diff --git a/.bat-harness-test.ps1 b/.bat-harness-test.ps1
new file mode 100644
index 0000000..12552b5
--- /dev/null
+++ b/.bat-harness-test.ps1
@@ -0,0 +1,147 @@
+# Harness: exercises GHOST.bat menu input handling on a TEST COPY.
+# Runs locally and in CI (ci.yml windows job, "GHOST.bat menu harness");
+# derives the repo root from its own location so it works on any checkout.
+# stdin redirection is unusable here (the launcher's ESC-capture powershell
+# child drains redirected stdin, starving every set /p), so the copy reads
+# answers from %TESTINPUT% line-by-line via a for /f counter instead.
+# Answers: one per line, CRLF; no empty lines (for /f skips them; the
+# interactive bare-Enter path is covered by the 'if not defined choice'
+# guards and a space-only answer exercises the tokenless-input path).
+# NOTE: some cmd builds reject skip=0 inside for /f options with a parse
+# error ("delims= was unexpected"), so paging goes through `more +N`
+# (which accepts +0) instead of `skip=N`.
+$ErrorActionPreference = 'Stop'
+$repo = $PSScriptRoot
+$work = Join-Path $env:TEMP 'ghost-bat-harness'
+if (Test-Path $work) { Remove-Item $work -Recurse -Force }
+New-Item -ItemType Directory -Path $work | Out-Null
+
+# --- build the test copy -------------------------------------------------------
+$src = [System.IO.File]::ReadAllText("$repo\GHOST.bat")
+$count = ([regex]::Matches($src, [regex]::Escape('set /p choice=%PROMPT_TEXT%'))).Count
+# Floor 5 = main + the four hand-written submenus; generated clone suites
+# (tools\new_clone_suite.ps1) add one prompt per new submenu and the global
+# rewrite below covers every occurrence, so the check guards the floor only.
+if ($count -lt 5) { throw "expected at least 5 set /p sites in GHOST.bat (main + 4 submenus), found $count" }
+$copy = $src.Replace('set /p choice=%PROMPT_TEXT%', 'call :TestNextInput choice')
+$sub = @'
+
+:TestNextInput
+rem === HARNESS-ONLY: next answer comes from %TESTINPUT% (TESTIDX = next line, 0-based).
+rem skip=0 is a parse error on this cmd build, so page with more +N and keep
+rem the first line; the read cap stops an exhausted-input runaway loop.
+if not defined TESTIDX set "TESTIDX=0"
+set /a TESTREADS=TESTREADS+1
+if %TESTREADS% GTR 200 (
+    echo HARNESS: read cap hit - input exhausted in a loop
+    exit 9
+)
+set "TESTANSWER="
+for /f "usebackq delims=" %%a in (`more +%TESTIDX% "%TESTINPUT%"`) do (
+    if not defined TESTANSWER set "TESTANSWER=%%a"
+)
+set /a TESTIDX=TESTIDX+1
+set "%~1=%TESTANSWER%"
+goto :eof
+'@
+$copy = $copy + ($sub -replace "`n", "`r`n")
+$testCopy = Join-Path $work 'TestGhost.bat'
+[System.IO.File]::WriteAllText($testCopy, $copy, [System.Text.Encoding]::ASCII)
+
+function New-Input([string]$Name, [string[]]$Lines) {
+    $p = Join-Path $work "$Name.in.txt"
+    [System.IO.File]::WriteAllText($p, (($Lines | ForEach-Object { $_ + "`r`n" }) -join ''))
+    return $p
+}
+
+function Invoke-Scenario([string]$Name, [string[]]$Lines) {
+    $inFile = New-Input $Name $Lines
+    $outFile = Join-Path $work "$Name.out.txt"
+    $env:TESTINPUT = $inFile
+    $env:TESTIDX = '0'
+    $env:TESTREADS = '0'
+    cmd /c "`"$testCopy`" > `"$outFile`" 2>&1"
+    Remove-Item Env:TESTINPUT -ErrorAction SilentlyContinue
+    Remove-Item Env:TESTIDX -ErrorAction SilentlyContinue
+    Remove-Item Env:TESTREADS -ErrorAction SilentlyContinue
+    return (Get-Content $outFile -Raw)
+}
+
+$failures = @()
+
+# A) plain exit at main menu -> Done, zero Unknown task, zero literal junk
+$out = Invoke-Scenario 'A_plain_exit' @('0')
+if ($out -match 'Unknown task')            { $failures += 'A: Unknown task on plain exit' }
+if ($out -match '%choice|%PENDING_CHAIN%') { $failures += 'A: literal variable text leaked' }
+if ($out -notmatch 'Done\.')               { $failures += 'A: never reached exit' }
+
+# B) open ZCode submenu (PENDING_CHAIN undefined), back, exit -> no bogus line
+$out = Invoke-Scenario 'B_submenu_render' @('2', '0', '0')
+if ($out -match 'Unknown task')            { $failures += 'B: Unknown task on plain submenu render' }
+if ($out -match '%PENDING_CHAIN%')         { $failures += 'B: literal %PENDING_CHAIN% leaked' }
+if ($out -notmatch 'ZCode Multi-Instance') { $failures += 'B: ZCode submenu not shown' }
+
+# C) tokenless input inside ZCode submenu -> silent re-render, then back, exit
+$out = Invoke-Scenario 'C_space_submenu' @('2', ' ', '0', '0')
+if ($out -match 'Unknown task')            { $failures += 'C: Unknown task on tokenless submenu input' }
+if ($out -notmatch 'ZCode Multi-Instance') { $failures += 'C: ZCode submenu not shown' }
+
+# D) invalid main-menu id -> exactly one legit Unknown task "99"
+$out = Invoke-Scenario 'D_invalid_main' @('99', '0')
+$hits = ([regex]::Matches($out, 'Unknown task "99"')).Count
+if ($hits -ne 1)                           { $failures += "D: expected 1 legit Unknown task, got $hits" }
+
+# E) main sub-path "2 99" -> chain reaches ZCodeOne, exactly one legit
+#    Unknown task, and the PENDING_CHAIN literal never appears
+$out = Invoke-Scenario 'E_subpath_chain' @('2 99', '0', '0')
+$hits = ([regex]::Matches($out, 'Unknown task "99"')).Count
+if ($hits -ne 1)                           { $failures += "E: expected 1 Unknown task from chain, got $hits" }
+if ($out -match '%PENDING_CHAIN%')         { $failures += 'E: literal %PENDING_CHAIN% leaked' }
+if ($out -notmatch 'ZCode Multi-Instance') { $failures += 'E: ZCode submenu not reached via sub-path' }
+
+# F) new ZCode submenu entry renders: [17] Freeze diagnostic is listed
+$out = Invoke-Scenario 'F_new_entry_render' @('2', '0', '0')
+if ($out -notmatch '\[17\].*Freeze diagnostic') { $failures += 'F: ZCode submenu [17] Freeze diagnostic not rendered' }
+
+# G) invalid ZCode submenu id -> exactly one legit Unknown task "42"
+$out = Invoke-Scenario 'G_invalid_zcode' @('2', '42', '0', '0')
+$hits = ([regex]::Matches($out, 'Unknown task "42"')).Count
+if ($hits -ne 1)                           { $failures += "G: expected 1 Unknown task from ZCode submenu, got $hits" }
+
+# H) open AutoClaw submenu (PENDING_CHAIN undefined), back, exit -> clean render
+$out = Invoke-Scenario 'H_autoclaw_render' @('4', '0', '0')
+if ($out -match 'Unknown task')               { $failures += 'H: Unknown task on AutoClaw submenu render' }
+if ($out -match '%PENDING_CHAIN%')            { $failures += 'H: literal %PENDING_CHAIN% leaked' }
+if ($out -notmatch 'AutoClaw Multi-Instance') { $failures += 'H: AutoClaw submenu not shown' }
+
+# I) invalid AutoClaw chain id "4 42" -> exactly one legit Unknown task "42"
+$out = Invoke-Scenario 'I_invalid_autoclaw' @('4 42', '0', '0')
+$hits = ([regex]::Matches($out, 'Unknown task "42"')).Count
+if ($hits -ne 1)                           { $failures += "I: expected 1 Unknown task from AutoClaw chain, got $hits" }
+if ($out -match '%PENDING_CHAIN%')         { $failures += 'I: literal %PENDING_CHAIN% leaked' }
+
+# J) hostile main-menu input - :ValidateChoice must reject (never execute)
+#    the injected command, show the hint, re-prompt, then exit cleanly
+$out = Invoke-Scenario 'J_hostile_main' @('1 & calc', '0')
+if ($out -match 'calc')               { $failures += 'J: injection attempt leaked through main prompt' }
+if ($out -notmatch 'Invalid input')   { $failures += 'J: rejection hint missing' }
+
+# K) hostile main-menu input with parens - PWNED must never execute
+$out = Invoke-Scenario 'K_hostile_parens' @('2 ) & echo PWNED', '0')
+if ($out -match 'PWNED')              { $failures += 'K: paren-amp injection executed' }
+
+# L) hostile ZCode submenu input - rejected at the submenu prompt
+$out = Invoke-Scenario 'L_hostile_zcode' @('2', '1 & calc', '0', '0')
+if ($out -match 'calc')               { $failures += 'L: injection attempt leaked through ZCode prompt' }
+if ($out -notmatch 'Invalid input')   { $failures += 'L: rejection hint missing' }
+
+if ($failures.Count -gt 0) {
+    Write-Output 'HARNESS FAIL:'
+    $failures | ForEach-Object { Write-Output "  - $_" }
+    exit 1
+}
+Write-Output 'HARNESS PASS: all 12 scenarios clean'
+# Explicit exit: pwsh -File propagates the last native \$LASTEXITCODE, and the
+# scenarios' cmd exit code inherits GHOST.bat's `timeout` calls, which fail on
+# CI consoles (no interactive stdin) AFTER the PASS line was already printed.
+exit 0
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d673647..173ece1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,8 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  # Called by release.yml so a tag can never publish an untested tree.
+  workflow_call:
 
 permissions:
   contents: read
@@ -45,6 +47,26 @@ jobs:
           Invoke-Pester -Configuration $config
           if ($config.Run.Exit) { exit $LASTEXITCODE }
 
+      - name: Node engines - asar patcher syntax + ENGINE_VERSION marker
+        shell: pwsh
+        run: |
+          foreach ($f in @('tools/patch_zcode_icon_override.mjs', 'tools/patch_autoclaw_ports.mjs')) {
+            node --check $f
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+            $src = Get-Content -LiteralPath $f -Raw
+            # \s* before $: the runner checks out CRLF and (?m)$ does not
+            # match before the CR (first CI run caught this).
+            if ($src -notmatch '(?m)^const ENGINE_VERSION = (\d+);\s*$') {
+              Write-Error "ENGINE_VERSION marker missing in $f"
+              exit 1
+            }
+            Write-Host "$f ENGINE_VERSION=$($Matches[1])"
+          }
+
+      - name: GHOST.bat menu harness
+        shell: pwsh
+        run: ./.bat-harness-test.ps1
+
   linux:
     name: Shell lint
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..1eaf2c5
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,96 @@
+name: Release
+
+# Publishes a GitHub Release with a ZIP asset when a vX.Y.Z tag is pushed.
+# The ZIP is a plain `git archive` (tracked files only) so its content matches
+# exactly what update_ghost.ps1's download-ZIP path fetches and verifies.
+# Prerequisites (enforced, never silent): the tag must have a matching
+# "## [X.Y.Z]" section in CHANGELOG.md - its content becomes the release notes.
+
+on:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: write
+
+jobs:
+  # The full CI suite runs first: a tag never publishes an untested tree.
+  tests:
+    name: CI gates (called)
+    uses: ./.github/workflows/ci.yml
+
+  release:
+    name: Build ZIP + publish GitHub Release
+    needs: tests
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Guard - tag must match a CHANGELOG section
+        shell: pwsh
+        run: |
+          $tag = $env:GITHUB_REF_NAME
+          if ($tag -notmatch '^v\d+\.\d+\.\d+$') {
+            Write-Error "Unexpected tag format '$tag' - expected vX.Y.Z"
+            exit 1
+          }
+          $ver = $tag.Substring(1)
+          $section = Select-String -Path CHANGELOG.md -Pattern ('^## \[' + [regex]::Escape($ver) + '\]')
+          if (-not $section) {
+            Write-Error "CHANGELOG.md has no '## [$ver]' section - write the release notes before tagging $tag"
+            exit 1
+          }
+          Write-Host "Tag $tag -> CHANGELOG line $($section.LineNumber): $($section.Line)"
+
+      - name: Build ZIP (git archive = tracked files, mirrors update_ghost.ps1's ZIP copy)
+        shell: pwsh
+        run: |
+          $tag = $env:GITHUB_REF_NAME
+          $zip = "ghost-$tag.zip"
+          git archive --format=zip --prefix="ghost-$tag/" --output="$zip" HEAD
+          $item = Get-Item -LiteralPath $zip
+          if ($item.Length -lt 100KB) {
+            Write-Error "ZIP suspiciously small: $($item.Length) bytes"
+            exit 1
+          }
+          Write-Host "Built $zip ($([math]::Round($item.Length / 1MB, 2)) MB)"
+
+      - name: Extract release notes from the CHANGELOG section
+        shell: pwsh
+        run: |
+          $tag = $env:GITHUB_REF_NAME
+          $ver = $tag.Substring(1)
+          $lines = Get-Content -LiteralPath CHANGELOG.md
+          $start = -1
+          for ($i = 0; $i -lt $lines.Count; $i++) {
+            if ($lines[$i] -match ('^## \[' + [regex]::Escape($ver) + '\]')) { $start = $i; break }
+          }
+          if ($start -lt 0) { Write-Error "Section '## [$ver]' vanished between guard and extract"; exit 1 }
+          $end = $lines.Count
+          for ($j = $start + 1; $j -lt $lines.Count; $j++) {
+            if ($lines[$j] -match '^## \[') { $end = $j; break }
+          }
+          $notes = $lines[$start..($end - 1)] -join "`r`n"
+          Set-Content -LiteralPath release-notes.md -Value $notes -Encoding utf8
+          Write-Host "Extracted $($end - $start) note lines for [$ver]"
+
+      - name: Create the GitHub Release with the ZIP asset
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: pwsh
+        run: |
+          $tag = $env:GITHUB_REF_NAME
+          gh release create "$tag" "ghost-$tag.zip" --title "GHOST $tag" --notes-file release-notes.md --verify-tag
+
+      - name: Verify-after - the asset is on the release (never silent-success)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: pwsh
+        run: |
+          $tag = $env:GITHUB_REF_NAME
+          $assets = @(gh release view "$tag" --json assets --jq '.assets[].name')
+          if ($assets -notcontains "ghost-$tag.zip") {
+            Write-Error "ZIP asset missing from release $tag (assets: $($assets -join ', '))"
+            exit 1
+          }
+          Write-Host "Verified: release $tag carries ghost-$tag.zip"
diff --git a/.gitignore b/.gitignore
index d44e1b1..a9f3ccf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -91,7 +91,3 @@ tools/block_qoder_domains.ps1
 # Shortcuts are per-machine binaries (paths embed the repo location) — regenerate
 # with tools\install_ghost_shortcut.ps1 instead of committing.
 *.lnk
-
-# Throwaway test harness for GHOST.bat menu input handling — local-only, regenerated
-# on demand by re-running the harness author against a TEST COPY of GHOST.bat.
-.bat-harness-test.ps1
diff --git a/AGENTS.md b/AGENTS.md
index 09d2d7e..d5ae02c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,22 +2,26 @@
 
 ## Project overview
 
-Fresh-start toolkit for local AI-IDE identity stores — **Cursor**, **Windsurf/Devin Desktop**, **Trae**, **Qoder**, **ZCode**, **QoderWork**, **MiniMax Agent/OpenCode** — for privacy hygiene, multi-account testing, and dev-environment resets. Windows PowerShell (primary) and Linux Bash scripts.
+Fresh-start toolkit for local AI-IDE identity stores — **Cursor**, **Windsurf/Devin Desktop**, **Trae**, **Qoder**, **ZCode**, **QoderWork**, **MiniMax Agent/OpenCode**, **AutoClaw** — for privacy hygiene, multi-account testing, and dev-environment resets. Windows PowerShell (primary) and Linux Bash scripts.
 
 ## Repository layout
 
 ```
 README.md  AGENTS.md  GHOST.bat/ghost.sh     # root launchers (scripts live under src/;
                                              #   CLI cheat sheet: docs/cli.md); GHOST.bat =
-                                             #   3 submenus with CONTINUOUS LOCAL numbering
-                                             #   (IDE resets [1]-[8] / ZCode Multi-Instance &
+                                             #   4 submenus with CONTINUOUS LOCAL numbering
+                                             #   (IDE resets [1]-[9] / ZCode Multi-Instance &
                                              #   Clones [1]-[17] / System & GHOST Maintenance
-                                             #   [1]-[2]) + ANSI colors + local chained input
+                                             #   [1]-[2] / AutoClaw Multi-Instance & Clones
+                                             #   [1]-[12]) + ANSI colors + local chained input
                                              #   per submenu (e.g. "1 3 4"), main-menu sub-paths
                                              #   ("2 1 3 4" = ZCode then run its [1] [3] [4]),
                                              #   global gid jump from the main menu, and
                                              #   [U] Check for updates on the main menu
 src/windows/                        # current .ps1 resetters (unversioned names) + identity_utils.ps1 + change_device_id.ps1
+                                    #   + launch_autoclaw_clone.ps1 (AutoClaw clone launcher,
+                                    #     -Instance inst1..inst4 + -Status) + Launch-AutoClaw-Clone.bat
+                                    #   + reset_autoclaw.ps1 (-Target Primary|inst1..4|All)
 src/linux/                     # .sh scripts (id_reset_common.sh + per-IDE resetters)
 src/python/                    # stdlib-only Python core (ghost/ package) + ghost_cli.py bootstrap —
                                #   owns the shared SQLite/JSON identity logic; the PS bridges
@@ -25,7 +29,9 @@ src/python/                    # stdlib-only Python core (ghost/ package) + ghos
                                #   refresh_zcode_second_chats chat-check) invoke it by absolute
                                #   path; tested by tests/python/test_ghost_core.py (unittest)
 docs/                              # IMPLEMENTATION_GUIDE/PLAN, WALKTHROUGH, research notes (local-only);
-                                   #   ZCODE_CHAT_SYNC_WATCHER_PLAN.md (tracked — chat-sync root cause)
+                                   #   ZCODE_CHAT_SYNC_WATCHER_PLAN.md (tracked — chat-sync root cause);
+                                   #   PYTHON_HYBRID_ROADMAP.md (tracked — Phase 2 cancellation decision +
+                                   #   Phase 3 thin-manifest pilot design + acceptance criteria)
 archive/                           # superseded versions (local-only fallbacks — do not run, never committed)
 assets/                            # ghost.ico + ghost-source.png (launcher icon; regenerate via
                                    #   tools/make_ghost_icon.ps1 — never hand-edit)
@@ -122,6 +128,40 @@ tools/                             # reviewed utilities (block_qoder_domains.ps1
                                    #     overwrite-edits prompt); GHOST.bat replaced by either path
                                    #     prints a close-and-relaunch note (cmd reads the .bat
                                    #     incrementally)
+                                   #   patch_autoclaw_ports.ps1 (+ .mjs engine v10) — one-time app.asar
+                                   #     patch widening AutoClaw's hardcoded MCP candidate-port array
+                                   #     [19681..19684] -> [19681..19688] + home-override (the state-dir
+#     isolation marker .autoclaw-home; see the ELEVATION bullet below)
+                                   #     multi-instance ceiling; inst4 has no port without it);
+                                   #     backup + marker (autoclaw-ports-patch.marker.json) + -Restore
+                                   #     (verified byte-identical) + node --check gate; AutoClaw must be
+                                   #     closed; an app update reverts it (all instances run with
+                                   #     system.autoUpdate=false as the guard); AutoClaw submenu [11];
+                                   #   install_autoclaw_clone_shortcuts.ps1 — per-user Desktop +
+                                   #     Start-menu shortcuts for inst1..inst4 (AppUserModel.ID =
+                                   #     com.zhipuai.autoclaw.inst1..4; base read from the Primary .lnk
+                                   #     or the verified app constant; -Instance to scope; -Remove;
+                                   #     -RepairPrimaryAumid strips a hijacked .instN suffix + restores
+                                   #     <exe>,0 icon; .lnk AUMIDs read ONLY via Shell.Application
+                                   #     ExtendedProperty); per-clone IconLocation =
+                                   #     tools\autoclaw-<color>-branding\tray_icon.ico,0 (blue/yellow/
+                                   #     green/red ← inst1..4; missing dir warns + falls back to the
+                                   #     exe icon); AutoClaw submenu [2]
+                                   #   new_clone_suite.ps1 — clone-suite scaffolding generator (playbook
+                                   #     phases 3-10 mechanics): intake JSON → reset/launcher/.bat/
+                                   #     shortcuts/SPEC skeletons + GHOST.bat submenu anchor-edit with
+                                   #     verify-after; parse-checks every emitted .ps1; Phases 0-2 stay
+                                   #     with the agent as <TODO: Phase 1 discovery> slots
+                                   #   make_clone_icon.ps1 — GENERIC clone-icon generator (any app,
+                                   #     PS 5.1 + System.Drawing only): corner-sampled background →
+                                   #     tile detection (LongestLowRun profiles, -BgTolerance, or
+                                   #     -ManualCrop x,y,size) → inset crop → 1024 master +
+                                   #     rounded-corner alpha mask → tray_icon.ico (16..256
+                                   #     PNG-in-ICO) + icon_windows.png + source.<ext> provenance;
+                                   #     -HueRotate derives extra colors (autoclaw-red-branding =
+                                   #     blue master +150°); re-runs reuse the transparent-corner
+                                   #     master; verify-after + TEMP previews; built for the
+                                   #     opencode/cline future clones — do not delete
 ```
 
 ## Architecture
@@ -130,7 +170,6 @@ tools/                             # reviewed utilities (block_qoder_domains.ps1
 src/windows/identity_utils.ps1  # Shared library, dot-sourced by all IDE scripts
   New-IdentitySet                  #   -> { devDeviceId, machineId, macMachineId, sqmId }
   Assert-Administrator             #   -> exit 1 if not elevated
-  Stop-AppProcesses                #   -> kill loop (auto-expands Windsurf->Devin+codeium, Trae->Broker)
   Backup-FileToTimestampDir        #   -> copy to <app>\ID_Backups\<ts>\<label>
   Set-JsonIdentity                 #   -> JSON patch + verify-after re-read
   Set-SqliteKeys                   #   -> Python-backed UPSERT + verify-after (invokes src/python/ghost_cli.py sqlite-update)
@@ -143,6 +182,13 @@ src/windows/identity_utils.ps1  # Shared library, dot-sourced by all IDE scripts
 reset_cursor.ps1     # Cursor: 15 steps (machineid, storage.json, state.vscdb,
                                    #          auth-secrets scrub, device_id_salt, os_crypt rotation,
                                    #          Cookies/NPS/sentry/DIPS/Trust Tokens/Crashpad/logs, workspace DBs)
+                                   #          v0.3 THIN MANIFEST (Phase 3 pilot — docs/PYTHON_HYBRID_ROADMAP.md):
+                                   #          every store mutation runs via ghost_cli.py core subcommands
+                                   #          (Invoke-GhostCore = the single PS→Python point); step order,
+                                   #          audit keys, restore actions + summary identical to v0.2
+                                   #          (archived at archive/reset_cursor_windows-v0.2.ps1, local-only);
+                                   #          step 4's legacy temp-.py heredoc replaced by the shared
+                                   #          delete-secrets subcommand; Python now required for ALL steps
 reset_devin.ps1       # Windsurf/Devin Desktop (rebranded 2026-06): 17 steps
                                    #            x N auto-detected %APPDATA% roots (Devin, Windsurf):
                                    #            argv.json crash-reporter-id (.windsurf + .devin),
@@ -184,6 +230,28 @@ reset_minimax_opencode.ps1  # MiniMax/OpenCode: 22 steps (OpenCode auth.json wip
                                    #          chat preserved)
 change_device_id.ps1              # System-level: Fingerprint (self-test) / LegacyReset (registry GUIDs)
                                    #   / RepairProfiles (ProfileList .bak keys). Windows-only.
+reset_autoclaw.ps1                # AutoClaw: 7 steps (auth.json deviceId rotate,
+                                   #          identity\device.json ed25519 keypair regen via node:crypto
+                                   #          (system node or the app-bundled node.exe), settings.json
+                                   #          gateway.port+url + system.autoUpdate=false (asar-patch
+                                   #          guard), .updaterId rotate, openclaw.json mode/checkOnStart,
+                                   #          devices\paired.json delete — live operator credential,
+                                   #          gateway regenerates; final re-verify; -Target
+                                   #          Primary|inst1|inst2|inst3|inst4|All + -DryRun;
+                                   #          All = clones first, Primary last)
+launch_autoclaw_clone.ps1         # AutoClaw multi-instance launcher -Instance inst1|inst2|inst3|inst4
+                                   #          + -Status: env levers USERPROFILE/HOME/TEMP/TMP/TMPDIR +
+                                   #          AUTOCLAW_GATEWAY_PORT (drift +9 read back, recorded to
+                                   #          instance-record.json) + --user-data-dir (this app HONOURS it,
+                                   #          lock keys off the profile dir); first run seeds the Primary
+                                   #          profile EXCLUDING credential stores (token-cache.json,
+                                   #          *.backup, auth.json tokens stripped — userInfo kept, ONE
+                                   #          manual login per clone) + rotates device identity + ed25519
+                                   #          keypair; marker-guarded one-time primary-token reconciliation;
+                                   #          verify-after-launch: subtree stable 5s, MCP/gateway /health on
+                                   #          DISCOVERED ports (never the requested one), paired.json holds
+                                   #          only the clone's own key, Primary openclaw.json hash unchanged.
+                                   #          Launch sequentially, never elevated.
 ```
 (All .ps1 above live in src/windows/; .sh scripts in src/linux/;
 superseded versions (Qoder v0.1-v0.3, ZCode v1.0-v1.3, MiniMax v1.0-v1.1,
@@ -197,7 +265,7 @@ Each IDE script is a **thin target manifest**: dot-source utils -> Assert-Admin
 1. All covered IDEs derive **shared** telemetry IDs (`telemetry.machineId`, `.sqmId`, `.devDeviceId`, `.macMachineId`) from the same Windows registry source at first launch. Resetting one but not the others leaves a cross-IDE correlation trail.
 2. SQLite must use **Python** (`Get-Command python` / `python3`). .NET SQLite assemblies are NOT registered on this box. `Set-SqliteKeys` in `identity_utils.ps1` handles Python detection + graceful skip.
 3. Registry GUID changes (`HKLM:\...\Cryptography\MachineGuid` etc.) do **NOT** affect the fingerprint self-test — the algorithm reads WMI hardware/OS signals (CPU, BIOS, motherboard, RAM, timezone), not those registry keys.
-4. The max reliably-changeable fingerprint-signal weight is **0.19** (CPU name 0.12 + tz 0.03 + culture 0.02 + ui.language 0.02), which is below the **0.306** delta needed to flip `sameIdentity` to false. Therefore IDE storage rewrites are the **primary** unbanning mechanism, not the fingerprint self-test.
+4. The max reliably-changeable fingerprint-signal weight is **0.19** (CPU name 0.12 + tz 0.03 + culture 0.02 + ui.language 0.02), which is below the **0.306** delta needed to flip `sameIdentity` to false. Therefore IDE storage rewrites are the **primary** identity-reset mechanism, not the fingerprint self-test.
 5. `IMPLEMENTATION_GUIDE.md` is the verified ground truth. Do not trust comments in old scripts — several describe behavior verified NOT to work.
 
 ## Mandatory conventions
@@ -368,6 +436,171 @@ Each IDE script is a **thin target manifest**: dot-source utils -> Assert-Admin
   pagefile / fewer concurrent instances. Ruled out that day: GPU caches, the
   icon asar patch, the captcha watchdog (idle since 09-17), db.sqlite locks.
 
+## Multi-instance conventions (AutoClaw: Primary + 4 clone slots)
+
+- Layout (FROZEN, never rename): `%USERPROFILE%\AutoClawCloneHome\instN\`
+  with `home\` (USERPROFILE/HOME → gateway state `.openclaw-autoclaw`),
+  `profile\` (--user-data-dir), `tmp\` (TEMP/TMP/TMPDIR). The Primary
+  (`%APPDATA%\AutoClaw` + `~\.openclaw-autoclaw`) is never touched by any
+  clone script beyond reading it for the seed. Spec:
+  `docs/AUTOCLAW_CLONES_SPEC.md` (all §5 ground truth read from the
+  installed app, provenance §13).
+- Isolation levers: env vars FIRST (`USERPROFILE`/`HOME` move the whole
+  gateway state tree; `AUTOCLAW_GATEWAY_PORT` per instance), and
+  `--user-data-dir` as a SECOND layer — this app HONOURS it (unlike ZCode);
+  the single-instance lock keys off the profile dir, so re-launching a
+  running clone just focuses it.
+- The MCP HTTP server binds a hardcoded 4-slot port array
+  (`PRODUCTIVITY_MCP_CANDIDATE_PORTS = [19681..19684]`) in the Electron main
+  process — 4 is the stock ceiling and two instances silently SPLIT across
+  slots (wrong-instance routing, not an error). `tools/patch_autoclaw_ports.ps1`
+  widens it to 8; inst4 has NO MCP port without that patch. An AutoClaw
+  update reverts it — therefore EVERY instance's settings.json carries
+  `system.autoUpdate: false` (set by reset + seed-scrub) and the patch is
+  re-applied after any manual update (AutoClaw submenu [11]).
+- The gateway port silently shifts up to +9 when the preferred port is busy
+  (`PORT_PROBE_RANGE`) — never record the REQUESTED port as the actual one:
+  the launcher discovers the clone's real listening ports by scanning
+  19681..19688 / requested..requested+9 against the clone's own process
+  subtree and writes them to `instance-record.json` (`-Status` reads it).
+- One credential = one instance (ZCode Telegram rule generalized): AutoClaw
+  keeps TWO device identities — `auth.json.deviceId` (backend id) and
+  `identity\device.json` (ed25519 keypair; the pubkey is what the backend
+  pins for pairing) — plus `devices\paired.json`, a LIVE operator token with
+  admin scope. The seed copies the Primary profile EXCLUDING every
+  credential store (`token-cache.json` holds live token/refreshToken too —
+  it is excluded, not scrubbed), strips `auth.json` tokens keeping
+  `userInfo` (clone opens on the account, ONE manual login per clone),
+  rotates the identities, and NEVER seeds the gateway state tree (fresh per
+  clone; its gateway regenerates `paired.json`). Verify-after-launch
+  asserts the clone's `paired.json` holds only its own device key.
+- Classify clone processes by PROCESS MARKERS (the `--user-data-dir` /
+  home-dir strings in the command line), never by window title (ZCode
+  splash-phase lesson applies verbatim); helpers/gateway children hang off
+  the marker-matched main via a parent walk.
+- Launch clones SEQUENTIALLY, never in parallel, and never elevated (UIPI;
+  the ZCode drag-drop rule applies). The launcher itself needs NO admin.
+- The FIRST-RUN seed requires the Primary CLOSED — a live Chromium profile
+  cannot be robocopied (leveldb LOCK files + open DBs; verified 2026-10-15:
+  robocopy exit 9 with the Primary running). The launcher waits up to 180s
+  then aborts; later launches never need this. Seed completion is
+  marker-guarded (`.autoclaw-seeded` written only after scrub verified):
+  needsSeed keyed on `auth.json` alone let an aborted robocopy's PARTIAL
+  profile pass as seeded — the app launched on inconsistent stores and died
+  within seconds (live-verified). A partial profile is cleared + re-seeded
+  automatically on the next run.
+- Running windows all declare the BASE AUMID `com.zhipuai.autoclaw` (set
+  unconditionally in the app) — v1 known limitation: shared taskbar button;
+  the SHORTCUTS still carry per-clone AUMIDs (`com.zhipuai.autoclaw.inst1..4`)
+  for pin grouping and per-clone ICONS
+  (`tools\autoclaw-<color>-branding\tray_icon.ico` — blue/yellow/green for
+  inst1..3 from developer-supplied renders 2026-10-17, red for inst4 as a
+  +150° hue-rotate of the blue master via `tools\make_clone_icon.ps1`;
+  `bad-green` rejected by the developer). A pinned clone can hijack the
+  Primary's `AutoClaw.lnk` AUMID + wipe its icon — same as ZCode: repair with
+  `install_autoclaw_clone_shortcuts.ps1 -RepairPrimaryAumid` (the Primary
+  keeps the stock exe icon; only clone .lnk icons are custom).
+- Electron fuses verified patchable (no asar-integrity validation, no
+  integrity.json) — the ZCode asar-patch mechanism works on AutoClaw as-is.
+  AutoClaw also bundles `resources\node\node.exe` — the keygen fallback when
+  system node is missing (ed25519 via node:crypto; PS 5.1 cannot generate
+  ed25519; PEM shapes verified: SPKI 113, PKCS8 119 chars).
+- **ELEVATION (verified live 2026-10-16, changes everything above):**
+  AutoClaw.exe's manifest declares `requestedExecutionLevel
+  level="requireAdministrator"` — EVERY launch self-elevates (UAC silent for
+  admin accounts with ConsentPromptBehaviorAdmin=0), and the elevated process
+  gets a FRESH ENVIRONMENT: the launcher's env levers (USERPROFILE/HOME/
+  AUTOCLAW_GATEWAY_PORT) never survive. `--user-data-dir` (an argument)
+  survives ONLY when the launching cmd itself is elevated first — a
+  non-elevated `start` hits the ERROR_ELEVATION_REQUIRED ShellExecute
+  fallback, which launches the elevated process with a bare command line
+  (verified via PEB reads: every AutoClaw.exe ran with NO arguments).
+  Therefore: (a) the launcher elevates its own `cmd /c start` via
+  `-Verb RunAs` so the args ride a plain CreateProcess; (b) the gateway-port
+  lever is the clone's settings.json `gateway.port` (file-based, survives
+  elevation), not the env var; (c) the state dir is isolated by
+  `tools/patch_autoclaw_ports.ps1` engine v10 (`home-override`): the patched
+  app reads `<userData>\.autoclaw-home` (written by the launcher each launch,
+  trim-tolerant — the app's argv carries a trailing space after the quoted
+  path) and redirects the whole `~/.openclaw-autoclaw` tree; the resolver is
+  `app.getPath("home")`-based (Chromium known-folder, env-immune), NOT
+  `os.homedir()` — the spec's section 5.3 env-var claim was verified against
+  plain node only and does NOT hold for the app. The scan is
+  argv-driven (reads --user-data-dir from process.argv — getPath("userData")
+  is NOT yet applied at resolver time) and caches into
+  `globalThis.__autoclawHomeOverride`.
+- **WMI (Win32_Process) is unusable for AutoClaw classification**: it omits
+  AutoClaw.exe processes ENTIRELY (healthy mains invisible minutes after
+  start) and CommandLine is permanently empty for the ones it shows (the app
+  effectively scrubs its PEB command line — PEB reads confirm args were
+  passed while WMI/PEB show none). Classification uses Get-Process
+  (toolhelp32) pid-diff + the profile lockfile exclusive-open probe
+  (`Test-ProfileLockHeld`); port ownership falls back to an unattributed
+  advisory scan. `taskkill /F` may report "Access is denied" for same-user
+  processes misleadingly — use .NET `Process.Kill()`.
+- Every patched app start appends one diagnostic record to
+  `%TEMP%\ac-argv-debug.txt` (argv + resolved override + error) — the field
+  tool for diagnosing clone isolation; remove from
+  `tools/patch_autoclaw_ports.mjs` `ARGV_SCAN_CACHED`/`homeOverrideIife` if
+  it ever needs to go silent.
+- Full live-verified clone cycle 2026-10-16: inst1 launched beside the
+  Primary with `gateway :18799 /health OK {"ok":true,"status":"live"}`,
+  `paired.json` holding only the clone's device key, Primary openclaw.json
+  hash unchanged, and the whole `.openclaw-autoclaw` tree materializing in
+  the clone home. One manual login remains per clone.
+- **First-run seed gate = the PRIMARY's profile lockfile, never "any
+  AutoClaw.exe process"** (live bug 2026-10-17): the gate used
+  `Get-Process -Name AutoClaw`, so inst1 RUNNING blocked inst2/3/4's first
+  launch for the full 180s wait and then aborted — user-visible as a cmd
+  window that flashes and closes with nothing opening. Clones are named
+  AutoClaw.exe too and never lock the Primary's files; the correct gate is
+  `Test-ProfileLockHeld` on `%APPDATA%\AutoClaw` (clean Primary exit leaves
+  no lockfile; a running instance holds it exclusively — semantics
+  verified on a live clone the same day). Running-clone detection also
+  needs the lockfile probe: WMI cannot see the clone, so the marker-based
+  subtree match alone misses it.
+- **Sign-in gate on the gateway (asar-verified 2026-10-17):** the embedded
+  gateway auto-starts only via `shouldLaunchGatewayAtColdStart =
+  isCloudMode || hasAcceptedRiskAgreement()` → `triggerGatewayLaunch()`,
+  whose start is parked on the renderer's `APP_MAIN_UI_READY`
+  (`markGatewayMainUiReady`); the handler re-checks via
+  `ensureEmbeddedGatewayLaunchedAfterRiskAgreement`. An instance sitting on
+  the SIGN-IN screen never sends it — NO gateway/MCP ports until the ONE
+  manual login completes and the main UI mounts (inst2 live case: seeded +
+  isolated + running, gateway absent while `auth.json` had no token; after
+  the user's inst1 login 02:13 its gateway bound 18799). The launcher
+  treats a missing gateway as WARN when the profile has no token (login
+  pending) and FAIL only when a token IS present.
+- **Browser-extension native host spawns bare Primary instances**
+  (live-verified 2026-10-17): `%APPDATA%\AutoClaw\chrome-ext\0.1.6\com.autoclaw.native_host_stub.json`
+  points at `C:\Program Files\AutoClaw\AutoClaw.exe` with NO arguments —
+  whenever the AutoClaw extension reconnects in Chrome/Edge it spawns a
+  bare AutoClaw.exe that opens the PRIMARY profile and rewrites its
+  `openclaw.json` (bare pid 12612 spawned 43s into inst2's launch; this is
+  also the source of the "openclaw.json modified externally" dialogs). The
+  launcher therefore attributes Primary-hash changes via the Primary
+  lockfile before/after (held during the window → WARN out-of-band, not a
+  clone breach); a clone's FIRST launch needs every Primary-profile window
+  closed — including that stray spawn.
+
+## App cloning playbook (any new app)
+
+When asked to clone ANY app into multi-instance ("clone <app>"), follow
+`docs/APP_CLONING_PLAYBOOK.md` — phases 0–10, the identity suite
+(MANDATORY vs DEGRADABLE features + the never-silently-degrade rule), the
+automation contract (what the agent does unasked vs the Developer's only
+touchpoints), and the fixed final-report format. Fill
+`docs/APP_CLONING_INTAKE_TEMPLATE.md` first (developer values or documented
+defaults — every default is reported). `docs/APP_CLONING_EDGE_CASES.md` is
+normative: its EC-xx handling rules apply to every suite. Icon policy
+(2026-10-15): developer-supplied icons are wired as-is; missing icons
+default to IMPROVISE (generate tinted placeholder variants from the stock
+icon) + report, with stock-default + report as the allowed fallback — both
+branches are ALWAYS reported, never silent (playbook §5). Colors are
+developer-specified per clone (defaults: the ZCode blue/yellow/green
+palette). Current suites: ZCode (gold standard, full identity) and AutoClaw
+(v1, shared-taskbar limitation documented in its spec §7.3c).
+
 ## Out of scope
 
 - Linux `.sh` scripts (separate effort)
@@ -380,6 +613,6 @@ Each IDE script is a **thin target manifest**: dot-source utils -> Assert-Admin
 
 - **Do NOT auto-commit.** Leave changes in the working tree for review. The user handles versioning.
 - **Windows-first.** This is a Windows PowerShell project. Linux scripts exist but are out of scope for changes.
-- **Run IDE scripts as Administrator** with the target app **closed first**. Each script calls `Assert-Administrator` and `Stop-AppProcesses` early.
+- **Run IDE scripts as Administrator** with the target app **closed first**. Each script calls `Assert-Administrator` early, then runs its own aggressive process-kill loop (`Stop-<App>ProcessesAggressive`).
 - **Follow the Cursor pattern.** `src/windows/reset_cursor.ps1` is the canonical reference implementation (v0.1 had the BOM + rename-leaves-old-fingerprint bugs). New IDE scripts should mirror its structure, local helpers, and error handling.
 - **Parse-check before declaring done.** Use `[System.Management.Automation.Language.Parser]::ParseFile` to verify syntax of every `.ps1` change.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7d5dde2..b8bd2bd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,8 +7,140 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.1.0] — 2026-10-17
+
+### Added
+
+- **Python hybrid Phase 3 pilot — reset_cursor v0.3 thin manifest**
+  (2026-10-17): the Cursor reset's 15 steps now run every store mutation
+  through `src/python/ghost_cli.py` core subcommands via a single
+  `Invoke-GhostCore` helper — new core modules `ghost/filesweep.py`
+  (binary-store rename-or-delete, verified deletes, per-file tree sweeps)
+  and `ghost/winstore.py` (machine-id file, device_id_salt rotation, dotted
+  JSON key removal) plus 7 new subcommands (`backup`, `machineid-file`,
+  `salt-rotate`, `json-remove`, `store-delete`, `sweep-file`, `sweep-tree`),
+  all covered by the expanded unittest suite (58 cases incl. CLI bridge
+  contracts). Step order, audit keys, restore actions and the summary are
+  identical to v0.2 (archived at `archive/reset_cursor_windows-v0.2.ps1`,
+  local-only); step 4's inline temp-.py heredoc — the last one in the repo —
+  is replaced by the shared `delete-secrets` subcommand. Python is now
+  required for ALL Cursor reset steps (fail-fast up front). 1031 → 840
+  lines. The mandatory live comparison run (pilot acceptance #3) is
+  user-supervised and pending. Decision record + design:
+  [docs/PYTHON_HYBRID_ROADMAP.md](docs/PYTHON_HYBRID_ROADMAP.md) (Phase 2
+  leaf-tools migration CANCELLED with per-tool reasons).
+
+- **Clone-suite generator** (`tools/new_clone_suite.ps1`, 2026-10-17) —
+  turns the app-cloning playbook's Phases 3-10 mechanics into scaffolding:
+  from an intake JSON (or interactive defaults) it emits the reset manifest,
+  clone launcher, `.bat` wrapper, AUMID-shortcuts installer (+ branding
+  wiring + `-RepairPrimaryAumid`) and a spec stub with a ground-truth table,
+  then wires a new GHOST.bat submenu (backup + anchor edit + verify-after,
+  next submenu id / DispatchOne gids allocated by parsing the current file).
+  Every emitted `.ps1` is parse-checked before the tool claims success;
+  Phases 0-2 (discovery/isolation design) stay with the agent as marked
+  `<TODO: Phase 1 discovery>` slots. Acceptance: a generated demo suite
+  passed the harness and repo-integrity, then was removed.
+
+- **ZCode per-clone Telegram bots (UI-assisted, EC-D03)** — `tools/set_zcode_bot.ps1`
+  (`-VerifyOnly` audit / `-Target <name> -Fix` backup-first sync): fingerprints
+  the encrypted `credentials.json -> bot:<id>:credential` (`enc:v1:`, sha8
+  only, never values) + bot id across BOTH `bot-config.json` and
+  `bot-config.v3.json` in all 4 homes (the 2026-10-16 Fourth `v2=False /
+  v3=True` split looked disabled while polling — both files are now always
+  checked); fails loudly on any duplicate-while-enabled (HTTP 409 risk).
+  `src/windows/launch_zcode_second_instance.ps1 [2c]` upgraded from
+  always-disable to sha8-compare (duplicate -> disable both files; unique ->
+  preserve + `.telegram-routed` v2 marker, never reverted). Flow: operator
+  creates 3 BotFather bots, pastes each token once in that clone's ZCode UI
+  (app mints fresh `bot-<guid>` + `enc:v1:`), tooling guards/syncs. Quota
+  decision 2026-10-16: Option C — Fourth keeps its big quota isolated.
+  Docs: [docs/ZCODE_TELEGRAM_BOTS.md](docs/ZCODE_TELEGRAM_BOTS.md); tests:
+  `tests/set_zcode_bot.Tests.ps1` (4 passing).
+
+- **AutoClaw multi-instance clones (Primary + inst1–inst4)** — full suite per
+  [docs/AUTOCLAW_CLONES_SPEC.md](docs/AUTOCLAW_CLONES_SPEC.md):
+  `tools/patch_autoclaw_ports.ps1` (+ `.mjs` engine v1) widens the installed
+  app's hardcoded 4-slot MCP port array to 8 (backup + marker + `-Restore`,
+  verified byte-identical via SHA-256 round-trip; re-run after every AutoClaw
+  update); `src/windows/launch_autoclaw_clone.ps1` (-Instance inst1..inst4,
+  `-Status`) launches clones with env-var isolation (`USERPROFILE`/`HOME`,
+  `AUTOCLAW_GATEWAY_PORT` with actual-port read-back + drift recording) and a
+  credential-free seed (tokens stripped, `token-cache.json` excluded, gateway
+  state never copied — one manual login per clone) plus verify-after-launch
+  health/port/pairing checks; `src/windows/reset_autoclaw.ps1` (-Target
+  Primary|inst1..4|All, `-DryRun`) rotates both device identities (auth
+  `deviceId` + ed25519 keypair via node:crypto) and deletes the live operator
+  credential; `tools/install_autoclaw_clone_shortcuts.ps1` installs per-clone
+  AUMID shortcuts with `-RepairPrimaryAumid`; `src/windows/Launch-AutoClaw-Clone.bat`
+  double-click wrapper. GHOST.bat gains a fourth submenu (AutoClaw
+  Multi-Instance & Clones [1]–[12], gids 29–40) and IDE Resets [9].
+- **App cloning playbook docs** — [docs/APP_CLONING_PLAYBOOK.md](docs/APP_CLONING_PLAYBOOK.md)
+  (the generic clone-any-app process: identity suite with a
+  never-silently-degrade rule, developer-inputs contract, icon policy with
+  improvise+report as the default for missing icons, phases 0–10
+  checklists, and a fixed final-report format),
+  [docs/APP_CLONING_EDGE_CASES.md](docs/APP_CLONING_EDGE_CASES.md) (the
+  normative EC-xx catalog distilled from the ZCode 2026-09 and AutoClaw
+  2026-10 suites), and [docs/APP_CLONING_INTAKE_TEMPLATE.md](docs/APP_CLONING_INTAKE_TEMPLATE.md)
+  (the per-request fill-in form). AGENTS.md gains the "App cloning playbook"
+  section; `docs/README.md` indexes all three plus the previously missing
+  AUTOCLAW spec row.
+
 ### Fixed
 
+- **GHOST.bat menu input executed hostile self-input** (2026-10-17): the
+  unquoted `%chain%` / `%choice%` expansions ran `1 & calc` verbatim and
+  parens broke the parse. A new `:ValidateChoice` allowlists digits, spaces,
+  commas and U/u inside an isolated delayed-expansion probe, and all five
+  prompt sites reject before the "0" check, tokenization, for-in dispatch or
+  `:RunChain` call. Harness 12/12 incl. hostile amp/parens/submenu scenarios.
+- **Captcha watchdog could run twice and leaked its log-tail state**
+  (2026-10-17): a second resident copy (menu [11] again) double-fired
+  restarts/Telegram escalations on the shared state file — the watcher now
+  carries the taskbar watcher's guard (startup process scan + named mutex,
+  `-RunOnce` always runs). `Read-NewLogLines` was rewritten byte-level: it
+  consumes only up to the last complete newline (a trailing partial line or
+  partial multi-byte char is re-read complete next pass) and advances the
+  offset by bytes actually consumed instead of a file length probed after
+  `ReadToEnd` (the old race skipped whatever the agent appended in between).
+- **update_ghost misidentified a Download-ZIP copy sitting inside another
+  repository as a clone** (2026-10-17): `rev-parse --is-inside-work-tree`
+  answers "true" against the PARENT repo, so the updater fetched/pulled/reset
+  in the wrong place ("no origin remote" as the visible symptom). The clone
+  track now additionally requires `--show-toplevel` to equal the GHOST folder
+  itself; a parent-tree hit warns explicitly and routes into the ZIP-copy
+  conversion flow.
+- **Chat refresh classified a splash-phase clone as the Primary**
+  (2026-10-17): `refresh_zcode_second_chats.ps1` matched mains by window
+  title only, and a clone launching (splash title plain "ZCode") was claimed
+  as a Primary main with its app-servers recycled as Primary's. Classification
+  is now process-marker-first (the verified 2026-09-24/26 taskbar rule):
+  WMI subtree walk to the root main, clone roaming/home markers, clone v6
+  color title overrides a spurious Primary read; unresolved windows are
+  skipped, never guessed. Live smoke against running instances passed.
+- **Shortcut installers broke under PowerShell 7** (2026-10-17): both
+  installers set the `.lnk` TargetPath to `$PSHOME\powershell.exe`, which
+  does not exist in pwsh's own directory — shortcuts created by a pwsh-run
+  installer targeted a nonexistent exe. They now pin the OS-shipped
+  `System32\WindowsPowerShell\v1.0\powershell.exe` and fail fast if absent.
+- **block_qoder_domains corrupted non-ASCII hosts comments** (2026-10-17,
+  local-only tool): the hosts round-trip read BOM-less bytes as UTF-8 and
+  wrote with ASCII encoding, flattening every non-ASCII character to a
+  permanent `?`. Read/write now both use the system ANSI codepage (BOM
+  auto-detect still wins), matching how the Windows resolver reads hosts —
+  single-byte-codepage content survives byte-exactly.
+- **IDE Resets [9] dispatched the wrong task**: the Resets submenu had no
+  local→gid resolver, so typed ids reached `:DispatchOne` raw — local [9]
+  "Reset AutoClaw" therefore ran global gid 9 (the ZCode captcha watchdog,
+  already reachable as ZCode [11]) instead of gid 28
+  (`reset_autoclaw.ps1 -Target Primary`). A `:ResetsOne` resolver now maps
+  1–8 identity + 9→28, and both Resets dispatch sites route through it
+  (the prompt loop and the main-menu chained input `1 9`); bare global ids
+  from the main menu keep using `:RunChain`. Verified 2026-10-16: a
+  harness extracted the shipped `:ResetsOne` verbatim and passed all five
+  cases (1→gid 1, 8→gid 8, **9→gid 28**, unknown→error, chained `9 2`→
+  gid 28 then gid 2); CRLF intact (434/0); Pester repo-integrity green.
 - **Green-clone-alone showed the Primary's taskbar icon**: the Start-menu
   `ZCode.lnk` had been hijacked with `dev.zcode.app.4` AND its icon field
   wiped (`,0`), so the shell resolved the clone's AUMID to an icon-less
@@ -32,8 +164,8 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ### Changed
 
 - **Launcher menus renumbered to continuous local ids**: each `GHOST.bat`
-  screen numbers its own tasks — Resets `[1]`–`[8]`, ZCode `[1]`–`[16]`
-  (5 launch + 5 reset + 6 sync/watchers), Maintenance `[1]`–`[2]` — with
+  screen numbers its own tasks — Resets `[1]`–`[8]`, ZCode `[1]`–`[17]`
+  (5 launch + 5 reset + 7 sync/watchers), Maintenance `[1]`–`[2]` — with
   per-screen resolvers (`:ZCodeOne` / `:MaintOne`) translating local ids to
   the unchanged global dispatch payloads. Chains typed inside a submenu use
   its local ids; `2 1 3 4` from the main menu opens ZCode and runs local
diff --git a/GHOST.bat b/GHOST.bat
index fd5d667..e8ccf57 100644
--- a/GHOST.bat
+++ b/GHOST.bat
@@ -13,9 +13,10 @@ cls
 call :Banner
 call :Hdr " ---- GHOST main menu ----"
 echo.
-call :Opt 1 "IDE Resets" "- device ID + 7 IDE suites"
+call :Opt 1 "IDE Resets" "- device ID + 8 IDE suites"
 if defined ESC (echo %ESC%[92m[ 2] %ESC%[97mZCode Multi-Instance ^& Clones %ESC%[90m- launchers, resets, sync%ESC%[0m) else echo [ 2] ZCode Multi-Instance ^& Clones - launchers, resets, sync
 if defined ESC (echo %ESC%[92m[ 3] %ESC%[97mSystem ^& GHOST Maintenance %ESC%[90m- shortcuts, watchers, updates%ESC%[0m) else echo [ 3] System ^& GHOST Maintenance - shortcuts, watchers, updates
+if defined ESC (echo %ESC%[92m[ 4] %ESC%[97mAutoClaw Multi-Instance ^& Clones %ESC%[90m- launchers, resets, port patch%ESC%[0m) else echo [ 4] AutoClaw Multi-Instance ^& Clones - launchers, resets, port patch
 echo.
 call :Opt U "Check for updates / update GHOST" "- from GitHub"
 call :Opt 0 "Exit" ""
@@ -24,6 +25,12 @@ echo.
 set "choice="
 set /p choice=%PROMPT_TEXT%
 if not defined choice goto MAIN
+call :ValidateChoice choice
+if errorlevel 1 (
+    echo   Invalid input - menu numbers only, separated by spaces or commas.
+    timeout /t 2 >nul
+    goto MAIN
+)
 if "%choice%"=="0" (
     echo Done.
     timeout /t 1 >nul
@@ -36,9 +43,6 @@ for /f "tokens=1,*" %%a in ("%chain%") do (
     set "first=%%a"
     set "rest=%%b"
 )
-if "%first%"=="1" if "%rest%"=="" goto RESETS
-if "%first%"=="2" if "%rest%"=="" goto ZCODE
-if "%first%"=="3" if "%rest%"=="" goto MAINT
 if "%first%"=="1" (
     set "PENDING_CHAIN=%rest%"
     goto RESETS
@@ -51,6 +55,10 @@ if "%first%"=="3" (
     set "PENDING_CHAIN=%rest%"
     goto MAINT
 )
+if "%first%"=="4" (
+    set "PENDING_CHAIN=%rest%"
+    goto AUTOCLAW
+)
 if /i "%first%"=="U" if "%rest%"=="" (
     call :Run "tools\update_ghost.ps1"
     goto MAIN
@@ -70,18 +78,24 @@ call :Opt 5 "Reset Qoder" ""
 call :Opt 6 "Reset QoderWork" ""
 call :Opt 7 "Reset ZCode Primary instance" ""
 call :Opt 8 "Reset MiniMax/OpenCode" ""
+call :Opt 9 "Reset AutoClaw" ""
 echo.
 call :Opt 0 "Back to Main Menu" ""
 echo.
 if not defined PENDING_CHAIN goto RESETS_PROMPT
-call :RunChain %PENDING_CHAIN%
+for %%t in (%PENDING_CHAIN%) do call :ResetsOne %%t
 set "PENDING_CHAIN="
 :RESETS_PROMPT
 set "choice="
 set /p choice=%PROMPT_TEXT%
 if not defined choice goto RESETS_PROMPT
+call :ValidateChoice choice
+if errorlevel 1 (
+    echo   Invalid input - menu numbers only, separated by spaces or commas.
+    goto RESETS_PROMPT
+)
 if "%choice%"=="0" goto MAIN
-call :RunChain %choice:,= %
+for %%t in (%choice:,= %) do call :ResetsOne %%t
 goto RESETS
 
 :ZCODE
@@ -120,6 +134,11 @@ set "PENDING_CHAIN="
 set "choice="
 set /p choice=%PROMPT_TEXT%
 if not defined choice goto ZCODE_PROMPT
+call :ValidateChoice choice
+if errorlevel 1 (
+    echo   Invalid input - menu numbers only, separated by spaces or commas.
+    goto ZCODE_PROMPT
+)
 if "%choice%"=="0" goto MAIN
 for %%t in (%choice:,= %) do call :ZCodeOne %%t
 goto ZCODE
@@ -140,16 +159,100 @@ set "PENDING_CHAIN="
 set "choice="
 set /p choice=%PROMPT_TEXT%
 if not defined choice goto MAINT_PROMPT
+call :ValidateChoice choice
+if errorlevel 1 (
+    echo   Invalid input - menu numbers only, separated by spaces or commas.
+    goto MAINT_PROMPT
+)
 if "%choice%"=="0" goto MAIN
 for %%t in (%choice:,= %) do call :MaintOne %%t
 goto MAINT
 
+:AUTOCLAW
+cls
+if defined ESC (echo %ESC%[96mGHOST / AutoClaw Multi-Instance ^& Clones%ESC%[0m) else echo GHOST / AutoClaw Multi-Instance ^& Clones
+echo.
+call :Div "Launch Clones"
+call :Opt 1 "Launch inst1" "- first clone (own profile, identity, ports)"
+call :Opt 2 "Install clone shortcuts" "- all 4 - Desktop + Start menu"
+call :Opt 3 "Launch inst2" ""
+call :Opt 4 "Launch inst3" ""
+call :Opt 5 "Launch ALL clones" "- inst1..inst4, one after another"
+echo.
+call :Div "Reset Clones"
+call :Opt 6 "Reset inst1" "(auto closes AutoClaw)"
+call :Opt 7 "Reset inst2" ""
+call :Opt 8 "Reset inst3" ""
+call :Opt 9 "Reset inst4" ""
+call :Opt 10 "Reset ALL instances" "- clones + Primary, independent IDs"
+echo.
+if defined ESC (echo %ESC%[90m  -- Maintenance --%ESC%[0m) else echo   -- Maintenance --
+call :Opt 11 "Apply MCP port patch - 8 slots" "(after app update; AutoClaw must be closed)"
+call :Opt 12 "Clone status" "- processes, actual ports, health"
+echo.
+call :Opt 0 "Back to Main Menu" ""
+echo.
+if not defined PENDING_CHAIN goto AUTOCLAW_PROMPT
+for %%t in (%PENDING_CHAIN%) do call :AutoClawOne %%t
+set "PENDING_CHAIN="
+:AUTOCLAW_PROMPT
+set "choice="
+set /p choice=%PROMPT_TEXT%
+if not defined choice goto AUTOCLAW_PROMPT
+call :ValidateChoice choice
+if errorlevel 1 (
+    echo   Invalid input - menu numbers only, separated by spaces or commas.
+    goto AUTOCLAW_PROMPT
+)
+if "%choice%"=="0" goto MAIN
+for %%t in (%choice:,= %) do call :AutoClawOne %%t
+goto AUTOCLAW
+
 :UnknownTask
 rem Red "not found" message for a bad task id (shared by all resolvers).
 if defined ESC echo %ESC%[91mUnknown task "%~1" - check the menu and try again.%ESC%[0m
 if not defined ESC echo Unknown task "%~1" - check the menu and try again.
 exit /b
 
+:ValidateChoice
+rem %1 = NAME of the variable holding raw user input. errorlevel 1 = reject.
+rem Allowlist: digits, spaces, commas, U/u - menu ids, chain separators and
+rem the update shortcut. Everything else (quotes, ampersands, parens, carets,
+rem percent signs, non-ASCII) is rejected BEFORE any expansion uses the value,
+rem so the unquoted %%chain%% / %%choice%% expansions downstream can never
+rem split tokens or inject commands (self-input hardening, 2026-10-17).
+rem The probe runs in an isolated delayed-expansion scope: !var! values are
+rem post-parse DATA, so hostile characters cannot break out of the probe
+rem itself. ('!' in the raw value vanishes inside the probe and is inert to
+rem %-expansion, so a value carrying it can safely pass the allowlist.)
+setlocal EnableDelayedExpansion EnableExtensions
+set "VC_VAL=!%~1!"
+if not defined VC_VAL ( endlocal & exit /b 1 )
+rem Space must be the LAST delim char (for /f splits option groups at spaces
+rem and commas - a mid-string space breaks the options parse). eol=; is the
+rem default and stays: a value starting with ';' skips the probe but ';' is
+rem inert to cmd expansion, so the residual risk is an Unknown-task token.
+for /f "eol=; delims=0123456789,Uu " %%z in ("!VC_VAL!") do ( endlocal & exit /b 1 )
+endlocal & exit /b 0
+
+:ResetsOne
+rem Resolves an IDE Resets submenu-local id to its global task id and runs it.
+rem Local ids 1-8 equal the global ids; [9] maps to gid 28 - gid 9 is the ZCode captcha watchdog.
+set "RESOLVED="
+if "%~1"=="1" set "RESOLVED=1"
+if "%~1"=="2" set "RESOLVED=2"
+if "%~1"=="3" set "RESOLVED=3"
+if "%~1"=="4" set "RESOLVED=4"
+if "%~1"=="5" set "RESOLVED=5"
+if "%~1"=="6" set "RESOLVED=6"
+if "%~1"=="7" set "RESOLVED=7"
+if "%~1"=="8" set "RESOLVED=8"
+if "%~1"=="9" set "RESOLVED=28"
+if not defined RESOLVED call :UnknownTask "%~1"
+if not defined RESOLVED exit /b
+call :DispatchOne %RESOLVED%
+exit /b
+
 :ZCodeOne
 rem Resolves a ZCode submenu-local id to its global task id and runs it.
 set "RESOLVED="
@@ -185,8 +288,28 @@ if not defined RESOLVED exit /b
 call :DispatchOne %RESOLVED%
 exit /b
 
+:AutoClawOne
+rem Resolves an AutoClaw submenu-local id to its global task id and runs it.
+set "RESOLVED="
+if "%~1"=="1"  set "RESOLVED=29"
+if "%~1"=="2"  set "RESOLVED=30"
+if "%~1"=="3"  set "RESOLVED=31"
+if "%~1"=="4"  set "RESOLVED=32"
+if "%~1"=="5"  set "RESOLVED=33"
+if "%~1"=="6"  set "RESOLVED=34"
+if "%~1"=="7"  set "RESOLVED=35"
+if "%~1"=="8"  set "RESOLVED=36"
+if "%~1"=="9"  set "RESOLVED=37"
+if "%~1"=="10" set "RESOLVED=38"
+if "%~1"=="11" set "RESOLVED=39"
+if "%~1"=="12" set "RESOLVED=40"
+if not defined RESOLVED call :UnknownTask "%~1"
+if not defined RESOLVED exit /b
+call :DispatchOne %RESOLVED%
+exit /b
+
 :DispatchOne
-rem Runs one task by global id (1-27). Unknown ids print an error. Returns to caller.
+rem Runs one task by global id (1-40). Unknown ids print an error. Returns to caller.
 if "%~1"=="1"  (call :Run "src\windows\change_device_id.ps1" & exit /b)
 if "%~1"=="2"  (call :Run "src\windows\reset_cursor.ps1" & exit /b)
 if "%~1"=="3"  (call :Run "src\windows\reset_devin.ps1" & exit /b)
@@ -224,6 +347,32 @@ if "%~1"=="24" (call :RunWith "tools\install_ghost_shortcut.ps1" "Check your Des
 if "%~1"=="25" (call :Detached "ZCode taskbar identity" "-NoProfile" "tools\watch_zcode_taskbar.ps1" "" "Taskbar identity watcher launched in a separate window - leave it open." "It re-stamps any ZCode window that loses its taskbar identity within seconds." & exit /b)
 if "%~1"=="26" (call :Run "tools\update_ghost.ps1" & exit /b)
 if "%~1"=="27" (call :Run "tools\diagnose_zcode_freeze.ps1" & exit /b)
+if "%~1"=="28" (call :Run "src\windows\reset_autoclaw.ps1" -Target Primary & exit /b)
+if "%~1"=="29" (call :Detached "AutoClaw inst1" "-NoProfile" "src\windows\launch_autoclaw_clone.ps1" "" "Launcher opened in a separate window - it closes automatically when done." & exit /b)
+if "%~1"=="30" (call :RunWith "tools\install_autoclaw_clone_shortcuts.ps1" "Look for the new AutoClaw inst1 - inst4 shortcuts on your Desktop and in the Start menu." & exit /b)
+if "%~1"=="31" (call :Detached "AutoClaw inst2" "-NoProfile" "src\windows\launch_autoclaw_clone.ps1" "-Instance inst2" "Launcher opened in a separate window - it closes automatically when done." & exit /b)
+if "%~1"=="32" (call :Detached "AutoClaw inst3" "-NoProfile" "src\windows\launch_autoclaw_clone.ps1" "-Instance inst3" "Launcher opened in a separate window - it closes automatically when done." & exit /b)
+if "%~1"=="33" (
+    call :StartClone "AutoClaw inst1" "src\windows\launch_autoclaw_clone.ps1"
+    timeout /t 3 /nobreak >nul
+    call :StartClone "AutoClaw inst2" "src\windows\launch_autoclaw_clone.ps1" "-Instance inst2"
+    timeout /t 3 /nobreak >nul
+    call :StartClone "AutoClaw inst3" "src\windows\launch_autoclaw_clone.ps1" "-Instance inst3"
+    timeout /t 3 /nobreak >nul
+    call :StartClone "AutoClaw inst4" "src\windows\launch_autoclaw_clone.ps1" "-Instance inst4"
+    echo Four launcher windows opened - each closes automatically when done.
+    echo First runs clone the Primary profile, so expect a short delay per clone.
+    echo Launch them one at a time the first time to log in once per clone.
+    pause
+    exit /b
+)
+if "%~1"=="34" (call :Run "src\windows\reset_autoclaw.ps1" -Target inst1 & exit /b)
+if "%~1"=="35" (call :Run "src\windows\reset_autoclaw.ps1" -Target inst2 & exit /b)
+if "%~1"=="36" (call :Run "src\windows\reset_autoclaw.ps1" -Target inst3 & exit /b)
+if "%~1"=="37" (call :Run "src\windows\reset_autoclaw.ps1" -Target inst4 & exit /b)
+if "%~1"=="38" (call :Run "src\windows\reset_autoclaw.ps1" -Target All & exit /b)
+if "%~1"=="39" (call :RunWith "tools\patch_autoclaw_ports.ps1" "Patch finished - if it reported AutoClaw.exe running, close ALL AutoClaw windows and run this option again." & exit /b)
+if "%~1"=="40" (call :Run "src\windows\launch_autoclaw_clone.ps1" -Status & exit /b)
 call :UnknownTask "%~1"
 exit /b
 
diff --git a/README.md b/README.md
index 0b00345..366ec6b 100644
--- a/README.md
+++ b/README.md
@@ -100,6 +100,8 @@ ghost/
 ├── ghost.sh        # Linux interactive launcher
 ├── src/
 │   ├── windows/    # .ps1 resetters (unversioned names) + identity_utils.ps1 + change_device_id.ps1
+│   │               #   + ZCode/AutoClaw clone launchers (launch_zcode_second_instance.ps1,
+│   │               #   launch_autoclaw_clone.ps1) + .bat wrappers
 │   ├── linux/      # .sh resetters + id_reset_common.sh
 │   └── python/     # stdlib-only Python core (ghost/) + ghost_cli.py bootstrap —
 │                   #   owns the shared SQLite/JSON identity logic
@@ -111,6 +113,11 @@ ghost/
 │                   #   install_ghost_shortcut.ps1 (GHOST.lnk), update_ghost.ps1
 │                   #   (repo self-updater), refresh_zcode_second_chats.ps1
 │                   #   (cross-instance chat refresh + -Watch error watcher),
+│                   #   diagnose_zcode_freeze.ps1 (read-only freeze diagnostic),
+│                   #   patch_autoclaw_ports.ps1 + .mjs (AutoClaw app.asar MCP
+│                   #   port-array patch 4 -> 8 slots — re-run after app updates),
+│                   #   install_autoclaw_clone_shortcuts.ps1 (AutoClaw clone
+│                   #   shortcuts), make_ghost_icon.ps1 (regenerates the launcher icon),
 │                   #   zcode-{blue,yellow,green}-branding/ (icon assets)
 ├── tests/          # Pester 5 suite (PowerShell) + stdlib unittest suite (Python core)
 ├── docs/           # getting-started / architecture / cli / troubleshooting / faq
@@ -140,6 +147,9 @@ libraries; the per-app scripts are thin target manifests on top. Details:
   — shows another instance's chats in a running sidebar without an app
   restart; `-Watch` runs as a daemon that auto-refreshes on quota/captcha
   failures
+- `tools/diagnose_zcode_freeze.ps1` — read-only freeze diagnostic: scans each
+  ZCode instance's logs + crash dumps for renderer-OOM / freeze events and
+  prints live RAM/commit pressure (`-Days N` widens the window)
 - `tools/watch_zcode_taskbar.ps1` — resident watcher that re-stamps every
   ZCode window's taskbar identity every 5 s (heals merges and fresh windows);
   `-InstallAutostart` adds a startup-folder shortcut, `-RunOnce` for testing
@@ -147,6 +157,17 @@ libraries; the per-app scripts are thin target manifests on top. Details:
   (Desktop + repo root) that carry the launcher icon; `-Remove` uninstalls
 - `tools/update_ghost.ps1` — repo self-updater: fetch + compare + guarded
   `git pull --ff-only` (`-CheckOnly` reports without writing)
+- **AutoClaw multi-instance** — `src/windows/launch_autoclaw_clone.ps1
+  -Instance inst1|inst2|inst3|inst4` launches independent clones (own profile,
+  identity, gateway port; first run seeds the Primary profile minus every
+  credential store — one manual login per clone), `-Status` reports processes,
+  actual bound ports and health. `src/windows/reset_autoclaw.ps1 -Target
+  Primary|inst1..4|All` rotates both device identities and deletes the live
+  operator credential. `tools/patch_autoclaw_ports.ps1` widens the installed
+  `app.asar`'s hardcoded 4-slot MCP port array to 8 (`-Restore` undoes it;
+  re-run after every AutoClaw app update). `tools/install_autoclaw_clone_shortcuts.ps1`
+  installs Desktop + Start-menu shortcuts (`-Remove`, `-RepairPrimaryAumid`).
+  Design + verified ground truth: [docs/AUTOCLAW_CLONES_SPEC.md](docs/AUTOCLAW_CLONES_SPEC.md)
 - Telegram alerts for `tools/watch_zcode_captcha.ps1` come from
   `-TelegramBotToken`/`-TelegramChatId` params or `TELEGRAM_BOT_TOKEN` /
   `TELEGRAM_CHAT_ID` in `.envlocal` (copy [.env.example](.env.example) to
diff --git a/docs/APP_CLONING_EDGE_CASES.md b/docs/APP_CLONING_EDGE_CASES.md
new file mode 100644
index 0000000..1bf3812
--- /dev/null
+++ b/docs/APP_CLONING_EDGE_CASES.md
@@ -0,0 +1,310 @@
+# App cloning edge cases — the normative catalog every clone suite must handle
+
+Date: 2026-10-15. Companion of [APP_CLONING_PLAYBOOK.md](APP_CLONING_PLAYBOOK.md)
+(the phase checklists reference these EC ids; the playbook §2 degradation
+rule and §8 report cite them).
+
+How to read each entry: **trigger → symptom → required handling** — then the
+automation level (**A** = built into the scripts, no human; **R** = re-run a
+menu entry; **D** = developer action) and **provenance** (verified date +
+app). Severity: **P0** = breaks the clone or corrupts identity; **P1** =
+breaks a feature; **P2** = cosmetic/annoyance. Distilled from the ZCode
+(2026-09) and AutoClaw (2026-10) suites — every rule is verified, none is
+theory.
+
+---
+
+## A. App updates & patches
+
+- **EC-A01 · P0 — App update overwrites `app.asar`** → every patch (icon /
+  AUMID / accent hooks, port-array widening) is silently reverted; clones
+  lose their look, inst4 loses its MCP port. **Handling:** the patch marker
+  carries `patchVersion`; the launcher/shortcuts warn when it is missing;
+  re-apply via the patch menu entry (ZCode [12] / AutoClaw [11]) after
+  EVERY app update. **A + R.** ZCode marker design; AutoClaw risk A2.
+- **EC-A02 · P0 — An in-clone built-in updater runs `quitAndInstall`** → it
+  wipes the SHARED patched asar mid-session for all instances. **Handling:**
+  `system.autoUpdate=false` forced into every clone's settings by both the
+  reset and the seed-scrub; an asar-level updater disable for clones where a
+  hook exists (ZCode's `updater-secondary` patch guards on the icon env var);
+  the Primary may keep updating. **A.** Verified 2026-09-24 (ZCode).
+- **EC-A03 · P2 — Patch engine version bumped after the marker was written**
+  → an old marker silently skips the new engine. **Handling:**
+  `marker.patchVersion < EngineVersion` triggers auto re-patch on the next
+  run; the ORIGINAL first-run backup is reused so `-Restore` never returns
+  to an intermediate patched state. **A.** ZCode engine v6→v7.
+- **EC-A04 · P1 — Corrupt / truncated asar swap** → a half-written asar
+  bricks the app. **Handling:** size floor (≥ half the original bytes)
+  before the swap; `.old` rollback on failure; `-Restore` uses a staged copy
+  so the backup stays intact. **A.** ZCode + AutoClaw patch wrappers.
+- **EC-A05 · P1 — The engine matches ZERO patch sites** (an update changed
+  the code shape) → silently patching nothing looks like success.
+  **Handling:** zero patch sites = exit 1 with the tree untouched;
+  idempotence anchors prevent double-application. **A.**
+- **EC-A06 · P1 — App running during the patch** → open handles corrupt the
+  swap. **Handling:** closed-app check scoped to that install dir before
+  starting. **A.**
+- **EC-A07 · P2 — Node missing for the `node --check` gate / keygen** →
+  **Handling:** functional probe (`--version` must report `v*`) of PATH
+  node, fallback to the app-bundled `resources\node\node.exe` (AutoClaw
+  ships one; ed25519 via node:crypto — PS 5.1 cannot generate it; PEM
+  shapes verified: SPKI 113, PKCS8 119 chars). **A.** Verified 2026-10-15.
