py-wlcli 0.8.0__py3-none-any.whl

wl_cli/cc/mutate.py

@@ -0,0 +1,1350 @@
+"""Write paths for ``wl cc`` (issue #223).
+
+``wl cc check`` is the read-only half (:mod:`wl_cli.cc.checks`, #222); this
+module is the other half. It does not re-implement a single judgement: every
+mutator starts from the same probe function the report uses, acts only on the
+difference, and re-probes before it reports -- so ``init``, ``repair`` and the
+granular commands share one source of truth, and a second run is a no-op.
+
+The invariants below are carried over verbatim from wlcc's ``check.sh`` and
+``wl-env-init`` (the migration ruling is #223 note 19199):
+
+* a plugin that is installed but **disabled** is never reinstalled and never
+  re-enabled -- only ``missing`` entries are installed;
+* an existing claude-mem ``settings.json`` is never overwritten (``exists`` is
+  a merge-it-yourself state, not a repair);
+* a conflicting statusline is never overwritten, an existing claude-hud
+  statusLine is never rewritten (a missing plugin cache does not turn a no-op
+  into a write), and a settings file that is not valid JSON is never rewritten;
+* hooks are rewritten before they are pruned, with a timestamped backup, an
+  atomic replace, a pre-write "nothing but ``hooks`` changed" self-check and a
+  post-write read-back;
+* under ``~/.config/wlcc`` only the retired stamp list is ever deleted;
+  unregistered entries are reported and kept;
+* the MCP version stamp is written only when *both* servers registered.
+
+``repaired`` is reported only for a section that actually wrote something and
+whose re-probe then succeeded; a section that wrote but still has pending work
+stays ``dangling``.
+
+The one write path that is deliberately not here is installing ``wl`` itself:
+that literal already lives in :data:`wl_cli.env_status.INSTALL_ARGV` and
+``wl env repair`` owns it. ``cc init`` reports the ``env`` section and points at
+that repair command instead of forking a second literal.
+"""
+
+from __future__ import annotations
+
+import datetime
+import json
+import os
+import shutil
+import subprocess
+from functools import partial
+from pathlib import Path
+from typing import TYPE_CHECKING, Any
+
+from ..env_status import build_payload
+from . import checks
+
+if TYPE_CHECKING:
+    from collections.abc import Callable, Iterable
+
+#: Sections ``wl cc init`` / ``wl cc repair`` report, in stable payload order.
+#: ``env`` is report-only: ``wl env repair`` owns the install literal.
+SECTION_ORDER: tuple[str, ...] = (
+    "env",
+    "plugins",
+    "mcp",
+    "settings",
+    "statusline",
+    "hooks",
+    "stamps",
+)
+
+#: Sections a mutator may touch (and the ``--section`` choices).
+MUTABLE_SECTIONS: tuple[str, ...] = (
+    "plugins",
+    "mcp",
+    "settings",
+    "statusline",
+    "hooks",
+    "stamps",
+)
+
+#: Marketplace sources check.sh §1 registers, in its order.
+MARKETPLACES: tuple[str, ...] = (
+    "https://github.com/affaan-m/ECC.git",
+    "astral-sh/claude-code-plugins",
+    "thedotmack/claude-mem",
+    "https://github.com/mattpocock/skills",
+    "jarrodwatts/claude-hud",
+)
+
+#: gstack clone source (check.sh §5).
+GSTACK_REPO = "https://github.com/garrytan/gstack.git"
+
+#: wlcc marketplace source when it is not registered yet (``/wl-upgrade`` §2).
+WLCC_MARKETPLACE_REPO = "https://gitlab.gewinnrobo.com/Humuyuan/wlcc.git"
+
+#: Per-server extra argv for ``claude mcp add`` (check.sh §3). The GitLab host
+#: is deliberately *not* passed: ``server.py`` owns that default (#242).
+MCP_SERVER_EXTRA: dict[str, tuple[str, ...]] = {
+    "gitlab": (),
+    "k8s-diagnose": ("-e", "K8S_SSH_HOST=ubuntu-server"),
+}
+
+#: How many timestamped ``settings.json`` backups are kept (hooks-drift).
+BACKUP_KEEP = 5
+
+#: Every status a mutator may report (``repaired`` is allowed here, unlike the
+#: read-only probe set in :mod:`wl_cli.cc.checks`).
+_WRITE_STATUSES = frozenset({"ok", "dangling", "repaired", "unverifiable", "error"})
+
+#: How much of a failed command's output is quoted in a reason.
+_EXCERPT_LIMIT = 400
+
+#: Network steps (marketplace, plugin install/update, gstack clone/setup) get a
+#: longer ceiling than the local ones; check.sh has no timeout at all, so a
+#: slow link must not turn a healthy install into a failure.
+_NETWORK_TIMEOUT = 600
+
+#: Runtime candidates for the claude-hud statusline, bun first (SKILL.md §3).
+_HUD_RUNTIMES: tuple[tuple[str, str], ...] = (
+    ("bun", "src/index.ts"),
+    ("node", "dist/index.js"),
+)
+
+#: The statusline command from wlcc ``wl-env-init`` §3, with three slots. The
+#: embedded ``'\''`` sequences are part of the generated text: the inner body
+#: is a ``bash -c`` single-quoted string, so an embedded quote is spelled that
+#: way on purpose. ``__FLAG__`` is empty for node and ``--env-file /dev/null``
+#: for bun. ``__RUNTIME__`` is an absolute path, so the shell always finds it.
+_HUD_TEMPLATE = r"""bash -c 'cols=${COLUMNS:-}; case "$cols" in ""|*[!0-9]*) cols=$(stty size 2>/dev/null </dev/tty | awk '\''{print $2}'\'');; esac; case "$cols" in ""|*[!0-9]*) cols=120;; esac; export COLUMNS=$(( cols > 4 ? cols - 4 : 1 )); plugin_dir=$(ls -d "${CLAUDE_CONFIG_DIR:-$HOME/.claude}"/plugins/cache/*/claude-hud/*/ 2>/dev/null | awk -F/ '\''{ print $(NF-1) "\t" $0 }'\'' | grep -E '\''^[0-9]+\.[0-9]+\.[0-9]+[[:space:]]'\'' | sort -t. -k1,1n -k2,2n -k3,3n -k4,4n | tail -1 | cut -f2-); [ -n "$plugin_dir" ] || exit 0; exec "__RUNTIME__" __FLAG__"${plugin_dir}__SOURCE__"'"""
+
+
+class WriteError(Exception):
+    """A write could not be completed safely; the caller reports the reason."""
