diff --git a/MAINTAINER.md b/MAINTAINER.md
index 3368f1ba..92948b37 100644
--- a/MAINTAINER.md
+++ b/MAINTAINER.md
@@ -46,7 +46,7 @@ src/
     sqlite.mjs           # node:sqlite helpers (scalar, checkpoint, withDb)
     versions.mjs         # installedVersion, driftReport, KIT_PKG
     ruvnet-brain.mjs     # RuvNet Brain: on-disk detection + GitHub-release drift (NOT an npm pkg)
-    blocks.mjs           # CLAUDE.md / AGENTS.md managed-block registry + syncBlocks
+    blocks.mjs           # managed-block registry + syncBlocks + guidanceTargets (3 targets: ~/.claude/CLAUDE.md, project AGENTS.md, ~/.codex/AGENTS.md)
     hosts.mjs            # host-adapter core: drivingHost() + HOST_ADAPTERS (guidance file, auth, statusline)
     providers.mjs        # frontier-host + LLM-provider detect/wire (hosts, auth, MCP bridges, aqe router)
     routing.mjs          # pure dual-host routing policy: defaults, projections, primary-host swap
diff --git a/README.md b/README.md
index 1a4da53c..fc04d3ff 100644
--- a/README.md
+++ b/README.md
@@ -66,12 +66,12 @@ What the verbs cover:
 
 | Verb | What it does |
 | ------ | -------------- |
-| **setup** | Installs/updates ruflo + agentic-qe + the **agentdb** CLI globally (handling npm ≥11.17's `allow-scripts` so natives build; agentdb is pinned to ruflo's bundled version so the shared learning store stays coherent), installs the **RuvNet Brain** (an offline knowledge base over the rUv stack, powering the `search_ruvnet` MCP — a ~2 GB one-time download, prompted; skip with `--no-ruvnet-brain`), deploys the token-audit skill, merges the managed guidance blocks into `~/.claude/CLAUDE.md`, offers one-time MCP registration (user scope, with a tool-family picker), and — inside a repo — initializes the project: sanitized `ruflo init`, absolute memory-path pin, a **verified** store→disk write, statusline footer, and a background daemon with **local-only ($0) workers** (token-spending AI workers stay opt-in behind upstream's machine-wide budget). Project scope triggers on a `.git` directory in the current folder; without one it's skipped with a note. `--project` forces it anyway (e.g. a not-yet-`git init`-ed folder), `--minimal` skips it, `--yes` accepts all prompts (non-interactive), `--no-aqe` / `--no-ruvnet-brain` / `--no-security` disable those subsystems, and `--reconfigure` re-offers MCP registration. `--codex` enables + installs the Codex host during setup (dual-mode; both hosts then run at once), and `--primary-host claude\|codex` picks which host leads (codex implies `--codex`). |
-| **status** | Per-subsystem ✓/⚠/✗ (versions, the kit's own version, **ruvnet-brain** (present + release drift, or "not installed"), natives, security, learning, aqe/RVF, **agentdb** (CLI present + coherent with ruflo's bundled version, or a store-skew warning), MCP, **hosts** (claude/codex — version + install method + **auth mode** (subscription $0 vs metered api-key), with the **primary** host marked and a *fail* when the primary host is absent), **providers** (host wiring + aqe fallback chain, or "drifted"/claude-only default), **routing** (per-activity Claude/Codex host+model policy, when dual-host — with drift vs the on-disk `agentOverrides`), daemons, CLAUDE.md blocks, statusline), each drift row naming what `sync` would do about it — plus a **health-history** line that flags regressions since the last sync (learning shrank, native slots dropped, drift/security backslid). |
+| **setup** | Installs/updates ruflo + agentic-qe + the **agentdb** CLI globally (handling npm ≥11.17's `allow-scripts` so natives build; agentdb is pinned to ruflo's bundled version so the shared learning store stays coherent), installs the **RuvNet Brain** (an offline knowledge base over the rUv stack, powering the `search_ruvnet` MCP — a ~2 GB one-time download, prompted; skip with `--no-ruvnet-brain`), deploys the token-audit skill, merges the managed guidance blocks into the machine-wide guidance files (`~/.claude/CLAUDE.md`, plus `~/.codex/AGENTS.md` on codex machines), offers one-time MCP registration (user scope, with a tool-family picker), and — inside a repo — initializes the project: sanitized `ruflo init`, absolute memory-path pin, a **verified** store→disk write, statusline footer, and a background daemon with **local-only ($0) workers** (token-spending AI workers stay opt-in behind upstream's machine-wide budget). Project scope triggers on a `.git` directory in the current folder; without one it's skipped with a note. `--project` forces it anyway (e.g. a not-yet-`git init`-ed folder), `--minimal` skips it, `--yes` accepts all prompts (non-interactive), `--no-aqe` / `--no-ruvnet-brain` / `--no-security` disable those subsystems, and `--reconfigure` re-offers MCP registration. `--codex` enables + installs the Codex host during setup (dual-mode; both hosts then run at once), and `--primary-host claude\|codex` picks which host leads (codex implies `--codex`). |
+| **status** | Per-subsystem ✓/⚠/✗ (versions, the kit's own version, **ruvnet-brain** (present + release drift, or "not installed"), natives (agentdb copies **and** ruflo's own memory runtime — the one `npx ruflo memory` loads — load-tested for a native better-sqlite3, not just the agentdb dirs), **memory-pin** (warns when `CLAUDE_FLOW_DB_PATH` points off the live DB), security, learning, aqe/RVF, **agentdb** (CLI present + coherent with ruflo's bundled version, or a store-skew warning), MCP, **hosts** (claude/codex — version + install method + **auth mode** (subscription $0 vs metered api-key), with the **primary** host marked and a *fail* when the primary host is absent), **providers** (host wiring + aqe fallback chain, or "drifted"/claude-only default), **routing** (per-activity Claude/Codex host+model policy, when dual-host — with drift vs the on-disk `agentOverrides`), daemons, guidance-file blocks (`~/.claude/CLAUDE.md`, project `AGENTS.md`, and `~/.codex/AGENTS.md` on codex machines), statusline), each drift row naming what `sync` would do about it — plus a **health-history** line that flags regressions since the last sync (learning shrank, native slots dropped, drift/security backslid). |