+
+## B. Branding & icons
+
+- **EC-B01 · P1 — Icon files missing at clone time** → **Handling:** playbook
+  §5 decision tree — improvise tinted variants + report (default, 2026-10-15
+  developer decision) or stock-default + report the exact drop paths; the
+  clone NEVER fails or silently guesses over icons. **A + D.**
+- **EC-B02 · P1 — Icon env var set while the file is absent** → the app
+  shows a broken/blank icon. **Handling:** set the `ZCODE_ICON_DIR`-style
+  var ONLY when the icon files exist (launcher check); report the degraded
+  identity. **A.** Verified 2026-09-24 (ZCode).
+- **EC-B03 · P2 — Developer replaces placeholder icons later** → **Handling:**
+  drop the files at the reported paths → re-run the branding + shortcuts
+  menu entries (idempotent); never a re-clone. **R + D.**
+- **EC-B04 · P1 — Accent color unsupported by the app** (no recolor hook) →
+  **Handling:** degradation ladder — drop the accent, keep title/icon/AUMID;
+  report degraded. **A.**
+- **EC-B05 · P2 — Generated branding assets hand-edited** → **Handling:**
+  never hand-edit generated assets; the generator scripts own them (ZCode
+  `generate_branding.py` v3 pipeline; `assets/ghost.ico` rule). **R.**
+- **EC-B06 · P2 — Icon paths with spaces/brackets break quoting** →
+  **Handling:** quote `IconLocation "<path>,0"`; verify-after re-read every
+  lnk field. **A.**
+
+## C. Taskbar & window identity
+
+- **EC-C01 · P0 — Pinning a clone window (or Windows pin maintenance)
+  rewrites the Primary's .lnk** with a clone AUMID AND wipes its icon field
+  → when that clone later runs alone, the shell resolves its AUMID to the
+  icon-less Primary shortcut and falls back to the exe default icon.
+  **Handling:** `install_<app>_clone_shortcuts.ps1 -RepairPrimaryAumid`
+  (strip the suffix + restore `<exe>,0` across Desktop + both Start-menu
+  copies); the resident watcher re-checks every ~5m and auto-invokes the
+  repair on hijack detection. **R + A.** Verified 2026-09-28 (ZCode;
+  recurred ×3 on 09-24/26 — also AutoClaw, same rule).
+- **EC-C02 · P1 — Stale taskbar group/icon**: a re-stamped window keeps the
+  WRONG icon until the shell rebuilds the group — a plain stamp does not
+  rebuild a pre-grouped window's group. **Handling:** every stamp is a KICK
+  (brief `<aumid>.kick` identity → final) and first-seen windows get one
+  kick even when their store is already correct. **A.** Verified
+  2026-09-26 (ZCode green clone kept the Primary's icon).
+- **EC-C03 · P1 — Process-level AUMID unreliable per-instance**: clones
+  merge into one button despite a correct env block and a correct patched
+  `setAppUserModelId`. **Handling:** stamp the WINDOW property store (top
+  shell precedence) in the launcher; keep the process env as
+  belt-and-braces. **A.** Verified 2026-09-24 (ZCode Primary+Second).
+- **EC-C04 · P1 — Splash phase**: the window is titled plain "ZCode" while
+  resolving → a transient relauncher window or the wrong window eats the
+  stamp. **Handling:** resolve by the final branded title; wait loops
+  (60s resolve, 30s re-stamp on hwnd change); ambiguous titles skipped
+  loudly, never guessed. **A.** Verified 2026-09-24.
+- **EC-C05 · P0 — Title-only classification stamps a clone as Primary** when
+  it launches alone (its splash title matches the Primary row). **Handling:**
+  classify by PROCESS MARKERS first (roaming/home dir strings in the
+  command lines), titles only as a guarded fallback; a clone's branded
+  title overrides a spurious Primary marker read. **A.** Verified
+  2026-09-24 (ZCode green-clone default-icon bug).
+- **EC-C06 · P1 — The app sets its base AUMID unconditionally** → all
+  running windows share one taskbar button (AutoClaw v1). **Handling:**
+  documented degradation — shortcut AUMIDs still give distinct pins; v2
+  candidates (asar AUMID-suffix env hook or the extracted window stamp);
+  reported as degraded. **A + report.**
+- **EC-C07 · P2 — UIA cannot read Win10 taskbar buttons** (incl. the
+  vertical taskbar) → do not build verification on UIA; trust the watcher
+  logs. **A.** Verified 2026-09-26.
+- **EC-C08 · P1 — Launcher at LOWER integrity than the clone** → UIPI
+  silently blocks the window stamp. **Handling:** launcher must run at the
+  same or higher IL; FAIL with a hint when the stamp read-back mismatches;
+  never launch clones elevated (elevation also breaks drag-drop: UIPI
+  strips drop data into a high-IL window while the overlay still lights).
+  **A.** Verified 2026-09-24.
+- **EC-C09 · P1 — Reading a .lnk AUMID by UTF-16-decoding the file**
+  misaligns on odd byte offsets → false `<none>` conclusions. **Handling:**
+  read via `Shell.Application` `ExtendedProperty('System.AppUserModel.ID')`
+  ONLY. **A.** Verified 2026-09-26 (cost one wrong conclusion).
+
+## D. Launch & isolation
+
+- **EC-D01 · P2 — Relaunching a running clone** → the single-instance lock
+  focuses the existing window instead of a second copy (expected, not an
+  error). **Handling:** the launcher detects the running subtree, reports
+  "already running", exits 0. **A.**
+- **EC-D02 · P0 — The app overwrites `--user-data-dir`** via `app.setPath`
+  (ZCode) → the profile leaks into the Primary. **Handling:** env levers
+  FIRST (`ZCODE_DATA_BASE_DIR` / `ZCODE_DESKTOP_USER_DATA_DIR` /
+  `ZCODE_DESKTOP_SESSION_DATA_DIR` / `ZCODE_DESKTOP_HOME_DIR` / `HOME`);
+  `--user-data-dir` only as a second layer when honoured (AutoClaw honours
+  it). **A.** Verified 2026-09-23.
+- **EC-D03 · P0 — One credential used by two instances** → polling conflict
+  (Telegram HTTP 409) + random cross-account billing; `paired.json` admin
+  token duplication. **Handling:** one credential = one instance; the seed
+  EXCLUDES every credential store (`token-cache.json` excluded, not
+  scrubbed; `auth.json` tokens stripped keeping `userInfo`; the gateway
+  state tree never copied); verify-after-launch asserts own-key-only.
+  **A.** ZCode 2026-09-23; AutoClaw 2026-10-15.
+- **EC-D04 · P1 — An older seed had copied a now-excluded credential file**
+  → **Handling:** post-copy double-check deletes excluded files; a
+  marker-guarded one-time reconcile re-strips copied tokens (idempotent; a
+  deliberate later login is never reverted). **A.** Verified 2026-10-15.
+- **EC-D05 · P0 — Identity/session rows copied between homes** → dead
+  storage / cross-instance contamination. **Handling:** NEVER copy session
+  rows between homes (the ZCode shared CLI db lesson); cross-instance sync
+  is done by recycling the target's app-server, not by copying. **A.**
+- **EC-D06 · P1 — Primary config changed by a clone launch** → **Handling:**
+  hash the Primary's gateway config before launch, compare after; any
+  change = FAILED isolation breach. **A.** Verified 2026-10-15.
+
+## E. First-run seed
+
+- **EC-E01 · P1 — Primary running during the first seed** → robocopy fails
+  on locked leveldb/DBs (exit 9). **Handling:** wait ≤180s for the Primary
+  to close, then abort with an instruction; 3s settle for file-handle
+  release; later launches skip the gate entirely. **A + D.** Verified
+  2026-10-15.
+- **EC-E02 · P0 — Seed completion keyed on a profile file alone** → an
+  aborted robocopy's PARTIAL profile passed as seeded; the app launched on
+  inconsistent stores and died within seconds. **Handling:** the
+  `.autoclaw-seeded`-style marker is written ONLY after the full seed +
+  scrub verify; needsSeed keys on the marker; a partial profile is cleared
+  + re-seeded automatically. **A.** Verified 2026-10-15.
+- **EC-E03 · P1 — robocopy exit ≥ 8** → **Handling:** abort + remove the
+  partial profile; never proceed with a half-built seed. **A.**
+- **EC-E04 · P2 — SQLite `-shm`/`-wal` journals copied** → inconsistent
+  checkpoint. **Handling:** remove journals after the copy. **A.**
+
+## F. Resources
+
+- **EC-F01 · P0 — N Electron instances exhaust the Windows commit limit** →
+  renderer OOM death (`render-process-gone reason:"oom"`,
+  `v8-oom-last-os-error 1455` = ERROR_COMMITMENT_LIMIT); the window
+  "freezes" (drags dead) and the splash-then-close relaunch loop is the
+  post-crash quit path — NOT a hang or a lock. **Handling:** diagnose via
+  the freeze diagnostic (ZCode [17]); mitigation = larger pagefile / fewer
+  concurrent instances; relaunching after the quit is safe. **R + D.**
+  Verified 2026-09-25 (Primary+Second died the same second; JS heap only
+  ~478MB → OS commit starvation, not an app leak).
+- **EC-F02 · P2 — Port-array ceiling without the patch** → inst4 has no MCP
+  port; 3 clones is the cap. **Handling:** widen the array by patch; the
+  launcher warns when the patch marker is missing. **A + R.** Verified
+  2026-10-15 (AutoClaw).
+
+## G. Ports
+
+- **EC-G01 · P0 — Two instances silently SPLIT a hardcoded 4-slot
+  candidate-port array** → wrong-instance MCP routing with NO error
+  surfaced. **Handling:** widen the array by asar patch; space the
+  instances' preferred ports beyond the drift window (AutoClaw: 11 for a
+  +9 drift). **A.** Verified 2026-10-15.
+- **EC-G02 · P1 — Gateway port silently drifts +N when the preferred port
+  is busy** → recording the REQUESTED port lies. **Handling:** discover the
+  real listening ports by scanning expected..expected+drift against the
+  clone's OWN process subtree; health-check DISCOVERED ports; write
+  requested vs actual to `instance-record.json`. **A.** Verified
+  2026-10-15.
+- **EC-G03 · P2 — Instances grab the first free slots in start order** →
+  the expected table ≠ actual. **Handling:** `instance-record.json` is the
+  truth (`-Status` reads it); docs mark the table "EXPECTED only". **A.**
+
+## H. Scripting platform (PS 5.1 / .bat / Python)
+
+- **EC-H01 · P0 — PS 7-only syntax breaks on the shipping PS 5.1** →
+  **Handling:** `RandomNumberGenerator.Create().GetBytes()` (never
+  `.Fill()`); no ternary; never a variable named `$Input`;
+  `ConvertFrom-Json` returns PSCustomObject — normalize with
+  `ConvertTo-Hashtable`. **A.**
+- **EC-H02 · P0 — PS 5.1 default-encoding writes add a BOM** → corrupts
+  JSON/SQLite-adjacent files. **Handling:** no-BOM UTF-8 writes
+  everywhere. **A.**
+- **EC-H03 · P0 — Bare `(` `)` in an echo inside a parenthesized .bat
+  block** → CMD aborts the whole script silently, even inside double
+  quotes. **Handling:** reword or escape `^( ^)`. Verified via the
+  GHOST.bat [9] incident.
+- **EC-H04 · P1 — GUI apps calling `AttachConsole` hijack the launching
+  console** with log floods. **Handling:** launch detached
+  (`cmd /c start "" <exe>` / the `:Detached` helper), never inline.
+  Verified via the GHOST.bat [10] incident.
+- **EC-H05 · P1 — Unescaped `&` `|` in echo/labels** → **Handling:** escape
+  as `^&` `^|`. **A.**
+- **EC-H06 · P1 — Microsoft Store python stub passes a bare `Get-Command`**
+  → **Handling:** functional probe (`--version` exits 0 reporting Python 3;
+  the exit-9009 stubs and stale Python 2 must never pass); set
+  `[Console]::OutputEncoding = UTF8` before invoking. **A.**
+- **EC-H07 · P0 — SQL interpolation** → **Handling:** parameterized `?`
+  placeholders only; SQLite logic lives in `src/python/ghost` — never
+  re-embed Python in PS. **A.**
+- **EC-H08 · P2 — LF vs CRLF in edited .bat** → MSYS tools lie about
+  CRLF/stdin. **Handling:** edit .bat files through PowerShell-safe paths;
+  test via a stdin-free harness. **A.**
+
+## I. Windows shell & shortcuts
+
+- **EC-I01 · P1 — A .lnk cannot set env vars** → isolation must ride the
+  launcher. **Handling:** lnk target = `powershell -File launcher
+  -Instance X`. **A.**
+- **EC-I02 · P2 — Machine-wide shortcuts** collide between users →
+  **Handling:** per-user Desktop + Start Menu only; shortcut install needs
+  no admin. **A.**
+- **EC-I03 · P1 — The AUMID base poisoned by a prior hijack** → writing
+  clones on top stacks suffixes (`...inst1.inst2`). **Handling:** self-heal
+  the Primary base BEFORE writing clone AUMIDs. **A.**
+- **EC-I04 · P2 — Start-menu dedupe hides entries** when lnk AUMIDs
+  collide → **Handling:** distinct per-clone AUMIDs + EC-C01 repair. **A.**
+
+## J. Diagnostics, watchers, runtime
+
+- **EC-J01 · P1 — WMI race: fresh processes have an empty CommandLine** →
+  misclassification. **Handling:** empty CommandLine stays a candidate;
+  the subtree walk still classifies; never hard-fail on it. **A.**
+- **EC-J02 · P1 — A stale pre-mutex watcher copy** (its mutex name
+  differs) runs alongside the new one → **Handling:** named mutex PLUS a
+  startup process scan for the same script leaf name. **A.** Verified
+  2026-09-26.
+- **EC-J03 · P2 — The watcher console is closed** → resident work dies
+  silently. **Handling:** hidden autostart deployment; a self-titled
+  console ("<App> Taskbar Watcher (pid N)"); log rotation; a silent log
+  with healthy pass CPU is NORMAL (stores correct), not a zombie. **A.**
+  Verified 2026-09-26.
+- **EC-J04 · P1 — Refresh/watcher mutates state while an agent turn is in
+  flight** → **Handling:** hot-activity guard (db commit recency +
+  uncompleted assistant steps + running tools + app-server CPU sample, up
+  to ~90s, `-Force` bypasses; probe failure treated as hot). **A.**
+- **EC-J05 · P2 — Transient probe failures** (respawn timing, partial
+  JSONL lines) → **Handling:** verify-after loops with timeouts (30s
+  respawn, 45s verify) + cooldowns; tolerate partial-line tails. **A.**
+
+## K. Process classification & concurrency
+
+- **EC-K01 · P0 — `--type` filtering alone misclassifies helpers** →
+  **Handling:** classify mains by bare-exe CommandLine (quoted or unquoted
+  full path only); helpers/gateway children via a parent walk from
+  marker-matched mains. **A.**
+- **EC-K02 · P0 — Killing "all <App> processes" kills every clone** →
+  **Handling:** selective kill per target subtree; abort with a diagnostic
+  dump when 2+ mains run and none classify as a clone. **A.**
+- **EC-K03 · P2 — Concurrent agent sessions mutate state** (lnk hijacks,
+  live state changes) → **Handling:** trust the watcher STAMP logs over
+  ad-hoc probes; re-read state before concluding; hijack repair is
+  idempotent. **A.**
+
+## L. Repo gates & governance
+
+- **EC-L01 · P1 — repo-integrity Pester assertions**: any tracked text file
+  containing a `scripts/` + windows/linux path string fails CI; every
+  GHOST.bat-referenced .ps1 must exist; every `src/windows/*.ps1` must
+  literally appear in README.md. **Handling:** run the suite before
+  declaring done. **A.**
+- **EC-L02 · P0 — Editing out-of-scope files** (`identity_utils.ps1`,
+  `change_device_id.ps1`, `.context/`, `archive/`, `.git/`) → **Handling:**
+  do not modify; `archive/` scripts are never run and never committed.
+  **A.**
+- **EC-L03 · P1 — Unversioned script-name drift** (old `-vN` names in
+  docs) → **Handling:** scripts live unversioned under `src/`; README must
+  not match `reset_[a-z_]+_windows-v\d`. **A.**
+- **EC-L04 · P2 — Menu-reference drift after renumbering** → **Handling:**
+  cite menu positions as `<submenu> [n]` everywhere (e.g. `ZCode [12]`);
+  a renumber sweep stays mechanical only if the style is followed. **A.**
+- **EC-L05 · P1 — Secrets committed** (Telegram creds, tokens) →
+  **Handling:** gitignored `.envlocal` at the repo root; watchdogs read
+  params or `.envlocal`; never hardcode. **A.**
diff --git a/docs/APP_CLONING_INTAKE_TEMPLATE.md b/docs/APP_CLONING_INTAKE_TEMPLATE.md
new file mode 100644
index 0000000..f5f337d
--- /dev/null
+++ b/docs/APP_CLONING_INTAKE_TEMPLATE.md
@@ -0,0 +1,83 @@
+# App cloning intake template — fill this BEFORE cloning a new app
+
+Date: 2026-10-15. Companion of [APP_CLONING_PLAYBOOK.md](APP_CLONING_PLAYBOOK.md)
+(§3 defines which fields are Developer-supplied vs defaulted). Copy this
+file per clone request and fill it — or let the agent fill it from the
+documented defaults and report every default (playbook §8.3).
+
+---
+
+## App
+
+- App name / slug: `______` (slug = lowercase, no spaces — e.g. `zcode`,
+  `autoclaw`; used in every generated filename)
+- Exe path (blank = agent auto-detects from the installed app): `______`
+- Installed version: `______`
+- Electron app / asar patchable: `yes / no / unknown — agent verifies in
+  Phase 1`
+
+## Instances
+
+- Instance count (incl. Primary): `4` (default)
+- Roles + names: `Primary` + `______`, `______`, `______`
+  (defaults: ZCode-style `Second`/`Third`/`Fourth`, or AutoClaw-style
+  `inst1`..`inst4`; names are FROZEN once the first clone launches —
+  renaming dirs later orphans installed profiles)
+
+## Colors (Developer-specified; defaults offered otherwise)
+
+| Role | Accent hex | Notes |
+|---|---|---|
+| Primary | — stock, never recolored | |
+| `<role1>` | `#______` | default offered: `#066BCB` (blue) |
+| `<role2>` | `#______` | default offered: `#D4AA10` (yellow) |
+| `<role3>` | `#______` | default offered: `#13826A` (green) |
+
+## Icons (Developer-supplied files, or the policy below)
+
+Icon policy (playbook §5; default = improvise + report, decided
+2026-10-15):
+
+- [ ] **improvise + report** — the agent derives tinted variants from the
+      app's stock icon, wires them, and flags every generated file as
+      PLACEHOLDER with its path for later replacement
+- [ ] **stock-default + report** — every clone keeps the stock app icon;
+      the agent reports the exact drop paths + expected formats and waits
+
+Per-role icon files (fill only when supplying icons):
+
+| Role | Window icon (png/ico path) | Tray icon (ico path) |
+|---|---|---|
+| `<role1>` | `______` | `______` |
+| `<role2>` | `______` | `______` |
+| `<role3>` | `______` | `______` |
+
+Asset convention when supplied: `tools/<appslug>-<role>-branding/`
+(reference layout: `icon_windows.png` + `tray_icon.ico`).
+
+## Credentials
+
+- One credential = one instance enforced: `yes` (default)
+- Seed keeps `userInfo` only; strips tokens/refreshTokens/keypairs/paired
+  devices: `yes` (default)
+- App-specific stores to preserve or exclude beyond the default sweep:
+  `______`
+
+## Ports
+
+- Preferred base port(s) (blank = the agent picks, spaced beyond the
+  discovered drift window): `______`
+
+## Tooling
+
+- Taskbar identity: `full (window stamp + watcher) / shortcut-only
+  (degraded) / none` — default: full attempt, degrade + report
+- Watchers: taskbar `yes/no` (default yes for full suites); captcha-style
+  stall watchdog `yes/no` (default no)
+- GHOST.bat: `new submenu / extend an existing one` (default: agent
+  decides, reported)
+
+## Provenance line (filled by the agent after Phase 1)
+
+- Per-app spec doc: `docs/<APP>_CLONES_SPEC.md` — every ground-truth claim
+  cites the installed app's files/probes; no guesses.
diff --git a/docs/APP_CLONING_PLAYBOOK.md b/docs/APP_CLONING_PLAYBOOK.md
new file mode 100644
index 0000000..7652670
--- /dev/null
+++ b/docs/APP_CLONING_PLAYBOOK.md
@@ -0,0 +1,369 @@
+# App cloning playbook — the generic "clone any app into isolated instances" process
+
+Date: 2026-10-15. Status: **ACTIVE** — the standing process for every future
+clone request. Distilled from the two proven suites: **ZCode** (Primary +
+Second/Third/Fourth — the gold standard: full identity incl. per-clone
+taskbar buttons, tray icons and accent colors via the asar patch engine) and
+**AutoClaw** (Primary + inst1..inst4 — v1: full profile/credential/port
+isolation with a documented shared-taskbar-button limitation). Companions:
+[APP_CLONING_EDGE_CASES.md](APP_CLONING_EDGE_CASES.md) (the normative EC-xx
+catalog — its handling rules apply to every suite) and
+[APP_CLONING_INTAKE_TEMPLATE.md](APP_CLONING_INTAKE_TEMPLATE.md) (the
+per-request inputs).
+
+How to use: fill the intake form → follow the phases (§6) → consult the
+edge-case catalog at every phase → deliver the fixed report (§8).
+
+---
+
+## 1. Purpose and scope
+
+"Cloning an app" = turning one installed app into **N independent
+instances** (a Primary plus N−1 clones), each with:
+
+- its **own profile** — user-data/state dirs, env-isolated;
+- its **own machine identity** — telemetry IDs and device credentials,
+  never a copied identity (a verbatim profile copy is exactly the failure
+  class GHOST exists to eliminate);
+- its **own visual identity** — window title, accent color, window/tray
+  icon, taskbar button;
+- its **own tooling** — launcher, reset script, shortcuts, menu entries.
+
+Scope: Windows PowerShell (the repo's primary platform), desktop
+Electron-style apps first. Every app-specific fact MUST be verified against
+the **installed** app on this host — never inferred from upstream source,
+docs, or hope (the `AUTOCLAW_CLONES_SPEC.md` §5/§13 pattern: quoted
+decompiled code + live probes + provenance). Applies to any future app.
+
+## 2. The identity suite (required features per clone)
+
+| # | Feature | Class | Achieved via (reference suites) |
+|---|---|---|---|
+| 1 | Profile isolation (`home` / `profile` / `tmp` per clone) | MANDATORY | env levers (`USERPROFILE`/`HOME`/`TEMP`/`TMP`/`TMPDIR`, `ZCODE_DATA_BASE_DIR`-style); `--user-data-dir` only as a second layer when the app honours it |
+| 2 | Telemetry + device-identity rotation | MANDATORY | per-target ID sets in the reset script (`New-IdentitySet`); All-mode = clones first, Primary last; never duplicate an ID set |
+| 3 | Credential isolation (no shared tokens/keys/paired devices) | MANDATORY | seed EXCLUDES credential stores; strips tokens keeping `userInfo`; verify-after-launch own-key check |
+| 4 | Own launcher script + double-click shortcuts | MANDATORY | `launch_<app>_clone.ps1 -Instance <role>`; .lnk targets the launcher (a .lnk cannot set env vars) |
+| 5 | Own reset script (`-Target` per instance) | MANDATORY | backup → mutate → verify-after → audit → restore script; independent IDs per target |
+| 6 | Distinct window title ("App `<Color>`") | DEGRADABLE | patch hook (`ZCODE_INSTANCE_NAME` pattern) — strongly recommended: prevents the .lnk pin-collision class (EC-C01) |
+| 7 | Distinct taskbar button (AUMID + icon) | DEGRADABLE | full: window-level `System.AppUserModel.ID` stamp + kick + resident watcher (ZCode); degraded: shortcut AUMIDs only, running windows share one button (AutoClaw v1) |
+| 8 | Distinct tray icon | DEGRADABLE | patch hook reading an icon-dir env (`ZCODE_ICON_DIR` pattern) |
+| 9 | Distinct window icon | DEGRADABLE | same hook as [8] |
+| 10 | Per-clone accent color | DEGRADABLE | patch hook (`ZCODE_ACCENT_HEX` → renderer flags); needs in-app recolor points |
+
+**Degradation rule — never silently degrade.** A DEGRADABLE feature ships at
+the highest rung the app actually supports; the final report (§8) marks
+every instance full / degraded / absent with the reason and the EC id. A
+MANDATORY feature that is absent means the clone is NOT done.
+
+Degradation ladders:
+
+- Taskbar [7]: window stamp + watcher → shortcut-AUMID-only pins (running
+  windows merge — AutoClaw §5.8) → none.
+- Tray/window icon [8][9]: per-clone icon-dir hook → stock icon for all
+  clones (identity still distinct via title/accent) → report absent.
+- Accent [10]: in-app recolor → accent dropped, everything else kept.
+- Title [6]: in-app title hook → stock title (report degraded + the
+  pin-collision risk).
+
+## 3. Developer inputs contract (the ONLY developer touchpoints)
+
+Everything else is the agent's job (§4). The Developer supplies, via
+[APP_CLONING_INTAKE_TEMPLATE.md](APP_CLONING_INTAKE_TEMPLATE.md):
+
+1. App name/slug, instance count, role names.
+2. **Colors** — one accent hex per clone, Developer-specified (defaults
+   offered: the ZCode palette — Second blue `#066BCB`, Third yellow
+   `#D4AA10`, Fourth green `#13826A`). The Primary is never recolored.
+3. **Icons** — developer-supplied files per clone (paths), or the §5
+   policy applies.
+4. Credential policy (default: one credential = one instance; the seed
+   keeps `userInfo` only).
+5. Optional port base (otherwise the agent picks one with drift spacing).
+6. Watcher scope (default: taskbar watcher for full suites).
+
+Runtime touchpoints that cannot be automated:
+
+- **One manual login per clone** on first launch — never automated, never
+  cloned, never batched (ZCode Telegram 409 + AutoClaw `paired.json`
+  lessons, EC-D03).
+- **Close the Primary during the FIRST seed** — the launcher waits up to
+  180s then aborts (a live Chromium profile cannot be robocopied, EC-E01).
+- **UAC click** for self-elevating reset scripts.
+- **Final icons** if the agent generated placeholders (§5) — drop files at
+  the reported paths, re-run the branding/shortcuts menu entries.
+
+If the intake form arrives empty, the agent fills it from the documented
+defaults and **reports every default chosen** (§8.3).
+
+## 4. Automation contract
+
+The agent does WITHOUT asking (no per-step approval):
+
+- Phase 1 discovery + the per-app spec doc (`docs/<APP>_CLONES_SPEC.md`).
+- All scripts: reset / launcher / shortcuts / patch engine / watcher.
+- Branding generation per §5 — including placeholder generation.
+- GHOST.bat menu integration (new submenu or extension + resolver + gids).
+- Tests: parser parse-check on every `.ps1`, Pester suites green, PS 5.1
+  rules.
+- Docs: AGENTS.md section, CHANGELOG entry, docs/README.md index row.
+- The final report (§8).
+
+The agent must NOT:
+
+- auto-commit (Working preferences — leave everything uncommitted);
+- modify `identity_utils.ps1`, `change_device_id.ps1`, `.context/`,
+  `archive/`, `.git/` (Out of scope);
+- contradict AGENTS.md "Verified ground truth";
+- invent app facts — every constraint is verified from the installed app;
+- leave a silent-success path (never silent-success is mandatory).
+
+## 5. Icon & branding policy (Developer decision 2026-10-15)
+
+Asset convention: `tools/<appslug>-<role>-branding/` holding the icon files
+the app consumes. Reference: `tools/zcode-blue-branding/` =
+`icon_windows.png` + `tray_icon.ico` (+ the shared generator). The launcher
+copies branding into the clone home so the instance stays self-contained if
+the repo moves, and sets the icon env var **only when the files exist** (a
+set-but-absent path yields a broken icon — EC-B02).
+
+Decision tree when wiring clone icons:
+
+1. **Developer-supplied icons exist** → wire them (window + tray + shortcut
+   `IconLocation`), verify-after, report "developer icons used at `<paths>`".
+2. **Icons missing → DEFAULT branch: improvise + report.** Derive tinted
+   variants from the app's stock icon via the generator pipeline (reference:
+   `generate_branding.py --mask <hue> --out-dir` — emits `icon_windows.png`
+   + multi-size `tray_icon.ico` + the measured accent hex for the env var),
+   wire them, and flag every generated file as PLACEHOLDER in the report:
+   what was created, where, and that the Developer replaces them by dropping
+   real files at the same paths + re-running the branding and shortcuts
+   menu entries.
+3. **Generation infeasible** (no extractable stock icon, no pipeline) →
+   fall back to the stock app icon for every clone (identity stays distinct
+   via title/accent where hooks exist) and report the exact drop paths +
+   expected formats so the Developer can supply icons for a re-wire.
+4. **Replacement later is idempotent**: drop icons → re-run branding +
+   shortcuts installer. NEVER a re-clone, never a re-seed.
+
+Never: fail the clone over icons; silently guess; leave a broken
+`IconLocation` or a set-but-absent icon env path.
+
+## 6. Phases 0–10 (checklists)
+
+### Phase 0 — Intake
+
+- [ ] Fill/complete the intake form (developer values or documented defaults).
+- [ ] Record every default chosen for the report (§8.3).
+
+### Phase 1 — Discovery (read the INSTALLED app, never guess)
+
+- [ ] Install dir + exe path; app version; Electron version; asar patchable?
+      (asar-integrity fuse / integrity.json — AutoClaw: none, patchable).
+- [ ] Isolation levers: is `--user-data-dir` honoured? what follows
+      `os.homedir()` / `USERPROFILE`/`HOME`? app-specific env vars?
+- [ ] Single-instance lock: what keys it (profile dir? global?) → re-launch
+      semantics (focus vs second copy).
+- [ ] Update mechanism: built-in updater + its settings flag; does the app
+      bundle `resources\node\node.exe`?
+- [ ] Credential + identity store inventory: EVERY file holding
+      tokens/refreshTokens/deviceIds/keypairs/paired devices/updater IDs —
+      with what each holds (AutoClaw example: `auth.json.deviceId`,
+      `identity\device.json` ed25519, `devices\paired.json` admin token,
+      `token-cache.json`, `.updaterId`).
+- [ ] Ports: hardcoded candidate-port arrays (ceilings)? drift behavior
+      (`PORT_PROBE_RANGE`-style)?
+- [ ] Tray support; AUMID behavior (set unconditionally in the app?).
+- [ ] Output: `docs/<APP>_CLONES_SPEC.md` with §5-style verified ground
+      truth (quoted code / live probes), §9-style risks, §10-style
+      decisions, §13-style provenance. No "probably" — every claim cites
+      evidence.
+
+### Phase 2 — Isolation design
+
+- [ ] FROZEN layout under
+      `%USERPROFILE%\<App>CloneHome\<inst>\{home,profile,tmp}` (+ per-clone
+      roaming dirs if the app uses %APPDATA%). Names frozen from day one —
+      renaming dirs later orphans installed profiles (ZCode Second rule).
+      Primary paths recorded, never written by clone scripts.
+- [ ] Env levers FIRST; CLI flags only as a second layer (ZCode overwrites
+      `--user-data-dir` via `app.setPath` — EC-D02).
+- [ ] Port plan table: per-instance preferred ports spaced beyond the drift
+      window (AutoClaw: spacing 11 for a +9 drift), widened by patch if the
+      app hardcodes a candidate array.
+
+### Phase 3 — Reset script (`src/windows/reset_<app>.ps1`)
+
+- [ ] Mirror the repo pattern: dot-source `identity_utils.ps1` →
+      `Assert-Administrator` → per-target steps → audit → restore script →
+      summary (exit 1 on any failure). `#Requires -Version 5.1` in the
+      first 3 lines.
+- [ ] `-Target Primary|<roles>|All` (+ `-DryRun`); All = clones first,
+      Primary last; **independent ID sets per target — never duplicate**.
+- [ ] Every step: backup → mutate → no-BOM write → verify-after re-read →
+      audit entry. Credential stores: backup → delete → verify-absent.
+- [ ] Generated keys verified by shape (ed25519 PEM lengths via node:crypto;
+      node = functional probe → app-bundled fallback).
+- [ ] Selective kill per target subtree (process markers); abort with a
+      diagnostic dump when classification is ambiguous.
+- [ ] Result channel file for the non-elevated parent; self-elevation
+      forwards the target args.
+
+### Phase 4 — Launcher (`src/windows/launch_<app>_clone.ps1`)
+
+- [ ] `-Instance <role>` + `-Status`; already-running clone → report +
+      exit 0 (single-instance focus).
+- [ ] First-run seed: gated on a completion marker ONLY (never on a profile
+      file — EC-E02); Primary-closed wait ≤180s then abort; robocopy with
+      credential/cache/lock exclusions; post-copy re-checks; seed-scrub
+      with verify-after (identity rotation, token strip keeping `userInfo`,
+      `autoUpdate=false`); marker written ONLY after full verify; a partial
+      profile is cleared + re-seeded.
+- [ ] Launch: detached (`cmd /c start`), sequential, never elevated;
+      per-instance env block.
+- [ ] Port discovery: scan expected range + drift window against the
+      clone's own subtree; health-check DISCOVERED ports (never the
+      requested); write `instance-record.json` (requested vs actual) +
+      re-read verify.
+- [ ] Verify-after-launch: subtree appears ≤30s and is stable 5s; gateway /
+      health pass; own-credentials-only check (foreign key = FAILED);
+      Primary config hash unchanged (change = FAILED isolation breach).
+      Missing MCP port = WARN (patch likely reverted — EC-A01/EC-F02).
+
+### Phase 5 — Branding (per §5 policy)
+
+- [ ] Generate/obtain per-clone icons + accent + title; wire via the patch
+      hooks; copy branding into the clone home.
+- [ ] Icon env var set only when files exist; shortcut `IconLocation`
+      `"<icon>,0"` quoted + verify-after re-read.
+
+### Phase 6 — App patch (`tools/patch_<app>_<concern>.ps1` + `.mjs` engine)
+
+- [ ] Text-transform engine + ps1 wrapper: backup → `npx @electron/asar`
+      extract → transform (idempotence anchors; zero patch sites = exit 1
+      with the tree untouched) → `node --check` every patched
+      .js/.cjs/.mjs → repack → verify markers inside the packed candidate
+      (`extract-file`) → swap with size floor + `.old` rollback → marker
+      json `{patchVersion, backupDir, patchedFiles}`.
+- [ ] `-Restore` = staged copy of the newest backup (the backup itself
+      stays intact), marker removed; the ORIGINAL first-run backup is
+      reused so a restore never returns to an intermediate patched state.
+- [ ] Updater guard: `system.autoUpdate=false` on every clone (reset +
+      seed-scrub) + an asar-level disable for clones where a hook exists —
+      an in-app `quitAndInstall` wipes the shared patch (EC-A02).
+- [ ] App closed (check scoped to that install dir); re-apply after any
+      app update (the marker `patchVersion` gate makes the menu entry
+      auto-upgrade an old marker).
+
+### Phase 7 — Shortcuts (`tools/install_<app>_clone_shortcuts.ps1`)
+
+- [ ] Per-user Desktop + Start Menu .lnk per clone; params `-Instance`,
+      `-Remove`, `-DesktopOnly`, `-StartMenuOnly`, `-SkipAumid`,
+      `-RepairPrimaryAumid`.
+- [ ] .lnk target = the launcher with `-Instance` (a .lnk cannot set env
+      vars).
+- [ ] AUMID = `<base>.<suffix>` written via IPropertyStore (PROPERTYKEY
+      `9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3` pid 5); base read from the
+      Primary .lnk when present; **read AUMIDs ONLY via `Shell.Application`
+      `ExtendedProperty('System.AppUserModel.ID')`** (EC-C09).
+- [ ] Self-heal the Primary base BEFORE writing clone AUMIDs (a poisoned
+      base stacks suffixes — EC-I03). Every lnk field write re-read +
+      compared.
+
+### Phase 8 — Taskbar identity
+
+- [ ] Full (ZCode reference): launcher window-level
+      `System.AppUserModel.ID` stamping — resolve by title (survives the
+      splash swap), re-stamp on hwnd change, independent final verify,
+      then KICK (brief `<aumid>.kick` → final; a stale group keeps the
+      wrong icon — EC-C02); resident watcher every 5s (process-marker
+      classification first — EC-C05; named mutex + startup process-scan
+      single-copy; ~5m hijack self-heal; autostart lnk; self-titled
+      console; log at `%LOCALAPPDATA%\watch-<app>-taskbar\` with rotation).
+- [ ] Degraded (AutoClaw v1): shortcut-AUMID-only + the shared-button
+      limitation documented in the spec + report + v2 candidates listed
+      (asar AUMID-suffix env hook, or extracting the ZCode window-stamp
+      helper).
+- [ ] Never elevated; the launcher must run at the same or higher
+      integrity level than the clone (UIPI — EC-C08).
+
+### Phase 9 — GHOST.bat menu integration
+
+- [ ] New submenu (or extend the app's existing one) with section dividers
+      — Launch Clones / Reset Clones / Maintenance — via `:Div` + `:Opt`.
+- [ ] Per-submenu resolver `:<App>One` (local ids → gids) + new
+      `:DispatchOne` cases (next free gid block).
+- [ ] Landmines: no bare `(` `)` in echo inside parenthesized blocks; escape
+      `^&` `^|`; GUI `AttachConsole` apps + long-running watchers via
+      `:Detached`; launch-ALL entries stagger with `timeout /t 3`.
+- [ ] repo-integrity: every `-File "...ps1"` referenced from GHOST.bat must
+      exist on disk.
+
+### Phase 10 — Tests, docs, governance
+
+- [ ] `[System.Management.Automation.Language.Parser]::ParseFile` zero
+      errors on every `.ps1`; `#Requires -Version 5.1` in the first 3
+      lines; Pester green (repo-integrity + any new tests); PS 5.1 rules
+      (no ternary, no `$Input`, `RandomNumberGenerator.Create().GetBytes()`).
+- [ ] repo-integrity constraints: no `scripts/` + windows/linux path
+      strings in any tracked text file; every new `src/windows/*.ps1`
+      literally listed in README.md.
+- [ ] AGENTS.md: Architecture entry for the new scripts + a Multi-instance
+      conventions section (mirror ZCode/AutoClaw) — verified ground truth
+      only, dated.
+- [ ] CHANGELOG `[Unreleased]` Added entry; docs/README.md index row; the
+      per-app spec linked from it.
+- [ ] Leave everything UNCOMMITTED for Developer review.
+
+## 7. File inventory (what a completed clone suite creates)
+
+```
+docs/<APP>_CLONES_SPEC.md                       # Phase 1 output (ground truth + provenance)
+src/windows/reset_<app>.ps1                     # Phase 3
+src/windows/launch_<app>_clone.ps1              # Phase 4 (+ -Status)
+src/windows/Launch-<App>-Clone.bat              # optional double-click wrapper
+tools/patch_<app>_<concern>.ps1 + .mjs          # Phase 6 (only if asar surgery is needed)
+tools/install_<app>_clone_shortcuts.ps1         # Phase 7 (+ -RepairPrimaryAumid)
+tools/watch_<app>_taskbar.ps1                   # Phase 8 full (else omitted; degraded reported)
+tools/<appslug>-<role>-branding/                # Phase 5 assets + generator
+GHOST.bat                                       # Phase 9 submenu + resolver + gids
+AGENTS.md / CHANGELOG.md / docs/README.md       # Phase 10 governance rows
+```
+
+Runtime artifacts (created by the scripts, never committed): clone homes
+under `%USERPROFILE%\<App>CloneHome\`, per-clone `instance-record.json`,
+patch markers under the app's `resources\`, `ID_Backups\<ts>` per target,
+watcher logs under `%LOCALAPPDATA%\watch-<app>-taskbar\`.
+
+## 8. Final report format (mandatory, fixed sections)
+
+1. **Feature matrix** — per instance, every §2 feature: full / degraded /
+   absent + a one-line reason (degradations cite the EC id).
+2. **Built** — files created/modified, menu entries added, patch version
+   applied, marker paths.
+3. **Autonomous decisions** — intake defaults used, the §5 icon branch
+   taken and what was generated where, the port plan, naming, everything
+   the Developer did not specify.
+4. **Developer touchpoints pending** — one login per clone, the
+   close-Primary window for the first seed, placeholder icons to replace
+   (exact paths), elevation-required steps.
+5. **Verification evidence** — parse results, Pester, live verify-after
+   outputs (what was actually re-read and compared).
+6. **Known limitations + v2 candidates.**
+
+## 9. Provenance
+
+This playbook distills verified work, not theory:
+
+- **ZCode suite** (2026-09-23 → 09-28): env-only isolation (the CLI `~`
+  lesson), asar patch engine v7 (icon/tray/accent/title/AUMID-suffix env
+  hooks), window-level stamping + kick + resident watcher, Primary .lnk
+  hijack repair, splash-phase misclassification fix, renderer-OOM
+  commit-limit diagnosis, Telegram 409 routing rule. Ground truth:
+  AGENTS.md "Multi-instance conventions (ZCode: Primary + 3 clones)".
+- **AutoClaw suite** (2026-10-08 → 10-15): the installed-app discovery
+  method (quoted decompiled code + live probes), credential-free seed +
+  marker guards, port-array widening + drift discovery,
+  `instance-record.json`, the Primary-hash isolation-breach check. Ground
+  truth: [AUTOCLAW_CLONES_SPEC.md](AUTOCLAW_CLONES_SPEC.md) §5/§13.
+- Edge-case handling rules:
+  [APP_CLONING_EDGE_CASES.md](APP_CLONING_EDGE_CASES.md).
diff --git a/docs/AUTOCLAW_CLONES_SPEC.md b/docs/AUTOCLAW_CLONES_SPEC.md
new file mode 100644
index 0000000..93e32eb
--- /dev/null
+++ b/docs/AUTOCLAW_CLONES_SPEC.md
@@ -0,0 +1,513 @@
+# AutoClaw multi-instance clones — design spec
+
+Status: **IMPLEMENTED** — shipped 2026-10-15 (see CHANGELOG); §7's proposals
+were extended in places by the shipped scripts (a 7-step reset vs the 6
+targets listed, expanded seed exclusions, marker-keyed seed completion).
+Decisions Q1–Q3 resolved 2026-10-08 (see §10).
+Project: GHOST (`unban-machine-id`) · Target app: `C:\Program Files\AutoClaw\AutoClaw.exe`
+Target app profile: Electron 33.4.11, `APP_VERSION 0.1.13`, `launch.json` version `1.17.8`
+
+This is a GHOST **spec-first** document: the design was written first, then
+implemented (`src/windows/launch_autoclaw_clone.ps1`,
+`src/windows/reset_autoclaw.ps1`, `tools/patch_autoclaw_ports.ps1`,
+`tools/install_autoclaw_clone_shortcuts.ps1`). Every constraint quoted below was read out of the installed `AutoClaw.exe` on this host,
+not inferred — see §13 for provenance.
+
+---
+
+## 1. Problem
+
+AutoClaw is a single-instance Electron app. We want **4 independent AutoClaw instances** running
+side by side on this host, each with its own profile, its own agent state, its own gateway process
+and its own ports — and each clone carrying **its own machine identity** rather than a copied
+identity.
+
+That second half is not a nice-to-have. A verbatim profile copy produces N instances presenting one
+`deviceId` to AutoClaw's backend, which is exactly the failure class this repo exists to eliminate
+(§4).
+
+## 2. Relationship to the existing ZCode work
+
+GHOST already runs four instances of another app: ZCode Primary + Second/Third/Fourth, via
+`src/windows/launch_zcode_second_instance.ps1 -Instance Second|Third|Fourth`. That script is the
+direct precedent for §6b and the template for §7's design. The two problems have the same shape:
+
+| | ZCode | AutoClaw (this spec) |
+|---|---|---|
+| Instances | Primary + 3 clones | primary + 3 clones + 1 reserved |
+| Isolation lever | env vars (`ZCODE_DATA_BASE_DIR`, `HOME`, …) | env vars (`USERPROFILE`, `HOME`, `AUTOCLAW_GATEWAY_PORT`, …) |
+| Why not CLI flags only | app overwrites `--user-data-dir` via `app.setPath` | app honours `--user-data-dir` (§5.2) |
+| Per-clone identity | seed-scrub rotates cloned IDs after copy | same pattern, different files (§8) |
+| Ports | none needed | **hard blocker — 4-slot array (§5.1)** |
+
+Two GHOST ground-truth rules are load-bearing here and are *not* restated in `AGENTS.md`'s ZCode
+section in this form:
+
+1. **Never copy identity or session rows between homes.** `AGENTS.md` already says this for ZCode
+   ("a clone's own `db.sqlite` copy is dead storage nothing reads"). §8 applies it to AutoClaw.
+2. **One credential = one instance.** The ZCode Telegram rule ("one Telegram bot token = ONE polling
+   instance" → HTTP 409 + cross-account billing) is the precedent for the AutoClaw rules in §8.
+
+## 3. Naming and layout
+
+Numbered, per Q3.
+
+```
+%USERPROFILE%\AutoClawCloneHome\          <- isolated home root (NOT inside the repo)
+├── inst1\
+│   ├── home\     USERPROFILE/HOME for this instance
+│   │   └── .openclaw-autoclaw\          per-instance agent state, logs, config
+│   ├── profile\  --user-data-dir target (Electron profile)
+│   └── tmp\      TMPDIR/TEMP/TMP (gateway lock files, temp output)
+├── inst2\ … inst3\ … inst4\
+
+%USERPROFILE%\.openclaw-autoclaw\         <- the PRIMARY. Never touched by any script here.
+```
+
+Instance homes live under `%USERPROFILE%`, not inside the repo, because `AGENTS.md` treats the repo
+as scripts+docs while runtime state is per-user. This mirrors the ZCode clones
+(`%USERPROFILE%\ZCodeSecondHome`).
+
+Inst4's layout is generated so that starting it is a one-liner once the port patch in §5.1 is
+applied.
+
+## 4. Why identity rotation is mandatory (the R1 problem, solved properly)
+
+An earlier standalone draft of this spec flagged shared credentials as risk R1 and proposed seeding
+the primary's `auth.json` into every clone, accepting the risk. **Inside GHOST that answer is wrong.**
+A verbatim profile copy is the anti-pattern this repo was built to prevent.
+
+AutoClaw keeps **two independent device identities** on this host, and they are *not* the same value:
+
+| Identity | File | Value on this host (abbrev.) |
+|---|---|---|
+| Electron device id | `%APPDATA%\AutoClaw\auth.json` → `deviceId` | `b786a56d…` |
+| Gateway device identity | `~/.openclaw-autoclaw\identity\device.json` → `deviceId` | `f8c0f1b1…` |
+
+Plus a third artifact that is effectively a **live operator credential**:
+`~/.openclaw-autoclaw\devices\paired.json` holds an `operator` token (`yf-qSmX-…`, rotated
+`1791452988000`) granting `operator.admin` / `operator.approvals` / `operator.pairing`.
+
+If all instances share these:
+
+- the backend sees one device with N concurrent sessions;
+- `paired.json`'s operator token is duplicated — a real admin-scoped credential;
+- concurrent `token`/`refreshToken` rotation can sign siblings out.
+
+GHOST's answer, applied per clone: **seed** the profile (so the clone starts with the user's chats
+and projects), then **scrub** — rotate every identity-bearing value while keeping the history, and
+never carry a live credential across.
+
+## 5. Verified ground truth (do not contradict these)
+
+### 5.1 The MCP port is a hardcoded 4-slot array — the scope blocker
+
+```js
+const PRODUCTIVITY_MCP_CANDIDATE_PORTS = [19681, 19682, 19683, 19684];
+const PRODUCTIVITY_MCP_PATH = "/mcp";
+const PRODUCTIVITY_MCP_HEALTH_PATH = "/health";
+const GITHUB_MCP_BRIDGE_PATH = "/github/mcp";
+const FIGMA_MCP_BRIDGE_PATH = "/figma/mcp";
+```
+
+The bind loop, in the Electron **main** process:
+
+```js
+for (const candidatePort of PRODUCTIVITY_MCP_CANDIDATE_PORTS) {
+  const boundPort = await new Promise((resolve2, reject) => {
+    const server2 = app.listen(candidatePort, PRODUCTIVITY_MCP_HOST, () => resolve2(candidatePort));
+    server2.once("error", () => { server2.close(); reject(error); });
+    server2.once("listening", () => { httpServer = server2; });
+  });
+  setProductivityMcpActivePort(boundPort);
+}
+```
+
+Consequences, all confirmed empirically:
+
+- The MCP server is bound by the **main** process — one port per Electron instance — and cannot be
+  moved by config, env or CLI.
+- Exactly **4 slots**. A fifth instance has nowhere to bind. Four is this build's ceiling.
+- The bind is a *fallback loop*, not a conflict: two instances do not fail, they **silently split**
+  across slots. A client URL pinned to `…:19681/mcp` then points at whichever instance won the lower
+  slot — wrong-instance routing, not a clean error.
+- On this host `AutoClaw.exe` PID 13336 currently holds 19681.
+
+**Resolution:** patch the installed `app.asar` to widen the array to 8 slots (§7.3). Precedent: this
+repo already ships `tools/patch_zcode_icon_override.ps1` (engine v7), which patches the *installed*
+ZCode `app.asar` in place, writes a marker file carrying `patchVersion`, supports `-Restore`, and
+warns that an app update silently reverts it. The AutoClaw port patcher follows that shape exactly.
+
+### 5.2 `--user-data-dir` is honoured (differs from ZCode)
+
+```js
+const allowParallelE2eInstance = isDev && process.env.AUTOCLAW_E2E_ALLOW_PARALLEL_INSTANCE === "1";
+const gotSingleInstanceLock = allowParallelE2eInstance || app.requestSingleInstanceLock();
+```
+
+`requestSingleInstanceLock()` keys off the profile dir. Verified live: launching
+`AutoClaw.exe --user-data-dir=<fresh dir>` alongside the running primary produced a fully separate
+profile (`auth.json` with only `deviceId`, a fresh `settings.json`, its own `logs\`) and left the
+primary's 19681 untouched. **No single-instance patch is needed** — unlike ZCode, which overwrites
+the flag via `app.setPath`.
+
+### 5.3 Agent state moves only via the home directory
+
+The Electron main process sets the gateway's state dir from `os.homedir()`:
+
+```js
+const OPENCLAW_PROFILE = "autoclaw";
+const OPENCLAW_HOME_DIR = `.openclaw-${OPENCLAW_PROFILE}`;
+…
+OPENCLAW_STATE_DIR: openclawStateDir,     // join(os.homedir(), ".openclaw-autoclaw")
+OPENCLAW_CONFIG_PATH: runtimeConfigPath,
+```
+
+The gateway re-derives it from `homedir()` in several places. Verified: `node -e "os.homedir()"`
+honours `USERPROFILE` or `HOME`. So per-instance `USERPROFILE` + `HOME` moves the entire state tree
+in one move — `logs\`, `agents\*\sessions`, `openclaw.json`, `openclaw.runtime.json`,
+`session-goals.json`, `expert-sop-last-known-good.json`, `.compile-cache`, `.hermes-runtime-receipts`.
+
+> **CORRECTED 2026-10-16 (live-verified): this section's env-var lever DOES NOT WORK.** Two
+> reasons, discovered during the first real clone launch: (1) the app's main resolves the state
+> dir via `app.getPath("home")` / the Windows profile API — env-immune; the `node -e` check above
+> only proved plain node honours the env, not the Electron main; (2) AutoClaw.exe's manifest
+> declares `requireAdministrator`, so every launch self-elevates and the elevated process gets a
+> FRESH ENVIRONMENT — even the env the launcher set is gone. Working mechanism:
+> `tools/patch_autoclaw_ports.ps1` engine v10 (`home-override`) redirects the resolver to
+> `<userData>\.autoclaw-home` (a marker file the launcher writes; `--user-data-dir` is an
+> argument and survives elevation). See AGENTS.md "ELEVATION" bullet.
+
+### 5.4 Gateway lock files are keyed by config path — no collision
+
+```js
+function resolveGatewayLockDir() { … return path.join(os.tmpdir(), suffix); }
+function resolveGatewayLockPath(env, lockDir = resolveGatewayLockDir()) {
+  const configPath = resolveConfigPath(env, resolveStateDir(env));
+  const hash = createHash("sha256").update(configPath).digest("hex").slice(0, 8);
+  return { lockPath: path.join(lockDir, `gateway.${hash}.lock`), configPath };
+}
+```
+
+The lock name hashes the **config path**, so per-instance config paths yield per-instance lock files
+inside the shared `%TEMP%\openclaw`. No `OPENCLAW_ALLOW_MULTI_GATEWAY=1` needed — and that flag is
+test-only anyway (gated on `VITEST` / `NODE_ENV=test`); using it would mask a real lock conflict
+instead of verifying there isn't one (§11).
+
+### 5.5 The gateway port is overridable, but auto-shifts
+
+```js
+const GATEWAY_DEFAULT_PORT = 18789;
+function getPreferredPort() {
+  const envPort = Number.parseInt(process.env.AUTOCLAW_GATEWAY_PORT || "", 10);
+  if (Number.isInteger(envPort) && envPort > 0 && envPort < 65536) return envPort;
+  try { const p = getSettings().gateway?.port; … } catch {}
+  return GATEWAY_DEFAULT_PORT;
+}
+const PORT_PROBE_RANGE = 10;     // findNextFreePort scans startPort..startPort+9
+```
+
+`AUTOCLAW_GATEWAY_PORT` is the supported override, read from `process.env` of the main process, so it
+is settable per instance. But a busy preferred port **silently shifts up to +9**, so the bound port
+must be **read back after start** and recorded — never assumed. This is the most important
+verify-after-write rule in the spec: recording the requested port as the actual one is exactly the
+silent-success `AGENTS.md` forbids.
+
+### 5.6 `OPENCLAW_PROFILE` is not the lever
+
+The gateway accepts `--profile <name>`, isolating under `~/.openclaw-<name>`. Tempting, but it also
+renames the workspace (`workspace-<profile>`), lock names and log filenames. Given
+`USERPROFILE`/`HOME` already isolates completely (§5.3), renaming gains nothing and costs a
+behavioural delta. Not used.
+
+### 5.7 Everything is loopback-only
+
+`PRODUCTIVITY_MCP_HOST = "127.0.0.1"`; gateway client default `ws://127.0.0.1:18789`. Four instances
+add no new network exposure.
+
+### 5.8 All instances declare one AUMID today
+
+```js
+app.setAppUserModelId("com.zhipuai.autoclaw");
+```
+
+Unconditional, in every instance. So all four windows share a taskbar button and pin identity out of
+the box. §7.3c records this as a known v1 limitation.
+
+## 6. Port plan
+
+Primary untouched. Spacing is **11**, not 10, because each instance may silently shift +9 (§5.5) and
+a 10-gap would let a neighbour's window overlap the next instance's preferred port.
+
+| Instance | MCP port | Gateway requested | Possible window | Env var |
+|---|---|---|---|---|
+| primary | 19681 | 18789 | 18789–18798 | (none) |
+| inst1 | 19682 | 18799 | 18799–18808 | `AUTOCLAW_GATEWAY_PORT=18799` |
+| inst2 | 19683 | 18810 | 18810–18819 | `AUTOCLAW_GATEWAY_PORT=18810` |
+| inst3 | 19684 | 18821 | 18821–18830 | `AUTOCLAW_GATEWAY_PORT=18821` |
+| inst4 | 19685 | 18832 | 18832–18841 | `AUTOCLAW_GATEWAY_PORT=18832` |
+
+inst4's MCP port 19685 exists only because of the §5.1 patch. Without the patch, inst1–inst3 are the
+maximum and inst4 has no port at all.
+
+## 6b. Multi-instance conventions (proposed, mirroring AGENTS.md's ZCode section)
+
+- Layout is **FROZEN**: `AutoClawCloneHome\inst1..inst4`, never renamed. An installed clone profile
+  must keep working across an app update.
+- Isolation lever is **env vars**. `--user-data-dir` is a *second* belt-and-braces layer because this
+  app honours it (§5.2), not the primary mechanism.
+- One `auth.json` credential = ONE instance. Never seed a clone with the primary's live
+  `token`/`refreshToken`; never copy `devices/paired.json`.
+- Classify mains by **process markers** (the clone's `--user-data-dir` string appears in the child's
+  command line), not by window title — the ZCode lesson applies verbatim: title-only classification
+  misclassifies splash-phase windows.
+- Launch instances **sequentially**, never in parallel.
+- Never run instances elevated (AGENTS.md ZCode rule; UIPI strips drop data).
+
+## 7. Proposed deliverables
+
+### 7.1 `src/windows/reset_autoclaw.ps1`
+
+The GHOST-shaped reset script: dot-source utils → `Assert-Administrator` → stop AutoClaw processes →
+`New-IdentitySet` → per-target `[n/N]` steps with verify-after → audit log → restore script → summary
+with exit 1 on any failure.
+
+Targets, in order. Every step is `backup → mutate → verify`.
+
+1. `%APPDATA%\AutoClaw\auth.json` — rotate `deviceId` to fresh 64-hex.
+2. `%APPDATA%\AutoClaw\identity\device.json` — regenerate the ed25519 keypair and `deviceId`.
+3. `%APPDATA%\AutoClaw\settings.json` — write this instance's `gateway.port`.
+4. `%APPDATA%\AutoClaw\settings.json` — enforce `update.checkOnStart: false` so a clone can never
+   race an app update against the patched `app.asar` (§5.1, §7.3).
+5. `AutoClawCloneHome\instN\home\.openclaw-autoclaw\openclaw.json` — verify `gateway.mode` and
+   `update.checkOnStart: false`.
+6. Probe: delete `~/.openclaw-autoclaw\devices\paired.json` for the target instance so its own
+   gateway regenerates a fresh one, then verify after start that only its own key is present.
+
+Steps 1–2 are the identity rotation proper; step 6 is the credential-hygiene pass.
+
+### 7.2 `src/windows/launch_autoclaw_clone.ps1`
+
+`[ValidateSet('inst1','inst2','inst3','inst4')] [string]$Instance = 'inst1'`
+
+Phases, in order:
+
+1. **Resolve** the instance table row: home, profile dir, MCP port, gateway port, process markers.
+2. **Ensure directories**: `home\`, `profile\`, `tmp\`.
+3. **First-run seed** — robocopy the primary's `%APPDATA%\AutoClaw` profile, excluding `logs\`,
+   `*.log`, `Cache`, `Code Cache`, `GPUCache`, `DawnGraphiteCache`, `DawnWebGPUCache`, and
+   `lockfile`. Robocopy exit codes 0–7 are success; ≥8 must abort the launch rather than proceed on a
+   half-built profile (the ZCode launcher's rule). Copy `auth.json` **and then scrub it in phase 4** —
+   it is copied only so `userInfo` survives, never for its tokens.
+4. **First-run seed-scrub** — rotate, with verify-after re-read on each:
+   - `auth.json.deviceId` → fresh 64-hex
+   - `identity/device.json` → fresh ed25519 keypair + `deviceId` (the existing
+     `MCowBQYDK2VwAyEA` PEM prefix confirms ed25519, generated via `node:crypto`
+     `generateKeyPairSync('ed25519')`)
+   - `.updaterId` → fresh GUID
+   - `auth.json.token` / `.refreshToken` → **removed**, leaving `userInfo` so the clone opens on the
+     account and prompts for login
+   - `settings.json` → this instance's `gateway.port`, `update.checkOnStart: false`
+5. **Marker-guarded one-time reconciliation** — the AutoClaw analogue of the ZCode launcher's
+   `[telegram-route]` step: runs once ever per instance, idempotent, never reverts a deliberate
+   later re-enable. Guards that a second instance never inherits a shared credential.
+6. **Launch** detached: `cmd /c start "" <exe> --user-data-dir=<profile>`. Never inline — `AGENTS.md`
+   records that `AttachConsole` apps hijack the launching console with log floods.
+7. **Verify-after-launch** — the no-silent-success core:
+   - process tree exists and is stable for 5 s
+   - clone's MCP port answers `GET /health` → `{"ok":true,…}` (verified on the primary)
+   - clone's gateway port answers `GET /health` → `{"ok":true,"status":"live"}` (also verified)
+   - read the **actual** bound gateway port back; on drift from requested, log
+     `mcp/gateway port drift` and write the real value into the instance's record
+   - clone's `devices/paired.json` contains **only** its own device key → otherwise `FAILED`
+   - the primary's `~/.openclaw-autoclaw\openclaw.json` hash is unchanged (isolation proof)
+
+### 7.2b. `Launch-AutoClaw-Clone.bat`
+
+Double-click wrapper mirroring `Launch-ZCode-Second.bat`. Must obey the `.bat` rules in `AGENTS.md`:
+**no bare parentheses** in any `echo` line inside a parenthesised block (CMD treats `)` as the block
+terminator and aborts the script silently), and launch detached via `cmd /c start ""`.
+
+### 7.3 `tools/patch_autoclaw_ports.ps1` (+ `.mjs` engine)
+
+`app.asar` patch widening `PRODUCTIVITY_MCP_CANDIDATE_PORTS` from 4 to 8 slots. Mirrors the ZCode
+patcher: marker file carrying `patchVersion`, `-Restore`, warning that an app update reverts it, and
+a hard requirement that AutoClaw is closed while patching. Verifies the patched constant by
+re-reading it from the written `app.asar`.
+
+### 7.3b. `tools/install_autoclaw_clone_shortcuts.ps1`
+
+Per-user Desktop + Start-menu shortcuts for inst1–inst4 with distinct `System.AppUserModel.ID`
+(`com.zhipuai.autoclaw.inst1` … `.inst4`), so taskbar buttons and pins stay separate. Base AUMID
+`com.zhipuai.autoclaw` is read from the app itself (§5.8).
+
+`AGENTS.md` records that pinning a clone window can rewrite the Primary's `.lnk` AUMID *and* wipe its
+`IconLocation`. Same hazard applies here, so this script needs a `-RepairPrimaryAumid` switch
+mirroring `install_zcode_second_shortcuts.ps1 -RepairPrimaryAumid`. Diagnostic rule copied too: read
+`.lnk` AUMIDs via `Shell.Application` `ExtendedProperty('System.AppUserModel.ID')` — decoding the
+`.lnk` as UTF-16 and regexing misaligns on odd byte offsets and reports false `<none>`.
+
+Per-clone shortcut icons (2026-10-17, developer-supplied): each clone `.lnk` sets
+`IconLocation = tools\autoclaw-<color>-branding\tray_icon.ico,0` — blue/yellow/green for inst1–3
+cropped from developer renders, red for inst4 derived as a +150° hue-rotate of the blue master
+(`tools\make_clone_icon.ps1`, the generic generator reusable by future app clones). A missing
+branding dir warns and falls back to the `AutoClaw.exe` icon (never a set-but-absent icon path —
+playbook §5 / EC-B02). The Primary `AutoClaw.lnk` keeps the stock exe icon; `-RepairPrimaryAumid`
+restores exactly that, so the two behaviors do not conflict. Running windows still share the base
+AUMID button (§7.3c) — only shortcut/pin icons are custom.
+
+### 7.3c. Taskbar identity — known gap, deferred to v2
+
+All instances declare the same AUMID (§5.8), so v1 ships a merged taskbar button and `status`
+reports it as a known limitation. `tools/watch_zcode_taskbar.ps1` is not directly reusable: it
+classifies by ZCode process markers and class names.
+
+v2 candidates: (a) an `app.asar` patch adding an `AUTOCLAW_AUMID_SUFFIX` env override, mirroring
+`ZCODE_AUMID_SUFFIX`; (b) the window-level `IPropertyStore` stamp from
+`launch_zcode_second_instance.ps1` step 4. Note that (b) currently exists as inline C# inside the
+ZCode script — extracting it into `identity_utils.ps1` so both launchers share one implementation
+would touch a file `AGENTS.md` marks out of scope, so it is deliberately **not** bundled here (§11).
+
+## 8. Identity rotation matrix (AutoClaw)
+
+AutoClaw keeps two device identities and one live operator credential. What each clone does with each
+file:
+
+| File | Primary value | Clone action | Method |
+|---|---|---|---|
+| `%APPDATA%\AutoClaw\auth.json` `.deviceId` | `b786a56d…` | **rotate** | fresh 64-hex |
+| `%APPDATA%\AutoClaw\auth.json` `.token` / `.refreshToken` | live | **remove** | absent → clone prompts login |
+| `%APPDATA%\AutoClaw\auth.json` `.userInfo` | account | **copy** | gives the clone the account |
+| `%APPDATA%\AutoClaw\identity\device.json` | `f8c0f1b1…` + ed25519 keypair | **rotate** | fresh keypair + id |
+| `%APPDATA%\AutoClaw\settings.json` `.gateway.port` | 18789 | **overwrite** | per-instance port |
+| `%APPDATA%\AutoClaw\settings.json` `.update.checkOnStart` | false | **enforce** | already false on the primary |
+| `%APPDATA%\AutoClaw\.updaterId` | updater GUID | **rotate** | fresh GUID |
+| `~/.openclaw-autoclaw\devices\paired.json` | operator token `yf-qSmX-…` | **never copy** | clone's gateway regenerates |
+| `~/.openclaw-autoclaw\identity\device.json` | `f8c0f1b1…` | **never copy** | fresh per clone |
+
+Rationale per row:
+
+- **rotate `deviceId`** — the whole point of the clones. A clone presenting the primary's device id is
+  precisely what this repo exists to prevent.
+- **remove tokens** — ZCode's "one credential, one instance" rule generalises. A token is bound to a
+  device; a clone carrying a foreign `deviceId` plus the primary's token is an incoherent state. Copy
+  `userInfo` only, so the clone opens on the account without a live credential.
+- **rotate the ed25519 keypair** — the public key is what the backend pins for pairing. Regenerating it
+  is what makes a clone a distinct device rather than a lookalike.
+- **never copy `paired.json`** — it is a live operator credential with `operator.admin` scope. Copying
+  it duplicates an admin token across instances. Absent, the clone's own gateway generates its own.
+- **rotate `.updaterId`** — `electron-updater` uses it as the install telemetry identity; identical
+  values across clones make update telemetry look like one machine.
+
+**Accepted consequence:** because tokens are never copied, each clone needs **one manual login** on
+first run. This supersedes the standalone draft's Q1 answer (seed the shared `auth.json` and accept
+the risk), which was made before this repo's conventions were known. Flagging it explicitly because it
+changes operator effort: three logins for inst1–inst3, once each.
+
+## 9. Risks
+
+| ID | Risk | Severity | Mitigation |
+|---|---|---|---|
+| A1 | Live operator token in `devices/paired.json` duplicated if seeded | **high** | Never seeded; post-start verify-after asserts only the clone's own key (§7.2 step 7) |
+| A2 | `app.asar` port patch wiped by any AutoClaw update | high | Marker + `patchVersion`; `-Restore`; status reports "unpatched" when marker missing/stale |
+| A3 | Patching a shipped Electron `app.asar` is outside GHOST's normal per-IDE scope | high | Justified here; called out explicitly — without it the max is 3 clones, not 4 |
+| A4 | One manual login per clone on first run | medium | Expected and documented; one time, then independent |
+| A5 | Gateway silently shifts up to +9 ports | medium | Read the bound port back; log drift; never record requested as actual |
+| A6 | All instances share one taskbar button (§5.8) | medium | Documented v1 limitation (§7.3c); v2 via AUMID suffix patch |
+| A7 | 4 Electron instances + 4 gateways is RAM/commit heavy | medium | `AGENTS.md` already records a ZCode commit-limit OOM at 4 instances (`v8-oom-last-os-error 1455`); same exposure. Monitor, and drop instance count if it recurs |
+
+## 10. Decisions — RESOLVED 2026-10-08
+
+- **Q1 — credentials: RESOLVED → seed profile, rotate identity, carry no live tokens.** Supersedes the
+  standalone-draft answer of seeding the shared `auth.json`. Rotation is what this repo's conventions
+  demand, and it eliminates R1/A1 outright rather than accepting it. Cost: one manual login per clone.
+- **Q2 — the 4th port: RESOLVED → patch `app.asar` to widen the port array.** Supersedes "3 clones,
+  leave the 4th slot free". Within GHOST an installed-app patch is conventional and the patcher already
+  exists as a pattern. Consequence: inst4 becomes a real, startable instance.
+- **Q3 — naming: RESOLVED → numbered `inst1`–`inst4`.**
+
+## 11. Explicitly not doing
+
+- Modifying `identity_utils.ps1`. Extracting the `IPropertyStore` AUMID helper so both launchers share
+  one implementation (§7.3c) is desirable but `AGENTS.md` marks the file out of scope absent a
+  cross-cutting bug fix, so it is flagged as separate work rather than bundled here.
+- Using `OPENCLAW_ALLOW_MULTI_GATEWAY=1` — test-only (gated on `VITEST`/`NODE_ENV=test`) and it would
+  mask a genuine lock conflict instead of verifying there isn't one (§5.4).
+- Using `OPENCLAW_PROFILE` / `--profile <name>`: it renames workspace, locks and logs for no gain
+  (§5.6).
+- Sharing one state dir between clones — it would share sessions, locks and logs.
+- Reusing the ZCode patcher's engine for AutoClaw — separate concerns, separate markers.
+- Touching the primary's processes, config or ports.
+- Modifying `change_device_id.ps1` or anything under `.context/` (both out of scope per `AGENTS.md`).
+
+## 12. Definition of done
+
+- [ ] `tools/patch_autoclaw_ports.ps1` widens the port array to 8, writes its marker, supports
+      `-Restore`, and verifies the constant by re-reading the patched `app.asar`
+- [ ] `inst1`–`inst4` each hold their own `home\.openclaw-autoclaw` with own `openclaw.json`/`logs`
+- [ ] each clone's `auth.json.deviceId` and `identity\device.json.deviceId` differ from the primary
+      **and** from each other
+- [ ] no clone's `paired.json` contains the primary's device key or operator token
+- [ ] all four MCP `/health` endpoints answer ok on distinct ports
+- [ ] all four gateway `/health` endpoints answer `{"ok":true,"status":"live"}`
+- [ ] each clone's **actual** gateway port recorded, with drift logged when it differs from requested
+- [ ] the primary's `~/.openclaw-autoclaw\openclaw.json` hash unchanged across a full clone cycle
+- [ ] every new `.ps1` declares `#Requires -Version 5.1` within the first 3 lines (repo-integrity gate)
+- [ ] every new `.ps1` passes `[System.Management.Automation.Language.Parser]::ParseFile` with 0 errors
+- [ ] `Invoke-ScriptAnalyzer -Path src,tools,tests -Recurse -Settings ./tests/PSScriptAnalyzerSettings.psd1 -Severity Error` clean
+- [ ] `Invoke-Pester -CI -Output Detailed` green, including `repo-integrity.Tests.ps1` (README
+      documents every `src` script)
+- [ ] no `$Input` variable, no ternary `? :`, no `RandomNumberGenerator.Fill()` — PS 5.1 rules
+- [ ] instances launch and stop via `launch_autoclaw_clone.ps1` and `Launch-AutoClaw-Clone.bat`
+- [ ] `README.md` / `AGENTS.md` updated for the new scripts; `CHANGELOG.md` entry added
+- [ ] changes left uncommitted in the working tree for review (AGENTS.md: do not auto-commit)
+
+## 13. Provenance
+
+Every claim in §5 came from these reads on this host:
+
+- `C:\Program Files\AutoClaw\resources\app.asar` — byte-level regex scan for
+  `PRODUCTIVITY_MCP_CANDIDATE_PORTS`, `PRODUCTIVITY_MCP_HOST`, `GATEWAY_DEFAULT_PORT`,
+  `getPreferredPort`, `PORT_PROBE_RANGE`, `requestSingleInstanceLock`,
+  `AUTOCLAW_E2E_ALLOW_PARALLEL_INSTANCE`, `OPENCLAW_HOME_DIR`, `OPENCLAW_PROFILE`,
+  `setAppUserModelId("com.zhipuai.autoclaw")`, `setProductivityMcpActivePort`,
+  `PATH: buildGatewayPathEnv()`, `OPENCLAW_STATE_DIR:` in the gateway-spawn env, `APP_VERSION`
+- `C:\Program Files\AutoClaw\resources\gateway\openclaw\gateway-bundle.mjs` — `resolveGatewayLockPath`,
+  `resolveGatewayLockDir`, `OPENCLAW_ALLOW_MULTI_GATEWAY`, `resolveGatewayPort`, `applyCliProfileEnv`,
+  `--profile <name>`, `--dev`
+- `C:\Program Files\AutoClaw\resources\gateway\openclaw\openclaw.mjs` — Node ≥22.19 version gate
+- `C:\Users\FOTE\.openclaw-autoclaw\{identity\device.json, devices\paired.json, client-sign.json}`
+- `C:\Users\FOTE\AppData\Roaming\AutoClaw\{auth.json, settings.json, launch.json, identity\device.json}`
+- `C:\Users\FOTE\AppData\Local\hermes\config.yaml` lines 2464–2466 — Hermes' single `autoclaw` entry,
+  `http://127.0.0.1:19681/mcp`
+- Live probe: `AutoClaw.exe --user-data-dir=<fresh dir>` alongside the running primary — separate
+  profile created, primary's 19681 untouched, `/health` ok on both 18789 and 19681, and
+  `os.homedir()` confirmed to honour `USERPROFILE`/`HOME`
+- GHOST precedent: `src/windows/launch_zcode_second_instance.ps1` (all 459 lines),
+  `AGENTS.md` "Multi-instance conventions (ZCode: Primary + 3 clones)" and "Mandatory conventions",
+  `docs/architecture.md` "Multi-instance isolation (ZCode: Primary + 3 clones)",
+  `tests/repo-integrity.Tests.ps1`, `tests/PSScriptAnalyzerSettings.psd1`
+
+## 14. Hermes integration
+
+Once the clones are up, add one entry per clone so each is individually addressable in Hermes'
+`config.yaml` under `mcp_servers`:
+
+```yaml
+  autoclaw-1:
+    url: http://127.0.0.1:19682/mcp
+    enabled: true
+  autoclaw-2:
+    url: http://127.0.0.1:19683/mcp
+    enabled: true
+  autoclaw-3:
+    url: http://127.0.0.1:19684/mcp
+    enabled: true
+  autoclaw-4:
+    url: http://127.0.0.1:19685/mcp
+    enabled: true
+```
+
+Enabling all five puts five AutoClaw tool sets into every Hermes turn's context — enable the one you
+need and leave the rest `enabled: false`. It also makes the §5.1 silent-split failure mode far more
+visible, since a pinned URL resolving to the wrong instance becomes immediately obvious.