+
+
+def _result(
+    status: str,
+    reason: str | None = None,
+    changed: list[str] | None = None,
+    **fields: Any,
+) -> dict[str, Any]:
+    """Build one section/mutation result with ``status``, ``reason``, ``changed``."""
+    return checks._result(status, reason, changed=list(changed or []), **fields)
+
+
+def _excerpt(proc: subprocess.CompletedProcess[str]) -> str:
+    """Flatten a failed command's output into one readable line."""
+    return " ".join((proc.stderr or proc.stdout or "").split())[:_EXCERPT_LIMIT]
+
+
+def _failure(proc: subprocess.CompletedProcess[str]) -> str:
+    """Render ``exited N[: excerpt]`` for a failed command."""
+    excerpt = _excerpt(proc)
+    return f"exited {proc.returncode}" + (f": {excerpt}" if excerpt else "")
+
+
+def _run(
+    argv: list[str], *, cwd: str | None = None, timeout: int = 120
+) -> subprocess.CompletedProcess[str]:
+    """Run one external host command and return its result without raising.
+
+    The single seam tests replace; production code never reads the return code
+    of a *probe* through this (the probes live in :mod:`wl_cli.cc.checks`).
+    """
+    return subprocess.run(
+        argv,
+        cwd=cwd,
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=timeout,
+    )
+
+
+def _quiet_remove(target: Path | None) -> None:
+    """Remove *target* if it exists, ignoring every error."""
+    if target is None:
+        return
+    try:
+        os.remove(target)
+    except OSError:
+        pass
+
+
+def _without_key(data: dict[str, Any], key: str) -> str:
+    """Normalised JSON of everything except one top-level key (self-check)."""
+    subset = {name: value for name, value in data.items() if name != key}
+    return json.dumps(subset, sort_keys=True, ensure_ascii=False)
+
+
+def _backup_path(path: Path) -> Path:
+    """Return an unused ``<name>.bak.<YYYYmmdd-HHMMSS>[-n]`` sibling."""
+    stamp = datetime.datetime.now().strftime("%Y%m%d-%H%M%S")
+    candidate = path.with_name(f"{path.name}.bak.{stamp}")
+    sequence = 0
+    while candidate.exists():
+        sequence += 1
+        candidate = path.with_name(f"{path.name}.bak.{stamp}-{sequence}")
+    return candidate
+
+
+def _prune_backups(path: Path) -> None:
+    """Keep only the newest :data:`BACKUP_KEEP` backups of *path*."""
+    prefix = f"{path.name}.bak."
+    try:
+        names = sorted(
+            name for name in os.listdir(path.parent) if name.startswith(prefix)
+        )
+    except OSError:
+        return
+    for name in names[:-BACKUP_KEEP]:
+        _quiet_remove(path.parent / name)
+
+
+def _read_settings(path: Path) -> dict[str, Any]:
+    """Read a JSON object, raising :class:`WriteError` with a readable reason."""
+    try:
+        text = path.read_text(encoding="utf-8")
+    except OSError as exc:
+        raise WriteError(f"cannot read {path}: {exc}") from exc
+    try:
+        data = json.loads(text)
+    except ValueError as exc:
+        raise WriteError(f"{path} is not valid JSON: {exc}") from exc
+    if not isinstance(data, dict):
+        raise WriteError(f"{path} is not a JSON object")
+    return data
+
+
+def _atomic_write_text(path: Path, text: str) -> None:
+    """Write *text* through a same-directory temp file and ``os.replace``."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    tmp = path.with_name(f"{path.name}.tmp.{os.getpid()}")
+    try:
+        with open(tmp, "w", encoding="utf-8") as handle:
+            handle.write(text)
+        os.replace(tmp, path)
+    except OSError as exc:
+        _quiet_remove(tmp)
+        raise WriteError(f"cannot write {path}: {exc}") from exc
+
+
+def _write_stamp(path: Path, content: str) -> None:
+    """Write a one-line stamp atomically, with wlcc's ``0700`` state root."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    try:
+        os.chmod(path.parent, 0o700)
+    except OSError:
+        pass
+    _atomic_write_text(path, content + "\n")
+
+
+def _atomic_write_json(
+    path: Path,
+    data: dict[str, Any],
+    *,
+    preserve_except: str | None = None,
+) -> str | None:
+    """Back up, write atomically, self-check, then verify. Returns the backup.
+
+    ``preserve_except`` names the one top-level key a caller may change. The
+    self-check compares the normalised JSON of every *other* key against the
+    file as it is on disk right now, so a concurrent edit or a planning bug
+    aborts the write instead of silently dropping someone else's keys. The
+    post-write read-back proves the disk holds exactly the planned object.
+
+    Raises:
+        WriteError: On backup, write, self-check or verification failure; the
+            reason always names the file and keeps the backup path when one
+            exists.
+    """
+    path.parent.mkdir(parents=True, exist_ok=True)
+    backup: Path | None = None
+    if path.exists():
+        backup = _backup_path(path)
+        try:
+            shutil.copy2(path, backup)
+        except OSError as exc:
+            raise WriteError(f"cannot back up {path}: {exc}") from exc
+
+    tmp = path.with_name(f"{path.name}.tmp.{os.getpid()}")
+    try:
+        with open(tmp, "w", encoding="utf-8") as handle:
+            json.dump(data, handle, indent=2, ensure_ascii=False)
+            handle.write("\n")
+        written = json.loads(tmp.read_text(encoding="utf-8"))
+    except (OSError, ValueError) as exc:
+        _quiet_remove(tmp)
+        _quiet_remove(backup)
+        raise WriteError(f"cannot write {tmp}: {exc}") from exc
+
+    if preserve_except is not None:
+        before = _read_settings(path) if path.exists() else {}
+        if _without_key(before, preserve_except) != _without_key(
+            written, preserve_except
+        ):
+            _quiet_remove(tmp)
+            _quiet_remove(backup)
+            raise WriteError(
+                "self-check failed: keys other than "
+                f"{preserve_except!r} changed; nothing was written"
+            )
+
+    try:
+        os.replace(tmp, path)
+    except OSError as exc:
+        _quiet_remove(tmp)
+        _quiet_remove(backup)
+        raise WriteError(f"cannot replace {path}: {exc}") from exc
+
+    try:
+        on_disk = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError) as exc:
+        raise WriteError(
+            f"post-write verification failed for {path}: {exc}; backup at {backup}"
+        ) from exc
+    if on_disk != data:
+        raise WriteError(
+            f"post-write verification failed for {path}: content mismatch; "
+            f"backup at {backup}"
+        )
+
+    _prune_backups(path)
+    return str(backup) if backup is not None else None
+
+
+def _isolated(name: str, action: Callable[[], dict[str, Any]]) -> dict[str, Any]:
+    """Run one mutator, converting any failure into an isolated ``unverifiable``."""