 | **sync** | The one convergence verb: upgrades first when a new release exists, then re-heals everything an upgrade wipes, then re-checks and reports. Included in that heal: it **installs any enabled frontier host** (claude/codex) that's entirely absent — never touching an external (mise/brew/native) install — and **re-applies provider wiring** (the `ENABLE_*` host env, the aqe fallback chain, and ruflo API providers) whenever it has drifted — and, on a dual-host project, **seeds/heals the per-activity routing policy** (materializing it into agentic-qe's `agentOverrides`, e.g. after an aqe upgrade first makes it eligible). It also **installs/repins the standalone `agentdb` CLI** to ruflo's bundled version (keeping the shared cognitive store coherent) and appends a **health-history snapshot** so `status` can flag regressions across syncs. It also **re-runs the RuvNet Brain installer** to pull the latest release when the on-disk KB has drifted (or installs it if absent, when enabled). It also **self-updates the kit**: when a newer `@pacphi/agentic-kit` exists it installs it as the *last* step (the new code applies from the next `ak` run, never mid-sync). Prerelease installs (`4.0.0-alpha.*`) track the `next` npm dist-tag as well as `latest`, so alphas see their successors; stable installs only ever follow `latest`. `--no-upgrade` skips the self-update along with the package upgrades. |
 | **dashboard** | Opens a read-only local web dashboard (`127.0.0.1:7431`, localhost-only, never detaches) that renders the same subsystem view as `ak status` in an Apple-style five-tab layout — **Overview · Hosts & Routing · Providers · Runtime · Intelligence** — with count badges on any tab holding a failing/warning subsystem. Problems never hide behind a tab: Overview aggregates every attention card, a quiet update notice, and a jump-to status map of all subsystems; Providers shows the **models in play** (distinct host+model pairs from your routing policy); Hosts & Routing carries the **per-activity routing matrix** (vendor-coded Claude/Codex host + model per activity) when dual-host routing is configured; Intelligence keeps the learning-over-time strip. Fully self-contained and offline (no external fetches, nothing leaves your machine). **Auto-opens your browser** (`--no-open` to just print the URL for headless/SSH); `--port N` to change the port; tabs deep-link (`#providers`) and persist. Stop with Ctrl-C. (Also available as `ak x dashboard`.) |
 | **admin** | Opens the **maintainer admin** (`127.0.0.1:7432`, localhost-only, foreground) — the project-telemetry sibling of `dashboard`: unique repo visitors and cloners (GitHub traffic API, needs a push-access token via `GITHUB_TOKEN`/`GH_TOKEN`/`gh auth token` — panels degrade honestly without one), npm download momentum (last 7d vs prior 7d, sparklines), release pulls, a **"since you last looked"** delta strip over a local baseline, open issues/PRs from others (oldest first), and external humans ranked by recency (bots excluded). Access is gated by a **per-session token** carried in the URL fragment and sent header-only; the page makes **zero external fetches** (the server proxies GitHub/npm; your credential never reaches the page or the payload — ADR-0007). Where `dashboard` is offline-first, `admin` does deliberate GitHub/npm egress — that contract split is why they're siblings, not tabs. `--port N`, `--no-open`; Ctrl-C stops. (Also available as `ak x admin`.) |
-| **dual** | Runs a **Claude + Codex collaboration swarm** using your per-activity routing policy: `ak dual run <template> "<task>"` materializes a dual-run config (each pipeline step assigned to the host + model your policy chose) and drives it via `claude-flow-codex`. Templates: `feature`, `security`, `refactor`, `packaging`, `release`. `--dry-run` prints the plan + config without running; `--route 'activity:host[:model]'` overrides one step for that run; `--escalate` retries once up the cross-vendor ladder on failure. Requires dual-host enabled (`ak setup --codex`, or `ak x provider pick --host claude,codex`). |
+| **dual** | Runs a **Claude + Codex collaboration swarm** using your per-activity routing policy: `ak dual run <template> "<task>"` materializes a dual-run config (each pipeline step assigned to the host + model your policy chose) and drives it via `claude-flow-codex`. Templates: `feature`, `security`, `refactor`, `packaging`, `release`. `--dry-run` prints the plan + config without running; `--route 'activity:host[:model]'` overrides one step for that run; `--escalate` retries once up the cross-vendor ladder on failure. Requires dual-host enabled (`ak setup --codex`, or `ak x provider pick --host claude,codex`). **Pre-flight refusal:** before spawning a worker, `dual run` refuses to start when ruflo's memory runtime lacks a native better-sqlite3 binding **and** the shared DB has an active native WAL (`-wal`/`-shm` sidecars) — the native WAL writer and the WASM `ruflo memory store` cannot share that DB without corrupting it; the fix is `ak sync` (builds the native binding), then retry. |
 | **uninstall** | Removes the kit's footprint (and any legacy shell-kit install); project data is never touched; `--purge` also offers to remove the global packages. |
 
 Power-user mechanisms live under `ak x …` (`daemon-gc`, `harvest`,
diff --git a/claude/dual-mode-reference.md b/claude/dual-mode-reference.md
index c9770557..08ad73ee 100644
--- a/claude/dual-mode-reference.md
+++ b/claude/dual-mode-reference.md
@@ -1,8 +1,11 @@
 <!-- BEGIN ruflo-dual-mode-reference -->
-<!-- ruflo-dual-mode-reference: merged into the guidance files (CLAUDE.md AND AGENTS.md)
-     ONLY when BOTH hosts (claude + codex) are enabled in kit.json — i.e. dual mode is on.