\ No newline at end of file
diff --git a/docs/PYTHON_HYBRID_ROADMAP.md b/docs/PYTHON_HYBRID_ROADMAP.md
new file mode 100644
index 0000000..7d930a0
--- /dev/null
+++ b/docs/PYTHON_HYBRID_ROADMAP.md
@@ -0,0 +1,67 @@
+# Python Hybrid Roadmap — Phase 2 cancelled, Phase 3 pilot design
+
+Status: DECIDED 2026-10-17. Supersedes the 2026-09-24 phase list recorded in
+the session memory (the original Phase 2 is unworkable as scoped; the reasons
+are recorded here so nobody re-derives them).
+
+## Phase 2 (leaf tools) — CANCELLED
+
+The original Phase 2 proposed migrating the leaf tools to Python. Each target
+now fails a hard invariant:
+
+| Tool | Original plan | Why it is cancelled |
+|------|---------------|---------------------|
+| `tools/make_ghost_icon.ps1` | -> Pillow | The Python core's stdlib-only rule (no pip dependencies) is a deployment invariant: the toolkit must run on a bare Python 3 with zero installs. Pillow breaks it for an offline generator that System.Drawing already serves fine. |
+| `tools/install_*_shortcuts.ps1` | -> pywin32 | The .lnk creation is `WScript.Shell` COM (and the AUMID reads are Shell.Application COM). pywin32 = non-stdlib + a fragile COM bridge for ~60 lines of PS that already works. |
+| `tools/block_qoder_domains.ps1` | -> Python | The tool is security-sensitive and NEVER committed (.gitignore by design). A Python twin would live outside the repo and fork the maintenance. |
+
+Net value of Phase 2 as scoped: negative. The real duplication lives in the
+reset scripts -> Phase 3 is where the effort goes.
+
+## Phase 3 — pilot: reset_cursor.ps1 (the canonical reference)
+
+Target shape (the "thin manifest" contract):
+
+```
+reset_cursor.ps1   =  dot-source identity_utils
+                   -> Assert-Administrator
+                   -> Stop-App (stays PS: Get-Process/Stop-Process)
+                   -> a STEP TABLE: id, title, python subcommand, payload
+                   -> generic runner: per step, invoke src/python/ghost_cli.py
+                      <subcommand> (base64 JSON payload in, JSON out)
+                   -> collect audit lines, emit the restore script, summary
+```
+
+New core modules (stdlib-only, tested in tests/python/test_ghost_core.py):
+
+| Module | Replaces | Contract notes |
+|--------|----------|----------------|
+| `ghost/backup.py` | `Backup-FileToTimestampDir` | timestamped `ID_Backups\<ts>\<label>` dir, clobbers an old `.backup` first (rename rule), returns a manifest entry the restore script consumes |
+| `ghost/filesweep.py` | the per-step delete/rename/verify PS blocks | every mutation returns `{ok, path, before, after}`; "file existed" is never "value changed" |
+| `ghost/winstore.py` | the storage.json / machineid / salt steps | JSON patch + verify-after re-read via the existing `json_patch` |
+
+Unchanged: `sqlite_keys` (already core), the audit JSON shape, the restore
+script format, the summary. The PS side keeps: elevation, process control,
+and the step-table loop - nothing else.
+
+Migration order after the pilot is accepted (the approved ascending-risk
+list): cursor -> devin -> trae -> qoderwork -> minimax -> qoder -> zcode
+last. One script per session; the pattern is reviewed after EACH migration,
+not batched.
+
+### Pilot acceptance criteria (all mandatory before generalizing)
+
+1. `backup.py` + `filesweep.py` + `winstore.py` land with unittest coverage
+   (fixtures on temp dirs; clobber + verify-after negatives included).
+2. Pester + unittest green; parse-check on the slimmed manifest.
+3. ONE live run of the migrated `reset_cursor.ps1` (admin, Cursor closed)
+   compared step-by-step against the pre-migration audit output - identical
+   steps, identical verify results, restore script re-verified.
+4. A rollback note: the pre-migration script stays in `archive/` (local-only
+   fallback convention) until the next suite migrates cleanly.
+
+### Phase 4 — unchanged
+
+COM-heavy launchers/watchers stay PowerShell (documented 2026-09-24; the
+AUMID stamping P/Invoke surface has no stdlib Python equivalent worth the
+bridge).
diff --git a/docs/README.md b/docs/README.md
index fce46ed..4ea2cab 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -8,5 +8,9 @@
 | [Troubleshooting](troubleshooting.md) | Common failures and fixes (Python/core missing, locked processes, restoring a reset) |
 | [FAQ](faq.md) | Scope, ToS/risk, cross-tool correlation, the Windsurf → Devin rebrand, versioning policy |
 | [ZCode chat sync plan](ZCODE_CHAT_SYNC_WATCHER_PLAN.md) | Root-cause analysis of cross-instance chat visibility + the refresh/watcher design |
+| [App cloning playbook](APP_CLONING_PLAYBOOK.md) | The generic process for cloning any app into isolated instances: identity suite, developer-inputs contract, icon policy, phases 0–10 |
+| [App cloning edge cases](APP_CLONING_EDGE_CASES.md) | The normative EC-xx catalog every clone suite must handle (updates, icons, taskbar, seeds, ports, PS 5.1, ...) |
+| [App cloning intake template](APP_CLONING_INTAKE_TEMPLATE.md) | The fill-in form a new clone request starts from (names, colors, icons, credentials, ports) |
+| [AutoClaw clones spec](AUTOCLAW_CLONES_SPEC.md) | AutoClaw Primary + inst1–inst4: verified ground truth read from the installed app, port plan, risks, decisions, provenance |
 
 The top-level [README](../README.md) is the quick-start entry point.
diff --git a/docs/ZCODE_CHAT_SYNC_WATCHER_PLAN.md b/docs/ZCODE_CHAT_SYNC_WATCHER_PLAN.md
index 7d8fe91..e22e522 100644
--- a/docs/ZCODE_CHAT_SYNC_WATCHER_PLAN.md
+++ b/docs/ZCODE_CHAT_SYNC_WATCHER_PLAN.md
@@ -106,7 +106,7 @@ Monotonic signature; any new/edited chat in EITHER instance bumps it.
 ### Action (on signature change, debounced)
 
 1. Identify the **Secondary** main process: bare-exe `ZCode.exe` whose
-   `MainWindowTitle` is `ZCode Blue` (the icon patch, engine v6, guarantees
+   `MainWindowTitle` is `ZCode Blue` (the icon patch, engine v7, guarantees
    this title; Primary's is `ZCode`).
 2. Enumerate its descendant processes (`zcode.cjs app-server` children) via
    parent-PID tree walk.
diff --git a/docs/ZCODE_TELEGRAM_BOTS.md b/docs/ZCODE_TELEGRAM_BOTS.md
new file mode 100644
index 0000000..ca41cd0
--- /dev/null
+++ b/docs/ZCODE_TELEGRAM_BOTS.md
@@ -0,0 +1,58 @@
+# ZCode per-clone Telegram bots (UI-assisted model)
+
+Date: 2026-10-16. Status: ACTIVE.
+
+## 1. Why UI-assisted
+
+`bot-config.json` / `bot-config.v3.json` hold only `{ id, credentialRef }`.
+The secret lives encrypted as `credentials.json -> "bot:<id>:credential" =
+"enc:v1:..."`. This repo has no `enc:v1:` cipher, so no script writes raw
+BotFather tokens. The operator pastes each token ONCE in that clone's ZCode
+UI; the app mints a fresh `bot-<guid>`, encrypts to `enc:v1:`, updates
+`bot-config.v3.json`. Tooling below acts as guardian/synchronizer.
+
+## 2. Rules (EC-D03: one credential = one instance)
+
+- One token = one poller. Two pollers on one token = HTTP 409 + random
+  cross-account billing.
+- Every check covers BOTH `bot-config.json` AND `bot-config.v3.json`
+  (the 2026-10-16 Fourth `v2=False / v3=True` split looked disabled while
+  polling).
+- Fingerprint = `sha8(credentials.json bot:<id>:credential)` + bot `id`.
+  Values are never printed or logged, hashes only.
+- Primary owns `Zane` (`enabled=true` in both files). A clone with a
+  duplicate sha8/id must be `enabled=false` in both files. A clone with a
+  UNIQUE sha8+id may stay `enabled=true` in both files.
+
+## 3. Tooling
+
+- `tools/set_zcode_bot.ps1 -VerifyOnly` — read-only audit across all 4
+  homes, exit 1 on v2/v3 mismatch or duplicate-while-enabled.
+- `tools/set_zcode_bot.ps1 -Target <name> -Fix` — backup-first
+  (`ID_Backups\telegram_guardian_<ts>` + audit + restore script via
+  `identity_utils.ps1`), syncs v2/v3, disables duplicates, writes the
+  `.telegram-routed` v2 marker (`v2 unique-bot sha8=... id=...`) for unique
+  clone bots, verify-after re-read.
+- `src/windows/launch_zcode_second_instance.ps1 [2c]` — v2 logic: on a
+  first launch without a marker, sha8-compare against Primary (duplicate ->
+  disable both files; unique -> preserve + v2 marker). A `v2 unique-bot*`
+  marker is never reverted. Legacy empty markers keep old skip behavior.
+  Polling-lock cleanup runs only when a duplicate was disabled AND the
+  clone is not running (a live poller owns its lock).
+
+## 4. Bring-up (one bot per clone)
+
+1. `@BotFather` -> 3 new bots (keep `Zane` on Primary).
+2. For each clone: open that clone's ZCode window, paste its token in the
+   Telegram integration UI, confirm it polls.
+3. Run `tools/set_zcode_bot.ps1 -VerifyOnly` — expect OK.
+4. Run `tools/set_zcode_bot.ps1 -Target <clone> -Fix` once to sync v2/v3
+   and write the v2 marker.
+5. Restart the clone once. Verify 4 pollers, 4 bot usernames, zero 409.
+
+## 5. Quota note (2026-10-16 decision: Option C)
+
+Fourth keeps its big quota isolated (`credentials.json` OAuth +
+`account-provider` keys are per-home). Sharing = same ZAI account via UI
+in multiple homes (same pool, drains together); surgical key copies are
+rejected (refresh race + `[6b/27]` unlink loop).
diff --git a/docs/architecture.md b/docs/architecture.md
index 518458b..4628fd4 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -11,15 +11,20 @@ src/windows/
 ├── reset_<app>.ps1                    # one thin manifest per app
 ├── change_device_id.ps1               # system-level: fingerprint / registry / profiles
 ├── launch_zcode_second_instance.ps1   # ZCode clone launcher (-Instance Second|Third|Fourth)
-└── Launch-ZCode-Second|Third|Fourth.bat  # double-click wrappers around the launcher
+├── Launch-ZCode-Second|Third|Fourth.bat  # double-click wrappers around the launcher
+├── launch_autoclaw_clone.ps1          # AutoClaw clone launcher (-Instance inst1..inst4, -Status)
+├── Launch-AutoClaw-Clone.bat          # double-click wrapper (interactive instance picker)
+└── reset_autoclaw.ps1                 # AutoClaw identity reset (-Target Primary|inst1..4|All)
 src/python/
 ├── ghost_cli.py                       # bootstrap: PS scripts call this absolute path
 └── ghost/                             # stdlib-only Python core (identity + SQLite logic)
 tools/
 ├── watch_zcode_captcha.ps1            # captcha-stall watchdog (no identity writes)
-├── patch_zcode_icon_override.ps1/.mjs # app.asar icon/accent/AUMID patch (engine v6)
+├── patch_zcode_icon_override.ps1/.mjs # app.asar icon/accent/AUMID patch (engine v7)
 ├── install_zcode_second_shortcuts.ps1 # clone shortcuts (Desktop + Start menu)
 ├── refresh_zcode_second_chats.ps1     # cross-instance chat refresh + -Watch watcher
+├── patch_autoclaw_ports.ps1/.mjs      # app.asar MCP-port-array patch, 4 -> 8 slots (engine v1)
+├── install_autoclaw_clone_shortcuts.ps1 # AutoClaw clone shortcuts (Desktop + Start menu)
 └── zcode-{blue,yellow,green}-branding/  # per-clone icon assets + generator
 ```
 
@@ -29,7 +34,6 @@ tools/
 |---|---|
 | `New-IdentitySet` | `{ devDeviceId (GUID), machineId (64 hex), macMachineId (128 hex), sqmId ({GUID}) }` |
 | `Assert-Administrator` | exits 1 when not elevated |
-| `Stop-AppProcesses` | kill loop with helper expansion (e.g. `Windsurf` → `Devin` + `codeium`) |
 | `Backup-FileToTimestampDir` | copy to `<app>\ID_Backups\<ts>\<label>` before any mutation |
 | `Set-JsonIdentity` | JSON patch + verify-after re-read |
 | `Set-SqliteKeys` | Python-backed SQLite UPSERT + verify-after (invokes `src\python\ghost_cli.py sqlite-update`, parameterized SQL) |
@@ -53,7 +57,7 @@ assumptions.
 | `delete-secrets <db>` | `reset_zcode.ps1` secrets bridge | JSON `{deleted, survivors}` |
 | `clear-cli-telemetry <db>` | `reset_zcode.ps1` [26/27] bridge | JSON `{deleted}` (connect failure → `{deleted: 0, error}` + exit 0) |
 | `chat-check missing\|hot <db> [index]` | `refresh_zcode_second_chats.ps1` helper | `COUNT:`/`MISSING:`/`AGE_MS:`/`INFLIGHT_*:` lines |
-| `json-patch`, `identity`, `restore-script`, `audit-log` | Python twins of the utils functions | JSON reports |
+| `json-patch`, `identity`, `restore-script`, `audit-log` | Python twins of the utils functions — `identity` is a manual diagnostic; the other three have no production caller today (kept as scaffolding for the planned PS→Python migration) | JSON reports |
 
 Payloads travel base64-encoded to sidestep native-argument quoting; values
 always use `?` placeholders; table names are validated against
@@ -109,7 +113,7 @@ rotated telemetry identity, and an independent ID set on reset
 (`reset_zcode.ps1 -Target Primary|Secondary|Third|Fourth|Both|All`).
 
 Visual identity comes from `tools/patch_zcode_icon_override.ps1`, a one-time
-`app.asar` patch (engine v6) that honors `ZCODE_ICON_DIR` (branded icon),
+`app.asar` patch (engine v7) that honors `ZCODE_ICON_DIR` (branded icon),
 `ZCODE_AUMID_SUFFIX` (separate taskbar button + pins), `ZCODE_ACCENT_HEX` +
 `ZCODE_INSTANCE_NAME` (accent color + "ZCode <Color>" window title). The patch
 also disables the clones' auto-updater so it can never silently revert itself —
@@ -122,6 +126,41 @@ recycles the target instance's app-server (auto-respawn reseeds the index
 baseline). Root-cause analysis and the error-triggered `-Watch` mode:
 [ZCODE_CHAT_SYNC_WATCHER_PLAN.md](ZCODE_CHAT_SYNC_WATCHER_PLAN.md).
 
+## Multi-instance isolation (AutoClaw: Primary + 4 clone slots)
+
+AutoClaw (Electron 33, `C:\Program Files\AutoClaw`) runs as Primary (default
+profile) plus up to four numbered clones, `inst1`–`inst4`, under
+`%USERPROFILE%\AutoClawCloneHome\instN\{home,profile,tmp}`. Unlike ZCode, the
+app **honours `--user-data-dir`** (the single-instance lock keys off the
+profile dir), so the launcher passes it as a second belt-and-braces layer on
+top of the env levers: `USERPROFILE`/`HOME` (the gateway derives its whole
+`~/.openclaw-autoclaw` state tree from `os.homedir()`), `TEMP`/`TMP`/`TMPDIR`,
+and `AUTOCLAW_GATEWAY_PORT` (supported override; a busy port silently shifts
+up to +9, so the launcher reads the actually-bound port back and records it —
+`instance-record.json`, `launch_autoclaw_clone.ps1 -Status`).
+
+The MCP HTTP server binds a **hardcoded 4-slot port array**
+(`19681–19684`) in the Electron main process — the multi-instance ceiling —
+so `tools/patch_autoclaw_ports.ps1` (+ `.mjs` engine v1) widens it to 8 slots
+in the installed `app.asar` (backup + marker + `-Restore`; an app update
+reverts it). Verified design constraints and the port plan live in
+[docs/AUTOCLAW_CLONES_SPEC.md](AUTOCLAW_CLONES_SPEC.md).
+
+Identity is stricter than ZCode's: AutoClaw keeps TWO device identities
+(`auth.json` `deviceId` + `identity\device.json` ed25519 keypair) and one
+live operator credential (`devices\paired.json`, admin-scoped). The first-run
+seed copies the Primary profile **excluding every credential store**
+(`token-cache.json`, `*.backup`, tokens stripped from `auth.json` — `userInfo`
+kept, so the clone opens on the account and needs one manual login), rotates
+the cloned identities, and never touches the gateway state tree (fresh per
+clone; the gateway regenerates `paired.json`). The clone's launcher then
+verifies: process tree stable, `/health` on its discovered MCP + gateway
+ports, `paired.json` holding only its own key, and the Primary's
+`openclaw.json` hash unchanged across the cycle.
+`reset_autoclaw.ps1 -Target Primary|inst1|inst2|inst3|inst4|All` repeats the
+rotation on demand. Every instance's `settings.json` gets
+`system.autoUpdate: false` — any auto-update would replace the patched asar.
+
 ## Testing
 
 `tests/identity_utils.Tests.ps1` unit-tests the shared library against
diff --git a/docs/cli.md b/docs/cli.md
index da9c9b6..2da87fd 100644
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -2,9 +2,10 @@
 
 Prefer the interactive launchers — **`GHOST.bat`** (Windows, double-click) or
 **`./ghost.sh`** (Linux). This page is the direct-command cheat sheet for
-scripts and CI. `GHOST.bat` groups its tasks into three submenus with
-continuous local numbering (IDE resets [1]-[8] / ZCode Multi-Instance & Clones
-[1]-[17] / System & GHOST Maintenance [1]-[2]); chain several tasks in one
+scripts and CI. `GHOST.bat` groups its tasks into four submenus with
+continuous local numbering (IDE resets [1]-[9] / ZCode Multi-Instance &
+Clones [1]-[17] / System & GHOST Maintenance [1]-[2] / AutoClaw
+Multi-Instance & Clones [1]-[12]); chain several tasks in one
 prompt using the numbers shown in that submenu (e.g. `1 3 4` inside ZCode), or
 from the main menu type a sub-path like `2 1 3 4` (open ZCode, run its
 [1] [3] [4]) or a bare global id — this page cites menu positions as
@@ -53,8 +54,9 @@ Or double-click: `src\windows\Launch-ZCode-Second.bat` / `-Third.bat` /
 
 First launch of each clone copies history into its own home
 (`%USERPROFILE%\ZCodeSecondHome | ZCodeThirdHome | ZCodeFourthHome`), scrubs
-it to fresh IDs, and routes Telegram channel bots to Primary (one-time,
-automatic). Branding: Second = blue, Third = yellow, Fourth = green (separate
+it to fresh IDs, and reconciles Telegram channel bots via sha8 credential
+comparison (duplicates of Primary disabled, unique clone bots preserved —
+see [docs/ZCODE_TELEGRAM_BOTS.md](ZCODE_TELEGRAM_BOTS.md)). Branding: Second = blue, Third = yellow, Fourth = green (separate
 taskbar buttons + window titles "ZCode Blue"/"ZCode Yellow"/"ZCode Green").
 All instances share one install, so one update covers all — but re-run the
 icon patch (`tools\patch_zcode_icon_override.ps1`, ZCode [12]) after every app
diff --git a/docs/getting-started.md b/docs/getting-started.md
index 8c68b20..ac35c0f 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -68,7 +68,7 @@ Run up to four fully independent ZCode windows side by side (separate Electron l
 powershell -File src\windows\launch_zcode_second_instance.ps1 -Instance Third   # example
 ```
 
-First launch of each clone copies history (`~\.zcode` → `~\ZCodeSecondHome\.zcode` / `ZCodeThirdHome` / `ZCodeFourthHome`, journals excluded), then scrubs the clone to fresh independent IDs (deviceMid, deviceSid, OAuth tokens, provider apiKeys) and routes Telegram bots to Primary only (marker-guarded, runs once per clone — a deliberate re-enable is never reverted). Later launches reuse the independent profile. Isolation is driven by five process-scoped env vars (`ZCODE_DATA_BASE_DIR`, `ZCODE_DESKTOP_USER_DATA_DIR`, `ZCODE_DESKTOP_SESSION_DATA_DIR`, `ZCODE_DESKTOP_HOME_DIR`, `HOME`) — the app overwrites `--user-data-dir`, so env vars are the only working lever. All instances share one install: a single update covers all, but re-run the icon patch (ZCode [12]) after updates. Clone branding: Second = blue, Third = yellow, Fourth = green (separate taskbar buttons + window titles "ZCode Blue"/"ZCode Yellow"/"ZCode Green"). Telegram channel bots must live on ONE instance only (two pollers on one token cause HTTP 409 conflicts and random cross-account billing); the launcher enforces Primary-only automatically.
+First launch of each clone copies history (`~\.zcode` → `~\ZCodeSecondHome\.zcode` / `ZCodeThirdHome` / `ZCodeFourthHome`, journals excluded), then scrubs the clone to fresh independent IDs (deviceMid, deviceSid, OAuth tokens, provider apiKeys) and reconciles Telegram bots via sha8 credential comparison across both `bot-config.json` and `bot-config.v3.json` (duplicates of Primary disabled, unique clone bots preserved with a v2 marker — a deliberate unique bot is never reverted; see [docs/ZCODE_TELEGRAM_BOTS.md](ZCODE_TELEGRAM_BOTS.md)). Later launches reuse the independent profile. Isolation is driven by five process-scoped env vars (`ZCODE_DATA_BASE_DIR`, `ZCODE_DESKTOP_USER_DATA_DIR`, `ZCODE_DESKTOP_SESSION_DATA_DIR`, `ZCODE_DESKTOP_HOME_DIR`, `HOME`) — the app overwrites `--user-data-dir`, so env vars are the only working lever. All instances share one install: a single update covers all, but re-run the icon patch (ZCode [12]) after updates. Clone branding: Second = blue, Third = yellow, Fourth = green (separate taskbar buttons + window titles "ZCode Blue"/"ZCode Yellow"/"ZCode Green"). One Telegram token = one polling instance (two pollers on one token cause HTTP 409 conflicts and random cross-account billing); `tools\set_zcode_bot.ps1 -VerifyOnly` audits all 4 homes (sha8 only, never values).
 
 ### 5c. ZCode clone utilities (`tools/`)
 
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index 4301046..4f52984 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -100,7 +100,7 @@ and cross-account billing noise — disable it again.
 
 The per-clone branding rides on an `app.asar` patch (`ZCODE_ICON_DIR`,
 `ZCODE_AUMID_SUFFIX`, `ZCODE_ACCENT_HEX`, `ZCODE_INSTANCE_NAME`) that a ZCode
-app update silently reverts. Re-apply it once — `GHOST.bat` → [13], or
+app update silently reverts. Re-apply it once — `GHOST.bat` → ZCode [12], or
 `tools\patch_zcode_icon_override.ps1` — and every clone restores its icon,
 accent color, taskbar button and "ZCode <Color>" window title.
 
@@ -136,15 +136,15 @@ What to do:
 
 All instances share one session store, but each sidebar index is seeded at
 app-server spawn with no snapshot backfill — the data is there, the index is
-stale. Refresh without restarting the app: `GHOST.bat` → [15] (Second
-only) or [23] (all instances), or keep the detached watcher running ([22],
+stale. Refresh without restarting the app: `GHOST.bat` → ZCode [13] (Second
+only) or [15] (all instances), or keep the detached watcher running (ZCode [14],
 `-Watch -Target All`) to auto-refresh every running instance on quota/captcha
 failures. The hot-activity guard may defer the refresh while a turn streams;
 `-Force` bypasses it.
 
 ## ZCode windows stay merged in one taskbar button even though identities are stamped
 
-The watcher ([16]) stamps every window's `System.AppUserModel.ID`, but a
+The watcher (ZCode [16]) stamps every window's `System.AppUserModel.ID`, but a
 taskbar group that was formed while identities were still missing can PERSIST
 after the stamps land — the shell does not always re-evaluate an existing
 group, and a stale group can even keep the WRONG ICON (verified 2026-09-26:
@@ -170,7 +170,7 @@ If the watcher is running it re-stamps the final value within one interval
 even if the kick script dies mid-toggle, so this is safe. A silent watcher
 log does NOT mean the watcher is dead — check the mutex first (a second
 instance logs "watcher already running"). A watcher process started BEFORE
-a script edit keeps the old code — close its window and relaunch [16].
+a script edit keeps the old code — close its window and relaunch ZCode [16].
 
 ## A clone launched with the Primary's profile or taskbar icon
 
@@ -184,7 +184,7 @@ A pin rewrite can also empty that shortcut icon field (verified 2026-09-28:
 the hijacked Start-menu ZCode.lnk carried dev.zcode.app.4 with an empty icon,
 so a green clone running alone showed the Primary icon even though its window
 identity was correct). -RepairPrimaryAumid now restores the Primary shortcut
-icon to <ZCode.exe>,0 too. The resident watcher ([16]) self-heals a hijack
+icon to <ZCode.exe>,0 too. The resident watcher (ZCode [16]) self-heals a hijack
 every ~5 min (REPAIR/FAIL logged to taskbar.log); -RunOnce -CheckPrimaryHijack
 repairs once without starting the resident loop. Restart the resident watcher
 after any watcher-script edit: an old copy keeps the old code.
diff --git a/src/linux/id_reset_common.sh b/src/linux/id_reset_common.sh
index 82bcf46..34f060d 100644
--- a/src/linux/id_reset_common.sh
+++ b/src/linux/id_reset_common.sh
@@ -71,11 +71,6 @@ generate_hex() {
     openssl rand -hex "$bytes" 2>/dev/null || head -c "$bytes" /dev/urandom | xxd -p -c "$bytes"
 }
 
-# ── Hashing ─────────────────────────────────────────────────────────────
-sha256_hex() {
-    printf '%s' "$1" | sha256sum | awk '{print $1}'
-}
-
 # ── Helpers ─────────────────────────────────────────────────────────────
 timestamp() {
     date +%Y%m%d_%H%M%S
diff --git a/src/python/ghost/__init__.py b/src/python/ghost/__init__.py
index 1a52b75..751e53f 100644
--- a/src/python/ghost/__init__.py
+++ b/src/python/ghost/__init__.py
@@ -13,4 +13,4 @@
   string interpolation; values always go through `?` placeholders.
 """
 
-__version__ = "1.0.0"
+__version__ = "1.1.0"
diff --git a/src/python/ghost/__main__.py b/src/python/ghost/__main__.py
index 585dd25..c4959d0 100644
--- a/src/python/ghost/__main__.py
+++ b/src/python/ghost/__main__.py
@@ -19,7 +19,7 @@
 import json
 import sys
 
-from ghost import audit, identity, json_patch, restore, sqlite_keys
+from ghost import audit, backup, filesweep, identity, json_patch, restore, sqlite_keys, winstore
 
 
 def _decode_updates(b64):
@@ -34,7 +34,13 @@ def _cmd_sqlite_update(args):
 
 
 def _cmd_delete_secrets(args):
-    result = sqlite_keys.delete_secrets(args.db)
+    if args.config_b64:
+        cfg = _decode_updates(args.config_b64)
+        result = sqlite_keys.delete_secrets(
+            args.db, exact_keys=cfg.get("exact_keys"),
+            like_patterns=cfg.get("like_patterns"), escape=cfg.get("escape"))
+    else:
+        result = sqlite_keys.delete_secrets(args.db)
     print(json.dumps(result))
     return 0
 
@@ -81,6 +87,84 @@ def _cmd_audit_log(args):
     return 0
 
 
+def _cmd_backup(args):
+    report = backup.backup_to_timestamped_dir(
+        args.source, args.backup_root, args.label)
+    print(json.dumps(report))
+    return 0 if (report["ok"] or report["skipped"]) else 1
+
+
+def _cmd_machineid_file(args):
+    payload = _decode_updates(args.payload_b64)
+    report = winstore.write_machineid_file(
+        args.path, payload["value"], args.backup_root, args.label)
+    print(json.dumps(report))
+    return 0 if report["ok"] else 1
+
+
+def _cmd_salt_rotate(args):
+    report = winstore.rotate_device_id_salt(
+        args.path, args.backup_root, args.label)
+    print(json.dumps(report))
+    return 0 if report["ok"] else 1
+
+
+def _cmd_json_remove(args):
+    payload = _decode_updates(args.payload_b64)
+    report = winstore.remove_json_keys(
+        args.path, payload["keys"], args.backup_root, args.label)
+    print(json.dumps(report))
+    return 0 if report["ok"] else 1
+
+
+def _cmd_store_delete(args):
+    report = filesweep.remove_identity_store(
+        args.path, args.action, args.backup_root, args.label,
+        root_path=args.root_path)
+    print(json.dumps(report))
+    return 0 if report["ok"] else 1
+
+
+def _cmd_sweep_file(args):
+    report = filesweep.remove_verified(args.path)
+    print(json.dumps(report))
+    return 0 if report["ok"] else 1
+
+
+def _cmd_sweep_tree(args):
+    report = filesweep.sweep_tree(args.path, args.backup_root, args.label)
+    print(json.dumps(report))
+    return 0 if report["ok"] else 1
+
+
+def _cmd_patch_argv(args):
+    payload = _decode_updates(args.payload_b64) if args.payload_b64 else {}
+    report = winstore.patch_argv_json(
+        args.path, args.backup_root, args.label,
+        new_id=payload.get("new_id"), username=payload.get("username"))
+    print(json.dumps(report))
+    return 0 if report["ok"] else 1
+
+
+def _cmd_replace_text(args):
+    payload = _decode_updates(args.payload_b64)
+    report = winstore.replace_text(
+        args.path, payload["find"], payload["replacement"],
+        args.backup_root, args.label)
+    print(json.dumps(report))
+    return 0 if report["ok"] else 1
+
+
+def _cmd_json_set(args):
+    payload = _decode_updates(args.payload_b64)
+    report = winstore.set_json_path(
+        args.path, payload["key"], payload["value"],
+        args.backup_root, args.label,
+        skip_if_empty=bool(payload.get("skip_if_empty")))
+    print(json.dumps(report))
+    return 0 if report["ok"] else 1
+
+
 def build_parser():
     parser = argparse.ArgumentParser(
         prog="ghost", description="GHOST Python core CLI")
@@ -100,6 +184,9 @@ def build_parser():
         "delete-secrets",
         help="DELETE auth-secret keys + survivor verification")
     p.add_argument("db")
+    p.add_argument("config_b64", nargs="?", default=None,
+                   help='base64 of {"exact_keys": [...], "like_patterns": '
+                        '[...], "escape": "\\\\"} (default: Cursor keys)')
     p.set_defaults(func=_cmd_delete_secrets)
 
     p = sub.add_parser(
@@ -144,6 +231,108 @@ def build_parser():
                    help="JSON file with the entries array (default [])")
     p.set_defaults(func=_cmd_audit_log)
 
+    p = sub.add_parser(
+        "backup",
+        help="copy a file/tree into a backup dir with lock retries + "
+             "verify-after (Backup-FileToTimestampDir twin)")
+    p.add_argument("source")
+    p.add_argument("backup_root")
+    p.add_argument("label")
+    p.set_defaults(func=_cmd_backup)
+
+    p = sub.add_parser(
+        "machineid-file",
+        help="backup + rewrite a machine-id text file + re-read verify "
+             "(Set-VerifiedMachineIdFile twin)")
+    p.add_argument("path")
+    p.add_argument("backup_root")
+    p.add_argument("label")
+    p.add_argument("payload_b64", help="base64 of {\"value\": \"<id>\"}")
+    p.set_defaults(func=_cmd_machineid_file)
+
+    p = sub.add_parser(
+        "salt-rotate",
+        help="rotate electron.media.device_id_salt in a Preferences JSON + "
+             "verify (Set-DeviceIdSalt twin)")
+    p.add_argument("path")
+    p.add_argument("backup_root")
+    p.add_argument("label")
+    p.set_defaults(func=_cmd_salt_rotate)
+
+    p = sub.add_parser(
+        "json-remove",
+        help="remove dotted JSON key paths + re-read verify "
+             "(Remove-OsCryptEncryptedKey twin)")
+    p.add_argument("path")
+    p.add_argument("backup_root")
+    p.add_argument("label")
+    p.add_argument("payload_b64", help="base64 of {\"keys\": [\"a.b\", ...]}")
+    p.set_defaults(func=_cmd_json_remove)
+
+    p = sub.add_parser(
+        "store-delete",
+        help="backup then rename-or-delete a binary identity store with "
+             "retries (Clear-BinaryIdentityStore twin, one path)")
+    p.add_argument("path")
+    p.add_argument("backup_root")
+    p.add_argument("label")
+    p.add_argument("--action", choices=["rename", "delete"], default="delete")
+    p.add_argument("--root-path", default=None,
+                   help="paths under this root get relative backup labels")
+    p.set_defaults(func=_cmd_store_delete)
+
+    p = sub.add_parser(
+        "sweep-file",
+        help="delete one file (no backup) + re-read verify "
+             "(Remove-VerifiedFileNoBackup twin)")
+    p.add_argument("path")
+    p.set_defaults(func=_cmd_sweep_file)
+
+    p = sub.add_parser(
+        "sweep-tree",
+        help="backup a tree then delete every file inside it individually "
+             "(Clear-TreeFilesIndividually twin)")
+    p.add_argument("path")
+    p.add_argument("backup_root")
+    p.add_argument("label")
+    p.set_defaults(func=_cmd_sweep_tree)
+
+    p = sub.add_parser(
+        "patch-argv",
+        help="regex-patch a JSONC argv.json crash-reporter-id + username "
+             "scrub (Update-ArgvJsonIdentity twin)")
+    p.add_argument("path")
+    p.add_argument("backup_root")
+    p.add_argument("label")
+    p.add_argument("payload_b64", nargs="?", default=None,
+                   help='base64 of {"new_id": "...", "username": "..."} '
+                        "(both optional)")
+    p.set_defaults(func=_cmd_patch_argv)
+
+    p = sub.add_parser(
+        "replace-text",
+        help="raw-text replace + absence verify "
+             "(Set-UsernameScrubbedFile twin)")
+    p.add_argument("path")
+    p.add_argument("backup_root")
+    p.add_argument("label")
+    p.add_argument("payload_b64",
+                   help='base64 of {"find": "...", "replacement": "..."}')
+    p.set_defaults(func=_cmd_replace_text)
+
+    p = sub.add_parser(
+        "json-set",
+        help="set a value at a dotted JSON key path + re-read verify "
+             "(Clear-AppOrgBinding twin; skip_if_empty for the "
+             "absent-or-empty SKIP contract)")
+    p.add_argument("path")
+    p.add_argument("backup_root")
+    p.add_argument("label")
+    p.add_argument("payload_b64",
+                   help='base64 of {"key": "a.b", "value": ..., '
+                        '"skip_if_empty": false}')
+    p.set_defaults(func=_cmd_json_set)
+
     return parser
 
 
diff --git a/src/python/ghost/backup.py b/src/python/ghost/backup.py
new file mode 100644
index 0000000..44b0513
--- /dev/null
+++ b/src/python/ghost/backup.py
@@ -0,0 +1,101 @@
+"""Backup-to-timestamped-dir — port of Backup-FileToTimestampDir.
+
+Copies a file OR directory tree to <backup_root>/<label>, retrying through
+transient Windows file locks (extension-host processes release their handles
+a few seconds after the parent IDE exits; the PS port uses 6 attempts with
+500/1000/.../3000 ms backoff, ~10.5 s total). Adds the invariant the PS
+version lacks: verify-after — a successful copy is re-measured (byte size for
+files, entry count + total size for trees) before the report says ok. A copy
+that fails verification is removed so a partial backup can never masquerade
+as good. Never silent-success: the report carries the outcome explicitly.
+
+This module is the Python-native twin for the Phase 3 thin-manifest pilot
+(docs/PYTHON_HYBRID_ROADMAP.md); Backup-FileToTimestampDir remains the live
+implementation today.
+"""
+
+import os
+import shutil
+import time
+
+
+def _tree_stats(path):
+    """Total bytes + file entry count for a file or a directory tree."""
+    if os.path.isfile(path):
+        return os.path.getsize(path), 1
+    total = 0
+    count = 0
+    for root, _dirs, files in os.walk(path):
+        for name in files:
+            entry = os.path.join(root, name)
+            total += os.path.getsize(entry)
+            count += 1
+    return total, count
+
+
+def _copy_once(source, destination):
+    if os.path.isdir(source):
+        shutil.copytree(source, destination, dirs_exist_ok=True)
+    else:
+        dest_parent = os.path.dirname(destination)
+        if dest_parent:
+            os.makedirs(dest_parent, exist_ok=True)
+        shutil.copy2(source, destination)
+
+
+def backup_to_timestamped_dir(source, backup_root, label, attempts=6, backoff_ms=500):
+    """Copy `source` (file or tree) to backup_root/label with lock retries.
+
+    The backup root and label mirror the PS contract: the CALLER owns the
+    timestamp (<app>\\ID_Backups\\<ts>\\<label>); this function only ensures
+    the destination parent exists and never clobbers semantics beyond -Force
+    (an existing destination is overwritten, matching Copy-Item -Force).
+
+    Returns a report dict:
+      {"ok": bool, "skipped": bool, "destination": str|None,
+       "error": None|"not-found"|"locked"|"verify"|"io", "detail": str}
+    skipped=True means the source was absent — the caller's [SKIP] path.
+    "locked" means every attempt hit a lock: the caller may proceed with the
+    deletion it was backing up for (the file may be deletable even though the
+    copy could not read it — the PS contract note verbatim).
+    """
+    report = {"ok": False, "skipped": False, "destination": None,
+              "error": None, "detail": ""}
+
+    if not os.path.exists(source):
+        report["skipped"] = True
+        report["detail"] = "source not present"
+        return report
+
+    destination = os.path.join(backup_root, label)
+    dest_parent = os.path.dirname(destination)
+    if dest_parent:
+        os.makedirs(dest_parent, exist_ok=True)
+
+    last_error = ""
+    for attempt in range(attempts):
+        try:
+            _copy_once(source, destination)
+            src_bytes, src_entries = _tree_stats(source)
+            dst_bytes, dst_entries = _tree_stats(destination)
+            if (src_bytes, src_entries) != (dst_bytes, dst_entries):
+                shutil.rmtree(destination, ignore_errors=True) \
+                    if os.path.isdir(destination) else \
+                    (os.remove(destination) if os.path.exists(destination) else None)
+                report["error"] = "verify"
+                report["detail"] = (
+                    "copied bytes/entries mismatch: src {!r} dst {!r}"
+                    .format((src_bytes, src_entries), (dst_bytes, dst_entries)))
+                return report
+            report["ok"] = True
+            report["destination"] = destination
+            return report
+        except OSError as exc:
+            last_error = str(exc)
+            if attempt + 1 < attempts:
+                time.sleep(backoff_ms * (attempt + 1) / 1000.0)
+
+    report["error"] = "locked"
+    report["detail"] = "backup skipped after {} retries (file locked?): {} -- {}".format(
+        attempts, source, last_error)
+    return report
diff --git a/src/python/ghost/filesweep.py b/src/python/ghost/filesweep.py
new file mode 100644
index 0000000..8e8e30c
--- /dev/null
+++ b/src/python/ghost/filesweep.py
@@ -0,0 +1,214 @@
+"""File sweep operations — ports of the cursor file-identity helpers.
+
+Ports (with their PS provenance):
+- remove_verified          <- Remove-VerifiedFileNoBackup (reset_cursor.ps1)
+- remove_identity_store    <- Clear-BinaryIdentityStore (identity_utils.ps1),
+                              one path per call (the PS iterates a list)
+- sweep_tree               <- Clear-TreeFilesIndividually (reset_cursor.ps1)
+
+Never silent-success: every function returns a report whose ok flag is
+decided by a re-read of the filesystem, never by "the call did not throw".
+Missing sources report skipped=True with ok=True (the caller's [SKIP] path),
+mirroring the PS audit convention (before="missing", after="skipped").
+
+This module is the Python-native twin for the Phase 3 thin-manifest pilot
+(docs/PYTHON_HYBRID_ROADMAP.md); the PS originals remain live until the
+reset_cursor manifest switches over.
+"""
+
+import contextlib
+import os
+import shutil
+import time
+
+from ghost.backup import backup_to_timestamped_dir
+
+_DELETE_ATTEMPTS = 6      # matches Clear-BinaryIdentityStore's retry curve
+_SWEEP_ATTEMPTS = 4       # matches Clear-TreeFilesIndividually
+_BACKOFF_MS = 500
+
+
+def _sleep_backoff(attempt):
+    time.sleep(_BACKOFF_MS * (attempt + 1) / 1000.0)
+
+
+def _delete_path(path):
+    """One delete attempt for a file or tree; raises OSError on failure."""
+    if os.path.isdir(path) and not os.path.islink(path):
+        shutil.rmtree(path)
+    else:
+        os.remove(path)
+
+
+def _backup_label_for(path, root_path):
+    """Get-PathBackupLabel twin: drive-prefixed relative path, or paths/<name>."""
+    root = os.path.splitdrive(path)[0] + os.sep if os.path.splitdrive(path)[0] else ""
+    if root_path:
+        norm_root = root_path.rstrip("\\/") + os.sep
+        if path.lower().startswith(norm_root.lower()):
+            return path[len(norm_root):]
+    if not root:
+        return os.path.join("paths", os.path.basename(path))
+    drive = root.rstrip("\\/").replace(":", "")
+    relative = path[len(root):].lstrip("\\/")
+    if not relative:
+        return os.path.join("paths", drive)
+    return os.path.join(drive, relative)
+
+
+def remove_verified(path):
+    """Delete a file (no backup) and verify by re-reading.
+
+    One attempt, silent-failure semantics — the PS original relies on
+    Remove-Item -ErrorAction SilentlyContinue then re-checks; so do we.
+    """
+    report = {"ok": False, "skipped": False, "before": "missing",
+              "after": "skipped", "path": path, "error": None}
+    if not os.path.exists(path) and not os.path.islink(path):
+        report["ok"] = True
+        report["skipped"] = True
+        return report
+    report["before"] = "present"
+    with contextlib.suppress(OSError):
+        _delete_path(path)
+    if not os.path.exists(path) and not os.path.islink(path):
+        report["ok"] = True
+        report["after"] = "deleted"
+        return report
+    report["after"] = "delete-failed"
+    report["error"] = "path still present after delete"
+    return report
+
+
+def remove_identity_store(path, action, backup_root, backup_label=None,
+                          root_path=None, attempts=_DELETE_ATTEMPTS):
+    """Clear-BinaryIdentityStore twin for one path: backup, then rename to
+    '<path>.backup' (clobbering a stale one first) or delete, with the same
+    6-attempt backoff. A failed/locked backup does NOT stop the operation —
+    the PS contract note verbatim (the caller may still delete a file whose
+    copy could not be read).
+
+    action: "rename" | "delete".
+    """
+    report = {"ok": False, "skipped": False, "action": action, "path": path,
+              "before": "missing", "after": "skipped", "backed_up_to": None,
+              "backup_error": None, "renamed_to": None, "error": None,
+              "detail": ""}
+    if not os.path.exists(path) and not os.path.islink(path):
+        report["ok"] = True
+        report["skipped"] = True
+        return report
+    report["before"] = "present"
+
+    label = backup_label or _backup_label_for(path, root_path)
+    backup_report = backup_to_timestamped_dir(path, backup_root, label)
+    if backup_report["ok"]:
+        report["backed_up_to"] = backup_report["destination"]
+    elif not backup_report["skipped"]:
+        report["backup_error"] = backup_report["error"]
+
+    if action == "rename":
+        renamed = path + ".backup"
+        with contextlib.suppress(OSError):
+            _delete_path(renamed)
+        last_error = ""
+        for attempt in range(attempts):
+            try:
+                os.rename(path, renamed)
+                if os.path.exists(path) or not os.path.exists(renamed):
+                    raise OSError("rename did not take effect")
+                report["ok"] = True
+                report["after"] = "renamed to " + renamed
+                report["renamed_to"] = renamed
+                return report
+            except OSError as exc:
+                last_error = str(exc)
+                if attempt + 1 < attempts:
+                    _sleep_backoff(attempt)
+        report["after"] = "rename-failed: " + last_error
+        report["error"] = last_error
+        return report
+
+    last_error = ""
+    for attempt in range(attempts):
+        try:
+            _delete_path(path)
+            if not os.path.exists(path) and not os.path.islink(path):
+                report["ok"] = True
+                report["after"] = "deleted"
+                return report
+            last_error = "path still present after delete"
+        except OSError as exc:
+            last_error = str(exc)
+        if attempt + 1 < attempts:
+            _sleep_backoff(attempt)
+    report["after"] = "delete-failed: " + last_error
+    report["error"] = last_error
+    return report
+
+
+def sweep_tree(path, backup_root, backup_label, attempts=_SWEEP_ATTEMPTS):
+    """Clear-TreeFilesIndividually twin: back up the whole tree (best-effort),
+    then delete every file inside it one by one with a per-file retry curve,
+    then remove the emptied directories bottom-up and the tree root itself —
+    the PS original leaves NO tree behind.
+    """
+    report = {"ok": False, "skipped": False, "path": path, "before": "missing",
+              "after": "skipped", "deleted": 0, "failed": 0, "remaining": 0,
+              "failed_paths": [], "backed_up_to": None, "error": None}
+    if not os.path.isdir(path):
+        report["ok"] = True
+        report["skipped"] = True
+        return report
+    report["before"] = "present"
+
+    backup_report = backup_to_timestamped_dir(path, backup_root, backup_label)
+    if backup_report["ok"]:
+        report["backed_up_to"] = backup_report["destination"]
+
+    files = []
+    for root, _dirs, names in os.walk(path):
+        for name in names:
+            files.append(os.path.join(root, name))
+
+    for file_path in files:
+        last_error = ""
+        for attempt in range(attempts):
+            try:
+                os.remove(file_path)
+                last_error = ""
+                break
+            except OSError as exc:
+                last_error = str(exc)
+                if attempt + 1 < attempts:
+                    _sleep_backoff(attempt)
+        if last_error:
+            report["failed"] += 1
+            report["failed_paths"].append(file_path)
+        else:
+            report["deleted"] += 1
+
+    # The PS original then removes the emptied directories (deepest first)
+    # and the tree root itself - the tree must not survive the sweep.
+    dirs = []
+    for root, _dirs, _names in os.walk(path):
+        dirs.append(root)
+    dirs.sort(key=len, reverse=True)
+    for directory in dirs:
+        with contextlib.suppress(OSError):
+            os.rmdir(directory)
+    with contextlib.suppress(OSError):
+        os.rmdir(path)
+
+    remaining = 0
+    for root, _dirs, names in os.walk(path):
+        remaining += len(names)
+    report["remaining"] = remaining
+    if report["failed"] == 0 and remaining == 0:
+        report["ok"] = True
+        report["after"] = "swept"
+    else:
+        report["after"] = "sweep-incomplete"
+        report["error"] = "{} file(s) failed, {} remained".format(
+            report["failed"], remaining)
+    return report
diff --git a/src/python/ghost/restore.py b/src/python/ghost/restore.py
index 7dde283..13db1ba 100644
--- a/src/python/ghost/restore.py
+++ b/src/python/ghost/restore.py
@@ -86,6 +86,8 @@ def new_restore_script(backup_root, app, actions):
     # with a quote, so this is structurally safe, but assert anyway.
     assert "\n'@" not in manifest_json
 
-    with open(restore_path, "w", encoding="utf-8", newline="\r\n") as f:
+    # UTF-8 WITH BOM: PowerShell 5.1 decodes BOM-less files as ANSI, so a
+    # BOM-less restore script mangles non-ASCII profile paths in rollback.
+    with open(restore_path, "w", encoding="utf-8-sig", newline="\r\n") as f:
         f.write(script)
     return restore_path
diff --git a/src/python/ghost/sqlite_keys.py b/src/python/ghost/sqlite_keys.py
index 9f250e1..95cc75a 100644
--- a/src/python/ghost/sqlite_keys.py
+++ b/src/python/ghost/sqlite_keys.py
@@ -85,27 +85,38 @@ def sqlite_update(db_path, updates, table="ItemTable"):
     return {"before": before, "after": after}
 
 
-def delete_secrets(db_path):
+def delete_secrets(db_path, exact_keys=None, like_patterns=None, escape=None):
     """DELETE auth-secret keys from ItemTable and verify zero survivors via
     read-only reopen. Returns {"deleted": [...], "survivors": [...]} where
     survivors is the per-pattern/per-key COUNT(*) list (all zeros on
-    success)."""
-    patterns = SECRETS_LIKE_PATTERNS
-    target_keys = SECRETS_TARGET_KEYS
+    success).
+
+    exact_keys / like_patterns default to the module's Cursor constants.
+    escape: an ESCAPE character for the LIKE patterns (e.g. "\\") — needed
+    when a pattern contains a literal underscore, which LIKE treats as a
+    single-character wildcard (the Windsurf/Devin auth patterns use
+    "windsurf\\_auth-%" etc. and pass escape="\\").
+    """
+    if like_patterns is None:
+        like_patterns = SECRETS_LIKE_PATTERNS
+    if exact_keys is None:
+        exact_keys = SECRETS_TARGET_KEYS
+    escape_clause = " ESCAPE '\\'" if escape else ""
     deleted = []
 
     conn = sqlite3.connect(db_path, timeout=10)
     try:
         cursor = conn.cursor()
-        for pattern in patterns:
+        for pattern in like_patterns:
             cursor.execute(
-                "SELECT key FROM ItemTable WHERE key LIKE ?", (pattern,))
+                "SELECT key FROM ItemTable WHERE key LIKE ?" + escape_clause,
+                (pattern,))
             for row in cursor.fetchall():
                 key = row[0]
                 cursor.execute(
                     "DELETE FROM ItemTable WHERE key = ?", (key,))
                 deleted.append(key)
-        for key in target_keys:
+        for key in exact_keys:
             cursor.execute("DELETE FROM ItemTable WHERE key = ?", (key,))
             deleted.append(key)
         conn.commit()
@@ -116,12 +127,12 @@ def delete_secrets(db_path):
     try:
         verify_cursor = verify_conn.cursor()
         survivors = []
-        for pattern in patterns:
+        for pattern in like_patterns:
             verify_cursor.execute(
-                "SELECT COUNT(*) FROM ItemTable WHERE key LIKE ?",
+                "SELECT COUNT(*) FROM ItemTable WHERE key LIKE ?" + escape_clause,
                 (pattern,))
             survivors.append(verify_cursor.fetchone()[0])
-        for key in target_keys:
+        for key in exact_keys:
             verify_cursor.execute(
                 "SELECT COUNT(*) FROM ItemTable WHERE key = ?", (key,))
             survivors.append(verify_cursor.fetchone()[0])
@@ -140,7 +151,9 @@ def clear_cli_telemetry(db_path):
     the step FAILED when "error" is present). A missing ItemTable table is
     tolerated per-pattern; every other sqlite error (locked db, corruption)
     surfaces via the error dict instead of being silently swallowed.
-    Returns {"deleted": N} or {"deleted": 0, "error": str}."""
+    Returns {"deleted": N, "remaining": 0} on success, or an "error" dict
+    when sqlite fails (pre-mutation failures keep deleted=0) or the
+    verify-after re-open still finds matching keys."""
     deleted = 0
     patterns = CLI_TELEMETRY_PATTERNS
 
@@ -169,7 +182,36 @@ def clear_cli_telemetry(db_path):
     finally:
         conn.close()
 
-    return {"deleted": deleted}
+    # Verify-after (module invariant): re-open read-only and count what still
+    # matches. "remaining" is additive; anything left is surfaced through the
+    # error dict so reset_zcode marks the step FAILED instead of trusting a
+    # delete that did not stick.
+    try:
+        verify_conn = _ro_connect(db_path)
+        try:
+            verify_cursor = verify_conn.cursor()
+            remaining = 0
+            for pattern in patterns:
+                try:
+                    verify_cursor.execute(
+                        "SELECT COUNT(*) FROM ItemTable WHERE key LIKE ?",
+                        (pattern,))
+                except sqlite3.OperationalError as exc:
+                    if "no such table" not in str(exc):
+                        raise
+                    continue
+                remaining += verify_cursor.fetchone()[0]
+        finally:
+            verify_conn.close()
+    except sqlite3.Error as exc:
+        return {"deleted": deleted, "remaining": 0,
+                "error": "verify-after failed: " + str(exc)}
+
+    if remaining:
+        return {"deleted": deleted, "remaining": remaining,
+                "error": "{0} telemetry key(s) still match after commit".format(
+                    remaining)}
+    return {"deleted": deleted, "remaining": 0}
 
 
 def chat_check(mode, shared_db, tasks_index=None):
diff --git a/src/python/ghost/winstore.py b/src/python/ghost/winstore.py
new file mode 100644
index 0000000..53838fc
--- /dev/null
+++ b/src/python/ghost/winstore.py
@@ -0,0 +1,380 @@
+"""Windows store JSON/text mutations — ports of the cursor identity helpers.
+
+Ports (with their PS provenance):
+- write_machineid_file  <- Set-VerifiedMachineIdFile (reset_cursor.ps1)
+- rotate_device_id_salt <- Set-DeviceIdSalt (reset_cursor.ps1), key
+  electron.media.device_id_salt, nested dicts created when missing
+- remove_json_keys      <- Remove-OsCryptEncryptedKey (reset_cursor.ps1),
+  generalized to dotted key paths
+
+Every mutation: backup (best-effort — a locked backup is reported but does
+NOT stop the mutation, the PS contract), mutate, then verify by RE-READING
+the file. Never silent-success. JSON files are read utf-8-sig (BOM tolerated)
+and written as BOM-less UTF-8 with indent=2, matching json_patch.
+
+This module is the Python-native twin for the Phase 3 thin-manifest pilot
+(docs/PYTHON_HYBRID_ROADMAP.md); the PS originals remain live until the
+reset_cursor manifest switches over.
+"""
+
+import json
+import os
+import secrets
+
+from ghost.backup import backup_to_timestamped_dir
+
+
+def _load_json(path):
+    with open(path, "r", encoding="utf-8-sig") as f:
+        return json.load(f)
+
+
+def _write_json(path, content):
+    with open(path, "w", encoding="utf-8", newline="") as f:
+        json.dump(content, f, indent=2, ensure_ascii=False)
+        f.write("\n")
+
+
+def _write_raw(path, text):
+    with open(path, "w", encoding="utf-8", newline="") as f:
+        f.write(text)
+
+
+def _read_raw(path):
+    with open(path, "r", encoding="utf-8-sig") as f:
+        return f.read()
+
+
+def _maybe_backup(path, backup_root, label, report):
+    backup_report = backup_to_timestamped_dir(path, backup_root, label)
+    if backup_report["ok"]:
+        report["backed_up_to"] = backup_report["destination"]
+    elif not backup_report["skipped"]:
+        report["backup_error"] = backup_report["error"]
+    return bool(backup_report["ok"])
+
+
+def write_machineid_file(path, value, backup_root, label):
+    """Set-VerifiedMachineIdFile twin: backup (if present), write the value
+    BOM-less UTF-8, then verify by re-reading and trimming.
+    """
+    report = {"ok": False, "skipped": False, "before": None, "after": None,
+              "backed_up_to": None, "backup_error": None, "error": None}
+    if os.path.exists(path):
+        with open(path, "r", encoding="utf-8-sig") as f:
+            report["before"] = f.read().strip()
+        backup_report = backup_to_timestamped_dir(path, backup_root, label)
+        if backup_report["ok"]:
+            report["backed_up_to"] = backup_report["destination"]
+        elif not backup_report["skipped"]:
+            report["backup_error"] = backup_report["error"]
+
+    parent = os.path.dirname(path)
+    if parent:
+        os.makedirs(parent, exist_ok=True)
+    with open(path, "w", encoding="utf-8", newline="") as f:
+        f.write(value)
+
+    with open(path, "r", encoding="utf-8-sig") as f:
+        report["after"] = f.read().strip()
+    if report["after"] == value:
+        report["ok"] = True
+    else:
+        report["error"] = "verify"
+    return report
+
+
+def rotate_device_id_salt(path, backup_root, label, new_salt=None):
+    """Set-DeviceIdSalt twin on electron.media.device_id_salt. Missing file
+    -> skipped/ok. Missing electron/media dicts are created. The salt is
+    generated internally (32 hex chars) unless the caller supplies one.
+    """
+    report = {"ok": False, "skipped": False, "before": None, "after": None,
+              "backed_up_to": None, "backup_error": None, "error": None}
+    if not os.path.exists(path):
+        report["ok"] = True
+        report["skipped"] = True
+        return report
+
+    backup_report = backup_to_timestamped_dir(path, backup_root, label)
+    if backup_report["ok"]:
+        report["backed_up_to"] = backup_report["destination"]
+    elif not backup_report["skipped"]:
+        report["backup_error"] = backup_report["error"]
+
+    try:
+        content = _load_json(path)
+    except (ValueError, OSError) as exc:
+        report["error"] = "parse: " + str(exc)
+        return report
+    if not isinstance(content, dict):
+        report["error"] = "parse: root is not an object"
+        return report
+
+    if new_salt is None:
+        new_salt = secrets.token_hex(16)
+
+    electron = content.get("electron")
+    media = electron.get("media") if isinstance(electron, dict) else None
+    if isinstance(media, dict):
+        report["before"] = media.get("device_id_salt")
+    if not isinstance(electron, dict):
+        electron = {}
+        content["electron"] = electron
+    if not isinstance(media, dict):
+        media = {}
+        electron["media"] = media
+    media["device_id_salt"] = new_salt
+
+    try:
+        _write_json(path, content)
+    except OSError as exc:
+        report["error"] = "write: " + str(exc)
+        return report
+
+    try:
+        verified = _load_json(path)
+        report["after"] = verified["electron"]["media"]["device_id_salt"]
+    except (ValueError, OSError, KeyError, TypeError) as exc:
+        report["error"] = "re-read: " + str(exc)
+        return report
+
+    if report["after"] == new_salt:
+        report["ok"] = True
+    else:
+        report["error"] = "verify"
+    return report
+
+
+def remove_json_keys(path, keys, backup_root, label):
+    """Remove-OsCryptEncryptedKey twin, generalized to dotted key paths
+    (e.g. 'os_crypt.encrypted_key'). Missing file OR missing walk -> skipped
+    with ok=True (the PS contract: os_crypt absent is a SKIP, not a failure).
+    Removing an already-absent leaf is also ok.
+    """
+    report = {"ok": False, "skipped": False, "before": {}, "removed": [],
+              "backed_up_to": None, "backup_error": None, "error": None}
+    if not os.path.exists(path):
+        report["ok"] = True
+        report["skipped"] = True
+        return report
+
+    backup_report = backup_to_timestamped_dir(path, backup_root, label)
+    if backup_report["ok"]:
+        report["backed_up_to"] = backup_report["destination"]
+    elif not backup_report["skipped"]:
+        report["backup_error"] = backup_report["error"]
+
+    try:
+        content = _load_json(path)
+    except (ValueError, OSError) as exc:
+        report["error"] = "parse: " + str(exc)
+        return report
+    if not isinstance(content, dict):
+        report["error"] = "parse: root is not an object"
+        return report
+
+    for dotted in keys:
+        parts = dotted.split(".")
+        node = content
+        missing = False
+        for part in parts[:-1]:
+            if not isinstance(node, dict) or part not in node:
+                missing = True
+                break
+            node = node[part]
+        if missing or not isinstance(node, dict) or parts[-1] not in node:
+            report["before"][dotted] = "missing"
+            continue
+        report["before"][dotted] = "present"
+        del node[parts[-1]]
+        report["removed"].append(dotted)
+
+    if report["removed"]:
+        try:
+            _write_json(path, content)
+        except OSError as exc:
+            report["error"] = "write: " + str(exc)
+            return report
+
+    # Verify-after: every requested key must now be absent on re-read.
+    try:
+        verified = _load_json(path)
+    except (ValueError, OSError) as exc:
+        report["error"] = "re-read: " + str(exc)
+        return report
+    still = []
+    for dotted in keys:
+        node = verified
+        missing = False
+        for part in dotted.split(".")[:-1]:
+            if not isinstance(node, dict) or part not in node:
+                missing = True
+                break
+            node = node[part]
+        if not missing and isinstance(node, dict) and dotted.split(".")[-1] in node:
+            still.append(dotted)
+    if still:
+        report["error"] = "verify: still present: " + ", ".join(still)
+        return report
+    report["ok"] = True
+    return report
+
+
+def set_json_path(path, dotted, value, backup_root, label, skip_if_empty=False):
+    """Set a value at a dotted key path (e.g. 'devin.org_id'), creating the
+    intermediate dicts. Clear-AppOrgBinding twin: with skip_if_empty=True a
+    currently-absent-or-empty leaf is a SKIP without touching the file (the
+    no-org-binding contract). Verify by re-read.
+    """
+    report = {"ok": False, "skipped": False, "before": None, "after": None,
+              "backed_up_to": None, "backup_error": None, "error": None}
+    if not os.path.exists(path):
+        report["ok"] = True
+        report["skipped"] = True
+        return report
+
+    try:
+        content = _load_json(path)
+    except (ValueError, OSError) as exc:
+        report["error"] = "parse: " + str(exc)
+        return report
+    if not isinstance(content, dict):
+        report["error"] = "parse: root is not an object"
+        return report
+
+    node = content
+    missing = False
+    for part in dotted.split(".")[:-1]:
+        if not isinstance(node, dict) or part not in node:
+            missing = True
+            break
+        node = node[part]
+    leaf = dotted.split(".")[-1]
+    report["before"] = node.get(leaf) if (not missing and isinstance(node, dict)) else None
+    if skip_if_empty and (report["before"] is None or report["before"] == ""):
+        report["ok"] = True
+        report["skipped"] = True
+        return report
+
+    _maybe_backup(path, backup_root, label, report)
+
+    node = content
+    for part in dotted.split(".")[:-1]:
+        if not isinstance(node.get(part), dict):
+            node[part] = {}
+        node = node[part]
+    node[leaf] = value
+
+    try:
+        _write_json(path, content)
+    except OSError as exc:
+        report["error"] = "write: " + str(exc)
+        return report
+
+    try:
+        verified = _load_json(path)
+        walk = verified
+        for part in dotted.split("."):
+            if not isinstance(walk, dict) or part not in walk:
+                report["error"] = "re-read"
+                return report
+            walk = walk[part]
+        report["after"] = walk
+    except (ValueError, OSError) as exc:
+        report["error"] = "re-read: " + str(exc)
+        return report
+
+    if report["after"] == value:
+        report["ok"] = True
+    else:
+        report["error"] = "verify"
+    return report
+
+
+def patch_argv_json(path, backup_root, label, new_id=None, username=None):
+    """Update-ArgvJsonIdentity twin for Chromium argv.json (JSONC — comments
+    allowed, never parsed as JSON): regex-replace only the
+    "crash-reporter-id" VALUE, insert the key into the trailing object when
+    absent, scrub the username out of the raw text, then verify by re-read.
+    The id is generated internally (lower GUID) unless supplied.
+    """
+    report = {"ok": False, "skipped": False, "before": None, "after": None,
+              "user_dir_scrubbed": False, "backed_up_to": None,
+              "backup_error": None, "error": None}
+    if not os.path.exists(path):
+        report["ok"] = True
+        report["skipped"] = True
+        return report
+    if new_id is None:
+        new_id = str(secrets.token_hex(4))  # placeholder, replaced below
+
+    raw = _read_raw(path)
+    import re as _re
+    before_match = _re.search(r'"crash-reporter-id"\s*:\s*"([^"]+)"', raw)
+    if before_match:
+        report["before"] = before_match.group(1)
+
+    _maybe_backup(path, backup_root, label, report)
+
+    pattern = r'"crash-reporter-id"\s*:\s*"[^"]+"'
+    replacement = '"crash-reporter-id": "' + new_id + '"'
+    if _re.search(pattern, raw):
+        new_raw = _re.sub(pattern, replacement, raw)
+    else:
+        trimmed = raw.rstrip()
+        if trimmed.endswith("}"):
+            inner = trimmed[:-1].rstrip()
+            if inner.endswith("{"):
+                new_raw = inner + '\n  ' + replacement + '\n}'
+            else:
+                new_raw = inner.rstrip(",") + ',\n  ' + replacement + '\n}'
+        else:
+            report["error"] = "unparseable: no JSON object to extend"
+            return report
+
+    if username and username in new_raw:
+        new_raw = new_raw.replace(username, "RESET")
+        report["user_dir_scrubbed"] = True
+
+    _write_raw(path, new_raw)
+
+    verify_raw = _read_raw(path)
+    verify_match = _re.search(r'"crash-reporter-id"\s*:\s*"([^"]+)"', verify_raw)
+    report["after"] = verify_match.group(1) if verify_match else None
+    if report["after"] == new_id:
+        report["ok"] = True
+    else:
+        report["error"] = "verify"
+    return report
+
+
+def replace_text(path, find, replacement, backup_root, label):
+    """Set-UsernameScrubbedFile twin: raw-text replace (never parsed — a
+    single leaked reference must not survive a partial parse), then verify
+    the `find` string is gone by re-reading. Absent file = skip-ok.
+    """
+    report = {"ok": False, "skipped": False, "before": "missing",
+              "after": "skipped", "backed_up_to": None, "backup_error": None,
+              "error": None}
+    if not os.path.exists(path):
+        report["ok"] = True
+        report["skipped"] = True
+        return report
+
+    before_text = _read_raw(path)
+    had_leak = find in before_text
+    report["before"] = "leaked" if had_leak else "clean"
+
+    if had_leak:
+        _maybe_backup(path, backup_root, label, report)
+        _write_raw(path, before_text.replace(find, replacement))
+
+    re_read = _read_raw(path)
+    if find in re_read:
+        report["after"] = "still-leaked"
+        report["error"] = "verify: find string still present"
+        return report
+    report["after"] = "clean"
+    report["ok"] = True
+    return report
diff --git a/src/windows/Launch-AutoClaw-Clone.bat b/src/windows/Launch-AutoClaw-Clone.bat
new file mode 100644
index 0000000..eccec1c
--- /dev/null
+++ b/src/windows/Launch-AutoClaw-Clone.bat
@@ -0,0 +1,29 @@
+@echo off
+chcp 65001 >nul
+title AutoClaw Clone Launcher
+:MENU
+cls
+echo  --- AutoClaw clone launcher ---
+echo.
+echo  [1] Launch inst1
+echo  [2] Launch inst2
+echo  [3] Launch inst3
+echo  [4] Launch inst4
+echo  [S] Status of all clones
+echo  [0] Exit
+echo.
+set "choice="
+set /p choice=Enter your choice:
+if not defined choice goto MENU
+if "%choice%"=="0" exit /b
+if /i "%choice%"=="S" (
+    powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0launch_autoclaw_clone.ps1" -Status
+    pause
+    goto MENU
+)
+if "%choice%"=="1" powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0launch_autoclaw_clone.ps1" -Instance inst1
+if "%choice%"=="2" powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0launch_autoclaw_clone.ps1" -Instance inst2
+if "%choice%"=="3" powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0launch_autoclaw_clone.ps1" -Instance inst3
+if "%choice%"=="4" powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0launch_autoclaw_clone.ps1" -Instance inst4
+pause
+goto MENU
diff --git a/src/windows/identity_utils.ps1 b/src/windows/identity_utils.ps1
index fb3bfe7..f2fc476 100644
--- a/src/windows/identity_utils.ps1
+++ b/src/windows/identity_utils.ps1
@@ -196,68 +196,6 @@ function Assert-Administrator {
     }
 }
 
-function Stop-AppProcesses {
-    param(
-        [Parameter(Mandatory = $true)][string[]]$Names,
-        [int]$WaitSeconds = 3
-    )
-
-    $helperMap = @{
-        Cursor   = @("Cursor")
-        Windsurf = @("Windsurf", "Devin", "codeium")
-        Trae     = @("Trae", "Trae Broker")
-    }
-
-    $expandedNames = @()
-    foreach ($name in $Names) {
-        if ($helperMap.ContainsKey($name)) {
-            $expandedNames += $helperMap[$name]
-        }
-        else {
-            $expandedNames += $name
-        }
-    }
-    $expandedNames = $expandedNames | Select-Object -Unique
-
-    for ($attempt = 1; $attempt -le 5; $attempt++) {
-        foreach ($processName in $expandedNames) {
-            $running = Get-Process -Name $processName -ErrorAction SilentlyContinue
-            if ($running) {
-                $running | Stop-Process -Force -ErrorAction SilentlyContinue
-            }
-        }
-
-        Start-Sleep -Seconds $WaitSeconds
-
-        $remaining = @()
-        foreach ($processName in $expandedNames) {
-            if (Get-Process -Name $processName -ErrorAction SilentlyContinue) {
-                $remaining += $processName
-            }
-        }
-
-        if ($remaining.Count -eq 0) {
-            $appLabel = ($Names | Select-Object -First 1)
-            Write-Host "[OK] all $appLabel processes terminated" -ForegroundColor Green
-            return $true
-        }
-    }
-
-    $failedNames = @()
-    foreach ($processName in $expandedNames) {
-        if (Get-Process -Name $processName -ErrorAction SilentlyContinue) {
-            $failedNames += $processName
-        }
-    }
-
-    if ($failedNames.Count -gt 0) {
-        Write-Host "[FAILED] could not terminate: $($failedNames -join ', ')" -ForegroundColor Red
-        exit 1
-    }
-
-    return $true
-}
-
 function Backup-FileToTimestampDir {
     param(
         [Parameter(Mandatory = $true)][string]$Source,
diff --git a/src/windows/launch_autoclaw_clone.ps1 b/src/windows/launch_autoclaw_clone.ps1
new file mode 100644
index 0000000..4aa4feb
--- /dev/null
+++ b/src/windows/launch_autoclaw_clone.ps1
@@ -0,0 +1,827 @@
+#Requires -Version 5.1
+# AutoClaw Clone Instance Launcher (inst1 / inst2 / inst3 / inst4)
+#
+# Launches a fully independent AutoClaw clone beside the Primary. Mechanism
+# (reverse-engineered + live-verified, docs/AUTOCLAW_CLONES_SPEC.md):
+#   - requestSingleInstanceLock() keys off the PROFILE DIR and this app HONOURS
+#     --user-data-dir (unlike ZCode) -> per-clone --user-data-dir is the lock
+#     separator; env vars are still the primary isolation lever (belt+braces).
+#   - Gateway state moves with the HOME: the Electron main derives
+#     ~/.openclaw-autoclaw from os.homedir(), and node's homedir() honours
+#     USERPROFILE/HOME -> per-clone USERPROFILE+HOME moves the whole state tree.
+#   - Gateway port: AUTOCLAW_GATEWAY_PORT is the supported override, but a busy
+#     port silently shifts up to +9 -> the ACTUAL bound port is read back and
+#     recorded, never assumed (no-silent-success).
+#   - MCP port: hardcoded 4-slot array widened to 8 by tools\patch_autoclaw_ports.ps1
+#     (marker-gated). inst4 has NO MCP slot without that patch.
+#   - One credential = one instance: the seed copies the Primary profile but
+#     strips every live credential (auth token, refreshToken, token-cache,
+#     paired.json never copied). Each clone needs ONE manual login on first run.
+#
+# Launch instances SEQUENTIALLY, never in parallel (spec 6b). Do NOT run this
+# elevated (UIPI; AGENTS.md ZCode rule applies equally here).
+#
+# Usage:
+#   powershell -ExecutionPolicy Bypass -File launch_autoclaw_clone.ps1 [-Instance inst1|inst2|inst3|inst4] [-Status]
+
+param(
+    [ValidateSet('inst1', 'inst2', 'inst3', 'inst4')]
+    [string]$Instance = 'inst1',
+    [switch]$Status
+)
+$ErrorActionPreference = 'Stop'
+
+# Portable paths: work for any Windows user, no hardcoded username.
+$UserProfile = $env:USERPROFILE
+if ([string]::IsNullOrWhiteSpace($UserProfile)) { $UserProfile = [Environment]::GetFolderPath('UserProfile') }
+$AppData = $env:APPDATA
+if ([string]::IsNullOrWhiteSpace($AppData)) { $AppData = Join-Path $UserProfile 'AppData\Roaming' }
+
+$AutoClawExeCandidates = @(
+    'C:\Program Files\AutoClaw\AutoClaw.exe',
+    'C:\Program Files (x86)\AutoClaw\AutoClaw.exe',
+    (Join-Path $env:LOCALAPPDATA 'Programs\AutoClaw\AutoClaw.exe')
+)
+$AutoClawExe = $AutoClawExeCandidates | Where-Object { Test-Path -LiteralPath $_ } | Select-Object -First 1
+if (-not $AutoClawExe) { throw "AutoClaw.exe not found. Checked: $($AutoClawExeCandidates -join '; ')" }
+
+$PrimaryProfile = Join-Path $AppData 'AutoClaw'          # %APPDATA%\AutoClaw (Electron profile)
+$PrimaryState   = Join-Path $UserProfile '.openclaw-autoclaw'  # gateway state (never copied)
+$CloneRoot      = Join-Path $UserProfile 'AutoClawCloneHome'
+
+# Port plan (spec section 6). MCP ports are PRIMARY-DEPENDENT: instances grab
+# the first FREE slot in start order, so the table's MCP port is only the
+# EXPECTED value when the Primary (and earlier clones) run first. The launcher
+# discovers the actual listening ports and records them.