+    try:
+        result = action()
+    except Exception as exc:  # noqa: BLE001 - isolation is the contract
+        return _result("unverifiable", f"{name}: {exc}")
+    if result.get("status") not in _WRITE_STATUSES:
+        return _result(
+            "unverifiable",
+            f"{name}: mutator returned an unknown status {result.get('status')!r}",
+        )
+    return result
+
+
+def _probe_env() -> dict[str, Any]:
+    """The report-only ``env`` section: the shared ``wl env check`` payload."""
+    status, reason, fields = build_payload()
+    return _result(status, reason, [], **fields)
+
+
+def _probe_plugins() -> dict[str, Any]:
+    return checks.probe_plugins(checks.load_host_context())
+
+
+def _probe_mcp() -> dict[str, Any]:
+    return checks.probe_mcp(checks.load_host_context())
+
+
+def _probe_settings() -> dict[str, Any]:
+    return checks.probe_settings(checks.load_host_context())
+
+
+def _probe_statusline() -> dict[str, Any]:
+    return checks.probe_statusline(checks.load_host_context())
+
+
+def _probe_hooks() -> dict[str, Any]:
+    return checks.probe_hooks(checks.load_host_context())
+
+
+def _probe_stamps() -> dict[str, Any]:
+    return checks.probe_stamps(checks.load_host_context())
+
+
+#: Read-only probes per section, reused by ``check``-style subcommands and by
+#: ``--dry-run``. ``env`` is special only in that it has no mutator.
+_PROBES: dict[str, Callable[[], dict[str, Any]]] = {
+    "env": _probe_env,
+    "plugins": _probe_plugins,
+    "mcp": _probe_mcp,
+    "settings": _probe_settings,
+    "statusline": _probe_statusline,
+    "hooks": _probe_hooks,
+    "stamps": _probe_stamps,
+}
+
+
+def probe_section(name: str, *, dry_run: bool = False) -> dict[str, Any]:
+    """Return one section's read-only probe as a mutation-shaped result.
+
+    Args:
+        name: One of :data:`SECTION_ORDER`.
+        dry_run: Mark the result as a preview (no mutator ran).
+    """
+    probe = _PROBES[name]()
+    fields = {
+        key: value for key, value in _section_fields(probe).items() if key != "changed"
+    }
+    if dry_run:
+        fields["dry_run"] = True
+    return _result(
+        str(probe["status"]),
+        probe.get("reason") if isinstance(probe.get("reason"), str) else None,
+        [],
+        **fields,
+    )
+
+
+def _section_fields(probe: dict[str, Any]) -> dict[str, Any]:
+    """Copy a probe's payload without its own status/reason pair."""
+    return {
+        key: value for key, value in probe.items() if key not in ("status", "reason")
+    }
+
+
+# --------------------------------------------------------------------------- #
+# plugins
+# --------------------------------------------------------------------------- #
+
+
+def ensure_plugins() -> dict[str, Any]:
+    """Install only the **missing** required plugins; never touch disabled ones.
+
+    Disabled entries are already installed, and wlcc's ruling is explicit:
+    ``check.sh`` only ever calls ``claude plugin install`` for an entry absent
+    from the registry, so a user's ``enabledPlugins: false`` survives every
+    repair. The marketplaces are added only when at least one plugin is
+    missing, which is what keeps a second ``wl cc init`` free of side effects.
+    """
+    before = checks.probe_plugins(checks.load_host_context())
+    fields = _section_fields(before)
+    changed: list[str] = []
+    if before["status"] == "unverifiable":
+        return _result("unverifiable", before.get("reason"), changed, **fields)
+
+    missing = list(before.get("missing") or [])
+    if not missing:
+        return _result(str(before["status"]), before.get("reason"), changed, **fields)
+
+    claude = shutil.which("claude")
+    if claude is None:
+        return _result(
+            "unverifiable",
+            "the claude CLI is not on PATH; cannot install "
+            + ", ".join(str(entry) for entry in missing),
+            changed,
+            **fields,
+        )
+
+    warnings: list[str] = []
+    for repo in MARKETPLACES:
+        try:
+            proc = _run(
+                [claude, "plugin", "marketplace", "add", repo],
+                timeout=_NETWORK_TIMEOUT,
+            )
+        except (OSError, subprocess.SubprocessError) as exc:
+            warnings.append(f"marketplace add {repo} could not run: {exc}")
+            continue
+        if proc.returncode == 0:
+            changed.append(f"plugins: added marketplace {repo}")
+    if warnings:
+        fields["warnings"] = warnings
+
+    failures: list[str] = []
+    for entry in missing:
+        try:
+            proc = _run(
+                [claude, "plugin", "install", str(entry), "-s", "user"],
+                timeout=_NETWORK_TIMEOUT,
+            )
+        except (OSError, subprocess.SubprocessError) as exc:
+            failures.append(f"{entry}: {exc}")
+            continue
+        if proc.returncode == 0:
+            changed.append(f"plugins: installed {entry}")
+        else:
+            failures.append(f"{entry}: {_failure(proc)}")
+    if failures:
+        fields["failed"] = failures
+
+    after = checks.probe_plugins(checks.load_host_context())
+    fields.update(_section_fields(after))
+    if changed and after["status"] == "ok":
+        return _result("repaired", None, changed, **fields)
+
+    reason = after.get("reason")
+    if failures:
+        reason = checks._join_reasons(
+            reason if isinstance(reason, str) else None,
+            "install failed: " + "; ".join(failures),
+        )
+    return _result(str(after["status"]), reason, changed, **fields)
+
+
+# --------------------------------------------------------------------------- #
+# mcp
+# --------------------------------------------------------------------------- #
+
+
+def _mcp_script(plugin_root: Path, name: str) -> Path:
+    """Return the registered server script for *name* under the plugin root."""
