",
-        reason: ours
-          ? `${file} holds only the import registration added`
-          : `${importLine} points at a file this uninstall removes`,
-        before: e.text,
-        after,
-        deleteIfEmpty: ours,
-      });
-    }
-    return items;
-  }
-
-  const current = a.current;
-  // A block marked above this copy's template is never rendered down (the
-  // install spec, contracts 4, 6 and 9, as amended 2026-10-14): a move, a
-  // migration or a dedupe carries its own bytes, stamped with its own marker.
-  const newer = a.newer || null;
-  const words = newer ? newerBlockWords(newer.block.v, a.version) : null;
-  const body = newer ? newer.block.block : a.desired;
-  const entry = `projectstore:agents v${newer ? newer.block.v : a.version}`;
-  // Two files, one block each: resolve in favour of the preferred file —
-  // register migrates, never duplicates (ADR-002 decision 3).
-  for (const e of a.duplicates || [])
-    items.push(
-      removal(e, {
-        state: "ours-stale",
-        reason:
-          newer === e
-            ? `carries v${e.block.v}, newer than this copy's v${a.version}; its text replaces the block in ${current.file}`
-            : `duplicate of the block in ${current.file}`,
-      }),
-    );
-  let newerInPlace = null;
-
-  if (!current) {
-    const target = preferred;
-    items.push({
-      surface: key,
-      kind: "shared",
-      path: target.path,
-      entry,
-      state: "ours-absent",
-      action: target.present ? "add" : "create",
-      reason: null,
-      before: target.present ? target.text : null,
-      after: replaceAgentsBlock(target.present ? target.text : "", a.desired),
-    });
-  } else if (!current.own || (current.file !== preferred.file && preferred.present)) {
-    // Two reasons to move, and they are not the same reason:
-    //   - the block sits in a file this harness cannot read (`!own`). It must
-    //     move, and its target is CREATED if it does not exist — this is a
-    //     second harness arriving in a project that had one.
-    //   - it sits in a readable but non-preferred file while the preferred one
-    //     already exists. A preference, satisfied because the file is there.
-    // The distinction is what keeps a Claude-Code-only project from acquiring
-    // an AGENTS.md it never asked for, while still moving the substance the
-    // moment a harness that can only read AGENTS.md is installed.
-    // A run of several harnesses says which of them cannot read the file the
-    // block leaves (rule 1); one harness keeps its text, byte for byte.
-    items.push(removal(current, { state: "ours-stale", reason: `migrating to ${preferred.file}` }));
-    items.push({
-      surface: key,
-      kind: "shared",
-      path: preferred.path,
-      entry,
-      state: "ours-absent",
-      action: preferred.present ? "add" : "create",
-      reason:
-        ctx.readers && !current.own
-          ? a.reason
-          : `migrated from ${current.file}${newer ? ` with its own text (${words})` : ""}`,
-      before: preferred.present ? preferred.text : null,
-      after: replaceAgentsBlock(preferred.present ? preferred.text : "", body),
-    });
-  } else if (newer && newer !== current) {
-    // The duplicate carries the higher marker: its text replaces the stayer's.
-    items.push({
-      surface: key,
-      kind: "shared",
-      path: current.path,
-      entry,
-      state: "ours-stale",
-      action: "replace-entry",
-      reason: `its text is replaced by ${newer.file}'s, which carries v${newer.block.v}, newer than this copy's v${a.version}`,
-      before: current.text,
-      after: replaceAgentsBlock(current.text, body),
-    });
-  } else if (newer) {
-    // It stays as it is; a named run with nothing else to place overwrites it,
-    // decided once the imports are known (below).
-    newerInPlace = {
-      surface: key,
-      kind: "shared",
-      path: current.path,
-      entry,
-      state: "ours-newer",
-      action: "skip",
-      reason: `${words}: left as it is — ${
-        ctx.takesSurface === false
-          ? `to write this copy's v${a.version} over it: ${coreCommand("install", { args: `--harness ${ctx.harness.id} --surface ${key}` })}`
-          : `name --surface ${key} to write this copy's v${a.version} over it`
-      }`,
-    };
-    items.push(newerInPlace);
-  } else if (current.block.v === a.version && current.block.block === a.desired) {
-    items.push({
-      surface: key,
-      kind: "shared",
-      path: current.path,
-      entry,
-      state: "ours-current",
-      action: "skip",
-      reason: null,
-    });
-  } else {
-    items.push({
-      surface: key,
-      kind: "shared",
-      path: current.path,
-      entry,
-      state: "ours-stale",
-      action: "replace-entry",
-      reason:
-        current.block.v !== a.version
-          ? `v${current.block.v} → v${a.version}`
-          : "content differs from the current source",
-      before: current.text,
-      after: replaceAgentsBlock(current.text, a.desired),
-    });
-  }
-
-  // The @AGENTS.md import in CLAUDE.md (ADR-002 decision 3), only when the
-  // block lives in AGENTS.md and CLAUDE.md exists without it. A removal
-  // already rewriting CLAUDE.md in this plan takes the import onto its own
-  // text, or the two items would race.
-  const written = items.find((i) => ["add", "create", "replace-entry", "skip"].includes(i.action) && i.surface === key);
-  const blockFile = written ? rel(projectDir, written.path) : null;
-  // Every OTHER file any manifest names, and only if it already exists: a
-  // reader whose file no longer holds the substance is pointed at the one that
-  // does. Never a file we would have to create — a project with no CLAUDE.md
-  // does not acquire one because Codex was installed.
-  //
-  // It used to key on `a.files.length > 1`, which is a property of the
-  // INSTALLING harness's list: Codex's has one entry, so installing Codex left
-  // a CLAUDE.md that still exists, still reads as authoritative, and no longer
-  // holds anything. The block's file is what decides, not the list's length.
-  // Installing FOR a harness means the file that harness reads by itself ends
-  // up present. It holds the block when the block lands there; it holds the
-  // import when the block lands elsewhere. Without this, a project that already
-  // had an AGENTS.md took the block into it and created no bridge — so Claude
-  // Code, the harness that ran the install, could not see what it had just
-  // installed. `reads_natively` is the manifest's, so this is a file list, not
-  // a harness name — and it is every RUN harness's (rule 1): one run for two
-  // harnesses leaves both native files present, each holding the block or the
-  // import.
-  const natives = new Set(run.map((m) => agentsBlockRow(m)?.[1].reads_natively).filter(Boolean));
-  // The import item sits under the run's first harness, which need not be the
-  // one that reads the file: in a run of several, the reason names the reader.
-  // One harness is its own reader and keeps its text, byte for byte.
-  const reader = (file) =>
-    (ctx.readers && run.find((m) => agentsBlockRow(m)?.[1].reads_natively === file)?.display_name) || "this harness";
-  for (const e of a.files) {
-    const mustExist = natives.has(e.file);
-    if (!blockFile || e.file === blockFile || (!e.present && !mustExist)) continue;
-    const line = `@${blockFile}`;
-    const rewrite = items.find((i) => i.action === "remove" && i.path === e.path);
-    // An absent native file is empty text, not a reason to skip: it is created.
-    const text = rewrite ? rewrite.after : e.present ? e.text : "";
-    if (typeof text !== "string" || importsLine(text, line)) continue;
-    const after = line + "\n" + (text.startsWith("\n") || !text.trim() ? "" : "\n") + text;
-    if (rewrite) {
-      rewrite.after = after;
-      rewrite.deleteIfEmpty = false;
-      rewrite.reason += `; ${line} import added`;
-    } else
-      items.push({
-        surface: `${key}_import`,
-        kind: "shared",
-        path: e.path,
-        entry: line,
-        state: "ours-absent",
-        action: e.present ? "add" : "create",
-        reason: e.present
-          ? `${blockFile} carries the block; ${e.file} must import it`
-          : `${e.file} is what ${reader(e.file)} reads by itself; it is created to import ${blockFile}`,
-        before: e.present ? text : null,
-        after,
-      });
-  }
-  // Naming the surface confirms the overwrite only when the run has nothing
-  // else to do for the block: it is the only block and every import it needs
-  // is in place. Doctor's placement remedies name the surface too, and they
-  // must never downgrade (contract 9 as amended 2026-10-14).
-  if (
-    newerInPlace &&
-    (ctx.surfaces || []).includes(key) &&
-    !(a.duplicates || []).length &&
-    !items.some((i) => i.surface === `${key}_import`)
-  )
-    Object.assign(newerInPlace, {
-      entry: `projectstore:agents v${a.version}`,
-      action: "replace-entry",
-      reason: `v${current.block.v} → v${a.version}: ${words}, and --surface ${key} names it`,
-      before: current.text,
-      after: replaceAgentsBlock(current.text, a.desired),
-    });
-  return items;
-}
-
 // ─── host-plugin-registration ──────────────────────────────────────────
 
 // One host command as a plan step: the verbatim argv (the manifest's
@@ -1134,16 +761,29 @@ function planRegistration(ctx, key, s) {
         path: a.paths.dir,
         why: "our marketplace directory, removed whole (its manifest carries our provenance field); no other checkout is installed from it",
       });
-    return [
-      {
-        ...base,
-        action: "remove",
-        steps,
-        reason: a.otherProjects
-          ? `${a.otherProjects} other checkout(s) are installed from the shared directory; it and the host's marketplace entry stay`
-          : a.reason,
-      },
-    ];
+    const removed = {
+      ...base,
+      action: "remove",
+      steps,
+      reason: a.otherProjects
+        ? `${a.otherProjects} other checkout(s) are installed from the shared directory; it and the host's marketplace entry stay`
+        : a.reason,
+    };
+    // The way back from the npm answer over a directory copy (PS-DIRECTORY,
+    // decision 5): when this checkout's npm copy was the one loading and no
+    // other copy is left on, the synced copy is the one the host loads again.
+    // DONE says so (off the envelope).
+    const reenabled = a.dir.disabled.some((k) => a.disabledHere.includes(k));
+    if (a.synced && a.installed?.present && a.enabled && !a.others.length && !reenabled)
+      Object.defineProperty(removed, "next", {
+        value: [
+          {
+            lead: `${a.synced.key}, from ${copyOrigin(a.synced)}, loads in this project again at the next start of ${harness.display_name}.`,
+          },
+        ],
+        enumerable: false,
+      });
+    return [removed];
   }
 
   // install / upgrade
@@ -1238,7 +878,8 @@ function planRegistration(ctx, key, s) {
   // Newer than what the project would run with the copy off — the shared
   // directory's version when another checkout wrote a newer one — not merely
   // newer than this package: under that, turning it off is no downgrade.
-  const newerOther = a.others
+  // A directory copy this registration would load over counts too (PS-DIRECTORY).
+  const newerOther = [...a.others, ...(a.directory ? [a.directory] : [])]
     .filter((o) => typeof o.version === "string" && cmpPrecedence(o.version, a.targetPkg || a.pkg) > 0)
     .sort((x, y) => cmpPrecedence(y.version, x.version))[0];
   if (newerOther && (ctx.channel ?? null) === null) {
@@ -1264,8 +905,11 @@ function planRegistration(ctx, key, s) {
   // switches this run plans, and contract 13's silenced set — the copies this
   // registration turned off that this checkout still holds off — for a
   // registration this checkout holds.
+  // A directory copy the registration loads over is that switch too, never
+  // turned off (PS-DIRECTORY, decision 4): a skip row of its own, below.
