diff --git a/MAINTAINER.md b/MAINTAINER.md
index 8a4347e..77daf5f 100644
--- a/MAINTAINER.md
+++ b/MAINTAINER.md
@@ -24,8 +24,11 @@ release this kit. User-facing docs live in [README.md](README.md); this file is
 
 ### CLI shape (`bin/agentic-kit.mjs`)
 
-- **Porcelain** (daily): `setup`, `status`, `sync`, `dashboard`, `admin`, `dual`, `uninstall`. Bare `ak` → `status --hint`. (`dashboard` and `admin` are also reachable as `ak x dashboard` / `ak x admin`.)
-- **Plumbing** (power users): `ak x daemon-gc | mcp | reference | statusline | verify | improvement-eval`.
+- **Porcelain** (daily): `setup`, `status`, `sync`, `dashboard`, `admin`, `usage`, `run`,
+  `host`, `uninstall`. Bare `ak` → `status --hint`. (`dashboard`, `admin`, and `host`
+  are also reachable under `ak x`.)
+- **Plumbing** (power users): `ak x admin | daemon-gc | dashboard | harvest | host | mcp |
+  reference | statusline | verify | improvement-eval`.
 - Each command module exports `options` (a `parseArgs` config) and `run({ flags, positionals, pkgRoot })`.
 - A best-effort drift nudge runs after non-`sync`, non-`--json` commands.
 
@@ -37,9 +40,9 @@ release this kit. User-facing docs live in [README.md](README.md); this file is
 bin/agentic-kit.mjs      # single entrypoint — arg parse + command dispatch (PORCELAIN/PLUMBING maps)
 src/
   commands/              # porcelain verbs
-    setup.mjs  status.mjs  sync.mjs  dual.mjs  uninstall.mjs
+    setup.mjs  status.mjs  sync.mjs  run.mjs  uninstall.mjs
     x/                   # plumbing verbs
-      admin.mjs  daemon-gc.mjs  dashboard.mjs  harvest.mjs  mcp.mjs  provider.mjs  reference.mjs  statusline.mjs  verify.mjs
+      admin.mjs  daemon-gc.mjs  dashboard.mjs  harvest.mjs  host.mjs  mcp.mjs  reference.mjs  statusline.mjs  verify.mjs
   lib/                   # the engine — each file is one concern
     heal.mjs             # the mutations sync/setup apply (idempotent, {ok,detail})
     natives.mjs          # better-sqlite3 / agentdb native detection
@@ -62,6 +65,7 @@ src/
     admin-model.mjs      # PURE admin number model — imports nothing; embedded in the page AND node-tested
     admin-view.mjs       # admin browser controller (embedded into the page; not node-imported)
     browser.mjs          # openInBrowser — shared by dashboard + admin
+    usage-index.mjs      # canonical usage aggregation by host, provider, model, project, and category
     npx.mjs              # stale npx-cache detection/prune
     mcp.mjs  settings.mjs  config.mjs  paths.mjs  statusline.mjs
     rvf.mjs  daemons.mjs  exec.mjs  output.mjs
@@ -80,17 +84,19 @@ docs/
 ```
 
 **Published tarball** = the `files` whitelist in `package.json`:
-`bin/agentic-kit.mjs`, `src/`, `claude/`, `docs/TROUBLESHOOTING.md`. Nothing else
-ships — verify with `npm pack --dry-run` before a release if you touch `files`.
-
-**Dual-host subsystem** (the `providers`/`routing`/`dual` cluster): one policy in
-`kit.json` `providers` is the source of truth — `hosts {claude,codex}` (which are
-enabled), `primaryHost` (which leads; default `claude`), and `dualRouting` (the
-per-activity host+model map). `routing.mjs` is pure (defaults, `seedDualRouting`,
-`swapRoute` for codex-primary mirroring, and the projections to aqe `agentOverrides`
-+ the dual-run config); `providers.mjs` does the I/O (host/auth detection, env
-wiring, both MCP-bridge directions, aqe router file). Seeded/healed by `setup` +
-`sync` + `x provider pick`, surfaced by `status` + `dashboard`. Design records:
+`bin/agentic-kit.mjs`, `src/`, `claude/`, `docs/TROUBLESHOOTING.md`,
+`docs/CODEX-STATUSLINE.md`, and
+`docs/adr/0015-managed-codex-native-statusline.md`. Generated workspace state under
+the shipped source trees is explicitly excluded. Nothing else ships — verify with
+`npm pack --dry-run` before a release if you touch `files`.
+
+**Multi-host routing subsystem** (the `providers`/`routing` cluster): durable intent is
+split between `integrations.hosts` (which hosts are enabled) and top-level `routing`
+(`version`, `primaryHost`, and the per-activity `routes`). `routing.mjs` is pure
+(defaults, primary-host mirroring, validation, and projections to AQE
+`agentOverrides` and `ak run`); `providers.mjs` does the I/O (host/auth detection,
+environment wiring, both MCP-bridge directions, AQE router file). Seeded/healed by
+`setup` + `sync` + `x host pick`, surfaced by `status` + `dashboard`. Design records:
 ADRs [0001–0006](docs/adr/); user guide: `docs/PROVIDERS.md`.
 
 **Status-line capability is host-specific.** Claude owns a project-scoped,
@@ -190,18 +196,16 @@ Edit a file under `src/`, re-run the CLI, done.
 ## 4. Testing
 