+    tools = plugin_root / ".claude" / "mcp-tools"
+    if name == "gitlab":
+        return tools / "server.py"
+    return tools / name / "server.py"
+
+
+def ensure_mcp() -> dict[str, Any]:
+    """Re-register both MCP servers and write the version stamp only on success.
+
+    A rejected plugin root or an unusable interpreter is reported as
+    ``unverifiable`` and never registered -- the same closed set of states
+    ``check.sh`` §3 uses. The stamp is the idempotency latch, so it is written
+    only after *both* ``claude mcp add`` calls returned 0; one failure leaves
+    the old stamp in place and the next run retries.
+    """
+    before = checks.probe_mcp(checks.load_host_context())
+    fields = _section_fields(before)
+    changed: list[str] = []
+    if before["status"] == "unverifiable":
+        return _result("unverifiable", before.get("reason"), changed, **fields)
+    if before["status"] == "ok":
+        return _result("ok", None, changed, **fields)
+
+    plugin_root = before.get("plugin_root")
+    if not isinstance(plugin_root, str) or not plugin_root:
+        return _result(
+            "unverifiable",
+            before.get("reason") or "the wlcc plugin root is unavailable",
+            changed,
+            **fields,
+        )
+    python = before.get("python")
+    python_path = python.get("path") if isinstance(python, dict) else None
+    python_state = python.get("state") if isinstance(python, dict) else None
+    if not isinstance(python_path, str) or not str(python_state).startswith(
+        ("supplied:", "ok:")
+    ):
+        return _result(
+            "unverifiable",
+            f"MCP interpreter is not usable: {python_state}",
+            changed,
+            **fields,
+        )
+
+    claude = shutil.which("claude")
+    if claude is None:
+        return _result(
+            "unverifiable", "the claude CLI is not on PATH", changed, **fields
+        )
+
+    failures: list[str] = []
+    root = Path(plugin_root)
+    for name in checks.MCP_SERVERS:
+        script = str(_mcp_script(root, name))
+        try:
+            _run([claude, "mcp", "remove", name])
+            proc = _run(
+                [
+                    claude,
+                    "mcp",
+                    "add",
+                    name,
+                    *MCP_SERVER_EXTRA[name],
+                    "-s",
+                    "user",
+                    "--",
+                    python_path,
+                    script,
+                ]
+            )
+        except (OSError, subprocess.SubprocessError) as exc:
+            failures.append(f"{name}: {exc}")
+            continue
+        if proc.returncode == 0:
+            changed.append(f"mcp: registered {name} -> {script}")
+        else:
+            failures.append(f"{name}: {_failure(proc)}")
+
+    if failures:
+        fields["failed"] = failures
+        failed_names = ", ".join(item.split(":", 1)[0] for item in failures)
+        return _result(
+            "dangling",
+            f"could not register {failed_names}",
+            changed,
+            **fields,
+        )
+
+    version = str(before.get("plugin_version") or "unknown")
+    stamp = checks.state_root() / "mcp-registered-version"
+    try:
+        _write_stamp(stamp, version)
+    except WriteError as exc:
+        return _result(
+            "unverifiable",
+            f"registered both servers but could not write {stamp}: {exc}",
+            changed,
+            **fields,
+        )
+    changed.append(f"mcp: wrote stamp {version}")
+
+    after = checks.probe_mcp(checks.load_host_context())
+    fields.update(_section_fields(after))
+    if after["status"] == "ok":
+        return _result("repaired", None, changed, **fields)
+    return _result(
+        str(after["status"]),
+        after.get("reason") or "the MCP stamp did not verify after registration",
+        changed,
+        **fields,
+    )
+
+
+# --------------------------------------------------------------------------- #
+# settings: gstack + claude-mem
+# --------------------------------------------------------------------------- #
+
+
+def _ensure_gstack() -> dict[str, Any]:
+    """Provision the pinned gstack skill; a half clone is cleaned and retried."""
+    host = checks.load_host_context()
+    path = host.config_root / "skills" / "gstack"
+    fields: dict[str, Any] = {"path": str(path), "pin": checks.GSTACK_PIN}
+    probe = checks._probe_gstack(host)
+    if probe["status"] == "ok":
+        return _result("ok", None, [], **fields)
+
+    changed: list[str] = []
+    if (path / ".git").exists():
+        try:
+            shutil.rmtree(path)
+        except OSError as exc:
+            return _result(
+                "unverifiable",
+                f"cannot remove the half-finished gstack clone {path}: {exc}",
+                changed,
+                **fields,
+            )
+        changed.append("settings: removed a half-finished gstack clone")
+
+    if not path.exists():
+        git = shutil.which("git")
+        if git is None:
+            return _result(
+                "dangling",
+                f"gstack is not provisioned at {path} and git is not on PATH",
+                changed,
+                **fields,
+            )
+        failures = _provision_gstack(git, path)
+        if failures:
+            shutil.rmtree(path, ignore_errors=True)
+            return _result(
+                "dangling",
+                "gstack provisioning failed: " + "; ".join(failures),
+                changed,
+                **fields,
+            )
+        changed.append(f"settings: provisioned gstack at {path} ({checks.GSTACK_PIN})")
+
+    after = checks._probe_gstack(checks.load_host_context())
+    fields["setup_executable"] = after.get("setup_executable")
+    if changed and after["status"] == "ok":
+        return _result("repaired", None, changed, **fields)
+    return _result(str(after["status"]), after.get("reason"), changed, **fields)
+
+
+def _provision_gstack(git: str, path: Path) -> list[str]:
+    """Clone, pin and ``./setup`` gstack; return a list of readable failures."""
+    steps: tuple[tuple[list[str], str | None, int], ...] = (
+        ([git, "clone", GSTACK_REPO, str(path)], None, _NETWORK_TIMEOUT),
+        ([git, "checkout", "--quiet", checks.GSTACK_PIN], str(path), 120),
+        ([str(path / "setup")], str(path), _NETWORK_TIMEOUT),
+    )
+    for argv, cwd, timeout in steps:
+        try:
+            proc = _run(argv, cwd=cwd, timeout=timeout)
+        except (OSError, subprocess.SubprocessError) as exc:
+            return [f"{argv[0]}: {exc}"]
+        if proc.returncode != 0:
+            return [f"{argv[0]}: {_failure(proc)}"]
+    setup = path / "setup"
+    if not setup.is_file() or not os.access(setup, os.X_OK):
+        return [f"{setup} is not executable after setup"]
+    return []
+
+
+def _ensure_claude_mem() -> dict[str, Any]:
+    """Write claude-mem's settings from the wlcc template only when absent.