+  const shadows = a.directory && a.state !== "current" ? a.directory : null;
   ctx.channelFacts = {
-    switches: a.others.map((o) => o.key),
+    switches: [...a.others.map((o) => o.key), ...(shadows ? [shadows.key] : [])],
     silenced: ["current", "stale"].includes(a.state) ? a.dir.disabled.filter((k) => a.disabledHere.includes(k)) : [],
   };
 
@@ -1435,27 +1079,44 @@ function planRegistration(ctx, key, s) {
         : null;
     items.push({ ...other(o), action: "disable", ...(reason ? { reason } : {}), steps });
   }
+  // The directory copy (PS-DIRECTORY, "Setup and install keep a directory
+  // copy…", decision 4): the registration above loads over it by Claude
+  // Code's own precedence, so nothing is turned off — no `disable`, no ⇄
+  // switch, no entry in our manifest's disabled list. A skip whose
+  // consequence line says what changes; asked like a switch (the gate).
+  if (shadows) {
+    const extra =
+      ctx.channel === "npm"
+        ? switchReason({
+            copy: shadows,
+            running: a.pkg,
+            runs: a.targetPkg,
+            decision: ctx.convergence,
+            unbound: !ctx.binding?.bound,
+          })
+        : null;
+    items.push({
+      ...other(shadows),
+      state: "shadowed",
+      action: "skip",
+      reason: `${shadows.key} (${shadows.version || "no version recorded"}), from ${copyOrigin(shadows)}, stays enabled: nothing turns it off${extra ? `; ${extra}` : ""}`,
+      steps: [consequenceStep(directoryConsequence(harness.display_name))],
+    });
+  }
   return items;
 }
-
-// A row's consequence (presentation spec contract 7) carried as a `note` step:
-// the envelope reads `{ kind: "note", why }`, as any note; PLAN draws it first
-// beneath its row, in the explanation role, by the mark kept off the envelope.
-function consequenceStep(why) {
-  const st = { kind: "note", why };
-  Object.defineProperty(st, "consequence", { value: true, enumerable: false });
-  return st;
-}
-const isConsequence = (st) => st?.kind === "note" && st.consequence === true;
 // A channel switch: a copy from another marketplace turned off for this checkout.
 const isSwitch = (i) => String(i?.surface || "").endsWith("_others") && i.action === "disable";
+// …and a directory copy an npm registration loads over, never turned off.
+const isShadow = (i) => String(i?.surface || "").endsWith("_others") && i.state === "shadowed" && i.action === "skip";
 
 // The channel "git" (the converge story's rules 1 and 5), for the first
 // harness of the run with a host plugin registration — the channel concerns
 // that registration alone; Codex has none. The copy kept is contract 12's
-// selection (lib's selectCopy), limited to copies from another marketplace —
-// the git marketplace, a fork's — so the npm registration's copy is never the
-// kept one. None enabled for this project is a refusal: there is nothing to
+// selection (lib's selectCopy), limited to copies from another channel — the
+// git marketplace, a fork's, or Anthropic's directory (after every registry
+// row, so an enabled git copy wins) — so the npm registration's copy is never
+// the kept one. None enabled for this project is a refusal: there is nothing to
 // keep. A copy of ours this checkout's local settings hold off — a hand
 // removal of the npm row leaves the git copy off — is named with the way to
 // turn it back on. Read-only; plan() and the prepare step both call it, so the
@@ -1471,7 +1132,7 @@ function keepTarget(projectDir, ids, { root, home, env }) {
     );
     if (!row) continue;
     const [key, s] = row;
-    const copy = selectCopy(home, projectDir, { harness, only: "marketplace" });
+    const copy = selectCopy(home, projectDir, { harness, only: ["marketplace", "synced"] });
     if (copy) return { harness, key, s, copy };
     const a = analyseRegistration(projectDir, s, { root, home, harness, env });
     const off = (a.disabledHere || []).filter((k) => k !== a.id && k.split("@")[0] === s.plugin_name);
@@ -1537,7 +1198,7 @@ function planKeep(ctx, target, read) {
   const { projectDir, env, home, root, harness, surfaces } = ctx;
   const { key, s, copy } = target;
   const a = analyseRegistration(projectDir, s, { root, home, harness, env });
-  const beside = a.installed?.present && a.enabled ? npmRowBeside({ harness, id: a.id, surface: key }) : null;
+  const beside = a.installed?.present && a.enabled ? npmRowBeside({ harness, id: a.id, surface: key, copy }) : null;
   const besides = beside ? [beside] : [];
   const named = `${copy.key} ${copy.version || "(no version recorded)"}`;
   // Built whole, never spread into place: `next` (what DONE says) and `kept`
@@ -1568,7 +1229,7 @@ function planKeep(ctx, target, read) {
     });
     return it;
   };
-  const kept = `this project keeps ${named} from the git marketplace, and that copy writes its own ${harness.display_name} surfaces here — no registration changes`;
+  const kept = `this project keeps ${named} from ${copyOrigin(copy)}, and that copy writes its own ${harness.display_name} surfaces here — no registration changes`;
   if (surfaces && surfaces.length) {
     return [
       item({
@@ -1768,7 +1429,7 @@ function planMark(ctx, facts) {
 // answer wins, as for the mark: a `channel_switch` this checkout recorded
 // earlier, of any shape, goes in the same item — alone, when the keep is
 // already recorded.
-function planKeepRecord(ctx) {
+function planKeepRecord(ctx, copy = null) {
   const b = ctx.binding;
   if (!b || !b.bound) return null;
   const record = !b.hasKeepRecord;
@@ -1789,8 +1450,7 @@ function planKeepRecord(ctx) {
     set: record ? { [CHANNEL_KEEP_KEY]: STAMP } : {},
     unset: b.hasKey ? [CHANNEL_SWITCH_KEY] : [],
     why: {
-      [CHANNEL_KEEP_KEY]:
-        "this checkout chose to keep the git marketplace: setup's channel question defaults to keep from now on, and a run without a terminal reads it as --channel git",
+      [CHANNEL_KEEP_KEY]: `this checkout chose to keep ${copy?.synced ? `the copy from ${copyOrigin(copy)}` : "the git marketplace"}: setup's channel question defaults to keep from now on, and a run without a terminal reads it as --channel git`,
       [CHANNEL_SWITCH_KEY]:
         "the switch this checkout recorded earlier goes: the keep is its later answer, and doctor names a copy held off here again",
     },
@@ -1802,428 +1462,8 @@ function planKeepRecord(ctx) {
   });
 }
 
-// The status line's flag (the setup story, rule 9; the configure spec,
-// contract 6): `statusline.enabled`, from setup's answer or from a run that
-// names the surface — install records on, uninstall off. This item is the
-// flag's one writer; every other key of a `statusline` object is kept.
-// Planned for the run's harness that has the status-line surface, when the
-// binding the run leaves does not already say the same; only when there is a
-// binding to record it in.
-const STATUSLINE_FLAG = "statusline.enabled";
-function planStatuslineFlag(ctx, value, mode = "install") {
-  const b = ctx.binding;
-  if (!b || !b.bound || typeof value !== "boolean" || b.statusline === value) return null;
-  const off =
-    mode === "uninstall"
-      ? "the status line is removed in this run, and the SessionStart hook keeps it off"
-      : "the status line stays off, and setup does not ask again";
-  return bindingItem({
-    harness: ctx.harness.id,
-    surface: "statusline_flag",
-    entry: STATUSLINE_FLAG,
-    path: b.path,
-    bound: true,
-    set: { [STATUSLINE_FLAG]: value },
-    why: {
-      [STATUSLINE_FLAG]: value
-        ? "the status line is wired in this run, and the SessionStart hook keeps it current"
-        : off,
-    },
-    said: {
-      unbound: "the project is not bound; the status line's flag is recorded once it is",
-      done: "the status line's flag is already recorded",
-      object: "the status line's flag is not recorded",
-    },
-  });
-}
-
-// Setup's vault item (the story's rule 10; the front-door ADR's decision 7):
-// one item of kind `vault`, first in the plan and under no harness — PLAN's
-// VAULT group. Its steps are the binding plan's own (binding.mjs
-// bindPlanSteps): the mkdir, the binding, `git init`, the scaffold. `create`
-// for a vault this run makes (missing, or there and empty); `add` for a
-// binding of one that exists, scaffolded or not, and for a worktree's
-// inherited binding. The binding plan rides along off the envelope, for
-// apply; with nothing to write there is no item.
-function planVault(bp) {
-  const steps = bindPlanSteps(bp);
-  if (!steps.length) return null;
-  const reason = bp.inherit
-    ? `the vault of ${bp.inherit.from}, with its settings`
-    : bp.buildsVault || !bp.vaultExists
-      ? null
-      : bp.scaffoldsExisting
-        ? "it already exists; it is bound as it is, and the layout's missing folders and indexes are added"
-        : "it already exists; it is bound as it is";
-  const item = {
-    harness: null,
-    surface: "vault",
-    kind: "vault",
-    path: bp.vault,
-    entry: null,
-    state: !bp.vaultExists ? "absent" : bp.buildsVault ? "empty" : "present",
-    action: bp.buildsVault ? "create" : "add",
-    reason,
-    steps,
-  };
-  Object.defineProperty(item, "bind", { value: bp, enumerable: false });
-  return item;
-}
-
-// Setup's state directory (the story's rule 10): an empty
-// .projectstore/state/<id>/, the signal detection reads (detectHarnesses'
-// `state`), so a harness setup installed with no directory of its own is used
-// here before its first session. Never the welcome marker: that file means
-// the welcome was shown, and the first session writes it into this
-// directory. The first such item names state/ and its .gitignore when they
-// are still to be made.
-function planStateDir(projectDir, harness, { first = false } = {}) {
-  const P = layoutPaths(projectDir);
-  const path = P.harnessState(harness.id);
-  if (existsSync(path)) return null;
-  const steps =
-    first && !existsSync(P.stateGitignore)
-      ? [
-          {
-            kind: "ensure",
-            path: P.state,
-            why: "state/ with its .gitignore, which keeps everything under it out of git",
-          },
-        ]
-      : [];
-  return {
-    harness: harness.id,
-    surface: "harness_state",
-    kind: "state",
-    path,
-    entry: null,
-    state: "absent",
-    action: "create",
-    reason: null,
-    ...(steps.length ? { steps } : {}),
-  };
-}
-
-// A key a `binding` item stamps at apply: `{ by: "setup", at: <the time of
-// apply> }`, the mark's shape and the keep's.
-const STAMP = Object.freeze({ stamp: "setup" });
-const stamped = (v) =>
-  Boolean(v) && typeof v === "object" && !Array.isArray(v) && typeof v.by === "string" && typeof v.at === "string";
-
-// A `binding` item (the converge story's kind, made generic by the setup
-// story's rule 10): keys merged into the binding at apply time, after the
-// layout item, every other key kept. `set` maps a key — dotted for a nested
-// one — to its value, or to STAMP; `unset` lists the keys it removes. Both
-// are apply's data, kept off the envelope, as `said` is: the item's own
-// words for a binding that is not there, not an object, or already says it.
-// The steps are what PLAN shows and the envelope carries, in that order:
-// `mark` for a stamped key, `set` for a value, `unmark` for a removal. An
-// item that only removes a key is an `update` of a binding whose key is
-// `present`.