 ```bash
-pnpm test        # the full gate — exactly what CI runs
+pnpm test        # coverage-enforced unit + renderer/server suites
+pnpm run check   # release gate: typecheck, lint, markdown, build/package, tests
 ```
 
-That expands to:
-
-```bash
-node --test "tests/kit/*.test.mjs" && node tests/statusline-segments.test.cjs
-```
-
-- `tests/kit/*.test.mjs` — `node:test` unit suites (blocks, natives, settings-config, versions). **32 tests.**
-- `tests/statusline-segments.test.cjs` — statusline footer renderer. **20 tests.**
-- **52 total, 0 failures = release-ready.**
+- `tests/kit/*.test.mjs` — the broad `node:test` suite, run with 70% line, branch, and
+  function coverage floors.
+- Eight `.cjs` suites exercise statusline rendering, Brain display, AgentDB,
+  health history, harvest, dashboard, and admin behavior.
+- `pnpm run build` validates the CLI load and dry-run package manifest, including
+  forbidden generated/private paths.
 
 Run one suite while iterating: `node --test tests/kit/versions.test.mjs`.
 
diff --git a/README.md b/README.md
index 91fd359..d095b0d 100644
--- a/README.md
+++ b/README.md
@@ -37,9 +37,8 @@ and transport.
 
 Those axes do not imply one another. OpenRouter is a provider behind a host, not another host.
 Ollama can have independent bindings through Claude and Codex. OpenCode is an opt-in, explicitly
-routable host through `ak run`, but it is never a primary host or AQE provider. Existing
-`ak dual` is a deprecated Claude+Codex compatibility interface. Provider, model, and billing claims state
-whether they are observed, configured, inferred, or unknown. See
+routable host through `ak run`, but it is never a primary host or AQE provider. Provider, model,
+and billing claims state whether they are observed, configured, inferred, or unknown. See
 [ADR-0016](docs/adr/0016-capability-driven-integration-adapters.md).
 
 ## Why this exists
@@ -73,7 +72,6 @@ ak host         manage execution hosts, routing, and provider bindings
                 status | pick | refresh | off
 ak run          execute a host-neutral activity pipeline (including explicit OpenCode routes)
                 <template> "<task>"  [--dry-run] [--route ...] [--max-concurrent N] [--timeout ms] [--json]
-ak dual         deprecated Claude+Codex compatibility wrapper; use ak run for new work
 ak x statusline manage Codex's native user-wide status line          status | codex native|extended|off
 ak uninstall    leave cleanly                [--dry-run] [--this-project] [--remove-ruflo] [--remove-aqe] [--purge] [--yes]
 ```
@@ -93,12 +91,11 @@ What the verbs cover:
 | **setup** | Installs/updates ruflo + agentic-qe + the **agentdb** CLI globally (handling npm ≥11.17's `allow-scripts` so natives build; agentdb is pinned to ruflo's bundled version so the shared learning store stays coherent), installs the **RuvNet Brain** (an offline knowledge base over the rUv stack, powering the `search_ruvnet` MCP — a ~2 GB one-time download, prompted; skip with `--no-ruvnet-brain`), deploys the token-audit skill, merges the managed guidance blocks into the machine-wide guidance files (`~/.claude/CLAUDE.md`, plus `~/.codex/AGENTS.md` on codex machines), offers one-time MCP registration (user scope, with a tool-family picker), and — inside a repo — initializes the project: sanitized `ruflo init`, absolute memory-path pin, a **verified** store→disk write, statusline footer, and a background daemon with **local-only ($0) workers** (token-spending AI workers stay opt-in behind upstream's machine-wide budget). Project scope triggers on a `.git` directory in the current folder; without one it's skipped with a note. `--project` forces it anyway (e.g. a not-yet-`git init`-ed folder), `--minimal` skips it, `--yes` accepts all prompts (non-interactive), `--no-aqe` / `--no-ruvnet-brain` / `--no-security` disable those subsystems, and `--reconfigure` re-offers MCP registration. `--codex` enables + installs the Codex host during setup (dual-mode; both hosts then run at once), and `--primary-host claude\|codex` picks which host leads (codex implies `--codex`). |
 | **status** | Per-subsystem ✓/⚠/✗ (versions, the kit's own version, **ruvnet-brain** (present + release drift, or "not installed"), natives (agentdb copies **and** ruflo's own memory runtime — the one `npx ruflo memory` loads — load-tested for a native better-sqlite3, not just the agentdb dirs), **memory-pin** (warns when `CLAUDE_FLOW_DB_PATH` points off the live DB), security, learning, aqe/RVF, **agentdb** (CLI present + coherent with ruflo's bundled version, or a store-skew warning), MCP, **hosts** (claude/codex/opencode version + install method; the Claude/Codex **primary** marked and failed when absent), **providers** (host wiring + aqe fallback chain, or "drifted"/claude-only default), **routing** (the persisted activity host+model policy; only Claude/Codex routes project into AQE), daemons, guidance-file blocks (`~/.claude/CLAUDE.md`, project `AGENTS.md`, and `~/.codex/AGENTS.md` on codex machines), statusline), each drift row naming what `sync` would do about it — plus a **health-history** line that flags regressions since the last sync (learning shrank, native slots dropped, drift/security backslid). |