+
+    The template is wlcc's own file under the trusted plugin root, and its
+    placeholders are substituted exactly as ``check.sh`` §6 does. An existing
+    file is never rewritten -- a differing model is a manual-merge state.
+    """
+    host = checks.load_host_context()
+    path = host.claude_mem_settings
+    fields: dict[str, Any] = {"path": str(path)}
+    if path.exists():
+        probe = checks._probe_claude_mem(host)
+        return _result(
+            str(probe["status"]), probe.get("reason"), [], **_section_fields(probe)
+        )
+
+    root, root_error = checks._locate_wlcc_root(host)
+    if root is None:
+        return _result("unverifiable", root_error, [], **fields)
+    template = root / "skills" / "wl-env" / "templates" / "claude-mem-settings.json"
+    if not template.is_file():
+        return _result(
+            "unverifiable",
+            f"claude-mem template is missing: {template}",
+            [],
+            **fields,
+        )
+    try:
+        text = template.read_text(encoding="utf-8")
+    except OSError as exc:
+        return _result("unverifiable", f"cannot read {template}: {exc}", [], **fields)
+
+    data_dir = Path(os.path.expanduser("~/.claude-mem"))
+    text = text.replace("__CLAUDE_MEM_DATA_DIR__", str(data_dir))
+    text = text.replace(
+        "__CLAUDE_MEM_TRANSCRIPTS_PATH__", str(data_dir / "transcript-watch.json")
+    )
+    if "__CLAUDE_MEM_" in text:
+        return _result(
+            "unverifiable",
+            f"unresolved template placeholder remains in {template}; nothing written",
+            [],
+            **fields,
+        )
+    try:
+        _atomic_write_text(path, text)
+    except WriteError as exc:
+        return _result("unverifiable", str(exc), [], **fields)
+
+    changed = [f"settings: applied the claude-mem template to {path}"]
+    after = checks._probe_claude_mem(checks.load_host_context())
+    fields.update(_section_fields(after))
+    if after["status"] == "ok":
+        return _result("repaired", None, changed, **fields)
+    return _result(str(after["status"]), after.get("reason"), changed, **fields)
+
+
+def ensure_settings() -> dict[str, Any]:
+    """§5 + §6 as one section: gstack and claude-mem, each isolated."""
+    subchecks: dict[str, dict[str, Any]] = {
+        "gstack": _isolated("gstack", _ensure_gstack),
+        "claude_mem": _isolated("claude_mem", _ensure_claude_mem),
+    }
+    status = checks._aggregate(
+        [str(subcheck["status"]) for subcheck in subchecks.values()]
+    )
+    changed = [
+        item for subcheck in subchecks.values() for item in subcheck.get("changed", [])
+    ]
+    reason: str | None = None
+    if status != "ok":
+        reason = checks._join_reasons(
+            *[
+                f"{name}: {subcheck.get('reason')}"
+                for name, subcheck in subchecks.items()
+                if subcheck["status"] == status and subcheck.get("reason")
+            ]
+        )
+    return _result(status, reason, changed, **subchecks)
+
+
+# --------------------------------------------------------------------------- #
+# statusline
+# --------------------------------------------------------------------------- #
+
+
+def _runtime() -> tuple[str | None, str | None]:
+    """Return ``(name, absolute path)`` for bun or node, preferring bun."""
+    for name, _source in _HUD_RUNTIMES:
+        path = shutil.which(name)
+        if path:
+            return name, path
+    return None, None
+
+
+def _hud_command(runtime_name: str, runtime_path: str) -> str:
+    """Render the self-contained claude-hud command for *runtime_name*."""
+    source = next(source for name, source in _HUD_RUNTIMES if name == runtime_name)
+    flag = "--env-file /dev/null" if runtime_name == "bun" else ""
+    return (
+        _HUD_TEMPLATE.replace("__RUNTIME__", runtime_path)
+        .replace("__FLAG__", flag)
+        .replace("__SOURCE__", source)
+    )
+
+
+def write_statusline() -> dict[str, Any]:
+    """Write the claude-hud statusLine; never overwrite another statusline.
+
+    ``conflict`` and invalid JSON are terminal states for this mutator: the
+    file is left byte-identical. ``missing_plugin`` is write-free as well: the
+    existing command already names claude-hud (that is how the probe
+    classified it), wlcc's rule is to skip a statusLine that already contains
+    ``claude-hud``, and rewriting the same command on every run would churn a
+    backup and report a change forever. Only the plugin itself is missing, so
+    the probe's ``dangling`` status is reported unchanged.
+
+    When a write *is* needed, the command merges into the existing
+    ``statusLine`` object instead of replacing it, so keys a user added there
+    survive.
+    """
+    host = checks.load_host_context()
+    before = checks.probe_statusline(host)
+    fields = _section_fields(before)
+    changed: list[str] = []
+    if before["status"] == "unverifiable":
+        return _result("unverifiable", before.get("reason"), changed, **fields)
+    action = before.get("action")
+    if action == "ok":
+        return _result("ok", None, changed, **fields)
+    if action == "conflict":
+        return _result("dangling", before.get("reason"), changed, **fields)
+    if action == "missing_plugin":
+        # Nothing to write: the command already contains claude-hud.
+        return _result("dangling", before.get("reason"), changed, **fields)
+
+    runtime_name, runtime_path = _runtime()
+    if runtime_name is None or runtime_path is None:
+        return _result(
+            "dangling",
+            "no bun/node runtime is on PATH; the claude-hud command was not written",
+            changed,
+            **fields,
+        )
+    if "'" in runtime_path:
+        return _result(
+            "dangling",
+            "runtime path contains a single quote, refusing to build the command: "
+            f"{runtime_path}",
+            changed,
+            **fields,
+        )
+    # The path lands inside a double-quoted word of the generated command, so
+    # these characters would be re-interpreted by the inner shell at runtime.