-function bindingItem({
-  harness,
-  surface,
-  entry,
-  path,
-  bound,
-  reason = null,
-  set = {},
-  unset = [],
-  why = {},
-  said = {},
-  action = "add",
-  state = "absent",
-}) {
-  const step = (fields, key) => (why[key] ? { ...fields, why: why[key] } : fields);
-  const steps = [
-    ...Object.entries(set).map(([key, value]) =>
-      step(value === STAMP ? { kind: "mark", path, key } : { kind: "set", path, key, value }, key),
-    ),
-    ...unset.map((key) => step({ kind: "unmark", path, key }, key)),
-  ];
-  const item = {
-    harness,
-    surface,
-    kind: "binding",
-    path,
-    entry,
-    state: bound ? state : "unbound",
-    action,
-    reason,
-    steps,
-  };
-  for (const [k, v] of Object.entries({ set, unset, said }))
-    Object.defineProperty(item, k, { value: v, enumerable: false });
-  return item;
-}
-
-function planJsonEntry(ctx, key, s) {
-  const { projectDir, mode, root, home } = ctx;
-  if (s.supported === false) {
-    return [
-      {
-        surface: key,
-        kind: "shared",
-        path: join(projectDir, s.file),
-        entry: s.marker?.pointer || null,
-        state: "unsupported",
-        action: "skip",
-        reason: s.why_unsupported || "not supported for this harness yet",
-      },
-    ];
-  }
-  const path = join(projectDir, s.file);
-  const entryKey = (s.marker?.pointer || "statusLine.command").split(".")[0];
-  // The status line is opt-in (projectstore.json → statusline.enabled), as
-  // the SessionStart refresh already honours; naming the surface explicitly
-  // is the other way to opt in. A verb with no --surface (setup, its rule 9)
-  // names install's command, which takes it, in the core form.
-  if (mode === "install" && !ctx.optIn.has(key)) {
-    const anyway =
-      ctx.takesSurface === false
-        ? `to wire it anyway: ${coreCommand("install", { args: `--harness ${ctx.harness.id} --surface ${key}` })}`
-        : "name --surface statusline to wire it anyway";
-    return [
-      {
-        surface: key,
-        kind: "shared",
-        path,
-        entry: entryKey,
-        state: "opt-out",
-        action: "skip",
-        reason: `statusline.enabled is not true in projectstore.json — ${anyway}`,
-      },
-    ];
-  }
-  const renderRoot = ctx.renderRoot || root;
-  // A root the package manager will collect (npx's cache, a node_modules) is
-  // never wired directly: the entry would name a path that disappears. It is
-  // wired against a registration's install path — or not at all (contract 4′).
-  if (mode === "install" && !isPluginCacheRoot(renderRoot, home) && isEphemeralRoot(renderRoot)) {
-    return [
-      {
-        surface: key,
-        kind: "shared",
-        path,
-        entry: entryKey,
-        state: "absent-or-present",
-        action: "skip",
-        reason:
-          "this package root is a package-manager cache; the status line is wired only against a registered install (see the registration above)",
-      },
-    ];
-  }
-  const a = analyseJsonEntry(projectDir, s, { root, home, renderRoot, harness: ctx.harness });
-  if (a.state === "unparseable")
-    return [
-      { surface: key, kind: "shared", path, entry: entryKey, state: "unparseable", action: "refuse", reason: a.reason },
-    ];
-
-  if (mode === "uninstall") {
-    if (!a.curEntry)
-      return [
-        { surface: key, kind: "shared", path, entry: entryKey, state: "ours-absent", action: "skip", reason: null },
-      ];
-    if (!a.ours)
-      return [
-        {
-          surface: key,
-          kind: "shared",
-          path,
-          entry: entryKey,
-          state: "theirs",
-          action: "skip",
-          reason: "the entry is not ours — left in place",
-        },
-      ];
-    const after = { ...a.settings };
-    delete after[entryKey];
-    return [
-      {
-        surface: key,
-        kind: "shared",
-        path,
-        entry: entryKey,
-        state: "ours-current",
-        action: "remove",
-        reason: null,
-        before: a.settings,
-        after,
-      },
-    ];
-  }
-  if (a.state === "theirs") {
-    ctx.slotForeign.add(key);
-    return [
-      {
-        surface: key,
-        kind: "shared",
-        path,
-        entry: entryKey,
-        state: "theirs",
-        action: "skip",
-        reason: "a status line we did not write owns the slot — left to its owner, and nothing else is wired for it",
-      },
-    ];
-  }
-  if (a.state === "ours-current")
-    return [
-      { surface: key, kind: "shared", path, entry: entryKey, state: "ours-current", action: "skip", reason: null },
-    ];
-  const after = {
-    ...a.settings,
-    [entryKey]: {
-      ...(a.curEntry && typeof a.curEntry === "object" ? a.curEntry : {}),
-      type: "command",
-      command: a.desired,
-    },
-  };
-  return [
-    {
-      surface: key,
-      kind: "shared",
-      path,
-      entry: entryKey,
-      state: a.state,
-      action: a.curEntry ? "replace-entry" : a.cur.present ? "add" : "create",
-      reason: a.curEntry ? a.reason : null,
-      before: a.cur.present ? a.settings : null,
-      after,
-    },
-  ];
-}
-
-function planStampedFile(ctx, key, s) {
-  const { projectDir, mode, root, home, harness } = ctx;
-  const renderRoot = ctx.renderRoot || root;
-  const path = join(projectDir, s.file);
-  const produced = !(s.condition === "plugin_cache_install" && !isPluginCacheRoot(renderRoot, home));
-  // The policy early-outs come before the render-and-hash, which they make
-  // unnecessary.
-  if (produced && mode === "install" && !ctx.optIn.has(s.condition ? "statusline" : key) && !ctx.optIn.has(key)) {
-    return [
-      {
-        surface: key,
-        kind: "exclusive",
-        path,
-        entry: null,
-        state: "opt-out",
-        action: "skip",
-        reason: "statusline.enabled is not true in projectstore.json",
-      },
-    ];
-  }
-  if (produced && mode === "install" && ctx.slotForeign.size) {
-    return [
-      {
-        surface: key,
-        kind: "exclusive",
-        path,
-        entry: null,
-        state: "absent-or-present",
-        action: "skip",
-        reason: "the status line slot is foreign; a launcher nothing points at is not written",
-      },
-    ];
-  }
-  const a = analyseStampedFile(projectDir, s, { root, home, harness, renderRoot });
-  // Not produced for this installation (a dev checkout is wired directly):
-  // a root that cannot produce a file has, by construction, never written it,
-  // so install and upgrade REPORT it and leave it (contract 13's wording;
-  // contract 7 as amended 2026-09-05 — a dev checkout's plan used to prune a
-  // cache install's launcher, the maintainer's habitual loop). Only uninstall
-  // removes it: the user asked to disown, and the file is recognisably ours.
-  // `prune` stays an action for the day a surface leaves the roster.
-  // A file found at its legacy path (the layout ADR): classified from there,
-  // removed from there, created at the new path — the legacy copy is then
-  // the layout cleanup's to delete once nothing names it.
-  const at = a.legacyPath || path;
-  if (!a.produced) {
-    if (!a.file.present) return [];
-    if (!a.ours)
-      return [
-        {
-          surface: key,
-          kind: "exclusive",
-          path: at,
-          entry: null,
-          state: "foreign",
-          action: "skip",
-          reason: "not produced for a dev checkout, and not ours — left in place",
-        },
-      ];
-    return [
-      {
-        surface: key,
-        kind: "exclusive",
-        path: at,
-        entry: null,
-        state: "stale",
-        action: mode === "uninstall" ? "remove" : "skip",
-        reason: a.reason,
-      },
-    ];
-  }
-  if (a.refusal)
-    return [{ surface: key, kind: "exclusive", path: at, state: "refused", action: "refuse", reason: a.refusal }];
-  const base = {
-    surface: key,
-    kind: "exclusive",
-    path: at,
-    entry: null,
-    state: a.state,
-    reason: a.reason,
-    writtenBy: a.writtenBy,
-    sameProject: a.sameProject,
-  };
-  if (mode === "uninstall") {
-    if (a.state === "absent") return [{ ...base, action: "skip" }];
-    if (a.state === "foreign") return [{ ...base, action: "refuse", reason: FOREIGN_TEXT }];
-    return [{ ...base, action: "remove" }];
-  }
-  if (a.state === "foreign") return [{ ...base, action: "refuse", reason: FOREIGN_TEXT }];
-  // Current, but written for another project (a copied or moved checkout):
-  // the file lives inside THIS project and its render names its project since
-  // 2026-09-06, so it is re-rendered here — doctor still reports who wrote it
-  // (contract 12); only the installer acts on it.
-  if (a.state === "current" && !a.legacyPath && a.writtenBy && !a.sameProject)
-    return [
-      {
-        ...base,
-        path,
-        action: "update",
-        reason: `current, written for ${a.writtenBy} — re-rendered for this project`,
-        after: a.stamped.text,
-      },
-    ];
-  if (a.state === "current" && !a.legacyPath) return [{ ...base, action: "skip" }];
-  // Written at the NEW path; a legacy file's state is why (stale, or current-but-moving).
-  return [
-    {
-      ...base,
-      path,
-      action: a.state === "absent" || a.legacyPath ? "create" : "update",
-      reason: a.legacyPath
-        ? `${a.reason ? a.reason + "; " : ""}moving from ${rel(projectDir, a.legacyPath)} (the layout ADR)`
-        : a.reason,
-      after: a.stamped.text,
-      legacyPath: a.legacyPath,
-    },
-  ];
-}
-
 // ─── plan ──────────────────────────────────────────────────────────────
 
-// The surface rows a run leaves out: a --surface that does not name the key
-// (by prefix, so `statusline` covers the launcher), or --no-register's
-// registration. One predicate for plan() and the shell fetch's decision.
-function surfaceExcluded(key, s, { surfaces = null, register = true } = {}) {
-  return (
-    Boolean(surfaces && !surfaces.some((x) => key === x || key.startsWith(x + "_"))) ||
-    (register === false && s.kind === "registration")
-  );
-}
-
 // `state` selects by the state directory too (upgrade's set, the shell-fetch
 // story's rule 5); `version` is the running root's, for a shell-rooted
 // registration planned without its payload; `payloadRoots` holds a fetched
@@ -2492,7 +1732,7 @@ export function plan(
     }
     if (mode === "uninstall") return;
     if (recordKeep && keeping && ctx.harness.id === keeping.harness.id) {
-      const kept = planKeepRecord(ctx);
+      const kept = planKeepRecord(ctx, keeping.copy);
       if (kept) marks.push(kept);
     }
   };
@@ -2641,7 +1881,7 @@ export function plan(
         // never an item: a --no-register run from a checkout re-pointed the
         // status line at the checkout (the second review of the 2026-10-03
         // fixes, S1).
-        if (s.kind === "registration" && !isPluginCacheRoot(root, home)) {
+        if (s.kind === "registration" && !isHostInstallRoot(root, home)) {
           const analyser =
             s.format === "portable-plugin-registration" ? analysePortableRegistration : analyseRegistration;
           const a = analyser(projectDir, s, { root, home, harness, env, version, fetched: ctx.fetched });
@@ -2678,8 +1918,12 @@ export function plan(
       const items = handler(ctx, key, s);
       const dependent =
         s.kind !== "registration" && ctx.renderRoot !== root && ["json-entry", "mjs"].includes(s.format);
-      for (const item of items)
-        out.items.push({ harness: id, ...item, ...(dependent ? { plannedAgainst: ctx.renderRoot } : {}) });
+      for (const item of items) {
+        const row = { harness: id, ...item, ...(dependent ? { plannedAgainst: ctx.renderRoot } : {}) };
+        // DONE's next lines stay off the envelope, through the spread too.
+        if (item.next) Object.defineProperty(row, "next", { value: item.next, enumerable: false });
+        out.items.push(row);
+      }
       if (s.kind === "registration") {
         // Phase two (contract 4′): the rest is planned against the root the
         // registration produces — when it produces one on this run or has.