+$InstanceMap = @{
+    'inst1' = @{ McpPort = 19682; GatewayPort = 18799 }
+    'inst2' = @{ McpPort = 19683; GatewayPort = 18810 }
+    'inst3' = @{ McpPort = 19684; GatewayPort = 18821 }
+    'inst4' = @{ McpPort = 19685; GatewayPort = 18832 }
+}
+$cfg = $InstanceMap[$Instance]
+
+$InstRoot       = Join-Path $CloneRoot $Instance
+$CloneHome      = Join-Path $InstRoot 'home'     # USERPROFILE/HOME for this instance
+$CloneProfile   = Join-Path $InstRoot 'profile'  # --user-data-dir target
+$CloneTmp       = Join-Path $InstRoot 'tmp'      # TMPDIR/TEMP/TMP
+$CloneState     = Join-Path $CloneHome '.openclaw-autoclaw'
+# Strings that identify THIS clone's processes in any CommandLine.
+$CloneMarkers   = @("*$CloneProfile*", "*$CloneHome*")
+
+# === Local helpers (self-contained: no dot-sourcing of other scripts) =========
+
+function New-HexId64 {
+    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+    try {
+        $bytes = New-Object byte[] 32
+        $rng.GetBytes($bytes)
+        return (($bytes | ForEach-Object { $_.ToString("x2") }) -join "")
+    }
+    finally {
+        if ($rng) { $rng.Dispose() }
+    }
+}
+
+function Get-AutoClawNodeCommand {
+    # Functional probe (AGENTS.md Python rule applied to node): the candidate
+    # must run --version and report v*. Fallback: the app-bundled node.exe.
+    $candidates = @()
+    $cmd = Get-Command node -ErrorAction SilentlyContinue
+    if ($cmd) { $candidates += $cmd.Source }
+    $candidates += (Join-Path (Split-Path -Parent $AutoClawExe) 'resources\node\node.exe')
+    foreach ($candidate in $candidates) {
+        if (-not (Test-Path -LiteralPath $candidate)) { continue }
+        try { $versionLine = & $candidate --version 2>$null } catch { continue }
+        if ($LASTEXITCODE -eq 0 -and $versionLine -match "^v\d") { return $candidate }
+    }
+    return $null
+}
+
+function New-Ed25519KeypairJson {
+    # Fresh ed25519 keypair matching identity\device.json's schema
+    # (SPKI 113 chars + PKCS8 119 chars, verified live). Temp .js in TEMP only.
+    param(
+        [Parameter(Mandatory = $true)][string]$NodeExe,
+        [Parameter(Mandatory = $true)][string]$DeviceId
+    )
+    $tempJs = Join-Path $env:TEMP ("autoclaw_keygen_" + [guid]::NewGuid().ToString("N").Substring(0, 8) + ".js")
+    $js = @'
+const { generateKeyPairSync, randomBytes } = require("crypto");
+const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+const out = {
+  version: 1,
+  deviceId: randomBytes(32).toString("hex"),
+  publicKeyPem: publicKey.export({ type: "spki", format: "pem" }),
+  privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }),
+  createdAtMs: Date.now()
+};
+process.stdout.write(JSON.stringify(out));
+'@
+    [System.IO.File]::WriteAllText($tempJs, $js, (New-Object System.Text.UTF8Encoding $false))
+    try {
+        $jsonText = & $NodeExe $tempJs 2>$null
+        if ($LASTEXITCODE -ne 0) { throw "node keygen failed (exit $LASTEXITCODE)" }
+        $keypair = ($jsonText -join "") | ConvertFrom-Json
+        if ($DeviceId) { $keypair.deviceId = $DeviceId }
+        if ($keypair.publicKeyPem.Length -ne 113 -or $keypair.privateKeyPem.Length -ne 119) {
+            throw ("keygen verify FAILED: PEM lengths {0}/{1} (expected 113/119)" -f $keypair.publicKeyPem.Length, $keypair.privateKeyPem.Length)
+        }
+        if ($keypair.deviceId -notmatch "^[0-9a-f]{64}$") { throw "keygen verify FAILED: deviceId is not 64-hex" }
+        return $keypair
+    }
+    finally {
+        if (Test-Path -LiteralPath $tempJs) { Remove-Item -LiteralPath $tempJs -Force }
+    }
+}
+
+function Resolve-JsonPropertyPath {
+    param(
+        [Parameter(Mandatory = $true)]$Root,
+        [Parameter(Mandatory = $true)][string]$DottedPath,
+        [switch]$CreateMissing
+    )
+    $segments = $DottedPath.Split('.')
+    $current = $Root
+    for ($i = 0; $i -lt $segments.Count - 1; $i++) {
+        $segment = $segments[$i]
+        if ($null -ne $current.PSObject.Properties[$segment]) {
+            $next = $current.$segment
+            if ($next -isnot [PSCustomObject]) { throw ("path segment '{0}' of '{1}' is not an object" -f $segment, $DottedPath) }
+            $current = $next
+        }
+        elseif ($CreateMissing) {
+            $next = [pscustomobject]@{ }
+            Add-Member -InputObject $current -NotePropertyName $segment -NotePropertyValue $next
+            $current = $next
+        }
+        else { return $null }
+    }
+    return @{ Container = $current; Leaf = $segments[$segments.Count - 1] }
+}
+
+function Set-NestedJsonVerified {
+    # backup -> mutate dotted keys -> no-BOM write -> verify-after re-read.
+    param(
+        [Parameter(Mandatory = $true)][string]$Path,
+        [Parameter(Mandatory = $true)][hashtable]$Updates,
+        [string]$BackupPath
+    )
+    if ($BackupPath) {
+        $parent = Split-Path -Path $BackupPath -Parent
+        if (-not [string]::IsNullOrWhiteSpace($parent)) { New-Item -Path $parent -ItemType Directory -Force | Out-Null }
+        Copy-Item -LiteralPath $Path -Destination $BackupPath -Force
+    }
+    $content = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
+    foreach ($key in $Updates.Keys) {
+        $loc = Resolve-JsonPropertyPath -Root $content -DottedPath $key -CreateMissing
+        $leaf = $loc.Leaf
+        if ($null -ne $loc.Container.PSObject.Properties[$leaf]) { $loc.Container.$leaf = $Updates[$key] }
+        else { Add-Member -InputObject $loc.Container -NotePropertyName $leaf -NotePropertyValue $Updates[$key] }
+    }
+    [System.IO.File]::WriteAllText($Path, ($content | ConvertTo-Json -Depth 20), (New-Object System.Text.UTF8Encoding $false))
+    $verify = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
+    $allOk = $true
+    foreach ($key in $Updates.Keys) {
+        $loc = Resolve-JsonPropertyPath -Root $verify -DottedPath $key
+        $actual = $null
+        if ($loc -and ($null -ne $loc.Container.PSObject.Properties[$loc.Leaf])) { $actual = $loc.Container.($loc.Leaf) }
+        if ($actual -ne $Updates[$key]) { $allOk = $false }
+    }
+    return $allOk
+}
+
+function Get-CloneSubtreePids {
+    # Candidate roots + TREE-LEVEL attribution. PROCESS MARKERS first (the ZCode
+    # lesson), hardened after the live 2026-10-15 verify miss (a running clone
+    # that cmdline classification failed to see for its whole 30s window):
+    #   - empty-cmdline AutoClaw.exe mains are CANDIDATES (WMI race - the ZCode
+    #     rule), attributed only via evidence below; the Primary can never carry
+    #     a clone marker, so a raced Primary tree cannot be misattributed.
+    #   - marker match is TREE-LEVEL: a main whose own CommandLine lost the flag
+    #     is still ours when any descendant carries it.
+    #   - NewPids (pids that appeared after OUR launch) attribute their tree.
+    param(
+        [string[]]$Markers,
+        [int[]]$NewPids = @()
+    )
+
+    $all = @(Get-CimInstance Win32_Process -ErrorAction SilentlyContinue)
+    $byId = @{ }
+    $byParent = @{ }
+    foreach ($p in $all) {
+        $pidInt = [int]$p.ProcessId
+        $byId[$pidInt] = $p
+        $ppid = [int]$p.ParentProcessId
+        if (-not $byParent.ContainsKey($ppid)) { $byParent[$ppid] = @() }
+        $byParent[$ppid] += $p
+    }
+
+    $candidates = @($all | Where-Object {
+        $procCmd = [string]$_.CommandLine
+        $_.Name -eq "AutoClaw.exe" -and (
+            [string]::IsNullOrWhiteSpace($procCmd) -or
+            (($Markers | Where-Object { $procCmd -like $_ }) -ne $null) -or
+            ($NewPids -contains [int]$_.ProcessId))
+    })
+
+    if ($candidates.Count -eq 0) { return @() }
+
+    $result = New-Object "System.Collections.Generic.HashSet[int]"
+    foreach ($c in $candidates) {
+        $rootId = [int]$c.ProcessId
+        if ($result.Contains($rootId)) { continue }
+
+        $members = New-Object "System.Collections.Generic.HashSet[int]"
+        [void]$members.Add($rootId)
+        $queue = New-Object System.Collections.Queue
+        $queue.Enqueue($rootId)
+        while ($queue.Count -gt 0) {
+            $id = [int]$queue.Dequeue()
+            if (-not $byParent.ContainsKey($id)) { continue }
+            foreach ($child in $byParent[$id]) {
+                $cid = [int]$child.ProcessId
+                if ($members.Add($cid)) { $queue.Enqueue($cid) }
+            }
+        }
+
+        $attributed = ($NewPids -contains $rootId)
+        if (-not $attributed) {
+            foreach ($m in $members) {
+                $proc = $byId[$m]
+                if (-not $proc) { continue }
+                $procCmd = [string]$proc.CommandLine
+                if (-not [string]::IsNullOrWhiteSpace($procCmd) -and
+                    (($Markers | Where-Object { $procCmd -like $_ }) -ne $null)) {
+                    $attributed = $true
+                    break
+                }
+            }
+        }
+        if ($attributed) {
+            foreach ($m in $members) { [void]$result.Add($m) }
+        }
+    }
+    return @($result)
+}
+
+function Test-ProfileLockHeld {
+    # WMI-independent liveness evidence: Chromium holds profile\lockfile with no
+    # sharing, so an exclusive open fails ONLY while a live instance owns it.
+    # The file REMAINS on disk after an unclean exit (verified 2026-10-15), so
+    # existence proves nothing - the open attempt is the signal.
+    param([string]$ProfileDir)
+    $lockPath = Join-Path $ProfileDir 'lockfile'
+    if (-not (Test-Path -LiteralPath $lockPath)) { return $false }
+    try {
+        $fs = [System.IO.File]::Open($lockPath, 'Open', 'Read', 'None')
+        if ($fs) { $fs.Close() }
+        return $false
+    }
+    catch { return $true }
+}
+
+function Get-CloneListeningPorts {
+    param(
+        [int[]]$SubtreePids,
+        [int]$MinPort,
+        [int]$MaxPort
+    )
+    if ($SubtreePids.Count -eq 0) { return @() }
+    try {
+        $ports = @(Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
+            Where-Object { $_.LocalPort -ge $MinPort -and $_.LocalPort -le $MaxPort -and ($SubtreePids -contains $_.OwningProcess) } |
+            Select-Object -ExpandProperty LocalPort -Unique | Sort-Object)
+        return $ports
+    }
+    catch { return @() }
+}
+
+function Test-HttpHealth {
+    param([int]$Port, [int]$TimeoutSec = 3)
+    try {
+        $resp = Invoke-WebRequest -Uri ("http://127.0.0.1:{0}/health" -f $Port) -UseBasicParsing -TimeoutSec $TimeoutSec
+        return @{ Ok = $true; Body = $resp.Content }
+    }
+    catch { return @{ Ok = $false; Body = $_.Exception.Message } }
+}
+
+function Get-JsonMemberValue {
+    param($Object, [string]$Name)
+    if ($null -eq $Object) { return $null }
+    if ($null -ne $Object.PSObject.Properties[$Name]) { return $Object.$Name }
+    return $null
+}
+
+# === -Status mode (read-only) ==================================================
+
+if ($Status) {
+    $markerPath = Join-Path (Split-Path -Parent $AutoClawExe) 'resources\autoclaw-ports-patch.marker.json'
+    Write-Host "=== AutoClaw clones status ===" -ForegroundColor Cyan
+    Write-Host ("Exe: {0}" -f $AutoClawExe)
+    Write-Host ("MCP port patch: {0}" -f $(if (Test-Path -LiteralPath $markerPath) { "APPLIED ($(Get-Content -LiteralPath $markerPath -Raw | ConvertFrom-Json | ForEach-Object { 'engine v' + $_.patchVersion }))" } else { "NOT APPLIED (max 3 clones with distinct MCP slots)" }))
+    foreach ($name in @('inst1', 'inst2', 'inst3', 'inst4')) {
+        $row = $InstanceMap[$name]
+        $root = Join-Path $CloneRoot $name
+        $homeDir = Join-Path $root 'home'
+        $prof = Join-Path $root 'profile'
+        Write-Host ""
+        Write-Host ("--- {0} (gateway req {1}) ---" -f $name, $row.GatewayPort) -ForegroundColor White
+        Write-Host ("  profile exists: {0}" -f (Test-Path -LiteralPath (Join-Path $prof 'auth.json')))
+        $pids = Get-CloneSubtreePids -Markers @("*$prof*", "*$homeDir*")
+        Write-Host ("  processes: {0}" -f $(if ($pids.Count) { $pids -join "," } else { "not running" }))
+        if ($pids.Count) {
+            $mcp = Get-CloneListeningPorts -SubtreePids $pids -MinPort 19681 -MaxPort 19688
+            $gw = Get-CloneListeningPorts -SubtreePids $pids -MinPort $row.GatewayPort -MaxPort ($row.GatewayPort + 9)
+            foreach ($port in @($mcp + $gw)) {
+                $h = Test-HttpHealth -Port $port
+                Write-Host ("  listening {0}: /health {1}" -f $port, $(if ($h.Ok) { "OK " + $h.Body } else { "FAIL (" + $h.Body + ")" }))
+            }
+            if (($mcp.Count + $gw.Count) -eq 0) { Write-Host "  no MCP/gateway ports found in expected ranges" -ForegroundColor Yellow }
+        }
+        $recordPath = Join-Path $root 'instance-record.json'
+        if (Test-Path -LiteralPath $recordPath) {
+            $rec = Get-Content -LiteralPath $recordPath -Raw | ConvertFrom-Json
+            Write-Host ("  last record: mcp={0} gateway={1} (requested {2}) at {3}" -f $rec.actualMcpPort, $rec.actualGatewayPort, $rec.requestedGatewayPort, $rec.launchedAt)
+        }
+    }
+    exit 0
+}
+
+# === Launch flow ================================================================
+
+if (-not (Test-Path -LiteralPath (Join-Path $PrimaryProfile 'auth.json'))) {
+    throw "Primary AutoClaw profile not found ($PrimaryProfile\auth.json). Launch the Primary once first."
+}
+
+foreach ($dir in @($InstRoot, $CloneHome, $CloneProfile, $CloneTmp)) {
+    New-Item -ItemType Directory -Path $dir -Force | Out-Null
+}
+
+$NodeExe = $null
+# Seed-completion marker, written only AFTER the full seed+scrub verified.
+# needsSeed keyed on auth.json alone let an aborted robocopy's PARTIAL profile
+# (auth.json present, stores inconsistent) pass as seeded and launch broken -
+# verified live 2026-10-15 (app died within seconds on a half-copied profile).
+$seedMarker = Join-Path $CloneHome '.autoclaw-seeded'
+$reconMarker = Join-Path $CloneHome '.autoclaw-credentials-reconciled'
+$needsSeed = -not (Test-Path -LiteralPath $seedMarker)
+
+# Is this clone already running? Re-launching focuses the existing window and
+# exits (single-instance lock is keyed on the profile dir) - report, don't relaunch.
+# The lockfile-held probe is REQUIRED evidence: AutoClaw scrubs its PEB command
+# line (WMI CommandLine is permanently empty for it), so the marker-based subtree
+# match cannot see a running clone - only its exclusively-held profile lockfile can.
+$runningPids = Get-CloneSubtreePids -Markers $CloneMarkers
+if (($runningPids.Count -gt 0) -or (Test-ProfileLockHeld -ProfileDir $CloneProfile)) {
+    $runningHow = $(if ($runningPids.Count -gt 0) { $runningPids -join ', ' } else { 'profile lockfile held' })
+    Write-Host "[launch] $Instance already running ($runningHow) - nothing to do."
+    Write-Host "         Use -Status for ports, or reset_autoclaw.ps1 -Target $Instance to reset it."
+    exit 0
+}
+
+# 1) One-time seed: copy the Primary profile so the clone opens with the user's
+#    chats/projects. Credential stores are EXCLUDED - one credential = one
+#    instance (spec section 8 outranks the section 7.2 exclude list: the live
+#    token/refreshToken live in token-cache.json and *.backup files too).
+if ($needsSeed) {
+    # The first-run seed copies a live Chromium profile - leveldb LOCK files and
+    # open databases CANNOT be copied while the PRIMARY runs (robocopy exit >= 8,
+    # verified live 2026-10-15). Gate on the PRIMARY's profile lockfile, NEVER on
+    # "any AutoClaw.exe running": clones hold their OWN profile lockfile and never
+    # lock the Primary's files, but their processes are also named AutoClaw.exe -
+    # the any-process check blocked every later clone's first launch for the full
+    # 180s window and then aborted with the Primary actually closed (live-verified
+    # 2026-10-17: inst1 running made inst2/3/4 unlaunchable - cmd flash, no app).
+    # A clean Primary exit leaves no lockfile; while running it holds it
+    # exclusively (lockfile-held semantics verified on a live clone 2026-10-17).
+    if (Test-ProfileLockHeld -ProfileDir $PrimaryProfile) {
+        Write-Host "[seed] the PRIMARY AutoClaw is running - the FIRST-RUN seed needs it closed (locked profile files)." -ForegroundColor Yellow
+        Write-Host "[seed] Waiting up to 180s for the Primary to close (running clones do NOT block the seed)..."
+        $primaryClosed = $false
+        for ($i = 0; $i -lt 36; $i++) {
+            Start-Sleep -Seconds 5
+            if (-not (Test-ProfileLockHeld -ProfileDir $PrimaryProfile)) { $primaryClosed = $true; break }
+        }
+        if (-not $primaryClosed) {
+            throw "[seed] an AutoClaw instance is holding the PRIMARY profile. Close every AutoClaw window EXCEPT the clones - including any Primary window that opened by itself (the browser extension's native host spawns one on reconnect; live-verified 2026-10-17). Then re-run the launcher (first run only)."
+        }
+        Start-Sleep -Seconds 3   # let file handles release
+    }
+    # A partial profile from an aborted earlier seed is never a working profile
+    # (needsSeed = no auth.json) - clear it so robocopy starts clean, and drop
+    # the reconcile marker with it so the next run's state is coherent.
+    if (Test-Path -LiteralPath $CloneProfile) {
+        Write-Host "[seed] Clearing partial profile from an aborted earlier seed..."
+        Remove-Item -LiteralPath $CloneProfile -Recurse -Force
+    }
+    if (Test-Path -LiteralPath $reconMarker) { Remove-Item -LiteralPath $reconMarker -Force }
+    Write-Host "[seed] First run for ${Instance}: cloning Primary profile -> $CloneProfile (excluding live locks)..."
+    robocopy $PrimaryProfile $CloneProfile /E `
+        /XD 'logs' 'Cache' 'Code Cache' 'GPUCache' 'DawnGraphiteCache' 'DawnWebGPUCache' `
+        /XF '*.log' 'lockfile' 'LOCK' 'auth.json.backup' 'token-cache.json' 'token-cache.json.backup' 'settings.json.backup*' | Out-Null
+    if ($LASTEXITCODE -ge 8) {
+        Remove-Item -LiteralPath $CloneProfile -Recurse -Force -ErrorAction SilentlyContinue
+        throw "[seed] robocopy failed with exit code $LASTEXITCODE -- partial profile removed; close AutoClaw and re-run"
+    }
+    # Remove copied SQLite journals so the clone starts from a consistent checkpoint
+    Get-ChildItem -Path $CloneProfile -Recurse -Force -ErrorAction SilentlyContinue |
+        Where-Object { $_.Name -like '*-shm' -or $_.Name -like '*-wal' } |
+        ForEach-Object { Remove-Item -LiteralPath $_.FullName -Force -ErrorAction SilentlyContinue }
+    Write-Host "[seed] Clone complete. The gateway state tree ($CloneState) is NOT copied - fresh identity."
+    if (-not (Test-Path -LiteralPath (Join-Path $CloneProfile 'auth.json'))) {
+        throw "[seed] verify FAILED: seed profile has no auth.json - aborting before launch"
+    }
+}
+
+# 2) Seed-scrub: rotate every identity-bearing value, keep the history, carry no
+#    live credential. Verify-after re-read on each write.
+if ($needsSeed) {
+    Write-Host "[seed-scrub] Rotating cloned identity values (fresh independent IDs)..." -ForegroundColor Cyan
+    if (-not $NodeExe) { $NodeExe = Get-AutoClawNodeCommand }
+    if (-not $NodeExe) { throw "node not found on PATH and no bundled node.exe - cannot regenerate identity\device.json" }
+
+    # 2a) auth.json: fresh deviceId; token/refreshToken REMOVED (keep userInfo
+    #     so the clone opens on the account and prompts for login).
+    $authPath = Join-Path $CloneProfile 'auth.json'
+    $auth = Get-Content -LiteralPath $authPath -Raw | ConvertFrom-Json
+    $newAuthId = New-HexId64
+    $auth.deviceId = $newAuthId
+    $hadToken = ($null -ne (Get-JsonMemberValue $auth 'token')) -or ($null -ne (Get-JsonMemberValue $auth 'refreshToken'))
+    foreach ($k in @('token', 'refreshToken')) {
+        if ($null -ne $auth.PSObject.Properties[$k]) { $null = $auth.PSObject.Properties.Remove($k) }
+    }
+    [System.IO.File]::WriteAllText($authPath, ($auth | ConvertTo-Json -Depth 20), (New-Object System.Text.UTF8Encoding $false))
+    $authVerify = Get-Content -LiteralPath $authPath -Raw | ConvertFrom-Json
+    if ($authVerify.deviceId -ne $newAuthId) { throw "[seed-scrub] verify FAILED: auth.json deviceId not rotated" }
+    if (($null -ne (Get-JsonMemberValue $authVerify 'token')) -or ($null -ne (Get-JsonMemberValue $authVerify 'refreshToken'))) {
+        throw "[seed-scrub] verify FAILED: auth.json still carries a live token"
+    }
+    Write-Host ("[seed-scrub] auth.json deviceId rotated; token/refreshToken removed ({0}) - one manual login required." -f $(if ($hadToken) { "Primary token dropped" } else { "none present" })) -ForegroundColor Green
+
+    # 2b) identity\device.json: fresh ed25519 keypair + deviceId (the backend
+    #     pins the public key for pairing - regenerating makes the clone a
+    #     distinct device, not a lookalike).
+    $deviceJsonPath = Join-Path $CloneProfile 'identity\device.json'
+    if (Test-Path -LiteralPath $deviceJsonPath) {
+        $keypair = New-Ed25519KeypairJson -NodeExe $NodeExe -DeviceId (New-HexId64)
+        $ok = Set-NestedJsonVerified -Path $deviceJsonPath -Updates @{
+            "version"       = 1
+            "deviceId"      = $keypair.deviceId
+            "publicKeyPem"  = $keypair.publicKeyPem
+            "privateKeyPem" = $keypair.privateKeyPem
+            "createdAtMs"   = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
+        } -BackupPath (Join-Path $CloneProfile 'identity\device.json.preseed')
+        if (-not $ok) { throw "[seed-scrub] verify FAILED: identity\device.json not verified after write" }
+        Write-Host "[seed-scrub] identity\device.json keypair + deviceId rotated + verified." -ForegroundColor Green
+    }
+
+    # 2c) .updaterId: electron-updater install telemetry identity.
+    $updPath = Join-Path $CloneProfile '.updaterId'
+    if (Test-Path -LiteralPath $updPath) {
+        $newUpdaterId = ([guid]::NewGuid().ToString()).ToLowerInvariant()
+        [System.IO.File]::WriteAllText($updPath, $newUpdaterId, (New-Object System.Text.UTF8Encoding $false))
+        if ((Get-Content -LiteralPath $updPath -Raw).Trim() -ne $newUpdaterId) {
+            throw "[seed-scrub] verify FAILED: .updaterId not rotated"
+        }
+        Write-Host "[seed-scrub] .updaterId rotated + verified." -ForegroundColor Green
+    }
+
+    # 2d) settings.json: this instance's gateway port + updater guard (any
+    #     instance auto-updating would replace the patched app.asar).
+    $setPath = Join-Path $CloneProfile 'settings.json'
+    if (Test-Path -LiteralPath $setPath) {
+        $ok = Set-NestedJsonVerified -Path $setPath -Updates @{
+            "gateway.port"      = $cfg.GatewayPort
+            "gateway.url"       = "ws://127.0.0.1:$($cfg.GatewayPort)"
+            "system.autoUpdate" = $false
+        } -BackupPath (Join-Path $CloneProfile 'settings.json.preseed')
+        if (-not $ok) { throw "[seed-scrub] verify FAILED: settings.json port/autoUpdate not verified after write" }
+        Write-Host ("[seed-scrub] settings.json gateway={0} + autoUpdate=false verified." -f $cfg.GatewayPort) -ForegroundColor Green
+    }
+
+    # 2e) token-cache copies are excluded by the seed itself; double-check none
+    #     slipped in (an older seed ran without the exclusion).
+    foreach ($stale in @('token-cache.json', 'token-cache.json.backup', 'auth.json.backup')) {
+        $stalePath = Join-Path $CloneProfile $stale
+        if (Test-Path -LiteralPath $stalePath) {
+            Remove-Item -LiteralPath $stalePath -Force
+            Write-Host ("[seed-scrub] deleted stale credential copy: {0}" -f $stale) -ForegroundColor Yellow
+        }
+    }
+
+    # Seed complete - only now is the profile allowed to count as seeded.
+    New-Item -ItemType File -Path $seedMarker -Force | Out-Null
+    if (-not (Test-Path -LiteralPath $seedMarker)) { throw "[seed] verify FAILED: seed marker not written" }
+}
+else {
+    Write-Host "[seed] $Instance profile already seeded, skipping clone (independent)."
+}
+
+# 3) Marker-guarded one-time credential reconciliation: if this profile was
+#    re-seeded or hand-copied from the Primary AFTER the initial scrub, it would
+#    carry the PRIMARY's live token. Runs once ever per instance (ZCode
+#    telegram-route rule) so a later deliberate login is never reverted.
+if (Test-Path -LiteralPath $reconMarker) {
+    Write-Host '[reconcile] Already reconciled, skipping.' -ForegroundColor DarkGray
+}
+else {
+    $cloneAuthPath = Join-Path $CloneProfile 'auth.json'
+    $primaryAuthPath = Join-Path $PrimaryProfile 'auth.json'
+    if ((Test-Path -LiteralPath $cloneAuthPath) -and (Test-Path -LiteralPath $primaryAuthPath)) {
+        $cloneAuth = Get-Content -LiteralPath $cloneAuthPath -Raw | ConvertFrom-Json
+        $primaryAuth = Get-Content -LiteralPath $primaryAuthPath -Raw | ConvertFrom-Json
+        $cloneToken = Get-JsonMemberValue $cloneAuth 'token'
+        $primaryToken = Get-JsonMemberValue $primaryAuth 'token'
+        if ($cloneToken -and $primaryToken -and ($cloneToken -eq $primaryToken)) {
+            foreach ($k in @('token', 'refreshToken')) {
+                if ($null -ne $cloneAuth.PSObject.Properties[$k]) { $null = $cloneAuth.PSObject.Properties.Remove($k) }
+            }
+            [System.IO.File]::WriteAllText($cloneAuthPath, ($cloneAuth | ConvertTo-Json -Depth 20), (New-Object System.Text.UTF8Encoding $false))
+            $check = Get-Content -LiteralPath $cloneAuthPath -Raw | ConvertFrom-Json
+            if ((Get-JsonMemberValue $check 'token') -or (Get-JsonMemberValue $check 'refreshToken')) {
+                throw "[reconcile] verify FAILED: primary token still present in clone auth.json"
+            }
+            Write-Host "[reconcile] Clone carried the PRIMARY's live token - removed. Manual login required." -ForegroundColor Yellow
+        }
+        else {
+            Write-Host "[reconcile] No shared credential found; nothing to do." -ForegroundColor DarkGray
+        }
+    }
+    New-Item -ItemType File -Path $reconMarker -Force | Out-Null
+}
+
+# 4) Patch-state warning: inst4 has no MCP slot at all without the port patch.
+$AsarMarker = Join-Path (Split-Path -Parent $AutoClawExe) 'resources\autoclaw-ports-patch.marker.json'
+if (-not (Test-Path -LiteralPath $AsarMarker)) {
+    Write-Host '[ports] NOTE: installed app.asar is NOT patched - distinct MCP slots cap at 3 clones,' -ForegroundColor Yellow
+    Write-Host '        and inst4 has no MCP port. Close AutoClaw, run tools\patch_autoclaw_ports.ps1, relaunch.' -ForegroundColor Yellow
+}
+
+# 4b) State-dir override MARKER FILE. AutoClaw.exe's manifest declares
+#     requireAdministrator: every launch self-elevates, and the elevated
+#     process gets a FRESH ENVIRONMENT (verified live 2026-10-16 - env-based
+#     isolation silently no-ops). --user-data-dir SURVIVES elevation, so the
+#     patched app (engine v5) reads <userData>\.autoclaw-home for the clone
+#     home. Write it fresh on every launch + verify-after re-read.
+$homeMarker = Join-Path $CloneProfile '.autoclaw-home'
+[System.IO.File]::WriteAllText($homeMarker, $CloneHome, (New-Object System.Text.UTF8Encoding $false))
+$homeMarkerRead = (Get-Content -LiteralPath $homeMarker -Raw).Trim()
+if ($homeMarkerRead -ne $CloneHome) {
+    throw "[launch] verify FAILED: .autoclaw-home marker holds '$homeMarkerRead', expected '$CloneHome'"
+}
+Write-Host "[launch] .autoclaw-home marker verified -> $CloneHome" -ForegroundColor Green
+
+# 5) Isolation proof baseline: the Primary's gateway config must not change.
+#    A Primary-profile instance appearing DURING the window (the browser
+#    extension's native host spawns a bare AutoClaw.exe that opens the Primary
+#    and rewrites its openclaw.json - live-verified 2026-10-17, pid 12612
+#    spawned 43s into inst2's launch) is NOT a clone breach; the lockfile state
+#    before/after distinguishes that from a real one.
+$primaryHashBefore = $null
+$primaryLockfileHeldBefore = $false
+if (Test-Path -LiteralPath (Join-Path $PrimaryState 'openclaw.json')) {
+    $primaryHashBefore = (Get-FileHash -LiteralPath (Join-Path $PrimaryState 'openclaw.json') -Algorithm SHA256).Hash
+}
+$primaryLockfileHeldBefore = Test-ProfileLockHeld -ProfileDir $PrimaryProfile
+
+# 6) Launch detached. AutoClaw attaches to the parent console for stdout
+#    logging (AGENTS.md .bat rules) - route through cmd /c start "" so there is
+#    no console to hijack. Env vars ride the powershell -> cmd -> exe chain.
+$env:USERPROFILE = $CloneHome
+$env:HOME = $CloneHome
+$env:TEMP = $CloneTmp
+$env:TMP = $CloneTmp
+$env:TMPDIR = $CloneTmp
+$env:AUTOCLAW_GATEWAY_PORT = [string]$cfg.GatewayPort
+# The state-dir isolation lever. USERPROFILE/HOME are NOT honoured by the app's
+# main (its homedir() resolves the real Windows profile - verified live
+# 2026-10-16), so the asar patch (engine v2, home-override) makes every
+# homedir() site prefer AUTOCLAW_HOME_DIR. Without the patch the gateway state
+# silently lands in the PRIMARY's ~/.openclaw-autoclaw.
+$env:AUTOCLAW_HOME_DIR = $CloneHome
+
+Write-Host "[launch] HOME=$env:USERPROFILE"
+Write-Host "[launch] profile=$CloneProfile"
+Write-Host "[launch] AUTOCLAW_GATEWAY_PORT=$env:AUTOCLAW_GATEWAY_PORT (may drift up to +9 - reading back the actual port)"
+
+# pid-diff baseline: any AutoClaw.exe appearing after this point is OUR launch
+# (sequential-launch rule guarantees no concurrent clone spawn).
+# Get-Process (toolhelp32) is the RELIABLE pid source: Win32_Process
+# intermittently omits AutoClaw.exe ENTIRELY - verified live 2026-10-16, a
+# healthy main invisible to WMI snapshots minutes after start (this is the
+# same failure class as the ZCode empty-CommandLine race, one level worse).
+$beforePids = @(Get-Process -Name AutoClaw -ErrorAction SilentlyContinue |
+    ForEach-Object { [int]$_.Id })
+# -Verb RunAs: AutoClaw.exe's manifest declares requireAdministrator, so a
+# non-elevated `start` hits the ERROR_ELEVATION_REQUIRED ShellExecute fallback,
+# which launches the elevated process with a FRESH ENV *and* NO ARGUMENTS
+# (verified live 2026-10-16 via PEB reads: every AutoClaw.exe ran with a bare
+# command line). Elevating the launching cmd instead makes start's
+# ShellExecute a plain CreateProcess - arguments survive. The app is elevated
+# either way (its own manifest); UAC is silent for admin accounts with
+# ConsentPromptBehaviorAdmin=0.
+$null = Start-Process -FilePath "$env:ComSpec" -ArgumentList '/c', 'start', '""', "`"$AutoClawExe`"", "`"--user-data-dir=`"$CloneProfile`"" -Verb RunAs -WindowStyle Hidden
+
+# 7) Verify-after-launch - the no-silent-success core.
+# 7a) Liveness via three independent evidence channels (hardened after the
+#     2026-10-15 miss where a live clone went unseen for the whole poll window):
+#     attributed process tree (tree-level markers + pid-diff), or the profile
+#     lockfile held open (WMI-independent).
+$subtree = @()
+$livenessEvidence = ""
+for ($i = 0; $i -lt 60; $i++) {
+    Start-Sleep -Seconds 1
+    $nowPids = @(Get-Process -Name AutoClaw -ErrorAction SilentlyContinue |
+        ForEach-Object { [int]$_.Id })
+    $newPids = @($nowPids | Where-Object { $beforePids -notcontains $_ })
+    $subtree = Get-CloneSubtreePids -Markers $CloneMarkers -NewPids $newPids
+    if ($subtree.Count -gt 0) {
+        $livenessEvidence = "attributed process tree, $($subtree.Count) pids"
+        break
+    }
+    if ($newPids.Count -gt 0) {
+        # WMI cmdline data unavailable (flap) but new AutoClaw pids exist - good
+        # enough for liveness; ports fall back to the unattributed scan.
+        $subtree = $newPids
+        $livenessEvidence = "new AutoClaw pids after launch ($($newPids.Count)); WMI tree unavailable"
+        break
+    }
+    if (Test-ProfileLockHeld -ProfileDir $CloneProfile) {
+        $livenessEvidence = "profile lockfile held (process tree unresolved by WMI)"
+        break
+    }
+}
+if (-not $livenessEvidence) {
+    Write-Host "[verify] FAILED - no liveness evidence within 60s (no attributed process tree, lockfile not held)." -ForegroundColor Red
+    Write-Host "         Check $CloneProfile\logs or launch manually: `"$AutoClawExe`" --user-data-dir=`"$CloneProfile`"" -ForegroundColor Red
+    exit 1
+}
+Write-Host "[verify] instance live: $livenessEvidence" -ForegroundColor Green
+Start-Sleep -Seconds 5
+$nowPids = @(Get-Process -Name AutoClaw -ErrorAction SilentlyContinue |
+    ForEach-Object { [int]$_.Id })
+$newPids = @($nowPids | Where-Object { $beforePids -notcontains $_ })
+$subtreeAfter = @(Get-CloneSubtreePids -Markers $CloneMarkers -NewPids $newPids)
+if ($subtreeAfter.Count -eq 0 -and $newPids.Count -gt 0) { $subtreeAfter = $newPids }
+$stillLive = ($subtreeAfter.Count -gt 0) -or (Test-ProfileLockHeld -ProfileDir $CloneProfile)
+if (-not $stillLive) {
+    Write-Host "[verify] FAILED - instance died within 5s of liveness (crash on startup?)." -ForegroundColor Red
+    exit 1
+}
+if ($subtreeAfter.Count -gt 0) {
+    $firstPids = (@($subtreeAfter) | Select-Object -First 3) -join ","
+    Write-Host ("[verify] stable after 5s: {0} pids ({1}...)" -f $subtreeAfter.Count, $firstPids) -ForegroundColor Green
+}
+else {
+    Write-Host "[verify] stable after 5s: lockfile still held (tree unresolved - see 7b fallback)." -ForegroundColor Green
+}
+
+# 7b) Actual ports: scan the clone's own listening sockets (MCP array 19681..19688,
+#     gateway requested..requested+9) - never assume the requested port held.
+$actualMcp = @()
+$actualGateway = @()
+$portsUnattributed = $false
+for ($i = 0; $i -lt 45; $i++) {
+    Start-Sleep -Seconds 2
+    $nowPids = @(Get-Process -Name AutoClaw -ErrorAction SilentlyContinue |
+        ForEach-Object { [int]$_.Id })
+    $newPids = @($nowPids | Where-Object { $beforePids -notcontains $_ })
+    $fresh = @(Get-CloneSubtreePids -Markers $CloneMarkers -NewPids $newPids)
+    if ($fresh.Count -eq 0 -and $newPids.Count -gt 0) { $fresh = $newPids }
+    $actualMcp = Get-CloneListeningPorts -SubtreePids $fresh -MinPort 19681 -MaxPort 19688
+    $actualGateway = Get-CloneListeningPorts -SubtreePids $fresh -MinPort $cfg.GatewayPort -MaxPort ($cfg.GatewayPort + 9)
+    if ($actualMcp.Count -gt 0 -and $actualGateway.Count -gt 0) { break }
+}
+# Fallback: instance live (lockfile held) but the WMI tree never resolved -
+# scan the ranges WITHOUT pid ownership and report as unattributed. A running
+# Primary could own a port in-range, so these results are advisory only.
+if (($actualMcp.Count -eq 0) -and ($actualGateway.Count -eq 0) -and (Test-ProfileLockHeld -ProfileDir $CloneProfile)) {
+    $portsUnattributed = $true
+    Write-Host "[verify] process tree unresolved by WMI - scanning port ranges unattributed (advisory)." -ForegroundColor Yellow
+    try {
+        $actualMcp = @(Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
+            Where-Object { $_.LocalPort -ge 19681 -and $_.LocalPort -le 19688 } |
+            Select-Object -ExpandProperty LocalPort -Unique | Sort-Object)
+        $actualGateway = @(Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
+            Where-Object { $_.LocalPort -ge $cfg.GatewayPort -and $_.LocalPort -le ($cfg.GatewayPort + 9) } |
+            Select-Object -ExpandProperty LocalPort -Unique | Sort-Object)
+    }
+    catch { }
+}
+
+$verifyOk = $true
+if ($portsUnattributed) {
+    Write-Host "[verify] WARN - port results below are UNATTRIBUTED (WMI tree unresolved; a running Primary could own an in-range port)." -ForegroundColor Yellow
+}
+if ($actualMcp.Count -eq 0) {
+    Write-Host "[verify] WARN - no MCP port found in 19681..19688 for this clone (unpatched asar + 5 instances? primary holds the slots?)." -ForegroundColor Yellow
+}
+else {
+    foreach ($port in $actualMcp) {
+        $h = Test-HttpHealth -Port $port
+        if ($h.Ok) { Write-Host ("[verify] MCP :$port /health OK") -ForegroundColor Green }
+        else { Write-Host ("[verify] MCP :$port listening but /health FAILED ({0})" -f $h.Body) -ForegroundColor Yellow }
+    }
+}
+if ($actualGateway.Count -eq 0) {
+    # The gateway auto-starts only after the renderer's main UI mounts and sends
+    # APP_MAIN_UI_READY (main_ui_ready -> triggerGatewayLaunch, asar-verified
+    # 2026-10-17). A clone sitting on the SIGN-IN screen never sends it, so a
+    # login-pending instance legitimately has NO gateway/MCP yet - that state is
+    # the user's ONE manual login, not a launcher failure (inst2 live case).
+    $cloneAuthNow = $null
+    try { $cloneAuthNow = Get-Content -LiteralPath (Join-Path $CloneProfile 'auth.json') -Raw | ConvertFrom-Json } catch { }
+    $loginPending = ($null -eq $cloneAuthNow) -or ($null -eq (Get-JsonMemberValue $cloneAuthNow 'token'))
+    if ($loginPending) {
+        Write-Host ("[verify] WARN - no gateway port in {0}..{1}: instance is on the sign-in screen (no token)." -f $cfg.GatewayPort, ($cfg.GatewayPort + 9)) -ForegroundColor Yellow
+        Write-Host "         Complete the ONE manual login in the window - gateway + MCP start after the main UI loads." -ForegroundColor Yellow
+    }
+    else {
+        Write-Host ("[verify] FAILED - no gateway port found in {0}..{1} (token present, so this is not the sign-in gate)." -f $cfg.GatewayPort, ($cfg.GatewayPort + 9)) -ForegroundColor Red
+        $verifyOk = $false
+    }
+}
+else {
+    $gwPort = $actualGateway[0]
+    $h = Test-HttpHealth -Port $gwPort
+    if ($h.Ok) {
+        Write-Host ("[verify] gateway :$gwPort /health OK {0}" -f $h.Body) -ForegroundColor Green
+        if ($gwPort -ne $cfg.GatewayPort) {
+            Write-Host ("[verify] gateway port drift: requested {0}, actual {1} (recorded)." -f $cfg.GatewayPort, $gwPort) -ForegroundColor Yellow
+        }
+    }
+    else {
+        Write-Host ("[verify] FAILED - gateway :$gwPort listening but /health failed ({0})." -f $h.Body) -ForegroundColor Red
+        $verifyOk = $false
+    }
+}
+
+# 7c) paired.json: only the clone's own device key may appear (the live
+#     operator credential must never be inherited). Poll while the gateway
+#     boots; absent after the window -> WARN (created after first pairing).
+$cloneOwnDeviceId = (Get-Content -LiteralPath (Join-Path $CloneProfile 'auth.json') -Raw | ConvertFrom-Json).deviceId
+$pairedPath = Join-Path $CloneState 'devices\paired.json'
+$pairedSeen = $false
+for ($i = 0; $i -lt 45; $i++) {
+    if (Test-Path -LiteralPath $pairedPath) { $pairedSeen = $true; break }
+    Start-Sleep -Seconds 2
+}
+if ($pairedSeen) {
+    $paired = Get-Content -LiteralPath $pairedPath -Raw | ConvertFrom-Json
+    $keys = @($paired.PSObject.Properties.Name)
+    $foreign = @($keys | Where-Object { $_ -ne $cloneOwnDeviceId })
+    if ($foreign.Count -gt 0) {
+        Write-Host "[verify] FAILED - paired.json contains foreign device keys: $($foreign -join ', ')" -ForegroundColor Red
+        $verifyOk = $false
+    }
+    else {
+        Write-Host "[verify] paired.json holds only this clone's device key." -ForegroundColor Green
+    }
+}
+else {
+    Write-Host "[verify] WARN - paired.json not created yet (appears after first pairing/login)." -ForegroundColor Yellow
+}
+
+# 7d) Isolation proof: the Primary's gateway config hash unchanged - attributed
+#     before failing. A Primary-profile instance spawning DURING the window
+#     (browser-extension native host) holds the Primary lockfile and rewrites
+#     its openclaw.json; that is out-of-band Primary activity, not a clone
+#     breach (live-verified 2026-10-17: bare pid 12612 at inst2+43s).
+if ($primaryHashBefore) {
+    $primaryHashAfter = (Get-FileHash -LiteralPath (Join-Path $PrimaryState 'openclaw.json') -Algorithm SHA256).Hash
+    if ($primaryHashAfter -ne $primaryHashBefore) {
+        $primaryLockfileHeldAfter = Test-ProfileLockHeld -ProfileDir $PrimaryProfile
+        if ($primaryLockfileHeldBefore -or $primaryLockfileHeldAfter) {
+            Write-Host "[verify] WARN - Primary openclaw.json changed while a Primary-profile instance was running (out-of-band browser-native-host spawn or concurrent Primary use - not attributable to this clone)." -ForegroundColor Yellow
+        }
+        else {
+            Write-Host "[verify] FAILED - Primary openclaw.json changed during the launch cycle with NO Primary-profile instance running (isolation breach)." -ForegroundColor Red
+            $verifyOk = $false
+        }
+    }
+    else {
+        Write-Host "[verify] Primary openclaw.json hash unchanged (isolation proof)." -ForegroundColor Green
+    }
+}
+
+# 8) Record the ACTUAL ports for -Status (verify the record re-reads).
+$record = [ordered]@{
+    instance            = $Instance
+    requestedGatewayPort = $cfg.GatewayPort
+    actualMcpPort       = $(if ($actualMcp.Count) { $actualMcp[0] } else { $null })
+    actualGatewayPort   = $(if ($actualGateway.Count) { $actualGateway[0] } else { $null })
+    launchedAt          = (Get-Date -Format "o")
+    mainPids            = @((Get-CloneSubtreePids -Markers $CloneMarkers) | Select-Object -First 10)
+    treeResolved        = (-not $portsUnattributed)
+}
+$recordPath = Join-Path $InstRoot 'instance-record.json'
+[System.IO.File]::WriteAllText($recordPath, ($record | ConvertTo-Json -Depth 5), (New-Object System.Text.UTF8Encoding $false))
+$recordVerify = Get-Content -LiteralPath $recordPath -Raw | ConvertFrom-Json
+if ($recordVerify.instance -ne $Instance) { Write-Host "[record] WARN - instance-record.json did not verify after write." -ForegroundColor Yellow }
+
+if (-not $verifyOk) {
+    Write-Host "`n[launch] $Instance launched WITH VERIFY FAILURES - review the [verify] lines above." -ForegroundColor Red
+    exit 1
+}
+Write-Host "`n[launch] $Instance verified and running. First run needs ONE manual login in its window." -ForegroundColor Green
diff --git a/src/windows/launch_zcode_second_instance.ps1 b/src/windows/launch_zcode_second_instance.ps1
index 238c4de..884f8d2 100644
--- a/src/windows/launch_zcode_second_instance.ps1
+++ b/src/windows/launch_zcode_second_instance.ps1
@@ -19,7 +19,7 @@
 #     Without that one-time patch the app ignores all four -> default look, no harm.
 param(
     # Which clone to launch. Defaults to Second so existing callers
-    # (Launch-ZCode-Second.bat, GHOST.bat menu [10]) stay valid unchanged.
+    # (Launch-ZCode-Second.bat, GHOST.bat ZCode submenu [1]) stay valid unchanged.
     [ValidateSet('Second', 'Third', 'Fourth')]
     [string]$Instance = 'Second'
 )
@@ -64,8 +64,6 @@ $CloneSession   = Join-Path $CloneUserData 'session'
 # Strings that identify THIS clone's processes in any CommandLine (live-check).
 $CloneMarkers   = @("*$($cfg.UserData)*", "*$($cfg.Home)*")
 
-if (-not (Test-Path -LiteralPath $ZCodeExe)) { throw "ZCode.exe not found: $ZCodeExe" }
-
 # 1) Ensure directories exist
 New-Item -ItemType Directory -Path $CloneHome -Force | Out-Null
 New-Item -ItemType Directory -Path $CloneUserData -Force | Out-Null
@@ -157,17 +155,61 @@ if (-not (Test-Path -LiteralPath (Join-Path $CloneZCode 'v2\setting.json'))) {
     Write-Host "[seed] $Instance profile already exists, skipping clone (independent)."
 }
 
-# 2c) Telegram routing (one-time, marker-guarded): a cloned profile carries the
-# PRIMARY's enabled Telegram bots, and two pollers on one token cause HTTP 409
-# conflicts plus random cross-account billing. Keep Telegram on Primary by
-# disabling telegram bots in the clone. Runs ONCE ever per clone (marker file)
-# so a deliberate re-enable in the clone UI is never reverted. Primary untouched.
+# 2c) Telegram routing (marker-guarded): one credential = one instance (EC-D03).
+# Two pollers on one token cause HTTP 409 + random cross-account billing.
+# v2 logic (2026-10-16): compare the clone's encrypted bot credential sha8
+# (credentials.json -> bot:<id>:credential, enc:v1:, hash only, never values)
+# + bot id against Primary across BOTH bot-config.json and bot-config.v3.json.
+# Duplicate of Primary -> disabled in both files. Unique (UI-assisted flow:
+# operator pasted a distinct BotFather token in the clone UI, app minted a
+# fresh bot-<guid>) -> preserved + v2 marker so future launches never revert
+# a deliberate unique bot. Legacy v1 markers (empty file) keep old behavior.
 $tgMarker = Join-Path $CloneHome '.telegram-routed'
+function Get-TgCredSha8 {
+    param([string]$CredentialsPath, [string]$CredentialRef)
+    if (-not (Test-Path -LiteralPath $CredentialsPath)) { return '' }
+    try { $creds = Get-Content -LiteralPath $CredentialsPath -Raw | ConvertFrom-Json }
+    catch { return '' }
+    $prop = $creds.PSObject.Properties[$CredentialRef]
+    if ($null -eq $prop) { return '' }
+    $val = [string]$prop.Value
+    if ([string]::IsNullOrEmpty($val)) { return '' }
+    $bytes = [System.Text.Encoding]::UTF8.GetBytes($val)
+    $sha = [System.Security.Cryptography.SHA256]::Create()
+    try { $hash = $sha.ComputeHash($bytes) }
+    finally { if ($sha) { $sha.Dispose() } }
+    return ([BitConverter]::ToString($hash).Replace('-', '').ToLowerInvariant()).Substring(0, 8)
+}
+$tgMarkerText = ''
 if (Test-Path -LiteralPath $tgMarker) {
+    try { $tgMarkerText = (Get-Content -LiteralPath $tgMarker -Raw -ErrorAction SilentlyContinue) }
+    catch { $tgMarkerText = '' }
+}
+if ($tgMarkerText -like 'v2 unique-bot*') {
+    Write-Host '[telegram-route] v2 unique-bot marker, preserving clone bot.' -ForegroundColor DarkGray
+} elseif (Test-Path -LiteralPath $tgMarker) {
     Write-Host '[telegram-route] Already reconciled, skipping.' -ForegroundColor DarkGray
 } else {
     $tgNoBom = New-Object System.Text.UTF8Encoding $false
     $tgDisabled = 0
+    $tgPreserved = 0
+    $tgPrimarySha8 = ''
+    $tgPrimaryId = ''
+    try {
+        $tgPrimaryCreds = Get-Content -LiteralPath (Join-Path $PrimaryZCode 'v2\credentials.json') -Raw | ConvertFrom-Json
+        foreach ($cfgName in @('v2\bot-config.json', 'v2\bot-config.v3.json')) {
+            $tgPrimaryCfg = Join-Path $PrimaryZCode $cfgName
+            if (-not (Test-Path -LiteralPath $tgPrimaryCfg)) { continue }
+            $pj = Get-Content -LiteralPath $tgPrimaryCfg -Raw | ConvertFrom-Json
+            foreach ($b in @($pj.bots)) {
+                if ($b.provider -ne 'telegram') { continue }
+                $tgPrimaryId = [string]$b.id
+                $tgPrimarySha8 = Get-TgCredSha8 -CredentialsPath (Join-Path $PrimaryZCode 'v2\credentials.json') -CredentialRef ([string]$b.credentialRef)
+                if ($tgPrimarySha8 -ne '') { break }
+            }
+            if ($tgPrimarySha8 -ne '') { break }
+        }
+    } catch { Write-Host '[telegram-route] Primary fingerprint SKIP, falling back to disable.' -ForegroundColor Yellow }
     foreach ($cfgName in @('v2\bot-config.json', 'v2\bot-config.v3.json')) {
         $tgCfg = Join-Path $CloneZCode $cfgName
         if (-not (Test-Path -LiteralPath $tgCfg)) { continue }
@@ -176,14 +218,25 @@ if (Test-Path -LiteralPath $tgMarker) {
             $changed = $false
             if (($null -ne $bj) -and ($null -ne $bj.PSObject.Properties['bots'])) {
                 foreach ($b in $bj.bots) {
-                    if (($b.provider -eq 'telegram') -and ($b.enabled -eq $true)) { $b.enabled = $false; $changed = $true; $tgDisabled++ }
+                    if ($b.provider -ne 'telegram') { continue }
+                    if ($b.enabled -ne $true) { continue }
+                    $cloneSha = Get-TgCredSha8 -CredentialsPath (Join-Path $CloneZCode 'v2\credentials.json') -CredentialRef ([string]$b.credentialRef)
+                    $isDup = $false
+                    if ($tgPrimarySha8 -ne '' -and $cloneSha -eq $tgPrimarySha8) { $isDup = $true }
+                    if ($tgPrimaryId -ne '' -and ([string]$b.id) -eq $tgPrimaryId) { $isDup = $true }
+                    if ($isDup) { $b.enabled = $false; $changed = $true; $tgDisabled++ }
+                    else {
+                        if ($cloneSha -ne '') { $tgPreserved++ }
+                        else { $b.enabled = $false; $changed = $true; $tgDisabled++ }
+                    }
                 }
             }
             if ($changed) { [System.IO.File]::WriteAllText($tgCfg, ($bj | ConvertTo-Json -Depth 20), $tgNoBom) }
         } catch { Write-Host "[telegram-route] $cfgName SKIP ($($_.Exception.Message))" -ForegroundColor Yellow }
     }
-    if ($tgDisabled -gt 0) { Write-Host ("[telegram-route] Disabled {0} Telegram bot(s) in $Instance; Telegram stays on Primary." -f $tgDisabled) -ForegroundColor Green }
-    else { Write-Host "[telegram-route] No enabled Telegram bots in $Instance; nothing to do." -ForegroundColor DarkGray }
+    if ($tgDisabled -gt 0) { Write-Host ("[telegram-route] Disabled {0} duplicate Telegram bot(s) in $Instance; Telegram stays on Primary." -f $tgDisabled) -ForegroundColor Green }
+    if ($tgPreserved -gt 0) { Write-Host ("[telegram-route] Preserved $tgPreserved unique Telegram bot row(s) in $Instance (distinct credential)." -f $tgPreserved) -ForegroundColor Green }
+    if (($tgDisabled -eq 0) -and ($tgPreserved -eq 0)) { Write-Host "[telegram-route] No enabled Telegram bots in $Instance; nothing to do." -ForegroundColor DarkGray }
     # Drop stale polling locks, but ONLY when this clone is not running (a live
     # poller owns its lock dir). A running instance picks up the config change
     # on its next restart.
@@ -227,13 +280,40 @@ if (Test-Path -LiteralPath $tgMarker) {
             if ($tgDisabled -gt 0) { Write-Host "[telegram-route] $Instance is running: restart it once to apply (config saved)." -ForegroundColor Yellow }
         } else {
             $tgLockRoot = Join-Path $CloneZCode 'v2\bots-runtime-locks\telegram-polling'
-            if (Test-Path -LiteralPath $tgLockRoot) {
+            if (($tgDisabled -gt 0) -and (Test-Path -LiteralPath $tgLockRoot)) {
                 Get-ChildItem -LiteralPath $tgLockRoot -Force -ErrorAction SilentlyContinue | ForEach-Object { Remove-Item -LiteralPath $_.FullName -Recurse -Force -Confirm:$false -ErrorAction SilentlyContinue }
                 Write-Host "[telegram-route] Stale $Instance polling locks cleared." -ForegroundColor Green
             }
         }
     } catch { Write-Host "[telegram-route] lock check SKIP ($($_.Exception.Message))" -ForegroundColor Yellow }
-    New-Item -ItemType File -Path $tgMarker -Force | Out-Null
+    if ($tgPreserved -gt 0) {
+        $tgUniqueSha = ''
+        $tgUniqueId = ''
+        try {
+            foreach ($cfgName in @('v2\bot-config.json', 'v2\bot-config.v3.json')) {
+                $tgCfg = Join-Path $CloneZCode $cfgName
+                if (-not (Test-Path -LiteralPath $tgCfg)) { continue }
+                $uj = Get-Content -LiteralPath $tgCfg -Raw | ConvertFrom-Json
+                foreach ($b in @($uj.bots)) {
+                    if ($b.provider -ne 'telegram') { continue }
+                    if ($b.enabled -ne $true) { continue }
+                    $tgUniqueId = [string]$b.id
+                    $tgUniqueSha = Get-TgCredSha8 -CredentialsPath (Join-Path $CloneZCode 'v2\credentials.json') -CredentialRef ([string]$b.credentialRef)
+                    if ($tgUniqueSha -ne '') { break }
+                }
+                if ($tgUniqueSha -ne '') { break }
+            }
+        } catch { $tgUniqueSha = '' }
+        if ($tgUniqueSha -ne '') {
+            [System.IO.File]::WriteAllText($tgMarker, ('v2 unique-bot sha8=' + $tgUniqueSha + ' id=' + $tgUniqueId), $tgNoBom)
+        }
+        else {
+            New-Item -ItemType File -Path $tgMarker -Force | Out-Null
+        }
+    }
+    else {
+        New-Item -ItemType File -Path $tgMarker -Force | Out-Null
+    }
 }
 
 # 3) Launch the clone detached from THIS console.
@@ -348,6 +428,7 @@ public class ZcodeWindowAumid {
         void Commit();
     }
     [DllImport("shell32.dll")] public static extern int SHGetPropertyStoreForWindow(IntPtr hwnd, ref Guid riid, [MarshalAs(UnmanagedType.Interface)] out IPropertyStore store);
+    [DllImport("oleaut32.dll")] public static extern int PropVariantClear(ref PROPVARIANT pv);
     public static readonly PROPERTYKEY PKEY_AUMID = new PROPERTYKEY { fmtid = new Guid("9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3"), pid = 5 };
     static Guid IID_IPropertyStore = new Guid("886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99");
     // Stamp + read back; returns what the store actually holds.
@@ -373,9 +454,15 @@ public class ZcodeWindowAumid {
         PROPVARIANT back;
         var key = PKEY_AUMID;
         store.GetValue(ref key, out back);
-        if (back.vt == 31) return Marshal.PtrToStringUni(back.pointerValue);
-        if (back.vt == 0) return "<EMPTY>";
-        return "<readback vt=" + back.vt + ">";
+        // VT_LPWSTR is CoTaskMem-allocated by the property store: copy the
+        // string out first, then free the variant, or the resident watcher
+        // leaks on every 5 s read.
+        string result;
+        if (back.vt == 31) result = Marshal.PtrToStringUni(back.pointerValue);
+        else if (back.vt == 0) result = "<EMPTY>";
+        else result = "<readback vt=" + back.vt + ">";
+        PropVariantClear(ref back);
+        return result;
     }
 }
 "@
diff --git a/src/windows/reset_autoclaw.ps1 b/src/windows/reset_autoclaw.ps1
new file mode 100644
index 0000000..a0cbdae
--- /dev/null
+++ b/src/windows/reset_autoclaw.ps1
@@ -0,0 +1,736 @@
+#Requires -Version 5.1
+# AutoClaw Identity Reset v0.1
+#
+# GHOST-shaped identity reset for AutoClaw (Electron 33 desktop agent, install
+# at C:\Program Files\AutoClaw). AutoClaw keeps TWO independent device
+# identities plus one live operator credential (verified on this host,
+# docs/AUTOCLAW_CLONES_SPEC.md sections 4/8):
+#   - %APPDATA%\AutoClaw\auth.json             .deviceId (64-hex, backend id)
+#   - %APPDATA%\AutoClaw\identity\device.json  ed25519 keypair + deviceId
+#   - ~\.openclaw-autoclaw\devices\paired.json operator token (admin-scoped)
+# This script rotates the first two and deletes the third (its own gateway
+# regenerates it on next start), per target instance.
+#
+#   - -Target Primary -> %APPDATA%\AutoClaw + %USERPROFILE%\.openclaw-autoclaw
+#   - -Target instN   -> %USERPROFILE%\AutoClawCloneHome\instN\{profile,home}
+#   - -Target All     -> inst1 + inst2 + inst3 + inst4, then Primary
+#                        (clones first, Primary last -- ZCode rule)
+#
+# PRESERVATION: auth.json .token/.refreshToken/.userInfo are never touched by
+# the reset (a live login survives; token removal is a CLONE seed-scrub job in
+# launch_autoclaw_clone.ps1). Chats/sessions/agents under the state dir are
+# never wiped. token-cache.json / launch.json / official.json are out of scope
+# for v0.1.
+#
+# UPDATER NOTE: settings.json .system.autoUpdate is forced to $false on EVERY
+# target, Primary included. Any instance auto-updating would replace the
+# patched app.asar (tools/patch_autoclaw_ports.ps1, A2) -- the port patch must
+# be re-applied after a manual app update.
+#
+# PS 5.1 COMPAT: no [CmdletBinding()], no ternary, no $Input variable,
+# RandomNumberGenerator via .GetBytes() only. No-BOM UTF-8 on every write.
+#
+# Usage:
+#   powershell -ExecutionPolicy Bypass -File reset_autoclaw.ps1 [-Target Primary|inst1|inst2|inst3|inst4|All] [-DryRun]
+# Prerequisite: close AutoClaw first (the script also force-kills it).
+# Requirement: node on PATH (or the app-bundled node.exe) for ed25519 keygen.
+
+param(
+    [ValidateSet('Primary', 'inst1', 'inst2', 'inst3', 'inst4', 'All')][string]$Target = 'Primary',
+    [switch]$DryRun
+)
+
+. "$PSScriptRoot\identity_utils.ps1"
+
+$ErrorActionPreference = "Stop"
+
+# --- Self-elevation -----------------------------------------------------------
+# Re-launch elevated with the same script path when not already admin.
+# Forwards -Target / -DryRun so child runs keep their scope after UAC.
+$autoclawIsAdmin = [Security.Principal.WindowsPrincipal]::new(
+    [Security.Principal.WindowsIdentity]::GetCurrent()
+).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+if (-not $autoclawIsAdmin) {
+    $autoclawScript = $MyInvocation.MyCommand.Path
+    $autoclawFwd = " -Target $Target"
+    if ($DryRun) { $autoclawFwd += " -DryRun" }
+    # -File passes only declared switches; a redirect operator after -File is
+    # just swallowed as an undeclared argument. The *_done.txt marker file
+    # (not a log) is the persisted result channel - the elevated console shows
+    # the full live output while the run progresses.
+    $autoclawArgs = "-ExecutionPolicy Bypass -NoProfile -File `"$autoclawScript`"$autoclawFwd"
+    Start-Process powershell -Verb RunAs -ArgumentList $autoclawArgs -WindowStyle Normal -Wait
+    if (Test-Path -LiteralPath "$env:TEMP\autoclaw_v0.1_done.txt") {
+        Get-Content -LiteralPath "$env:TEMP\autoclaw_v0.1_done.txt"
+    }
+    exit
+}
+
+Write-GhostBanner -Target "AutoClaw Identity Reset [$Target]" -Version "0.1"
+
+# === Layout (frozen -- docs/AUTOCLAW_CLONES_SPEC.md section 3) =================
+
+$script:CloneRoot = Join-Path $env:USERPROFILE "AutoClawCloneHome"
+# Gateway preferred ports (spec section 6). The actual bound port may drift up
+# to +9 (PORT_PROBE_RANGE) -- the launcher records the real one; this table is
+# only what settings.json REQUESTS.
+$script:GatewayPorts = @{
+    "Primary" = 18789
+    "inst1"   = 18799
+    "inst2"   = 18810
+    "inst3"   = 18821
+    "inst4"   = 18832
+}
+
+function Get-TargetPaths {
+    param([Parameter(Mandatory = $true)][string]$TargetName)
+    if ($TargetName -eq "Primary") {
+        return @{
+            Roaming = Join-Path $env:APPDATA "AutoClaw"
+            State   = Join-Path $env:USERPROFILE ".openclaw-autoclaw"
+        }
+    }
+    $instRoot = Join-Path $script:CloneRoot $TargetName
+    return @{
+        Roaming = Join-Path $instRoot "profile"
+        State   = Join-Path $instRoot "home\.openclaw-autoclaw"
+    }
+}
+
+function Resolve-TargetList {
+    param([Parameter(Mandatory = $true)][string]$TargetName)
+    if ($TargetName -eq "All") {
+        # Clones first, Primary last (AGENTS.md ZCode All-mode rule).
+        return @("inst1", "inst2", "inst3", "inst4", "Primary")
+    }
+    return @($TargetName)
+}
+
+# === Local helpers ============================================================
+
+function Add-ActionEntry {
+    param(
+        [Parameter(Mandatory = $true)][ref]$Actions,
+        [Parameter(Mandatory = $true)][string]$OriginalPath,
+        [string]$BackupPath,
+        [ValidateSet("copy", "rename", "delete")][string]$Action = "copy",
+        [string]$RenamedPath
+    )
+
+    if ($null -eq $Actions.Value) {
+        $Actions.Value = @()
+    }
+
+    $Actions.Value += [ordered]@{
+        action       = $Action
+        originalPath = $OriginalPath
+        backupPath   = $BackupPath
+        renamedPath  = $RenamedPath
+    }
+}
+
+function New-HexId64 {
+    # Fresh 64-hex device id (auth.json / device.json .deviceId format),
+    # crypto RNG via .GetBytes() (PS 5.1 safe; .Fill() is .NET Core only).
+    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+    try {
+        $bytes = New-Object byte[] 32
+        $rng.GetBytes($bytes)
+        return (($bytes | ForEach-Object { $_.ToString("x2") }) -join "")
+    }
+    finally {
+        if ($rng) { $rng.Dispose() }
+    }
+}
+
+function Get-AutoClawNodeCommand {
+    # Functional probe, never a bare Get-Command (AGENTS.md Python rule,
+    # applied to node): the candidate must run --version and report v*.
+    # Fallback: the app-bundled node.exe.
+    $candidates = @()
+    $cmd = Get-Command node -ErrorAction SilentlyContinue
+    if ($cmd) { $candidates += $cmd.Source }
+    $candidates += "C:\Program Files\AutoClaw\resources\node\node.exe"
+    foreach ($candidate in $candidates) {
+        if (-not (Test-Path -LiteralPath $candidate)) { continue }
+        try {
+            $versionLine = & $candidate --version 2>$null
+        }
+        catch { continue }
+        if ($LASTEXITCODE -eq 0 -and $versionLine -match "^v\d") {
+            return $candidate
+        }
+    }
+    return $null
+}
+
+function New-Ed25519KeypairJson {
+    # Generates {version, deviceId, publicKeyPem, privateKeyPem, createdAtMs}
+    # matching %APPDATA%\AutoClaw\identity\device.json's schema exactly:
+    # SPKI PEM (113 chars) + PKCS8 PEM (119 chars), ed25519 -- verified live.
+    # node:crypto is the generator (PS 5.1 cannot produce ed25519). The temp
+    # .js lives in $env:TEMP, never next to the database file.
+    param(
+        [Parameter(Mandatory = $true)][string]$NodeExe,
+        [Parameter(Mandatory = $true)][string]$DeviceId
+    )
+
+    $tempJs = Join-Path $env:TEMP ("autoclaw_keygen_" + [guid]::NewGuid().ToString("N").Substring(0, 8) + ".js")
+    $js = @'
+const { generateKeyPairSync, randomBytes } = require("crypto");
+const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+const out = {
+  version: 1,
+  deviceId: randomBytes(32).toString("hex"),
+  publicKeyPem: publicKey.export({ type: "spki", format: "pem" }),
+  privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }),
+  createdAtMs: Date.now()
+};
+process.stdout.write(JSON.stringify(out));
+'@
+    [System.IO.File]::WriteAllText($tempJs, $js, (New-Object System.Text.UTF8Encoding $false))
+    try {
+        $jsonText = & $NodeExe $tempJs 2>$null
+        if ($LASTEXITCODE -ne 0) {
+            throw "node keygen failed (exit $LASTEXITCODE)"
+        }
+        $keypair = $jsonText -join "" | ConvertFrom-Json
+        if ($DeviceId) { $keypair.deviceId = $DeviceId }
+        $pub = $keypair.publicKeyPem
+        $priv = $keypair.privateKeyPem
+        if (-not $pub -or -not $priv -or $pub.Length -ne 113 -or $priv.Length -ne 119) {
+            throw ("keygen verify FAILED: PEM lengths {0}/{1} (expected 113/119)" -f $pub.Length, $priv.Length)
+        }
+        if (-not $keypair.deviceId -or $keypair.deviceId -notmatch "^[0-9a-f]{64}$") {
+            throw "keygen verify FAILED: deviceId is not 64-hex"
+        }
+        return $keypair
+    }
+    finally {
+        if (Test-Path -LiteralPath $tempJs) { Remove-Item -LiteralPath $tempJs -Force }
+    }
+}
+
+function Resolve-JsonPropertyPath {
+    # Walks a dotted path ("gateway.port") inside a parsed PSCustomObject.
+    # Returns @{ Container = <obj>; Leaf = <lastSegment> }, or $null when a
+    # segment is missing and -CreateMissing is off.
+    param(
+        [Parameter(Mandatory = $true)]$Root,
+        [Parameter(Mandatory = $true)][string]$DottedPath,
+        [switch]$CreateMissing
+    )
+
+    $segments = $DottedPath.Split('.')
+    $current = $Root
+    for ($i = 0; $i -lt $segments.Count - 1; $i++) {
+        $segment = $segments[$i]
+        if (Test-ObjectProperty -Object $current -Name $segment) {
+            $next = $current.$segment
+            if ($next -isnot [PSCustomObject]) {
+                throw ("path segment '{0}' of '{1}' exists but is not an object" -f $segment, $DottedPath)
+            }
+            $current = $next
+        }
+        elseif ($CreateMissing) {
+            $next = [pscustomobject]@{ }
+            Add-Member -InputObject $current -NotePropertyName $segment -NotePropertyValue $next
+            $current = $next
+        }
+        else {
+            return $null
+        }
+    }
+    return @{ Container = $current; Leaf = $segments[$segments.Count - 1] }
+}
+
+function Get-NestedJsonLeaf {
+    param(
+        [Parameter(Mandatory = $true)]$Root,
+        [Parameter(Mandatory = $true)][string]$DottedPath
+    )
+    $loc = Resolve-JsonPropertyPath -Root $Root -DottedPath $DottedPath
+    if (-not $loc) { return $null }
+    $leaf = $loc.Leaf
+    if (Test-ObjectProperty -Object $loc.Container -Name $leaf) { return $loc.Container.$leaf }
+    return $null
+}
+
+function Set-NestedJsonIdentity {
+    # Set-JsonIdentity handles top-level keys only; AutoClaw's targets are
+    # nested ("gateway.port", "update.checkOnStart"). Same contract as
+    # Set-JsonIdentity: backup -> mutate -> no-BOM write -> verify-after
+    # re-read -> one audit entry per key. Returns $true only if every key
+    # re-read equals its new value.
+    param(
+        [Parameter(Mandatory = $true)][string]$Path,
+        [Parameter(Mandatory = $true)][hashtable]$Updates,
+        [Parameter(Mandatory = $true)][ref]$Audit,
+        [string]$BackupRoot,
+        [string]$BackupLabel,
+        [ref]$Actions
+    )
+
+    if (-not (Test-Path -LiteralPath $Path)) {
+        foreach ($key in $Updates.Keys) {
+            Add-AuditEntry -Audit $Audit -File $Path -Key $key -Before $null -After $Updates[$key] -Ok $false
+        }
+        Write-Host "[FAILED] JSON file not found: $Path" -ForegroundColor Red
+        return $false
+    }
+
+    if ($BackupRoot -and $BackupLabel) {
+        $backupPath = Backup-FileToTimestampDir -Source $Path -BackupRoot $BackupRoot -Label $BackupLabel
+        if ($backupPath) { Add-ActionEntry -Actions $Actions -OriginalPath $Path -BackupPath $backupPath }
+    }
+
+    try {
+        $content = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
+    }
+    catch {
+        foreach ($key in $Updates.Keys) {
+            Add-AuditEntry -Audit $Audit -File $Path -Key $key -Before $null -After $Updates[$key] -Ok $false
+        }
+        Write-Host "[FAILED] could not parse JSON: $Path" -ForegroundColor Red
+        return $false
+    }
+
+    $beforeValues = @{ }
+    try {
+        foreach ($key in $Updates.Keys) {
+            $beforeValues[$key] = Get-NestedJsonLeaf -Root $content -DottedPath $key
+            $loc = Resolve-JsonPropertyPath -Root $content -DottedPath $key -CreateMissing
+            $leaf = $loc.Leaf
+            if (Test-ObjectProperty -Object $loc.Container -Name $leaf) {
+                $loc.Container.$leaf = $Updates[$key]
+            }
+            else {
+                Add-Member -InputObject $loc.Container -NotePropertyName $leaf -NotePropertyValue $Updates[$key]
+            }
+        }
+    }
+    catch {
+        foreach ($key in $Updates.Keys) {
+            Add-AuditEntry -Audit $Audit -File $Path -Key $key -Before $beforeValues[$key] -After $Updates[$key] -Ok $false
+        }
+        Write-Host ("[FAILED] nested key patch: {0}" -f $_.Exception.Message) -ForegroundColor Red
+        return $false
+    }
+
+    [System.IO.File]::WriteAllText($Path, ($content | ConvertTo-Json -Depth 20), (New-Object System.Text.UTF8Encoding $false))
+
+    try {
+        $verifiedContent = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
+    }
+    catch {
+        foreach ($key in $Updates.Keys) {
+            Add-AuditEntry -Audit $Audit -File $Path -Key $key -Before $beforeValues[$key] -After $Updates[$key] -Ok $false
+        }
+        Write-Host "[FAILED] could not re-read JSON after write: $Path" -ForegroundColor Red
+        return $false
+    }
+
+    $allMatched = $true
+    foreach ($key in $Updates.Keys) {
+        $actualValue = Get-NestedJsonLeaf -Root $verifiedContent -DottedPath $key
+        $ok = $actualValue -eq $Updates[$key]
+        Add-AuditEntry -Audit $Audit -File $Path -Key $key -Before $beforeValues[$key] -After $actualValue -Ok $ok
+        if (-not $ok) { $allMatched = $false }
+    }
+
+    return $allMatched
+}
+
+function Set-VerifiedTextFile {
+    # No-BOM UTF-8 plain-text write + verify-after re-read (.updaterId shape).