+    if any(char in runtime_path for char in ('"', "$", "`", "\n")):
+        return _result(
+            "dangling",
+            "runtime path contains a shell-unsafe character, refusing to build "
+            f"the command: {runtime_path}",
+            changed,
+            **fields,
+        )
+
+    settings = host.settings if isinstance(host.settings, dict) else {}
+    planned = dict(settings)
+    existing = settings.get("statusLine")
+    status_line = dict(existing) if isinstance(existing, dict) else {}
+    status_line["type"] = "command"
+    status_line["command"] = _hud_command(runtime_name, runtime_path)
+    planned["statusLine"] = status_line
+    if planned == settings:
+        # Semantically identical already (e.g. a previous run wrote exactly
+        # this command): never create a backup or report a change for a no-op.
+        return _result(str(before["status"]), before.get("reason"), changed, **fields)
+    try:
+        backup = _atomic_write_json(
+            host.config_root / "settings.json", planned, preserve_except="statusLine"
+        )
+    except WriteError as exc:
+        return _result("unverifiable", str(exc), changed, **fields)
+    changed.append(f"statusline: wrote the claude-hud command via {runtime_name}")
+    if backup is not None:
+        fields["backup"] = backup
+
+    after = checks.probe_statusline(checks.load_host_context())
+    fields.update(_section_fields(after))
+    if after["status"] == "ok":
+        return _result("repaired", None, changed, **fields)
+    return _result(str(after["status"]), after.get("reason"), changed, **fields)
+
+
+# --------------------------------------------------------------------------- #
+# hooks
+# --------------------------------------------------------------------------- #
+
+
+def _rewritten_command(command: str, root: str) -> str:
+    """Apply hooks-drift's rewrite rule to one command string."""
+    updated = command
+    for kind, token, _reason in checks._scan_tokens(command):
+        if kind != "dangling":
+            continue
+        target = checks._rewrite_path(token, root)
+        if target is not None and os.path.exists(target):
+            updated = updated.replace(token, target)
+    return updated
+
+
+def _plan_hook_group(
+    event: str, group: Any, root: str, entries: list[dict[str, Any]]
+) -> Any | None:
+    """Plan one matcher group; return the kept group, or None when it emptied."""
+    if not isinstance(group, dict):
+        return group
+    hook_list = group.get("hooks")
+    if not isinstance(hook_list, list):
+        return group
+    matcher = group.get("matcher") if isinstance(group.get("matcher"), str) else None
+    kept_hooks: list[Any] = []
+    for hook in hook_list:
+        command = hook.get("command") if isinstance(hook, dict) else None
+        if not isinstance(command, str):
+            kept_hooks.append(hook)
+            continue
+        action, hook_entries = checks._plan_hook_command(command, root, event, matcher)
+        entries.extend(hook_entries)
+        if action == "prune":
+            continue
+        if action == "rewrite":
+            hook = dict(hook)
+            hook["command"] = _rewritten_command(command, root)
+        kept_hooks.append(hook)
+    if not kept_hooks:
+        return None
+    if kept_hooks != hook_list:
+        group = dict(group)
+        group["hooks"] = kept_hooks
+    return group
+
+
+def _plan_hook_settings(
+    settings: dict[str, Any], root: str
+) -> tuple[dict[str, Any], list[dict[str, Any]]]:
+    """Port of hooks-drift's ``plan_settings`` on top of the #222 planner.
+
+    Rewrite wins over prune: as long as one path in a command can be saved, the
+    command is kept. Empty matchers and empty event keys are reclaimed.
+    """
+    planned = json.loads(json.dumps(settings))
+    entries: list[dict[str, Any]] = []
+    hooks = planned.get("hooks")
+    if not isinstance(hooks, dict):
+        return planned, entries
+
+    for event in list(hooks):
+        groups = hooks.get(event)
+        if not isinstance(groups, list):
+            continue
+        kept_groups = [
+            kept
+            for kept in (
+                _plan_hook_group(str(event), group, root, entries) for group in groups
+            )
+            if kept is not None
+        ]
+        if kept_groups:
+            hooks[event] = kept_groups
+        elif groups:
+            del hooks[event]
+    return planned, entries
+
+
+def _hook_changes(entries: Iterable[dict[str, Any]]) -> list[str]:
+    """Turn the plan entries into readable ``changed`` actions."""
+    changed: list[str] = []
+    for entry in entries:
+        if entry.get("action") == "rewrite":
+            changed.append(f"hooks: rewrote {entry.get('from')} -> {entry.get('to')}")
+        elif entry.get("action") == "prune":
+            changed.append(f"hooks: pruned {entry.get('from')}")
+    return changed
+
+
+def repair_hooks() -> dict[str, Any]:
+    """Rewrite or prune dangling hook commands with backup + atomic replace.
+
+    The plan is the same :func:`wl_cli.cc.checks.probe_hooks` plan the report
+    shows; this mutator only materialises it. A plan that is identical to the
+    file (every entry ``skip``) is ``dangling`` with no write -- reporting
+    ``repaired`` there would lie.
+    """
+    host = checks.load_host_context()
+    before = checks.probe_hooks(host)
+    fields = _section_fields(before)
+    changed: list[str] = []
+    if before["status"] == "unverifiable":
+        return _result("unverifiable", before.get("reason"), changed, **fields)
+    if not before.get("entries"):
+        return _result("ok", None, changed, **fields)
+
+    settings_path = host.config_root / "settings.json"
+    try:
+        original = _read_settings(settings_path)
+    except WriteError as exc:
+        return _result("error", str(exc), changed, **fields)
+    planned, entries = _plan_hook_settings(original, str(host.config_root))
+    if planned == original:
+        return _result("dangling", before.get("reason"), changed, **fields)
+
+    try:
+        backup = _atomic_write_json(settings_path, planned, preserve_except="hooks")
+    except WriteError as exc:
+        return _result("error", str(exc), changed, **fields)
+    changed = _hook_changes(entries)
+    if backup is not None:
+        fields["backup"] = backup
+
+    after = checks.probe_hooks(checks.load_host_context())
+    fields["wrote"] = True
+    fields["after_status"] = after["status"]
+    if not after.get("entries"):
+        return _result("repaired", None, changed, **fields)
+    return _result(str(after["status"]), after.get("reason"), changed, **fields)
+
+
+# --------------------------------------------------------------------------- #
+# stamps
+# --------------------------------------------------------------------------- #
+
+
+def prune_stamps() -> dict[str, Any]:
+    """Delete only retired stamps; report unregistered entries and keep them.
+
+    This is check.sh §8's rule verbatim: the retired list is closed, the
+    ``visionary-cli`` skill copy is removed only when it carries its
+    ``.wlcc-version`` marker, and everything else is an orphan reported in the
+    payload -- ``~/.config/wlcc`` belongs to the user.