@@ -2774,1028 +2018,6 @@ export function plan(
   return out;
 }
 
-// One add per file (the presentation spec, contract 7 as amended 2026-10-14):
-// within one plan, a file an earlier item creates is added once. A later
-// `create` or `add` on that path changes the file the run has just made, so it
-// reads `update`; its state, steps and detail stay. Each item is planned
-// against the tree before the run, so the binding the vault item writes was
-// "absent" to the status-line flag and the channel mark, and all three read
-// "add". A creator is an earlier `create` or `add` item that is neither a
-// registration (its host-owned files are the host CLI's) nor a binding row (it
-// never makes the binding: apply skips it on an unbound project, and the vault
-// item or the layout move makes the file), counted for the paths absent at
-// plan time: its own and each step's `path` — never a move step's `to`, so a
-// migrating project's binding rows keep `add`. An entry row on a file that was
-// there keeps `add`.
-function oneAddPerFile(items) {
-  const created = new Set();
-  const writes = (i) => i.action === "create" || i.action === "add";
-  for (const item of items) {
-    if (!writes(item) || item.kind === "registration") continue;
-    if (item.path && created.has(resolve(item.path))) {
-      item.action = "update";
-      continue;
-    }
-    if (item.kind === "binding") continue;
-    for (const p of [item.path, ...(item.steps || []).map((s) => s.path)])
-      if (p && !existsSync(p)) created.add(resolve(p));
-  }
-}
-
-// ─── the layout migration (the layout ADR; layout spec contract 6) ──────
-//
-// Two items, kind `layout`. The FIRST moves what only we read — the legacy
-// state directory (per-file collision policy), the entry log (merged), the
-// two legacy markers — and, last of its steps, the binding, whose `agents`
-// block becomes the harness's overlay. It never touches the launcher: the
-// settings entry names it, and the entry is re-pointed by the statusline item
-// only after the launcher item has written the new one. The LAST item, planned
-// after every surface, removes the legacy launcher once nothing names it and
-// prunes the emptied legacy runtime directory. Two config files is the one
-// refusal (a merge is the user's); uninstall is never blocked by it.
-function planLayout(ctx) {
-  const { projectDir, mode, env, harness } = ctx;
-  const a = analyseLayout(projectDir, { harness });
-  const P = a.paths;
-  const none = { first: [], last: [] };
-  if (!a.pending) return none;
-  const base = { surface: "layout", kind: "layout", path: P.legacy.binding, entry: null, state: a.state, reason: null };
-  if (mode === "uninstall") {
-    // Disowning: the legacy runtime directory goes with the new one when it is
-    // ours (its header); the legacy binding is bind's, never uninstall's. A
-    // narrowed uninstall leaves it alone: the way back from an npm switch is
-    // `uninstall --surface plugin`, and it deleted a not-yet-moved project's
-    // sessions, log and the launcher its status line still ran (the critic's
-    // fourth pass, 2026-10-04). `surfaces` is null when nothing was named.
-    if (ctx.surfaces) return none;
-    if (!a.legacy.runtime || !a.legacy.runtimeOurs) return none;
-    return {
-      first: [],
-      last: [
-        {
-          ...base,
-          surface: "layout_cleanup",
-          path: P.legacy.runtime,
-          state: "legacy",
-          action: "remove",
-          reason: "the legacy runtime directory is ours (its .gitignore header) and goes with the state",
-          steps: [
-            {
-              kind: "remove-legacy-runtime",
-              path: P.legacy.runtime,
-              why: "the pre-0.28 state directory, removed whole",
-            },
-            {
-              kind: "note",
-              why: ".projectstore/state/ (sessions, the entry log) and the binding stay: the hooks' records and bind's file, not install's — delete .projectstore/ by hand to disown fully",
-            },
-          ],
-        },
-      ],
-    };
-  }
-  if (a.twoConfigs && !a.resumable)
-    return {
-      first: [
-        {
-          ...base,
-          action: "refuse",
-          reason: `two bindings: ${P.legacy.binding} (legacy) and ${P.binding} — keep one and delete the other (usually the legacy one), then run install again; nothing is written while both exist`,
-        },
-      ],
-      last: [],
-    };
-  if (insideHostSession(env, harness)) {
-    ctx.incomplete = true;
-    return {
-      first: [
-        {
-          ...base,
-          action: "skip",
-          deferred: true,
-          reason: `the layout migration moves files this ${harness.display_name} session reads and writes — run it from a terminal outside the session`,
-        },
-      ],
-      last: [],
-    };
-  }
-  const steps = [
-    {
-      kind: "note",
-      why: `close other ${harness.display_name} sessions in this project first and restart afterwards: the migration moves files a running session reads and writes, and the status line does not reload mid-session`,
-    },
-    { kind: "ensure", path: P.root, why: ".projectstore/ with its .gitignore (projectstore.json, state/)" },
-  ];
-  if (a.legacy.state)
-    steps.push({
-      kind: "move-state",
-      from: P.legacy.state,
-      to: P.sessions,
-      files: a.legacy.stateFiles.length,
-      why: "session files move into state/sessions/; one present on both sides keeps the newer, a per-session directory keeps the new side",
-    });
-  if (a.legacy.entryLog)
-    steps.push({
-      kind: "merge-log",
-      from: P.legacy.entryLog,
-      to: P.entryLog,
-      why: "the legacy entry log's lines go before the new log's",
-    });
-  if (a.legacy.welcomed)
-    steps.push({
-      kind: "move-marker",
-      from: P.legacy.welcomed,
-      to: P.welcomed(harness.id),
-      why: "the welcome marker moves under state/<harness>/ — a migrated project is not welcomed twice",
-    });
-  if (a.legacy.sessionId) steps.push({ kind: "delete", path: P.legacy.sessionId, why: "the 0.6-era session-id file" });
-  if (a.legacy.binding && a.resumable)
-    steps.push({
-      kind: "delete",
-      path: P.legacy.binding,
-      why: "the binding was already moved (an interrupted run left the legacy copy, byte-equal but for its agents block)",
-    });
-  else if (a.legacy.binding)
-    steps.push({
-      kind: "move-binding",
-      from: P.legacy.binding,
-      to: P.binding,
-      overlay: P.overlay(harness.id),
-      why: `the binding moves; its agents block becomes harness/${harness.id}.json`,
-    });
-  const first = [
-    {
-      ...base,
-      action: "migrate",
-      steps,
-      reason: `${a.legacy.binding ? "binding" : "state"} in the pre-0.28 layout under ${a.legacy.dir}/`,
-    },
-  ];
-  const last = [];
-  if (a.legacy.launcher || a.legacy.runtime) {
-    const cleanup = [];
-    if (a.legacy.launcher)
-      cleanup.push({
-        kind: "remove-legacy-launcher",
-        path: P.legacy.launcher,
-        why: "removed once the new launcher is written and the settings entry names it — or at once when the status-line slot is not ours (foreign, or empty because the status line is off); kept while a settings file the host reads (this project's local or committed settings, or the user's) still runs it as the status line — a script that calls it indirectly is not seen",
-      });
-    if (a.legacy.runtime)
-      cleanup.push({ kind: "rmdir-legacy", path: P.legacy.runtime, why: "the emptied pre-0.28 runtime directory" });
-    last.push({
-      ...base,
-      surface: "layout_cleanup",
-      path: P.legacy.runtime,
-      state: "legacy",
-      action: "cleanup",
-      reason: null,
-      steps: cleanup,
-    });
-  }
-  return { first, last };
-}
-
-// A project uninstall's last item per harness (the shell-fetch story's rule
-// 5; install spec contract 13 as amended): .projectstore/state/<id>/ is
-// emptied of the welcome marker — recognised by analyseHarnessState — and
-// removed once empty, so the next bare upgrade stops selecting the harness
-// it disowned. Planned for a directory holding the marker, or nothing; a
-// directory holding only what is not ours is left without a row. It never
-// touches a launcher: that is its surface item's to remove, when it is ours.
-// What stays — a launcher this plan does not remove, a file of the user's —
-// is named in the preview, and keeps the directory. Not a guarantee: a
-// harness whose plugin stays installed for the machine fires its hooks here
-// again, its welcome comes back, and so does the signal — accurately.
-function planHarnessState(projectDir, harness, planned) {
-  const a = analyseHarnessState(projectDir, harness.id);
-  if (!a.present || (!a.marker && a.names.length)) return null;
-  const removing = new Set(
-    planned
-      .filter((i) => i.kind === "exclusive" && i.action === "remove" && dirname(i.path) === a.dir)
-      .map((i) => basename(i.path)),
-  );
-  const left = a.others.filter((n) => !removing.has(n));
-  const steps = [];
-  if (a.marker)
-    steps.push({
-      kind: "delete",
-      path: a.marker,
-      why: "the welcome marker the SessionStart hook wrote; a bare upgrade selects the harness by it",
-    });
-  steps.push({
-    kind: "rmdir-state",
-    path: a.dir,
-    left,
-    why: left.length
-      ? `${left.join(", ")} ${left.length === 1 ? "is" : "are"} not this step's to remove, and keep${left.length === 1 ? "s" : ""} the directory`
-      : "removed once empty",
-  });
-  return {
-    surface: "harness_state",
-    kind: "layout",
-    path: a.dir,
-    entry: null,
-    state: a.marker ? "ours" : "empty",
-    action: "remove",
-    reason: a.marker
-      ? `${harness.display_name}'s welcome marker — the state directory selects ${harness.display_name} for a bare upgrade`
-      : `an empty state directory of ${harness.display_name}`,
-    steps,
-  };
-}
-
-function applyLayout(p, i, { failed, home = homedir(), onStep = null }) {
-  const out = { path: i.path, action: i.action, surface: i.surface, steps: [] };
-  const within = p.projectDir;
-  if (i.action === "cleanup" && failed) {
-    out.action = "skipped";
-    out.reason = "an earlier item failed; the legacy files stay until the next run";
-    return out;
-  }
-  const fail = (step, message) => {
-    out.failed = { step, status: null, stderr: message };
-    return out;
-  };
-  for (const st of i.steps || []) {
-    const seen = out.steps.length;
-    if (onStep) onStep(st, "start");
-    try {
-      if (st.kind === "ensure") {
-        ensureRuntimeDir(within);
-        out.steps.push({ kind: st.kind, ok: true });
-      } else if (st.kind === "move-state") {
-        const r = moveStateDir(st.from, st.to, within);
-        ensureStateDir(within);
-        out.steps.push({ kind: st.kind, ok: true, ...r });
-      } else if (st.kind === "merge-log") {
-        const r = mergeEntryLog(st.from, st.to, within);
-        out.steps.push({ kind: st.kind, ok: true, result: r });
-      } else if (st.kind === "delete") {
-        out.steps.push({ kind: st.kind, path: st.path, ok: true, removed: removeInside(st.path, within) });
-      } else if (st.kind === "move-marker") {
-        const r = movePath(st.from, st.to, within);
-        if (r === "target-exists") removeInside(st.from, within);
-        out.steps.push({ kind: st.kind, ok: true, result: r });
-      } else if (st.kind === "move-binding") {
-        let cfg;
-        try {
-          cfg = JSON.parse(readFileSync(st.from, "utf8"));
-        } catch {
-          return fail(st.kind, `${st.from} is not valid JSON; the binding was not moved`);
-        }
-        if (existsSync(st.to)) return fail(st.kind, `${st.to} appeared under the plan; two bindings are a refusal`);
-        const { agents, ...binding } = cfg && typeof cfg === "object" ? cfg : {};
-        if (agents && typeof agents === "object") {
-          let overlay = {};
-          try {
-            overlay = JSON.parse(readFileSync(st.overlay, "utf8"));
-          } catch {}
-          mkdirSync(dirname(st.overlay), { recursive: true });
-          writeFileAtomic(st.overlay, JSON.stringify({ ...overlay, agents }, null, 2) + "\n", { sweep: false });
-        }
-        mkdirSync(dirname(st.to), { recursive: true });
-        writeFileAtomic(st.to, JSON.stringify(binding, null, 2) + "\n", { sweep: false });
-        removeInside(st.from, within);
-        out.steps.push({ kind: st.kind, ok: true, overlay: Boolean(agents) });
-      } else if (st.kind === "remove-legacy-launcher") {
-        // Only ours, and only when no settings entry names it any more.