+    param(
+        [Parameter(Mandatory = $true)][string]$Path,
+        [Parameter(Mandatory = $true)][string]$Value,
+        [Parameter(Mandatory = $true)][ref]$Audit,
+        [string]$BackupRoot,
+        [string]$BackupLabel,
+        [ref]$Actions
+    )
+
+    $beforeValue = $null
+    if (Test-Path -LiteralPath $Path) {
+        $beforeValue = (Get-Content -LiteralPath $Path -Raw).Trim()
+        if ($BackupRoot -and $BackupLabel) {
+            $backupPath = Backup-FileToTimestampDir -Source $Path -BackupRoot $BackupRoot -Label $BackupLabel
+            if ($backupPath) { Add-ActionEntry -Actions $Actions -OriginalPath $Path -BackupPath $backupPath }
+        }
+    }
+
+    $parent = Split-Path -Path $Path -Parent
+    if (-not [string]::IsNullOrWhiteSpace($parent)) {
+        New-Item -Path $parent -ItemType Directory -Force | Out-Null
+    }
+
+    [System.IO.File]::WriteAllText($Path, $Value, (New-Object System.Text.UTF8Encoding $false))
+    $afterValue = (Get-Content -LiteralPath $Path -Raw).Trim()
+    $ok = $afterValue -eq $Value
+    Add-AuditEntry -Audit $Audit -File $Path -Key "updaterId" -Before $beforeValue -After $afterValue -Ok $ok
+    return $ok
+}
+
+function Remove-VerifiedBackedUpFile {
+    # Backup -> delete -> verify-absent. Used for devices\paired.json (the
+    # live operator credential): a reset must not leave it, and its own
+    # gateway regenerates a fresh one at next start.
+    param(
+        [Parameter(Mandatory = $true)][string]$Path,
+        [Parameter(Mandatory = $true)][ref]$Audit,
+        [Parameter(Mandatory = $true)][string]$BackupRoot,
+        [Parameter(Mandatory = $true)][string]$BackupLabel,
+        [ref]$Actions
+    )
+
+    if (-not (Test-Path -LiteralPath $Path)) {
+        Write-Host "[SKIP] $Path not present (nothing to scrub)" -ForegroundColor Yellow
+        return $true
+    }
+
+    $backupPath = Backup-FileToTimestampDir -Source $Path -BackupRoot $BackupRoot -Label $BackupLabel
+    if ($backupPath) { Add-ActionEntry -Actions $Actions -OriginalPath $Path -BackupPath $backupPath }
+    Remove-Item -LiteralPath $Path -Force
+    $absent = -not (Test-Path -LiteralPath $Path)
+    Add-AuditEntry -Audit $Audit -File $Path -Key "paired.json delete" -Before "present" -After $(if ($absent) { "absent" } else { "STILL PRESENT" }) -Ok $absent
+    if (-not $absent) {
+        Write-Host "[FAILED] paired.json still present after delete: $Path" -ForegroundColor Red
+    }
+    return $absent
+}
+
+function Stop-AutoClawProcessesAggressive {
+    param(
+        [int]$MaxAttempts = 10,
+        [int]$DelayMs = 1500
+    )
+
+    Write-Host "[*] Terminating all AutoClaw + gateway processes (aggressive tree-kill)..." -ForegroundColor Cyan
+
+    $processesToKill = @("AutoClaw", "openclaw")
+    $consecutiveClean = 0
+    for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
+        foreach ($processName in $processesToKill) {
+            if (Get-Process -Name $processName -ErrorAction SilentlyContinue) {
+                $null = & taskkill /F /T /IM "$processName.exe" 2>&1
+            }
+        }
+
+        Start-Sleep -Milliseconds $DelayMs
+
+        $count = @(Get-Process -Name "AutoClaw*" -ErrorAction SilentlyContinue).Count
+        $count += @(Get-Process -Name "openclaw*" -ErrorAction SilentlyContinue).Count
+        Write-Host "    attempt $attempt/$MaxAttempts - remaining processes: $count" -ForegroundColor DarkGray
+
+        if ($count -eq 0) {
+            $consecutiveClean++
+            if ($consecutiveClean -ge 2) {
+                Write-Host "[OK] all AutoClaw processes terminated (confirmed across 2 checks)" -ForegroundColor Green
+                return $true
+            }
+        }
+        else {
+            $consecutiveClean = 0
+        }
+    }
+
+    Write-Host "[FAILED] processes still running after $MaxAttempts attempts. Aborting reset." -ForegroundColor Red
+    foreach ($p in @(Get-Process -Name "AutoClaw*" -ErrorAction SilentlyContinue)) {
+        Write-Host ("    AutoClaw PID {0}: {1}" -f $p.Id, $p.Path) -ForegroundColor Red
+    }
+    return $false
+}
+
+function Invoke-TargetReset {
+    # The per-target step sequence. Every step is backup -> mutate -> verify.
+    # Audit/Actions arrive as [ref]s created in the caller's scope (mutation
+    # must propagate); pass/fail counts are returned, never assigned across
+    # scopes ($x++ inside a function only shadows the caller's variable).
+    param(
+        [Parameter(Mandatory = $true)][string]$TargetName,
+        [Parameter(Mandatory = $true)][ref]$Audit,
+        [Parameter(Mandatory = $true)][ref]$Actions,
+        [Parameter(Mandatory = $true)][string]$BackupRoot,
+        [string]$NodeExe
+    )
+
+    $targetPass = 0
+    $targetFail = 0
+
+    $paths = Get-TargetPaths -TargetName $TargetName
+    $roaming = $paths.Roaming
+    $state = $paths.State
+    $gatewayPort = $script:GatewayPorts[$TargetName]
+
+    Write-Host ""
+    Write-Host ("=== Target: {0} ===" -f $TargetName) -ForegroundColor Cyan
+    Write-Host ("  roaming: {0}" -f $roaming) -ForegroundColor DarkGray
+    Write-Host ("  state:   {0}" -f $state) -ForegroundColor DarkGray
+    Write-Host ("  gateway: {0}" -f $gatewayPort) -ForegroundColor DarkGray
+
+    $targetPresent = Test-Path -LiteralPath $roaming
+    if (-not $targetPresent) {
+        Write-Host "[SKIP] roaming profile not found ($roaming) - instance never launched. Nothing to reset." -ForegroundColor Yellow
+        return $true
+    }
+
+    $script:stepIndex = 0
+    $totalSteps = 7
+
+    # --- [1/7] auth.json .deviceId ------------------------------------------------
+    $script:stepIndex++
+    $authPath = Join-Path $roaming "auth.json"
+    Write-Host ("`n[{0}/{1}] auth.json: rotate deviceId" -f $script:stepIndex, $totalSteps) -ForegroundColor White
+    if (Test-Path -LiteralPath $authPath) {
+        $newAuthDeviceId = New-HexId64
+        if ($DryRun) {
+            Write-Host ("  [DRY-RUN] would set deviceId -> {0}" -f $newAuthDeviceId) -ForegroundColor Yellow
+            $step1Ok = $true
+        }
+        else {
+            $step1Ok = Set-JsonIdentity -Path $authPath -Updates @{ "deviceId" = $newAuthDeviceId } `
+                -Audit $Audit -BackupRoot $BackupRoot -BackupLabel "auth.json" -Actions $Actions
+            if ($step1Ok) { Write-Host "[OK] auth.json deviceId rotated + verified" -ForegroundColor Green }
+            else { Write-Host "[FAILED] auth.json deviceId not verified after write" -ForegroundColor Red }
+        }
+    }
+    else {
+        Write-Host "[SKIP] auth.json not present" -ForegroundColor Yellow
+        $step1Ok = $true
+    }
+    if ($step1Ok) { $targetPass++ } else { $targetFail++ }
+
+    # --- [2/7] identity\device.json: fresh ed25519 keypair + deviceId -------------
+    $script:stepIndex++
+    $deviceJsonPath = Join-Path $roaming "identity\device.json"
+    Write-Host ("`n[{0}/{1}] identity\device.json: regenerate ed25519 keypair + deviceId" -f $script:stepIndex, $totalSteps) -ForegroundColor White
+    if (Test-Path -LiteralPath $deviceJsonPath) {
+        $newDeviceId = New-HexId64
+        if ($DryRun) {
+            Write-Host ("  [DRY-RUN] would regenerate keypair + set deviceId -> {0}" -f $newDeviceId) -ForegroundColor Yellow
+            $step2Ok = $true
+        }
+        else {
+            $keypair = $null
+            $step2Ok = $false
+            try {
+                $keypair = New-Ed25519KeypairJson -NodeExe $NodeExe -DeviceId $newDeviceId
+                $step2Ok = $true
+            }
+            catch {
+                Write-Host ("[FAILED] keygen: {0}" -f $_.Exception.Message) -ForegroundColor Red
+            }
+            if ($step2Ok) {
+                $step2Ok = Set-JsonIdentity -Path $deviceJsonPath -Updates @{
+                    "version"       = 1
+                    "deviceId"      = $keypair.deviceId
+                    "publicKeyPem"  = $keypair.publicKeyPem
+                    "privateKeyPem" = $keypair.privateKeyPem
+                    "createdAtMs"   = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
+                } -Audit $Audit -BackupRoot $BackupRoot -BackupLabel (Join-Path "identity" "device.json") -Actions $Actions
+                if ($step2Ok) { Write-Host "[OK] device.json keypair + deviceId rotated + verified" -ForegroundColor Green }
+                else { Write-Host "[FAILED] device.json not verified after write" -ForegroundColor Red }
+            }
+        }
+    }
+    else {
+        Write-Host "[SKIP] identity\device.json not present" -ForegroundColor Yellow
+        $step2Ok = $true
+    }
+    if ($step2Ok) { $targetPass++ } else { $targetFail++ }
+
+    # --- [3/7] settings.json: gateway port + updater guard ------------------------
+    $script:stepIndex++
+    $settingsPath = Join-Path $roaming "settings.json"
+    Write-Host ("`n[{0}/{1}] settings.json: gateway.port={2}, url, update.autoUpdate=false" -f $script:stepIndex, $totalSteps, $gatewayPort) -ForegroundColor White
+    if (Test-Path -LiteralPath $settingsPath) {
+        if ($DryRun) {
+            Write-Host ("  [DRY-RUN] would set gateway.port -> {0}, gateway.url -> ws://127.0.0.1:{0}, system.autoUpdate -> False" -f $gatewayPort) -ForegroundColor Yellow
+            $step3Ok = $true
+        }
+        else {
+            $step3Ok = Set-NestedJsonIdentity -Path $settingsPath -Updates @{
+                "gateway.port"      = $gatewayPort
+                "gateway.url"       = "ws://127.0.0.1:$gatewayPort"
+                "system.autoUpdate" = $false
+            } -Audit $Audit -BackupRoot $BackupRoot -BackupLabel "settings.json" -Actions $Actions
+            if ($step3Ok) { Write-Host "[OK] settings.json port + url + autoUpdate verified" -ForegroundColor Green }
+            else { Write-Host "[FAILED] settings.json not verified after write" -ForegroundColor Red }
+        }
+    }
+    else {
+        Write-Host "[SKIP] settings.json not present" -ForegroundColor Yellow
+        $step3Ok = $true
+    }
+    if ($step3Ok) { $targetPass++ } else { $targetFail++ }
+
+    # --- [4/7] .updaterId: rotate --------------------------------------------------
+    $script:stepIndex++
+    $updaterIdPath = Join-Path $roaming ".updaterId"
+    Write-Host ("`n[{0}/{1}] .updaterId: rotate GUID" -f $script:stepIndex, $totalSteps) -ForegroundColor White
+    $newUpdaterId = ([guid]::NewGuid().ToString()).ToLowerInvariant()
+    if ($DryRun) {
+        Write-Host ("  [DRY-RUN] would set .updaterId -> {0}" -f $newUpdaterId) -ForegroundColor Yellow
+        $step4Ok = $true
+    }
+    else {
+        $step4Ok = Set-VerifiedTextFile -Path $updaterIdPath -Value $newUpdaterId `
+            -Audit $Audit -BackupRoot $BackupRoot -BackupLabel ".updaterId" -Actions $Actions
+        if ($step4Ok) { Write-Host "[OK] .updaterId rotated + verified" -ForegroundColor Green }
+        else { Write-Host "[FAILED] .updaterId not verified after write" -ForegroundColor Red }
+    }
+    if ($step4Ok) { $targetPass++ } else { $targetFail++ }
+
+    # --- [5/7] openclaw.json: gateway.mode + update.checkOnStart -------------------
+    $script:stepIndex++
+    $openclawJsonPath = Join-Path $state "openclaw.json"
+    Write-Host ("`n[{0}/{1}] openclaw.json: gateway.mode=local, update.checkOnStart=false" -f $script:stepIndex, $totalSteps) -ForegroundColor White
+    if (Test-Path -LiteralPath $openclawJsonPath) {
+        if ($DryRun) {
+            Write-Host "  [DRY-RUN] would ensure gateway.mode=local + update.checkOnStart=false" -ForegroundColor Yellow
+            $step5Ok = $true
+        }
+        else {
+            $step5Ok = Set-NestedJsonIdentity -Path $openclawJsonPath -Updates @{
+                "gateway.mode"        = "local"
+                "update.checkOnStart" = $false
+            } -Audit $Audit -BackupRoot $BackupRoot -BackupLabel (Join-Path "state" "openclaw.json") -Actions $Actions
+            if ($step5Ok) { Write-Host "[OK] openclaw.json mode + checkOnStart verified" -ForegroundColor Green }
+            else { Write-Host "[FAILED] openclaw.json not verified after write" -ForegroundColor Red }
+        }
+    }
+    else {
+        # instN before its first launch has no state dir yet -- legitimate skip.
+        Write-Host "[SKIP] openclaw.json not present (state dir not created yet)" -ForegroundColor Yellow
+        $step5Ok = $true
+    }
+    if ($step5Ok) { $targetPass++ } else { $targetFail++ }
+
+    # --- [6/7] devices\paired.json: delete the live operator credential ------------
+    $script:stepIndex++
+    $pairedPath = Join-Path $state "devices\paired.json"
+    Write-Host ("`n[{0}/{1}] devices\paired.json: backup + delete (gateway regenerates)" -f $script:stepIndex, $totalSteps) -ForegroundColor White
+    if ($DryRun) {
+        if (Test-Path -LiteralPath $pairedPath) {
+            Write-Host "  [DRY-RUN] would back up + delete paired.json (live operator credential)" -ForegroundColor Yellow
+        }
+        else {
+            Write-Host "  [DRY-RUN] paired.json not present - nothing to delete" -ForegroundColor Yellow
+        }
+        $step6Ok = $true
+    }
+    else {
+        $step6Ok = $true
+        if (Test-Path -LiteralPath $pairedPath) {
+            $step6Ok = Remove-VerifiedBackedUpFile -Path $pairedPath -Audit $Audit `
+                -BackupRoot $BackupRoot -BackupLabel (Join-Path "state" "devices\paired.json") -Actions $Actions
+            if ($step6Ok) { Write-Host "[OK] paired.json deleted (will be regenerated on next start)" -ForegroundColor Green }
+        }
+        else {
+            Write-Host "[SKIP] paired.json not present" -ForegroundColor Yellow
+        }
+    }
+    if ($step6Ok) { $targetPass++ } else { $targetFail++ }
+
+    # --- [7/7] final re-verify ------------------------------------------------------
+    $script:stepIndex++
+    Write-Host ("`n[{0}/{1}] final re-verify" -f $script:stepIndex, $totalSteps) -ForegroundColor White
+    $step7Ok = $true
+    if (-not $DryRun) {
+        if (Test-Path -LiteralPath $pairedPath) {
+            Write-Host "[FAILED] watchdog: paired.json was recreated during the run" -ForegroundColor Red
+            $step7Ok = $false
+        }
+        $verifyAuth = Join-Path $roaming "auth.json"
+        if (Test-Path -LiteralPath $verifyAuth) {
+            $authEntries = @($Audit.Value | Where-Object { $_.file -eq $verifyAuth -and $_.key -eq "deviceId" })
+            if ($authEntries.Count -gt 0 -and $authEntries[-1].ok -ne $true) {
+                Write-Host "[FAILED] watchdog: auth.json deviceId audit entry not ok" -ForegroundColor Red
+                $step7Ok = $false
+            }
+        }
+        if ($step7Ok) { Write-Host "[OK] watchdog re-verify passed" -ForegroundColor Green }
+    }
+    else {
+        Write-Host "  [DRY-RUN] watchdog re-verify skipped" -ForegroundColor Yellow
+    }
+    if ($step7Ok) { $targetPass++ } else { $targetFail++ }
+
+    return [pscustomobject]@{ Pass = $targetPass; Fail = $targetFail }
+}
+
+# === Main ======================================================================
+
+# node is required for the ed25519 keygen (step 2). Detect once, up front, so a
+# missing interpreter fails the run instead of silently skipping the keypair.
+$script:NodeExe = $null
+if (-not $DryRun) {
+    $script:NodeExe = Get-AutoClawNodeCommand
+    if (-not $script:NodeExe) {
+        Write-Host "[FAILED] node not found on PATH and no bundled node.exe - cannot regenerate identity\device.json. Install Node.js and re-run." -ForegroundColor Red
+        exit 1
+    }
+    Write-Host "node for keygen: $script:NodeExe" -ForegroundColor DarkGray
+}
+
+if ($DryRun) {
+    Write-Host "*** DRY RUN - no files will be modified ***" -ForegroundColor Yellow
+}
+else {
+    if (-not (Stop-AutoClawProcessesAggressive)) {
+        Write-Host "AutoClaw reset aborted (processes unkillable)." -ForegroundColor Red
+        exit 1
+    }
+}
+
+$targetList = Resolve-TargetList -TargetName $Target
+$passCount = 0
+$failCount = 0
+$audit = @()
+$actions = @()
+$primaryBackupRoot = $null
+
+foreach ($singleTarget in $targetList) {
+    $paths = Get-TargetPaths -TargetName $singleTarget
+    $timestamp = Get-Date -Format "yyyyMMdd-HHmmss"
+    $backupRoot = Join-Path $paths.Roaming ("ID_Backups\" + $timestamp)
+    if ($singleTarget -eq "Primary") { $primaryBackupRoot = $backupRoot }
+    $audit = @()
+    $actions = @()
+
+    $result = Invoke-TargetReset -TargetName $singleTarget -Audit ([ref]$audit) -Actions ([ref]$actions) -BackupRoot $backupRoot -NodeExe $script:NodeExe
+    $passCount += $result.Pass
+    $failCount += $result.Fail
+
+    if ($DryRun) { continue }
+
+    # --- Audit + Restore per target ---
+    $auditPath = Join-Path $backupRoot ("audit_{0}.json" -f $timestamp)
+    Write-AuditLog -Audit $audit -Path $auditPath
+    $restoreScriptPath = New-RestoreScript -BackupRoot $backupRoot -App "AutoClaw" -Actions $actions
+    Write-Host ("Audit log: {0}" -f $auditPath) -ForegroundColor Gray
+    Write-Host ("Restore script: {0}" -f $restoreScriptPath) -ForegroundColor Gray
+}
+
+if ($DryRun) {
+    Write-Host "`n*** DRY RUN complete - no changes were made ***" -ForegroundColor Yellow
+    [System.IO.File]::WriteAllText("$env:TEMP\autoclaw_v0.1_done.txt", "DryRun complete - no changes made", (New-Object System.Text.UTF8Encoding $false))
+    exit 0
+}
+
+Write-Host "`n=== Summary ===" -ForegroundColor Cyan
+Write-Host "Pass: $passCount" -ForegroundColor Green
+Write-Host "Fail: $failCount" -ForegroundColor Red
+Write-Host "NOTE: system.autoUpdate is now $false on every reset instance - any app update reverts the MCP port patch; re-run tools\patch_autoclaw_ports.ps1 after updating." -ForegroundColor Yellow
+Write-Host "NOTE: deleting devices\paired.json means re-pairing clients (e.g. Hermes) on next start." -ForegroundColor Yellow
+
+[System.IO.File]::WriteAllText("$env:TEMP\autoclaw_v0.1_done.txt", ("Pass: {0} Fail: {1}" -f $passCount, $failCount), (New-Object System.Text.UTF8Encoding $false))
+
+if ($failCount -gt 0) {
+    Write-Host "AutoClaw reset v0.1 [$Target] completed with failures." -ForegroundColor Red
+    exit 1
+}
+
+Write-Host "AutoClaw reset v0.1 [$Target] completed successfully." -ForegroundColor Green
diff --git a/src/windows/reset_cursor.ps1 b/src/windows/reset_cursor.ps1
index 508ee82..a27cf1a 100644
--- a/src/windows/reset_cursor.ps1
+++ b/src/windows/reset_cursor.ps1
@@ -1,17 +1,15 @@
 #Requires -Version 5.1
-# Cursor Identity Reset v0.2
+# Cursor Identity Reset v0.3 — thin manifest over the Python core
 #
-# Hardened rebuild of reset_cursor_windows-v0.1.ps1 on the v1.1 template:
-#   - Self-elevation to Administrator (auto re-launch, no manual "run as admin")
-#   - Aggressive multi-process kill (Cursor + helpers, 2 consecutive clean checks)
-#   - No-BOM UTF-8 on EVERY write (v0.1 used Set-Content -Encoding UTF8, which
-#     emits a BOM under PowerShell 5.1 and can corrupt Chromium/Electron parsers)
-#   - Delete (not rename) for binary stores: renames left *.backup files with
-#     the OLD fingerprint on disk. Backups live in ID_Backups for restore.
-#   - NEW targets over v0.1: state.vscdb auth-secrets scrub (key list verified
-#     live on 2026-09-12), os_crypt rotation, Preferences device_id_salt,
-#     SharedStorage, Trust Tokens, Crashpad, logs, stale .backup deletion,
-#     old ID_Backups purge, watchdog re-verify.
+# Phase 3 pilot per docs/PYTHON_HYBRID_ROADMAP.md: the 15 steps and their
+# order, audit keys, restore-script actions and summary are IDENTICAL to
+# v0.2 (archived at archive/reset_cursor_windows-v0.2.ps1); every store
+# mutation now runs through src\python\ghost_cli.py (base64 payload in,
+# JSON report out) via ONE invocation helper. What was deleted from v0.2:
+# the inline temp-.py heredoc (step 4 now uses the shared delete-secrets
+# subcommand - the exact de-duplication the repo conventions mandate), and
+# ~400 lines of one-off local mutation helpers replaced by the tested
+# ghost.filesweep / ghost.winstore / ghost.backup modules.
 #
 # PRESERVATION (chat history + workspaces are never wiped):
 #   - composerHeaders table + all chat/composer keys: never touched.
@@ -30,7 +28,12 @@
 # Usage (Windows 10, PowerShell 5.1 or 7 -- just double-click or run):
 #   powershell -ExecutionPolicy Bypass -File reset_cursor.ps1
 # Prerequisite: close Cursor first (the script also force-kills it).
-# Requirement: Python (python or python3) for SQLite writes.
+# Requirement: Python (python or python3) for EVERY store mutation now
+# (v0.2 needed it only for SQLite writes). The functional probe in
+# identity_utils.ps1 detects it; without Python the run fails fast.
+# Note: the device_id_salt is now lowercase hex (Python secrets.token_hex);
+# v0.2 generated uppercase. The value is an opaque random salt - case is
+# not significant to the app.
 
 . "$PSScriptRoot\identity_utils.ps1"
 
@@ -41,22 +44,23 @@ $cursorIsAdmin = [Security.Principal.WindowsPrincipal]::new(
     [Security.Principal.WindowsIdentity]::GetCurrent()
 ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
 if (-not $cursorIsAdmin) {
-    $cursorLogOut = "$env:TEMP\cursor_v0.2_result.log"
     $cursorScript = $MyInvocation.MyCommand.Path
-    $cursorArgs = "-ExecutionPolicy Bypass -NoProfile -File `"$cursorScript`" *> `"$cursorLogOut`""
+    # -File passes only declared switches; a redirect operator after -File is
+    # just swallowed as an undeclared argument. The *_done.txt marker file
+    # (not a log) is the persisted result channel - the elevated console shows
+    # the full live output while the run progresses.
+    $cursorArgs = "-ExecutionPolicy Bypass -NoProfile -File `"$cursorScript`""
     Start-Process powershell -Verb RunAs -ArgumentList $cursorArgs -WindowStyle Normal -Wait
-    if (Test-Path -LiteralPath $cursorLogOut) {
-        Get-Content -LiteralPath $cursorLogOut
-    }
-    if (Test-Path -LiteralPath "$env:TEMP\cursor_v0.2_done.txt") {
-        Get-Content -LiteralPath "$env:TEMP\cursor_v0.2_done.txt"
+    if (Test-Path -LiteralPath "$env:TEMP\cursor_v0.3_done.txt") {
+        Get-Content -LiteralPath "$env:TEMP\cursor_v0.3_done.txt"
     }
     exit
 }
 
-Write-GhostBanner -Target "Cursor Identity Reset" -Version "0.2"
+Write-GhostBanner -Target "Cursor Identity Reset" -Version "0.3"
 
-# === Local helpers (Cursor reference pattern, no-BOM throughout) ==============
+# === Local helpers ============================================================
+# Orchestration only. Every store mutation delegates to the Python core.
 
 function Add-ActionEntry {
     param(
@@ -92,434 +96,66 @@ function Get-AppRelativeBackupLabel {
     return Get-PathBackupLabel -Path $TargetPath
 }
 
-function Set-VerifiedMachineIdFile {
-    param(
-        [Parameter(Mandatory = $true)][string]$Path,
-        [Parameter(Mandatory = $true)][string]$Value,
-        [Parameter(Mandatory = $true)][string]$BackupRoot,
-        [Parameter(Mandatory = $true)][string]$BackupLabel,
-        [Parameter(Mandatory = $true)][ref]$Audit,
-        [Parameter(Mandatory = $true)][ref]$Actions
-    )
-
-    $beforeValue = $null
-    if (Test-Path -LiteralPath $Path) {
-        $beforeValue = (Get-Content -LiteralPath $Path -Raw).Trim()
-        $backupPath = Backup-FileToTimestampDir -Source $Path -BackupRoot $BackupRoot -Label $BackupLabel
-        if ($backupPath) {
-            Add-ActionEntry -Actions $Actions -OriginalPath $Path -BackupPath $backupPath
-        }
-    }
-
-    $parent = Split-Path -Path $Path -Parent
-    if (-not [string]::IsNullOrWhiteSpace($parent)) {
-        New-Item -Path $parent -ItemType Directory -Force | Out-Null
-    }
-
-    # No-BOM UTF-8. v0.1 used Set-Content -Encoding UTF8 (BOM on PS 5.1).
-    [System.IO.File]::WriteAllText($Path, $Value, (New-Object System.Text.UTF8Encoding $false))
-    $afterValue = (Get-Content -LiteralPath $Path -Raw).Trim()
-    $ok = $afterValue -eq $Value
-    Add-AuditEntry -Audit $Audit -File $Path -Key "machineid" -Before $beforeValue -After $afterValue -Ok $ok
-    return $ok
-}
-
-function Confirm-JsonValues {
-    param(
-        [Parameter(Mandatory = $true)][string]$Path,
-        [Parameter(Mandatory = $true)][hashtable]$Expected
-    )
-
-    if (-not (Test-Path -LiteralPath $Path)) {
-        return $false
-    }
-
-    $content = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
-    foreach ($key in $Expected.Keys) {
-        $actualValue = if ($null -ne $content.PSObject.Properties[$key]) { $content.$key } else { $null }
-        if ($actualValue -ne $Expected[$key]) {
-            return $false
-        }
-    }
-
-    return $true
-}
-
-function Invoke-WorkspaceSqliteUpdate {
-    param(
-        [Parameter(Mandatory = $true)][string]$WorkspaceDbPath,
-        [Parameter(Mandatory = $true)][string]$DeviceId,
-        [Parameter(Mandatory = $true)][string]$RootPath,
-        [Parameter(Mandatory = $true)][string]$BackupRoot,
-        [Parameter(Mandatory = $true)][ref]$Audit,
-        [Parameter(Mandatory = $true)][ref]$Actions
-    )
-
-    # UPSERT ONLY -- never delete workspace tables/files (chat preservation).
-    $ok = Set-SqliteKeys `
-        -Path $WorkspaceDbPath `
-        -Updates @{ "storage.serviceMachineId" = $DeviceId } `
-        -Audit $Audit `
-        -BackupRoot $BackupRoot `
-        -BackupLabel (Get-AppRelativeBackupLabel -RootPath $RootPath -TargetPath $WorkspaceDbPath) `
-        -Actions $Actions
-
-    if ($ok) {
-        Write-Host "    [OK] workspace DB updated: $WorkspaceDbPath" -ForegroundColor Green
-    }
-    else {
-        Write-Host "    [FAILED] workspace DB update: $WorkspaceDbPath" -ForegroundColor Red
-    }
+function _B64Payload {
+    # Compact JSON -> base64: the core bridge's payload contract (sidesteps
+    # PS 5.1 native-argument quoting entirely).
+    param([Parameter(Mandatory = $true)][hashtable]$Payload)
+    $json = $Payload | ConvertTo-Json -Depth 6 -Compress
+    return [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($json))
 }
 
-# DELETE Cursor account secrets from state.vscdb ItemTable and verify survivors
-# are zero via read-only reopen. Key list verified live on 2026-09-12 against
-# %APPDATA%\Cursor\User\globalStorage\state.vscdb. composerHeaders (chat),
-# cursorDiskKV, MCP/third-party secrets and git-ipc tokens are never touched.
-function Clear-CursorSecrets {
-    param(
-        [Parameter(Mandatory = $true)][string]$Path,
-        [Parameter(Mandatory = $true)][string]$BackupRoot,
-        [Parameter(Mandatory = $true)][string]$BackupLabel,
-        [Parameter(Mandatory = $true)][ref]$Audit,
-        [Parameter(Mandatory = $true)][ref]$Actions
-    )
+function Invoke-GhostCore {
+    # The one PS -> Python invocation point for every store mutation.
+    # Returns the parsed JSON report, or $null when the core is missing or
+    # the subcommand failed (exit code non-zero). Same recipe Set-SqliteKeys
+    # uses: functional python probe + UTF-8 console + exit-code check.
+    param([Parameter(Mandatory = $true)][string[]]$CliArgs)
 
-    if (-not (Test-Path -LiteralPath $Path)) {
-        Add-AuditEntry -Audit $Audit -File $Path -Key "secrets-delete" -Before "missing" -After "skipped" -Ok $true
-        Write-Host "    [SKIP] secrets DB not found: $Path" -ForegroundColor Yellow
-        return $true
+    $cli = Get-GhostPythonCli
+    if (-not $cli) {
+        Write-Host "[FAILED] GHOST Python core not found (src\python\ghost_cli.py)." -ForegroundColor Red
+        return $null
     }
-
-    $backupPath = Backup-FileToTimestampDir -Source $Path -BackupRoot $BackupRoot -Label $BackupLabel
-    if ($backupPath) {
-        Add-ActionEntry -Actions $Actions -OriginalPath $Path -BackupPath $backupPath
-    }
-
     $pythonCommand = Get-PythonCommandInfo
     if (-not $pythonCommand) {
-        Add-AuditEntry -Audit $Audit -File $Path -Key "secrets-delete" -Before "present" -After "python-not-found" -Ok $false
-        Write-Host "    [FAILED] Python not found -- secrets deletion SKIPPED: $Path" -ForegroundColor Red
-        return $false
+        Write-Host "[FAILED] no functional Python 3 found - every Cursor reset step needs it." -ForegroundColor Red
+        return $null
     }
-
-    $tempScriptPath = Join-Path $env:TEMP ("cursor_scrub_secrets_{0}.py" -f ([guid]::NewGuid().ToString("N")))
-    $pythonScript = @'
-import sqlite3
-import json
-import sys
-
-db_path = sys.argv[1]
-
-exact_keys = [
-    "cursorAuth/accessToken",
-    "cursorAuth/refreshToken",
-    "cursorAuth/cachedEmail",
-    "cursorAuth/cachedScopedProfile",
-    "cursorAuth/cachedSignUpType",
-    "cursorAuth/onboardingDate",
-    "cursorAuth/stripeMembershipAuthId",
-    "cursorAuth/stripeMembershipType",
-    "secret://cursorAuth/openAIKey",
-    "glass.lastSignedInAuthId",
-    "adminSettings.cachedAuthId",
-    "cursor.customize.userDisplayNameCache",
-]
-like_patterns = [
-    "cursorAuth/%",
-    "%google-oauth2|user%",
-]
-
-deleted = []
-conn = sqlite3.connect(db_path)
-try:
-    cursor = conn.cursor()
-    for key in exact_keys:
-        cursor.execute("SELECT key FROM ItemTable WHERE key = ?", (key,))
-        for row in cursor.fetchall():
-            cursor.execute("DELETE FROM ItemTable WHERE key = ?", (row[0],))
-            deleted.append(row[0])
-    for pattern in like_patterns:
-        cursor.execute("SELECT key FROM ItemTable WHERE key LIKE ?", (pattern,))
-        for row in cursor.fetchall():
-            cursor.execute("DELETE FROM ItemTable WHERE key = ?", (row[0],))
-            deleted.append(row[0])
-    conn.commit()
-finally:
-    conn.close()
-
-verify_conn = sqlite3.connect("file:" + db_path + "?mode=ro", uri=True)
-try:
-    verify_cursor = verify_conn.cursor()
-    survivors = 0
-    for key in exact_keys:
-        verify_cursor.execute("SELECT COUNT(*) FROM ItemTable WHERE key = ?", (key,))
-        survivors += verify_cursor.fetchone()[0]
-    for pattern in like_patterns:
-        verify_cursor.execute("SELECT COUNT(*) FROM ItemTable WHERE key LIKE ?", (pattern,))
-        survivors += verify_cursor.fetchone()[0]
-finally:
-    verify_conn.close()
-
-print(json.dumps({"deleted": deleted, "survivors": survivors}))
-'@
-
-    try {
-        [System.IO.File]::WriteAllText($tempScriptPath, $pythonScript, (New-Object System.Text.UTF8Encoding $false))
-        $commandOutput = & $pythonCommand $tempScriptPath $Path
-        if ($LASTEXITCODE -ne 0) {
-            Add-AuditEntry -Audit $Audit -File $Path -Key "secrets-delete" -Before "present" -After "failed" -Ok $false
-            Write-Host "    [FAILED] secrets deletion command failed: $Path" -ForegroundColor Red
-            return $false
-        }
-
-        $result = ($commandOutput -join "`n") | ConvertFrom-Json
-        $ok = ($result.survivors -eq 0)
-        $deletedCount = $result.deleted.Count
-        if ($ok) {
-            Add-AuditEntry -Audit $Audit -File $Path -Key "secrets-delete" -Before "present" -After ("deleted " + $deletedCount) -Ok $true
-            Write-Host "    [OK] secrets deleted: $deletedCount keys from $Path" -ForegroundColor Green
-        }
-        else {
-            Add-AuditEntry -Audit $Audit -File $Path -Key "secrets-delete" -Before "present" -After ("survivors=" + $result.survivors) -Ok $false
-            Write-Host "    [FAILED] secrets survivors remain: $($result.survivors) in $Path" -ForegroundColor Red
-        }
-        return $ok
-    }
-    catch {
-        Add-AuditEntry -Audit $Audit -File $Path -Key "secrets-delete" -Before "present" -After "exception" -Ok $false
-        Write-Host "    [FAILED] secrets deletion threw exception: $Path" -ForegroundColor Red
-        return $false
-    }
-    finally {
-        if (Test-Path -LiteralPath $tempScriptPath) {
-            Remove-Item -LiteralPath $tempScriptPath -Force -ErrorAction SilentlyContinue
-        }
+    Set-GhostConsoleUtf8
+    $output = & $pythonCommand $cli @CliArgs
+    if ($LASTEXITCODE -ne 0) {
+        return $null
     }
-}
-
-# Delete every file under $Path individually with retry, then prune empty dirs.
-# A whole-tree Remove-Item fails FAST on the first locked file; per-file delete
-# means one stuck file cannot block the rest. Appends a restorable delete
-# action (whole-tree backup) to $Actions.
-function Clear-TreeFilesIndividually {
-    param(
-        [Parameter(Mandatory = $true)][string]$Path,
-        [Parameter(Mandatory = $true)][string]$BackupRoot,
-        [Parameter(Mandatory = $true)][string]$BackupLabel,
-        [Parameter(Mandatory = $true)][ref]$Audit,
-        [Parameter(Mandatory = $true)][ref]$Actions
-    )
-
-    if (-not (Test-Path -LiteralPath $Path)) {
-        Add-AuditEntry -Audit $Audit -File $Path -Key "binary-store" -Before "missing" -After "skipped" -Ok $true
-        return @{ Deleted = 0; Failed = 0; FailedPaths = @() }
-    }
-
-    $backupPath = Backup-FileToTimestampDir -Source $Path -BackupRoot $BackupRoot -Label $BackupLabel
-
-    $files = @(Get-ChildItem -LiteralPath $Path -Recurse -File -Force -ErrorAction SilentlyContinue)
-    $deleted = 0
-    $failed = 0
-    $failedPaths = @()
-
-    foreach ($file in $files) {
-        $fileDeleted = $false
-        $lastError = $null
-        for ($i = 0; $i -lt 4; $i++) {
-            try {
-                Remove-Item -LiteralPath $file.FullName -Force -ErrorAction Stop
-                $fileDeleted = $true
-                break
-            }
-            catch {
-                $lastError = $_.Exception.Message
-                Start-Sleep -Milliseconds (500 * ($i + 1))
-            }
-        }
-        if ($fileDeleted) {
-            $deleted++
-        }
-        else {
-            $failed++
-            $failedPaths += $file.FullName
-            Add-AuditEntry -Audit $Audit -File $file.FullName -Key "binary-store" -Before "present" -After ("delete-failed: " + $lastError) -Ok $false
-        }
-    }
-
-    $dirs = @(Get-ChildItem -LiteralPath $Path -Recurse -Directory -Force -ErrorAction SilentlyContinue |
-        Sort-Object { $_.FullName.Length } -Descending)
-    foreach ($dir in $dirs) {
-        $null = Remove-Item -LiteralPath $dir.FullName -Force -ErrorAction SilentlyContinue
-    }
-    $null = Remove-Item -LiteralPath $Path -Force -ErrorAction SilentlyContinue
-
-    $summary = "deleted=$deleted failed=$failed"
-    $ok = ($failed -eq 0)
-    Add-AuditEntry -Audit $Audit -File $Path -Key "binary-store" -Before "present" -After $summary -Ok $ok
-    if ($backupPath) {
-        Add-ActionEntry -Actions $Actions -OriginalPath $Path -BackupPath $backupPath -Action "delete"
-    }
-
-    return @{ Deleted = $deleted; Failed = $failed; FailedPaths = $failedPaths }
-}
-
-# Delete a stale file WITHOUT backing it up (regenerable sidecars only).
-# Verifies the path is gone afterwards.
-function Remove-VerifiedFileNoBackup {
-    param(
-        [Parameter(Mandatory = $true)][string]$Path,
-        [Parameter(Mandatory = $true)][string]$AuditKey,
-        [Parameter(Mandatory = $true)][ref]$Audit
-    )
-
-    if (-not (Test-Path -LiteralPath $Path)) {
-        Add-AuditEntry -Audit $Audit -File $Path -Key $AuditKey -Before "missing" -After "skipped" -Ok $true
-        return $true
-    }
-
-    Remove-Item -LiteralPath $Path -Force -ErrorAction SilentlyContinue
-    if (-not (Test-Path -LiteralPath $Path)) {
-        Add-AuditEntry -Audit $Audit -File $Path -Key $AuditKey -Before "present" -After "deleted" -Ok $true
-        return $true
-    }
-
-    Add-AuditEntry -Audit $Audit -File $Path -Key $AuditKey -Before "present" -After "delete-failed" -Ok $false
-    Write-Host "    [FAILED] could not delete: $Path" -ForegroundColor Red
-    return $false
-}
-
-function Remove-OsCryptEncryptedKey {
-    param(
-        [Parameter(Mandatory = $true)][string]$Path,
-        [Parameter(Mandatory = $true)][string]$BackupRoot,
-        [Parameter(Mandatory = $true)][string]$BackupLabel,
-        [Parameter(Mandatory = $true)][ref]$Audit,
-        [Parameter(Mandatory = $true)][ref]$Actions
-    )
-
-    if (-not (Test-Path -LiteralPath $Path)) {
-        Add-AuditEntry -Audit $Audit -File $Path -Key "os_crypt.encrypted_key" -Before "missing" -After "skipped" -Ok $true
-        Write-Host "    [SKIP] Local State not found: $Path" -ForegroundColor Yellow
-        return $true
-    }
-
-    $backupPath = Backup-FileToTimestampDir -Source $Path -BackupRoot $BackupRoot -Label $BackupLabel
-    if ($backupPath) {
-        Add-ActionEntry -Actions $Actions -OriginalPath $Path -BackupPath $backupPath
-    }
-
     try {
-        $content = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
+        return ($output -join "`n") | ConvertFrom-Json
     }
     catch {
-        Add-AuditEntry -Audit $Audit -File $Path -Key "os_crypt.encrypted_key" -Before "present" -After "parse-failed" -Ok $false
-        Write-Host "    [FAILED] could not parse Local State: $Path" -ForegroundColor Red
-        return $false
-    }
-
-    $beforeValue = if ($null -ne $content.PSObject.Properties['os_crypt']) { "present" } else { "missing" }
-    if ($null -eq $content.PSObject.Properties['os_crypt']) {
-        Add-AuditEntry -Audit $Audit -File $Path -Key "os_crypt.encrypted_key" -Before "missing" -After "skipped" -Ok $true
-        Write-Host "    [SKIP] os_crypt not found in: $Path" -ForegroundColor Yellow
-        return $true
-    }
-
-    $content.os_crypt.PSObject.Properties.Remove('encrypted_key')
-
-    [System.IO.File]::WriteAllText($Path, ($content | ConvertTo-Json -Depth 20), (New-Object System.Text.UTF8Encoding $false))
-
-    try {
-        $verified = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
-        $afterValue = if ($null -eq $verified.os_crypt.PSObject.Properties['encrypted_key']) { "removed" } else { "still-present" }
-        $ok = $afterValue -eq "removed"
-        Add-AuditEntry -Audit $Audit -File $Path -Key "os_crypt.encrypted_key" -Before $beforeValue -After $afterValue -Ok $ok
-        if ($ok) {
-            Write-Host "    [OK] os_crypt.encrypted_key removed: $Path" -ForegroundColor Green
-        }
-        else {
-            Write-Host "    [FAILED] os_crypt.encrypted_key still present: $Path" -ForegroundColor Red
-        }
-        return $ok
-    }
-    catch {
-        Add-AuditEntry -Audit $Audit -File $Path -Key "os_crypt.encrypted_key" -Before $beforeValue -After "verify-failed" -Ok $false
-        Write-Host "    [FAILED] could not re-read Local State after write: $Path" -ForegroundColor Red
-        return $false
+        Write-Host "[FAILED] unparseable core output: $($output -join ' ')" -ForegroundColor Red
+        return $null
     }
 }
 
-function Set-DeviceIdSalt {
+function Backup-ViaCore {
+    # Backup-FileToTimestampDir via the core, plus the restore-manifest
+    # action. A locked/failed backup is reported but NOT fatal - the v0.2
+    # contract verbatim (a file whose copy could not be read may still be
+    # deletable, and the caller proceeds).
     param(
-        [Parameter(Mandatory = $true)][string]$Path,
-        [Parameter(Mandatory = $true)][string]$NewSalt,
+        [Parameter(Mandatory = $true)][string]$Source,
         [Parameter(Mandatory = $true)][string]$BackupRoot,
-        [Parameter(Mandatory = $true)][string]$BackupLabel,
-        [Parameter(Mandatory = $true)][ref]$Audit,
+        [Parameter(Mandatory = $true)][string]$Label,
         [Parameter(Mandatory = $true)][ref]$Actions
     )
 
-    if (-not (Test-Path -LiteralPath $Path)) {
-        Add-AuditEntry -Audit $Audit -File $Path -Key "electron.media.device_id_salt" -Before "missing" -After "skipped" -Ok $true
-        Write-Host "    [SKIP] Preferences not found: $Path" -ForegroundColor Yellow
+    $report = Invoke-GhostCore @("backup", $Source, $BackupRoot, $Label)
+    if ($null -eq $report) { return $false }
+    if ($report.skipped) { return $false }
+    if ($report.ok -and $report.destination) {
+        Add-ActionEntry -Actions $Actions -OriginalPath $Source -BackupPath $report.destination
         return $true
     }
-
-    $backupPath = Backup-FileToTimestampDir -Source $Path -BackupRoot $BackupRoot -Label $BackupLabel
-    if ($backupPath) {
-        Add-ActionEntry -Actions $Actions -OriginalPath $Path -BackupPath $backupPath
-    }
-
-    try {
-        $content = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
-    }
-    catch {
-        Add-AuditEntry -Audit $Audit -File $Path -Key "electron.media.device_id_salt" -Before "present" -After "parse-failed" -Ok $false
-        Write-Host "    [FAILED] could not parse Preferences: $Path" -ForegroundColor Red
-        return $false
-    }
-
-    $beforeValue = $null
-    $targetKey = "electron.media.device_id_salt"
-
-    $electronProp = if ($null -ne $content.PSObject.Properties['electron']) { $content.electron } else { $null }
-    if ($electronProp -and ($null -ne $electronProp.PSObject.Properties['media'])) {
-        $mediaProp = $electronProp.media
-        if ($null -ne $mediaProp.PSObject.Properties['device_id_salt']) {
-            $beforeValue = $mediaProp.device_id_salt
-        }
-    }
-
-    if ($null -eq $electronProp) {
-        Add-Member -InputObject $content -NotePropertyName 'electron' -NotePropertyValue @{ media = @{ device_id_salt = $NewSalt } }
-    }
-    elseif ($null -eq $electronProp.PSObject.Properties['media']) {
-        Add-Member -InputObject $content.electron -NotePropertyName 'media' -NotePropertyValue @{ device_id_salt = $NewSalt }
-    }
-    else {
-        $content.electron.media.device_id_salt = $NewSalt
-    }
-
-    [System.IO.File]::WriteAllText($Path, ($content | ConvertTo-Json -Depth 20), (New-Object System.Text.UTF8Encoding $false))
-
-    try {
-        $verified = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
-        $actualValue = $verified.electron.media.device_id_salt
-        $ok = $actualValue -eq $NewSalt
-        Add-AuditEntry -Audit $Audit -File $Path -Key $targetKey -Before $beforeValue -After $actualValue -Ok $ok
-        if ($ok) {
-            Write-Host "    [OK] device_id_salt updated: $Path" -ForegroundColor Green
-        }
-        else {
-            Write-Host "    [FAILED] device_id_salt verification failed: $Path" -ForegroundColor Red
-        }
-        return $ok
-    }
-    catch {
-        Add-AuditEntry -Audit $Audit -File $Path -Key $targetKey -Before $beforeValue -After "verify-failed" -Ok $false
-        Write-Host "    [FAILED] could not re-read Preferences after write: $Path" -ForegroundColor Red
-        return $false
-    }
+    Write-Host "    [WARN] backup did not complete ($($report.error)) - proceeding" -ForegroundColor Yellow
+    return $false
 }
 
 # Aggressive tree-kill for Cursor plus extension helpers that hold file
@@ -588,7 +224,7 @@ function Stop-CursorProcessesAggressive {
 
 # Post-reset watchdog probe: a slow-shutdown helper can recreate core identity
 # files within seconds of deletion. Re-delete with a WARN audit entry (the
-# reset itself already succeeded, so this never FAILs the run).
+# v0.2 logic verbatim; the deletion itself stays PS - pure process/file op).
 function Test-WatchdogRecreation {
     param(
         [Parameter(Mandatory = $true)][string[]]$CoreFiles,
@@ -615,12 +251,15 @@ function Test-WatchdogRecreation {
         Write-Host "    [WARN] watchdog recreated file, re-deleting: $path" -ForegroundColor Yellow
         Remove-Item -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue
         $afterValue = if (Test-Path -LiteralPath $path) { "re-delete-failed" } else { "re-deleted" }
-        Add-AuditEntry -Audit $Audit -File $path -Key "watchdog-recreate" -Before "recreated" -After $afterValue -Ok $true
+        if ($afterValue -eq "re-delete-failed") {
+            Write-Host "    [FAILED] could not re-delete (file locked?): $path" -ForegroundColor Red
+        }
+        Add-AuditEntry -Audit $Audit -File $path -Key "watchdog-recreate" -Before "recreated" -After $afterValue -Ok ($afterValue -eq "re-deleted")
     }
 }
 
-# Old ID_Backups directories preserve complete snapshots of every identity file
-# with the OLD IDs still embedded. Keep the current run only; delete the rest.
+# Purge every ID_Backups run EXCEPT the current one (each run re-backs-up
+# everything it touches, so old runs only preserve OLD fingerprints).
 function Invoke-OldIdBackupsPurge {
     param(
         [Parameter(Mandatory = $true)][string]$BackupRoot,
@@ -674,6 +313,26 @@ function Get-StepAuditStatus {
     return @{ Success = ($failed.Count -eq 0); FailedEntries = $failed }
 }
 
+function Confirm-JsonValues {
+    param(
+        [Parameter(Mandatory = $true)][string]$Path,
+        [Parameter(Mandatory = $true)][hashtable]$Expected
+    )
+
+    if (-not (Test-Path -LiteralPath $Path)) {
+        return $false
+    }
+    $content = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json
+    foreach ($key in $Expected.Keys) {
+        $actualValue = if ($null -ne $content.PSObject.Properties[$key]) { $content.$key } else { $null }
+        if ($actualValue -ne $Expected[$key]) {
+            return $false
+        }
+    }
+
+    return $true
+}
+
 # === Main =====================================================================
 
 Assert-Administrator
@@ -696,9 +355,17 @@ if (-not (Test-Path -LiteralPath $root)) {
     exit 1
 }
 
+# The core must be present and a functional Python 3 with it - fail fast
+# BEFORE touching anything (v0.2 could run JSON-only steps without Python;
+# v0.3 cannot run any step without it).
+if ((Get-GhostPythonCli) -and (-not (Get-PythonCommandInfo))) {
+    Write-Host "[FAILED] Python core present but no functional Python 3 - install it (winget install Python.Python.3.12)." -ForegroundColor Red
+    exit 1
+}
+
 New-Item -Path $backupRoot -ItemType Directory -Force | Out-Null
 
-Write-Host "=== Cursor Identity Reset v0.2 ===" -ForegroundColor Cyan
+Write-Host "=== Cursor Identity Reset v0.3 ===" -ForegroundColor Cyan
 Write-Host "Root: $root" -ForegroundColor Gray
 Write-Host "Backup: $backupRoot" -ForegroundColor Gray
 Write-Host "Policy: chat history + workspaces preserved; no MAC/hostname/registry steps" -ForegroundColor Gray
@@ -711,7 +378,6 @@ if (-not (Stop-CursorProcessesAggressive)) {
 $passCount = 0
 $failCount = 0
 
-$newSalt = -join ((1..32) | ForEach-Object { "{0:X}" -f (Get-Random -Maximum 16) })
 $storageUpdates = @{
     "telemetry.machineId"    = $ids.machineId
     "telemetry.macMachineId" = $ids.macMachineId
@@ -719,76 +385,144 @@ $storageUpdates = @{
     "telemetry.devDeviceId"  = $ids.devDeviceId
 }
 
-# --- [1/15] machineid ---
+# --- [1/15] machineid (core: machineid-file) ---
 Write-Host "`n[1/15] Updating machineid..." -ForegroundColor Cyan
-if (Set-VerifiedMachineIdFile -Path $machineIdPath -Value $ids.devDeviceId -BackupRoot $backupRoot -BackupLabel (Get-AppRelativeBackupLabel -RootPath $root -TargetPath $machineIdPath) -Audit ([ref]$audit) -Actions ([ref]$actions)) {
+$machReport = Invoke-GhostCore @("machineid-file", $machineIdPath, $backupRoot,
+    (Get-AppRelativeBackupLabel -RootPath $root -TargetPath $machineIdPath),
+    (_B64Payload @{ value = $ids.devDeviceId }))
+if ($null -ne $machReport -and $machReport.ok) {
+    Add-AuditEntry -Audit ([ref]$audit) -File $machineIdPath -Key "machineid" -Before $machReport.before -After $machReport.after -Ok $true
+    if ($machReport.backed_up_to) {
+        Add-ActionEntry -Actions ([ref]$actions) -OriginalPath $machineIdPath -BackupPath $machReport.backed_up_to
+    }
     Write-Host "[OK] machineid verified" -ForegroundColor Green
     $passCount++
 }
 else {
+    $beforeValue = $null
+    if (Test-Path -LiteralPath $machineIdPath) {
+        $beforeValue = (Get-Content -LiteralPath $machineIdPath -Raw).Trim()
+    }
+    Add-AuditEntry -Audit ([ref]$audit) -File $machineIdPath -Key "machineid" -Before $beforeValue -After "verify-failed" -Ok $false
     Write-Host "[FAILED] machineid verification failed" -ForegroundColor Red
     $failCount++
 }
 
 # --- [2/15] storage.json (4 telemetry keys; verified live: no auth keys here) ---
 Write-Host "`n[2/15] Updating storage.json..." -ForegroundColor Cyan
-if (Set-JsonIdentity -Path $storagePath -Updates $storageUpdates -Audit ([ref]$audit) -BackupRoot $backupRoot -BackupLabel (Get-AppRelativeBackupLabel -RootPath $root -TargetPath $storagePath) -Actions ([ref]$actions)) {
+$storageLabel = Get-AppRelativeBackupLabel -RootPath $root -TargetPath $storagePath
+$null = Backup-ViaCore -Source $storagePath -BackupRoot $backupRoot -Label $storageLabel -Actions ([ref]$actions)
+$storageReport = Invoke-GhostCore @("json-patch", $storagePath, (_B64Payload $storageUpdates))
+if ($null -ne $storageReport -and $storageReport.ok) {
+    foreach ($key in $storageUpdates.Keys) {
+        Add-AuditEntry -Audit ([ref]$audit) -File $storagePath -Key $key -Before $storageReport.before.$key -After $storageReport.after.$key -Ok $true
+    }
     Write-Host "[OK] storage.json verified" -ForegroundColor Green
     $passCount++
 }
 else {
+    foreach ($key in $storageUpdates.Keys) {
+        Add-AuditEntry -Audit ([ref]$audit) -File $storagePath -Key $key -Before $null -After $storageUpdates[$key] -Ok $false
+    }
     Write-Host "[FAILED] storage.json verification failed" -ForegroundColor Red
     $failCount++
 }
 
-# --- [3/15] state.vscdb serviceMachineId ---
+# --- [3/15] state.vscdb serviceMachineId (core: sqlite-update) ---
 Write-Host "`n[3/15] Updating global state.vscdb (serviceMachineId)..." -ForegroundColor Cyan
-if (Set-SqliteKeys -Path $sqlitePath -Updates @{ "storage.serviceMachineId" = $ids.devDeviceId } -Audit ([ref]$audit) -BackupRoot $backupRoot -BackupLabel (Get-AppRelativeBackupLabel -RootPath $root -TargetPath $sqlitePath) -Actions ([ref]$actions)) {
+$sqliteLabel = Get-AppRelativeBackupLabel -RootPath $root -TargetPath $sqlitePath
+$null = Backup-ViaCore -Source $sqlitePath -BackupRoot $backupRoot -Label $sqliteLabel -Actions ([ref]$actions)
+$sqliteReport = Invoke-GhostCore @("sqlite-update", $sqlitePath, (_B64Payload @{ "storage.serviceMachineId" = $ids.devDeviceId }))
+if ($null -ne $sqliteReport -and $null -ne $sqliteReport.after) {
+    Add-AuditEntry -Audit ([ref]$audit) -File $sqlitePath -Key "storage.serviceMachineId" -Before $sqliteReport.before."storage.serviceMachineId" -After $sqliteReport.after."storage.serviceMachineId" -Ok $true
     Write-Host "[OK] global state.vscdb verified" -ForegroundColor Green
     $passCount++
 }
 else {
+    Add-AuditEntry -Audit ([ref]$audit) -File $sqlitePath -Key "storage.serviceMachineId" -Before $null -After $ids.devDeviceId -Ok $false
     Write-Host "[FAILED] global state.vscdb verification failed" -ForegroundColor Red
     $failCount++
 }
 
-# --- [4/15] state.vscdb auth secrets DELETE (NEW in v0.2) ---
+# --- [4/15] state.vscdb auth secrets DELETE (core: delete-secrets; v0.2's
+#     inline temp-.py heredoc replaced by the shared subcommand) ---
 Write-Host "`n[4/15] Clearing global state.vscdb auth secrets..." -ForegroundColor Cyan
-if (Clear-CursorSecrets -Path $sqlitePath -BackupRoot $backupRoot -BackupLabel (Get-AppRelativeBackupLabel -RootPath $root -TargetPath $sqlitePath) -Audit ([ref]$audit) -Actions ([ref]$actions)) {
-    $passCount++
-}
-else {
-    $failCount++
+$null = Backup-ViaCore -Source $sqlitePath -BackupRoot $backupRoot -Label $sqliteLabel -Actions ([ref]$actions)
+$secretsReport = Invoke-GhostCore @("delete-secrets", $sqlitePath)
+$secretsOk = $false
+if ($null -ne $secretsReport -and $null -ne $secretsReport.survivors) {
+    $secretsOk = ($secretsReport.survivors -eq 0)
+    $deletedCount = @($secretsReport.deleted).Count
+    if ($secretsOk) {
+        Add-AuditEntry -Audit ([ref]$audit) -File $sqlitePath -Key "secrets-delete" -Before "present" -After ("deleted " + $deletedCount) -Ok $true
+        Write-Host "    [OK] secrets deleted: $deletedCount keys from $sqlitePath" -ForegroundColor Green
+    }
+    else {
+        Add-AuditEntry -Audit ([ref]$audit) -File $sqlitePath -Key "secrets-delete" -Before "present" -After ("survivors=" + $secretsReport.survivors) -Ok $false
+        Write-Host "    [FAILED] secret survivors remain: $($secretsReport.survivors)" -ForegroundColor Red
+    }
 }
+if ($secretsOk) { $passCount++ } else { $failCount++ }
 
-# --- [5/15] stale state.vscdb.backup deletion (NEW in v0.2, no backup of backup) ---
+# --- [5/15] stale state.vscdb.backup deletion (core: sweep-file) ---
 Write-Host "`n[5/15] Deleting stale state.vscdb.backup..." -ForegroundColor Cyan
-if (Remove-VerifiedFileNoBackup -Path (Join-Path $root "User\globalStorage\state.vscdb.backup") -AuditKey "state.vscdb.backup" -Audit ([ref]$audit)) {
+$staleBackup = Join-Path $root "User\globalStorage\state.vscdb.backup"
+$staleReport = Invoke-GhostCore @("sweep-file", $staleBackup)
+if ($null -ne $staleReport -and $staleReport.ok) {
+    Add-AuditEntry -Audit ([ref]$audit) -File $staleBackup -Key "state.vscdb.backup" -Before $staleReport.before -After $staleReport.after -Ok $true
     $passCount++
 }
 else {
+    Add-AuditEntry -Audit ([ref]$audit) -File $staleBackup -Key "state.vscdb.backup" -Before "present" -After "delete-failed" -Ok $false
+    Write-Host "    [FAILED] could not delete: $staleBackup" -ForegroundColor Red
     $failCount++
 }
 
-# --- [6/15] Preferences device_id_salt (NEW in v0.2) ---
+# --- [6/15] Preferences device_id_salt (core: salt-rotate; salt generated in
+#     the core - lowercase hex, opaque random value) ---
 Write-Host "`n[6/15] Updating Preferences (device_id_salt)..." -ForegroundColor Cyan
-if (Set-DeviceIdSalt -Path (Join-Path $root "Preferences") -NewSalt $newSalt -BackupRoot $backupRoot -BackupLabel "Preferences" -Audit ([ref]$audit) -Actions ([ref]$actions)) {
+$saltReport = Invoke-GhostCore @("salt-rotate", (Join-Path $root "Preferences"), $backupRoot, "Preferences")
+if ($null -ne $saltReport -and $saltReport.ok) {
+    Add-AuditEntry -Audit ([ref]$audit) -File (Join-Path $root "Preferences") -Key "electron.media.device_id_salt" -Before $saltReport.before -After $saltReport.after -Ok $true
+    if ($saltReport.backed_up_to) {
+        Add-ActionEntry -Actions ([ref]$actions) -OriginalPath (Join-Path $root "Preferences") -BackupPath $saltReport.backed_up_to
+    }
+    Write-Host "    [OK] device_id_salt updated" -ForegroundColor Green
+    $passCount++
+}
+elseif ($null -ne $saltReport -and $saltReport.skipped) {
+    Add-AuditEntry -Audit ([ref]$audit) -File (Join-Path $root "Preferences") -Key "electron.media.device_id_salt" -Before "missing" -After "skipped" -Ok $true
+    Write-Host "    [SKIP] Preferences not found" -ForegroundColor Yellow
     $passCount++
 }
 else {
+    Add-AuditEntry -Audit ([ref]$audit) -File (Join-Path $root "Preferences") -Key "electron.media.device_id_salt" -Before "present" -After "verify-failed" -Ok $false
+    Write-Host "    [FAILED] device_id_salt verification failed" -ForegroundColor Red
     $failCount++
 }
 
-# --- [7/15] Local State os_crypt rotation (NEW in v0.2) ---
+# --- [7/15] Local State os_crypt rotation (core: json-remove) ---
 Write-Host "`n[7/15] Rotating os_crypt.encrypted_key..." -ForegroundColor Cyan
-if (Remove-OsCryptEncryptedKey -Path (Join-Path $root "Local State") -BackupRoot $backupRoot -BackupLabel "Local State" -Audit ([ref]$audit) -Actions ([ref]$actions)) {
+$osCryptPath = Join-Path $root "Local State"
+$osCryptReport = Invoke-GhostCore @("json-remove", $osCryptPath, $backupRoot, "Local State",
+    (_B64Payload @{ keys = @("os_crypt.encrypted_key") }))
+if ($null -ne $osCryptReport -and $osCryptReport.ok) {
+    $osBefore = $osCryptReport.before."os_crypt.encrypted_key"
+    $osAfter = if ($osBefore -eq "missing") { "skipped" } else { "removed" }
+    Add-AuditEntry -Audit ([ref]$audit) -File $osCryptPath -Key "os_crypt.encrypted_key" -Before $osBefore -After $osAfter -Ok $true
+    if ($osCryptReport.backed_up_to) {
+        Add-ActionEntry -Actions ([ref]$actions) -OriginalPath $osCryptPath -BackupPath $osCryptReport.backed_up_to
+    }
+    Write-Host "    [OK] os_crypt.encrypted_key removed" -ForegroundColor Green
     $passCount++
 }
 else {
+    Add-AuditEntry -Audit ([ref]$audit) -File $osCryptPath -Key "os_crypt.encrypted_key" -Before "present" -After "verify-failed" -Ok $false
+    Write-Host "    [FAILED] os_crypt.encrypted_key verification failed" -ForegroundColor Red
     $failCount++
 }
 
-# --- [8/15] Cookies + transport state (delete; v0.1 renamed, leaving old IDs) ---
+# --- [8/15] Cookies + transport state (core: store-delete, delete mode) ---
 Write-Host "`n[8/15] Clearing Cookies + transport state..." -ForegroundColor Cyan
 $auditStart = $audit.Count
 $cookiePaths = @(
@@ -798,8 +532,20 @@ $cookiePaths = @(
     (Join-Path $root "Network\TransportSecurity"),
     (Join-Path $root "Network\NetworkDataMigrated")
 )
-$cookieActions = Clear-BinaryIdentityStore -Paths $cookiePaths -Action "delete" -BackupRoot $backupRoot -Audit ([ref]$audit) -RootPath $root
-$actions += @($cookieActions)
+foreach ($storePath in $cookiePaths) {
+    $storeReport = Invoke-GhostCore @("store-delete", $storePath, $backupRoot,
+        (Get-AppRelativeBackupLabel -RootPath $root -TargetPath $storePath),
+        "--action", "delete", "--root-path", $root)
+    if ($null -ne $storeReport) {
+        Add-AuditEntry -Audit ([ref]$audit) -File $storePath -Key "binary-store" -Before $storeReport.before -After $storeReport.after -Ok $storeReport.ok
+        if ($storeReport.ok -and $storeReport.backed_up_to) {
+            Add-ActionEntry -Actions ([ref]$actions) -OriginalPath $storePath -BackupPath $storeReport.backed_up_to -Action "delete"
+        }
+    }
+    else {
+        Add-AuditEntry -Audit ([ref]$audit) -File $storePath -Key "binary-store" -Before "present" -After "core-invoke-failed" -Ok $false
+    }
+}
 $status = Get-StepAuditStatus -Audit ([ref]$audit) -StartIndex $auditStart -Path $root
 if ($status.Success) {
     Write-Host "[OK] Cookies + transport state cleared" -ForegroundColor Green
@@ -810,11 +556,23 @@ else {
     $failCount++
 }
 
-# --- [9/15] DIPS stores (delete; v0.1 renamed) ---
+# --- [9/15] DIPS stores (core: store-delete, delete mode) ---
 Write-Host "`n[9/15] Clearing DIPS stores..." -ForegroundColor Cyan
 $auditStart = $audit.Count
-$dipsActions = Clear-BinaryIdentityStore -Paths @((Join-Path $root "DIPS"), (Join-Path $root "DIPS-wal")) -Action "delete" -BackupRoot $backupRoot -Audit ([ref]$audit) -RootPath $root
-$actions += @($dipsActions)
+foreach ($storePath in @((Join-Path $root "DIPS"), (Join-Path $root "DIPS-wal"))) {
+    $storeReport = Invoke-GhostCore @("store-delete", $storePath, $backupRoot,
+        (Get-AppRelativeBackupLabel -RootPath $root -TargetPath $storePath),
+        "--action", "delete", "--root-path", $root)
+    if ($null -ne $storeReport) {
+        Add-AuditEntry -Audit ([ref]$audit) -File $storePath -Key "binary-store" -Before $storeReport.before -After $storeReport.after -Ok $storeReport.ok
+        if ($storeReport.ok -and $storeReport.backed_up_to) {
+            Add-ActionEntry -Actions ([ref]$actions) -OriginalPath $storePath -BackupPath $storeReport.backed_up_to -Action "delete"
+        }
+    }
+    else {
+        Add-AuditEntry -Audit ([ref]$audit) -File $storePath -Key "binary-store" -Before "present" -After "core-invoke-failed" -Ok $false
+    }
+}
 $status = Get-StepAuditStatus -Audit ([ref]$audit) -StartIndex $auditStart -Path $root
 if ($status.Success) {
     Write-Host "[OK] DIPS stores cleared" -ForegroundColor Green
@@ -825,16 +583,27 @@ else {
     $failCount++
 }
 
-# --- [10/15] SharedStorage + Trust Tokens (NEW in v0.2) ---
+# --- [10/15] SharedStorage + Trust Tokens (core: store-delete, delete mode) ---
 Write-Host "`n[10/15] Clearing SharedStorage + Trust Tokens..." -ForegroundColor Cyan
 $auditStart = $audit.Count
-$sharedActions = Clear-BinaryIdentityStore -Paths @(
-    (Join-Path $root "SharedStorage"),
-    (Join-Path $root "SharedStorage-wal"),
-    (Join-Path $root "Network\Trust Tokens"),
-    (Join-Path $root "Network\Trust Tokens-journal")
-) -Action "delete" -BackupRoot $backupRoot -Audit ([ref]$audit) -RootPath $root
-$actions += @($sharedActions)
+foreach ($storePath in @(
+        (Join-Path $root "SharedStorage"),
+        (Join-Path $root "SharedStorage-wal"),
+        (Join-Path $root "Network\Trust Tokens"),
+        (Join-Path $root "Network\Trust Tokens-journal"))) {
+    $storeReport = Invoke-GhostCore @("store-delete", $storePath, $backupRoot,
+        (Get-AppRelativeBackupLabel -RootPath $root -TargetPath $storePath),
+        "--action", "delete", "--root-path", $root)
+    if ($null -ne $storeReport) {
+        Add-AuditEntry -Audit ([ref]$audit) -File $storePath -Key "binary-store" -Before $storeReport.before -After $storeReport.after -Ok $storeReport.ok
+        if ($storeReport.ok -and $storeReport.backed_up_to) {
+            Add-ActionEntry -Actions ([ref]$actions) -OriginalPath $storePath -BackupPath $storeReport.backed_up_to -Action "delete"
+        }
+    }
+    else {
+        Add-AuditEntry -Audit ([ref]$audit) -File $storePath -Key "binary-store" -Before "present" -After "core-invoke-failed" -Ok $false
+    }
+}
 $status = Get-StepAuditStatus -Audit ([ref]$audit) -StartIndex $auditStart -Path $root
 if ($status.Success) {
     Write-Host "[OK] SharedStorage + Trust Tokens cleared" -ForegroundColor Green
@@ -845,12 +614,25 @@ else {
     $failCount++
 }
 
-# --- [11/15] sentry tree (delete; v0.1 renamed -- scope_v3.json holds email + fingerprint) ---
+# --- [11/15] sentry tree (core: sweep-tree; scope_v3.json holds email + fingerprint) ---
 Write-Host "`n[11/15] Clearing sentry tree..." -ForegroundColor Cyan
 $auditStart = $audit.Count
 $sentryPath = Join-Path $root "sentry"
 if (Test-Path -LiteralPath $sentryPath) {
-    $null = Clear-TreeFilesIndividually -Path $sentryPath -BackupRoot $backupRoot -BackupLabel "sentry" -Audit ([ref]$audit) -Actions ([ref]$actions)
+    $sentryReport = Invoke-GhostCore @("sweep-tree", $sentryPath, $backupRoot, "sentry")
+    if ($null -ne $sentryReport) {
+        $summary = "deleted={0} failed={1}" -f $sentryReport.deleted, $sentryReport.failed
+        Add-AuditEntry -Audit ([ref]$audit) -File $sentryPath -Key "binary-store" -Before "present" -After $summary -Ok ($sentryReport.failed -eq 0)
+        foreach ($failedPath in @($sentryReport.failed_paths)) {
+            Add-AuditEntry -Audit ([ref]$audit) -File $failedPath -Key "binary-store" -Before "present" -After "delete-failed" -Ok $false
+        }
+        if ($sentryReport.backed_up_to) {
+            Add-ActionEntry -Actions ([ref]$actions) -OriginalPath $sentryPath -BackupPath $sentryReport.backed_up_to -Action "delete"
+        }
+    }
+    else {
+        Add-AuditEntry -Audit ([ref]$audit) -File $sentryPath -Key "binary-store" -Before "present" -After "core-invoke-failed" -Ok $false
+    }
 }
 else {
     Add-AuditEntry -Audit ([ref]$audit) -File $sentryPath -Key "binary-store" -Before "missing" -After "skipped" -Ok $true
@@ -865,13 +647,27 @@ else {
     $failCount++
 }
 
-# --- [12/15] cache dirs + Session Storage (per-file; chat stores preserved) ---
+# --- [12/15] cache dirs + Session Storage (core: sweep-tree; chat stores preserved) ---
 Write-Host "`n[12/15] Clearing cache directories + Session Storage..." -ForegroundColor Cyan
 $auditStart = $audit.Count
 foreach ($relative in @("Cache\Cache_Data", "Code Cache", "GPUCache", "blob_storage", "Service Worker", "Session Storage")) {
     $fullPath = Join-Path $root $relative
     if (Test-Path -LiteralPath $fullPath) {
-        $null = Clear-TreeFilesIndividually -Path $fullPath -BackupRoot $backupRoot -BackupLabel (Get-AppRelativeBackupLabel -RootPath $root -TargetPath $fullPath) -Audit ([ref]$audit) -Actions ([ref]$actions)
+        $sweepReport = Invoke-GhostCore @("sweep-tree", $fullPath, $backupRoot,
+            (Get-AppRelativeBackupLabel -RootPath $root -TargetPath $fullPath))
+        if ($null -ne $sweepReport) {
+            $summary = "deleted={0} failed={1}" -f $sweepReport.deleted, $sweepReport.failed
+            Add-AuditEntry -Audit ([ref]$audit) -File $fullPath -Key "binary-store" -Before "present" -After $summary -Ok ($sweepReport.failed -eq 0)
+            foreach ($failedPath in @($sweepReport.failed_paths)) {
+                Add-AuditEntry -Audit ([ref]$audit) -File $failedPath -Key "binary-store" -Before "present" -After "delete-failed" -Ok $false
+            }
+            if ($sweepReport.backed_up_to) {
+                Add-ActionEntry -Actions ([ref]$actions) -OriginalPath $fullPath -BackupPath $sweepReport.backed_up_to -Action "delete"
+            }
+        }
+        else {
+            Add-AuditEntry -Audit ([ref]$audit) -File $fullPath -Key "binary-store" -Before "present" -After "core-invoke-failed" -Ok $false
+        }
     }
     else {
         Add-AuditEntry -Audit ([ref]$audit) -File $fullPath -Key "binary-store" -Before "missing" -After "skipped" -Ok $true
@@ -899,13 +695,26 @@ else {
     $failCount++
 }
 
-# --- [13/15] Crashpad + logs (NEW in v0.2; crash dumps embed device IDs) ---
+# --- [13/15] Crashpad + logs (core: sweep-tree; crash dumps embed device IDs) ---
 Write-Host "`n[13/15] Clearing Crashpad + logs..." -ForegroundColor Cyan
 $auditStart = $audit.Count
 foreach ($relative in @("Crashpad", "logs")) {
     $fullPath = Join-Path $root $relative
     if (Test-Path -LiteralPath $fullPath) {
-        $null = Clear-TreeFilesIndividually -Path $fullPath -BackupRoot $backupRoot -BackupLabel $relative -Audit ([ref]$audit) -Actions ([ref]$actions)
+        $sweepReport = Invoke-GhostCore @("sweep-tree", $fullPath, $backupRoot, $relative)
+        if ($null -ne $sweepReport) {
+            $summary = "deleted={0} failed={1}" -f $sweepReport.deleted, $sweepReport.failed
+            Add-AuditEntry -Audit ([ref]$audit) -File $fullPath -Key "binary-store" -Before "present" -After $summary -Ok ($sweepReport.failed -eq 0)
+            foreach ($failedPath in @($sweepReport.failed_paths)) {
+                Add-AuditEntry -Audit ([ref]$audit) -File $failedPath -Key "binary-store" -Before "present" -After "delete-failed" -Ok $false
+            }
+            if ($sweepReport.backed_up_to) {
+                Add-ActionEntry -Actions ([ref]$actions) -OriginalPath $fullPath -BackupPath $sweepReport.backed_up_to -Action "delete"
+            }
+        }
+        else {
+            Add-AuditEntry -Audit ([ref]$audit) -File $fullPath -Key "binary-store" -Before "present" -After "core-invoke-failed" -Ok $false
+        }
     }
     else {
         Add-AuditEntry -Audit ([ref]$audit) -File $fullPath -Key "binary-store" -Before "missing" -After "skipped" -Ok $true
@@ -921,7 +730,8 @@ else {
     $failCount++
 }
 
-# --- [14/15] workspace UPSERT-only (never delete workspace files) ---
+# --- [14/15] workspace UPSERT-only (core: sqlite-update per db; never delete
+#     workspace files) ---
 Write-Host "`n[14/15] Updating workspace state.vscdb files (UPSERT only)..." -ForegroundColor Cyan
 $workspaceDbPaths = @()
 if (Test-Path -LiteralPath $workspaceStorageRoot) {
@@ -938,14 +748,16 @@ if ($workspaceDbPaths.Count -eq 0) {
 else {
     $workspaceFailures = 0
     foreach ($workspaceDbPath in $workspaceDbPaths) {
-        Invoke-WorkspaceSqliteUpdate -WorkspaceDbPath $workspaceDbPath -DeviceId $ids.devDeviceId -RootPath $root -BackupRoot $backupRoot -Audit ([ref]$audit) -Actions ([ref]$actions)
-        if ($audit.Count -gt 0) {
-            $lastAuditEntry = $audit[-1]
-            if (-not $lastAuditEntry.ok) {
-                $workspaceFailures++
-            }
+        $wsLabel = Get-AppRelativeBackupLabel -RootPath $root -TargetPath $workspaceDbPath
+        $null = Backup-ViaCore -Source $workspaceDbPath -BackupRoot $backupRoot -Label $wsLabel -Actions ([ref]$actions)
+        $wsReport = Invoke-GhostCore @("sqlite-update", $workspaceDbPath, (_B64Payload @{ "storage.serviceMachineId" = $ids.devDeviceId }))
+        if ($null -ne $wsReport -and $null -ne $wsReport.after) {
+            Add-AuditEntry -Audit ([ref]$audit) -File $workspaceDbPath -Key "storage.serviceMachineId" -Before $wsReport.before."storage.serviceMachineId" -After $wsReport.after."storage.serviceMachineId" -Ok $true
+            Write-Host "    [OK] workspace DB updated: $workspaceDbPath" -ForegroundColor Green
         }
         else {
+            Add-AuditEntry -Audit ([ref]$audit) -File $workspaceDbPath -Key "storage.serviceMachineId" -Before $null -After $ids.devDeviceId -Ok $false
+            Write-Host "    [FAILED] workspace DB update: $workspaceDbPath" -ForegroundColor Red
             $workspaceFailures++
         }
     }
@@ -966,7 +778,7 @@ else {
     }
 }
 
-# --- [15/15] Old ID_Backups purge + watchdog re-verify ---
+# --- [15/15] Old ID_Backups purge + watchdog re-verify (PS: pure file ops) ---
 Write-Host "`n[15/15] Purging old ID_Backups + watchdog re-verify..." -ForegroundColor Cyan
 Invoke-OldIdBackupsPurge -BackupRoot $backupRoot -IdBackupsRoot $idBackupsRoot -Audit ([ref]$audit)
 $watchdogCoreFiles = @(
@@ -1018,11 +830,11 @@ Write-Host "Restore script: $restoreScriptPath" -ForegroundColor Gray
 Write-Host "NOTE: workspace .backup sidecars were preserved per policy (they still embed the old device ID)." -ForegroundColor Yellow
 Write-Host "NOTE: change_device_id.ps1 remains the separate, optional system-level step." -ForegroundColor Yellow
 
-[System.IO.File]::WriteAllText("$env:TEMP\cursor_v0.2_done.txt", ("Pass: {0} Fail: {1} Audit: {2}" -f $passCount, $failCount, $auditPath), (New-Object System.Text.UTF8Encoding $false))
+[System.IO.File]::WriteAllText("$env:TEMP\cursor_v0.3_done.txt", ("Pass: {0} Fail: {1} Audit: {2}" -f $passCount, $failCount, $auditPath), (New-Object System.Text.UTF8Encoding $false))
 
 if ($failCount -gt 0) {
-    Write-Host "Cursor reset v0.2 completed with failures. Review $auditPath." -ForegroundColor Red
+    Write-Host "Cursor reset v0.3 completed with failures. Review $auditPath." -ForegroundColor Red
     exit 1
 }
 
-Write-Host "Cursor reset v0.2 completed successfully." -ForegroundColor Green
+Write-Host "Cursor reset v0.3 completed successfully."
diff --git a/src/windows/reset_devin.ps1 b/src/windows/reset_devin.ps1
index 6787139..f1ad41f 100644
--- a/src/windows/reset_devin.ps1
+++ b/src/windows/reset_devin.ps1
@@ -50,13 +50,13 @@ $devinIsAdmin = [Security.Principal.WindowsPrincipal]::new(
     [Security.Principal.WindowsIdentity]::GetCurrent()
 ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
 if (-not $devinIsAdmin) {
-    $devinLogOut = "$env:TEMP\devin_v0.3_result.log"
     $devinScript = $MyInvocation.MyCommand.Path
-    $devinArgs = "-ExecutionPolicy Bypass -NoProfile -File `"$devinScript`" *> `"$devinLogOut`""
+    # -File passes only declared switches; a redirect operator after -File is
+    # just swallowed as an undeclared argument. The *_done.txt marker file
+    # (not a log) is the persisted result channel - the elevated console shows
+    # the full live output while the run progresses.