-     Managed by agentic-kit / `ak sync` — stripped automatically when either host is
-     disabled. Do not hand-edit between the sentinels. -->
+<!-- ruflo-dual-mode-reference: merged into the two MACHINE-scoped guidance files —
+     ~/.claude/CLAUDE.md AND ~/.codex/AGENTS.md — ONLY when BOTH hosts (claude + codex)
+     are enabled in kit.json (i.e. dual mode is on). This is machine state, so it never
+     lands in a repo's checked-in AGENTS.md (ADR-0008). Managed by agentic-kit / `ak
+     sync` — stripped automatically when either host is disabled. The ~/.codex/AGENTS.md
+     copy only appears on machines where ~/.codex exists. Do not hand-edit between the
+     sentinels. -->
 
 ## Ambidextrous dual-host mode (claude + codex)
 
diff --git a/docs/TROUBLESHOOTING.md b/docs/TROUBLESHOOTING.md
index dffb710e..708ede5e 100644
--- a/docs/TROUBLESHOOTING.md
+++ b/docs/TROUBLESHOOTING.md
@@ -25,6 +25,8 @@ ak sync             # apply it
 | Too many `⚙` daemons / stale daemons | One daemon per active project is normal (local-only workers, $0). Stale = workspace deleted or past the 12h TTL | `ak x daemon-gc --kill`; `sync` also reaps (and verifies the pid really is a ruflo daemon before killing) |
 | Want to change which MCP tool families are callable | Exclusions are `permissions.deny` rules, persisted in kit.json | `ak x mcp pick` (re-runnable); `x mcp status` shows the inventory; `x mcp off` unregisters |
 | `ruflo memory store` says OK but reads return nothing | Absolute-DB-path pin missing, or WAL not checkpointed, or the WASM fallback above | `ak setup` in the project re-pins + verifies a real write lands on disk |
+| `status` shows a `memory-pin` warning | `CLAUDE_FLOW_DB_PATH` is pinned to a dead or foreign path, so every memory op targets the wrong DB ("Database not initialized" beside a healthy in-repo DB). The pin may be deliberate, so `sync` never touches it | repoint (or remove) the pin in `.claude/settings.local.json` `env` |
+| `ak dual run` refuses to start ("ruflo's memory runtime lacks a native better-sqlite3 binding AND … active native WAL") | Pre-flight guard: the orchestrator's native WAL writer and the WASM `ruflo memory store` would share one DB and corrupt it. It refuses **before** spawning a worker rather than crashing mid-run | `ak sync` builds the native binding for ruflo's memory runtime, then retry the `dual run` |
 | Suspicious token burn | Background automation vs interactive usage | ask Claude to run the **ruflo-token-audit** skill (deployed by `setup`) |
 | `status` shows `ruvnet-brain … not installed` | The RuvNet Brain (offline KB + `search_ruvnet` MCP) isn't on disk | `ak sync` (or `ak setup`) runs the installer; `npx ruvnet-brain --doctor` health-checks it |
 | Don't want the RuvNet Brain (the ~2 GB KB download) | It's on by default | `ak setup --no-ruvnet-brain`, or set `ruvnetBrain: false` in `~/.config/agentic-kit/kit.json` |
diff --git a/docs/UPGRADING.md b/docs/UPGRADING.md
index 2dc9085e..d0dc118f 100644
--- a/docs/UPGRADING.md
+++ b/docs/UPGRADING.md
@@ -68,8 +68,9 @@ Every `ak` command ends with a best-effort, never-blocking drift nudge. It has t
 - **Local artifact drift** (spawn-light file compares, evaluated on every run):
   `↻ drifted: 2 CLAUDE.md block(s) · codex MCP unregistered — run: ak sync`
 
-The second half covers the artifacts `ak` *renders*: managed guidance blocks in
-`~/.claude/CLAUDE.md` and the project `AGENTS.md`, the Claude↔Codex MCP bridge (both
+The second half covers the artifacts `ak` *renders*: managed guidance blocks in the
+machine-wide guidance files (`~/.claude/CLAUDE.md`, and `~/.codex/AGENTS.md` on codex
+machines), the Claude↔Codex MCP bridge (both
 directions), and the statusline footer. These can drift with **no version change at all** —
 a kit update (or, on an npm-linked dev checkout, merely merging a PR that edits a
 `claude/*.md` template) revises the source of truth, and the rendered copies lag until the
diff --git a/docs/adr/0008-guidance-target-scope-split.md b/docs/adr/0008-guidance-target-scope-split.md
new file mode 100644
index 00000000..b37aeffa
--- /dev/null
+++ b/docs/adr/0008-guidance-target-scope-split.md
@@ -0,0 +1,107 @@
+# ADR-0008 — Machine-scoped guidance blocks land in machine files, not a repo's AGENTS.md
+
+- **Status:** Accepted
+- **Date:** 2026-07-24
+- **Deciders:** agentic-kit maintainers
+
+## Context
+
+`ak` renders managed sentinel blocks into guidance files via the registry in
+`src/lib/blocks.mjs`. Each registry row carries `guidanceFiles` — logical target names —
+and `sync`/`status` loop those targets, resolving each to a path. Until now there were two
+targets, and both `src/commands/sync.mjs` and `src/commands/status.mjs` carried the **same
+literal list**:
+
+- `claude` → machine-wide `~/.claude/CLAUDE.md`
+- `agents` → the **project's** `<cwd>/AGENTS.md`
+
+Exactly one row targeted `agents`: `ruflo-dual-mode-reference`, gated on
+`bothHostsEnabled(cfg)` (both `claude` and `codex` enabled in `kit.json`). Its content is
+**machine state** — "this machine runs dual-host, here is the bridge and the routing." A
+project's `AGENTS.md` is checked into git. So `ak sync` on a dual-host machine wrote a
+machine truth into a repo's shared history — and it did: commit `371da30` committed the
+dual-mode block into this repo's own `AGENTS.md`. The leak is invisible from the repo root
+and rides along in every clone.