-        let text = null;
-        try {
-          text = readFileSync(st.path, "utf8");
-        } catch {}
-        // "Still in use" is decided by the FILE, not the spelling: an entry
-        // written through a symlinked or differently-cased path, or living in
-        // the committed or the user's settings, still runs it (the third review
-        // of the 2026-10-03 fixes — a string comparison of the local file alone
-        // deleted a launcher the status line was running).
-        const named =
-          entryNames(p.projectDir, i.harness, st.path) || settingsRunFile(p.projectDir, i.harness, st.path, home);
-        // Moved, never just deleted: the legacy launcher goes only once the new
-        // one exists (a dev root produces none — contract 7 leaves it in place)
-        // — unless the status-line slot is not ours (any wiring of ours counts).
-        // Under a foreign or empty slot the new launcher is never made, and
-        // keeping the old one kept layout-legacy alive forever (the critic of
-        // the layout spec's 2026-10-03 amendment, case S1).
-        const moved = existsSync(layoutPaths(p.projectDir).launcher(i.harness));
-        const slotOurs = slotIsOurs(p.projectDir, i.harness, { home, root: p.root });
-        if (text === null) out.steps.push({ kind: st.kind, ok: true, removed: false });
-        else if (!moved && slotOurs)
-          out.steps.push({
-            kind: st.kind,
-            ok: true,
-            removed: false,
-            reason: "no launcher at the new path yet (this root does not produce one) — left in place",
-          });
-        else if (!isOurFile(text))
-          out.steps.push({ kind: st.kind, ok: true, removed: false, reason: "not ours — left in place" });
-        else if (named)
-          out.steps.push({
-            kind: st.kind,
-            ok: true,
-            removed: false,
-            reason: "a settings file the host reads still runs it as the status line — left in place",
-          });
-        else out.steps.push({ kind: st.kind, ok: true, removed: removeInside(st.path, within) });
-      } else if (st.kind === "rmdir-legacy") {
-        // Prune the legacy runtime dir when only its own .gitignore (and an empty state/) remain.
-        let left = [];
-        try {
-          left = readdirSync(st.path).filter((n) => n !== ".gitignore");
-        } catch {
-          out.steps.push({ kind: st.kind, ok: true, removed: false });
-          continue;
-        }
-        if (left.length === 1 && left[0] === "state") {
-          try {
-            if (readdirSync(join(st.path, "state")).length === 0) {
-              rmdirSync(join(st.path, "state"));
-              left = [];
-            }
-          } catch {}
-        }
-        if (left.length) {
-          out.steps.push({ kind: st.kind, ok: true, removed: false, reason: `${left.join(", ")} remain` });
-          continue;
-        }
-        removeInside(st.path, within, { recursive: true });
-        out.steps.push({ kind: st.kind, ok: true, removed: true });
-      } else if (st.kind === "remove-legacy-runtime") {
-        removeInside(st.path, within, { recursive: true });
-        out.steps.push({ kind: st.kind, ok: true, removed: true });
-      } else if (st.kind === "rmdir-state") {
-        // rmdirSync on an empty directory only: whatever is left — read now,
-        // after the items before it ran — keeps it, and is named.
-        let left = [];
-        try {
-          left = readdirSync(st.path).sort();
-        } catch {
-          out.steps.push({ kind: st.kind, ok: true, removed: false });
-          continue;
-        }
-        if (left.length) {
-          out.steps.push({ kind: st.kind, ok: true, removed: false, reason: `${left.join(", ")} remain` });
-          continue;
-        }
-        rmdirSync(st.path);
-        out.steps.push({ kind: st.kind, ok: true, removed: true });
-      }
-    } catch (e) {
-      return fail(st.kind, e && e.message ? e.message : String(e));
-    } finally {
-      if (onStep) onStep(st, "end", stepResult(out, seen));
-    }
-  }
-  return out;
-}
-
-// What one step left behind, for the APPLY line: its record when it pushed
-// one, and a failure when the item failed under it.
-function stepResult(out, seen) {
-  const rec = out.steps.length > seen ? out.steps[out.steps.length - 1] : null;
-  return { ok: !out.failed && (!rec || rec.ok !== false), kept: Boolean(rec && rec.removed === false && rec.reason) };
-}
-
-// Does any settings file the host reads run this file as its status line?
-// Compared by identity (device and inode), so a path spelled through a symlink
-// or in another case still counts; the project-directory variable a command
-// may carry is substituted first.
-function settingsRunFile(projectDir, harnessId, file, home) {
-  const id = (f) => {
-    try {
-      const s = statSync(f);
-      return `${s.dev}:${s.ino}`;
-    } catch {
-      return null;
-    }
-  };
-  const want = id(file);
-  if (!want) return false;
-  const h = loadHarness(harnessId);
-  const dir = h.runtime?.harness_dir || ".claude",
-    v = h.runtime?.project_dir_env;
-  const files = [
-    join(projectDir, h.surfaces?.statusline?.file || join(dir, "settings.local.json")),
-    join(projectDir, dir, "settings.json"),
-    join(claudeHome(home), "settings.json"),
-  ];
-  return files.some((f) => {
-    try {
-      let cmd = JSON.parse(readFileSync(f, "utf8"))?.statusLine?.command;
-      if (typeof cmd !== "string") return false;
-      if (v)
-        cmd = cmd
-          .split("${" + v + "}")
-          .join(projectDir)
-          .split("$" + v)
-          .join(projectDir);
-      const sp = statusLineScriptPath(cmd);
-      return Boolean(sp) && id(isAbsolute(sp) ? sp : join(projectDir, sp)) === want;
-    } catch {
-      return false;
-    }
-  });
-}
-
-// Is the harness's status-line slot wired to anything of ours (any wiring)?
-function slotIsOurs(projectDir, harnessId, { home, root }) {
-  try {
-    const s = loadHarness(harnessId).surfaces?.statusline;
-    if (!s || !s.file) return false;
-    const cmd = JSON.parse(readFileSync(join(projectDir, s.file), "utf8"))?.statusLine?.command;
-    return typeof cmd === "string" && statusLineIsOurWiring(cmd, projectDir, home, root);
-  } catch {
-    return false;
-  }
-}
-
-// Does the harness's settings entry still name this launcher path?
-function entryNames(projectDir, harnessId, launcherPath) {
-  try {
-    const h = loadHarness(harnessId);
-    const s = h.surfaces?.statusline;
-    if (!s || !s.file) return false;
-    const settings = JSON.parse(readFileSync(join(projectDir, s.file), "utf8"));
-    const cmd = settings?.statusLine?.command;
-    const named = statusLineScriptPath(typeof cmd === "string" ? cmd : null);
-    return Boolean(named) && resolve(named) === resolve(launcherPath);
-  } catch {
-    return false;
-  }
-}
-
-// Contract 14: the host installs and updates these itself; say how, from the
-// manifest, and write nothing. (PR #13's installElsewhere, as a plan line.)
-function hostManagedReport(m, rows, registration = null) {
-  const inst = m.install || {};
-  const lines = [
-    `${m.display_name}: ${rows.join(", ")} are installed by ${inst.mechanism || "the host"} — nothing to write.`,
-  ];
-  if (registration && registration.entry) {
-    const how =
-      registration.action === "skip" && registration.state === "current"
-        ? "registered here"
-        : registration.action === "refuse"
-          ? "refused, see below"
-          : registration.action === "skip"
-            ? "not registered on this run, see below"
-            : `registered by this run (${registration.action})`;
-    // A host plugin registration is a marketplace added from a local path, and
-    // the host loads its plugin in place, from the plugin's root inside that
-    // directory (`payload`, set by plan()); the install path is the registry's
-    // copy, which the launcher renders (the story "The SessionStart hook and
-    // install agree on the status line…", measured on host 2.1.293 and
-    // 2.1.296). A portable registration's host loads the copy.
-    const where = !registration.root
-      ? ""
-      : registration.payload
-        ? ` — install path ${registration.root}; the host loads them in place from ${registration.payload}`
-        : ` — the host loads them from ${registration.root}`;
-    lines.push(`  They come from the registration ${registration.entry}, ${how}${where}.`);
-  }
-  if (inst.why_not_scripted) lines.push(`  ${inst.why_not_scripted}`);
-  for (const s of inst.steps || []) lines.push(`    ${s}`);
-  for (const n of inst.notes || []) lines.push(`  ${n}`);
-  if (inst.docs) lines.push(`  ${inst.docs}`);
-  return lines.join("\n");
-}
-
-const isWrite = (i) => !["skip", "refuse"].includes(i.action);
-
-// ─── preview ───────────────────────────────────────────────────────────
-//
-// PLAN (presentation spec contract 7, which revises the layout clauses of
-// install spec contract 18): the badge, the project path, a summary line of
-// counts, then the rows grouped under each run harness's display name, in run
-// order. A row is one aligned line — glyph, action word, target, note — and
-// beneath it what the reader consents to (install spec contract 9: every path
-// written and every host argv, with the files it touches), the reason when
-// there is one, and a consequence the reader must know. Internal words —
-// kinds, provenance states, entry markers, roadmap ids — and each step's why
-// are behind `--verbose`. Groups and counts are computed here, never added to
-// the plan: plan --json keeps its keys. Colour and glyphs are the caller's
-// stream's (`caps`, term.mjs); the default is plain text in Unicode.
-const unicodeGlyph = (name) => termIcon({ ascii: false }, name);
-
-// Every action a plan item can carry, as its glyph. A write never wears the
-// skip glyph: `add` and `replace-entry` are changes as much as `create` and
-// `update`.
-// A copy from another marketplace turned off for this checkout is a channel
-// switch, `disable` (the converge story; contract 7's `switch` word, ⇄).
-const ACTION_ICON = {
-  create: "create",
-  add: "create",
-  update: "update",
-  "replace-entry": "update",
-  migrate: "migrate",
-  disable: "switch",
-  cleanup: "cleanup",
-  remove: "remove",
-  prune: "remove",
-  skip: "skip",
-  refuse: "refuse",
-};
-// …and as a person's word (contract 7's table). A registration's write takes
-// `register`; a skip reads `unchanged` when the item is current and carries
-// no reason, and `skipped` otherwise — deferred, opted out, unsupported, or
-// left in place: a current row with a reason is one the run did not act on
-// for that reason (uninstall keeping a user-global registration, a host CLI
-// not on PATH), and the reason beneath it is what the reader acts on.
-const ACTION_WORD = {
-  create: "add",
-  add: "add",
-  update: "update",
-  "replace-entry": "update",
-  migrate: "update",
-  disable: "switch",
-  cleanup: "remove",
-  remove: "remove",
-  prune: "remove",
-  refuse: "refused",
-};
-// Each word's colour role (contract 3): a refusal's ▲, a channel switch and a
-// removal are attention; red is for what failed.