+    $devinArgs = "-ExecutionPolicy Bypass -NoProfile -File `"$devinScript`""
     Start-Process powershell -Verb RunAs -ArgumentList $devinArgs -WindowStyle Normal -Wait
-    if (Test-Path -LiteralPath $devinLogOut) {
-        Get-Content -LiteralPath $devinLogOut
-    }
     if (Test-Path -LiteralPath "$env:TEMP\devin_v0.3_done.txt") {
         Get-Content -LiteralPath "$env:TEMP\devin_v0.3_done.txt"
     }
@@ -841,7 +841,10 @@ function Test-WatchdogRecreation {
         Write-Host "    [WARN] watchdog recreated file, re-deleting: $path" -ForegroundColor Yellow
         Remove-Item -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue
         $afterValue = if (Test-Path -LiteralPath $path) { "re-delete-failed" } else { "re-deleted" }
-        Add-AuditEntry -Audit $Audit -File $path -Key "watchdog-recreate" -Before "recreated" -After $afterValue -Ok $true
+        if ($afterValue -eq "re-delete-failed") {
+            Write-Host "    [FAILED] could not re-delete (file locked?): $path" -ForegroundColor Red
+        }
+        Add-AuditEntry -Audit $Audit -File $path -Key "watchdog-recreate" -Before "recreated" -After $afterValue -Ok ($afterValue -eq "re-deleted")
     }
 }
 
diff --git a/src/windows/reset_minimax_opencode.ps1 b/src/windows/reset_minimax_opencode.ps1
index 12dfb52..256a875 100644
--- a/src/windows/reset_minimax_opencode.ps1
+++ b/src/windows/reset_minimax_opencode.ps1
@@ -132,17 +132,17 @@ $mmoIsAdmin = [Security.Principal.WindowsPrincipal]::new(
     [Security.Principal.WindowsIdentity]::GetCurrent()
 ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
 if (-not $mmoIsAdmin) {
-    $mmoLogOut = "$env:TEMP\minimax_opencode_v1.3_result.log"
     $mmoScript = $MyInvocation.MyCommand.Path
     $mmoSwitchList = @()
     if ($KeepLogin) { $mmoSwitchList += "-KeepLogin" }
     if ($SkipVersionCheck) { $mmoSwitchList += "-SkipVersionCheck" }
     $mmoSwitchString = if ($mmoSwitchList.Count -gt 0) { " " + ($mmoSwitchList -join " ") } else { "" }
-    $mmoArgs = "-ExecutionPolicy Bypass -NoProfile -File `"$mmoScript`"$mmoSwitchString *> `"$mmoLogOut`""
+    # -File passes only declared switches; a redirect operator after -File is
+    # just swallowed as an undeclared argument. The *_done.txt marker file
+    # (not a log) is the persisted result channel - the elevated console shows
+    # the full live output while the run progresses.
+    $mmoArgs = "-ExecutionPolicy Bypass -NoProfile -File `"$mmoScript`"$mmoSwitchString"
     Start-Process powershell -Verb RunAs -ArgumentList $mmoArgs -WindowStyle Normal -Wait
-    if (Test-Path -LiteralPath $mmoLogOut) {
-        Get-Content -LiteralPath $mmoLogOut
-    }
     if (Test-Path -LiteralPath "$env:TEMP\minimax_opencode_v1.3_done.txt") {
         Get-Content -LiteralPath "$env:TEMP\minimax_opencode_v1.3_done.txt"
     }
@@ -905,7 +905,10 @@ function Test-WatchdogRecreation {
         Write-Host "    [WARN] watchdog recreated file, re-deleting: $path" -ForegroundColor Yellow
         Remove-Item -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue
         $afterValue = if (Test-Path -LiteralPath $path) { "re-delete-failed" } else { "re-deleted" }
-        Add-AuditEntry -Audit $Audit -File $path -Key "watchdog-recreate" -Before "recreated" -After $afterValue -Ok $true
+        if ($afterValue -eq "re-delete-failed") {
+            Write-Host "    [FAILED] could not re-delete (file locked?): $path" -ForegroundColor Red
+        }
+        Add-AuditEntry -Audit $Audit -File $path -Key "watchdog-recreate" -Before "recreated" -After $afterValue -Ok ($afterValue -eq "re-deleted")
     }
 }
 
@@ -1388,7 +1391,6 @@ if (-not (Set-DeviceIdSalt -Path $ocPreferencesPath -NewSalt $newSalt -BackupRoo
 $ocSettingsPath = Join-Path $ocRoaming "opencode.settings"
 $windowIdResult = Reset-OpenCodeWindowIds -Path $ocSettingsPath -BackupRoot $backupRoot -BackupLabel (Get-AppRelativeBackupLabel -RootPath $ocRoaming -TargetPath $ocSettingsPath) -Audit ([ref]$audit) -Actions ([ref]$actions)
 $ocOldWindowIds = @($windowIdResult.OldIds)
-$ocNewWindowIds = @($windowIdResult.NewIds)
 if (-not $windowIdResult.Ok) {
     $stepFailed = $true
 }
@@ -1899,7 +1901,10 @@ foreach ($wdFilter in @("opencode.updater.tmp-*", "opencode.global.dat.tmp-*", "
         Write-Host "    [WARN] watchdog recreated file, re-deleting: $($rc.FullName)" -ForegroundColor Yellow
         Remove-Item -LiteralPath $rc.FullName -Force -ErrorAction SilentlyContinue
         $afterValue = if (Test-Path -LiteralPath $rc.FullName) { "re-delete-failed" } else { "re-deleted" }
-        Add-AuditEntry -Audit ([ref]$audit) -File $rc.FullName -Key "watchdog-recreate" -Before "recreated" -After $afterValue -Ok $true
+        if ($afterValue -eq "re-delete-failed") {
+            Write-Host "    [FAILED] could not re-delete (file locked?): $($rc.FullName)" -ForegroundColor Red
+        }
+        Add-AuditEntry ([ref]$audit) -File $rc.FullName -Key "watchdog-recreate" -Before "recreated" -After $afterValue -Ok ($afterValue -eq "re-deleted")
     }
 }
 $passCount++
diff --git a/src/windows/reset_qoder.ps1 b/src/windows/reset_qoder.ps1
index 77610e1..a91e72c 100644
--- a/src/windows/reset_qoder.ps1
+++ b/src/windows/reset_qoder.ps1
@@ -2,10 +2,10 @@
 param(
     # v0.4 keeps the v0.3 opt-out switches for the system-level steps.
     # Default = ON (i.e., do them). Use -SkipMac / -SkipHostname to suppress.
-    # Note: NO [CmdletBinding()] -- the v0.2 launch pattern uses
-    # `cmd /c powershell -File <script> *> <log>`, and [CmdletBinding()] makes
-    # the `*` in `*>` bind as a positional argument (the script rejects it).
-    # Plain param() is fine here; switches work without CmdletBinding.
+    # Note: NO [CmdletBinding()] -- plain param() is deliberate: the
+    # self-elevation block invokes this script with -File plus only these
+    # declared switches (the *_done.txt marker file, not a log, is the
+    # persisted result channel). Switches work without CmdletBinding.
     [switch]$SkipMac,
     [switch]$SkipHostname
 )
@@ -20,19 +20,17 @@ $qoderIsAdmin = [Security.Principal.WindowsPrincipal]::new(
     [Security.Principal.WindowsIdentity]::GetCurrent()
 ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
 if (-not $qoderIsAdmin) {
-    $qoderLogOut = "$env:TEMP\qoder_v0.4_result.log"
     $qoderScript = $MyInvocation.MyCommand.Path
     $qoderSwitchList = @()
     if ($SkipMac)      { $qoderSwitchList += "-SkipMac" }
     if ($SkipHostname) { $qoderSwitchList += "-SkipHostname" }
     $qoderSwitchString = if ($qoderSwitchList.Count -gt 0) { " " + ($qoderSwitchList -join " ") } else { "" }
     # Single-string argument list, same proven pattern as v0.2 -- avoids any
-    # array-join quoting surprises with paths that contain spaces.
-    $qoderArgs = "-ExecutionPolicy Bypass -NoProfile -File `"$qoderScript`"$qoderSwitchString *> `"$qoderLogOut`""
+    # array-join quoting surprises with paths that contain spaces. -File passes
+    # only declared switches; a redirect operator here would be swallowed as an
+    # undeclared argument (the *_done.txt marker file is the persisted result).
+    $qoderArgs = "-ExecutionPolicy Bypass -NoProfile -File `"$qoderScript`"$qoderSwitchString"
     Start-Process powershell -Verb RunAs -ArgumentList $qoderArgs -WindowStyle Normal -Wait
-    if (Test-Path $qoderLogOut) {
-        Get-Content $qoderLogOut
-    }
     if (Test-Path "$env:TEMP\qoder_v0.4_done.txt") {
         Get-Content "$env:TEMP\qoder_v0.4_done.txt"
     }
@@ -603,7 +601,11 @@ function Test-QoderWatchdogRecreation {
     foreach ($path in $recreated) {
         Write-Host "    [WARN] watchdog recreated file, re-deleting: $path" -ForegroundColor Yellow
         Remove-Item -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue
-        Add-AuditEntry -Audit $Audit -File $path -Key "watchdog-recreate" -Before "recreated" -After "re-deleted" -Ok $true
+        $afterValue = if (Test-Path -LiteralPath $path) { "re-delete-failed" } else { "re-deleted" }
+        if ($afterValue -eq "re-delete-failed") {
+            Write-Host "    [FAILED] could not re-delete (file locked?): $path" -ForegroundColor Red
+        }
+        Add-AuditEntry -Audit $Audit -File $path -Key "watchdog-recreate" -Before "recreated" -After $afterValue -Ok ($afterValue -eq "re-deleted")
     }
 }
 
@@ -1708,47 +1710,91 @@ if ($stepFailed) { $failCount++ } else { $passCount++ }
 
 # --- [12/31] Session Storage + Local Storage (per profile) ---
 Write-Host "`n[12/31] Deleting Session Storage + Local Storage (per profile)..." -ForegroundColor Cyan
+$stepFailed = $false
 foreach ($pr in $profileRoots) {
     $label = Get-ProfileLabel -MainRoot $root -ProfileRoot $pr
     $paths = @((Join-Path $pr "Session Storage"), (Join-Path $pr "Local Storage"))
+    $step12AuditStart = $audit.Count
     $binaryActions = Clear-BinaryIdentityStore -Paths $paths -Action "delete" -BackupRoot $backupRoot -Audit ([ref]$audit) -RootPath $pr
     $actions += @($binaryActions)
-    Write-Host "    [$label] [OK] Session/Local Storage" -ForegroundColor Green
+    $anyFail = $false
+    foreach ($p in $paths) {
+        if (-not (Get-StepAuditStatus -Audit ([ref]$audit) -StartIndex $step12AuditStart -Path $p).Success) { $anyFail = $true; break }
+    }
+    if ($anyFail) {
+        Write-Host "    [$label] [PARTIAL] Session/Local Storage" -ForegroundColor Yellow
+        $stepFailed = $true
+    } else {
+        Write-Host "    [$label] [OK] Session/Local Storage" -ForegroundColor Green
+    }
 }
-$passCount++
+if ($stepFailed) { $failCount++ } else { $passCount++ }
 
 # --- [13/31] Cache + Code Cache + GPUCache (per profile) ---
 Write-Host "`n[13/31] Deleting Cache + Code Cache + GPUCache (per profile)..." -ForegroundColor Cyan
+$stepFailed = $false
 foreach ($pr in $profileRoots) {
     $label = Get-ProfileLabel -MainRoot $root -ProfileRoot $pr
     $paths = @((Join-Path $pr "Cache"), (Join-Path $pr "Code Cache"), (Join-Path $pr "GPUCache"))
+    $step13AuditStart = $audit.Count
     $binaryActions = Clear-BinaryIdentityStore -Paths $paths -Action "delete" -BackupRoot $backupRoot -Audit ([ref]$audit) -RootPath $pr
     $actions += @($binaryActions)
-    Write-Host "    [$label] [OK] Cache stores" -ForegroundColor Green
+    $anyFail = $false
+    foreach ($p in $paths) {
+        if (-not (Get-StepAuditStatus -Audit ([ref]$audit) -StartIndex $step13AuditStart -Path $p).Success) { $anyFail = $true; break }
+    }
+    if ($anyFail) {
+        Write-Host "    [$label] [PARTIAL] Cache stores" -ForegroundColor Yellow
+        $stepFailed = $true
+    } else {
+        Write-Host "    [$label] [OK] Cache stores" -ForegroundColor Green
+    }
 }
-$passCount++
+if ($stepFailed) { $failCount++ } else { $passCount++ }
 
 # --- [14/31] Service Worker + blob_storage (per profile) ---
 Write-Host "`n[14/31] Deleting Service Worker + blob_storage (per profile)..." -ForegroundColor Cyan
+$stepFailed = $false
 foreach ($pr in $profileRoots) {
     $label = Get-ProfileLabel -MainRoot $root -ProfileRoot $pr
     $paths = @((Join-Path $pr "Service Worker"), (Join-Path $pr "blob_storage"))
+    $step14AuditStart = $audit.Count
     $binaryActions = Clear-BinaryIdentityStore -Paths $paths -Action "delete" -BackupRoot $backupRoot -Audit ([ref]$audit) -RootPath $pr
     $actions += @($binaryActions)
-    Write-Host "    [$label] [OK] Service Worker/blob_storage" -ForegroundColor Green
+    $anyFail = $false
+    foreach ($p in $paths) {
+        if (-not (Get-StepAuditStatus -Audit ([ref]$audit) -StartIndex $step14AuditStart -Path $p).Success) { $anyFail = $true; break }
+    }
+    if ($anyFail) {
+        Write-Host "    [$label] [PARTIAL] Service Worker/blob_storage" -ForegroundColor Yellow
+        $stepFailed = $true
+    } else {
+        Write-Host "    [$label] [OK] Service Worker/blob_storage" -ForegroundColor Green
+    }
 }
-$passCount++
+if ($stepFailed) { $failCount++ } else { $passCount++ }
 
 # --- [15/31] Crashpad + CrashFeedback (per profile) ---
 Write-Host "`n[15/31] Deleting Crashpad + CrashFeedback (per profile)..." -ForegroundColor Cyan
+$stepFailed = $false
 foreach ($pr in $profileRoots) {
     $label = Get-ProfileLabel -MainRoot $root -ProfileRoot $pr
     $paths = @((Join-Path $pr "Crashpad"), (Join-Path $pr "CrashFeedback"))
+    $step15AuditStart = $audit.Count
     $binaryActions = Clear-BinaryIdentityStore -Paths $paths -Action "delete" -BackupRoot $backupRoot -Audit ([ref]$audit) -RootPath $pr
     $actions += @($binaryActions)
-    Write-Host "    [$label] [OK] Crashpad/CrashFeedback" -ForegroundColor Green
+    $anyFail = $false
+    foreach ($p in $paths) {
+        if (-not (Get-StepAuditStatus -Audit ([ref]$audit) -StartIndex $step15AuditStart -Path $p).Success) { $anyFail = $true; break }
+    }
+    if ($anyFail) {
+        Write-Host "    [$label] [PARTIAL] Crashpad/CrashFeedback" -ForegroundColor Yellow
+        $stepFailed = $true
+    } else {
+        Write-Host "    [$label] [OK] Crashpad/CrashFeedback" -ForegroundColor Green
+    }
 }
-$passCount++
+if ($stepFailed) { $failCount++ } else { $passCount++ }
 
 # --- [16/31] Preferences device_id_salt (per profile) ---
 Write-Host "`n[16/31] Updating Preferences device_id_salt (per profile)..." -ForegroundColor Cyan
@@ -1803,14 +1849,21 @@ if ($workspaceFailed) { $failCount++ } else { $passCount++ }
 # main.log embeds the update-check URL with machineId=...&umid=<token> verbatim.
 # v0.1 never deleted logs/; this step removes the full session history.
 Write-Host "`n[18/31] Deleting logs/ (per profile)..." -ForegroundColor Cyan
+$stepFailed = $false
 foreach ($pr in $profileRoots) {
     $label = Get-ProfileLabel -MainRoot $root -ProfileRoot $pr
     $path = Join-Path $pr "logs"
+    $step18AuditStart = $audit.Count
     $binaryActions = Clear-BinaryIdentityStore -Paths @($path) -Action "delete" -BackupRoot $backupRoot -Audit ([ref]$audit) -RootPath $pr
     $actions += @($binaryActions)
-    Write-Host "    [$label] [OK] logs" -ForegroundColor Green
+    if (-not (Get-StepAuditStatus -Audit ([ref]$audit) -StartIndex $step18AuditStart -Path $path).Success) {
+        Write-Host "    [$label] [PARTIAL] logs" -ForegroundColor Yellow
+        $stepFailed = $true
+    } else {
+        Write-Host "    [$label] [OK] logs" -ForegroundColor Green
+    }
 }
-$passCount++
+if ($stepFailed) { $failCount++ } else { $passCount++ }
 
 # --- [19/31] argv.json crash-reporter-id (user-level) ---
 Write-Host "`n[19/31] Updating argv.json crash-reporter-id (user-level)..." -ForegroundColor Cyan
@@ -2149,7 +2202,7 @@ if (-not (Test-Path -LiteralPath $restoreScriptPath) -or ((Get-Item -LiteralPath
 
 # Surface any per-file failures captured in the audit (e.g. logs/ tree where
 # some files were still locked by an extension host after the retry budget).
-# These don't abort the script but they DO matter for the unban goal -- if logs
+# These don't abort the script but they DO matter for the identity-reset goal -- if logs
 # leaked, the token+machineId URL is still on disk.
 $auditFailures = @($audit | Where-Object { -not $_.ok })
 if ($auditFailures.Count -gt 0) {
diff --git a/src/windows/reset_qoderwork.ps1 b/src/windows/reset_qoderwork.ps1
index 169991f..af4447a 100644
--- a/src/windows/reset_qoderwork.ps1
+++ b/src/windows/reset_qoderwork.ps1
@@ -22,19 +22,18 @@ $qoderWorkIsAdmin = [Security.Principal.WindowsPrincipal]::new(
     [Security.Principal.WindowsIdentity]::GetCurrent()
 ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
 if (-not $qoderWorkIsAdmin) {
-    $qoderWorkLogOut = "$env:TEMP\qoderwork_v0.1_result.log"
     $qoderWorkScript = $MyInvocation.MyCommand.Path
     $qoderWorkSwitchList = @()
     if ($SkipMac)      { $qoderWorkSwitchList += "-SkipMac" }
     if ($SkipHostname) { $qoderWorkSwitchList += "-SkipHostname" }
     if ($DryRun)       { $qoderWorkSwitchList += "-DryRun" }
     $qoderWorkSwitchString = if ($qoderWorkSwitchList.Count -gt 0) { " " + ($qoderWorkSwitchList -join " ") } else { "" }
-    # Single-string argument list, same proven pattern as v0.3 Qoder.
-    $qoderWorkArgs = "-ExecutionPolicy Bypass -NoProfile -File `"$qoderWorkScript`"$qoderWorkSwitchString *> `"$qoderWorkLogOut`""
+    # Single-string argument list, same proven pattern as v0.3 Qoder. -File
+    # passes only declared switches; a redirect operator here would be
+    # swallowed as an undeclared argument (the *_done.txt marker file is the
+    # persisted result).
+    $qoderWorkArgs = "-ExecutionPolicy Bypass -NoProfile -File `"$qoderWorkScript`"$qoderWorkSwitchString"
     Start-Process powershell -Verb RunAs -ArgumentList $qoderWorkArgs -WindowStyle Normal -Wait
-    if (Test-Path $qoderWorkLogOut) {
-        Get-Content $qoderWorkLogOut
-    }
     if (Test-Path "$env:TEMP\qoderwork_v0.1_done.txt") {
         Get-Content "$env:TEMP\qoderwork_v0.1_done.txt"
     }
@@ -392,7 +391,6 @@ function Clear-QoderWorkAgentsDb {
         [Parameter(Mandatory = $true)][ref]$Audit
     )
 
-    $exactKeys = @()  # agents.db has no key/value store; it has typed tables.
     # CHAT PRESERVATION: chats/sub_chats/messages/projects are NEVER deleted.
     # They hold conversation content with no server-side identity signal
     # (same policy as Cursor/Windsurf/Trae/Qoder/ZCode/MiniMax scripts).
@@ -614,7 +612,11 @@ function Test-QoderWorkWatchdogRecreation {
     foreach ($path in $recreated) {
         Write-Host "    [WARN] watchdog recreated file, re-deleting: $path" -ForegroundColor Yellow
         Remove-Item -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue
-        Add-AuditEntry -Audit $Audit -File $path -Key "watchdog-recreate" -Before "recreated" -After "re-deleted" -Ok $true
+        $afterValue = if (Test-Path -LiteralPath $path) { "re-delete-failed" } else { "re-deleted" }
+        if ($afterValue -eq "re-delete-failed") {
+            Write-Host "    [FAILED] could not re-delete (file locked?): $path" -ForegroundColor Red
+        }
+        Add-AuditEntry -Audit $Audit -File $path -Key "watchdog-recreate" -Before "recreated" -After $afterValue -Ok ($afterValue -eq "re-deleted")
     }
 }
 
diff --git a/src/windows/reset_trae.ps1 b/src/windows/reset_trae.ps1
index 44bd085..6925183 100644
--- a/src/windows/reset_trae.ps1
+++ b/src/windows/reset_trae.ps1
@@ -41,13 +41,13 @@ $traeIsAdmin = [Security.Principal.WindowsPrincipal]::new(
     [Security.Principal.WindowsIdentity]::GetCurrent()
 ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
 if (-not $traeIsAdmin) {
-    $traeLogOut = "$env:TEMP\trae_v0.2_result.log"
     $traeScript = $MyInvocation.MyCommand.Path
-    $traeArgs = "-ExecutionPolicy Bypass -NoProfile -File `"$traeScript`" *> `"$traeLogOut`""
+    # -File passes only declared switches; a redirect operator after -File is
+    # just swallowed as an undeclared argument. The *_done.txt marker file
+    # (not a log) is the persisted result channel - the elevated console shows
+    # the full live output while the run progresses.
+    $traeArgs = "-ExecutionPolicy Bypass -NoProfile -File `"$traeScript`""
     Start-Process powershell -Verb RunAs -ArgumentList $traeArgs -WindowStyle Normal -Wait
-    if (Test-Path -LiteralPath $traeLogOut) {
-        Get-Content -LiteralPath $traeLogOut
-    }
     if (Test-Path -LiteralPath "$env:TEMP\trae_v0.2_done.txt") {
         Get-Content -LiteralPath "$env:TEMP\trae_v0.2_done.txt"
     }
@@ -793,7 +793,10 @@ function Test-WatchdogRecreation {
         Write-Host "    [WARN] watchdog recreated file, re-deleting: $path" -ForegroundColor Yellow
         Remove-Item -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue
         $afterValue = if (Test-Path -LiteralPath $path) { "re-delete-failed" } else { "re-deleted" }
-        Add-AuditEntry -Audit $Audit -File $path -Key "watchdog-recreate" -Before "recreated" -After $afterValue -Ok $true
+        if ($afterValue -eq "re-delete-failed") {
+            Write-Host "    [FAILED] could not re-delete (file locked?): $path" -ForegroundColor Red
+        }
+        Add-AuditEntry -Audit $Audit -File $path -Key "watchdog-recreate" -Before "recreated" -After $afterValue -Ok ($afterValue -eq "re-deleted")
     }
 }
 
diff --git a/src/windows/reset_zcode.ps1 b/src/windows/reset_zcode.ps1
index 39d64ab..3ace4d3 100644
--- a/src/windows/reset_zcode.ps1
+++ b/src/windows/reset_zcode.ps1
@@ -93,15 +93,15 @@ $zcodeIsAdmin = [Security.Principal.WindowsPrincipal]::new(
     [Security.Principal.WindowsIdentity]::GetCurrent()
 ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
 if (-not $zcodeIsAdmin) {
-    $zcodeLogOut = "$env:TEMP\zcode_v1.4_result.log"
     $zcodeScript = $MyInvocation.MyCommand.Path
     $zcodeFwd = " -Target $Target"
     if ($SkipQoder) { $zcodeFwd += " -SkipQoder" }
-    $zcodeArgs = "-ExecutionPolicy Bypass -NoProfile -File `"$zcodeScript`"$zcodeFwd *> `"$zcodeLogOut`""
+    # -File passes only declared switches; a redirect operator after -File is
+    # just swallowed as an undeclared argument. The *_done.txt marker file
+    # (not a log) is the persisted result channel - the elevated console shows
+    # the full live output while the run progresses.
+    $zcodeArgs = "-ExecutionPolicy Bypass -NoProfile -File `"$zcodeScript`"$zcodeFwd"
     Start-Process powershell -Verb RunAs -ArgumentList $zcodeArgs -WindowStyle Normal -Wait
-    if (Test-Path -LiteralPath $zcodeLogOut) {
-        Get-Content -LiteralPath $zcodeLogOut
-    }
     if (Test-Path -LiteralPath "$env:TEMP\zcode_v1.3_done.txt") {
         Get-Content -LiteralPath "$env:TEMP\zcode_v1.3_done.txt"
     }
@@ -1115,7 +1115,10 @@ function Test-WatchdogRecreation {
         Write-Host "    [WARN] watchdog recreated file, re-deleting: $path" -ForegroundColor Yellow
         Remove-Item -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue
         $afterValue = if (Test-Path -LiteralPath $path) { "re-delete-failed" } else { "re-deleted" }
-        Add-AuditEntry -Audit $Audit -File $path -Key "watchdog-recreate" -Before "recreated" -After $afterValue -Ok $true
+        if ($afterValue -eq "re-delete-failed") {
+            Write-Host "    [FAILED] could not re-delete (file locked?): $path" -ForegroundColor Red
+        }
+        Add-AuditEntry -Audit $Audit -File $path -Key "watchdog-recreate" -Before "recreated" -After $afterValue -Ok ($afterValue -eq "re-deleted")
     }
 }
 
@@ -2453,6 +2456,8 @@ Write-Host "Restore script: $restoreScriptPath" -ForegroundColor Gray
 Write-Host "NOTE: workspace .backup sidecars were preserved per policy (they still embed the old device ID)." -ForegroundColor Yellow
 Write-Host "NOTE: change_device_id.ps1 is machine-wide and affects ALL ZCode instances + Qoder." -ForegroundColor Yellow
 
+# Marker filename keeps the historical "v1.3" label (docs + user habits read
+# it); the script itself is v1.4.
 [System.IO.File]::WriteAllText("$env:TEMP\zcode_v1.3_done.txt", ("Pass: {0} Fail: {1} Audit: {2}" -f $passCount, $failCount, $auditPath), (New-Object System.Text.UTF8Encoding $false))
 
 if ($failCount -gt 0) {
diff --git a/tests/python/test_ghost_core.py b/tests/python/test_ghost_core.py
index 2345871..d8a3741 100644
--- a/tests/python/test_ghost_core.py
+++ b/tests/python/test_ghost_core.py
@@ -22,7 +22,7 @@
 
 sys.path.insert(0, os.path.join(REPO_ROOT, "src", "python"))
 
-from ghost import audit, identity, json_patch, restore, sqlite_keys  # noqa: E402
+from ghost import audit, backup, filesweep, identity, json_patch, restore, sqlite_keys, winstore  # noqa: E402
 
 
 def _b64(payload):
@@ -179,6 +179,7 @@ def _make_db(self):
     def test_deletes_telemetry_like_keys_only(self):
         result = sqlite_keys.clear_cli_telemetry(self._make_db())
         self.assertEqual(result["deleted"], 3)
+        self.assertEqual(result["remaining"], 0)
         self.assertNotIn("error", result)
         conn = sqlite3.connect(os.path.join(self._tmp.name, "db.sqlite"))
         remaining = [r[0] for r in conn.execute("SELECT key FROM ItemTable")]
@@ -387,7 +388,11 @@ def test_restore_script_shape(self):
         path = restore.new_restore_script(backup_root, "ZCode", actions)
         self.assertTrue(path.endswith(
             os.path.join(backup_root, "restore_ZCode_20260101_000000.ps1")))
-        with open(path, "r", encoding="utf-8") as f:
+        # PS 5.1 reads BOM-less files as ANSI, so the restore script must
+        # carry a UTF-8 BOM for non-ASCII profile paths to survive.
+        with open(path, "rb") as f:
+            self.assertEqual(f.read(3), b"\xef\xbb\xbf")
+        with open(path, "r", encoding="utf-8-sig") as f:
             body = f.read()
         self.assertIn("function Restore-Entry", body)
         self.assertIn("$manifestJson = @'", body)
@@ -461,6 +466,501 @@ def test_chat_check_unknown_mode_cli_exit_code(self):
         self.assertEqual(proc.returncode, 2)
         self.assertIn("invalid choice", proc.stderr)
 
+    def test_machineid_file_command_bridge_contract(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            path = os.path.join(tmp, "machineid")
+            root = os.path.join(tmp, "ID_Backups", "ts")
+            payload_b64 = _b64({"value": "NEW-ID"})
+            proc = self._run("machineid-file", path, root, "machineid",
+                             payload_b64)
+            self.assertEqual(proc.returncode, 0, proc.stderr)
+            report = json.loads(proc.stdout)
+            self.assertEqual(report["after"], "NEW-ID")
+            # BOM-less UTF-8: the PS Set-VerifiedMachineIdFile regression.
+            with open(path, "rb") as f:
+                self.assertEqual(f.read(), b"NEW-ID")
+
+    def test_sweep_file_and_backup_command(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            src = os.path.join(tmp, "Cookies")
+            with open(src, "wb") as f:
+                f.write(b"data")
+            root = os.path.join(tmp, "ID_Backups", "ts")
+            proc = self._run("backup", src, root, "Cookies")
+            self.assertEqual(proc.returncode, 0, proc.stderr)
+            report = json.loads(proc.stdout)
+            self.assertTrue(report["ok"])
+            self.assertTrue(os.path.exists(report["destination"]))
+            proc = self._run("sweep-file", src)
+            self.assertEqual(proc.returncode, 0, proc.stderr)
+            self.assertEqual(json.loads(proc.stdout)["after"], "deleted")
+            self.assertFalse(os.path.exists(src))
+
+    def test_store_delete_command_rename_bridge(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            store = os.path.join(tmp, "Cookies")
+            with open(store, "wb") as f:
+                f.write(b"data")
+            root = os.path.join(tmp, "ID_Backups", "ts")
+            proc = self._run("store-delete", store, root, "Cookies",
+                             "--action", "rename")
+            self.assertEqual(proc.returncode, 0, proc.stderr)
+            report = json.loads(proc.stdout)
+            self.assertEqual(report["renamed_to"], store + ".backup")
+            self.assertFalse(os.path.exists(store))
+
+    def test_sweep_tree_command_reports_remaining(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            tree = os.path.join(tmp, "sentry")
+            os.makedirs(tree)
+            with open(os.path.join(tree, "a.log"), "w", encoding="utf-8") as f:
+                f.write("x")
+            root = os.path.join(tmp, "ID_Backups", "ts")
+            proc = self._run("sweep-tree", tree, root, "sentry")
+            self.assertEqual(proc.returncode, 0, proc.stderr)
+            report = json.loads(proc.stdout)
+            self.assertTrue(report["ok"])
+            self.assertEqual(report["deleted"], 1)
+            self.assertEqual(report["remaining"], 0)
+
+
+class BackupToTimestampedDirTests(unittest.TestCase):
+    """ghost.backup — port of Backup-FileToTimestampDir with verify-after."""
+
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        base = self._tmp.name
+        self.src_dir = os.path.join(base, "store")
+        os.makedirs(self.src_dir)
+        with open(os.path.join(self.src_dir, "storage.json"), "w",
+                  encoding="utf-8") as f:
+            f.write('{"telemetry.machineId": "OLD"}')
+        with open(os.path.join(self.src_dir, "nested.log"), "w",
+                  encoding="utf-8") as f:
+            f.write("log line" * 10)
+        self.src_file = os.path.join(base, "state.vscdb")
+        with open(self.src_file, "wb") as f:
+            f.write(b"sqlite-bytes" * 64)
+        self.backup_root = os.path.join(base, "ID_Backups", "20261017-120000")
+        self._sleeps = []
+        self._orig_sleep = backup.time.sleep
+        backup.time.sleep = self._sleeps.append
+        self._orig_copy = backup._copy_once
+
+    def tearDown(self):
+        backup.time.sleep = self._orig_sleep
+        backup._copy_once = self._orig_copy
+        self._tmp.cleanup()
+
+    def test_file_backup_ok_and_content_identical(self):
+        r = backup.backup_to_timestamped_dir(
+            self.src_file, self.backup_root, "state.vscdb")
+        self.assertTrue(r["ok"], r)
+        self.assertFalse(r["skipped"])
+        self.assertIsNone(r["error"])
+        dst = os.path.join(self.backup_root, "state.vscdb")
+        self.assertEqual(r["destination"], dst)
+        with open(self.src_file, "rb") as a, open(dst, "rb") as b:
+            self.assertEqual(a.read(), b.read())
+
+    def test_tree_backup_ok_and_entries_match(self):
+        r = backup.backup_to_timestamped_dir(
+            self.src_dir, self.backup_root, "store")
+        self.assertTrue(r["ok"], r)
+        dst = os.path.join(self.backup_root, "store")
+        self.assertTrue(os.path.isfile(os.path.join(dst, "storage.json")))
+        self.assertTrue(os.path.isfile(os.path.join(dst, "nested.log")))
+
+    def test_missing_source_reports_skip(self):
+        r = backup.backup_to_timestamped_dir(
+            os.path.join(self._tmp.name, "nope.json"),
+            self.backup_root, "nope.json")
+        self.assertFalse(r["ok"])
+        self.assertTrue(r["skipped"])
+        self.assertIsNone(r["destination"])
+
+    def test_label_may_carry_a_subdirectory(self):
+        r = backup.backup_to_timestamped_dir(
+            self.src_file, self.backup_root, os.path.join("sub", "state.vscdb"))
+        self.assertTrue(r["ok"], r)
+        self.assertTrue(os.path.isfile(
+            os.path.join(self.backup_root, "sub", "state.vscdb")))
+
+    def test_existing_destination_is_clobbered(self):
+        dst = os.path.join(self.backup_root, "state.vscdb")
+        os.makedirs(self.backup_root, exist_ok=True)
+        with open(dst, "wb") as f:
+            f.write(b"stale-backup-bytes")
+        r = backup.backup_to_timestamped_dir(
+            self.src_file, self.backup_root, "state.vscdb")
+        self.assertTrue(r["ok"], r)
+        with open(dst, "rb") as f:
+            self.assertEqual(f.read(), b"sqlite-bytes" * 64)
+
+    def test_transient_lock_retries_then_succeeds(self):
+        calls = []
+
+        def flaky(source, destination):
+            calls.append(destination)
+            if len(calls) < 3:
+                raise PermissionError("file in use")
+            self._orig_copy(source, destination)
+
+        backup._copy_once = flaky
+        r = backup.backup_to_timestamped_dir(
+            self.src_file, self.backup_root, "state.vscdb")
+        self.assertTrue(r["ok"], r)
+        self.assertEqual(len(calls), 3)
+        self.assertEqual(len(self._sleeps), 2)
+
+    def test_permanent_lock_reports_locked_after_all_attempts(self):
+        def locked(source, destination):
+            raise PermissionError("being held by another process")
+
+        backup._copy_once = locked
+        r = backup.backup_to_timestamped_dir(
+            self.src_file, self.backup_root, "state.vscdb", attempts=4,
+            backoff_ms=1)
+        self.assertFalse(r["ok"])
+        self.assertEqual(r["error"], "locked")
+        self.assertIn("locked", r["detail"])
+        self.assertEqual(len(self._sleeps), 3)
+
+    def test_verify_mismatch_removes_the_partial_copy(self):
+        real_stats = backup._tree_stats
+
+        def lying_stats(path):
+            if path.endswith("state.vscdb") and self.backup_root in path:
+                return (1, 1)  # lie about the copy
+            return real_stats(path)
+
+        backup._tree_stats = lying_stats
+        try:
+            r = backup.backup_to_timestamped_dir(
+                self.src_file, self.backup_root, "state.vscdb")
+        finally:
+            backup._tree_stats = real_stats
+        self.assertFalse(r["ok"])
+        self.assertEqual(r["error"], "verify")
+        self.assertIn("mismatch", r["detail"])
+        self.assertFalse(os.path.exists(
+            os.path.join(self.backup_root, "state.vscdb")))
+
+
+class FilesweepTests(unittest.TestCase):
+    """ghost.filesweep — ports of the cursor file-identity helpers."""
+
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        base = self._tmp.name
+        self.store = os.path.join(base, "Cookies")
+        with open(self.store, "wb") as f:
+            f.write(b"binary-store-bytes" * 8)
+        self.tree = os.path.join(base, "sentry")
+        os.makedirs(os.path.join(self.tree, "sub"))
+        for name in ("a.log", "b.log", os.path.join("sub", "c.log")):
+            with open(os.path.join(self.tree, name), "w", encoding="utf-8") as f:
+                f.write("log" * 10)
+        self.backup_root = os.path.join(base, "ID_Backups", "20261017-130000")
+        self._sleeps = []
+        self._orig_sleep = filesweep.time.sleep
+        filesweep.time.sleep = self._sleeps.append
+
+    def tearDown(self):
+        filesweep.time.sleep = self._orig_sleep
+        self._tmp.cleanup()
+
+    def test_remove_verified_present_and_missing(self):
+        r = filesweep.remove_verified(self.store)
+        self.assertTrue(r["ok"], r)
+        self.assertEqual((r["before"], r["after"]), ("present", "deleted"))
+        self.assertFalse(os.path.exists(self.store))
+        r2 = filesweep.remove_verified(self.store)
+        self.assertTrue(r2["ok"])
+        self.assertTrue(r2["skipped"])
+        self.assertEqual((r2["before"], r2["after"]), ("missing", "skipped"))
+
+    def test_identity_store_delete_mode_with_backup(self):
+        r = filesweep.remove_identity_store(
+            self.store, "delete", self.backup_root)
+        self.assertTrue(r["ok"], r)
+        self.assertEqual(r["after"], "deleted")
+        self.assertTrue(r["backed_up_to"])
+        self.assertFalse(os.path.exists(self.store))
+        self.assertTrue(os.path.exists(r["backed_up_to"]))
+
+    def test_identity_store_rename_mode_clobbers_stale_backup(self):
+        stale = self.store + ".backup"
+        with open(stale, "wb") as f:
+            f.write(b"stale")
+        r = filesweep.remove_identity_store(
+            self.store, "rename", self.backup_root)
+        self.assertTrue(r["ok"], r)
+        self.assertEqual(r["renamed_to"], stale)
+        self.assertFalse(os.path.exists(self.store))
+        with open(stale, "rb") as f:
+            self.assertEqual(f.read(), b"binary-store-bytes" * 8)
+
+    def test_identity_store_missing_is_skip_ok(self):
+        r = filesweep.remove_identity_store(
+            os.path.join(self._tmp.name, "nope"), "delete", self.backup_root)
+        self.assertTrue(r["ok"])
+        self.assertTrue(r["skipped"])
+
+    def test_identity_store_relative_label_from_root_path(self):
+        root = self._tmp.name
+        r = filesweep.remove_identity_store(
+            self.store, "delete", self.backup_root, root_path=root)
+        self.assertTrue(r["ok"], r)
+        self.assertEqual(r["backed_up_to"],
+                         os.path.join(self.backup_root, "Cookies"))
+
+    def test_sweep_tree_deletes_every_file_and_verifies(self):
+        r = filesweep.sweep_tree(self.tree, self.backup_root, "sentry")
+        self.assertTrue(r["ok"], r)
+        self.assertEqual(r["deleted"], 3)
+        self.assertEqual(r["failed"], 0)
+        self.assertEqual(r["remaining"], 0)
+        self.assertTrue(r["backed_up_to"])
+        # The PS original removes the emptied dirs and the tree root itself -
+        # no trace of the tree may survive the sweep.
+        self.assertFalse(os.path.exists(self.tree))
+
+    def test_sweep_tree_missing_is_skip_ok(self):
+        r = filesweep.sweep_tree(
+            os.path.join(self._tmp.name, "no-tree"),
+            self.backup_root, "no-tree")
+        self.assertTrue(r["ok"])
+        self.assertTrue(r["skipped"])
+
+
+class WinstoreTests(unittest.TestCase):
+    """ghost.winstore — ports of the cursor JSON/text identity helpers."""
+
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.base = self._tmp.name
+        self.backup_root = os.path.join(self.base, "ID_Backups", "ts")
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def test_machineid_file_write_and_verify(self):
+        path = os.path.join(self.base, "machineid")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write("OLD-ID\n")
+        r = winstore.write_machineid_file(
+            path, "NEW-ID", self.backup_root, "machineid")
+        self.assertTrue(r["ok"], r)
+        self.assertEqual((r["before"], r["after"]), ("OLD-ID", "NEW-ID"))
+        self.assertTrue(r["backed_up_to"])
+        with open(path, "r", encoding="utf-8") as f:
+            self.assertEqual(f.read(), "NEW-ID")
+
+    def test_machineid_file_creates_missing(self):
+        path = os.path.join(self.base, "Cursor", "machineid")
+        r = winstore.write_machineid_file(
+            path, "NEW-ID", self.backup_root, "machineid")
+        self.assertTrue(r["ok"], r)
+        self.assertIsNone(r["before"])
+        self.assertIsNone(r["backed_up_to"])
+
+    def test_salt_rotation_creates_nested_dicts(self):
+        path = os.path.join(self.base, "Preferences")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write('{"other": 1}')
+        r = winstore.rotate_device_id_salt(path, self.backup_root, "Preferences")
+        self.assertTrue(r["ok"], r)
+        self.assertIsNone(r["before"])
+        self.assertRegex(r["after"], r"^[0-9a-f]{32}$")
+        with open(path, "r", encoding="utf-8-sig") as f:
+            content = json.load(f)
+        self.assertEqual(content["electron"]["media"]["device_id_salt"],
+                         r["after"])
+
+    def test_salt_rotation_replaces_existing_and_verifies(self):
+        path = os.path.join(self.base, "Preferences")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write('{"electron": {"media": {"device_id_salt": "OLD"}}}')
+        r = winstore.rotate_device_id_salt(
+            path, self.backup_root, "Preferences", new_salt="a" * 32)
+        self.assertTrue(r["ok"], r)
+        self.assertEqual((r["before"], r["after"]), ("OLD", "a" * 32))
+        self.assertTrue(r["backed_up_to"])
+
+    def test_salt_rotation_missing_file_is_skip_ok(self):
+        r = winstore.rotate_device_id_salt(
+            os.path.join(self.base, "nope"), self.backup_root, "nope")
+        self.assertTrue(r["ok"])
+        self.assertTrue(r["skipped"])
+
+    def test_remove_json_keys_dotted_path(self):
+        path = os.path.join(self.base, "Local State")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write('{"os_crypt": {"encrypted_key": "SECRET"}, "keep": 1}')
+        r = winstore.remove_json_keys(
+            path, ["os_crypt.encrypted_key"], self.backup_root, "Local State")
+        self.assertTrue(r["ok"], r)
+        self.assertEqual(r["before"], {"os_crypt.encrypted_key": "present"})
+        self.assertEqual(r["removed"], ["os_crypt.encrypted_key"])
+        with open(path, "r", encoding="utf-8-sig") as f:
+            content = json.load(f)
+        self.assertNotIn("encrypted_key", content["os_crypt"])
+        self.assertEqual(content["keep"], 1)
+
+    def test_remove_json_keys_missing_walk_is_skip_ok(self):
+        path = os.path.join(self.base, "Local State")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write('{"keep": 1}')
+        r = winstore.remove_json_keys(
+            path, ["os_crypt.encrypted_key"], self.backup_root, "Local State")
+        self.assertTrue(r["ok"], r)
+        self.assertEqual(r["before"], {"os_crypt.encrypted_key": "missing"})
+
+    def test_remove_json_keys_missing_file_is_skip_ok(self):
+        r = winstore.remove_json_keys(
+            os.path.join(self.base, "nope"), ["a.b"],
+            self.backup_root, "nope")
+        self.assertTrue(r["ok"])
+        self.assertTrue(r["skipped"])
+
+
+class DevinPrepTests(unittest.TestCase):
+    """The Phase 3 devin-migration core additions: generalized delete_secrets,
+    JSONC argv patcher, raw-text scrubber, dotted JSON set."""
+
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.base = self._tmp.name
+        self.backup_root = os.path.join(self.base, "ID_Backups", "ts")
+        self._sleeps = []
+        self._orig_sleep = filesweep.time.sleep
+        filesweep.time.sleep = self._sleeps.append
+
+    def tearDown(self):
+        filesweep.time.sleep = self._orig_sleep
+        self._tmp.cleanup()
+
+    def _secret_db(self, rows):
+        db = os.path.join(self.base, "state.vscdb")
+        conn = sqlite3.connect(db)
+        conn.execute("CREATE TABLE ItemTable (key TEXT PRIMARY KEY, value TEXT)")
+        for k, v in rows:
+            conn.execute("INSERT INTO ItemTable VALUES (?, ?)", (k, v))
+        conn.commit()
+        conn.close()
+        return db
+
+    def test_delete_secrets_generalized_with_escape(self):
+        db = self._secret_db([
+            ("codeium.windsurf-windsurf_auth", "TOKEN"),
+            ("windsurf_auth-extra", "TOKEN2"),
+            ("windsurfXauth-keep", "NOT-SECRET"),  # X is NOT a literal _
+            ("keep-me", "x"),
+        ])
+        r = sqlite_keys.delete_secrets(
+            db,
+            exact_keys=["codeium.windsurf-windsurf_auth"],
+            like_patterns=["windsurf\\_auth-%"],
+            escape="\\")
+        self.assertEqual(r["survivors"], [0, 0])
+        self.assertIn("windsurf_auth-extra", r["deleted"])
+        self.assertNotIn("windsurfXauth-keep", r["deleted"])
+        conn = sqlite3.connect(db)
+        remaining = conn.execute(
+            "SELECT key FROM ItemTable ORDER BY key").fetchall()
+        conn.close()
+        self.assertEqual([row[0] for row in remaining],
+                         ["keep-me", "windsurfXauth-keep"])
+
+    def test_delete_secrets_defaults_unchanged(self):
+        db = self._secret_db([
+            ("secret://aicoding.auth.t", "x"),
+            ("gituser", "u"),
+        ])
+        r = sqlite_keys.delete_secrets(db)
+        self.assertEqual(r["survivors"], [0, 0, 0])
+
+    def _argv(self):
+        path = os.path.join(self.base, "argv.json")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write('// comments must survive\n{\n  '
+                    '"crash-reporter-id": "OLD-ID",\n'
+                    '  "user-data-dir": "C:\\\\Users\\\\FOTE\\\\x"\n}')
+        return path
+
+    def test_patch_argv_json_replaces_and_scrubs(self):
+        path = self._argv()
+        r = winstore.patch_argv_json(
+            path, self.backup_root, "argv.json",
+            new_id="NEW-ID", username="FOTE")
+        self.assertTrue(r["ok"], r)
+        self.assertEqual((r["before"], r["after"]), ("OLD-ID", "NEW-ID"))
+        self.assertTrue(r["user_dir_scrubbed"])
+        raw = open(path, encoding="utf-8-sig").read()
+        self.assertIn("// comments must survive", raw)  # JSONC preserved
+        self.assertNotIn("FOTE", raw)
+        self.assertIn("RESET", raw)
+
+    def test_patch_argv_json_inserts_missing_key(self):
+        path = os.path.join(self.base, "argv.json")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write('{\n  "disable-hardware-acceleration": true\n}')
+        r = winstore.patch_argv_json(path, self.backup_root, "argv.json",
+                                     new_id="NEW-ID")
+        self.assertTrue(r["ok"], r)
+        self.assertIsNone(r["before"])
+        self.assertEqual(r["after"], "NEW-ID")
+
+    def test_patch_argv_json_missing_file_is_skip_ok(self):
+        r = winstore.patch_argv_json(
+            os.path.join(self.base, "nope"), self.backup_root, "nope")
+        self.assertTrue(r["ok"])
+        self.assertTrue(r["skipped"])
+
+    def test_replace_text_scrubs_and_verifies(self):
+        path = os.path.join(self.base, "Preferences")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write('{"profile": "C:\\\\Users\\\\FOTE\\\\Cursor"}')
+        r = winstore.replace_text(path, "FOTE", "RESET",
+                                  self.backup_root, "Preferences")
+        self.assertTrue(r["ok"], r)
+        self.assertEqual((r["before"], r["after"]), ("leaked", "clean"))
+        self.assertTrue(r["backed_up_to"])
+
+    def test_replace_text_clean_file_needs_no_backup(self):
+        path = os.path.join(self.base, "Preferences")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write('{"profile": "clean"}')
+        r = winstore.replace_text(path, "FOTE", "RESET",
+                                  self.backup_root, "Preferences")
+        self.assertTrue(r["ok"], r)
+        self.assertEqual((r["before"], r["after"]), ("clean", "clean"))
+        self.assertIsNone(r["backed_up_to"])
+
+    def test_set_json_path_dotted(self):
+        path = os.path.join(self.base, "config.json")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write('{"devin": {"org_id": "ORG-123"}}')
+        r = winstore.set_json_path(path, "devin.org_id", "",
+                                   self.backup_root, "config.json")
+        self.assertTrue(r["ok"], r)
+        self.assertEqual(r["before"], "ORG-123")
+        with open(path, "r", encoding="utf-8-sig") as f:
+            self.assertEqual(json.load(f)["devin"]["org_id"], "")
+
+    def test_set_json_path_skip_if_empty(self):
+        path = os.path.join(self.base, "config.json")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write('{"devin": {"org_id": ""}}')
+        r = winstore.set_json_path(path, "devin.org_id", "NEW",
+                                   self.backup_root, "config.json",
+                                   skip_if_empty=True)
+        self.assertTrue(r["ok"], r)
+        self.assertTrue(r["skipped"])
+        with open(path, "r", encoding="utf-8-sig") as f:
+            self.assertEqual(json.load(f)["devin"]["org_id"], "")
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/repo-integrity.Tests.ps1 b/tests/repo-integrity.Tests.ps1
index 836aa43..8c7a401 100644
--- a/tests/repo-integrity.Tests.ps1
+++ b/tests/repo-integrity.Tests.ps1
@@ -124,7 +124,21 @@ Describe "README consistency" {
 
     It "has no stale scripts/ paths in tracked text files (CHANGELOG exempt: rename history)" {
         $repoRoot = (Get-Item (Join-Path $PSScriptRoot "..")).FullName
-        $hits = & git -C $repoRoot grep -l -E "scripts[/\\\\](windows|linux)" -- "*.md" "*.bat" "*.sh" "*.txt" "*.yml" ":!CHANGELOG.md" 2>$null
+        if ((Get-Command git -ErrorAction SilentlyContinue) -and (Test-Path -LiteralPath (Join-Path $repoRoot ".git"))) {
+            # Real checkout: grep only tracked files.
+            $hits = & git -C $repoRoot grep -l -E "scripts[/\\\\](windows|linux)" -- "*.md" "*.bat" "*.sh" "*.txt" "*.yml" ":!CHANGELOG.md" 2>$null
+        }
+        else {
+            # Download-ZIP copy (README-supported): no .git to grep, so scan
+            # the extracted text files with the same extension set instead.
+            $hits = @(Get-ChildItem -Path $repoRoot -Recurse -File -Include *.md, *.bat, *.sh, *.txt, *.yml -ErrorAction SilentlyContinue |
+                Where-Object {
+                    ($_.Name -ne "CHANGELOG.md") -and
+                    ($_.FullName -notmatch '[\\/]\.git[\\/]') -and
+                    ($_.FullName -notmatch '[\\/]archive[\\/]') -and
+                    (Select-String -LiteralPath $_.FullName -Pattern "scripts[/\\](windows|linux)" -Quiet)
+                } | ForEach-Object { $_.FullName })
+        }
         @($hits).Count | Should -Be 0
     }
 }
diff --git a/tests/set_zcode_bot.Tests.ps1 b/tests/set_zcode_bot.Tests.ps1
new file mode 100644
index 0000000..4e1bfec
--- /dev/null
+++ b/tests/set_zcode_bot.Tests.ps1
@@ -0,0 +1,89 @@
+# SPDX-License-Identifier: Apache-2.0
+# Unit tests for tools/set_zcode_bot.ps1 guardian logic.
+# The guardian never writes secrets: it fingerprints the encrypted
+# credentials.json -> bot:<id>:credential (enc:v1:) via sha8 + bot id across
+# BOTH bot-config.json and bot-config.v3.json. These tests exercise that
+# contract on TestDrive: fixtures only, never the live homes.
+
+BeforeAll {
+    function Get-TestBotCredSha8 {
+        param([string]$CredentialsPath, [string]$CredentialRef)
+        if (-not (Test-Path -LiteralPath $CredentialsPath)) { return '' }
+        try { $creds = Get-Content -LiteralPath $CredentialsPath -Raw | ConvertFrom-Json }
+        catch { return '' }
+        $prop = $creds.PSObject.Properties[$CredentialRef]
+        if ($null -eq $prop) { return '' }
+        $val = [string]$prop.Value
+        if ([string]::IsNullOrEmpty($val)) { return '' }
+        $bytes = [System.Text.Encoding]::UTF8.GetBytes($val)
+        $sha = [System.Security.Cryptography.SHA256]::Create()
+        try { $hash = $sha.ComputeHash($bytes) }
+        finally { if ($sha) { $sha.Dispose() } }
+        return ([BitConverter]::ToString($hash).Replace('-', '').ToLowerInvariant()).Substring(0, 8)
+    }
+
+    function New-TestBotHome {
+        param([string]$Root, [string]$BotId, [string]$CredValue, [bool]$EnabledV2, [bool]$EnabledV3)
+        $zcode = Join-Path $Root '.zcode'
+        New-Item -ItemType Directory -Path (Join-Path $zcode 'v2') -Force | Out-Null
+        $creds = [ordered]@{ }
+        $creds[('bot:' + $BotId + ':credential')] = $CredValue
+        [System.IO.File]::WriteAllText((Join-Path $zcode 'v2\credentials.json'), ($creds | ConvertTo-Json -Depth 10), (New-Object System.Text.UTF8Encoding $false))
+        foreach ($pair in @(@('bot-config.json', $EnabledV2), @('bot-config.v3.json', $EnabledV3))) {
+            $cfg = [ordered]@{
+                version = 2
+                bots    = @(@{
+                        id            = $BotId
+                        name          = 'TestBot'
+                        provider      = 'telegram'
+                        enabled       = $pair[1]
+                        credentialRef = ('bot:' + $BotId + ':credential')
+                    })
+            }
+            [System.IO.File]::WriteAllText((Join-Path $zcode ('v2\' + $pair[0])), ($cfg | ConvertTo-Json -Depth 20), (New-Object System.Text.UTF8Encoding $false))
+        }
+        return $zcode
+    }
+}
+
+Describe 'Telegram guardian sha8 contract' {
+    It 'same enc:v1: value yields same sha8 across homes (duplicate detected)' {
+        $a = Join-Path $TestDrive 'homeA'
+        $b = Join-Path $TestDrive 'homeB'
+        $za = New-TestBotHome -Root $a -BotId 'bot-aaa' -CredValue 'enc:v1:SHARED' -EnabledV2 $true -EnabledV3 $true
+        $zb = New-TestBotHome -Root $b -BotId 'bot-aaa' -CredValue 'enc:v1:SHARED' -EnabledV2 $false -EnabledV3 $false
+        $shaA = Get-TestBotCredSha8 -CredentialsPath (Join-Path $za 'v2\credentials.json') -CredentialRef 'bot:bot-aaa:credential'
+        $shaB = Get-TestBotCredSha8 -CredentialsPath (Join-Path $zb 'v2\credentials.json') -CredentialRef 'bot:bot-aaa:credential'
+        $shaA | Should -Not -BeNullOrEmpty
+        $shaB | Should -Be $shaA
+    }
+
+    It 'distinct enc:v1: values yield distinct sha8 (unique bot allowed)' {
+        $a = Join-Path $TestDrive 'homeC'
+        $b = Join-Path $TestDrive 'homeD'
+        $za = New-TestBotHome -Root $a -BotId 'bot-aaa' -CredValue 'enc:v1:ONE' -EnabledV2 $true -EnabledV3 $true
+        $zb = New-TestBotHome -Root $b -BotId 'bot-bbb' -CredValue 'enc:v1:TWO' -EnabledV2 $true -EnabledV3 $true
+        $shaA = Get-TestBotCredSha8 -CredentialsPath (Join-Path $za 'v2\credentials.json') -CredentialRef 'bot:bot-aaa:credential'
+        $shaB = Get-TestBotCredSha8 -CredentialsPath (Join-Path $zb 'v2\credentials.json') -CredentialRef 'bot:bot-bbb:credential'
+        $shaB | Should -Not -Be $shaA
+    }
+
+    It 'detects v2/v3 enabled mismatch (the 2026-10-16 Fourth split)' {
+        $root = Join-Path $TestDrive 'homeE'
+        $zcode = New-TestBotHome -Root $root -BotId 'bot-aaa' -CredValue 'enc:v1:X' -EnabledV2 $false -EnabledV3 $true
+        $flags = @()
+        foreach ($cfgName in @('v2\bot-config.json', 'v2\bot-config.v3.json')) {
+            $cfg = Get-Content -LiteralPath (Join-Path $zcode $cfgName) -Raw | ConvertFrom-Json
+            foreach ($bot in @($cfg.bots)) {
+                if ($bot.provider -eq 'telegram') { $flags += [bool]$bot.enabled }
+            }
+        }
+        @($flags | Select-Object -Unique).Count | Should -Be 2
+    }
+
+    It 'missing credential ref yields empty sha8 (safe disable path)' {
+        $root = Join-Path $TestDrive 'homeF'
+        $zcode = New-TestBotHome -Root $root -BotId 'bot-aaa' -CredValue 'enc:v1:X' -EnabledV2 $false -EnabledV3 $false
+        Get-TestBotCredSha8 -CredentialsPath (Join-Path $zcode 'v2\credentials.json') -CredentialRef 'bot:bot-missing:credential' | Should -Be ''
+    }
+}
diff --git a/tools/autoclaw-blue-branding/icon_windows.png b/tools/autoclaw-blue-branding/icon_windows.png
new file mode 100644
index 0000000..f365005
Binary files /dev/null and b/tools/autoclaw-blue-branding/icon_windows.png differ
diff --git a/tools/autoclaw-blue-branding/source.jpg b/tools/autoclaw-blue-branding/source.jpg
new file mode 100644
index 0000000..aae9aed
Binary files /dev/null and b/tools/autoclaw-blue-branding/source.jpg differ
diff --git a/tools/autoclaw-blue-branding/tray_icon.ico b/tools/autoclaw-blue-branding/tray_icon.ico
new file mode 100644
index 0000000..83addfe
Binary files /dev/null and b/tools/autoclaw-blue-branding/tray_icon.ico differ
diff --git a/tools/autoclaw-green-branding/icon_windows.png b/tools/autoclaw-green-branding/icon_windows.png
new file mode 100644
index 0000000..b9ceb8c
Binary files /dev/null and b/tools/autoclaw-green-branding/icon_windows.png differ
diff --git a/tools/autoclaw-green-branding/source.jpg b/tools/autoclaw-green-branding/source.jpg
new file mode 100644
index 0000000..eeb6870
Binary files /dev/null and b/tools/autoclaw-green-branding/source.jpg differ
diff --git a/tools/autoclaw-green-branding/tray_icon.ico b/tools/autoclaw-green-branding/tray_icon.ico
new file mode 100644
index 0000000..5d8a446
Binary files /dev/null and b/tools/autoclaw-green-branding/tray_icon.ico differ
diff --git a/tools/autoclaw-red-branding/icon_windows.png b/tools/autoclaw-red-branding/icon_windows.png
new file mode 100644
index 0000000..97b9500
Binary files /dev/null and b/tools/autoclaw-red-branding/icon_windows.png differ
diff --git a/tools/autoclaw-red-branding/tray_icon.ico b/tools/autoclaw-red-branding/tray_icon.ico
new file mode 100644
index 0000000..4e1a866
Binary files /dev/null and b/tools/autoclaw-red-branding/tray_icon.ico differ
diff --git a/tools/autoclaw-yellow-branding/icon_windows.png b/tools/autoclaw-yellow-branding/icon_windows.png
new file mode 100644
index 0000000..c648dcf
Binary files /dev/null and b/tools/autoclaw-yellow-branding/icon_windows.png differ
diff --git a/tools/autoclaw-yellow-branding/source.jpg b/tools/autoclaw-yellow-branding/source.jpg
new file mode 100644
index 0000000..26afb09
Binary files /dev/null and b/tools/autoclaw-yellow-branding/source.jpg differ
diff --git a/tools/autoclaw-yellow-branding/tray_icon.ico b/tools/autoclaw-yellow-branding/tray_icon.ico
new file mode 100644
index 0000000..1d5c1d4
Binary files /dev/null and b/tools/autoclaw-yellow-branding/tray_icon.ico differ
diff --git a/tools/diagnose_zcode_freeze.ps1 b/tools/diagnose_zcode_freeze.ps1
index 0bbad2b..433ea10 100644
--- a/tools/diagnose_zcode_freeze.ps1
+++ b/tools/diagnose_zcode_freeze.ps1
@@ -69,7 +69,7 @@ function Get-JsonLeaves {
 
 $Dates = @(0..($Days - 1) | ForEach-Object { (Get-Date).Date.AddDays(-$_).ToString('yyyy-MM-dd') })
 $Events = @()   # objects: Instance, Ts, Pid, Kind, Reason
-$OomOsError1455 = $false
+$script:OomOsError1455 = $false
 
 # ---- [1] per-instance crash events from the v2 logs -------------------------
 # Only the event lines carry a json payload ("...-gone: {"); the follow-up
@@ -184,7 +184,7 @@ foreach ($inst in $Instances) {
         Write-Output ('   ' + $stamp + '  ' + $dmp.Name)
         foreach ($one in @($prio + $rest)) {
             $out = '     ' + $one
-            if ($one -match 'last-os-error\s*=\s*1455') {
+            if ($one -match 'last-os-error\s*=\s*1455(?!\d)') {
                 $script:OomOsError1455 = $true
                 $out = $out + '   <-- ERROR_COMMITMENT_LIMIT: paging file too small'
             }
diff --git a/tools/install_autoclaw_clone_shortcuts.ps1 b/tools/install_autoclaw_clone_shortcuts.ps1
new file mode 100644
index 0000000..a698802
--- /dev/null
+++ b/tools/install_autoclaw_clone_shortcuts.ps1
@@ -0,0 +1,415 @@
+#requires -Version 5.1
+<#
+.SYNOPSIS
+  Installs (or removes) Desktop + Start Menu shortcuts for the AutoClaw CLONE
+  instances (inst1 / inst2 / inst3 / inst4). Default: all four.
+
+.DESCRIPTION
+  A Windows .lnk cannot set environment variables, and each clone AutoClaw
+  instance is fully driven by env vars (USERPROFILE / HOME / TEMP / TMPDIR /
+  AUTOCLAW_GATEWAY_PORT) plus its --user-data-dir. So each shortcut points at
+  src\windows\launch_autoclaw_clone.ps1 with -Instance <name>, which sets the
+  isolation env and launches AutoClaw detached (cmd /c start) - any future
+  launcher fix automatically applies to the shortcuts.
+
+  Per-clone icons: each shortcut's IconLocation points at its branding dir
+  (tools\autoclaw-<color>-branding\tray_icon.ico, generated by
+  tools\make_clone_icon.ps1). Missing branding files fall back to the
+  AutoClaw.exe icon - never a set-but-absent icon path. The PRIMARY
+  AutoClaw.lnk always keeps the stock exe icon (see -RepairPrimaryAumid).
+
+  Per-user locations only -> NO admin rights needed:
+    Desktop    : [Environment]::GetFolderPath('Desktop')
+    Start Menu : %APPDATA%\Microsoft\Windows\Start Menu\Programs
+
+  Every write is re-read and compared (no silent-success). Unless -SkipAumid is
+  given, each shortcut gets System.AppUserModel.ID = <base AUMID>.<instN>
+  (base com.zhipuai.autoclaw, set unconditionally by the app itself - verified
+  in the installed app.asar, spec section 5.8; read from the Primary .lnk when
+  one exists, constant otherwise). NOTE: v1 known limitation - running windows
+  all declare the BASE AUMID (no env override exists yet), so shortcuts get
+  distinct pins but the running windows share one taskbar button until the v2
+  AUMID-suffix patch lands (spec section 7.3c).
+
+  The same repair path (-RepairPrimaryAumid) also strips an ".instN" suffix
+  hijacked onto the PRIMARY AutoClaw.lnk AND restores the Primary shortcut's
+  wiped icon back to <AutoClaw.exe>,0 (a pin rewrite can empty the icon field -
+  same hazard as the ZCode Primary, verified 2026-09-28 there).
+
+  Diagnostic rule (ZCode lesson, do not regress): read .lnk AUMIDs ONLY via
+  Shell.Application ExtendedProperty('System.AppUserModel.ID') - decoding the
+  whole .lnk as UTF-16 and regexing misaligns on odd byte offsets and reports
+  false <none>.
+
+.EXAMPLE
+  powershell -NoProfile -ExecutionPolicy Bypass -File tools\install_autoclaw_clone_shortcuts.ps1
+  powershell -NoProfile -ExecutionPolicy Bypass -File tools\install_autoclaw_clone_shortcuts.ps1 -Instance inst2
+  powershell -NoProfile -ExecutionPolicy Bypass -File tools\install_autoclaw_clone_shortcuts.ps1 -Remove
+  powershell -NoProfile -ExecutionPolicy Bypass -File tools\install_autoclaw_clone_shortcuts.ps1 -RepairPrimaryAumid
+#>
+[CmdletBinding()]
+param(
+  [ValidateSet('inst1', 'inst2', 'inst3', 'inst4')]
+  [string[]]$Instance = @('inst1', 'inst2', 'inst3', 'inst4'),
+  [switch]$Remove,
+  [switch]$DesktopOnly,
+  [switch]$StartMenuOnly,
+  [switch]$SkipAumid,
+  [switch]$RepairPrimaryAumid
+)
+
+$ErrorActionPreference = 'Stop'
+
+$RepoRoot = Split-Path -Parent $PSScriptRoot
+$Launcher = Join-Path $RepoRoot 'src\windows\launch_autoclaw_clone.ps1'
+
+# Must stay in sync with the InstanceMap in launch_autoclaw_clone.ps1.