+
+Codex reads a **user-level** guidance file at `~/.codex/AGENTS.md` (ak's host adapter
+already models codex's guidance surface, `src/lib/hosts.mjs`). That is the correct home for
+machine-scoped guidance destined for the codex host: same scope (the machine), same
+lifecycle (`kit.json` enablement), never in a repo. `~/.codex` exists on machines where
+codex is installed and **must never be created by ak** — its existence is itself the signal
+that codex is present.
+
+## Decision
+
+### 1. A third logical target: `agents-user` → `~/.codex/AGENTS.md`
+
+Machine-scoped guidance for the codex host lands in codex's **machine-wide** file, mirroring
+how `claude` guidance lands in `~/.claude/CLAUDE.md`. The `ruflo-dual-mode-reference` row
+moves to `guidanceFiles: ['claude', 'agents-user']` — machine content in machine files. The
+project `agents` target **stays** for genuinely repo-scoped rows (there are none in the
+built-in registry today; custom `kit.json` rows may still opt in), and — critically — for
+**strips** (Decision 3).
+
+### 2. One shared `guidanceTargets({ cwd, cfg })` helper — the duplicated list is gone
+
+Both commands now call `guidanceTargets` in `blocks.mjs`; the two literal lists that could
+silently disagree are replaced by one source of truth. `agents-user` is included **only when
+`~/.codex` (the directory) already exists** — a dir-exists gate, never a `mkdir`. That single
+gate covers both cases correctly:
+
+- a codex machine that is momentarily single-host still gets the target, so a stale block can
+  be **stripped** after dual mode is disabled;
+- a codex-less machine never grows a `~/.codex` and sees zero new writes (NFR-1).
+
+### 3. Re-scoped blocks are force-stripped from files they left — `retiredForTarget`
+
+Moving a block between targets is a migration: the old file still carries the sentinel. For
+each target, `sync`/`status` pass `syncBlocks` both `blocksForTarget(rows, name)` (rows that
+belong) **and** `retiredForTarget(rows, name)` (rows that do **not** belong, each rewritten
+with a detector that never fires). A retired row that is *present* is stripped; *absent* is a
+no-op. Using a never-firing detector — rather than the row's real detector — is load-bearing:
+the dual-mode row's live `flag` detector would otherwise **re-upsert** the block into the
+very project `AGENTS.md` we are trying to clear whenever dual mode is on. This is the
+mechanism that removes the leaked block (from `371da30`) on the next `ak sync` in this repo.
+
+### 4. Backup parity and no spurious writes
+
+`~/.codex/AGENTS.md` gets the same one-time `.bak`-before-first-rewrite contract as
+`~/.claude/CLAUDE.md`. `syncBlocks` writes only when content actually changes, so a
+single-host codex machine (dual block not wanted, nothing present) yields **no file and no
+backup** — the target is discovered but nothing is written.
+
+## Consequences
+
+- Machine truths stop leaking into shared git history. A dual-host machine writes the
+  dual-mode block to `~/.claude/CLAUDE.md` and `~/.codex/AGENTS.md`; a repo's checked-in
+  `AGENTS.md` is never a target for it.
+- The next `ak sync` in *this* repo strips the previously-committed dual block from
+  `AGENTS.md` — a follow-up commit that is expected and desired, not a regression.
+- Other machines self-heal: their next `ak sync` strips any project-`AGENTS.md` copy they
+  carry. No cross-repo migration tooling is needed.
+- `sync` and `status` can no longer disagree about targets — they read the same helper.
+- No behavior change on machines without `~/.codex`: same rows, same files, zero new writes.
+- Out of scope: aqe-init's own `AGENTS.md` sentinel (a different manager) and any
+  `~/.codex/config.toml` changes — this ADR is only about the guidance-block registry.
+
+## Alternatives considered
+
+- **Keep the dual block in the project `AGENTS.md`.** Rejected: it is machine state, and a
+  project file is committed — the leak is the whole reason for this record.
+- **Gate `agents-user` on `bothHostsEnabled(cfg)` instead of `~/.codex` existing.** Rejected:
+  a single-host codex machine must still be able to *strip* a stale block, and gating on
+  enablement would skip the target exactly when a strip is needed. Dir-existence is the
+  gate that makes both the write and the strip paths correct.
+- **`mkdir ~/.codex` when absent.** Rejected: `~/.codex` is codex's home; ak creating it
+  would fabricate a codex install on a machine that has none.
+- **Give retired rows their real detector.** Rejected: a live `flag` detector would re-upsert
+  the block into the file we are clearing. Retired rows must be unconditional strips.
+
+## References
+
+- `src/lib/blocks.mjs` (`guidanceTargets`, `retiredForTarget`, the re-scoped row, the
+  `.bak` mechanism), `src/lib/paths.mjs` (`codexDir`/`codexAgentsMdPath`),
+  `src/commands/sync.mjs` + `src/commands/status.mjs` (target loop), `src/lib/hosts.mjs`
+  (codex guidance surface).
+- Spec: `sparc/spec-agents-user-target.md` (Phase 1).
+- The leak: commit `371da30` ("chore: sync heals AGENTS.md dual-mode reference block").
diff --git a/docs/adr/README.md b/docs/adr/README.md
index affe3fdd..1f73718a 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -16,10 +16,14 @@ Consequences**, and cites the grounded source it rests on where relevant.
 | [0005](0005-dashboard-in-page-routing-reveal.md) | Dashboard surfaces routing via in-page reveal | Accepted |
 | [0006](0006-primary-host-and-ambidextrous-mirroring.md) | Primary host & ambidextrous mirroring (which host leads) | Accepted |
 | [0007](0007-maintainer-admin-local-telemetry.md) | Maintainer admin: a loopback telemetry page with deliberate egress | Accepted |
+| [0008](0008-guidance-target-scope-split.md) | Machine-scoped guidance blocks land in machine files, not a repo's AGENTS.md | Accepted |
 
 Theme: ADRs **0001–0006** define **dual-host LLM routing and leadership** — how `ak` lets ruflo route
 each development activity (architecture, implementation, testing, review, …) to the right host (Claude
 or Codex) and model, which host **leads** (0006), seeded on detection, tunable by the user, and surfaced
 across `setup`/`sync`/`status`/`dashboard`. **0007** covers the local diagnostic surfaces — splitting the
 offline-first `dashboard` from the deliberately-egressing, credential-touching maintainer `admin` along
-the network-egress line. See also `docs/PROVIDERS.md`.