 | **sync** | The one convergence verb: upgrades first when a new release exists, then re-heals everything an upgrade wipes, then re-checks and reports. Included in that heal: it **installs any enabled frontier host** (claude/codex/opencode) that's entirely absent — never touching an external (mise/brew/native) install — and **re-applies provider wiring** (the `ENABLE_*` host env, OpenCode's native configuration, the aqe fallback chain, and ruflo API providers) whenever it has drifted — and, on a dual-host project, **seeds/heals the Claude/Codex default routing policy** (materializing eligible routes into agentic-qe's `agentOverrides`, e.g. after an aqe upgrade first makes it eligible). It also **installs/repins the standalone `agentdb` CLI** to ruflo's bundled version (keeping the shared cognitive store coherent) and appends a **health-history snapshot** so `status` can flag regressions across syncs. It also **re-runs the RuvNet Brain installer** to pull the latest release when the on-disk KB has drifted (or installs it if absent, when enabled). It also **self-updates the kit**: when a newer `@pacphi/agentic-kit` exists it installs it as the *last* step (the new code applies from the next `ak` run, never mid-sync). Prerelease installs (`4.0.0-alpha.*`) track the `next` npm dist-tag as well as `latest`, so alphas see their successors; stable installs only ever follow `latest`. `--no-upgrade` skips the self-update along with the package upgrades. |
-| **dashboard** | Opens a read-only local web dashboard (`127.0.0.1:7431`, localhost-only, never detaches) with seven tabs: **Overview · Hosts & Routing · Providers · Runtime · Intelligence · Usage · Live**. The first five render `ak status` health and routing; Usage indexes local Claude/Codex/OpenCode transcripts on demand and can display a separately cached OpenRouter account-analytics block. That block never changes local transcript/session/host totals; the dashboard itself never fetches it. Live groups work by project, then host-branded root sessions with nested agent/worker threads and independently evidenced provider/model metadata, and pairs an interactive agent/tool execution canvas with a rich, server-masked transcript stream. Active sessions can be followed live or reviewed with synchronized play/pause/seek; completed sessions remain available for bounded playback. Live contains no chat or control plane. Ruflo, agentic-qe, and dual-run stores are not auto-discovered; register each trusted structured JSONL file with repeatable `--live-source 'surface=path'` (`surface` is `ruflo`, `aqe`, or `dual-run`). The page is self-contained and offline-first (no internet fetches; local files and loopback subprocesses/endpoints only). A fresh **per-session token** is minted at startup and required by every `/api/*` route (`x-dash-token` header; the launch URL carries it in the `#` fragment, same contract as `ak admin` — ADR-0007, ADR-0014) — this page serves full transcript text, so it is gated the same way admin already gated GitHub/npm stats. See [Live Sessions](docs/LIVE-SESSIONS.md) for coverage, syntax, and privacy limits. **Auto-opens your browser** (`--no-open` for headless/SSH); `--port N` changes the port; tabs deep-link (`#live`) and persist. Stop with Ctrl-C. (Also available as `ak x dashboard`.) |
+| **dashboard** | Opens a read-only local web dashboard (`127.0.0.1:7431`, localhost-only, never detaches) with seven tabs: **Overview · Hosts & Routing · Providers · Runtime · Intelligence · Usage · Live**. The first five render `ak status` health and routing; Usage indexes local Claude/Codex/OpenCode transcripts on demand and can display a separately cached OpenRouter account-analytics block. That block never changes local transcript/session/host totals; the dashboard itself never fetches it. Live groups work by project, then host-branded root sessions with nested agent/worker threads and independently evidenced provider/model metadata, and pairs an interactive agent/tool execution canvas with a rich, server-masked transcript stream. Active sessions can be followed live or reviewed with synchronized play/pause/seek; completed sessions remain available for bounded playback. Live contains no chat or control plane. Ruflo and agentic-qe stores are not