+# BrandingRepo dirs hold tray_icon.ico generated by tools\make_clone_icon.ps1
+# (developer-supplied renders 2026-10-17; red is a derived hue-rotate of blue).
+$InstanceDefs = @{
+  'inst1' = @{ ShortcutName = 'AutoClaw inst1.lnk'; BrandingRepo = 'autoclaw-blue-branding';   DisplayName = 'Blue' }
+  'inst2' = @{ ShortcutName = 'AutoClaw inst2.lnk'; BrandingRepo = 'autoclaw-yellow-branding'; DisplayName = 'Yellow' }
+  'inst3' = @{ ShortcutName = 'AutoClaw inst3.lnk'; BrandingRepo = 'autoclaw-green-branding';  DisplayName = 'Green' }
+  'inst4' = @{ ShortcutName = 'AutoClaw inst4.lnk'; BrandingRepo = 'autoclaw-red-branding';    DisplayName = 'Red' }
+}
+$BaseAumidConstant = 'com.zhipuai.autoclaw'
+$script:Failed = $false
+
+if ($DesktopOnly -and $StartMenuOnly) { $DesktopOnly = $false; $StartMenuOnly = $false }
+
+function Get-ShortcutTargets {
+  param([string]$ShortcutName)
+  $targets = @()
+  if (-not $StartMenuOnly) {
+    $targets += Join-Path ([Environment]::GetFolderPath('Desktop')) $ShortcutName
+  }
+  if (-not $DesktopOnly) {
+    $targets += Join-Path $env:APPDATA "Microsoft\Windows\Start Menu\Programs\$ShortcutName"
+  }
+  return $targets
+}
+
+function Assert-Value {
+  param([string]$Name, [string]$Expected, [string]$Actual)
+  if ($Actual -ieq $Expected) {
+    Write-Host "      [ok] $Name" -ForegroundColor Green
+  } else {
+    Write-Host "      [FAILED] $Name : expected '$Expected' but read '$Actual'" -ForegroundColor Red
+    $script:Failed = $true
+  }
+}
+
+function Add-AumidType {
+  if ('ShortcutAumid' -as [type]) { return }
+  $cs = @'
+using System;
+using System.Runtime.InteropServices;
+
+public static class ShortcutAumid
+{
+    [ComImport, Guid("00021401-0000-0000-C000-000000000046")]
+    private class ShellLinkCom { }
+
+    [ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown), Guid("0000010B-0000-0000-C000-000000000046")]
+    private interface IPersistFile
+    {
+        void GetClassID(out Guid pClassID);
+        [PreserveSig] int IsDirty();
+        void Load([MarshalAs(UnmanagedType.LPWStr)] string pszFileName, uint dwMode);
+        void Save([MarshalAs(UnmanagedType.LPWStr)] string pszFileName, bool fRemember);
+        void SaveCompleted([MarshalAs(UnmanagedType.LPWStr)] string pszFileName);
+        void GetCurFile([MarshalAs(UnmanagedType.LPWStr)] out string ppszFileName);
+    }
+
+    [StructLayout(LayoutKind.Sequential, Pack = 4)]
+    private struct PROPERTYKEY { public Guid fmtid; public uint pid; }
+
+    [ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown), Guid("886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99")]
+    private interface IPropertyStore
+    {
+        [PreserveSig] int GetCount(out uint cProps);
+        [PreserveSig] int GetAt(uint iProp, out PROPERTYKEY pkey);
+        [PreserveSig] int GetValue(ref PROPERTYKEY key, out PROPVARIANT pv);
+        [PreserveSig] int SetValue(ref PROPERTYKEY key, ref PROPVARIANT pv);
+        [PreserveSig] int Commit();
+    }
+
+    [StructLayout(LayoutKind.Explicit, Size = 24)] // native x64 PROPVARIANT is 24 bytes
+    private struct PROPVARIANT
+    {
+        [FieldOffset(0)] public ushort vt;
+        [FieldOffset(8)] public IntPtr ptr;
+    }
+
+    private const ushort VT_LPWSTR = 31;
+    private static PROPERTYKEY AppIdKey()
+    {
+        PROPERTYKEY k;
+        k.fmtid = new Guid("9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3");
+        k.pid = 5;
+        return k;
+    }
+
+    public static void Set(string lnkPath, string aumid)
+    {
+        IPersistFile pf = (IPersistFile)new ShellLinkCom();
+        pf.Load(lnkPath, 2); // STGM_READWRITE
+        IPropertyStore ps = (IPropertyStore)pf;
+        PROPERTYKEY key = AppIdKey();
+        PROPVARIANT pv = new PROPVARIANT();
+        pv.vt = VT_LPWSTR;
+        pv.ptr = Marshal.StringToCoTaskMemUni(aumid);
+        int hr = ps.SetValue(ref key, ref pv);
+        Marshal.FreeCoTaskMem(pv.ptr);
+        if (hr != 0) Marshal.ThrowExceptionForHR(hr);
+        hr = ps.Commit();
+        if (hr != 0) Marshal.ThrowExceptionForHR(hr);
+        pf.Save(lnkPath, true);
+    }
+}
+'@
+  Add-Type -TypeDefinition $cs
+}
+
+function Get-LnkAumid {
+  # Shell property system ONLY (see header diagnostic rule).
+  param([string]$Path)
+  $sh = New-Object -ComObject Shell.Application
+  $ns = $sh.Namespace((Split-Path -Parent $Path))
+  if (-not $ns) { return $null }
+  $item = $ns.ParseName((Split-Path -Leaf $Path))
+  if (-not $item) { return $null }
+  $v = $item.ExtendedProperty('System.AppUserModel.ID')
+  if ($null -eq $v) { return $null }
+  return ([string]$v)
+}
+
+function Get-PrimaryLnkPaths {
+  return @(
+    (Join-Path ([Environment]::GetFolderPath('Desktop')) 'AutoClaw.lnk'),
+    (Join-Path $env:APPDATA 'Microsoft\Windows\Start Menu\Programs\AutoClaw.lnk'),
+    (Join-Path $env:ProgramData 'Microsoft\Windows\Start Menu\Programs\AutoClaw.lnk')
+  )
+}
+
+function Get-AutoClawExe {
+  $cands = @(
+    'C:\Program Files\AutoClaw\AutoClaw.exe',
+    'C:\Program Files (x86)\AutoClaw\AutoClaw.exe',
+    (Join-Path $env:LOCALAPPDATA 'Programs\AutoClaw\AutoClaw.exe')
+  )
+  foreach ($c in $cands) { if (Test-Path -LiteralPath $c) { return $c } }
+  return $null
+}
+
+function Repair-PrimaryLnkIcon {
+  param([string]$Path)
+  $ws = New-Object -ComObject WScript.Shell
+  $sc = $ws.CreateShortcut($Path)
+  $exe = $sc.TargetPath
+  if ([string]::IsNullOrWhiteSpace($exe) -or -not (Test-Path -LiteralPath $exe)) { $exe = Get-AutoClawExe }
+  if (-not $exe) {
+    Write-Host "  [skip] icon restore on $Path - AutoClaw.exe not found." -ForegroundColor Yellow
+    return
+  }
+  $expected = "$exe,0"
+  if ($sc.IconLocation -ieq $expected) { return }
+  try {
+    $sc.IconLocation = $expected
+    $sc.Save()
+    $chk = (New-Object -ComObject WScript.Shell).CreateShortcut($Path)
+    Assert-Value 'IconLocation' $expected $chk.IconLocation
+  } catch {
+    Write-Host "  [FAILED] icon restore on $Path : $($_.Exception.Message)" -ForegroundColor Red
+    $script:Failed = $true
+  }
+}
+
+function Repair-PrimaryAumid {
+  # Strip any trailing ".instN" clone suffix from the primary shortcut's AUMID
+  # (a pin rewrite can stamp it there) and restore a wiped icon field.
+  Add-AumidType
+  $repaired = 0
+  $base = $null
+  foreach ($c in (Get-PrimaryLnkPaths)) {
+    if (-not (Test-Path -LiteralPath $c)) { continue }
+    $id = Get-LnkAumid $c
+    if (-not [string]::IsNullOrWhiteSpace($id)) {
+      if ($base -eq $null) { $base = $id }
+      if ($id -match '\.inst\d+$') {
+        $clean = $id -replace '\.inst\d+$', ''
+        try {
+          [ShortcutAumid]::Set($c, $clean)
+          $after = Get-LnkAumid $c
+          if ($after -ieq $clean) {
+            Write-Host "  [ok] repaired AUMID '$id' -> '$clean' in $c" -ForegroundColor Green
+            $repaired++
+            if ($base -eq $id) { $base = $clean }
+            Repair-PrimaryLnkIcon $c
+          } else {
+            Write-Host "  [FAILED] AUMID still '$after' after repair in $c" -ForegroundColor Red
+            $script:Failed = $true
+          }
+        } catch {
+          Write-Host "  [FAILED] AUMID repair on $c : $($_.Exception.Message)" -ForegroundColor Red
+          $script:Failed = $true
+        }
+        continue
+      }
+    }
+    # Healthy AUMID (or none stamped): still heal a wiped icon field.
+    Repair-PrimaryLnkIcon $c
+  }
+  if ($repaired -eq 0) { Write-Host '  [ok] no clone AUMID collision on the primary shortcut.' -ForegroundColor Green }
+  return $base
+}
+
+function Get-InstalledAutoClawAumid {
+  # Prefer the Primary .lnk's own AUMID; fall back to the verified constant
+  # (the app sets com.zhipuai.autoclaw unconditionally - spec section 5.8).
+  foreach ($c in (Get-PrimaryLnkPaths)) {
+    if (Test-Path -LiteralPath $c) {
+      $id = Get-LnkAumid $c
+      if (-not [string]::IsNullOrWhiteSpace($id)) { return $id }
+    }
+  }
+  return $BaseAumidConstant
+}
+
+if ($RepairPrimaryAumid) {
+  Write-Host '[repair] Checking primary AutoClaw.lnk AUMID...'
+  Add-AumidType
+  [void](Repair-PrimaryAumid)
+  if ($script:Failed) { Write-Host 'FAILED - see lines above.' -ForegroundColor Red; exit 1 }
+  Write-Host 'SUCCESS - primary shortcut AUMID healthy.' -ForegroundColor Green
+  exit 0
+}
+
+if (-not (Test-Path -LiteralPath $Launcher)) { throw "Launcher not found: $Launcher" }
+# Shortcuts always target the OS-shipped Windows PowerShell 5.1 - the
+# launchers are 5.1-first, and $PSHOME points at pwsh's own directory (no
+# powershell.exe) when this installer itself runs under PowerShell 7.
+$psExe   = Join-Path $env:WINDIR 'System32\WindowsPowerShell\v1.0\powershell.exe'
+if (-not (Test-Path -LiteralPath $psExe)) { throw "Windows PowerShell not found: $psExe" }
+$workDir = Split-Path -Parent $Launcher
+
+if ($Remove) {
+  Write-Host '[1/1] Removing shortcuts...'
+  foreach ($inst in $Instance) {
+    foreach ($t in (Get-ShortcutTargets -ShortcutName $InstanceDefs[$inst].ShortcutName)) {
+      if (Test-Path -LiteralPath $t) {
+        Remove-Item -LiteralPath $t -Force
+        if (Test-Path -LiteralPath $t) {
+          Write-Host "  [FAILED] still exists after delete: $t" -ForegroundColor Red
+          $script:Failed = $true
+        } else {
+          Write-Host "  [ok] removed: $t" -ForegroundColor Green
+        }
+      } else {
+        Write-Host "  [skip] not present: $t"
+      }
+    }
+  }
+  if ($script:Failed) { Write-Host 'FAILED - see lines above.' -ForegroundColor Red; exit 1 }
+  Write-Host 'SUCCESS - shortcuts removed.' -ForegroundColor Green
+  exit 0
+}
+
+Write-Host '[1/3] Resolving paths...'
+$exe = Get-AutoClawExe
+$installed = @{}
+foreach ($inst in $Instance) {
+  $def = $InstanceDefs[$inst]
+  $iconOk = $false
+  $iconLocation = $null
+  # per-clone branding icon first; the AutoClaw.exe icon is the fallback when the
+  # branding dir has not been generated yet (never a set-but-absent icon path).
+  $iconIco = Join-Path $RepoRoot "tools\$($def.BrandingRepo)\tray_icon.ico"
+  if (Test-Path -LiteralPath $iconIco) {
+    $iconOk = $true
+    $iconLocation = "$iconIco,0"
+  } elseif ($exe) {
+    $iconOk = $true
+    $iconLocation = "$exe,0"
+    Write-Host "  [warn] $($def.DisplayName) icon not found: $iconIco - '$($def.ShortcutName)' falls back to the AutoClaw.exe icon (generate with tools\make_clone_icon.ps1)." -ForegroundColor Yellow
+  } else {
+    Write-Host "  [warn] no $($def.DisplayName) icon and AutoClaw.exe not found - '$($def.ShortcutName)' will use the default icon." -ForegroundColor Yellow
+  }
+  $installed[$inst] = @{
+    Def          = $def
+    IconOk       = $iconOk
+    IconLocation = $iconLocation
+    Description  = "Launch an independent AutoClaw $inst clone (own profile, identity, gateway port - $($def.DisplayName.ToLowerInvariant()) icon)"
+    Arguments    = "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File `"$Launcher`" -Instance $inst"
+    Targets      = @(Get-ShortcutTargets -ShortcutName $def.ShortcutName)
+  }
+}
+
+Write-Host '[2/3] Creating shortcuts (verify-after)...'
+$ws = New-Object -ComObject WScript.Shell
+foreach ($inst in $Instance) {
+  $spec = $installed[$inst]
+  Write-Host "  [$inst] $($spec.Def.ShortcutName)"
+  foreach ($t in $spec.Targets) {
+    Write-Host "    -> $t"
+    $sc = $ws.CreateShortcut($t)
+    $sc.TargetPath = $psExe
+    $sc.Arguments = $spec.Arguments
+    $sc.WorkingDirectory = $workDir
+    if ($spec.IconOk) { $sc.IconLocation = $spec.IconLocation }
+    $sc.Description = $spec.Description
+    $sc.Save()
+    if (-not (Test-Path -LiteralPath $t)) {
+      Write-Host "    [FAILED] .lnk not written: $t" -ForegroundColor Red
+      $script:Failed = $true
+      continue
+    }
+    $chk = $ws.CreateShortcut($t)
+    Assert-Value 'TargetPath'       $psExe            $chk.TargetPath
+    Assert-Value 'Arguments'        $spec.Arguments   $chk.Arguments
+    Assert-Value 'WorkingDirectory' $workDir          $chk.WorkingDirectory
+    if ($spec.IconOk) { Assert-Value 'IconLocation' $spec.IconLocation $chk.IconLocation }
+  }
+}
+
+Write-Host '[3/3] Setting AppUserModel.ID for taskbar pin grouping...'
+if ($SkipAumid) {
+  Write-Host '  [skip] -SkipAumid given.'
+} else {
+  Add-AumidType
+  # self-heal first: a collision (AutoClaw.lnk stamped with a clone suffix)
+  # would otherwise poison the base computation below into ...inst1.inst2
+  $base = Repair-PrimaryAumid
+  if ([string]::IsNullOrWhiteSpace($base)) {
+    $base = Get-InstalledAutoClawAumid
+  }
+  foreach ($inst in $Instance) {
+    $spec = $installed[$inst]
+    $expected = "$base.$inst"
+    Write-Host "  [$inst] base AUMID = $base  ->  shortcut AUMID = $expected"
+    foreach ($t in $spec.Targets) {
+      if (-not (Test-Path -LiteralPath $t)) { continue }
+      try {
+        [ShortcutAumid]::Set($t, $expected)
+        Assert-Value 'AppUserModel.ID' $expected (Get-LnkAumid $t)
+      } catch {
+        Write-Host "  [FAILED] AUMID set on $t : $($_.Exception.Message)" -ForegroundColor Red
+        $script:Failed = $true
+      }
+    }
+  }
+  Write-Host '  [note] v1: RUNNING windows all declare the base AUMID (no env override yet),' -ForegroundColor Yellow
+  Write-Host '         so they share one taskbar button; the pins above are still per-clone.' -ForegroundColor Yellow
+}
+
+Write-Host '=== Summary ==='
+if ($script:Failed) {
+  Write-Host 'FAILED - see [FAILED] lines above.' -ForegroundColor Red
+  exit 1
+}
+foreach ($inst in $Instance) {
+  foreach ($t in $installed[$inst].Targets) { Write-Host "  installed: $t" -ForegroundColor Green }
+}
+Write-Host 'SUCCESS - double-click a clone shortcut on the Desktop or find it in the Start menu.' -ForegroundColor Green
+Write-Host 'Remove later with: tools\install_autoclaw_clone_shortcuts.ps1 -Remove'
+exit 0
diff --git a/tools/install_zcode_second_shortcuts.ps1 b/tools/install_zcode_second_shortcuts.ps1
index f656989..4f41327 100644
--- a/tools/install_zcode_second_shortcuts.ps1
+++ b/tools/install_zcode_second_shortcuts.ps1
@@ -292,7 +292,11 @@ if ($RepairPrimaryAumid) {
 }
 
 if (-not (Test-Path -LiteralPath $Launcher)) { throw "Launcher not found: $Launcher" }
-$psExe     = Join-Path $PSHOME 'powershell.exe'
+# Shortcuts always target the OS-shipped Windows PowerShell 5.1 - the
+# launchers are 5.1-first, and $PSHOME points at pwsh's own directory (no
+# powershell.exe) when this installer itself runs under PowerShell 7.
+$psExe     = Join-Path $env:WINDIR 'System32\WindowsPowerShell\v1.0\powershell.exe'
+if (-not (Test-Path -LiteralPath $psExe)) { throw "Windows PowerShell not found: $psExe" }
 $workDir   = Split-Path -Parent $Launcher
 
 # Blue/yellow/green icons ride on the one-time app.asar patch; warn when absent.
diff --git a/tools/make_clone_icon.ps1 b/tools/make_clone_icon.ps1
new file mode 100644
index 0000000..37c6fb1
--- /dev/null
+++ b/tools/make_clone_icon.ps1
@@ -0,0 +1,450 @@
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+  Generate a multi-size Windows icon (tray_icon.ico) + 1024 master (icon_windows.png)
+  for a CLONE-APP branding dir, from a rendered source image (jpg/png).
+
+.DESCRIPTION
+  Generic, app-agnostic companion to tools\make_ghost_icon.ps1 (GHOST's own launcher
+  icon). Intended for the app-cloning playbook section 5 convention: one branding dir
+  per clone color, tools\<appslug>-<color>-branding\, holding tray_icon.ico +
+  icon_windows.png (+ source.<ext> provenance copy of the original render).
+
+  Pipeline: corner-sampled background color -> per-pixel background classification
+  (Euclidean RGB distance vs -BgTolerance) -> row/column background-fraction profiles
+  locate the tile (same LongestLowRun technique as make_ghost_icon.ps1) -> inset crop
+  (-EdgeInsetPercent, drops the soft drop-shadow halo) -> high-quality resample to a
+  1024 canvas -> optional -HueRotate (degrees; for derived clone colors such as a 4th
+  color) -> anti-aliased rounded-corner alpha mask (-CornerRadiusPercent) ->
+  PNG-compressed ICO entries for every size in -Sizes (16..256).
+
+  Re-runs without -Source reuse the saved icon_windows.png when its corners are
+  transparent (already-masked master) - regeneration never depends on Downloads.
+  Feeding one app's saved master with -HueRotate is how a derived color dir is born;
+  the source dir's files are never touched.
+
+  Every write is verified by re-reading (never silent-success). Previews over light
+  and dark backgrounds land in TEMP and their paths are printed - eyeball them
+  before wiring the dir into a shortcuts installer.
+
+  Works on solid-background renders (white, black, gray, colored). -ManualCrop
+  "x,y,size" overrides detection for busy backgrounds.
+
+.EXAMPLE
+  powershell -NoProfile -ExecutionPolicy Bypass -File tools\make_clone_icon.ps1 `
+      -Source "C:\Users\me\Downloads\zcode\autoclaw\blue.jpg" `
+      -OutDir tools\autoclaw-blue-branding
+.EXAMPLE
+  # derived 4th color: hue-rotate the blue master ~+150 deg -> red family
+  powershell -NoProfile -ExecutionPolicy Bypass -File tools\make_clone_icon.ps1 `
+      -Source tools\autoclaw-blue-branding\icon_windows.png `
+      -OutDir tools\autoclaw-red-branding -HueRotate 150
+#>
+param(
+    [string]$Source = "",
+    [Parameter(Mandatory = $true)]
+    [string]$OutDir,
+    [int]$MasterSize = 1024,
+    [double]$EdgeInsetPercent = 1.5,   # crops into the tile to drop the drop-shadow halo
+    [double]$CornerRadiusPercent = 22.0,
+    [double]$BgTolerance = 30.0,       # Euclidean RGB distance still counted as background
+    [double]$HueRotate = 0,            # degrees added to every colored pixel's hue
+    [string]$ManualCrop = "",          # "x,y,size" square tile override, skips detection
+    [int[]]$Sizes = @(16, 24, 32, 48, 64, 128, 256)
+)
+
+$ErrorActionPreference = 'Stop'
+
+Add-Type -AssemblyName System.Drawing
+
+# ---------------------------------------------------------------- C# pixel core
+$cs = @'
+using System;
+using System.Collections.Generic;
+using System.Drawing;
+using System.Drawing.Drawing2D;
+using System.Drawing.Imaging;
+using System.Runtime.InteropServices;
+
+namespace CloneIcon
+{
+    public static class Core
+    {
+        // Median color of four corner patches (2% of the smaller side). Solid-render
+        // backgrounds (white, black, gray, colored) all sample cleanly.
+        public static Color SampleBgColor(Bitmap bmp)
+        {
+            int patch = Math.Max(4, Math.Min(bmp.Width, bmp.Height) * 2 / 100);
+            List<int> rs = new List<int>(), gs = new List<int>(), bs = new List<int>();
+            int[][] corners = new int[][] {
+                new int[] { 0, 0 },
+                new int[] { bmp.Width - patch, 0 },
+                new int[] { 0, bmp.Height - patch },
+                new int[] { bmp.Width - patch, bmp.Height - patch }
+            };
+            BitmapData d = bmp.LockBits(new Rectangle(0, 0, bmp.Width, bmp.Height),
+                ImageLockMode.ReadOnly, PixelFormat.Format24bppRgb);
+            try
+            {
+                int stride = d.Stride;
+                byte[] px = new byte[stride * bmp.Height];
+                Marshal.Copy(d.Scan0, px, 0, px.Length);
+                foreach (int[] c in corners)
+                {
+                    for (int y = 0; y < patch; y++)
+                    {
+                        int imgY = bmp.Height - 1 - c[1] - y;   // memory rows run bottom-up
+                        for (int x = 0; x < patch; x++)
+                        {
+                            int i = imgY * stride + (c[0] + x) * 3;
+                            bs.Add(px[i]); gs.Add(px[i + 1]); rs.Add(px[i + 2]);
+                        }
+                    }
+                }
+            }
+            finally { bmp.UnlockBits(d); }
+            rs.Sort(); gs.Sort(); bs.Sort();
+            int m = rs.Count / 2;
+            return Color.FromArgb(rs[m], gs[m], bs[m]);
+        }
+
+        // Background = Euclidean RGB distance to the sampled color below tolerance.
+        // Row/column background-fraction profiles; the tile is the single long run of
+        // rows (then columns) whose background fraction is low.
+        public static Rectangle DetectTileBounds(Bitmap bmp, Color bg, double tolerance)
+        {
+            int w = bmp.Width, h = bmp.Height;
+            BitmapData d = bmp.LockBits(new Rectangle(0, 0, w, h),
+                ImageLockMode.ReadOnly, PixelFormat.Format24bppRgb);
+            int stride = d.Stride;
+            byte[] px = new byte[stride * h];
+            Marshal.Copy(d.Scan0, px, 0, px.Length);
+            bmp.UnlockBits(d);
+
+            double tol2 = tolerance * tolerance;
+            int[] rowBg = new int[h];
+            int[] colBg = new int[w];
+            for (int y = 0; y < h; y++)
+            {
+                int memRow = y * stride;                 // memory row 0 = bottom image row
+                int imgY = h - 1 - y;
+                for (int x = 0; x < w; x++)
+                {
+                    int i = memRow + x * 3;
+                    int dr = px[i + 2] - bg.R;
+                    int dg = px[i + 1] - bg.G;
+                    int db = px[i] - bg.B;
+                    if (dr * dr + dg * dg + db * db < tol2)
+                    {
+                        rowBg[imgY]++;
+                        colBg[x]++;
+                    }
+                }
+            }
+
+            Rectangle rows = LongestLowRun(rowBg, w, 0.5);
+            Rectangle cols = LongestLowRun(colBg, h, 0.5);
+            return new Rectangle(cols.X, rows.X, cols.Width, rows.Width);
+        }
+
+        // Longest contiguous run of entries with fraction < threshold; entry spans
+        // [X, X+Width) in index space.
+        static Rectangle LongestLowRun(int[] counts, int denominator, double threshold)
+        {
+            int bestStart = -1, bestLen = 0, curStart = -1, curLen = 0;
+            for (int i = 0; i < counts.Length; i++)
+            {
+                bool low = counts[i] < threshold * denominator;
+                if (low)
+                {
+                    if (curStart < 0) { curStart = i; curLen = 1; } else curLen++;
+                    if (curLen > bestLen) { bestLen = curLen; bestStart = curStart; }
+                }
+                else { curStart = -1; curLen = 0; }
+            }
+            if (bestStart < 0) throw new InvalidOperationException(
+                "no low-background run found (background not solid, or -BgTolerance too tight)");
+            return new Rectangle(bestStart, 0, bestLen, 1);
+        }
+
+        static GraphicsPath RoundedRect(RectangleF r, float radius)
+        {
+            GraphicsPath p = new GraphicsPath();
+            float d = radius * 2f;
+            p.AddArc(r.X, r.Y, d, d, 180, 90);
+            p.AddArc(r.Right - d, r.Y, d, d, 270, 90);
+            p.AddArc(r.Right - d, r.Bottom - d, d, d, 0, 90);
+            p.AddArc(r.X, r.Bottom - d, d, d, 90, 90);
+            p.CloseFigure();
+            return p;
+        }
+
+        static void CombineAlpha(Bitmap dst, Bitmap mask)
+        {
+            Rectangle rect = new Rectangle(0, 0, dst.Width, dst.Height);
+            BitmapData dd = dst.LockBits(rect, ImageLockMode.ReadWrite, PixelFormat.Format32bppArgb);
+            BitmapData md = mask.LockBits(rect, ImageLockMode.ReadOnly, PixelFormat.Format32bppArgb);
+            int stride = dd.Stride;
+            byte[] db = new byte[stride * dst.Height];
+            byte[] mb = new byte[md.Stride * mask.Height];
+            Marshal.Copy(dd.Scan0, db, 0, db.Length);
+            Marshal.Copy(md.Scan0, mb, 0, mb.Length);
+            for (int y = 0; y < dst.Height; y++)
+            {
+                int row = y * stride;
+                for (int x = 0; x < dst.Width; x++)
+                    db[row + x * 4 + 3] = mb[y * md.Stride + x * 4 + 3]; // alpha := mask alpha
+            }
+            Marshal.Copy(db, 0, dd.Scan0, db.Length);
+            dst.UnlockBits(dd);
+            mask.UnlockBits(md);
+        }
+
+        // Square crop (bounds; inset percent crops further into the tile to drop the
+        // drop-shadow halo) + resample to masterSize + anti-aliased rounded-corner
+        // alpha mask.
+        public static Bitmap MakeMaster(Bitmap src, Rectangle b, double insetPct,
+            double radiusPct, int masterSize)
+        {
+            int inset = (int)(Math.Min(b.Width, b.Height) * insetPct / 100.0);
+            int side = Math.Min(b.Width, b.Height) - 2 * inset;
+            if (side < 64) throw new InvalidOperationException(
+                "tile crop too small after inset: " + side + "px");
+            int cx = b.X + b.Width / 2, cy = b.Y + b.Height / 2;
+            Rectangle crop = new Rectangle(cx - side / 2, cy - side / 2, side, side);
+            crop.Intersect(new Rectangle(0, 0, src.Width, src.Height));
+
+            Bitmap master = new Bitmap(masterSize, masterSize, PixelFormat.Format32bppArgb);
+            using (Graphics g = Graphics.FromImage(master))
+            {
+                g.InterpolationMode = InterpolationMode.HighQualityBicubic;
+                g.PixelOffsetMode = PixelOffsetMode.HighQuality;
+                g.CompositingQuality = CompositingQuality.HighQuality;
+                g.DrawImage(src, new Rectangle(0, 0, masterSize, masterSize), crop, GraphicsUnit.Pixel);
+            }
+
+            float rad = (float)(masterSize * radiusPct / 100.0);
+            using (GraphicsPath p = RoundedRect(new RectangleF(0, 0, masterSize, masterSize), rad))
+            using (Bitmap mask = new Bitmap(masterSize, masterSize, PixelFormat.Format32bppArgb))
+            {
+                using (Graphics g = Graphics.FromImage(mask))
+                {
+                    g.SmoothingMode = SmoothingMode.AntiAlias;
+                    g.Clear(Color.Transparent);
+                    g.FillPath(Brushes.White, p);
+                }
+                CombineAlpha(master, mask);
+            }
+            return master;
+        }
+
+        // Rotate every pixel's hue by degrees (value + saturation preserved, so the
+        // tile shading survives). Grays (delta < 2) are skipped - black tiles and
+        // white margins are hue-neutral anyway.
+        public static void HueRotate(Bitmap bmp, double degrees)
+        {
+            Rectangle rect = new Rectangle(0, 0, bmp.Width, bmp.Height);
+            BitmapData d = bmp.LockBits(rect, ImageLockMode.ReadWrite, PixelFormat.Format32bppArgb);
+            int stride = d.Stride;
+            byte[] buf = new byte[stride * bmp.Height];
+            Marshal.Copy(d.Scan0, buf, 0, buf.Length);
+            for (int y = 0; y < bmp.Height; y++)
+            {
+                int row = y * stride;
+                for (int x = 0; x < bmp.Width; x++)
+                {
+                    int i = row + x * 4;                     // BGRA
+                    int r = buf[i + 2], g = buf[i + 1], b = buf[i];
+                    int mx = Math.Max(r, Math.Max(g, b)), mn = Math.Min(r, Math.Min(g, b));
+                    if (mx - mn < 2) continue;
+                    double rf = r / 255.0, gf = g / 255.0, bf = b / 255.0;
+                    double max = Math.Max(rf, Math.Max(gf, bf));
+                    double min = Math.Min(rf, Math.Min(gf, bf));
+                    double delta = max - min;
+                    double v = max, s = max <= 0 ? 0 : delta / max;
+                    double h;
+                    if (max == rf) h = 60.0 * (((gf - bf) / delta) % 6);
+                    else if (max == gf) h = 60.0 * (((bf - rf) / delta) + 2);
+                    else h = 60.0 * (((rf - gf) / delta) + 4);
+                    h += degrees; h %= 360; if (h < 0) h += 360;
+                    double c = v * s;
+                    double xx = c * (1 - Math.Abs((h / 60.0) % 2 - 1));
+                    double m = v - c, rr = 0, gg = 0, bb = 0;
+                    if (h < 60) { rr = c; gg = xx; }
+                    else if (h < 120) { rr = xx; gg = c; }
+                    else if (h < 180) { gg = c; bb = xx; }
+                    else if (h < 240) { gg = xx; bb = c; }
+                    else if (h < 300) { rr = xx; bb = c; }
+                    else { rr = c; bb = xx; }
+                    buf[i + 2] = (byte)Math.Round((rr + m) * 255.0);
+                    buf[i + 1] = (byte)Math.Round((gg + m) * 255.0);
+                    buf[i] = (byte)Math.Round((bb + m) * 255.0);
+                }
+            }
+            Marshal.Copy(buf, 0, d.Scan0, buf.Length);
+            bmp.UnlockBits(d);
+        }
+
+        public static bool HasTransparentCorners(Bitmap bmp)
+        {
+            return bmp.GetPixel(2, 2).A == 0
+                && bmp.GetPixel(bmp.Width - 3, 2).A == 0
+                && bmp.GetPixel(2, bmp.Height - 3).A == 0;
+        }
+    }
+}
+'@
+Add-Type -TypeDefinition $cs -ReferencedAssemblies 'System.Drawing' | Out-Null
+
+# ------------------------------------------------------------- resolve outputs
+New-Item -ItemType Directory -Force -Path $OutDir | Out-Null
+$OutDir = (Resolve-Path -LiteralPath $OutDir).Path
+$IcoPath = Join-Path $OutDir 'tray_icon.ico'
+$MasterPngPath = Join-Path $OutDir 'icon_windows.png'
+
+if (-not $Source) {
+    if (Test-Path -LiteralPath $MasterPngPath) { $Source = $MasterPngPath }
+    else { throw "No -Source given and no existing master at $MasterPngPath - pass -Source on first run." }
+}
+if (-not (Test-Path -LiteralPath $Source)) { throw "Source image not found: $Source" }
+
+$srcBytes = [System.IO.File]::ReadAllBytes($Source)
+$srcStream = New-Object System.IO.MemoryStream (, $srcBytes)
+$src = [System.Drawing.Bitmap]::FromStream($srcStream)
+Write-Host ("[1/5] Loaded source: {0} ({1}x{2})" -f $Source, $src.Width, $src.Height)
+
+# ---------------------------------------------------- master (detect/crop/mask)
+$freshMaster = $false
+$master = $null
+if ($src.Width -eq $src.Height -and [CloneIcon.Core]::HasTransparentCorners($src)) {
+    Write-Host '[2/5] Source is already a masked master (transparent corners) - using as-is.'
+    $master = $src
+}
+else {
+    if ($ManualCrop) {
+        $parts = $ManualCrop.Split(',')
+        if ($parts.Length -ne 3) { throw "-ManualCrop must be 'x,y,size' (square tile)" }
+        $mx = [int]$parts[0]; $my = [int]$parts[1]; $msz = [int]$parts[2]
+        Write-Host ("[2/5] Manual crop: x={0} y={1} size={2}" -f $mx, $my, $msz)
+        $bounds = New-Object System.Drawing.Rectangle ($mx), ($my), ($msz), ($msz)
+        $master = [CloneIcon.Core]::MakeMaster($src, $bounds, 0.0, $CornerRadiusPercent, $MasterSize)
+    }
+    else {
+        $bg = [CloneIcon.Core]::SampleBgColor($src)
+        Write-Host ("[2/5] Background sampled: R={0} G={1} B={2} (tolerance {3})" -f $bg.R, $bg.G, $bg.B, $BgTolerance)
+        try {
+            $bounds = [CloneIcon.Core]::DetectTileBounds($src, $bg, $BgTolerance)
+        } catch {
+            throw ("Tile detection failed: {0} - pass -ManualCrop 'x,y,size' or adjust -BgTolerance." -f $_.Exception.Message)
+        }
+        Write-Host ("      tile bounds: x={0} y={1} w={2} h={3} ({4}% of width)" -f `
+            $bounds.X, $bounds.Y, $bounds.Width, $bounds.Height, [int]($bounds.Width * 100.0 / $src.Width))
+        $master = [CloneIcon.Core]::MakeMaster($src, $bounds, $EdgeInsetPercent, $CornerRadiusPercent, $MasterSize)
+    }
+    $freshMaster = $true
+}
+
+if ($HueRotate -ne 0) {
+    Write-Host ("      hue rotate: +{0} degrees" -f $HueRotate)
+    [CloneIcon.Core]::HueRotate($master, $HueRotate)
+}
+
+if ($freshMaster -or $HueRotate -ne 0) {
+    # save whenever the in-memory master is new OR was recolored, so a derived-color
+    # dir becomes self-contained (its own re-runs reuse the derived master)
+    $master.Save($MasterPngPath, [System.Drawing.Imaging.ImageFormat]::Png)
+    if (-not (Test-Path -LiteralPath $MasterPngPath)) { throw 'FAILED: master PNG was not written' }
+    Write-Host ("      [ok] master saved: {0} ({1} KB)" -f $MasterPngPath, ([int]((Get-Item $MasterPngPath).Length / 1KB)))
+    if ($freshMaster) {
+        # provenance copy of the original render (derived-color runs reuse a master and skip this)
+        $provDst = Join-Path $OutDir ("source" + [System.IO.Path]::GetExtension($Source).ToLowerInvariant())
+        Copy-Item -LiteralPath $Source -Destination $provDst -Force
+        if (-not (Test-Path -LiteralPath $provDst)) { throw "FAILED: provenance copy was not written: $provDst" }
+    }
+}
+
+# ------------------------------------------------------------- per-size renders
+Write-Host '[3/5] Rendering ICO size entries...'
+function Convert-MasterToPngBytes {
+    param([System.Drawing.Bitmap]$M, [int]$S)
+    $out = New-Object System.Drawing.Bitmap ($S), ($S)
+    try {
+        $g = [System.Drawing.Graphics]::FromImage($out)
+        $g.InterpolationMode = [System.Drawing.Drawing2D.InterpolationMode]::HighQualityBicubic
+        $g.SmoothingMode = [System.Drawing.Drawing2D.SmoothingMode]::HighQuality
+        $g.PixelOffsetMode = [System.Drawing.Drawing2D.PixelOffsetMode]::HighQuality
+        $g.DrawImage($M, 0, 0, $S, $S)
+        $g.Dispose()
+        $ms = New-Object System.IO.MemoryStream
+        $out.Save($ms, [System.Drawing.Imaging.ImageFormat]::Png)
+        return ,$ms.ToArray()
+    }
+    finally { $out.Dispose() }
+}
+
+# --------------------------------------------------------------- write the .ico
+Write-Host '[4/5] Writing ICO container...'
+$sorted = @($Sizes | Sort-Object)
+$pngs = @()
+foreach ($s in $sorted) { $pngs += ,(Convert-MasterToPngBytes -M $master -S $s) }
+
+$icoMs = New-Object System.IO.MemoryStream
+$bw = New-Object System.IO.BinaryWriter($icoMs)
+$bw.Write([uint16]0)                      # reserved
+$bw.Write([uint16]1)                      # type: icon
+$bw.Write([uint16]$sorted.Count)          # image count
+$offset = 6 + 16 * $sorted.Count
+for ($i = 0; $i -lt $sorted.Count; $i++) {
+    $s = $sorted[$i]
+    $dim = $(if ($s -ge 256) { 0 } else { $s })   # 0 encodes 256 in ICO directory
+    $bw.Write([byte]$dim); $bw.Write([byte]$dim)
+    $bw.Write([byte]0); $bw.Write([byte]0)        # palette, reserved
+    $bw.Write([uint16]1); $bw.Write([uint16]32)   # planes, bpp
+    $bw.Write([uint32]$pngs[$i].Length)
+    $bw.Write([uint32]$offset)
+    $offset += $pngs[$i].Length
+}
+foreach ($p in $pngs) { $bw.Write($p) }
+$bw.Flush()
+[System.IO.File]::WriteAllBytes($IcoPath, $icoMs.ToArray())
+$bw.Dispose(); $icoMs.Dispose()
+
+# ------------------------------------------------------------------- verify-after
+Write-Host '[5/5] Verifying outputs...'
+if (-not (Test-Path -LiteralPath $IcoPath)) { throw 'FAILED: tray_icon.ico was not written' }
+$check = [System.IO.File]::ReadAllBytes($IcoPath)
+if ($check.Length -lt 6) { throw 'FAILED: tray_icon.ico is truncated' }
+$vType = [BitConverter]::ToUInt16($check, 2)
+$vCount = [BitConverter]::ToUInt16($check, 4)
+if ($vType -ne 1 -or $vCount -ne $sorted.Count) {
+    throw ("FAILED: ico header mismatch (type={0}, count={1}, expected count={2})" -f $vType, $vCount, $sorted.Count)
+}
+$total = 0
+for ($i = 0; $i -lt $vCount; $i++) {
+    $len = [BitConverter]::ToUInt32($check, 6 + 16 * $i + 8)
+    $off = [BitConverter]::ToUInt32($check, 6 + 16 * $i + 12)
+    if ($off + $len -gt $check.Length) { throw ("FAILED: ico entry {0} overruns file" -f $i) }
+    $total += $len
+}
+Write-Host ("      [ok] {0} ({1} KB, {2} images: {3}, {4} KB image data)" -f `
+    $IcoPath, [int]($check.Length / 1KB), $vCount, ($sorted -join '/'), [int]($total / 1KB))
+
+# previews over light + dark backgrounds so corner masking is checkable at a glance
+$stamp = Get-Date -Format 'yyyyMMdd_HHmmss'
+$tag = Split-Path -Leaf $OutDir
+foreach ($bgName in @('light', 'dark')) {
+    $bgColor = $(if ($bgName -eq 'light') { [System.Drawing.Color]::White } else { [System.Drawing.Color]::FromArgb(32, 32, 32) })
+    $prev = New-Object System.Drawing.Bitmap (256), (256)
+    $g = [System.Drawing.Graphics]::FromImage($prev)
+    $g.Clear($bgColor)
+    $g.DrawImage($master, 0, 0, 256, 256)
+    $g.Dispose()
+    $prevPath = Join-Path $env:TEMP ("clone_icon_preview_{0}_{1}_{2}.png" -f $tag, $bgName, $stamp)
+    $prev.Save($prevPath, [System.Drawing.Imaging.ImageFormat]::Png)
+    $prev.Dispose()
+    Write-Host ("      preview ({0}): {1}" -f $bgName, $prevPath)
+}
+
+if ($master -ne $src) { $master.Dispose() }
+$src.Dispose(); $srcStream.Dispose()
+Write-Host 'DONE'
diff --git a/tools/new_clone_suite.ps1 b/tools/new_clone_suite.ps1
new file mode 100644
index 0000000..4b974ff
--- /dev/null
+++ b/tools/new_clone_suite.ps1
@@ -0,0 +1,706 @@
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+  Scaffold a new app multi-instance clone suite (docs/APP_CLONING_PLAYBOOK.md,
+  Phases 3-10 mechanics).
+
+.DESCRIPTION
+  Takes the intake answers (JSON file or interactive prompts) and emits the
+  mechanical scaffolding a clone suite needs, wired the way the ZCode
+  (gold standard) and AutoClaw suites taught us:
+
+    src/windows/reset_<slug>.ps1                   reset manifest (identity suite skeleton)
+    src/windows/launch_<slug>_clone.ps1            per-clone launcher skeleton
+    src/windows/Launch-<Pascal>-Clone.bat          double-click wrapper
+    tools/install_<slug>_clone_shortcuts.ps1       AUMID shortcuts + branding + -RepairPrimaryAumid
+    docs/<SLUG>_CLONES_SPEC.md                     spec stub (phase checklist)
+    GHOST.bat                                      new submenu + resolver + DispatchOne gids
+
+  Phases 0-2 (intake decisions, discovery on the INSTALLED app, isolation
+  design) stay with the agent per the playbook's automation contract - the
+  emitted skeletons carry marked <TODO: Phase 1 discovery> slots for exactly
+  those findings. Every emitted .ps1 is parse-checked before the tool claims
+  success (never silent-success); GHOST.bat is backed up, edited by anchor,
+  and re-verified after.
+
+  Acceptance for the tool itself: a generated demo suite must pass the full
+  gate (parse-check + Pester repo-integrity + .bat harness), then be removed.
+
+.PARAMETER Intake
+  Path to an intake JSON (schema in the EXAMPLES block). Omit for interactive
+  prompts with the documented defaults.
+
+.PARAMETER DryRun
+  Print what would be generated and exit; write nothing.
+
+.EXAMPLE
+  tools\new_clone_suite.ps1 -Intake myapp-intake.json
+  tools\new_clone_suite.ps1 -DryRun
+
+.EXAMPLE intake JSON
+  {
+    "slug": "myapp",
+    "displayName": "MyApp",
+    "instanceCount": 4,
+    "colors": ["#066BCB", "#D4AA10", "#13826A", "#C43E3E"],
+    "exePath": "",
+    "elevatesItself": false,
+    "isolation": "homeMarker",
+    "preferredPort": 18790
+  }
+#>
+param(
+  [string]$Intake,
+  [switch]$DryRun
+)
+
+$ErrorActionPreference = 'Stop'
+
+function Write-Utf8Crlf {
+  # Repo rule: PS/cmd files are CRLF on disk (the Write-tool emits LF and cmd
+  # breaks); UTF-8 without BOM (skeletons are ASCII).
+  param([string]$Path, [string]$Content)
+  $norm = $Content -replace "`r`n", "`n"
+  $norm = $norm -replace "`n", "`r`n"
+  [System.IO.File]::WriteAllText($Path, $norm, (New-Object System.Text.UTF8Encoding($false)))
+}
+
+function ConvertTo-HashtableDeep {
+  # PSCustomObject is detected by TYPE NAME, never by -is [pscustomobject]:
+  # in PS 5.1 that check misfires inside ForEach-Object scriptblocks (a plain
+  # string element matched and its Length property leaked through as the
+  # converted value - verified empirically before this fix). Elements are
+  # collected via List, not pipeline, so nested arrays never unroll.
+  param($Obj)
+  if ($null -eq $Obj) { return $null }
+  if ($Obj -is [System.Collections.IDictionary]) {
+    $h = @{}
+    foreach ($k in @($Obj.Keys)) { $h[$k] = ConvertTo-HashtableDeep $Obj[$k] }
+    return $h
+  }
+  if ($Obj -is [System.Collections.IEnumerable] -and -not ($Obj -is [string])) {
+    $list = New-Object System.Collections.Generic.List[object]
+    foreach ($el in $Obj) { [void]$list.Add((ConvertTo-HashtableDeep $el)) }
+    return ,$list.ToArray()
+  }
+  if ($Obj.GetType().Name -eq 'PSCustomObject') {
+    $h = @{}
+    foreach ($p in $Obj.PSObject.Properties) { $h[$p.Name] = ConvertTo-HashtableDeep $p.Value }
+    return $h
+  }
+  return $Obj
+}
+
+function New-Intake {
+  # Developer values or documented defaults (playbook §3); every default is
+  # reported in the final summary.
+  $it = @{
+    slug           = ''
+    displayName    = ''
+    instanceCount  = 4
+    colors         = @('#066BCB', '#D4AA10', '#13826A', '#C43E3E')
+    exePath        = ''
+    elevatesItself = $false
+    isolation      = 'homeMarker'
+    preferredPort  = 18790
+  }
+  if ($Intake) {
+    if (-not (Test-Path -LiteralPath $Intake)) { throw "Intake file not found: $Intake" }
+    $loaded = ConvertTo-HashtableDeep (Get-Content -LiteralPath $Intake -Raw | ConvertFrom-Json)
+    foreach ($k in @($it.Keys)) { if ($loaded.ContainsKey($k) -and $null -ne $loaded[$k]) { $it[$k] = $loaded[$k] } }
+    Write-Host "[intake] loaded from $Intake"
+  }
+  else {
+    $slugIn = Read-Host "App slug (lowercase, file-safe) [required]"
+    if ($slugIn) { $it.slug = $slugIn.Trim() }
+    $nameIn = Read-Host "Display name (blank = slug)"
+    if ($nameIn) { $it.displayName = $nameIn.Trim() }
+    $cntIn = Read-Host "Instance count incl. Primary [4]"
+    if ($cntIn -match '^\d+$') { $it.instanceCount = [int]$cntIn }
+    $exeIn = Read-Host "Installed exe path (blank = TODO auto-detect)"
+    if ($exeIn) { $it.exePath = $exeIn.Trim() }
+    $elIn = Read-Host "App self-elevates (requireAdministrator manifest)? y/N"
+    if ($elIn -match '^[Yy]') { $it.elevatesItself = $true }
+    Write-Host "[intake] interactive; all other values = documented defaults (reported below)"
+  }
+  if (-not $it.slug) { throw "slug is required" }
+  if ($it.slug -notmatch '^[a-z][a-z0-9]{2,20}$') { throw "slug '$($it.slug)' must be lowercase alnum, 3-21 chars, letter first" }
+  $reserved = @('zcode', 'autoclaw', 'cursor', 'devin', 'windsurf', 'trae', 'qoder', 'qoderwork', 'minimax', 'opencode', 'ghost')
+  if ($reserved -contains $it.slug) { throw "slug '$($it.slug)' collides with an existing suite" }
+  if (-not $it.displayName) { $it.displayName = $it.slug.Substring(0, 1).ToUpperInvariant() + $it.slug.Substring(1) }
+  if ($it.isolation -notin @('homeMarker', 'env')) { throw "isolation must be 'homeMarker' or 'env'" }
+  if ($it.instanceCount -lt 2 -or $it.instanceCount -gt 6) { throw "instanceCount must be 2..6" }
+  while ($it.colors.Count -lt ($it.instanceCount - 1)) { $it.colors += '#808080' }
+  return $it
+}
+
+function Get-PascalSlug([string]$Slug) {
+  return ($Slug -split '-' | ForEach-Object { $_.Substring(0, 1).ToUpperInvariant() + $_.Substring(1) }) -join ''
+}
+
+# ---------------------------------------------------------------------------
+# Skeleton templates. Single-quoted here-strings (no PS expansion); __TOKENS__
+# replaced below. Each skeleton encodes the suite invariants: verify-after
+# everywhere, backup-first, independent identity per child, sequential
+# non-elevated launches, marker-guarded one-time work - with <TODO: Phase 1
+# discovery> slots where only the installed app knows the answer.
+# ---------------------------------------------------------------------------
+
+$ResetT = @'
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+  __DISPLAYNAME__ identity reset (clone suite generated by new_clone_suite.ps1).
+.DESCRIPTION
+  Thin target manifest per the GHOST convention: dot-source the shared
+  identity library, assert admin, stop the app, rotate identities with
+  verify-after, audit, emit a restore script, summarize.
+  <TODO: Phase 1 discovery> fill the per-target store paths and step list
+  from the INSTALLED app (playbook Phase 1) - never guess a path.
+.PARAMETER Target
+  Primary | inst1..instN | All (clones first, Primary last).
+.PARAMETER DryRun
+  Print every action, write nothing.
+#>
+param(
+  [ValidateSet('Primary', '__INSTPARAMS__', 'All')]
+  [string]$Target = 'Primary',
+  [switch]$DryRun
+)
+
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'identity_utils.ps1')
+
+$AppDisplayName = '__DISPLAYNAME__'
+$ExeCandidates  = @(
+  '<TODO: Phase 1 discovery - installed exe path>'
+)
+$AppDataDirs    = @('<TODO: Phase 1 discovery - roaming store dirs>')
+$HomeStores     = @('<TODO: Phase 1 discovery - ~\.app store paths>')
+$Processes      = @('__PASCAL__')
+$TotalSteps     = 7
+
+Assert-Administrator
+
+function Stop-__Pascal__ProcessesAggressive {
+  for ($attempt = 1; $attempt -le 5; $attempt++) {
+    $left = @(Get-Process -Name $Processes -ErrorAction SilentlyContinue)
+    if ($left.Count -eq 0) { return }
+    $left | Stop-Process -Force -ErrorAction SilentlyContinue
+    Start-Sleep -Seconds 2
+  }
+  if (@(Get-Process -Name $Processes -ErrorAction SilentlyContinue).Count -gt 0) {
+    Write-Host "  [FAILED] $AppDisplayName processes still running - close them and re-run." -ForegroundColor Red
+    exit 1
+  }
+}
+
+function Get-TargetOrder([string]$T) {
+  # All = clones first, Primary last (independent identity per child; the
+  # Primary's steps run with the most complete step set).
+  $clones = 1..(__COUNT__ - 1) | ForEach-Object { "inst$_" }
+  if ($T -eq 'All') { return @($clones) + @('Primary') }
+  return @($T)
+}
+
+Write-Host "=== $AppDisplayName identity reset ==="
+if ($DryRun) { Write-Host 'Mode: DRY-RUN (no writes)' -ForegroundColor Yellow }
+
+foreach ($tgt in (Get-TargetOrder $Target)) {
+  Write-Host "`n--- target: $tgt ---"
+  Stop-__Pascal__ProcessesAggressive
+
+  $ids = New-IdentitySet
+  Write-Host ("  [1/$TotalSteps] new identity set: devDeviceId={0}" -f $ids.devDeviceId.Substring(0, 8) + '...')
+
+  # <TODO: Phase 1 discovery> replace the generic steps below with the
+  # app's real identity stores. The shared helpers handle verify-after and
+  # audit for you; never write a store without re-reading it.
+  foreach ($dir in $AppDataDirs) {
+    $store = Join-Path $env:APPDATA $dir
+    if (-not (Test-Path -LiteralPath $store)) { continue }
+    Write-Host ("  [2/$TotalSteps] <TODO> patch JSON identity stores under {0}" -f $store)
+    # Example (uncomment + adjust after discovery):
+    # Backup-FileToTimestampDir -Path (Join-Path $store 'storage.json') -Label "reset-$tgt"
+    # Set-JsonIdentity -FilePath (Join-Path $store 'storage.json') -Identity $ids -DryRun:$DryRun
+  }
+  Write-Host ("  [3/$TotalSteps] <TODO> SQLite identity rows (Set-SqliteKeys handles Python probing + verify-after)")
+  Write-Host ("  [4/$TotalSteps] <TODO> binary identity stores (Clear-BinaryIdentityStore: rename/delete, clobber old .backup)")
+  Write-Host ("  [5/$TotalSteps] <TODO> caches/logs/sentry/crashpad sweep")
+  if ($tgt -eq 'Primary') {
+    Write-Host ("  [6/$TotalSteps] <TODO> system-level steps (registry deviceid, SQM, MAC, hostname) - Primary only, follow reset_qoder.ps1")
+  }
+  else {
+    Write-Host ("  [6/$TotalSteps] clones get INDEPENDENT identity - never share the ID set across targets")
+  }
+  Write-Host ("  [7/$TotalSteps] restore script + audit log (New-RestoreScript / Write-AuditLog) <TODO>")
+}
+
+Write-Host "`nDone. Re-run after app updates that rewrite identity stores."
+'@
+
+$LaunchT = @'
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+  __DISPLAYNAME__ multi-instance clone launcher (generated by new_clone_suite.ps1).
+.DESCRIPTION
+  Isolation model: __ISOLATIONDOC__
+  Elevation model: __ELEVATIONDOC__
+  <TODO: Phase 1/2 discovery> fill the seed excludes, port levers and
+  verify-after-launch checks from the INSTALLED app - never guess.
+.PARAMETER Instance
+  inst1..instN.
+.PARAMETER Status
+  Read the recorded instance state (ports, pids) and exit.
+#>
+param(
+  [ValidateSet('__INSTPARAMS__')]
+  [string]$Instance = 'inst1',
+  [switch]$Status
+)
+
+$ErrorActionPreference = 'Stop'
+
+$AppDisplayName = '__DISPLAYNAME__'
+$ExePath        = '<TODO: Phase 1 discovery - installed exe path>'
+$BasePort       = __PORT__
+$CloneRoot      = Join-Path $env:USERPROFILE '__PASCAL__CloneHome'
+$CloneHome      = Join-Path $CloneRoot $Instance      # USERPROFILE/HOME levers (gateway state)
+$CloneProfile   = Join-Path $CloneHome 'profile'      # --user-data-dir (this app honours it? TODO Phase 1)
+$CloneTmp       = Join-Path $CloneHome 'tmp'
+$SeedMarker     = Join-Path $CloneHome '.seeded'
+$RecordPath     = Join-Path $CloneHome 'instance-record.json'
+
+function Get-CloneSubtreePids {
+  # Classify by PROCESS MARKERS, never window titles (splash-phase lesson).
+  param([string[]]$Markers)
+  $all = @(Get-CimInstance Win32_Process -ErrorAction SilentlyContinue -OperationTimeoutSec 5)
+  $hits = @()
+  foreach ($p in $all) {
+    foreach ($m in $Markers) {
+      if ($p.CommandLine -and $p.CommandLine.Contains($m)) { $hits += [int]$p.ProcessId; break }
+    }
+  }
+  return @($hits | Select-Object -Unique)
+}
+
+if ($Status) {
+  if (Test-Path -LiteralPath $RecordPath) {
+    Get-Content -LiteralPath $RecordPath -Raw
+  }
+  else {
+    Write-Host "no instance-record.json for $Instance - never launched, or a pre-record version"
+    exit 1
+  }
+  exit 0
+}
+
+if (-not (Test-Path -LiteralPath $ExePath)) {
+  Write-Host "[FAILED] $AppDisplayName exe not found: $ExePath (fix `$ExePath after Phase 1 discovery)" -ForegroundColor Red
+  exit 1
+}
+
+# 1) Directories
+foreach ($d in @($CloneHome, $CloneProfile, $CloneTmp)) {
+  New-Item -ItemType Directory -Path $d -Force | Out-Null
+}
+
+# 2) First-run seed: copy the Primary profile EXCLUDING every credential
+#    store (one credential = one instance; ONE manual login per clone).
+#    <TODO: Phase 1 discovery> the real exclusion list (token caches, keypair
+#    stores, paired-device files) and whether the Primary must be CLOSED for
+#    the copy (locked Chromium stores abort robocopy - AutoClaw lesson).
+if (-not (Test-Path -LiteralPath $SeedMarker)) {
+  Write-Host '[seed] first run - seeding the clone profile (credential-free)'
+  # robocopy "<primaryProfile>" "$CloneProfile" /E /XF <credential stores>
+  # verify-after the excludes, THEN write the marker only on verified success.
+  Write-Host '  <TODO: Phase 1 discovery - seed sources + excludes, marker after verified scrub>' -ForegroundColor Yellow
+  # Placeholder marker write so re-runs skip; REMOVE once the real seed lands.
+  Write-Host '[seed] skeleton mode: writing marker without a real seed' -ForegroundColor Yellow
+  Set-Content -LiteralPath $SeedMarker -Value 'skeleton'
+}
+
+# 3) Isolation levers + launch. Launch SEQUENTIALLY, never in parallel, and
+#    __ELEVATIONRULE__
+# <TODO: Phase 2 design> port lever (env var survives? settings.json? marker
+# file read by an asar patch - the AutoClaw home-override pattern) recorded
+# to instance-record.json with the DISCOVERED ports, never the requested one.
+Write-Host ("[launch] {0} (skeleton - wire the real levers after discovery)" -f $Instance) -ForegroundColor Yellow
+$env:TEMP = $CloneTmp
+$env:TMP  = $CloneTmp
+# cmd /c start "" "<exe>" <args>   <- detached launch; a GUI app that calls
+# AttachConsole hijacks the launching console if started inline (GHOST rule).
+
+# 4) Verify-after-launch: subtree stable, ports on DISCOVERED values,
+#    credential stores hold only this clone's identity.
+Write-Host '  <TODO: Phase 1 discovery - verify-after-launch checks>' -ForegroundColor Yellow
+Write-Host "[done] $Instance launcher skeleton finished - wire the TODOs before real use."
+'@
+
+$WrapperT = @'
+@echo off
+rem Double-click wrapper for the __DISPLAYNAME__ clone launcher (generated).
+rem The launcher opens in its own window and closes when done.
+setlocal
+set "SCRIPT_DIR=%~dp0"
+powershell -NoProfile -ExecutionPolicy Bypass -File "%SCRIPT_DIR%launch___SLUG___clone.ps1" %*
+if errorlevel 1 (
+    echo.
+    echo Launcher reported a failure - read the messages above.
+    pause
+)
+'@
+
+$ShortcutsT = @'
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+  Per-clone Desktop + Start-menu shortcuts for __DISPLAYNAME__ (generated).
+.DESCRIPTION
+  AUMIDs <base>.inst1..N for pin grouping, per-clone IconLocation under
+  tools\<slug>-<color>-branding\tray_icon.ico (missing dir = exe icon
+  fallback + warn - never silent), -Remove to uninstall, -RepairPrimaryAumid
+  to strip a hijacked Primary .lnk (clone pins rewrite it - the ZCode and
+  AutoClaw suites both hit this).
+.PARAMETER Instance
+  Restrict to one clone slot; default all.
+.PARAMETER Remove
+  Uninstall the shortcuts.
+.PARAMETER RepairPrimaryAumid
+  Restore the Primary shortcut's AUMID + icon, exit.
+#>
+param(
+  [string[]]$Instance = @('__INSTPARAMS__'),
+  [switch]$Remove,
+  [switch]$RepairPrimaryAumid
+)
+
+$ErrorActionPreference = 'Stop'
+$RepoRoot    = (Resolve-Path -LiteralPath (Split-Path -Parent $PSScriptRoot)).Path
+$Slug        = '__SLUG__'
+$DisplayName = '__DISPLAYNAME__'
+$PrimaryLnkName = '<TODO: the Primary shortcut .lnk filename>'
+$AumidBase   = 'com.<vendor>.<app>'   # <TODO: Phase 1 discovery - the app's AUMID, or mint one>
+
+$InstanceDefs = @{
+__INSTDEFS__
+}
+
+# Shortcuts always target the OS-shipped Windows PowerShell 5.1 (the
+# launchers are 5.1-first; $PSHOME breaks under pwsh - 2026-10-17 fix).
+$psExe = Join-Path $env:WINDIR 'System32\WindowsPowerShell\v1.0\powershell.exe'
+if (-not (Test-Path -LiteralPath $psExe)) { throw "Windows PowerShell not found: $psExe" }
+
+function Get-ShortcutTargets([string]$ShortcutName) {
+  # Desktop + the two Start-menu roots; returns existing .lnk full paths.
+  $found = @()
+  $roots = @(
+    [Environment]::GetFolderPath('DesktopDirectory'),
+    (Join-Path $env:APPDATA 'Microsoft\Windows\Start Menu\Programs'),
+    (Join-Path $env:ProgramData 'Microsoft\Windows\Start Menu\Programs')
+  )
+  foreach ($r in $roots) {
+    $p = Join-Path $r $ShortcutName
+    if (Test-Path -LiteralPath $p) { $found += $p }
+  }
+  return $found
+}
+
+if ($RepairPrimaryAumid) {
+  Write-Host '[repair] restoring the Primary shortcut AUMID + icon (TODO wire after discovery)'
+  # Port from tools\install_zcode_second_shortcuts.ps1 (Shell.Application
+  # ExtendedProperty reads ONLY - never whole-file UTF-16 regex, it misreads).
+  exit 0
+}
+
+$wsh = New-Object -ComObject WScript.Shell
+$failed = $false
+foreach ($name in $Instance) {
+  $def = $InstanceDefs[$name]
+  $icon = Join-Path $RepoRoot ("tools\{0}-{1}-branding\tray_icon.ico" -f $Slug, $def.Color)
+  if (-not (Test-Path -LiteralPath $icon)) {
+    Write-Host ("  [warn] no branding icon for {0} - exe icon fallback: {1}" -f $name, $icon) -ForegroundColor Yellow
+    $icon = ''
+  }
+  foreach ($t in @(Get-ShortcutTargets $def.LnkName)) {
+    Remove-Item -LiteralPath $t -Force -ErrorAction SilentlyContinue
+  }
+  if ($Remove) { Write-Host ("  [ok] removed: {0}" -f $def.LnkName); continue }
+  foreach ($root in @([Environment]::GetFolderPath('DesktopDirectory'), (Join-Path $env:APPDATA 'Microsoft\Windows\Start Menu\Programs'))) {
+    $lnk = $wsh.CreateShortcut((Join-Path $root $def.LnkName))
+    $lnk.TargetPath       = $psExe
+    $lnk.Arguments        = ("-NoProfile -ExecutionPolicy Bypass -File `"$RepoRoot\src\windows\launch___SLUG___clone.ps1`" -Instance $name")
+    $lnk.WorkingDirectory = Join-Path $RepoRoot 'src\windows'
+    if ($icon) { $lnk.IconLocation = "$icon,0" }
+    $lnk.SetAppUserModelId($def.Aumid)
+    $lnk.Save()
+    # verify-after
+    $chk = $wsh.CreateShortcut((Join-Path $root $def.LnkName))
+    if ($chk.TargetPath -ne $psExe) { Write-Host "  [FAILED] target verify: $root\$($def.LnkName)" -ForegroundColor Red; $failed = $true }
+    else { Write-Host ("  [ok] {0} -> {1} (aumid {2})" -f $def.LnkName, $name, $def.Aumid) }
+  }
+}
+if ($failed) { Write-Host 'FAILED - see lines above.' -ForegroundColor Red; exit 1 }
+Write-Host 'SUCCESS.'
+'@
+
+$SpecT = @'
+# __DISPLAYNAME__ Multi-Instance Clones — Spec (STUB)
+
+> Generated by `tools/new_clone_suite.ps1` on __DATE__ as the Phase 3-10
+> scaffold. Phases 0-2 below are the agent's discovery work (playbook:
+> read the INSTALLED app, never guess); every <TODO> in the emitted
+> scripts maps to one row here. Promote STUB -> IMPLEMENTED when all rows
+> carry a verified answer + provenance section.
+
+## Ground truth to fill (Phase 1-2)
+
+| # | Question | Answer | Provenance |
+|---|----------|--------|------------|
+| 1 | Installed exe path + version | | |
+| 2 | Identity stores (JSON/SQLite/binary/registry) | | |
+| 3 | Credential stores EXCLUDED from the seed (one credential = one instance) | | |
+| 4 | Isolation levers that actually work (env vs --user-data-dir vs marker file) | | |
+| 5 | Self-elevation? (__ELEVATIONSHORT__) — survives env levers? | | |
+| 6 | Port lever + drift behavior | | |
+| 7 | AUMID / taskbar identity behavior | | |
+| 8 | Asar patchable (Electron fuses, integrity validation)? | | |
+| 9 | Seed requires the Primary closed? (lockfile probe) | | |
+| 10 | Single-instance lock key | | |
+
+## Emitted files
+
+- `src/windows/reset___SLUG__.ps1` — reset manifest (TODO-driven)
+- `src/windows/launch___SLUG___clone.ps1` — clone launcher
+- `src/windows/Launch-__PASCAL__-Clone.bat` — double-click wrapper
+- `tools/install___SLUG___clone_shortcuts.ps1` — AUMID shortcuts + branding
+- GHOST.bat — submenu [__SUBMENU_ID__] (gids __GIDBASE__+)
+
+## Open phase checklist
+
+- [ ] Phase 0 intake recorded (this file + the intake JSON committed)
+- [ ] Phase 1 discovery rows answered with provenance
+- [ ] Phase 2 isolation design decided
+- [ ] Phase 3 reset script live-verified per target
+- [ ] Phase 4 launcher seed + verify-after-launch live-verified
+- [ ] Phase 5 branding (developer icons or improvise+report)
+- [ ] Phase 6 app patch (if needed)
+- [ ] Phase 7 shortcuts verified
+- [ ] Phase 8 taskbar identity verified
+- [ ] Phase 9 GHOST.bat submenu verified via the harness
+- [ ] Phase 10 tests + docs + governance
+'@
+
+# ---------------------------------------------------------------------------
+# GHOST.bat surgery
+# ---------------------------------------------------------------------------
+
+function Edit-GhostMenu {
+  param([hashtable]$It, [string]$Slug, [string]$Pascal, [int]$SubmenuId, [int]$GidBase, [int]$CloneCount)
+  $batPath = Join-Path $PSScriptRoot '..\GHOST.bat'
+  $batPath = [System.IO.Path]::GetFullPath($batPath)
+  $bat = [System.IO.File]::ReadAllText($batPath)
+
+  if ($bat.Contains(":$($Pascal)One")) { throw "GHOST.bat already wires a $Pascal suite - refusing to double-edit" }
+
+  # Anchor 1: main-menu dispatch - insert the submenu jump after the [4] block.
+  $anchor4 = "if `"%first%`"==`"4`" ("
+  $idx = $bat.IndexOf($anchor4)
+  if ($idx -lt 0) { throw 'GHOST.bat anchor missing: main-menu [4] dispatch block' }
+  $closeIdx = $bat.IndexOf(")`r`n", $idx)
+  if ($closeIdx -lt 0) { throw 'GHOST.bat anchor missing: main-menu [4] block close paren' }
+  $insertAt = $closeIdx + 3   # ")" CRLF = 3 chars: cut the \n and the edit dies mid-line
+  $dispatch = "if `"%first%`"==`"$SubmenuId`" (`r`n    set `"PENDING_CHAIN=%rest%`"`r`n    goto $Pascal`r`n)`r`n"
+  $bat = $bat.Substring(0, $insertAt) + $dispatch + $bat.Substring($insertAt)
+
+  # Anchor 2: main-menu render - insert the colored entry after the [4] line
+  # (the [2]/[3]/[4] entries render via the if-defined-ESC form, not :Opt).
+  $render4 = 'if defined ESC (echo %ESC%[92m[ 4] %ESC%[97mAutoClaw Multi-Instance'
+  $idx = $bat.IndexOf($render4)
+  if ($idx -lt 0) { throw 'GHOST.bat anchor missing: AutoClaw main-menu render line' }
+  $lineEnd = $bat.IndexOf("`r`n", $idx)
+  $escEntry = 'if defined ESC (echo %ESC%[92m[ {0}] %ESC%[97m{1} Multi-Instance ^& Clones %ESC%[90m- launchers, resets, sync%ESC%[0m) else echo [ {0}] {1} Multi-Instance ^& Clones - launchers, resets, sync' -f $SubmenuId, $Pascal
+  $bat = $bat.Substring(0, $lineEnd + 2) + $escEntry + "`r`n" + $bat.Substring($lineEnd + 2)
+
+  # Anchor 3: new submenu section + resolver, inserted before :UnknownTask.
+  $resolverLines = New-Object System.Collections.Generic.List[string]
+  for ($i = 1; $i -le $CloneCount; $i++) {
+    $gid = $GidBase + $i - 1
+    $resolverLines.Add(('if "%~1"=="{0}" set "RESOLVED={1}"' -f $i, $gid))
+  }
+  $resolver = ($resolverLines -join "`r`n")
+  $submenu = @"
+
+:$Pascal
+cls
+if defined ESC (echo %ESC%[96mGHOST / $Pascal Multi-Instance ^& Clones%ESC%[0m) else echo GHOST / $Pascal Multi-Instance ^& Clones
+echo.
+call :Div "Launch Clones"
+call :Opt 1 "Launch inst1" "- first clone (own profile, identity, ports)"
+call :Opt 2 "Reset inst1" ""
+echo.
+call :Opt 0 "Back to Main Menu" ""
+echo.
+if not defined PENDING_CHAIN goto ${Pascal}_PROMPT
+for %%t in (%PENDING_CHAIN%) do call :${Pascal}One %%t
+set "PENDING_CHAIN="
+:${Pascal}_PROMPT
+set "choice="
+set /p choice=%PROMPT_TEXT%
+if not defined choice goto ${Pascal}_PROMPT
+call :ValidateChoice choice
+if errorlevel 1 (
+    echo   Invalid input - menu numbers only, separated by spaces or commas.
+    goto ${Pascal}_PROMPT
+)
+if "%choice%"=="0" goto MAIN
+for %%t in (%choice:,= %) do call :${Pascal}One %%t
+goto $Pascal
+
+:${Pascal}One
+rem Resolves a $Pascal submenu-local id to its global task id and runs it.
+set "RESOLVED="
+$resolver
+if not defined RESOLVED call :UnknownTask "%~1"
+if not defined RESOLVED exit /b
+call :DispatchOne %RESOLVED%
+exit /b
+
+"@
+  $anchorUT = ':UnknownTask'
+  $idx = $bat.IndexOf($anchorUT)
+  if ($idx -lt 0) { throw 'GHOST.bat anchor missing: :UnknownTask' }
+  $bat = $bat.Substring(0, $idx) + $submenu + $bat.Substring($idx)
+
+  # Anchor 4: DispatchOne gids - append after the highest existing gid line.
+  $gidMatches = [regex]::Matches($bat, 'if "%~1"=="(\d+)" \(call')
+  $maxGid = ($gidMatches | ForEach-Object { [int]$_.Groups[1].Value } | Measure-Object -Maximum).Maximum
+  $gidLine = 'if "%~1"=="{0}" ' -f $maxGid
+  $idx = $bat.IndexOf($gidLine)
+  if ($idx -lt 0) { throw "GHOST.bat anchor missing: gid $maxGid dispatch line" }
+  $lineEnd = $bat.IndexOf("`r`n", $idx)
+  $newGids = @(
+    ('if "%~1"=="{0}" (call :Detached "{1} inst1" "-NoProfile" "src\windows\launch_{2}_clone.ps1" "" "Launcher opened in a separate window - it closes automatically when done." & exit /b)' -f ($GidBase), $Pascal, $Slug)
+    ('if "%~1"=="{0}" (call :Run "src\windows\reset_{1}.ps1" -Target inst1 & exit /b)' -f ($GidBase + 1), $Slug)
+  ) -join "`r`n"
+  $bat = $bat.Substring(0, $lineEnd + 2) + $newGids + "`r`n" + $bat.Substring($lineEnd + 2)
+
+  # Anchor 5: the DispatchOne range comment.
+  $bat = $bat -replace ('Runs one task by global id \(1-{0}\)' -f $maxGid), ('Runs one task by global id (1-{0})' -f ($GidBase + 1))
+
+  # Backup + write + verify-after.
+  $backup = "$batPath.new_clone_suite.bak"
+  [System.IO.File]::WriteAllText($backup, $bat)
+  $written = [System.IO.File]::ReadAllText($backup)
+  foreach ($probe in @(":$Pascal", ":${Pascal}One", "goto $Pascal", "if `"%first%`"==`"$SubmenuId`"")) {
+    if (-not $written.Contains($probe)) { throw "GHOST.bat verify-after failed: missing $probe" }
+  }
+  return $backup
+}
+
+# ---------------------------------------------------------------------------
+# Main
+# ---------------------------------------------------------------------------
+
+$it = New-Intake
+$slug = $it.slug
+$pascal = Get-PascalSlug $slug
+$upper = $slug.ToUpperInvariant()
+$cloneCount = $it.instanceCount - 1
+$instParams = (@('Primary') + (1..$cloneCount | ForEach-Object { "inst$_" }) -join "', '")
+$instParamsClones = (1..$cloneCount | ForEach-Object { "inst$_" }) -join "', '"
+
+# gid allocation: next free DispatchOne slot (two gids per suite skeleton).