+the network-egress line. **0008** draws a second scope line — machine-scoped guidance blocks belong in
+machine-wide files (`~/.claude/CLAUDE.md`, `~/.codex/AGENTS.md`), never a repo's checked-in `AGENTS.md` —
+and folds the two duplicated target lists into one shared `guidanceTargets` helper. See also
+`docs/PROVIDERS.md`.
diff --git a/src/commands/status.mjs b/src/commands/status.mjs
index 4cdf1465..8555ce25 100644
--- a/src/commands/status.mjs
+++ b/src/commands/status.mjs
@@ -11,7 +11,7 @@ import { scanNpxStale } from '../lib/npx.mjs';
 import { registrationStatus, codexMcpStatus, rufloCodexMcpStatus } from '../lib/mcp.mjs';
 import { listDaemons, staleDaemons } from '../lib/daemons.mjs';
 import { scanRvf } from '../lib/rvf.mjs';
-import { registry, syncBlocks, blocksForTarget } from '../lib/blocks.mjs';
+import { registry, syncBlocks, blocksForTarget, retiredForTarget, guidanceTargets } from '../lib/blocks.mjs';
 import { loadKitConfig } from '../lib/config.mjs';
 import { driftReport, selfDrift } from '../lib/versions.mjs';
 import { upstreamCveCounterFabricated, fixStatusline, helperStampStale } from '../lib/statusline.mjs';
@@ -391,28 +391,28 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
     rows.push(row('daemons', 'warn', `daemon check unavailable: ${e.message}`));
   }
 
-  // guidance-file blocks (dry-run reconcile = drift report). Two targets: the
-  // machine-wide CLAUDE.md (claude) and the project AGENTS.md (codex). The
-  // dual-mode block is gated on both hosts being enabled (flag detector), so
-  // AGENTS.md stays unmanaged/quiet until dual mode is on.
+  // guidance-file blocks (dry-run reconcile = drift report). Three targets
+  // (guidanceTargets): machine-wide ~/.claude/CLAUDE.md (claude), the project
+  // <cwd>/AGENTS.md (agents), and — only when ~/.codex exists — machine-wide
+  // ~/.codex/AGENTS.md (agents-user). The dual-mode block is gated on both hosts
+  // being enabled (flag detector), so the agents targets stay unmanaged/quiet
+  // until dual mode is on. retiredForTarget force-strips re-scoped blocks (the
+  // migration path that clears the dual block from any project AGENTS.md).
   try {
     const rowsReg = registry(cfg.customBlocks);
     const resolve = (r) => (r.custom
       ? (r.template.startsWith('~/') ? path.join(paths.home, r.template.slice(2)) : r.template)
       : path.join(pkgRoot, 'claude', r.template));
     const ctx = { flags: { dualMode: bothHostsEnabled(cfg) } };
-    const targets = [
-      { name: 'claude', label: 'CLAUDE.md', file: paths.claudeMdPath() },
-      { name: 'agents', label: 'AGENTS.md', file: path.join(cwd, 'AGENTS.md') },
-    ];
-    for (const t of targets) {
-      const treg = blocksForTarget(rowsReg, t.name);
+    for (const t of guidanceTargets({ cwd, cfg })) {
+      const treg = [...blocksForTarget(rowsReg, t.name), ...retiredForTarget(rowsReg, t.name)];
       const res = await syncBlocks(t.file, treg, resolve, { dryRun: true, context: ctx });
       const drift = res.filter((r) => r.action === 'upserted' || r.action === 'stripped');
-      // AGENTS.md is unmanaged on single-host setups — stay quiet unless there's
-      // actual drift (e.g. a block to strip after disabling dual mode).
-      if (t.name === 'agents' && !ctx.flags.dualMode && drift.length === 0) continue;
       const missing = res.filter((r) => r.action === 'missing-template');
+      // The agents targets are unmanaged on single-host setups — stay quiet
+      // unless there's actual drift (e.g. a block to strip after disabling dual
+      // mode) or a missing template. Only the claude target always reports.
+      if (t.name !== 'claude' && drift.length === 0 && missing.length === 0) continue;
       if (drift.length) {
         rows.push(row('blocks', 'warn',
           `${drift.length} ${t.label} block(s) drifted: ${drift.map((d) => `${d.slug}→${d.action.replace('ped', 'p')}`).join(', ')}`,
diff --git a/src/commands/sync.mjs b/src/commands/sync.mjs
index 866e2559..f39e31e1 100644
--- a/src/commands/sync.mjs
+++ b/src/commands/sync.mjs
@@ -5,7 +5,7 @@ import path from 'node:path';
 import { collect } from './status.mjs';
 import * as heal from '../lib/heal.mjs';
 import { fixStatusline, helperStampStale } from '../lib/statusline.mjs';
-import { registry, syncBlocks, blocksForTarget } from '../lib/blocks.mjs';
+import { registry, syncBlocks, blocksForTarget, retiredForTarget, guidanceTargets } from '../lib/blocks.mjs';
 import { register as mcpRegister, applyExclusions } from '../lib/mcp.mjs';
 import { listDaemons, staleDaemons, reap } from '../lib/daemons.mjs';
 import { loadKitConfig, saveKitConfig } from '../lib/config.mjs';
@@ -132,21 +132,22 @@ export async function run({ flags, pkgRoot }) {
     const resolve = (r) => (r.custom
       ? (r.template.startsWith('~/') ? path.join(paths.home, r.template.slice(2)) : r.template)
       : path.join(pkgRoot, 'claude', r.template));
-    // Two guidance targets: machine-wide CLAUDE.md (claude) + project AGENTS.md
-    // (codex). The dual-mode block's flag detector gates AGENTS.md on both hosts
-    // being enabled, so single-host setups leave AGENTS.md untouched (no .bak).