-const WORD_ROLE = {
-  add: "done",
-  register: "done",
-  update: "action",
-  switch: "attention",
-  remove: "attention",
-  refused: "attention",
-  unchanged: "explanation",
-  skipped: "explanation",
-};
-// APPLY says a word while its step runs and once it has (contract 8).
-const WORD_TENSES = {
-  add: ["adding", "added"],
-  register: ["registering", "registered"],
-  update: ["updating", "updated"],
-  switch: ["switching", "switched"],
-  remove: ["removing", "removed"],
-};
-
-const CURRENT_STATES = new Set(["current", "ours-current", "ours"]);
-const isUnchanged = (i) => i.action === "skip" && !i.deferred && !i.reason && CURRENT_STATES.has(i.state);
-// A surface this harness does not have: folded into one line per harness.
-const isUnsupported = (i) => i.action === "skip" && i.state === "unsupported";
-// A row of something another project wrote last (install spec contract 12):
-// never collapsed, and its note says whose it is.
-const writtenElsewhere = (i) => i.state === "current" && Boolean(i.writtenBy) && !i.sameProject;
-// A row that writes nothing and asks nothing of the reader collapses into
-// one line per group naming it (contract 7).
-const isQuiet = (i) => isUnchanged(i) && !writtenElsewhere(i) && !(i.steps || []).length;
-// The registration row a fetched shell's registry lines sit beneath, when the
-// run fetched one from a registry that is not the user's.
-const fetchedFor = (p, i) =>
-  p.fetchedFrom &&
-  i.kind === "registration" &&
-  !String(i.surface).endsWith("_others") &&
-  p.fetchedFrom.harnesses.includes(i.harness)
-    ? p.fetchedFrom
-    : null;
-
-function actionWord(i) {
-  if (i.action === "skip") return isUnchanged(i) ? "unchanged" : "skipped";
-  if (i.kind === "registration" && ["create", "add", "update"].includes(i.action)) return "register";
-  return ACTION_WORD[i.action] || "update";
-}
-const glyphName = (i) => ACTION_ICON[i.action] || (isWrite(i) ? "update" : "skip");
-// The surface key in words: `agents_block` reads "agents block".
-const surfaceWords = (key) => String(key).replace(/_/g, " ");
-// What a row names: a registration by its plugin id — its paths are the
-// consent lines beneath it — anything else by its path, project-relative.
-function rowTarget(p, i, home = homedir()) {
-  // …and the keep (kind `channel`) by the key of the copy it keeps.
-  if ((i.kind === "registration" || i.kind === "channel") && i.entry) return i.entry;
-  if (i.path === null) return `${i.surface} [${i.harness}, no filesystem path]`;
-  // Setup's vault and state directories, as directories; a vault outside the
-  // project — beside it, usually — by its path from home, as the project's.
-  if (i.kind === "vault") {
-    const r = rel(p.projectDir, i.path);
-    return `${r === i.path ? tilde(i.path, home) : r}/`;
-  }
-  if (i.kind === "state") return `${rel(p.projectDir, i.path)}/`;
-  return rel(p.projectDir, i.path);
-}
-// The heading of the group of rows that belong to no harness: setup's vault
-// (presentation spec contract 7's VAULT group, first when present).
-const VAULT_GROUP = "Vault";
-function rowNote(i, { verbose, glyph }) {
-  const words = writtenElsewhere(i) ? `last written by ${i.writtenBy}` : surfaceWords(i.surface);
-  if (!verbose) return words;
-  return `${words} ${glyph("dot")} ${i.kind}${i.entry && i.kind !== "registration" ? ` [${i.entry}]` : ""}`;
-}
-// --verbose's line beneath a row: the provenance state, the reason and the
-// plan's own action, as install spec contract 18 wrote them.
-function transitionText(i, glyph) {
-  let state = writtenElsewhere(i) ? `current, last written by ${i.writtenBy}` : i.state;
-  // A reason with commands gives its prose here; the commands follow, alone.
-  const reason = i.advice ? i.advice.text : i.reason;
-  if (reason && i.action !== "refuse") state += ` (${reason})`;
-  // A dry run's unchanged registration: right by every host fact, its
-  // payload digest still to compare. Said only where the reasoning is.
-  if (i.digestDeferred) state += " (the payload digest is compared when install or upgrade fetches the shell)";
-  return `${state} ${glyph("transition")} ${i.action}${i.action === "refuse" && i.reason ? ": " + i.reason : ""}`;
-}
-
-// One step of an item as the lines it shows: always the action and its target,
-// then — under --verbose — why it runs.
-function stepLines(p, st, { verbose, paint, width = 0, glyph = unicodeGlyph, home = homedir() }) {
-  const r = (x) => rel(p.projectDir, x);
-  // A path outside the project — setup's vault, beside it usually — from
-  // home, as its row and its APPLY lines name it.
-  const t = (x) => tilde(r(x), home);
-  const to = ` ${glyph("transition")} `;
-  const lead = "      ";
-  const sub = "          ";
-  const why =
-    verbose && st.why
-      ? wrap(st.why, width, sub)
-          .split("\n")
-          .map((l, k) => (k ? "" : sub) + paint("explanation", l))
-      : [];
-  // A consent line (install spec contract 9): the step's verb and what it
-  // touches, in the explanation role (presentation spec contracts 3 and 7).
-  const said = (text) => `${lead}${paint("explanation", text)}`;
-  switch (st.kind) {
-    case "host": {
-      // The keep step's argv is whole (its bin is the Node that runs us), and
-      // its touches are the kept copy's planned writes, each with its action.
-      const out = [said(`$ ${(st.bin ? [st.bin, ...st.argv] : st.argv).join(" ")}`)];
-      if (st.touches.length)
-        out.push(
-          `${sub}${paint("explanation", `touches ${st.touches.map((t) => (typeof t === "string" ? r(t) : `${t.path ? r(t.path) : t.surface} (${t.action})`)).join(", ")}`)}`,
-        );
-      return [...out, ...why];
-    }
-    // The fetch a dry run would run first (the shell-fetch story's rule 6),
-    // with the fetch glyph (presentation spec contract 4).
-    case "fetch":
-      return [
-        `${lead}${paint("action", glyph("fetch"))} ${paint("explanation", [st.bin, ...st.argv].join(" "))}`,
-        ...why,
-      ];
-    case "note":
-      return wrap(`note: ${st.why}`, width, sub)
-        .split("\n")
-        .map((l, k) => (k ? l : lead + paint("attention", "note:") + l.slice(5)));
-    case "write":
-      return [
-        said(`write ${st.path}${st.manifestOnly ? " (manifest only)" : ` (${st.files} files + the manifest)`}`),
-        ...why,
-      ];
-    // A dry run names no file count: the payload is counted after the fetch.
-    case "portable-write":
-      return [
-        said(
-          `stage ${st.path} (${Array.isArray(st.files) ? `${st.files.length} payload files` : "the fetched payload"} + catalogue + ownership)`,
-        ),
-        ...why,
-      ];
-    case "rmdir-state":
-      return [
-        said(
-          `remove ${r(st.path)}/ once empty${st.left?.length ? ` ${glyph("dash")} ${st.left.join(", ")} stay${st.left.length === 1 ? "s" : ""} and keep${st.left.length === 1 ? "s" : ""} it` : ""}`,
-        ),
-        ...why,
-      ];
-    case "portable-remove":
-    case "remove":
-      return [said(`remove ${st.path}`), ...why];
-    case "unregister":
-      return [said(`edit ${r(st.path)}  [${st.pointer}.${st.name}]${to}removed`), ...why];
-    // The channel switch's record in the binding (the converge story's rules
-    // 2 and 4): its time is the apply's, unknown to a preview.
-    case "mark":
-      return [said(`edit ${r(st.path)}  [${st.key}]${to}by "setup", at the time of apply`), ...why];
-    case "unmark":
-      return [said(`edit ${r(st.path)}  [${st.key}]${to}removed`), ...why];
-    // A `binding` item's value (the setup story's status-line flag).
-    case "set":
-      return [said(`edit ${r(st.path)}  [${st.key}]${to}${JSON.stringify(st.value)}`), ...why];
-    // Setup's vault (rule 10), the binding plan's own steps: every path is in
-    // the default view. A scaffold step's paths are the vault's, beneath the
-    // row that names it.
-    case "mkdir":
-      return [said(`create ${t(st.path)}/`), ...why];
-    case "bind":
-      return [
-        said(
-          `write ${r(st.path)}  (${st.from ? `the binding of ${st.from}${st.drop?.length ? `, without ${st.drop.join(" and ")}` : ""}` : `vault_path, layout ${st.layout}, language ${st.language}`})`,
-        ),
-        ...why,
-      ];
-    case "git-init":
-      return [
-        said(`$ ${st.argv.join(" ")}`),
-        `${sub}${paint("explanation", `in ${t(st.path)}, with no commit`)}`,
-        ...why,
-      ];
-    case "scaffold":
-      return [said(`create ${st.rels.join(" and ")}`), ...why];
-    case "ensure":
-      return [said(`ensure ${r(st.path)}/`), ...why];
-    case "move-state":
-      return [said(`move ${r(st.from)}/${to}${r(st.to)}/ (${st.files} entries)`), ...why];
-    case "merge-log":
-      return [said(`merge ${r(st.from)}${to}${r(st.to)}`), ...why];
-    case "delete":
-      return [said(`delete ${r(st.path)}`), ...why];
-    case "move-marker":
-      return [said(`move ${r(st.from)}${to}${r(st.to)}`), ...why];
-    case "move-binding":
-      return [said(`move ${r(st.from)}${to}${r(st.to)}  (agents${to}${r(st.overlay)})`), ...why];
-    case "remove-legacy-launcher":
-    case "rmdir-legacy":
-    case "remove-legacy-runtime":
-      return [said(`remove ${r(st.path)}`), ...why];
-    default:
-      return [];
-  }
-}
-
-const displayName = (id) => loadHarness(id)?.display_name || id;
-// The harnesses a plan names, by their display names — for the badge.
-function displayNames(p) {
-  return p.harnesses.map(displayName).join(", ") || "(no harness)";
-}
-
-const tilde = (path, home = homedir()) =>
-  path === home || path.startsWith(home + "/") ? "~" + path.slice(home.length) : path;
-
-// The badge (presentation spec contract 7): `projectstore <verb> · <display
-// names>`, the first line of a verb's output. A run that fetches prints it
-// before the fetch line, and its preview then leaves it out (`badge: false`),
-// so it is printed once.
-export function badgeLine(p, { verb = null, caps: c = PLAIN } = {}) {
-  return badgeText(c, `projectstore ${verb || p.mode}`, [displayNames(p)]);
-}
-
-// The update notice in the badge's slot (the converge story's rule 8;
-// presentation spec contracts 6 and 7): the note glyph, the text in the
-// explanation role, then the command alone on its line after a blank one, in
-// the action role, and a blank line before the preview.
-export function noticeText(n, c = PLAIN) {
-  const paint = painter(c);
-  return (
-    [
-      `  ${paint("attention", termIcon(c, "note"))} ${paint("explanation", n.text)}`,
-      ...commandBlock(c, [n.command], { indent: 4 }),
-      "",
-    ].join("\n") + "\n"
-  );
-}
-
-// The summary line: the counts by kind of change, each in its word's role.
-// Unsupported rows are not counted: they are the harness's, not the run's.