auto-discovered; register each trusted structured JSONL file with repeatable `--live-source 'surface=path'` (`surface` is `ruflo` or `aqe`). The page is self-contained and offline-first (no internet fetches; local files and loopback subprocesses/endpoints only). A fresh **per-session token** is minted at startup and required by every `/api/*` route (`x-dash-token` header; the launch URL carries it in the `#` fragment, same contract as `ak admin` — ADR-0007, ADR-0014) — this page serves full transcript text, so it is gated the same way admin already gated GitHub/npm stats. See [Live Sessions](docs/LIVE-SESSIONS.md) for coverage, syntax, and privacy limits. **Auto-opens your browser** (`--no-open` for headless/SSH); `--port N` changes the port; tabs deep-link (`#live`) and persist. Stop with Ctrl-C. (Also available as `ak x dashboard`.) |
 | **usage** | Reads provider-account analytics from local cache (`ak usage status`) or performs one explicit OpenRouter management-API refresh (`ak usage refresh openrouter`). Refresh requires `OPENROUTER_MANAGEMENT_KEY`, writes a credential-free mode-`0600` cache, and discards endpoint/user/key/session identifiers. `status` and dashboard reads make no network request. OpenRouter account rows have no grounded host/session/project correlation and are never merged into transcript totals. |
 | **admin** | Opens the **maintainer admin** (`127.0.0.1:7432`, localhost-only, foreground) — the project-telemetry sibling of `dashboard`, with the same dark/light visual theme and persisted theme preference: unique repo visitors and cloners (GitHub traffic API, needs a push-access token via `GITHUB_TOKEN`/`GH_TOKEN`/`gh auth token` — panels degrade honestly without one), contributors and watchers, npm download momentum (last 7d vs prior 7d, sparklines — shown as trend only, never an absolute reach number, since mirrors/CI inflate the raw count), latest CI run status and open Dependabot alerts, a **"since you last looked"** delta strip over a local baseline, open issues/PRs from others (oldest first), and external humans ranked by recency (bots excluded). Access is gated by a **per-session token** carried in the URL fragment and sent header-only; the page makes **zero external fetches** (the server proxies GitHub/npm; your credential never reaches the page or the payload — ADR-0007, ADR-0013). Where `dashboard` is offline-first, `admin` does deliberate GitHub/npm egress — that contract split is why they're siblings, not tabs. `--port N`, `--no-open`; Ctrl-C stops. (Also available as `ak x admin`.) |
 | **run** | **Canonical execution surface.** Executes the template vocabulary through host-neutral supervised adapters. It accepts an explicit OpenCode route (persisted or `--route`) alongside Claude/Codex; `--dry-run` prints the exact static plan (with each worker's escalation ladder); at runtime, successful dependencies pass runtime-only, sanitized handoffs capped at 2 KiB each/8 KiB fan-in, never exposed in public JSON. A handoff may cross hosts/vendors and must exclude secrets, credentials, raw logs, and transcript excerpts. `--escalate` advances a failed worker one rung of its route's ladder per attempt (bounded by the ladder; permission/consent and uncertain results are never escalated — ADR-0019). `--timeout` is one absolute readiness→prepare→launch→observe budget per attempt, while separately bounded teardown proves whether resources terminated. An OpenCode worker runs an isolated loopback server with ephemeral basic authentication, returns only normalized observed facts, and aborts instead of approving a permission request. `ak run` does not turn OpenCode into an AQE provider or primary host. |
-| **dual** | **Deprecated compatibility wrapper** for existing Claude+Codex `claude-flow-codex` scripts, including its legacy escalation behavior. New execution work should use `ak run`; `ak dual` warns on stderr and will be removed before the stable release. |
-| **host** | Canonical alpha namespace for execution-host status, selection, primary-host choice, activity routing, and reversible teardown: `ak host status\|pick\|refresh\|off`. The plumbing spelling is `ak x host`. `ak provider` and `ak x provider` are deprecated compatibility aliases that warn on stderr and will be removed before the stable release. |
+| **host** | Execution-host status, selection, primary-host choice, activity routing, and reversible teardown: `ak host status\|pick\|refresh\|off`. The plumbing spelling is `ak x host`. Inference providers and bindings remain separate concepts even though their controls share this workflow. |
 | **uninstall** | Removes the kit's footprint (and any legacy shell-kit install); project data is never touched; `--purge` also offers to remove the global packages. |
 