+    // Three guidance targets (guidanceTargets): machine-wide ~/.claude/CLAUDE.md
+    // (claude), the project's own <cwd>/AGENTS.md (agents), and — only when
+    // ~/.codex exists — machine-wide ~/.codex/AGENTS.md (agents-user). The
+    // dual-mode block's flag detector gates it on both hosts being enabled, so
+    // single-host setups leave the agents files untouched (no .bak). Each target
+    // also force-strips blocks that no longer belong in it (retiredForTarget) —
+    // the migration path that clears the dual block out of any project AGENTS.md
+    // that still carries it after the re-scope (ADR-0008).
     const ctx = { flags: { dualMode: bothHostsEnabled(cfg) } };
-    const targets = [
-      { name: 'claude', label: 'CLAUDE.md', file: paths.claudeMdPath() },
-      { name: 'agents', label: 'AGENTS.md', file: path.join(cwd, 'AGENTS.md') },
-    ];
-    for (const t of targets) {
-      const treg = blocksForTarget(rowsReg, t.name);
+    for (const t of guidanceTargets({ cwd, cfg })) {
+      const treg = [...blocksForTarget(rowsReg, t.name), ...retiredForTarget(rowsReg, t.name)];
       const res = await syncBlocks(t.file, treg, resolve, { context: ctx });
       const changed = res.filter((r) => r.action !== 'unchanged' && r.action !== 'skipped')
         .map((r) => `${r.slug} ${r.action}`).join(', ');
-      // stay quiet on the AGENTS.md target unless it actually changed (single-host
-      // leaves it unmanaged); always report the claude target.
+      // stay quiet on the agents targets unless they actually changed (single-host
+      // leaves them unmanaged); always report the claude target.
       if (t.name === 'claude' || changed) ok(`blocks(${t.label}): ${changed || 'in sync'}`);
     }
   }
diff --git a/src/lib/blocks.mjs b/src/lib/blocks.mjs
index 231df988..b8399d3f 100644
--- a/src/lib/blocks.mjs
+++ b/src/lib/blocks.mjs
@@ -16,7 +16,7 @@
 // `blocksForTarget(rows, name)`. Logical names only; paths stay a caller concern.
 import fs from 'node:fs';
 import path from 'node:path';
-import { claudeDir, home } from './paths.mjs';
+import { claudeDir, claudeMdPath, codexDir, home } from './paths.mjs';
 import { have } from './exec.mjs';
 
 export const BEGIN = (slug) => `<!-- BEGIN ${slug} -->`;
@@ -62,14 +62,16 @@ export const BUILTIN_BLOCKS = [
   {
     // Surfaces only when BOTH hosts are enabled in kit.json (dual mode) — gated
     // on a caller flag, not PATH, so it does not fire just because `codex` is
-    // installed. Lands in BOTH guidance files (CLAUDE.md + AGENTS.md) via the
-    // `guidanceFiles` fan-out. Documents `ak dual`, the Claude↔Codex bridge, and
-    // per-activity routing/escalation.
+    // installed. Its content is MACHINE state (both hosts enabled in kit.json),
+    // so it lands in the two MACHINE-scoped guidance files — ~/.claude/CLAUDE.md
+    // (claude) and ~/.codex/AGENTS.md (agents-user) — never a repo's checked-in
+    // AGENTS.md, which would leak machine truths into shared git history (ADR-0008).
+    // Documents `ak dual`, the Claude↔Codex bridge, and per-activity routing.
     slug: 'ruflo-dual-mode-reference',
     template: 'dual-mode-reference.md',
     position: 'append',
     detector: { type: 'flag', target: 'dualMode' },
-    guidanceFiles: ['claude', 'agents'],
+    guidanceFiles: ['claude', 'agents-user'],
   },
   {
     // Surfaces once the RuvNet Brain KB is on disk. `dir` supports ~/ expansion;
@@ -216,6 +218,42 @@ export function blocksForTarget(rows, targetName) {
   return rows.filter((r) => (r.guidanceFiles ?? ['claude']).includes(targetName));
 }
 
+/** Registry rows whose sentinel might linger in a target's file but which no
+ *  longer belong there (they don't list `targetName` in guidanceFiles). This is
+ *  the migration path for a RE-SCOPED block: pass these to `syncBlocks` alongside
+ *  `blocksForTarget` and they are force-stripped when present. Each returned row
+ *  carries a detector that never fires (`{type:'retired'}` → detect() falls to
+ *  its default false), so a present block is stripped and an absent one is a
+ *  no-op — the original detector (e.g. a live `flag`) can never re-upsert it into
+ *  a file it must stay out of. Absent from the file → nothing happens (no write). */
+export function retiredForTarget(rows, targetName) {
+  return rows
+    .filter((r) => !(r.guidanceFiles ?? ['claude']).includes(targetName))
+    .map((r) => ({ ...r, detector: { type: 'retired' } }));
+}
+
+/** The logical guidance targets `sync` (apply) and `status` (dry-run) both loop.
+ *  ONE source of truth so the two commands can never drift. Always: machine-wide
+ *  `~/.claude/CLAUDE.md` (claude) + the project's own `<cwd>/AGENTS.md` (agents).
+ *  The machine-scoped `~/.codex/AGENTS.md` (agents-user) is included ONLY when
+ *  `~/.codex` already exists — codex's presence signal — and is NEVER created by
+ *  this discovery (dir-exists gate, no mkdir). That single gate covers both cases:
+ *  a codex machine that is momentarily single-host still gets the target (so a
+ *  stale block can be stripped), and a codex-less machine never grows a ~/.codex.