-const COUNTED = [
-  ["add", (n) => `${n} to add`],
-  ["register", (n) => `${n} to register`],
-  ["update", (n) => `${n} to update`],
-  ["switch", (n) => `${n} to switch`],
-  ["remove", (n) => `${n} to remove`],
-  ["unchanged", (n) => `${n} unchanged`],
-  ["skipped", (n) => `${n} skipped`],
-];
-function planSummary(p, c) {
-  if (!p.ok) return heading(c, "Plan", [["refused", "attention"]]);
-  const n = {};
-  for (const i of p.items) if (!isUnsupported(i)) n[actionWord(i)] = (n[actionWord(i)] || 0) + 1;
-  const counts = COUNTED.filter(([w]) => n[w]).map(([w, say]) => [say(n[w]), WORD_ROLE[w]]);
-  return heading(c, "Plan", counts.length ? counts : [["nothing to change", "explanation"]]);
-}
-
-// `home` shortens the project path to ~ (the caller's home; a test's fixed
-// one); everything else the screen needs is in `p`. `header` is a caller's
-// lines beneath the project path — setup's, naming the git work tree's top
-// when it runs in a subfolder (the setup story, rule 4).
-export function renderPreview(
-  p,
-  { verbose = false, verb = null, caps: c = PLAIN, badge = true, home = homedir(), header = [] } = {},
-) {
-  const paint = painter(c);
-  const glyph = (name) => termIcon(c, name);
-  const width = c.live ? c.width : 0;
-  const writes = p.items.filter(isWrite);
-  // A text's lines, each of its own lines wrapped on its own, returned without
-  // the indent for the caller to lay out. wrap indents only the lines it
-  // breaks, so a line the text carried itself must never lose the indent's
-  // width of characters (a refusal's "--harness claude-code" read "laude-code").
-  const textLines = (text, indent) =>
-    String(text)
-      .split("\n")
-      .flatMap((para) =>
-        wrap(para, width, indent)
-          .split("\n")
-          .map((l, k) => (k ? l.slice(indent.length) : l)),
-      );
-  // Prose, wrapped to the terminal with every line indented; a path or a
-  // command inside it is one word and never broken (term.mjs wrap).
-  const prose = (indent, text, role = "explanation") => textLines(text, indent).map((l) => indent + paint(role, l));
-  const lines = [
-    ...(badge ? [badgeLine(p, { verb, caps: c })] : []),
-    `  ${paint("explanation", tilde(p.projectDir, home))}`,
-    ...(header || []).flatMap((h) => prose("  ", h)),
-    "",
-  ];
-  if (verbose) {
-    for (const [h, r] of Object.entries(p.plannedAgainst || {}))
-      lines.push(
-        ...prose(
-          "  ",
-          `${h}: the surfaces below are planned against the host's install path ${r}, not this package at ${p.root}.`,
-        ),
-        "",
-      );
-    for (const r of p.reports) lines.push(...r.split("\n").flatMap((l) => (l.trim() ? prose("  ", l) : [""])), "");
-  }
-  lines.push(planSummary(p, c));
-  // An emptied state directory is pruned with the launcher removed from it;
-  // said once, beneath the first such row.
-  let pruneSaid = false;
-  const beneath = (i) => {
-    const out = [];
-    // A user-scope registration reaches past this project: contract 7's
-    // consequence line, on the line beneath its row, before anything else.
-    if (isWrite(i) && i.kind === "registration" && i.scope === "user")
-      out.push(
-        ...prose(
-          "      ",
-          `user-wide: the plugin is ${i.action === "remove" ? "removed" : "registered"} for every project ${displayName(i.harness)} opens, not only this one`,
-        ),
-      );
-    // …and a channel switch's (the converge story's rule 2), carried as its
-    // note step: first, before the reason and the consent lines.
-    for (const st of (i.steps || []).filter(isConsequence)) out.push(...prose("      ", st.why));
-    if (verbose) out.push(...prose("      ", transitionText(i, glyph)));
-    else if (i.reason && !isUnsupported(i))
-      out.push(
-        ...prose("      ", i.advice ? i.advice.text : i.reason, i.action === "refuse" ? "attention" : "explanation"),
-      );
-    // The reason's ways out (the converge story): each lead, then its command
-    // alone on its line after a blank one (contract 6), and a blank line after.
-    if (i.advice?.blocks?.length) {
-      for (const b of i.advice.blocks)
-        out.push(...prose("      ", b.lead), ...commandBlock(c, [b.command], { indent: 10 }), "");
-    }
-    // A shell this run fetched from a registry that is not the user's (the
-    // converge story's rule 8, as amended 2026-10-09): both named. Neutral
-    // words: the fetch's URL can come from the project's .npmrc or from the
-    // run's own environment (`npx --registry`), and either reads the same.
-    const from = fetchedFor(p, i);
-    if (from)
-      out.push(
-        ...prose("      ", `fetched from ${from.registry}`),
-        ...prose("      ", `your npm's own registry is ${from.user}`),
-      );
-    for (const st of (i.steps || []).filter((x) => !isConsequence(x)))
-      out.push(...stepLines(p, st, { verbose, paint, width, glyph, home }));
-    if (i.kind === "registration" && i.home && i.surface && !i.surface.endsWith("_others"))
-      out.push(`      ${paint("explanation", `(harness home ${i.home}${i.scope ? `, scope ${i.scope}` : ""})`)}`);
-    if (i.deleteIfEmpty && typeof i.after === "string" && !i.after.trim())
-      out.push(`      ${paint("explanation", "(the file would hold nothing else and is removed)")}`);
-    if (!pruneSaid && i.action === "remove" && i.kind === "exclusive") {
-      pruneSaid = true;
-      out.push(`      ${paint("explanation", `(an emptied ${rel(p.projectDir, dirname(i.path))}/ is pruned)`)}`);
-    }
-    return out;
-  };
-  // The run's one agents block, named again where each other harness's row
-  // would have been (contract 7; the story "One run plans the agents block
-  // once…", rule 1): in that harness's group, before its first item at or
-  // after the recorded index, else at the group's end. Not a step and not an
-  // item: nothing is planned there.
-  const sameBlock = () =>
-    `  ${paint("explanation", glyph("skip"))} ${p.sharedBlock.file} ${glyph("dash")} the same block as ${p.sharedBlock.display}, above`;
-  const hostLines = (h) => {
-    const from = h.entry ? `from the registration ${h.entry}` : "from the host's own plugin system";
-    return wrap(`${h.display} installs ${h.rows.join(", ")} itself, ${from}`, width, "    ")
-      .split("\n")
-      .map((l, k) =>
-        k
-          ? `    ${paint("explanation", l.slice(4))}`
-          : `  ${paint("explanation", glyph("skip"))} ${paint("explanation", l)}`,
-      );
-  };
-  // The VAULT group first, when setup plans one: the rows of no harness.
-  const ids = [
-    ...(p.items.some((i) => i.harness === null) ? [null] : []),
-    ...p.harnesses,
-    ...new Set(p.items.map((i) => i.harness).filter((h) => h !== null && !p.harnesses.includes(h))),
-  ];
-  for (const id of ids) {
-    const entries = p.items.map((i, at) => ({ i, at })).filter((e) => e.i.harness === id);
-    const others = (p.sharedBlock?.others || []).filter((o) => o.harness === id).sort((a, b) => a.at - b.at);
-    const host = (p.hostManaged || []).filter((h) => h.harness === id);
-    if (!entries.length && !others.length && !host.length) continue;
-    const folded = verbose ? [] : entries.filter((e) => isUnsupported(e.i));
-    // A registration this run fetched from another registry keeps its row, so
-    // the registry lines beneath it show on every run, not only on a change.
-    const quiet = verbose ? [] : entries.filter((e) => isQuiet(e.i) && !fetchedFor(p, e.i));
-    const shown = entries.filter((e) => !folded.includes(e) && !quiet.includes(e));
-    const specs = shown.map(({ i }) => ({
-      glyph: glyphName(i),
-      role: WORD_ROLE[actionWord(i)],
-      action: actionWord(i),
-      target: rowTarget(p, i, home),
-      note: rowNote(i, { verbose, glyph }),
-    }));
-    if (quiet.length)
-      specs.push({
-        glyph: "unchanged",
-        role: "explanation",
-        action: "unchanged",
-        target: paint("explanation", quiet.map((e) => surfaceWords(e.i.surface)).join(", ")),
-      });
-    // Unsupported rows keep one line per harness (contract 18), named in
-    // words as the unchanged line names its rows; --verbose lists each with
-    // the manifest's reason.
-    if (folded.length)
-      specs.push({
-        glyph: "unchanged",
-        role: "explanation",
-        action: "skipped",
-        target: paint(
-          "explanation",
-          `not on ${displayName(id)}: ${folded.map((e) => surfaceWords(e.i.surface)).join(", ")}`,
-        ),
-        note: "--verbose says why",
-      });
-    const drawn = rowLines(c, specs);
-    lines.push("", paint("emphasis", id === null ? VAULT_GROUP : displayName(id)));
-    const pending = [...others];
-    shown.forEach(({ i, at }, k) => {
-      while (pending.length && pending[0].at <= at) {
-        pending.shift();
-        lines.push(sameBlock());
-      }
-      lines.push(...drawn[k], ...beneath(i));
-    });
-    for (const _ of pending) lines.push(sameBlock());
-    for (const extra of drawn.slice(shown.length)) lines.push(...extra);
-    for (const h of host) lines.push(...hostLines(h));
-  }
-  if (p.refusals.length) lines.push("");
-  // A plan-level refusal: its message in the attention role, as an item's
-  // refusal reason is (presentation spec contract 3 as amended 2026-10-11).
-  p.refusals.forEach((r, k) => {
-    const lead = `  ${paint("attention", glyph("refuse"))} ${paint("attention", "refused")}  `;
-    const pad = " ".repeat(plain(lead).length);
-    // The stop (the converge story's rule 6) carries its commands apart from
-    // its words: each is printed alone on its line after a blank one, with
-    // nothing after it (contract 6), the way a person copies it.
-    const stop = k === 0 && p.stop ? p.stop : null;
-    // The same for a refusal that names its ways out (the channel "git" with
-    // nothing to keep): its prose, then each lead and its command alone.
-    const advice = k === 0 && !stop && p.refusalAdvice ? p.refusalAdvice : null;
-    const [first, ...rest] = textLines(stop ? stop.lead : advice ? advice.text : r, pad);
-    lines.push(lead + paint("attention", first), ...rest.map((l) => pad + paint("attention", l)));
-    if (stop)
-      lines.push(
-        ...commandBlock(c, [stop.commands[0]], { indent: 4 }),
-        "",
-        ...prose("  ", stop.between),
-        ...commandBlock(c, stop.commands.slice(1), { indent: 4 }),
-      );
-    if (advice)
-      for (const b of advice.blocks)
-        lines.push("", ...prose("  ", b.lead), ...commandBlock(c, [b.command], { indent: 4 }));
-  });
-  // The closing lines, in a person's words: only what is listed is written,
-  // and a $ line is the host's own CLI at work.
-  const closing = [];
-  if (p.ok && writes.length)
-    closing.push(
-      ...prose(
-        "  ",
-        `Only the entries listed above are written ${glyph("dash")} nothing else in those files is read, rewritten or removed.`,
-      ),
-    );
-  if (p.items.some((i) => (i.steps || []).some((s) => s.kind === "host" && s.name !== "keep")))
-    closing.push(
-      ...prose("  ", "Each $ line runs the host's own CLI, which writes the host-owned files named after it."),
-    );
-  if (p.items.some((i) => isWrite(i) && (i.steps || []).some((s) => s.kind === "host" && s.name === "keep")))
-    closing.push(
-      ...prose(
-        "  ",
-        "The kept copy's $ line runs that copy's own projectstore, which writes the files named after it.",
-      ),
-    );
-  if (closing.length) lines.push("", ...closing);
-  if (!p.ok) lines.push("", `  ${paint("attention", "Nothing will be written: resolve the refusals above first.")}`);
-  // A plan that wrote nothing because part of it could not be planned never
-  // reads as converged (the converge story's keep, a copy with work pending).