 Power-user mechanisms live under `ak x …` (`daemon-gc`, `harvest`,
@@ -174,9 +171,8 @@ you opt in. Two independent axes:
   **OpenCode is explicit, not seeded.** Enable it with `ak host pick --host claude,opencode`,
   then route a compatible activity through `ak run`, for example
   `ak run security "src/auth/" --route 'security-scan:opencode:provider/model'`.
-  OpenCode routes are not projected to AQE, do not affect vendor-diversity claims, cannot be a
-  primary host, and the deprecated `ak dual` rejects them rather than silently changing its two-host
-  compatibility contract.
+  OpenCode routes are not projected to AQE, do not affect vendor-diversity claims, and cannot be a
+  primary host.
 
 `ak host status` shows what's detected, wired, and routed; `ak host pick` chooses and
 applies (reversibly); `ak host off` restores the claude-only default. Full guide:
@@ -186,7 +182,7 @@ applies (reversibly); `ak host off` restores the claude-only default. Full guide
 ### opencode host (opt-in)
 
 [opencode](https://opencode.ai) is a third host alongside claude/codex — wired through its own
-native surfaces rather than env flags. `ak setup --opencode` (or `providers.hosts.opencode: true`
+native surfaces rather than env flags. `ak setup --opencode` (or `integrations.hosts.opencode: true`
 in `kit.json`) converges, on every `ak sync`:
 
 - **`~/.config/opencode/opencode.json`** — the `claude-flow` MCP server (ruflo's 300+ tools,
@@ -205,11 +201,11 @@ in `kit.json`) converges, on every `ak sync`:
   platform skill (`~/.config/opencode/skills/ruflo/`). The catalog source resolves
   automatically: claude marketplace clone (full set, auto-updated) → published
   `@claude-flow/cli` package (substrate set); override via
-  `providers.opencodeCatalogDir` or `$RUFLO_REPO`.
+  `integrations.ownership.opencode.catalogDir` or `$RUFLO_REPO`.
 - **Guidance** — `~/.config/opencode/AGENTS.md` gets ak's managed blocks with
   opencode-correct tool names (`claude-flow_*`, `ruvnet-brain_search_ruvnet`).
 
-Everything is ownership-recorded (`providers.opencodeMcp`) and stripped surgically by
+Everything is ownership-recorded (`integrations.ownership.opencode.mcp`) and stripped surgically by
 `ak host off` / `ak uninstall` — your own opencode.json entries are never touched.
 
 **Execution routing.** `ak run` is the host-neutral runner for explicit OpenCode routes. For
diff --git a/bin/agentic-kit.mjs b/bin/agentic-kit.mjs
index feed0ed..1f568c4 100755
--- a/bin/agentic-kit.mjs
+++ b/bin/agentic-kit.mjs
@@ -23,9 +23,7 @@ const PORCELAIN = Object.assign(Object.create(null), {
   admin: () => import('../src/commands/x/admin.mjs'),
   usage: () => import('../src/commands/usage.mjs'),
   run: () => import('../src/commands/run.mjs'),
-  dual: () => import('../src/commands/dual.mjs'),
-  host: () => import('../src/commands/x/provider.mjs'),
-  provider: () => import('../src/commands/x/provider.mjs'),
+  host: () => import('../src/commands/x/host.mjs'),
   uninstall: () => import('../src/commands/uninstall.mjs'),
 });
 
@@ -35,8 +33,7 @@ const PLUMBING = Object.assign(Object.create(null), {
   'dashboard': () => import('../src/commands/x/dashboard.mjs'),
   'harvest': () => import('../src/commands/x/harvest.mjs'),
   'mcp': () => import('../src/commands/x/mcp.mjs'),
-  'host': () => import('../src/commands/x/provider.mjs'),
-  'provider': () => import('../src/commands/x/provider.mjs'),
+  'host': () => import('../src/commands/x/host.mjs'),
   'reference': () => import('../src/commands/x/reference.mjs'),
   'statusline': () => import('../src/commands/x/statusline.mjs'),
   'verify': () => import('../src/commands/x/verify.mjs'),
@@ -53,9 +50,7 @@ Usage (ak = alias of agentic-kit):
   ak admin           maintainer-only telemetry admin (localhost; GitHub/npm egress)  [--port N] [--no-open]
   ak usage           inspect/refresh offline provider analytics  [status|refresh openrouter]
   ak run             execute a host-neutral activity pipeline  [template "task"] [--dry-run]
-  ak dual            deprecated compatibility wrapper; use ak run for new work
   ak host            manage agent hosts, routing, and provider bindings  [status|pick|refresh|off]
-  ak provider        deprecated alias for ak host; removed before the stable release
   ak uninstall       leave cleanly                                      [--this-project] [--purge]
 