+ *  `cfg` is accepted for call-site symmetry/forward-compat; the target set is
+ *  cfg-independent today. `codexRoot` is a test seam (defaults to the real dir).
+ *  @param {{ cwd?: string, cfg?: object, codexRoot?: string }} opts */
+export function guidanceTargets({ cwd = process.cwd(), codexRoot = codexDir() } = {}) {
+  const targets = [
+    { name: 'claude', label: 'CLAUDE.md', file: claudeMdPath() },
+    { name: 'agents', label: 'AGENTS.md', file: path.join(cwd, 'AGENTS.md') },
+  ];
+  if (fs.existsSync(codexRoot)) {
+    targets.push({ name: 'agents-user', label: '~/.codex/AGENTS.md', file: path.join(codexRoot, 'AGENTS.md') });
+  }
+  return targets;
+}
+
 /** Reconcile every registry row against its detector on a file.
  *  resolveTemplate(row) → absolute template path (built-ins resolve against the
  *  package's claude/ dir; custom rows are absolute or ~-expanded already).
diff --git a/src/lib/paths.mjs b/src/lib/paths.mjs
index 60ca6c4a..cb0e734e 100644
--- a/src/lib/paths.mjs
+++ b/src/lib/paths.mjs
@@ -28,6 +28,13 @@ export const claudeSettingsPath = () => path.join(claudeDir(), 'settings.json');
 export const claudeUserMcpPath = () => path.join(home, '.claude.json');
 export const claudeSkillsDir = () => path.join(claudeDir(), 'skills');
 
+/** OpenAI Codex user-level locations. `~/.codex` is codex's home; its global
+ *  guidance file is AGENTS.md (the codex analogue of ~/.claude/CLAUDE.md). ak
+ *  reads/writes this dir but NEVER creates it — its existence is the signal that
+ *  codex is installed on the machine (see blocks.guidanceTargets). */
+export const codexDir = () => path.join(home, '.codex');
+export const codexAgentsMdPath = () => path.join(codexDir(), 'AGENTS.md');
+
 /** Per-project locations, relative to a project root. */
 export const projectSettings = (root) => path.join(root, '.claude', 'settings.json');
 export const projectSettingsLocal = (root) => path.join(root, '.claude', 'settings.local.json');
diff --git a/tests/kit/blocks-dual-mode.test.mjs b/tests/kit/blocks-dual-mode.test.mjs
index 169cfaab..4e4bd88b 100644
--- a/tests/kit/blocks-dual-mode.test.mjs
+++ b/tests/kit/blocks-dual-mode.test.mjs
@@ -125,7 +125,7 @@ test('the dual-mode block is registered as a flag-gated multi-target row', () =>
   const dual = BUILTIN_BLOCKS.find((b) => b.slug === 'ruflo-dual-mode-reference');
   assert.ok(dual, 'ruflo-dual-mode-reference is a builtin');
   assert.deepEqual(dual.detector, { type: 'flag', target: 'dualMode' });
-  assert.deepEqual(dual.guidanceFiles, ['claude', 'agents']);
+  assert.deepEqual(dual.guidanceFiles, ['claude', 'agents-user']);
 });
 
 test('registry defaults a custom row without guidanceFiles to claude', () => {
diff --git a/tests/kit/guidance-targets.test.mjs b/tests/kit/guidance-targets.test.mjs
new file mode 100644
index 00000000..8ba13148
--- /dev/null
+++ b/tests/kit/guidance-targets.test.mjs
@@ -0,0 +1,143 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import {
+  guidanceTargets, retiredForTarget, blocksForTarget, syncBlocks, registry, BUILTIN_BLOCKS,
+} from '../../src/lib/blocks.mjs';
+import { codexDir, codexAgentsMdPath, home, claudeMdPath } from '../../src/lib/paths.mjs';
+
+const block = (slug, body) => `<!-- BEGIN ${slug} -->\n${body}\n<!-- END ${slug} -->\n`;
+
+// ── paths helpers ────────────────────────────────────────────────────────────
+
+test('codexDir / codexAgentsMdPath resolve under ~/.codex', () => {
+  assert.equal(codexDir(), path.join(home, '.codex'));
+  assert.equal(codexAgentsMdPath(), path.join(home, '.codex', 'AGENTS.md'));
+});
+
+// ── guidanceTargets ──────────────────────────────────────────────────────────
+
+test('guidanceTargets always yields claude + project agents, gated codex', () => {
+  const cwd = '/tmp/proj-x';
+  // codexRoot points at a NON-existent dir → agents-user omitted (never mkdir'd).
+  const absent = guidanceTargets({ cwd, codexRoot: path.join(os.tmpdir(), 'no-such-codex-xyz') });
+  assert.deepEqual(absent.map((t) => t.name), ['claude', 'agents']);
+  assert.equal(absent[0].file, claudeMdPath());
+  assert.equal(absent[1].file, path.join(cwd, 'AGENTS.md'));
+});
+
+test('guidanceTargets includes agents-user only when the codex dir exists', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'kit-codex-'));
+  const cwd = '/tmp/proj-y';
+  const targets = guidanceTargets({ cwd, codexRoot: tmp });
+  assert.deepEqual(targets.map((t) => t.name), ['claude', 'agents', 'agents-user']);
+  const au = targets.find((t) => t.name === 'agents-user');
+  assert.equal(au.file, path.join(tmp, 'AGENTS.md'));
+  fs.rmSync(tmp, { recursive: true, force: true });
+});
+
+test('guidanceTargets does not create the codex dir when absent', () => {
+  const missing = path.join(os.tmpdir(), `kit-codex-never-${Date.now()}`);
+  guidanceTargets({ cwd: '/tmp/z', codexRoot: missing });
+  assert.equal(fs.existsSync(missing), false, 'target discovery must never mkdir ~/.codex');
+});
+
+test('guidanceTargets defaults codexRoot to the real ~/.codex path', () => {
+  // Presence of agents-user tracks whether the real ~/.codex exists on this box.