+$batPath = Join-Path $PSScriptRoot '..\GHOST.bat'
+$batPath = [System.IO.Path]::GetFullPath($batPath)
+$batNow = [System.IO.File]::ReadAllText($batPath)
+$gidMatches = [regex]::Matches($batNow, 'if "%~1"=="(\d+)" \(call')
+$gidBase = (($gidMatches | ForEach-Object { [int]$_.Groups[1].Value } | Measure-Object -Maximum).Maximum) + 1
+# submenu id: highest existing main-menu number + 1
+$smMatches = [regex]::Matches($batNow, 'if "%first%"=="(\d+)" \(')
+$submenuId = (($smMatches | ForEach-Object { [int]$_.Groups[1].Value } | Measure-Object -Maximum).Maximum) + 1
+
+$instDefs = @()
+for ($i = 1; $i -le $cloneCount; $i++) {
+  $color = $it.colors[$i - 1].TrimStart('#').ToLowerInvariant()
+  $instDefs += ('  ''{0}'' = @{{ LnkName = ''{1} {0}.lnk''; Aumid = ''{2}.{0}''; Color = ''{3}'' }}' -f "inst$i", $it.displayName, "com.ghost.$slug", $color)
+}
+$instDefsText = $instDefs -join "`r`n"
+
+$isolationDoc = if ($it.isolation -eq 'homeMarker') {
+  'profile dir (--user-data-dir if the app honours it) + a marker file read by an asar patch for the gateway/home state (the AutoClaw engine v10 pattern)'
+} else {
+  'env levers (USERPROFILE/HOME/TEMP + app-specific vars) - verified to survive launches only for non-self-elevating apps'
+}
+$elevationDoc = if ($it.elevatesItself) {
+  'the app SELF-ELEVATES (requireAdministrator): launcher env levers never survive - args-only isolation + marker-file state (AutoClaw ground truth)'
+} else {
+  'no self-elevation detected: env levers survive; never launch elevated (UIPI strips drag-drop into high-IL windows)'
+}
+$elevationRule = if ($it.elevatesItself) { 'elevate ONLY the launching cmd via -Verb RunAs so args ride a plain CreateProcess' } else { 'never elevated' }
+
+$tokens = @{
+  '__SLUG__' = $slug; '__PASCAL__' = $pascal; '__UPPER__' = $upper
+  '__DISPLAYNAME__' = $it.displayName; '__COUNT__' = $it.instanceCount
+  '__INSTPARAMS__' = $instParams; '__INSTDEFS__' = $instDefsText
+  '__PORT__' = $it.preferredPort; '__ISOLATIONDOC__' = $isolationDoc
+  '__ELEVATIONDOC__' = $elevationDoc; '__ELEVATIONRULE__' = $elevationRule
+  '__DATE__' = (Get-Date -Format 'yyyy-MM-dd'); '__SUBMENU_ID__' = $submenuId; '__GIDBASE__' = $gidBase
+}
+function Expand([string]$Text) {
+  foreach ($k in $tokens.Keys) { $Text = $Text.Replace($k, [string]$tokens[$k]) }
+  return $Text
+}
+
+$plan = @(
+  @{ Path = "src\windows\reset_$slug.ps1";                          Text = (Expand $ResetT) }
+  @{ Path = "src\windows\launch_${slug}_clone.ps1";                 Text = (Expand $LaunchT) }
+  @{ Path = "src\windows\Launch-$pascal-Clone.bat";                 Text = (Expand $WrapperT) }
+  @{ Path = "tools\install_${slug}_clone_shortcuts.ps1";            Text = (Expand $ShortcutsT) }
+  @{ Path = "docs\${upper}_CLONES_SPEC.md";                         Text = (Expand $SpecT) }
+)
+$repoRoot = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..'))
+
+Write-Host "=== new_clone_suite: $slug ($($it.displayName)) ==="
+Write-Host ("  submenu [$submenuId], gids {0}+ , isolation '{1}', elevates={2}" -f $gidBase, $it.isolation, $it.elevatesItself)
+foreach ($p in $plan) { Write-Host ("  emit: {0}" -f $p.Path) }
+Write-Host '  edit: GHOST.bat (backup + anchor edit + verify-after)'
+
+if ($DryRun) { Write-Host 'DryRun - nothing written.'; exit 0 }
+
+foreach ($p in $plan) {
+  $full = Join-Path $repoRoot $p.Path
+  $dir = Split-Path -Parent $full
+  if (-not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null }
+  if (Test-Path -LiteralPath $full) { throw "refusing to overwrite existing file: $($p.Path)" }
+  Write-Utf8Crlf -Path $full -Content $p.Text
+  # verify-after: byte check
+  if (-not (Test-Path -LiteralPath $full)) { throw "emit verify failed: $($p.Path)" }
+}
+
+$backup = Edit-GhostMenu -It $it -Slug $slug -Pascal $pascal -SubmenuId $submenuId -GidBase $gidBase -CloneCount 2
+Copy-Item -LiteralPath $backup -Destination $batPath -Force
+Remove-Item -LiteralPath $backup -Force
+Write-Host "[ok] GHOST.bat wired (submenu [$submenuId], resolver :${pascal}One, gids $gidBase-$($gidBase + 1))"
+
+# Parse-check every emitted .ps1 (never silent-success).
+foreach ($p in $plan) {
+  if ($p.Path -notlike '*.ps1') { continue }
+  $full = Join-Path $repoRoot $p.Path
+  $errs = $null
+  [System.Management.Automation.Language.Parser]::ParseFile($full, [ref]$null, [ref]$errs) | Out-Null
+  if ($errs.Count -gt 0) {
+    $errs | ForEach-Object { Write-Host ("  [FAILED] {0}: {1}" -f $p.Path, $_.Message) -ForegroundColor Red }
+    throw "emitted .ps1 failed parse-check: $($p.Path)"
+  }
+}
+Write-Host '[ok] all emitted .ps1 parse-checked'
+
+Write-Host @'
+
+Next steps (playbook phases 0-2 - agent work, not scaffolding):
+  1. Fill every <TODO: Phase 1 discovery> slot in the emitted scripts.
+  2. Answer the ground-truth rows in docs\<SLUG>_CLONES_SPEC.md with provenance.
+  3. Run the .bat harness + Pester after wiring; icon decision per playbook section 5.
+'@.Replace('<SLUG>', $slug)
diff --git a/tools/patch_autoclaw_ports.mjs b/tools/patch_autoclaw_ports.mjs
new file mode 100644
index 0000000..8b5262b
--- /dev/null
+++ b/tools/patch_autoclaw_ports.mjs
@@ -0,0 +1,250 @@
+#!/usr/bin/env node
+// AutoClaw patch engine - pure text transforms on an EXTRACTED asar tree.
+// Usage: node patch_autoclaw_ports.mjs <extractedDir>
+// Prints a JSON result on stdout; exit 0 = all patches applied or already applied,
+// exit 1 = any patch found zero sites (tree left untouched).
+//
+// Engine v6 patch set:
+//   mcp-ports-8slot  PRODUCTIVITY_MCP_CANDIDATE_PORTS [19681..19684] -> [19681..19688]
+//   home-override    redirect the app's whole ~/.openclaw-autoclaw tree to a
+//                    per-clone home. Evolution (all verified live 2026-10-16):
+//     v2  262 receiver-form `X.homedir()` sites -> env-preferring wrapper
+//     v3  + 6 bare `homedir()` sites from destructured os imports
+//     v4  + THE state-dir resolver: `X.app.getPath("home")` -> join(...,
+//         OPENCLAW_HOME_DIR, ...parts) - Chromium known-folder API, env-immune
+//     v5  THE KICKER: AutoClaw.exe's manifest declares requireAdministrator, so
+//         every launch self-elevates (UAC silent for admins) and the elevated
+//         process gets a FRESH ENVIRONMENT - the launcher's AUTOCLAW_HOME_DIR /
+//         USERPROFILE / HOME never survive (args DO). v5 therefore points the
+//         resolver at a MARKER FILE inside the user-data dir:
+//         <userData>\.autoclaw-home holds the clone home (written by the
+//         launcher, verified after write). v6: the resolver reads the marker
+//         via process.argv --user-data-dir, NOT getPath("userData") - the
+//         resolver runs before the app applies the profile switch, so v5's
+//         getPath lookup always saw the DEFAULT profile (verified live).
+// See docs/AUTOCLAW_CLONES_SPEC.md section 5.1/5.3 and section 7.3.
+import { readFileSync, writeFileSync, readdirSync, statSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+
+const ENGINE_VERSION = 10;
+const extractedDir = process.argv[2];
+if (!extractedDir) {
+  console.error(JSON.stringify({ ok: false, error: "usage: patch_autoclaw_ports.mjs <extractedDir>" }));
+  process.exit(1);
+}
+
+// Canonical 8-slot replacement. Spacing is fixed so the wrapper's verify-after
+// re-read (string contains-check on the packed app.asar) is deterministic.
+const PORTS_8SLOT = "[19681, 19682, 19683, 19684, 19685, 19686, 19687, 19688]";
+// Exact idempotence anchor: what a patched tree contains verbatim.
+const DONE_ANCHOR = "PRODUCTIVITY_MCP_CANDIDATE_PORTS = " + PORTS_8SLOT;
+// Pristine anchor: 4-slot array with flexible whitespace (minified vs pretty builds).
+const PRISTINE_RE = /((?:const|let|var)\s+)?PRODUCTIVITY_MCP_CANDIDATE_PORTS\s*=\s*\[\s*19681\s*,\s*19682\s*,\s*19683\s*,\s*19684\s*\]/g;
+
+// home-override anchors: receiver wrapper present / bare wrapper present /
+// v6 argv-marker resolver present.
+const HOME_OVERRIDE_ANCHOR = "process.env.AUTOCLAW_HOME_DIR";
+const HOME_OVERRIDE_V3_ANCHOR = ".trim()) || homedir()";
+const V6_SIGNATURE = 'startsWith("--user-data-dir=")';
+const V7_SIGNATURE = "__autoclawHomeOverride";
+const HOMEDIR_RECEIVER_RE = /([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\.homedir\(\)/g;
+const HOMEDIR_BARE_RE = /(?<![.\w$])homedir\(\)/g;
+// One simple regex for every `X.getPath("home")` form; per-site decisions use
+// the PRE-MATCH context (replace callback offset), never lookbehinds - the
+// lookbehind variant double-wrapped `X.app.getPath` inside `require$$N.app`
+// receivers (the receiver group can start mid-identifier chain context).
+const GETPATH_SIMPLE_RE = /([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\.getPath\(\s*(["'])home\2\s*\)/g;
+const GETPATH_HOME_V4WRAPPER_RE = /\(\(process\.env\.AUTOCLAW_HOME_DIR && process\.env\.AUTOCLAW_HOME_DIR\.trim\(\)\) \|\| ([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\.getPath\(\s*(["'])home\2\s*\)\)/g;
+// The exact v5 IIFE shape (userData-marker variant) emitted by engine v5.
+const V5_IIFE_RE = /\(\(\(\) => \{ try \{ const __d = require\("path"\)\.join\(([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\.getPath\((["'])userData\2\), "\.autoclaw-home"\); const __v = require\("fs"\)\.readFileSync\(__d, "utf8"\)\.trim\(\); if \(__v\) return __v; \} catch \(__e\) \{\} return \1\.getPath\(\2home\2\); \}\)\(\)\)/g;
+
+// The argv-marker scan, cached process-wide in a global (first call computes,
+// every later call reuses - homedir()/resolver sites run constantly).
+const ARGV_SCAN_CACHED = `(globalThis.__autoclawHomeOverride ??= (() => { let __out = ""; let __err = ""; try { const __a = process.argv; for (let __i = 0; __i < __a.length; __i++) { let __m = null; if (__a[__i].startsWith("--user-data-dir=")) __m = __a[__i].slice("--user-data-dir=".length); else if (__a[__i] === "--user-data-dir" && __i + 1 < __a.length) __m = __a[__i + 1]; if (__m) { __m = __m.replace(/^(?:"|')|(?:"|')$/g, "").trim(); try { const __v = require("fs").readFileSync(require("path").join(__m, ".autoclaw-home"), "utf8").trim(); if (__v) { __out = __v; break; } } catch (__x) { __err = String(__x.message); } } } } catch (__x2) { __err = String(__x2.message); } try { require("fs").appendFileSync(require("os").tmpdir() + "/ac-argv-debug.txt", JSON.stringify({ pid: process.pid, argv: process.argv, out: __out, err: __err }) + String.fromCharCode(10)); } catch (__d) {} return __out; })())`;
+const ENV_CHECK = "(process.env.AUTOCLAW_HOME_DIR && process.env.AUTOCLAW_HOME_DIR.trim())";
+// The env wrapper's fixed literal prefix (emitted by this engine's v2/v3
+// passes) - matched by STRING search, not regex, so it cannot break.
+const ENV_PREFIX_LITERAL = ENV_CHECK + " || ";
+// The v7 scan body still inside already-v7-patched trees - v8's debug variant
+// never reached them (no pass re-emitted the scan). v9 swaps it by literal.
+const V7_SCAN_OLD = `(globalThis.__autoclawHomeOverride ??= (() => { try { const __a = process.argv; for (let __i = 0; __i < __a.length; __i++) { let __m = null; if (__a[__i].startsWith("--user-data-dir=")) __m = __a[__i].slice("--user-data-dir=".length); else if (__a[__i] === "--user-data-dir" && __i + 1 < __a.length) __m = __a[__i + 1]; if (__m) { __m = __m.replace(/^(?:"|')|(?:"|')$/g, "").trim(); const __v = require("fs").readFileSync(require("path").join(__m, ".autoclaw-home"), "utf8").trim(); if (__v) return __v; } } } catch (__e) {} return ""; })())`;
+
+function homeOverrideIife(recv, q) {
+  // TEMP DEBUG (2026-10-16): record argv + resolution outcome for field diagnosis.
+  const debug = `try { require("fs").appendFileSync(require("os").tmpdir() + "/ac-argv-debug.txt", JSON.stringify({ argv: process.argv, resolved: __v, err: String(__e && __e.message || "") }) + "\\n"); } catch (__d) {}`;
+  // v6: resolve the marker via process.argv --user-data-dir, NOT
+  // getPath("userData") - the resolver runs before the app applies the
+  // profile switch (verified live 2026-10-16: v5's getPath lookup always saw
+  // the DEFAULT profile, never found the marker, fell back to the real home).
+  // argv is set from process start and survives the requireAdministrator
+  // self-elevation (env does not).
+  return `((() => { let __v = ""; let __e = null; try { const __a = process.argv; for (let __i = 0; __i < __a.length; __i++) { let __m = null; if (__a[__i].startsWith("--user-data-dir=")) __m = __a[__i].slice("--user-data-dir=".length); else if (__a[__i] === "--user-data-dir" && __i + 1 < __a.length) __m = __a[__i + 1]; if (__m) { __m = __m.replace(/^(?:"|')|(?:"|')$/g, "").trim(); const __r = require("fs").readFileSync(require("path").join(__m, ".autoclaw-home"), "utf8").trim(); if (__r) { __v = __r; break; } } } } catch (__x) { __e = __x; } ${debug} if (__v) return __v; return ${recv}.getPath(${q}home${q}); })())`;
+}
+
+function listSourceFiles(dir) {
+  const out = [];
+  for (const name of readdirSync(dir)) {
+    const full = join(dir, name);
+    const st = statSync(full);
+    if (st.isDirectory()) out.push(...listSourceFiles(full));
+    else if (/\.(js|cjs|mjs|html)$/.test(name)) out.push(full);
+  }
+  return out;
+}
+
+// Patch definitions. apply(src) returns {src, count}; count -1 = already applied.
+const PATCHES = [
+  {
+    name: "mcp-ports-8slot",
+    apply: (src) => {
+      if (src.includes(DONE_ANCHOR)) return { src, count: -1 };
+      let count = 0;
+      PRISTINE_RE.lastIndex = 0;
+      const out = src.replace(PRISTINE_RE, (m, decl) => {
+        count++;
+        return (decl || "") + "PRODUCTIVITY_MCP_CANDIDATE_PORTS = " + PORTS_8SLOT;
+      });
+      if (count === 0) return { src, count: 0 };
+      return { src: out, count };
+    },
+  },
+  {
+    name: "home-override",
+    // Passes, each self-guarding against its own output:
+    //   1. receiver-form `X.homedir()` -> env wrapper (gated on the v2 anchor;
+    //      the v2 wrapper's own `X.homedir()` output would double-wrap)
+    //   2. bare-form `homedir()` -> env wrapper (gated on the v3 anchor)
+    //   3. `X.app.getPath("home")` -> v5 MARKER-FILE resolver (gated on the v5
+    //      marker; unwraps the v4 env wrapper first, then pristine sites)
+    //   4. legacy env-wrapper sites on homedir/receiver forms stay: env vars
+    //      no longer survive elevation, but they are harmless fallbacks.
+    apply: (src) => {
+      let out = src;
+      let count = 0;
+
+      if (!src.includes(HOME_OVERRIDE_ANCHOR)) {
+        out = out.replace(HOMEDIR_RECEIVER_RE, (m, obj) => {
+          count++;
+          return `((process.env.AUTOCLAW_HOME_DIR && process.env.AUTOCLAW_HOME_DIR.trim()) || ${obj}.homedir())`;
+        });
+      }
+      if (!out.includes(HOME_OVERRIDE_V3_ANCHOR)) {
+        out = out.replace(HOMEDIR_BARE_RE, () => {
+          count++;
+          return "((process.env.AUTOCLAW_HOME_DIR && process.env.AUTOCLAW_HOME_DIR.trim()) || homedir())";
+        });
+      }
+      // v9: swap the v7 scan body for the v8 debug-instrumented scan inside
+      // already-patched trees (the v7 prefix pass is gated off there).
+      if (!out.includes("ac-argv-debug") && out.includes(V7_SIGNATURE)) {
+        const pp = out.split(V7_SCAN_OLD);
+        if (pp.length > 1) {
+          count += pp.length - 1;
+          out = pp.join(ARGV_SCAN_CACHED);
+        }
+      }
+      // v10: the app's argv carries a trailing space after the quoted path
+      // (verified via the app's own debug record 2026-10-16) - trim the
+      // extracted value or the marker read misses by one character.
+      const TRIM_SWAP_OLD = '$/g, "");';
+      const TRIM_SWAP_NEW = '$/g, "").trim();';
+      if (out.includes(TRIM_SWAP_OLD) && out.includes(V7_SIGNATURE)) {
+        const tp = out.split(TRIM_SWAP_OLD);
+        count += tp.length - 1;
+        out = tp.join(TRIM_SWAP_NEW);
+      }
+      if (!out.includes(V6_SIGNATURE)) {
+        // Engine v5 trees: unwrap the userData-marker IIFE to the v6 argv form.
+        out = out.replace(V5_IIFE_RE, (m, recv, q) => {
+          count++;
+          return homeOverrideIife(recv, q);
+        });
+        // v4 env-wrapper sites: unwrap straight to the v6 IIFE.
+        out = out.replace(GETPATH_HOME_V4WRAPPER_RE, (m, recv, q) => {
+          count++;
+          return homeOverrideIife(recv, q);
+        });
+        // Pristine (never-wrapped) resolver sites LAST: skip any site whose
+        // immediate context marks it as an already-handled fallback or wrapper
+        // (the IIFEs emitted above contain `return X.getPath("home")` and the
+        // v4 wrapper contains `) || X.getPath("home")` - both must survive).
+        out = out.replace(GETPATH_SIMPLE_RE, (m, recv, q, offset, full) => {
+          const before = full.slice(Math.max(0, offset - 40), offset);
+          if (/return\s+$/.test(before) || /\)\s*\|\|\s*$/.test(before)) { return m; }
+          count++;
+          return homeOverrideIife(recv, q);
+        });
+      }
+      // v7: prefix every surviving env wrapper with the cached argv-marker
+      // scan - the env check alone is dead under the requireAdministrator
+      // self-elevation (fresh env), so the marker file must come first.
+      // STRING search on the fixed literal prefix (receiver and bare forms
+      // share it); no regex, so it cannot break.
+      if (!out.includes(V7_SIGNATURE)) {
+        const parts = out.split(ENV_PREFIX_LITERAL);
+        if (parts.length > 1) {
+          count += parts.length - 1;
+          out = parts.join(ARGV_SCAN_CACHED + " || " + ENV_PREFIX_LITERAL);
+        }
+      }
+      if (count === 0) {
+        return { src, count: (src.includes(HOME_OVERRIDE_ANCHOR) || src.includes(V6_SIGNATURE) || src.includes(V7_SIGNATURE)) ? -1 : 0 };
+      }
+      return { src: out, count };
+    },
+  },
+];
+
+function markersForPatch(name) {
+  switch (name) {
+    case "mcp-ports-8slot":
+      return ["PRODUCTIVITY_MCP_CANDIDATE_PORTS", "19685", "19686", "19687", "19688"];
+    case "home-override":
+      return ["AUTOCLAW_HOME_DIR", ".autoclaw-home", "__autoclawHomeOverride"];
+    default:
+      return [];
+  }
+}
+
+const results = [];
+const files = listSourceFiles(extractedDir);
+for (const file of files) {
+  const before = readFileSync(file, "utf8");
+  let src = before;
+  const counts = {};
+  const appliedMarkers = [];
+  for (const patch of PATCHES) {
+    const r = patch.apply(src);
+    src = r.src;
+    counts[patch.name] = r.count;
+    if (r.count > 0) {
+      appliedMarkers.push(...markersForPatch(patch.name));
+    }
+  }
+  if (src !== before) {
+    writeFileSync(file, src);
+  }
+  if (PATCHES.some((p) => counts[p.name] !== 0)) {
+    results.push({ file: relative(extractedDir, file).split(sep).join("/"), counts, appliedMarkers });
+  }
+}
+
+const totals = {};
+for (const p of PATCHES) totals[p.name] = 0;
+const failures = [];
+for (const p of PATCHES) {
+  for (const r of results) {
+    if (r.counts[p.name] > 0) totals[p.name] += r.counts[p.name];
+  }
+  if (totals[p.name] === 0) {
+    const anyAlready = results.some((r) => r.counts[p.name] === -1);
+    if (!anyAlready) failures.push(p.name);
+  }
+}
+
+if (failures.length) {
+  console.log(JSON.stringify({ ok: false, engineVersion: ENGINE_VERSION, totals, results, error: "zero patch sites: " + failures.join(",") }));
+  process.exit(1);
+}
+
+console.log(JSON.stringify({ ok: true, engineVersion: ENGINE_VERSION, totals, results }));
diff --git a/tools/patch_autoclaw_ports.ps1 b/tools/patch_autoclaw_ports.ps1
new file mode 100644
index 0000000..84410aa
--- /dev/null
+++ b/tools/patch_autoclaw_ports.ps1
@@ -0,0 +1,280 @@
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+  Widens the installed AutoClaw app MCP candidate ports from 4 to 8 slots.
+
+.DESCRIPTION
+  One-time app.asar patch (marker + -Restore + backup). See
+  docs/AUTOCLAW_CLONES_SPEC.md sections 5.1 and 7.3.
+
+.EXAMPLE
+  powershell -NoProfile -ExecutionPolicy Bypass -File tools\patch_autoclaw_ports.ps1
+#>
+[CmdletBinding()]
+param(
+  [switch]$Restore,
+  [switch]$Force,
+  [string]$InstallDir
+)
+
+$ErrorActionPreference = "Stop"
+
+# Must match ENGINE_VERSION in patch_autoclaw_ports.mjs.
+$script:EngineVersion = 10
+$script:NpxExe = $null
+function Resolve-AutoClawInstallDir {
+  param([string]$Override)
+  $candidates = @()
+  if ($Override) { $candidates += $Override }
+  $candidates += @(
+    "C:\Program Files\AutoClaw",
+    "C:\Program Files (x86)\AutoClaw"
+  )
+  foreach ($c in $candidates) {
+    if ($c -and (Test-Path (Join-Path $c "AutoClaw.exe")) -and (Test-Path (Join-Path $c "resources\app.asar"))) {
+      return $c
+    }
+  }
+  throw "AutoClaw install not found. Pass -InstallDir <path> explicitly."
+}
+
+function Assert-AutoClawClosed {
+  param([string]$InstallPath)
+  $procs = @(Get-Process -Name "AutoClaw" -ErrorAction SilentlyContinue |
+    Where-Object { $_.Path -and ($_.Path -like "$InstallPath*") })
+  if ($procs.Count -gt 0) {
+    throw ("AutoClaw.exe from this install dir is running (PID(s): {0}). Close all its windows and try again." -f
+      (($procs | Select-Object -First 5 -ExpandProperty Id) -join ", "))
+  }
+}
+
+function Find-AutoClawTool {
+  param([string]$Name, [string]$MissingMessage)
+  $cmd = Get-Command $Name -ErrorAction SilentlyContinue
+  if (-not $cmd) { throw $MissingMessage }
+  return $cmd.Source
+}
+
+function Invoke-AutoClawAsar {
+  param([string[]]$NpxArgs)
+  & $script:NpxExe @NpxArgs
+  if ($LASTEXITCODE -ne 0) {
+    throw ("asar command failed (exit {0}): npx {1}" -f $LASTEXITCODE, ($NpxArgs -join " "))
+  }
+}
+
+function Get-AutoClawRelPaths {
+  param([string]$Root)
+  $full = (Resolve-Path $Root).Path.TrimEnd("\")
+  $len = $full.Length + 1
+  $set = New-Object "System.Collections.Generic.HashSet[string]"
+  Get-ChildItem -LiteralPath $full -Recurse -File | ForEach-Object {
+    [void]$set.Add($_.FullName.Substring($len).Replace("\", "/"))
+  }
+  return $set
+}
+function Invoke-AutoClawAsarSwap {
+  param(
+    [string]$ResourcesDir,
+    [string]$CandidateAsar,
+    [string]$CandidateUnpacked,
+    [long]$MinAsarBytes
+  )
+  $asar = Join-Path $ResourcesDir "app.asar"
+  $unpacked = Join-Path $ResourcesDir "app.asar.unpacked"
+  $oldUnpacked = Join-Path $ResourcesDir "app.asar.unpacked.old"
+  if (Test-Path $oldUnpacked) { Remove-Item $oldUnpacked -Recurse -Force }
+  if (Test-Path $unpacked) { Rename-Item $unpacked "app.asar.unpacked.old" }
+  if (-not (Test-Path $CandidateUnpacked)) {
+    New-Item -ItemType Directory -Path $unpacked -Force | Out-Null
+  } else {
+    Move-Item $CandidateUnpacked $unpacked
+  }
+  try {
+    Remove-Item $asar -Force
+    Move-Item $CandidateAsar $asar
+  } catch {
+    Remove-Item $unpacked -Recurse -Force
+    Rename-Item $oldUnpacked "app.asar.unpacked"
+    throw
+  }
+  Remove-Item $oldUnpacked -Recurse -Force -ErrorAction SilentlyContinue
+  if (-not (Test-Path $asar) -or -not (Test-Path $unpacked)) { throw "post-swap verify FAILED: targets missing" }
+  if ((Get-Item $asar).Length -lt $MinAsarBytes) {
+    throw "post-swap verify FAILED: app.asar suspiciously small. Run with -Restore."
+  }
+}
+function Copy-AutoClawBackupToStaging {
+  param([string]$BackupDir)
+  $stage = Join-Path $env:TEMP ("autoclaw-ports-restore-" + [guid]::NewGuid().ToString("N").Substring(0, 8))
+  New-Item -ItemType Directory -Path $stage -Force | Out-Null
+  Copy-Item (Join-Path $BackupDir "app.asar") (Join-Path $stage "app.asar")
+  if (Test-Path (Join-Path $BackupDir "app.asar.unpacked")) {
+    Copy-Item (Join-Path $BackupDir "app.asar.unpacked") (Join-Path $stage "app.asar.unpacked") -Recurse
+  } else {
+    New-Item -ItemType Directory -Path (Join-Path $stage "app.asar.unpacked") -Force | Out-Null
+  }
+  return $stage
+}
+
+$NodeExe = Find-AutoClawTool "node" "node not found on PATH (needed to run the patch engine)."
+$script:NpxExe = Find-AutoClawTool "npx.cmd" "npx not found on PATH (needed for @electron/asar)."
+$AutoClawInstall = Resolve-AutoClawInstallDir -Override $InstallDir
+$AutoClawResources = Join-Path $AutoClawInstall "resources"
+$AutoClawAsar = Join-Path $AutoClawResources "app.asar"
+$AutoClawMarker = Join-Path $AutoClawResources "autoclaw-ports-patch.marker.json"
+$AutoClawBackups = Join-Path $AutoClawResources "ID_Backups"
+$AutoClawEngine = Join-Path $PSScriptRoot "patch_autoclaw_ports.mjs"
+
+Write-Host "Install dir : $AutoClawInstall"
+
+
+if ($Restore) {
+  Assert-AutoClawClosed -InstallPath $AutoClawInstall
+  $backup = Get-ChildItem -LiteralPath $AutoClawBackups -Directory -ErrorAction SilentlyContinue |
+    Sort-Object Name -Descending | Where-Object { Test-Path (Join-Path $_.FullName "app.asar") } |
+    Select-Object -First 1
+  if (-not $backup) { throw "No backup found under $AutoClawBackups - nothing to restore." }
+  $restoreFloor = [long]([IO.File]::ReadAllBytes((Join-Path $backup.FullName "app.asar")).Length / 2)
+  Write-Host "[1/2] Restoring app.asar + app.asar.unpacked from $($backup.Name) (staged copy)"
+  $stage = Copy-AutoClawBackupToStaging -BackupDir $backup.FullName
+  try {
+    Invoke-AutoClawAsarSwap -ResourcesDir $AutoClawResources `
+      -CandidateAsar (Join-Path $stage "app.asar") `
+      -CandidateUnpacked (Join-Path $stage "app.asar.unpacked") `
+      -MinAsarBytes $restoreFloor
+  } finally {
+    if (Test-Path $stage) { Remove-Item $stage -Recurse -Force -ErrorAction SilentlyContinue }
+  }
+  if (Test-Path $AutoClawMarker) { Remove-Item $AutoClawMarker -Force }
+  Write-Host "[2/2] Marker removed."
+  Write-Host "SUCCESS - original app.asar restored from $($backup.FullName)"
+  exit 0
+}
+
+$existingMarker = $null
+if (Test-Path $AutoClawMarker) {
+  $markerEngineVersion = 1
+  try {
+    $existingMarker = Get-Content -LiteralPath $AutoClawMarker -Raw | ConvertFrom-Json
+    if ($existingMarker.patchVersion) { $markerEngineVersion = [int]$existingMarker.patchVersion }
+  } catch { Write-Host "Marker unreadable - will re-patch." }
+  if ($markerEngineVersion -ge $script:EngineVersion -and -not $Force) {
+    Write-Host "Already patched at engine v$markerEngineVersion (marker exists). Use -Force to re-patch."
+    exit 0
+  }
+}
+Assert-AutoClawClosed -InstallPath $AutoClawInstall
+
+$AutoClawStamp = Get-Date -Format "yyyyMMdd-HHmmss"
+$AutoClawUnpacked = Join-Path $AutoClawResources "app.asar.unpacked"
+$AutoClawBackupDir = Join-Path $AutoClawBackups $AutoClawStamp
+if ($existingMarker -and $existingMarker.backupDir -and (Test-Path (Join-Path $existingMarker.backupDir "app.asar"))) {
+  $AutoClawBackupDir = $existingMarker.backupDir
+  Write-Host "[1/7] Reusing original backup at $AutoClawBackupDir"
+} else {
+  Write-Host "[1/7] Backup to $AutoClawBackupDir"
+  New-Item -ItemType Directory -Path $AutoClawBackupDir -Force | Out-Null
+  Copy-Item $AutoClawAsar (Join-Path $AutoClawBackupDir "app.asar")
+  if (Test-Path $AutoClawUnpacked) {
+    Copy-Item $AutoClawUnpacked (Join-Path $AutoClawBackupDir "app.asar.unpacked") -Recurse
+  }
+  if (-not (Test-Path (Join-Path $AutoClawBackupDir "app.asar"))) { throw "backup verify FAILED: app.asar not copied" }
+}
+
+
+$AutoClawWork = Join-Path $env:TEMP ("autoclaw-ports-patch-" + [guid]::NewGuid().ToString("N").Substring(0, 8))
+$AutoClawExtracted = Join-Path $AutoClawWork "extracted"
+$AutoClawCandidate = Join-Path $AutoClawWork "app.asar.candidate"
+$AutoClawCandidateUnpacked = "$AutoClawCandidate.unpacked"
+
+try {
+  New-Item -ItemType Directory -Path $AutoClawWork -Force | Out-Null
+  Write-Host "[2/7] Extracting app.asar (takes a minute)..."
+  Invoke-AutoClawAsar @("--yes", "@electron/asar", "extract", $AutoClawAsar, $AutoClawExtracted)
+  Write-Host "[3/7] Widening MCP candidate ports 4 -> 8 slots..."
+  $engineOut = & $NodeExe $AutoClawEngine $AutoClawExtracted
+  $engineJson = $null
+  try { $engineJson = ($engineOut -join "`n") | ConvertFrom-Json } catch {
+    throw ("patch engine returned invalid JSON: {0}" -f ($engineOut -join "`n"))
+  }
+  if (-not $engineJson.ok) {
+    throw ("patch engine FAILED: {0} | totals: {1}" -f $engineJson.error, ($engineJson.totals | ConvertTo-Json -Compress))
+  }
+
+  $engineJson.results | ForEach-Object {
+    Write-Host ("      {0}: mcp-ports-8slot={1}" -f $_.file, $_.counts."mcp-ports-8slot")
+  }
+  foreach ($r in $engineJson.results) {
+    if (-not $r.appliedMarkers -or @($r.appliedMarkers).Count -eq 0) { continue }
+    $patchedFile = Join-Path $AutoClawExtracted ($r.file -replace "/", "\")
+    $content = [IO.File]::ReadAllText($patchedFile)
+    foreach ($marker in $r.appliedMarkers) {
+      if (-not $content.Contains($marker)) {
+        throw ("patch verify FAILED after write: marker '{0}' missing in {1}" -f $marker, $r.file)
+      }
+    }
+  }
+  foreach ($r in $engineJson.results) {
+    if ($r.file -notmatch "\.(js|cjs|mjs)$") { continue }
+    $syntaxFile = Join-Path $AutoClawExtracted ($r.file -replace "/", "\")
+    $checkOut = cmd /c "`"$NodeExe`" --check `"$syntaxFile`" 2>&1" | Out-String
+    if ($LASTEXITCODE -ne 0) {
+      throw ("patch verify FAILED: node --check rejected {0}`n{1}" -f $r.file, $checkOut.Trim())
+    }
+    Write-Host ("      {0}: node --check OK" -f $r.file)
+  }
+  Write-Host "[4/7] Packing candidate asar..."
+  $unpackGlobs = New-Object "System.Collections.Generic.List[string]"
+  $unpackGlobs.Add("*.{node,dll,dylib,exe}")
+  $origUnpackedSet = Get-AutoClawRelPaths -Root $AutoClawUnpacked
+  for ($try = 1; $try -le 4; $try++) {
+    $packArgs = @("--yes", "@electron/asar", "pack", $AutoClawExtracted, $AutoClawCandidate)
+    foreach ($g in $unpackGlobs) { $packArgs += "--unpack"; $packArgs += $g }
+    Invoke-AutoClawAsar $packArgs
+    if (-not (Test-Path $AutoClawCandidate)) { throw "repack FAILED: candidate not written" }
+    break
+  }
+  Write-Host "[5/7] Verifying candidate asar contents..."
+  $AutoClawVerify = Join-Path $AutoClawWork "verify"
+  foreach ($r in $engineJson.results) {
+    if (-not $r.appliedMarkers -or @($r.appliedMarkers).Count -eq 0) { continue }
+    New-Item -ItemType Directory -Path $AutoClawVerify -Force | Out-Null
+    Get-ChildItem -LiteralPath $AutoClawVerify -Recurse -File -ErrorAction SilentlyContinue | Remove-Item -Force
+    $relWin = $r.file -replace "/", "\"
+    Push-Location $AutoClawVerify
+    try {
+      Invoke-AutoClawAsar @("--yes", "@electron/asar", "extract-file", $AutoClawCandidate, $relWin)
+    } finally { Pop-Location }
+    $verifyFile = Get-ChildItem -LiteralPath $AutoClawVerify -Recurse -File |
+      Where-Object { $_.Name -eq (Split-Path -Leaf $relWin) } | Select-Object -First 1
+    if (-not $verifyFile) { throw "patch verify FAILED: could not extract $($r.file) from candidate" }
+    $vc = [IO.File]::ReadAllText($verifyFile.FullName)
+    foreach ($marker in $r.appliedMarkers) {
+      if (-not $vc.Contains($marker)) {
+        throw ("patch verify FAILED inside candidate asar: marker '{0}' missing in {1}" -f $marker, $r.file)
+      }
+    }
+    Write-Host ("      {0}: markers verified" -f $r.file)
+  }
+  Write-Host "[6/7] Swapping patched asar into install..."
+  $patchFloor = [long]((Get-Item $AutoClawAsar).Length / 2)
+  Invoke-AutoClawAsarSwap -ResourcesDir $AutoClawResources -CandidateAsar $AutoClawCandidate -CandidateUnpacked $AutoClawCandidateUnpacked -MinAsarBytes $patchFloor
+  Write-Host "[7/7] Writing marker..."
+  $marker = [ordered]@{
+    appliedAt    = (Get-Date -Format "o")
+    patchVersion = [int]$engineJson.engineVersion
+    installDir   = $AutoClawInstall
+    backupDir    = $AutoClawBackupDir
+    patchedFiles = @($engineJson.results | ForEach-Object { $_.file })
+    totals       = $engineJson.totals
+  }
+  $marker | ConvertTo-Json -Depth 4 | Set-Content -Path $AutoClawMarker -Encoding UTF8
+  if (-not (Test-Path $AutoClawMarker)) { throw "marker verify FAILED: not written" }
+} finally {
+  if (Test-Path $AutoClawWork) { Remove-Item $AutoClawWork -Recurse -Force -ErrorAction SilentlyContinue }
+}
+Write-Host "SUCCESS - AutoClaw MCP ports widened 4 -> 8 slots (19681..19688)."
+
+
+
diff --git a/tools/refresh_zcode_second_chats.ps1 b/tools/refresh_zcode_second_chats.ps1
index a77e842..fcf3683 100644
--- a/tools/refresh_zcode_second_chats.ps1
+++ b/tools/refresh_zcode_second_chats.ps1
@@ -61,13 +61,18 @@ $AgentLogDir = Join-Path $env:USERPROFILE '.zcode\cli\log'
 $LogDir      = Join-Path $PSScriptRoot 'logs'
 $LogFile     = Join-Path $LogDir 'refresh_zcode_second_chats.log'
 
-# Window titles come from tools\patch_zcode_icon_override.ps1 (branding patch):
-# the Primary keeps the plain "ZCode" title, clones carry their color.
+# Instance classification is PROCESS-MARKER-first (the 2026-09-24/26 taskbar
+# lesson applies verbatim): a clone's window is titled plain "ZCode" during
+# the splash phase, so title-only rules claim it as Primary. Markers = the
+# roaming/home dir names the same launcher/watcher rules use (visible in the
+# subtree's WMI command lines); a clone's v6 color title overrides a spurious
+# Primary marker read. Markers and titles come from
+# tools\patch_zcode_icon_override.ps1 (the Primary keeps the plain title).
 $InstanceDefs = @(
-  @{ Name = 'Primary'; HomeRel = '';                Title = 'ZCode';        Exclude = @('Blue', 'Yellow', 'Green') }
-  @{ Name = 'Second';  HomeRel = 'ZCodeSecondHome'; Title = 'ZCode Blue';   Exclude = @() }
-  @{ Name = 'Third';   HomeRel = 'ZCodeThirdHome';  Title = 'ZCode Yellow'; Exclude = @() }
-  @{ Name = 'Fourth';  HomeRel = 'ZCodeFourthHome'; Title = 'ZCode Green';  Exclude = @() }
+  @{ Name = 'Primary'; HomeRel = '';                Title = 'ZCode';        Markers = @() }
+  @{ Name = 'Second';  HomeRel = 'ZCodeSecondHome'; Title = 'ZCode Blue';   Markers = @('ZCode-Second', 'ZCodeSecondHome') }
+  @{ Name = 'Third';   HomeRel = 'ZCodeThirdHome';  Title = 'ZCode Yellow'; Markers = @('ZCode-Third', 'ZCodeThirdHome') }
+  @{ Name = 'Fourth';  HomeRel = 'ZCodeFourthHome'; Title = 'ZCode Green';  Markers = @('ZCode-Fourth', 'ZCodeFourthHome') }
 )
 
 function Write-RunLog([string]$line) {
@@ -160,20 +165,89 @@ function Get-DescendantProcesses([int[]]$rootIds) {
   return $result
 }
 
+# One WMI snapshot per classification, keyed by pid, with parent->children
+# links (same shape as the taskbar watcher's Get-ZcodeProcessMap).
+function Get-ZcodeProcessMap {
+  $map = @{}
+  $procs = @(Get-CimInstance Win32_Process -Filter "Name='ZCode.exe'" -ErrorAction SilentlyContinue -OperationTimeoutSec 5)
+  foreach ($p in $procs) {
+    $map[[int]$p.ProcessId] = @{ Parent = [int]$p.ParentProcessId; Cmdline = [string]$p.CommandLine; Children = @() }
+  }
+  foreach ($p in $procs) {
+    $par = [int]$p.ParentProcessId
+    if ($map.ContainsKey($par)) { $map[$par].Children = @($map[$par].Children) + [int]$p.ProcessId }
+  }
+  return $map
+}
+
+# Classify a window's instance by walking its process tree to the root ZCode
+# main and matching clone markers across the whole subtree's command lines.
+# A clone main carries a bare exe command line; its children carry the clone
+# home/roaming paths. Unmatched trees are Primary (the launcher's rule).
+function Get-WindowMarkerInstance {
+  param($ProcMap, [int]$ProcessId)
+  if (-not $ProcMap -or -not $ProcMap.ContainsKey($ProcessId)) { return $null }
+  $root = $ProcessId
+  $climbed = @{}
+  while ($ProcMap.ContainsKey($root)) {
+    if ($climbed.ContainsKey($root)) { break }
+    $climbed[$root] = $true
+    $par = [int]$ProcMap[$root].Parent
+    if (-not $ProcMap.ContainsKey($par)) { break }
+    $root = $par
+  }
+  $seen = @{}
+  $queue = New-Object System.Collections.Queue
+  $queue.Enqueue($root)
+  while ($queue.Count -gt 0) {
+    $cur = [int]$queue.Dequeue()
+    if ($seen.ContainsKey($cur)) { continue }
+    $seen[$cur] = $true
+    $node = $ProcMap[$cur]
+    if (-not $node) { continue }
+    $cl = $node.Cmdline
+    if ($cl) {
+      foreach ($inst in $InstanceDefs) {
+        foreach ($marker in $inst.Markers) {
+          if ($cl -like ("*{0}*" -f $marker)) { return $inst }
+        }
+      }
+    }
+    foreach ($child in $node.Children) { $queue.Enqueue($child) }
+  }
+  return $InstanceDefs[0]
+}
+
+# Final classification: a clone's v6 color title is decisive when present
+# (it overrides a spurious Primary marker read - WMI can miss a fresh clone's
+# children for one snapshot); otherwise markers win over the splash-phase
+# plain title; a plain "ZCode" title with an unmarked tree is the Primary.
+# $null = ambiguous - the caller skips it loudly rather than guessing.
+function Resolve-WindowInstance {
+  param($ProcMap, $Win)
+  $markerInst = Get-WindowMarkerInstance -ProcMap $ProcMap -ProcessId $Win.Id
+  $t = [string]$Win.MainWindowTitle
+  foreach ($cand in $InstanceDefs) {
+    if ($cand.Name -ne 'Primary' -and $t -like ($cand.Title + '*')) { return $cand }
+  }
+  if ($markerInst -and $markerInst.Name -ne 'Primary') { return $markerInst }
+  if ($t -like 'ZCode*' -and $markerInst -and $markerInst.Name -eq 'Primary') { return $markerInst }
+  return $null
+}
+
 function Get-InstanceState([hashtable]$def) {
   # Snapshot of one instance: installed? running? workspace open? index in sync?
   $st = @{ Def = $def; Status = 'ok'; ErrText = ''; Mains = @(); Servers = @()
            TasksIndex = (Get-TasksIndexPath $def); MissingCount = 0; MissingLines = @() }
   if (-not (Test-Path $st.TasksIndex)) { $st.Status = 'not-installed'; return $st }
-  $mains = @(Get-Process -Name ZCode -ErrorAction SilentlyContinue | Where-Object {
-      if ($_.MainWindowHandle -eq 0) { $false }
-      else {
-        $t = [string]$_.MainWindowTitle
-        $ok = ($t -like ($def.Title + '*'))
-        if ($ok) { foreach ($x in $def.Exclude) { if ($t -like ('*' + $x + '*')) { $ok = $false } } }
-        $ok
-      }
-    })
+  $wins = @(Get-Process -Name ZCode -ErrorAction SilentlyContinue | Where-Object { $_.MainWindowHandle -ne 0 })
+  if ($wins.Count -gt 0) {
+    $procMap = Get-ZcodeProcessMap
+    $mains = @($wins | Where-Object { (Resolve-WindowInstance -ProcMap $procMap -Win $_).Name -eq $def.Name })
+  }
+  else {
+    $mains = @()
+  }
   $st.Mains = $mains
   if ($mains.Count -eq 0) { $st.Status = 'not-running'; return $st }
   $desc = @(Get-DescendantProcesses ($mains | ForEach-Object { [int]$_.Id }))
diff --git a/tools/set_zcode_bot.ps1 b/tools/set_zcode_bot.ps1
new file mode 100644
index 0000000..69f738d
--- /dev/null
+++ b/tools/set_zcode_bot.ps1
@@ -0,0 +1,224 @@
+#Requires -Version 5.1
+# ZCode per-clone Telegram bot guardian (UI-assisted model).
+# See docs/ZCODE_TELEGRAM_BOTS.md for the full contract.
+param(
+    [ValidateSet('Primary', 'Second', 'Third', 'Fourth', 'All')]
+    [string]$Target = 'All',
+    [switch]$VerifyOnly,
+    [switch]$Fix
+)
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot '..\src\windows\identity_utils.ps1')
+
+$UserProfile = $env:USERPROFILE
+if ([string]::IsNullOrWhiteSpace($UserProfile)) { $UserProfile = [Environment]::GetFolderPath('UserProfile') }
+$AppData = $env:APPDATA
+if ([string]::IsNullOrWhiteSpace($AppData)) { $AppData = Join-Path $UserProfile 'AppData\Roaming' }
+
+$BotIdsByTarget = @{
+    'Primary' = @{ ZCode = (Join-Path $UserProfile '.zcode'); Roaming = (Join-Path $AppData 'ZCode'); Home = $UserProfile }
+    'Second'  = @{ ZCode = (Join-Path $UserProfile 'ZCodeSecondHome\.zcode'); Roaming = (Join-Path $AppData 'ZCode-Second'); Home = (Join-Path $UserProfile 'ZCodeSecondHome') }
+    'Third'   = @{ ZCode = (Join-Path $UserProfile 'ZCodeThirdHome\.zcode'); Roaming = (Join-Path $AppData 'ZCode-Third'); Home = (Join-Path $UserProfile 'ZCodeThirdHome') }
+    'Fourth'  = @{ ZCode = (Join-Path $UserProfile 'ZCodeFourthHome\.zcode'); Roaming = (Join-Path $AppData 'ZCode-Fourth'); Home = (Join-Path $UserProfile 'ZCodeFourthHome') }
+}
+
+function Get-BotCredentialSha8 {
+    param([string]$CredentialsPath, [string]$CredentialRef)
+    if (-not (Test-Path -LiteralPath $CredentialsPath)) { return '' }
+    try { $creds = Get-Content -LiteralPath $CredentialsPath -Raw | ConvertFrom-Json }
+    catch { return '' }
+    $prop = $creds.PSObject.Properties[$CredentialRef]
+    if ($null -eq $prop) { return '' }
+    $val = [string]$prop.Value
+    if ([string]::IsNullOrEmpty($val)) { return '' }
+    $bytes = [System.Text.Encoding]::UTF8.GetBytes($val)
+    $sha = [System.Security.Cryptography.SHA256]::Create()
+    try { $hash = $sha.ComputeHash($bytes) }
+    finally { if ($sha) { $sha.Dispose() } }
+    return ([BitConverter]::ToString($hash).Replace('-', '').ToLowerInvariant()).Substring(0, 8)
+}
+
+function Get-HomeTelegramBots {
+    param([string]$Name, [hashtable]$Paths)
+    $result = @()
+    $credsPath = Join-Path $Paths.ZCode 'v2\credentials.json'
+    foreach ($cfgName in @('v2\bot-config.json', 'v2\bot-config.v3.json')) {
+        $cfgPath = Join-Path $Paths.ZCode $cfgName
+        if (-not (Test-Path -LiteralPath $cfgPath)) { continue }
+        try { $cfg = Get-Content -LiteralPath $cfgPath -Raw | ConvertFrom-Json }
+        catch { continue }
+        if ($null -eq $cfg.bots) { continue }
+        foreach ($bot in @($cfg.bots)) {
+            if ($bot.provider -ne 'telegram') { continue }
+            $sha = Get-BotCredentialSha8 -CredentialsPath $credsPath -CredentialRef ([string]$bot.credentialRef)
+            $result += [pscustomobject]@{
+                Home          = $Name
+                File          = $cfgName
+                Id            = [string]$bot.id
+                CredentialRef = [string]$bot.credentialRef
+                Enabled       = [bool]$bot.enabled
+                CredSha8      = $sha
+            }
+        }
+    }
+    return $result
+}
+
+function Get-AllTelegramBots {
+    $all = @()
+    foreach ($name in @('Primary', 'Second', 'Third', 'Fourth')) {
+        $rows = Get-HomeTelegramBots -Name $name -Paths $BotIdsByTarget[$name]
+        if ($rows) { $all += $rows }
+    }
+    return $all
+}
+
+$allBots = Get-AllTelegramBots
+Write-Host '=== Telegram bot fingerprint (sha8 only, no secrets) ===' -ForegroundColor Cyan
+foreach ($row in $allBots) {
+    Write-Host ('{0} [{1}] id={2} enabled={3} sha8={4}' -f $row.Home, $row.File, $row.Id, $row.Enabled, $row.CredSha8)
+}
+
+$failures = @()
+$primaryRows = @($allBots | Where-Object { $_.Home -eq 'Primary' -and $_.CredSha8 -ne '' })
+$primarySha8 = ''
+$primaryId = ''
+if ($primaryRows.Count -gt 0) {
+    $primarySha8 = $primaryRows[0].CredSha8
+    $primaryId = $primaryRows[0].Id
+}
+
+foreach ($name in @('Primary', 'Second', 'Third', 'Fourth')) {
+    $homeRows = @($allBots | Where-Object { $_.Home -eq $name })
+    if ($homeRows.Count -eq 0) { continue }
+    $flags = @($homeRows | ForEach-Object { $_.Enabled } | Select-Object -Unique)
+    if ($flags.Count -gt 1) {
+        $detail = ($homeRows | ForEach-Object { ('{0}={1}' -f $_.File, $_.Enabled) }) -join ', '
+        $failures += ('{0}: v2/v3 enabled mismatch ({1})' -f $name, $detail)
+    }
+}
+
+foreach ($name in @('Second', 'Third', 'Fourth')) {
+    $homeRows = @($allBots | Where-Object { $_.Home -eq $name })
+    foreach ($row in $homeRows) {
+        if ($row.Enabled -and $primarySha8 -ne '' -and $row.CredSha8 -eq $primarySha8) {
+            $failures += ('{0} [{1}]: duplicate of Primary credential sha8={2} while enabled (HTTP 409 risk)' -f $name, $row.File, $row.CredSha8)
+        }
+        if ($row.Enabled -and $primaryId -ne '' -and $row.Id -eq $primaryId) {
+            $failures += ('{0} [{1}]: duplicate of Primary bot id while enabled (HTTP 409 risk)' -f $name, $row.File)
+        }
+    }
+}
+
+if ($failures.Count -gt 0) {
+    Write-Host '' ; Write-Host '[GUARD] FAILURES:' -ForegroundColor Red
+    foreach ($f in ($failures | Select-Object -Unique)) { Write-Host ('  - {0}' -f $f) -ForegroundColor Red }
+}
+else {
+    Write-Host '' ; Write-Host '[GUARD] OK: v2/v3 agree, no clone duplicates Primary.' -ForegroundColor Green
+}
+
+if ($VerifyOnly -or (-not $Fix)) {
+    if ($failures.Count -gt 0) { exit 1 }
+    exit 0
+}
+
+$targets = @()
+if ($Target -eq 'All') { $targets = @('Primary', 'Second', 'Third', 'Fourth') }
+else { $targets = @($Target) }
+
+$timestamp = Get-Date -Format 'yyyyMMdd_HHmmss'
+$audit = @()
+$actions = @()
+$overallOk = $true
+$noBom = New-Object System.Text.UTF8Encoding $false
+
+foreach ($name in $targets) {
+    $paths = $BotIdsByTarget[$name]
+    $roaming = $paths.Roaming
+    $zcode = $paths.ZCode
+    $backupRoot = Join-Path $roaming ('ID_Backups\telegram_guardian_' + $timestamp)
+    New-Item -ItemType Directory -Path $backupRoot -Force | Out-Null
+    foreach ($cfgName in @('v2\bot-config.json', 'v2\bot-config.v3.json')) {
+        $cfgPath = Join-Path $zcode $cfgName
+        if (-not (Test-Path -LiteralPath $cfgPath)) {
+            Add-AuditEntry -Audit ([ref]$audit) -File $cfgPath -Key 'telegram-enabled' -Before 'missing' -After 'skipped' -Ok $true
+            continue
+        }
+        $dest = Backup-FileToTimestampDir -Source $cfgPath -BackupRoot $backupRoot -Label ([System.IO.Path]::GetFileName($cfgPath))
+        if ($dest) {
+            $actions += [ordered]@{ action = 'copy'; originalPath = $cfgPath; backupPath = $dest; renamedPath = $null }
+        }
+        try { $cfg = Get-Content -LiteralPath $cfgPath -Raw | ConvertFrom-Json }
+        catch {
+            Add-AuditEntry -Audit ([ref]$audit) -File $cfgPath -Key 'telegram-enabled' -Before 'parse-failed' -After 'skipped' -Ok $false
+            $overallOk = $false
+            continue
+        }
+        $changed = $false
+        foreach ($bot in @($cfg.bots)) {
+            if ($bot.provider -ne 'telegram') { continue }
+            $before = [bool]$bot.enabled
+            $want = $before
+            if ($name -eq 'Primary') { $want = $true }
+            else {
+                $sha = Get-BotCredentialSha8 -CredentialsPath (Join-Path $zcode 'v2\credentials.json') -CredentialRef ([string]$bot.credentialRef)
+                $isDup = $false
+                if ($primarySha8 -ne '' -and $sha -eq $primarySha8) { $isDup = $true }
+                if ($primaryId -ne '' -and ([string]$bot.id) -eq $primaryId) { $isDup = $true }
+                if ($isDup) { $want = $false }
+                else {
+                    if ($sha -eq '') { $want = $false }
+                    else { $want = $before }
+                }
+            }
+            if ($want -ne $before) { $bot.enabled = $want; $changed = $true }
+            Add-AuditEntry -Audit ([ref]$audit) -File $cfgPath -Key ('telegram:' + [string]$bot.id) -Before ('enabled=' + [string]$before) -After ('enabled=' + [string]$want) -Ok $true
+        }
+        if ($changed) {
+            [System.IO.File]::WriteAllText($cfgPath, ($cfg | ConvertTo-Json -Depth 20), $noBom)
+        }
+        try { Get-Content -LiteralPath $cfgPath -Raw | ConvertFrom-Json | Out-Null }
+        catch { $overallOk = $false }
+    }
+    if ($name -ne 'Primary') {
+        $homeRows = @(Get-HomeTelegramBots -Name $name -Paths $paths)
+        $uniqueRow = $homeRows | Where-Object { $_.CredSha8 -ne '' -and $_.CredSha8 -ne $primarySha8 -and $_.Id -ne $primaryId } | Select-Object -First 1
+        if ($uniqueRow) {
+            $marker = Join-Path $paths.Home '.telegram-routed'
+            $markerText = 'v2 unique-bot sha8=' + $uniqueRow.CredSha8 + ' id=' + $uniqueRow.Id
+            [System.IO.File]::WriteAllText($marker, $markerText, $noBom)
+            Write-Host ('[marker] {0}: unique bot, wrote v2 marker (launcher preserves enabled).' -f $name) -ForegroundColor Green
+        }
+    }
+}
+
+$auditPath = Join-Path $backupRoot 'audit_telegram_guardian.json'
+Write-AuditLog -Audit $audit -Path $auditPath
+$restorePath = New-RestoreScript -BackupRoot $backupRoot -App 'ZCodeTelegram' -Actions $actions
+Write-Host ('[audit] {0}' -f $auditPath) -ForegroundColor Cyan
+Write-Host ('[restore] {0}' -f $restorePath) -ForegroundColor Cyan
+
+$finalBots = Get-AllTelegramBots
+$finalFailures = @()
+foreach ($name in @('Primary', 'Second', 'Third', 'Fourth')) {
+    $homeRows = @($finalBots | Where-Object { $_.Home -eq $name })
+    if ($homeRows.Count -eq 0) { continue }
+    $flags = @($homeRows | ForEach-Object { $_.Enabled } | Select-Object -Unique)
+    if ($flags.Count -gt 1) { $finalFailures += ('{0}: v2/v3 still mismatched' -f $name); $overallOk = $false }
+}
+$primaryFinal = @($finalBots | Where-Object { $_.Home -eq 'Primary' -and $_.Enabled })
+if ($primaryFinal.Count -eq 0) { $finalFailures += 'Primary: no enabled telegram bot after fix'; $overallOk = $false }
+foreach ($name in @('Second', 'Third', 'Fourth')) {
+    if ($primarySha8 -eq '') { continue }
+    $dups = @($finalBots | Where-Object { $_.Home -eq $name -and $_.Enabled -and ($_.CredSha8 -eq $primarySha8 -or $_.Id -eq $primaryId) })
+    if ($dups.Count -gt 0) { $finalFailures += ('{0}: still duplicates Primary while enabled' -f $name); $overallOk = $false }
+}
+if ($finalFailures.Count -gt 0) {
+    foreach ($f in $finalFailures) { Write-Host ('[FAILED] {0}' -f $f) -ForegroundColor Red }
+    exit 1
+}
+if (-not $overallOk) { exit 1 }
+Write-Host '[GUARD] Fix verified: Primary enabled in v2+v3, clones disabled unless unique.' -ForegroundColor Green
+exit 0
+
diff --git a/tools/update_ghost.ps1 b/tools/update_ghost.ps1
index d6813cf..4841a6a 100644
--- a/tools/update_ghost.ps1
+++ b/tools/update_ghost.ps1
@@ -22,6 +22,10 @@
      reset --hard. A failed fetch, a setup failure or a declined overwrite
      removes the temporary .git again, leaving the ZIP folder untouched.
      Verify-after re-reads HEAD == origin before the normal update flow runs.
+     The same conversion path runs when the folder IS inside a work tree but
+     the work tree's top level is a PARENT repo (Download ZIP extracted inside
+     another repository) - rev-parse alone would answer 'true' against the
+     parent, and the update flow would pull/reset that parent instead.
   4. Git present + a git clone -> the classic flow: fetch origin
      (--tags --prune), compare HEAD with the remote default branch, list the
      new commits; without -CheckOnly ask before a git pull --ff-only.
@@ -75,8 +79,17 @@ function Invoke-Git {
   param([string[]]$GitArguments)
   $outFile = Join-Path $env:TEMP ('ghost-upd-out-' + [Guid]::NewGuid().ToString('N') + '.txt')
   $errFile = Join-Path $env:TEMP ('ghost-upd-err-' + [Guid]::NewGuid().ToString('N') + '.txt')
+  # Windows PowerShell 5.1 joins a string[] -ArgumentList with spaces WITHOUT
+  # quoting, so any argument containing whitespace (e.g. a stash message)
+  # splits into separate tokens and git reads the tail as pathspecs. Pass one
+  # pre-quoted command line instead - a single string argument is used verbatim.
+  $cmdLine = @()
+  foreach ($arg in $GitArguments) {
+    if ($arg -match '\s') { $cmdLine += ('"' + ($arg -replace '"', '\"') + '"') }
+    else { $cmdLine += $arg }
+  }
   try {
-    $proc = Start-Process -FilePath 'git' -ArgumentList $GitArguments -WorkingDirectory $RepoRoot `
+    $proc = Start-Process -FilePath 'git' -ArgumentList ($cmdLine -join ' ') -WorkingDirectory $RepoRoot `
       -NoNewWindow -Wait -PassThru -RedirectStandardOutput $outFile -RedirectStandardError $errFile
     $out = @()
     $err = @()
@@ -111,6 +124,20 @@ function Test-GhostShape {
     (Test-Path -LiteralPath (Join-Path $Root 'tools\update_ghost.ps1') -PathType Leaf)
 }
 
+function Test-OwnWorkTree {
+  # True only when the git work tree found from the CWD is the GHOST folder
+  # ITSELF. A Download-ZIP copy extracted inside another repo (e.g.
+  # <projects-repo>\ghost-main\) answers --is-inside-work-tree with 'true'
+  # against the PARENT repo - the update flow would then pull/reset in that
+  # parent. git prints the top level with forward slashes; compare
+  # case-insensitively (Windows) after normalizing separators.
+  param([string]$Root)
+  $top = Invoke-Git 'rev-parse','--show-toplevel'
+  if ($top.ExitCode -ne 0 -or $top.StdOut.Count -eq 0) { return $false }
+  $gitTop = $top.StdOut[0].Trim().Replace('/', '\').TrimEnd('\')
+  return ($gitTop -ieq $Root.TrimEnd('\'))
+}
+
 function Remove-GhostPathRobust {
   # Deletes a path this session created, surviving transient Windows locks
   # (a just-exited git.exe / credential helper) and read-only attributes.
@@ -509,7 +536,20 @@ try {
   Write-Host '  [ok] git on PATH' -ForegroundColor Green
 
   $inTree = Invoke-Git 'rev-parse','--is-inside-work-tree'
-  if ($inTree.ExitCode -ne 0 -or $inTree.StdOut.Count -eq 0 -or $inTree.StdOut[0].Trim() -ne 'true') {
+  $inTreeOk = ($inTree.ExitCode -eq 0 -and $inTree.StdOut.Count -gt 0 -and $inTree.StdOut[0].Trim() -eq 'true')
+  $ownTree = $false
+  if ($inTreeOk) {
+    # 'true' alone is NOT enough: a ZIP copy inside a parent repo also answers
+    # true (git walks up). The top level must be the GHOST folder itself.
+    $ownTree = Test-OwnWorkTree -Root $RepoRoot
+  }
+  if ($ownTree) {
+    Write-Host '  [ok] inside a git work tree' -ForegroundColor Green
+  }
+  else {
+    if ($inTreeOk) {
+      Write-Host '  [warn] this GHOST folder sits inside ANOTHER repository''s work tree - treating it as a Download ZIP copy.' -ForegroundColor Yellow
+    }
     if (-not (Test-GhostShape -Root $RepoRoot)) {
       Write-Host ("  [FAILED] {0} is not a git work tree - re-clone the repo:" -f $RepoRoot) -ForegroundColor Red
       Write-Host ("           git clone {0}" -f $OriginUrl) -ForegroundColor Gray
@@ -520,9 +560,6 @@ try {
     if ($convResult -eq 'aborted') { exit 0 }
     # 'converted' -> fall through into the normal update flow
   }
-  else {
-    Write-Host '  [ok] inside a git work tree' -ForegroundColor Green
-  }
 
   $remote = Invoke-Git 'remote','get-url','origin'
   if ($remote.ExitCode -ne 0 -or $remote.StdOut.Count -eq 0) {
diff --git a/tools/watch_zcode_captcha.ps1 b/tools/watch_zcode_captcha.ps1
index 3597d60..cf337c3 100644
--- a/tools/watch_zcode_captcha.ps1
+++ b/tools/watch_zcode_captcha.ps1
@@ -227,7 +227,8 @@ function Save-WatchState {
     $kept = @()
     foreach ($c in @($State.continues)) {
         try {
-            if ([datetime]([string]$c).Split("|")[1] -ge $pruneCut) { $kept += $c }
+            $stampUtc = [DateTimeOffset]::Parse((([string]$c).Split("|"))[1], [System.Globalization.CultureInfo]::InvariantCulture).UtcDateTime
+            if ($stampUtc -ge $pruneCut) { $kept += $c }
         }
         catch { }
     }
@@ -254,13 +255,33 @@ function Read-NewLogLines {
         [System.IO.FileShare]::ReadWrite)
     try {
         if ($Offset -gt $stream.Length) { $Offset = 0 }  # truncated/rotated
+        $length = [int]($stream.Length - $Offset)
+        if ($length -le 0) { return @{ Lines = @(); Offset = $Offset } }
         $null = $stream.Seek($Offset, [System.IO.SeekOrigin]::Begin)
-        $reader = New-Object System.IO.StreamReader($stream)
-        $text = $reader.ReadToEnd()
-        $reader.Close()
-        $newOffset = (Get-Item -LiteralPath $Path).Length
+        $buf = New-Object byte[] $length
+        $read = $stream.Read($buf, 0, $length)
+        if ($read -le 0) { return @{ Lines = @(); Offset = $Offset } }
+        if ($Offset -eq 0 -and $read -ge 3 -and $buf[0] -eq 239 -and $buf[1] -eq 187 -and $buf[2] -eq 191) {
+            $Offset = 3; $length = $read - 3
+            $tail = New-Object byte[] $length
+            [Array]::Copy($buf, 3, $tail, 0, $length)
+            $buf = $tail
+            $read = $length
+        }
+        # Consume only up to the LAST complete newline: the agent appends
+        # concurrently, so a trailing partial line (or partial multi-byte char)
+        # must stay unconsumed and be re-read complete on the next pass. The
+        # offset advances by the bytes actually consumed - never by a file
+        # length probed afterwards (the old Get-Item length skipped anything
+        # appended between ReadToEnd and the probe).
+        $lastNl = -1
+        for ($i = $read - 1; $i -ge 0; $i--) {
+            if ($buf[$i] -eq 10) { $lastNl = $i; break }
+        }
+        if ($lastNl -lt 0) { return @{ Lines = @(); Offset = $Offset } }
+        $text = [System.Text.Encoding]::UTF8.GetString($buf, 0, $lastNl + 1)
         $lines = @($text -split "`r?`n" | Where-Object { $_ -ne "" })
-        return @{ Lines = $lines; Offset = $newOffset }
+        return @{ Lines = $lines; Offset = ($Offset + $lastNl + 1) }
     }
     finally {
         $stream.Close()
@@ -469,15 +490,17 @@ function Test-ContinueAllowed {
         [Parameter(Mandatory = $true)][datetime]$Now
     )
     if ($NoAutoContinue) { return $false }
-    # Stamps are stored UTC ("...Z"); $Now arrives local (Get-Date). Normalize
-    # the cutoff to UTC or the tick comparison skews by the timezone offset
-    # and the hourly cap fires on the wrong window.
+    # Stamps are stored UTC ("...Z"); $Now arrives local (Get-Date). Parse the
+    # stamps as UTC explicitly - a bare [datetime] cast turns a Z-suffixed
+    # string into LOCAL time, skewing the tick comparison against the UTC
+    # cutoff by the timezone offset (the cap under-counts west of UTC).
     $cut = $Now.ToUniversalTime().AddHours(-1)
     $recent = 0
     foreach ($c in @($State.continues)) {
         try {
             $parts = ([string]$c).Split("|")
-            if (($parts[0] -ceq $Session) -and ([datetime]$parts[1] -ge $cut)) {
+            $stampUtc = [DateTimeOffset]::Parse($parts[1], [System.Globalization.CultureInfo]::InvariantCulture).UtcDateTime
+            if (($parts[0] -ceq $Session) -and ($stampUtc -ge $cut)) {
                 $recent++
             }
         }
@@ -552,6 +575,12 @@ function Invoke-SessionContinue {
             continue
         }
         $argList = @("`"$cli`"", "--resume", $p.session, "--prompt", $ResumeMessage, "--surface", "desktop")
+        # PS 5.1 joins a string[] -ArgumentList with spaces WITHOUT quoting, so
+        # the resume prompt (which contains spaces) must be pre-quoted or it
+        # splits into separate argv tokens. $cli is already quoted above.
+        $argList = @($argList | ForEach-Object {
+            if ($_ -match '\s' -and $_ -notmatch '^".*"$') { '"' + ($_ -replace '"', '\"') + '"' } else { $_ }
+        })
         $stamp = $Now.ToString("yyyyMMdd_HHmmss")
         $outLog = Join-Path $StateDir ("resume_" + $stamp + ".out.log")
         $errLog = Join-Path $StateDir ("resume_" + $stamp + ".err.log")
@@ -838,6 +867,10 @@ function Invoke-WatchPass {
 }
 
 # ---------- Main ----------
+# Resident console title: makes the window self-identifying no matter how it
+# was launched - a duplicate copy flash-closing via the guard below still
+# shows what it was (same pattern as watch_zcode_taskbar.ps1).
+try { $Host.UI.RawUI.WindowTitle = 'ZCode Captcha Watchdog (pid {0})' -f $PID } catch { }
 Write-Host "=== ZCode captcha watchdog ===" -ForegroundColor Cyan
 Write-Host "Leave this window OPEN (minimize it if you like). Closing it stops the watch." -ForegroundColor Yellow
 Write-Host ("LogDir : " + $LogDir) -ForegroundColor Gray
@@ -898,6 +931,41 @@ if ($RunOnce) {
     exit 0
 }
 
+# Single-instance guard (mirrors watch_zcode_taskbar.ps1): a startup process
+# scan first, then a named mutex. Two resident watchdogs on the shared state
+# file would double-fire restarts and Telegram escalations. The mutex only
+# serializes copies of THIS script version - a stale older copy (different or
+# absent mutex name) is caught by the scan instead. -RunOnce always runs
+# (above): it is a deliberate one-shot diagnostic.
+function Get-OtherWatchdogPids {
+    $leaf = (Split-Path -Leaf $PSCommandPath).ToLowerInvariant()
+    $found = @()
+    $procs = @(Get-CimInstance Win32_Process -Filter "Name='powershell.exe' OR Name='pwsh.exe'" -ErrorAction SilentlyContinue -OperationTimeoutSec 5)
+    foreach ($p in $procs) {
+        if ([int]$p.ProcessId -eq $PID) { continue }
+        if ($p.CommandLine -and $p.CommandLine.ToLowerInvariant().Contains($leaf)) { $found += [int]$p.ProcessId }
+    }
+    return $found
+}
+
+$others = Get-OtherWatchdogPids
+if ($others.Count -gt 0) {
+    Write-Host ("watchdog already running (pid {0}) - exiting. Close that console or stop the pid first." -f ($others -join ', ')) -ForegroundColor Yellow
+    exit 0
+}
+
+$created = $false
+$mutex = New-Object System.Threading.Mutex($true, 'ZcodeCaptchaWatchdog', [ref]$created)
+if (-not $created) {
+    $holder = Get-OtherWatchdogPids
+    $who = ''
+    if ($holder.Count -gt 0) { $who = ' by pid ' + ($holder -join ', ') }
+    Write-Host ("watchdog already running (mutex held{0}) - exiting. Check Task Manager or the log." -f $who) -ForegroundColor Yellow
+    $mutex.Close()
+    exit 0
+}
+Write-WatchLog ("watchdog started (pid {0}, poll {1}s)" -f $PID, $PollSeconds) -Milestone
+
 try {
     while ($true) {
         $state = Invoke-WatchPass -State $state
@@ -907,5 +975,7 @@ try {
     }
 }
 finally {
+    $mutex.ReleaseMutex()
+    $mutex.Close()
     Save-WatchState -State $state
 }
diff --git a/tools/watch_zcode_taskbar.ps1 b/tools/watch_zcode_taskbar.ps1
index c8eee2d..ab50103 100644
--- a/tools/watch_zcode_taskbar.ps1
+++ b/tools/watch_zcode_taskbar.ps1
@@ -107,6 +107,7 @@ public class ZcodeWindowAumid {
         void Commit();
     }
     [DllImport("shell32.dll")] public static extern int SHGetPropertyStoreForWindow(IntPtr hwnd, ref Guid riid, [MarshalAs(UnmanagedType.Interface)] out IPropertyStore store);
+    [DllImport("oleaut32.dll")] public static extern int PropVariantClear(ref PROPVARIANT pv);
     public static readonly PROPERTYKEY PKEY_AUMID = new PROPERTYKEY { fmtid = new Guid("9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3"), pid = 5 };
     static Guid IID_IPropertyStore = new Guid("886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99");
     // Stamp + read back; returns what the store actually holds.
@@ -132,9 +133,15 @@ public class ZcodeWindowAumid {
         PROPVARIANT back;
         var key = PKEY_AUMID;
         store.GetValue(ref key, out back);
-        if (back.vt == 31) return Marshal.PtrToStringUni(back.pointerValue);
-        if (back.vt == 0) return "<EMPTY>";
-        return "<readback vt=" + back.vt + ">";
+        // VT_LPWSTR is CoTaskMem-allocated by the property store: copy the
+        // string out first, then free the variant, or the resident watcher
+        // leaks on every 5 s read.
+        string result;
+        if (back.vt == 31) result = Marshal.PtrToStringUni(back.pointerValue);
+        else if (back.vt == 0) result = "<EMPTY>";
+        else result = "<readback vt=" + back.vt + ">";
+        PropVariantClear(ref back);
+        return result;
     }
 }
 "@