[jbwinters]

Crosshead quickstart previews and applies explicit project, all-project, or manual scope. Each selected directory binds its hosts, profile, and source-excerpt choice. Agents can use --dry-run --json; workspace add/remove/list/check and doctor distinguish configuration from observed startup and resume.

Only an argument-free terminal quickstart opens the wizard. Existing argument-based commands retain their legacy routing, including Pi dry runs. Installed legacy hooks retain their configured profile; explicit CLI commands respect environment/argument precedence. Scoped setup does not change the global source-excerpt capture default.

Migration and recovery:

• A legacy flat local-only store remains readable for its sole identifiable profile, pinned by name and identity. Scoped setup copies eligible history into current workspace partitions before the first new session. Replaced scopes stop falling back to their archived version. Original archives remain intact; ambiguous ownership requires manual recovery.
• Earlier subdirectory and symlink workspace IDs map to their canonical project. Previewed adoption of unscoped history is restricted to one selected project for an existing profile, its identity, and a setup-time cutoff. Applying a preview rechecks the profile and complete memory source snapshot, including newly created partitions.
• workspace repair preserves exact damaged policy bytes in a private backup and installs manual scope. List/check/doctor report invalid policy and missing directories without losing other diagnostics. Automatic hook work stays paused until explicit setup.
• The first workspace add that changes legacy user-wide coverage requires interactive consent or --replace-user-hooks after a dry run. Updates refresh wrappers and scoped hooks once; uninstall removes both scoped and legacy adapter state, including recorded custom homes.

Setup uses a kernel-owned lock with no external flock executable and releases after process death. Excerpt-disabled scoped settings omit tool-use hooks. Workspace matching caches each distinct path within one recall call. Generated Codex settings stay locally excluded from Git; tracked team hooks are preserved. Runtime-home symlink refreshes preserve one registration, and diagnostics share status/profile validation.

Review finding 2 (linked workspaces) was not reproduced: the new two-device explicit-link/scoped-filter test passes on the reviewed 3dedb33 production source and this patch. Hot sync already projects shared IDs onto local aliases; arbitrary foreign paths remain excluded. This patch retains those semantics and the regression.

Validation on Linux with Node 26.12.1:

• Full suite: 523 tests across 61 files passed, exit 0. The regressions include legacy startup/search/update, profile consent races, archive replacement, corrupt-policy recovery, missing roots, disabled tool registrations, killed setup owners, runtime aliases, and changed/empty migration previews. Release archive smoke installation, plugin metadata, public boundary, and whitespace checks passed. Real Codex and Claude Code passed all six startup, resume, and unselected-directory checks against a loopback provider, exit 0.
• Baseline 3dedb33: linked-workspace regression passed, 1 selected test, exit 0, against a local mock sync service.
• No paid provider calls. Native host checks use a loopback provider; Codex requires a hook-trust override in that isolated fixture.
• Fresh independent static review found no remaining material blocker. Darwin scoped setup locking has not been exercised locally.

GitHub Actions at e2882f0: all three workflows passed, including Node 22/24 tests, the reproducible release build, Linux/macOS customer journeys and host-plugin checks, and the Hermes/OpenCode container smoke checks.