   When in doubt: ak sync
@@ -77,7 +72,6 @@ Plumbing (power users) — each takes --help:
   ak x harvest [--dry-run]     opt-in learning-write: replay experiences into the substrate
   ak x mcp [status|pick|off]   MCP registration + tool-family deny rules
   ak x host [status|pick|refresh|off]   manage hosts, routing, and provider bindings
-  ak x provider [status|pick|refresh|off]   deprecated alias; removed before the stable release
   ak x reference [diff|sync]   CLAUDE.md managed-block inspection/reconcile
   ak x statusline [status|codex native|codex extended|codex off]   manage Codex's native user status line
   ak x verify [learning|security|aqe|providers|harvest|all]   deep proofs (slow, spawns real CLIs)
@@ -90,8 +84,6 @@ async function main() {
   const argv = process.argv.slice(2);
   let cmd = argv[0];
   let rest = argv.slice(1);
-  let deprecatedProvider = cmd === 'provider';
-  const deprecatedDual = cmd === 'dual';
 
   if (cmd === '--help' || cmd === '-h' || cmd === 'help') {
     console.log(argv.includes('--all') ? HELP_ALL : HELP);
@@ -109,7 +101,6 @@ async function main() {
     table = PLUMBING;
     cmd = rest[0];
     rest = rest.slice(1);
-    deprecatedProvider = cmd === 'provider';
     // `ak x`, `ak x --help`, `ak x -h` → the plumbing index.
     if (!cmd || cmd === '--help' || cmd === '-h') { console.log(HELP_ALL); return 0; }
     if (cmd === 'improvement-eval') {
@@ -133,14 +124,6 @@ async function main() {
     return 2;
   }
 
-  if (deprecatedProvider) {
-    const legacy = argv[0] === 'x' ? 'ak x provider' : 'ak provider';
-    const canonical = argv[0] === 'x' ? 'ak x host' : 'ak host';
-    console.error(`${legacy} is deprecated; use \`${canonical}\`. It will be removed before the stable release.`);
-  }
-  if (deprecatedDual) {
-    console.error('ak dual is deprecated; use `ak run` for new execution work. It will be removed before the stable release.');
-  }
   const mod = await table[cmd]();
 
   // Per-command help — intercepted BEFORE run() so mutating commands
@@ -191,7 +174,28 @@ async function main() {
   return code ?? 0;
 }
 
+const shellQuote = (value) => process.platform === 'win32'
+  ? `'${String(value).replaceAll("'", "''")}'`
+  : `'${String(value).replaceAll("'", "'\"'\"'")}'`;
+
+function reportFatal(err) {
+  if (err?.name === 'KitConfigError' && typeof err.configPath === 'string') {
+    const backup = `${err.configPath}.invalid`;
+    fail(err.message);
+    console.log('Recovery (the original is preserved):');
+    if (process.platform === 'win32') {
+      console.log(`  Move-Item -LiteralPath ${shellQuote(err.configPath)} -Destination ${shellQuote(backup)}`);
+    } else {
+      console.log(`  mv -- ${shellQuote(err.configPath)} ${shellQuote(backup)}`);
+    }
+    console.log('  ak status');
+    console.log(`Then compare ${backup} with the regenerated defaults and restore only the intended values.`);
+    return;
+  }
+  fail(err?.stack ?? String(err));
+}
+
 main().then(
   (code) => process.exit(code),
-  (err) => { fail(err?.stack ?? String(err)); process.exit(1); },
+  (err) => { reportFatal(err); process.exit(1); },
 );
diff --git a/claude/dual-mode-reference.md b/claude/dual-mode-reference.md
index 689c53a..b9c66a6 100644
--- a/claude/dual-mode-reference.md
+++ b/claude/dual-mode-reference.md
@@ -33,10 +33,9 @@ ak run refactor "extract the payment module" --dry-run
   host/model comes from your routing policy, not the template.
 - **`--route 'act:host[:model]'`** — per-run routing override (repeatable, not persisted).
 - **`--max-concurrent <n>` / `--timeout <ms>`** — bound parallel work and each worker.
-- **`--dry-run` / `--json`** — print the materialized plan, spawn nothing.
-
-`ak dual` is a deprecated Claude/Codex `claude-flow-codex` compatibility wrapper. It retains its
-own `--parallel` and `--escalate` behavior for existing scripts, but new work must use `ak run`.
+- **`--dry-run`** — print the materialized plan and spawn nothing.
+- **`--json`** — emit machine-readable output while executing; combine it with
+  `--dry-run` for a machine-readable preview.
 
 ### The Claude ↔ Codex bridge (bidirectional MCP)
 
@@ -54,9 +53,9 @@ Register (or repair) both directions with `ak sync`; inspect with `ak status`.
 