+    """
+    host = checks.load_host_context()
+    changed: list[str] = []
+    failures: list[str] = []
+
+    for name in sorted(checks.RETIRED_STAMPS):
+        path = host.state_root / name
+        if not path.exists():
+            continue
+        try:
+            path.unlink()
+        except OSError as exc:
+            failures.append(f"cannot remove {path}: {exc}")
+            continue
+        changed.append(f"stamps: removed retired stamp {path}")
+
+    # check.sh §8 attempts this unconditionally: the retired deepseek stack
+    # registered the server from this repo, so a leftover registration is
+    # cleaned here too. `claude mcp remove` is idempotent (non-zero when the
+    # server is absent) and there is no scope-independent read-only query for
+    # it, so the call stays unconditional and only a zero exit counts as a
+    # change.
+    claude = shutil.which("claude")
+    if claude is not None:
+        try:
+            proc = _run([claude, "mcp", "remove", "deepseek-visionary"])
+        except (OSError, subprocess.SubprocessError) as exc:
+            failures.append(f"claude mcp remove deepseek-visionary: {exc}")
+        else:
+            if proc.returncode == 0:
+                changed.append(
+                    "stamps: removed the retired deepseek-visionary MCP registration"
+                )
+
+    skill = host.config_root / "skills" / "visionary-cli"
+    if (skill / ".wlcc-version").exists():
+        try:
+            shutil.rmtree(skill)
+        except OSError as exc:
+            failures.append(f"cannot remove {skill}: {exc}")
+        else:
+            changed.append(f"stamps: removed the retired skill copy {skill}")
+
+    after = checks.probe_stamps(checks.load_host_context())
+    fields = _section_fields(after)
+    if failures:
+        fields["failed"] = failures
+    reason = after.get("reason")
+    if failures:
+        reason = checks._join_reasons(
+            reason if isinstance(reason, str) else None, "; ".join(failures)
+        )
+    if after["status"] == "ok":
+        return _result("repaired" if changed else "ok", None, changed, **fields)
+    return _result(str(after["status"]), reason, changed, **fields)
+
+
+# --------------------------------------------------------------------------- #
+# upgrade
+# --------------------------------------------------------------------------- #
+
+
+#: Marker from the ``/wl-upgrade`` contract: the ``wlcc@wlcc`` array has no
+#: ``scope: user`` entry, so the plugin is treated as unprovisioned and the
+#: version cannot be verified (never "already latest").
+NO_USER_SCOPE_ENTRY = "NO_USER_SCOPE_ENTRY"
+
+
+def _wlcc_user_version(host: checks.HostContext) -> str | None:
+    """Return the ``scope: user`` version of ``wlcc@wlcc``, or ``None``.
+
+    ``installed_plugins.json``'s ``wlcc@wlcc`` array is authoritative, and only
+    its ``scope: user`` element is the one the MCP registration follows
+    (wlcc stamps.md, ``/wl-upgrade`` §1). The cache-directory maximum is *not*
+    a fallback: a downgrade or a leftover directory can make it disagree with
+    the registered version, so it is reported only as a diagnostic.
+    """
+    entry = (host.installed or {}).get("wlcc@wlcc")
+    if isinstance(entry, list):
+        for item in entry:
+            if isinstance(item, dict) and item.get("scope") == "user":
+                version = item.get("version")
+                if isinstance(version, str) and version:
+                    return version
+    return None
+
+
+def _cached_wlcc_version(host: checks.HostContext) -> str | None:
+    """Return the largest plugin-cache version directory (diagnostic only)."""
+    try:
+        return checks._max_version_dir(checks._wlcc_cache(host))
+    except OSError:
+        return None
+
+
+def upgrade_wlcc() -> dict[str, Any]:
+    """Upgrade the wlcc Claude Code plugin (``/wl-upgrade``'s two steps).
+
+    This upgrades the *plugin*, not the ``wl`` binary: ``wl self update`` /
+    ``wl env repair`` own the CLI, and the two must never be confused. The
+    marketplace is refreshed when registered and added when it is not.
+
+    A registry without a ``scope: user`` ``wlcc@wlcc`` entry is
+    ``unverifiable`` (``NO_USER_SCOPE_ENTRY``): the plugin is not provisioned
+    for this user, so "already latest" would be a guess. The plugin cache is
+    reported as ``cache_version`` but never decides the verdict.
+    """
+    host = checks.load_host_context()
+    before = _wlcc_user_version(host)
+    fields: dict[str, Any] = {
+        "before": before,
+        "after": None,
+        "version_source": "installed_plugins.json:user" if before else None,
+        "cache_version": _cached_wlcc_version(host),
+        "requires_restart": False,
+    }
+    changed: list[str] = []
+    if before is None:
+        return _result(
+            "unverifiable",
+            f"{NO_USER_SCOPE_ENTRY}: installed_plugins.json has no wlcc@wlcc "
+            "entry with scope 'user'; the plugin is not provisioned for this "
+            "user, so its version cannot be verified",
+            changed,
+            **fields,
+        )
+
+    claude = shutil.which("claude")
+    if claude is None:
+        return _result(
+            "unverifiable", "the claude CLI is not on PATH", changed, **fields
+        )
+    try:
+        listed = _run([claude, "plugin", "marketplace", "list"])
+    except (OSError, subprocess.SubprocessError) as exc:
+        return _result(
+            "unverifiable",
+            f"claude plugin marketplace list could not run: {exc}",
+            changed,
+            **fields,
+        )
+    if listed.returncode != 0:
+        return _result(
+            "unverifiable",
+            f"claude plugin marketplace list {_failure(listed)}",
+            changed,
+            **fields,
+        )
+
+    if "wlcc" in listed.stdout:
+        marketplace_argv = [claude, "plugin", "marketplace", "update", "wlcc"]
+        marketplace_action = "updated"
+    else:
+        marketplace_argv = [
+            claude,
+            "plugin",
+            "marketplace",
+            "add",
+            WLCC_MARKETPLACE_REPO,
+        ]
+        marketplace_action = "added"
+    fields["marketplace_action"] = marketplace_action
+    try:
+        refreshed = _run(marketplace_argv, timeout=_NETWORK_TIMEOUT)
+    except (OSError, subprocess.SubprocessError) as exc:
+        return _result(
+            "unverifiable",
+            f"claude plugin marketplace {marketplace_action} could not run: {exc}",