-  else if (!writes.length)
-    lines.push(
-      "",
-      p.incomplete
-        ? "  Nothing will be written: one surface could not be planned (see above)."
-        : "  Nothing to change.",
-    );
-  else if (p.incomplete) lines.push("", "  One surface could not be planned (see above); the rest proceeds.");
-  return lines.join("\n") + "\n";
-}
-
 // ─── gate ──────────────────────────────────────────────────────────────
 
 // Contract 9, amended 2026-10-04: a person at a terminal is asked, even when
@@ -3835,7 +2057,7 @@ export function asksAtTerminal({ stdin = null, stdout = null, ask = null, env =
 // confirm it, a bare run is refused for it too, and nothing is written:
 // `channel`, ahead of the whole non-interactive branch. A plan built without
 // plan() (no `channel` on it) reads as no answer.
-export const switchUnanswered = (p) => (p.channel ?? null) === null && p.items.some(isSwitch);
+export const switchUnanswered = (p) => (p.channel ?? null) === null && p.items.some((i) => isSwitch(i) || isShadow(i));
 export async function confirm(
   p,
   {
@@ -3926,7 +2148,11 @@ export function apply(
       return r;
     }
     if (i.kind === "binding") {
-      const r = applyBinding(p, i, { env, onStep, switched: switched.get(i.harness) || [] });
+      // A directory copy's "switch" is the registration itself (PS-DIRECTORY):
+      // the mark waits on it as on a switch.
+      const shadowed = p.items.some((x) => x.harness === i.harness && isShadow(x));
+      const outcome = [...(switched.get(i.harness) || []), ...(shadowed ? [registered.get(i.harness) === true] : [])];
+      const r = applyBinding(p, i, { env, onStep, switched: outcome });
       if (r.failed) done.failed = r.failed;
       return r;
     }
@@ -5482,189 +3708,6 @@ export async function runVerb(verb, projectDir, opts = {}) {
   }
 }
 
-// APPLY, one line per step as it finishes (presentation spec contract 8):
-// the glyph, what was done in the past tense — "added CLAUDE.md", having read
-// "adding CLAUDE.md" while it ran on a terminal — and the duration. An item
-// with steps — a registration, the layout move — prints its own line as it
-// starts ("registering …"), one line per step beneath it — each host
-// command, staging write, write and move — and, once all of them have run,
-// its finished line in the past tense ("registered …") with the item's whole
-// time, so a transcript never ends on a line that reads as still running.
-// No heading: the plan's last line and the question are above it. `now` is
-// the test's clock; `home` shortens paths to ~.
-export function applyReporter(out, c, p, { now = Date.now, home = homedir() } = {}) {
-  const paint = painter(c);
-  const glyph = (name) => termIcon(c, name);
-  const item = stepReporter(out, c, { indent: 2, now });
-  const step = stepReporter(out, c, { indent: 6, now });
-  const said = (i) => {
-    const word = actionWord(i);
-    const [running, done] = WORD_TENSES[word] || [word, word];
-    const target = rowTarget(p, i, home);
-    return { word, running: `${running} ${target}`, done: `${done} ${target}` };
-  };
-  // The mark too: a skip prints its reason (the project not bound, the switch
-  // not done) beneath the line it started.
-  // …and the keep, whose $ line and the kept copy's own items print beneath it.
-  // …and setup's vault, whose binding, git and scaffold steps print beneath it.
-  const stepped = (i) =>
-    i.kind === "registration" ||
-    i.kind === "layout" ||
-    i.kind === "binding" ||
-    i.kind === "channel" ||
-    i.kind === "vault";
-  const began = new Map();
-  return {
-    onItem(i, phase, r) {
-      const s = said(i);
-      if (stepped(i)) {
-        if (phase === "start") {
-          began.set(i, now());
-          out.write(`  ${paint(WORD_ROLE[s.word], glyph(glyphName(i)))} ${s.running}\n`);
-          return;
-        }
-        const t0 = began.get(i) ?? now();
-        began.delete(i);
-        if (phase === "abort") step.abort();
-        else if (r && (r.action === "skipped" || r.action === "skip"))
-          out.write(
-            `      ${paint("explanation", glyph("skip"))} ${paint("explanation", `${r.action === "skip" ? "nothing to do" : "skipped"}: ${r.reason || "an earlier item failed"}`)}\n`,
-          );
-        else if (r && r.failed) out.write(`      ${paint("error", glyph("fail"))} ${paint("error", "stopped")}\n`);
-        else item.finish(s.done, t0);
-        return;
-      }
-      if (phase === "start") item.start(s.running);
-      else if (phase === "abort") item.abort();
-      else {
-        // An item that failed or was skipped keeps the words it ran under.
-        const failed = Boolean(r && (r.failed || r.action === "skipped"));
-        item.end(!failed, r && r.action === "skipped" ? "skipped" : "", failed ? {} : { label: s.done });
-      }
-    },
-    onStep(st, phase, r) {
-      const l = stepLabel(p, st, { home, glyph });
-      if (!l) return;
-      if (phase === "start") {
-        step.start(l.running);
-        return;
-      }
-      const ok = r ? r.ok : true;
-      const kept = Boolean(r && r.kept);
-      // A step that failed without stopping the run (setup's git init) is ▲,
-      // in its own words.
-      if (r && r.warn) {
-        step.end(true, "", { warn: true, label: r.warn });
-        return;
-      }
-      // A step that left its target in place did not do its verb; one that
-      // says why in its own words (a git init skipped) needs no note.
-      const own = r && r.label ? r.label : null;
-      step.end(ok, kept && !own ? "kept" : "", ok ? { kept, label: own || (kept ? l.base : l.done) } : {});
-    },
-    // The wrapped spawn prints each host command as a step. Its `unwrapped`
-    // is the caller's own spawn, for an item that reports its commands as its
-    // own steps (setup's vault: `$ git init --quiet`).
-    spawn(inner) {
-      const wrapped = (bin, argv, o) => {
-        step.start(`$ ${basename(String(bin))} ${argv.join(" ")}`);
-        let r;
-        try {
-          r = inner(bin, argv, o);
-        } catch (e) {
-          step.abort();
-          throw e;
-        }
-        step.end(!r.error && r.status === 0);
-        return r;
-      };
-      Object.defineProperty(wrapped, "unwrapped", { value: inner });
-      return wrapped;
-    },
-  };
-}
-
-// A step as its APPLY line names it: the verb and the target, short — the
-// full form, file counts and entry pointers, was in PLAN. `base` is the plain
-// verb, for a step that left its target in place.
-const STEP_TENSES = {
-  stage: ["staging", "staged"],
-  lift: ["lifting", "lifted"],
-  write: ["writing", "wrote"],
-  edit: ["editing", "edited"],
-  ensure: ["ensuring", "ensured"],
-  move: ["moving", "moved"],
-  merge: ["merging", "merged"],
-  remove: ["removing", "removed"],
-  create: ["creating", "created"],
-};
-function stepLabel(p, st, { home = homedir(), glyph = unicodeGlyph } = {}) {
-  const r = (x) => tilde(rel(p.projectDir, x), home);
-  const to = ` ${glyph("transition")} `;
-  const said = (verb, rest) => ({
-    base: `${verb} ${rest}`,
-    running: `${STEP_TENSES[verb][0]} ${rest}`,
-    done: `${STEP_TENSES[verb][1]} ${rest}`,
-  });
-  switch (st.kind) {
-    case "portable-write":
-      return said("stage", r(st.path));
-    case "recover":
-      return said(
-        "lift",
-        `${r(st.path)} ${glyph("dash")} the previous state proved${st.lifted ? `; it held: ${String(st.lifted).split("\n")[0]}` : ""}`,
-      );
-    case "write":
-      return said("write", r(st.path));
-    case "unregister":
-      return said("edit", `${r(st.path)} [${st.pointer}.${st.name}]`);
-    case "mark":
-    case "unmark":
-    case "set":
-      return said("edit", `${r(st.path)} [${st.key}]`);
-    case "ensure":
-      return said("ensure", `${r(st.path)}/`);
-    // Setup's vault (rule 10): the directory, the binding, git, the scaffold
-    // — a scaffold step's paths are the vault's, beneath the vault's line.
-    case "mkdir":
-      return said("create", `${r(st.path)}/`);
-    case "bind":
-      return said("write", r(st.path));
-    case "git-init": {
-      const line = `$ ${st.argv.join(" ")}`;
-      return { base: line, running: line, done: line };
-    }
-    case "scaffold":
-      return said("create", st.rels.join(" and "));
-    case "move-state":
-      return said("move", `${r(st.from)}/${to}${r(st.to)}/`);
-    case "merge-log":
-      return said("merge", `${r(st.from)}${to}${r(st.to)}`);
-    case "move-marker":
-    case "move-binding":
-      return said("move", `${r(st.from)}${to}${r(st.to)}`);
-    case "delete":
-    case "portable-remove":
-    case "remove":
-    case "remove-legacy-launcher":
-    case "rmdir-legacy":
-    case "remove-legacy-runtime":
-      return said("remove", r(st.path));
-    case "rmdir-state":
-      return said("remove", `${r(st.path)}/`);
-    // An item the kept copy applied (the converge story's rule 5), in this
-    // run's words for its action; one the preview did not list says so.
-    case "kept": {
-      const word = ACTION_WORD[st.action] || "update";
-      const [running, done] = WORD_TENSES[word] || [word, word];
-      const target = `${st.path ? r(st.path) : st.surface}${st.unplanned ? " (not in the preview)" : ""}`;
-      return { base: `${word} ${target}`, running: `${running} ${target}`, done: `${done} ${target}` };
-    }
-    default:
-      return null;
-  }
-}
-
 // DONE and STOPPED (presentation spec contract 8). DONE: the count and the
 // time; Next, one line per harness — its display name in a column, its
 // manifest's next steps beside it, deduplicated; the facts the run settled
@@ -5757,7 +3800,9 @@ export function renderDone(r, { caps: c = PLAIN, verbose = false, cwd = process.
   // that could not run the keep needs, its own upgrade when its plan printed
   // no result, the npm row's uninstall — each lead, then its command alone on
   // its line (contract 6).
-  const kept = p.items.filter((i) => i.kind === "channel" && Array.isArray(i.next)).flatMap((i) => i.next);
+  // An uninstall's registration row carries one too: the directory copy that
+  // loads again (PS-DIRECTORY).
+  const kept = p.items.filter((i) => Array.isArray(i.next)).flatMap((i) => i.next);
   const more = extra?.blocks || [];
   if (next.length || kept.length || more.length) lines.push("", paint("emphasis", "Next"));
   if (next.length) {
@@ -5889,9 +3934,12 @@ export function gateText(r, { verb, harnesses = [], caps: c = PLAIN, args = "" }
   if (why === "dry-run") return "Nothing written: this was a dry run.\n";
   if (why === "channel") {
     const keys = [...new Set(r.plan.items.filter(isSwitch).map((i) => i.entry))];
+    const directory = [...new Set(r.plan.items.filter(isShadow).map((i) => i.entry))];
     return (
       channelText(
-        channelChoices({ gate: { args: { harnesses }, keys, version: pinFor(r.plan.root, r.plan.version) } }),
+        channelChoices({
+          gate: { args: { harnesses }, keys, directory, version: pinFor(r.plan.root, r.plan.version) },
+        }),
         c,
       ) + "\n"
     );