 Routing is **per activity**, not per session — coder/tester lean Codex, reviewer and
 security-analysis lean Claude, and so on (`ak host` shows and edits the table).
-`--escalate` walks a **cross-vendor** ladder: a failed step retries on the other vendor's
-stronger model, so a Codex miss escalates into Claude (and vice-versa) rather than just
-burning retries on the same engine.
+`--escalate` walks the configured **cross-host** ladder. A failed step can retry on another
+host/model, but host diversity is not vendor proof; provider evidence determines whether a
+particular ladder is also cross-vendor.
 
 **Which host leads.** The two are peers, but `ak host pick --primary-host claude|codex`
 (default `claude`) picks which one leads: codex-primary **mirrors** the default table so Codex
@@ -64,11 +63,11 @@ takes the reasoning/review lead and Claude becomes the alternate/escalation targ
 ambidextrous experience with the roles flipped. `ak status` marks the primary and **fails**
 (not warns) if the primary host is missing.
 
-### qe-court: ≥2-vendor cross-check
+### qe-court: evidence-backed vendor cross-check
 
-Because dual mode routes activities across **two vendors**, the qe-court diversity property
-is satisfiable — a quality verdict backed by ≥2 distinct vendors is far harder to fool than
-a single-model self-review. Prefer cross-vendor routing for review/security activities so
-the court sees genuinely independent opinions.
+Two enabled hosts do not by themselves prove two inference vendors. qe-court diversity must be
+grounded in the providers that actually serve the selected roles. Prefer independently evidenced
+providers for review/security activities and treat configured host/model routes as intent, not
+vendor proof.
 
 <!-- END ruflo-dual-mode-reference -->
diff --git a/claude/providers-reference.md b/claude/providers-reference.md
index 3243d7e..21e7766 100644
--- a/claude/providers-reference.md
+++ b/claude/providers-reference.md
@@ -19,14 +19,13 @@ agentic-qe to use one or both. Two independent axes:
   - **ruflo** — `anthropic` / `openai` / `google` / `ollama` via `ruflo providers configure`.
   - API keys live in the environment; they are never persisted to `kit.json`.
 
-During the alpha, `ak host` is the canonical namespace for execution-host lifecycle and
-selection; `ak x host` is its plumbing spelling. `ak provider` and `ak x provider` are deprecated
-compatibility aliases that warn on stderr and will be removed before stable. This does not rename
-inference providers or bindings into hosts; provider flags remain temporarily co-located on this
-workflow while dedicated capability-driven surfaces mature.
+`ak host` is the namespace for execution-host lifecycle and selection; `ak x host` is its
+plumbing spelling. This does not rename inference providers or bindings into hosts; provider
+controls remain co-located on this workflow while the axes stay distinct.
 
 **One or several — you're never forced to pick just one.** All three surfaces run multiple
 providers concurrently:
+
 - **ruflo hosts** — enable `claude` *and* `codex` together (dual-mode); ruflo runs both.
 - **ruflo LLM providers** — a list, with load-balancing + automatic failover.
 - **agentic-qe** — its `HybridRouter` **auto-enables every provider that has an API key in the
@@ -63,8 +62,8 @@ ak host off      # reset to claude-only default; strip managed env keys
 
 `pick` persists your choice to `kit.json` and applies it: it writes the ruflo backend flags
 (`ENABLE_CLAUDE_CODE` / `ENABLE_CODEX`) and `AQE_LLM_PROVIDER` into
-`.claude/settings.local.json` `env` (merge-not-clobber, backup-first), runs
-`ruflo init --dual` when codex is enabled, and registers any API-key providers with ruflo.
+`.claude/settings.local.json` `env` (merge-not-clobber, backup-first), maintains the
+Claude↔Codex bridge when both hosts are enabled, and registers any API-key providers with ruflo.
 `ak sync` reapplies the same choice idempotently; `ak status` shows **hosts** and
 **providers** rows and flags drift. At the claude-only default nothing is written — behavior
 is unchanged until you opt in.
@@ -89,8 +88,7 @@ execution.
 
 - ruflo **ADR-034 Optional MCP Backends** (accepted): Claude Code / Gemini / OpenAI Codex
   backends enabled via `ENABLE_CLAUDE_CODE` / `ENABLE_GEMINI_MCP` / `ENABLE_CODEX`.
-- `@claude-flow/codex` adapter + `ruflo init --dual` ("Initialize for both Claude Code and
-  OpenAI Codex").
+- Ruflo's supported Claude Code and OpenAI Codex host backends.
 - `ruflo providers list|configure|test` — the API-key provider matrix.
 