+            changed,
+            **fields,
+        )
+    if refreshed.returncode != 0:
+        return _result(
+            "unverifiable",
+            f"claude plugin marketplace {marketplace_action} {_failure(refreshed)}",
+            changed,
+            **fields,
+        )
+
+    try:
+        updated = _run(
+            [claude, "plugin", "update", "wlcc@wlcc", "-s", "user"],
+            timeout=_NETWORK_TIMEOUT,
+        )
+    except (OSError, subprocess.SubprocessError) as exc:
+        return _result(
+            "unverifiable",
+            f"claude plugin update wlcc@wlcc could not run: {exc}",
+            changed,
+            **fields,
+        )
+    if updated.returncode != 0:
+        return _result(
+            "unverifiable",
+            f"claude plugin update wlcc@wlcc {_failure(updated)}",
+            changed,
+            **fields,
+        )
+
+    fresh = checks.load_host_context()
+    after = _wlcc_user_version(fresh)
+    fields.update(after=after, cache_version=_cached_wlcc_version(fresh))
+    if after is None:
+        return _result(
+            "unverifiable",
+            f"{NO_USER_SCOPE_ENTRY}: `claude plugin update wlcc@wlcc -s user` "
+            "succeeded but installed_plugins.json still has no user-scope "
+            "entry; the resulting version cannot be verified",
+            changed,
+            **fields,
+        )
+    fields["requires_restart"] = before != after
+    if before != after:
+        changed.append(f"upgrade: wlcc {before or 'unknown'} -> {after or 'unknown'}")
+        return _result("repaired", None, changed, **fields)
+    return _result("ok", None, changed, **fields)
+
+
+# --------------------------------------------------------------------------- #
+# init-done stamp
+# --------------------------------------------------------------------------- #
+
+
+def write_init_done() -> dict[str, Any]:
+    """Write ``<plugin version> <YYYY-MM-DD>`` when the content actually differs.
+
+    ``wl-env-init`` §5 uses the largest cache directory as the version source
+    (not ``VERSION``). Rewriting an identical stamp would make every ``init``
+    look like a change, so an already-current file is reported ``ok``.
+    """
+    host = checks.load_host_context()
+    fields: dict[str, Any] = {}
+    try:
+        version = checks._max_version_dir(checks._wlcc_cache(host))
+    except OSError as exc:
+        return _result("unverifiable", f"cannot read the wlcc plugin cache: {exc}")
+    content = f"{version or 'unknown'} {datetime.date.today().isoformat()}"
+    path = checks.state_root() / "init-done"
+    fields.update(path=str(path), content=content)
+    try:
+        existing = path.read_text(encoding="utf-8").strip()
+    except FileNotFoundError:
+        existing = None
+    except OSError as exc:
+        return _result("unverifiable", f"cannot read {path}: {exc}", **fields)
+    if existing == content:
+        return _result("ok", None, **fields)
+    try:
+        _write_stamp(path, content)
+    except WriteError as exc:
+        return _result("unverifiable", str(exc), **fields)
+    return _result("repaired", None, [f"init-done: wrote {content}"], **fields)
+
+
+# --------------------------------------------------------------------------- #
+# Orchestration
+# --------------------------------------------------------------------------- #
+
+#: One action per section; ``env`` is report-only on purpose (see module doc).
+_ACTIONS: dict[str, Callable[[], dict[str, Any]]] = {
+    "env": _probe_env,
+    "plugins": ensure_plugins,
+    "mcp": ensure_mcp,
+    "settings": ensure_settings,
+    "statusline": write_statusline,
+    "hooks": repair_hooks,
+    "stamps": prune_stamps,
+}
+
+
+def run_repair(
+    selected: Iterable[str] | None = None,
+    *,
+    dry_run: bool = False,
+) -> tuple[str, str | None, dict[str, Any]]:
+    """Run the selected sections and aggregate them into one envelope payload.
+
+    ``env`` is always reported (it answers "is the host ready" as a whole) but
+    is never mutated. ``--dry-run`` reports the same probes without touching a
+    file. Each section is isolated: one raising mutator becomes
+    ``unverifiable`` and the others still run.
+    """
+    chosen = set(MUTABLE_SECTIONS if selected is None else selected)
+    names = ["env", *(name for name in MUTABLE_SECTIONS if name in chosen)]
+    sections: dict[str, dict[str, Any]] = {}
+    for name in names:
+        action = (
+            partial(probe_section, name, dry_run=True) if dry_run else _ACTIONS[name]
+        )
+        sections[name] = _isolated(name, action)
+
+    status = checks._aggregate(
+        [str(section["status"]) for section in sections.values()]
+    )
+    reason = checks._reason_for(sections, status)
+    changed = [
+        item for section in sections.values() for item in section.get("changed", [])
+    ]
+    return status, reason, {"dry_run": dry_run, "changed": changed, **sections}
+
+
+def run_init(*, dry_run: bool = False) -> tuple[str, str | None, dict[str, Any]]:
+    """Provision every section, then write the ``init-done`` stamp.
+
+    The stamp is skipped when any section is ``error`` or ``unverifiable``: an
+    init that could not establish its own probe must not leave a marker saying
+    it did. Known problems (``dangling``, e.g. a deliberately disabled plugin)
+    do not block the stamp -- they are reported in the payload.
+    """
+    status, reason, fields = run_repair(None, dry_run=dry_run)
+    sections = {name: fields[name] for name in SECTION_ORDER}
+    if dry_run:
+        init_done = _result("dangling", "dry run: init-done was not written")
+        return status, reason, {**fields, "init_done": init_done}
+
+    blocking = [
+        name
+        for name, section in sections.items()
+        if section["status"] in ("error", "unverifiable")
+    ]
+    if blocking:
+        init_done = _result(
+            "dangling",
+            "init-done was not written; sections not established: "
+            + ", ".join(blocking),
+        )
+    else:
+        init_done = _isolated("init_done", write_init_done)
+
+    final_status = checks._aggregate([status, str(init_done["status"])])
+    if final_status != status and isinstance(init_done.get("reason"), str):
+        reason = checks._join_reasons(reason, f"init-done: {init_done['reason']}")
+    changed = [*fields["changed"], *init_done.get("changed", [])]
+    return final_status, reason, {**fields, "changed": changed, "init_done": init_done}