+  const targets = guidanceTargets({ cwd: '/tmp/z' });
+  const hasCodex = fs.existsSync(codexDir());
+  assert.equal(targets.some((t) => t.name === 'agents-user'), hasCodex);
+});
+
+// ── retiredForTarget ─────────────────────────────────────────────────────────
+
+test('retiredForTarget returns rows NOT listing the target, with a false detector', async () => {
+  const rows = [
+    { slug: 'claude-only', detector: { type: 'always' } },
+    { slug: 'dual', guidanceFiles: ['claude', 'agents-user'], detector: { type: 'flag', target: 'dualMode' } },
+  ];
+  // For the project 'agents' target NEITHER row belongs → both retired.
+  const retiredAgents = retiredForTarget(rows, 'agents');
+  assert.deepEqual(retiredAgents.map((r) => r.slug).sort(), ['claude-only', 'dual']);
+  // For 'agents-user' only the claude-only row is retired (dual belongs there).
+  const retiredUser = retiredForTarget(rows, 'agents-user');
+  assert.deepEqual(retiredUser.map((r) => r.slug), ['claude-only']);
+  // For 'claude' nothing is retired (every row lists claude).
+  assert.deepEqual(retiredForTarget(rows, 'claude'), []);
+  // Retired rows carry a detector that never fires (forced strip, not upsert).
+  for (const r of retiredUser) {
+    assert.notEqual(r.detector?.type, 'flag', 'retired detector must not re-fire the original');
+  }
+});
+
+// ── registry re-scoping of the dual-mode block ───────────────────────────────
+
+test('dual-mode block is re-scoped to claude + agents-user (machine files)', () => {
+  const dual = BUILTIN_BLOCKS.find((b) => b.slug === 'ruflo-dual-mode-reference');
+  assert.deepEqual(dual.guidanceFiles, ['claude', 'agents-user']);
+});
+
+// ── migration: strip an orphaned dual block from a project AGENTS.md ──────────
+
+test('project AGENTS.md carrying the dual block gets it stripped (retired strip)', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'kit-mig-'));
+  const file = path.join(tmp, 'AGENTS.md');
+  const tplDir = path.join(tmp, 'tpl');
+  fs.mkdirSync(tplDir);
+  fs.writeFileSync(path.join(tplDir, 'dual.md'), block('ruflo-dual-mode-reference', 'DUAL'));
+  fs.writeFileSync(file, `# Project\n\n${block('ruflo-dual-mode-reference', 'DUAL')}\nkeep me\n`);
+  const rows = registry();
+  const resolve = () => path.join(tplDir, 'dual.md');
+  // Even with dualMode ON, the project 'agents' target must NOT re-add the block:
+  // no row targets 'agents', and the retired row forces a strip.
+  const treg = [...blocksForTarget(rows, 'agents'), ...retiredForTarget(rows, 'agents')];
+  const ctx = { flags: { dualMode: true } };
+  const res = await syncBlocks(file, treg, resolve, { context: ctx });
+  assert.ok(res.some((r) => r.slug === 'ruflo-dual-mode-reference' && r.action === 'stripped'));
+  const after = fs.readFileSync(file, 'utf8');
+  assert.ok(!after.includes('DUAL'), 'dual block stripped from project AGENTS.md');
+  assert.ok(after.includes('keep me'), 'surrounding content preserved');
+  // idempotent second run
+  const again = await syncBlocks(file, treg, resolve, { context: ctx });
+  assert.ok(again.every((r) => r.action === 'unchanged'));
+  fs.rmSync(tmp, { recursive: true, force: true });
+});
+
+// ── agents-user: upsert + one-time backup, no spurious writes ────────────────
+
+test('agents-user upserts the dual block with a one-time .bak when file pre-existed', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'kit-au-'));
+  const file = path.join(tmp, 'AGENTS.md');
+  const tplDir = path.join(tmp, 'tpl');
+  fs.mkdirSync(tplDir);
+  fs.writeFileSync(path.join(tplDir, 'dual.md'), block('ruflo-dual-mode-reference', 'DUAL'));
+  fs.writeFileSync(file, '# user content\n');
+  const rows = registry();
+  const resolve = () => path.join(tplDir, 'dual.md');
+  const treg = [...blocksForTarget(rows, 'agents-user'), ...retiredForTarget(rows, 'agents-user')];
+  const res = await syncBlocks(file, treg, resolve, { context: { flags: { dualMode: true } } });
+  assert.ok(res.some((r) => r.slug === 'ruflo-dual-mode-reference' && r.action === 'upserted'));
+  const after = fs.readFileSync(file, 'utf8');
+  assert.ok(after.includes('DUAL') && after.includes('# user content'));
+  assert.equal(fs.readFileSync(`${file}.bak`, 'utf8'), '# user content\n', 'pre-rewrite content backed up once');
+  fs.rmSync(tmp, { recursive: true, force: true });
+});
+
+test('agents-user makes no file and no backup when single-host and never managed (AC-5)', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'kit-au-empty-'));
+  const file = path.join(tmp, 'AGENTS.md'); // does not exist yet
+  const tplDir = path.join(tmp, 'tpl');
+  fs.mkdirSync(tplDir);
+  fs.writeFileSync(path.join(tplDir, 'dual.md'), block('ruflo-dual-mode-reference', 'DUAL'));
+  const rows = registry();
+  const resolve = () => path.join(tplDir, 'dual.md');
+  const treg = [...blocksForTarget(rows, 'agents-user'), ...retiredForTarget(rows, 'agents-user')];
+  // single-host → dualMode false → dual block not wanted, nothing else present.
+  const res = await syncBlocks(file, treg, resolve, { context: { flags: { dualMode: false } } });
+  assert.ok(res.every((r) => r.action === 'unchanged'));
+  assert.equal(fs.existsSync(file), false, 'no created-but-empty file');
+  assert.equal(fs.existsSync(`${file}.bak`), false, 'no spurious backup');
+  fs.rmSync(tmp, { recursive: true, force: true });
+});