 <!-- END ruflo-providers-reference -->
diff --git a/claude/ruflo-opencode-reference.md b/claude/ruflo-opencode-reference.md
index 65a716f..842b9ad 100644
--- a/claude/ruflo-opencode-reference.md
+++ b/claude/ruflo-opencode-reference.md
@@ -1,6 +1,6 @@
 <!-- BEGIN ruflo-opencode-reference -->
 <!-- ruflo-opencode-reference: merged into ~/.config/opencode/AGENTS.md ONLY when the
-     opencode host is enabled (kit.json providers.hosts.opencode). Managed by ak.
+     opencode host is enabled (kit.json integrations.hosts.opencode). Managed by ak.
      Source of truth: claude/ruflo-opencode-reference.md in the agentic-kit kit. -->
 
 ## Ruflo for opencode
@@ -86,7 +86,6 @@ hooks, swarm state):
 
 ```bash
 ruflo init --codex   # AGENTS.md + .agents/ layout — the closest fit for opencode
-ruflo init --dual    # both Claude Code (.claude/, CLAUDE.md) and AGENTS.md
 ```
 
 opencode reads project `AGENTS.md` natively (and `CLAUDE.md` as a fallback
diff --git a/docs/LIVE-SESSIONS.md b/docs/LIVE-SESSIONS.md
index cb69beb..8706282 100644
--- a/docs/LIVE-SESSIONS.md
+++ b/docs/LIVE-SESSIONS.md
@@ -11,14 +11,13 @@ ak dashboard
 # Optional structured telemetry; repeat the option for multiple files.
 ak dashboard \
   --live-source 'ruflo=.claude-flow/live-events.jsonl' \
-  --live-source 'aqe=.agentic-qe/live-events.jsonl' \
-  --live-source 'dual-run=.claude-flow/dual-run-events.jsonl'
+  --live-source 'aqe=.agentic-qe/live-events.jsonl'
 ```
 
 > [!NOTE]
 > `--live-source` is opt-in, not required. Without it, Claude and Codex
 > sessions are still fully covered — auto-discovered, no config needed. What
-> you don't get: ruflo, agentic-qe, and dual-run activity, which are never
+> you don't get: ruflo and agentic-qe activity, which are never
 > auto-discovered and only appear once you register their event file
 > explicitly (see [Evidence and limitations](#evidence-and-limitations)).
 
@@ -164,13 +163,12 @@ capacity.
 | Codex rollout | Session, response/tool lifecycle, model, and explicit rollout metadata | Observed |
 | Codex state ledger | Parent-to-child spawn edges | Observed |
 | Ruflo / agentic-qe | Conservative adapter for an explicitly supplied structured JSONL source | Observed as reported by that source |
-| Dual run | Planned steps from explicit `dual-run.plan` JSONL records | Planned |
 
 The default dashboard automatically discovers only Claude and Codex transcript
 files and reads the Codex state ledger. It does **not** search arbitrary ruflo,
-agentic-qe, plugin, skill, or dual-run stores. Register a structured source
+agentic-qe, plugin, or skill stores. Register a structured source
 explicitly with repeatable `--live-source 'surface=path'`, where `surface` is
-exactly `ruflo`, `aqe`, or `dual-run`.
+exactly `ruflo` or `aqe`.
 
 Relative paths resolve from the directory where `ak dashboard` starts; absolute
 paths remain absolute. The parser rejects an unsupported/missing surface or an
@@ -181,6 +179,10 @@ dashboard. Only register a local file you trust the dashboard process to read.
 The structured adapter still constructs allowlisted events, so arbitrary JSON
 fields do not pass through to the browser.
 
+Historical persisted events from the pre-GA executor normalize to the read-only
+`internal` surface so retained evidence is not mislabeled as native. No current
+writer or `--live-source` parser accepts the retired label.
+
 The diagram is a bounded current-state projection, not a durable audit log.
 Silence changes a session's projection lifecycle to quiescent after 30 seconds
 and expired after five minutes; it does not claim successful completion.
diff --git a/docs/PROVIDERS.md b/docs/PROVIDERS.md
index 43e431e..36b12c8 100644
--- a/docs/PROVIDERS.md
+++ b/docs/PROVIDERS.md
@@ -36,16 +36,9 @@ totals or prove which host executed a request.
 
 This capability model is
 [ADR-0016](adr/0016-capability-driven-integration-adapters.md) (Accepted); the controls below
-implement it and remain backward compatible.
-
-> [!IMPORTANT]
-> During the alpha, `ak host` is the canonical namespace for execution-host lifecycle and
-> selection: `status`, `pick`, `refresh`, and `off`; `ak x host` is its plumbing spelling.
-> `ak provider` and `ak x provider` remain only as deprecated compatibility aliases, warn on
-> stderr, and will be removed before the stable release. This is **not** a wholesale
-> rename of inference-provider management: providers and bindings remain separate axes. Some
-> router-provider flags are temporarily co-located on the host configuration workflow while their
-> dedicated capability-driven surfaces mature.
+implement it. `ak host` owns execution-host lifecycle and selection (`status`, `pick`, `refresh`,
+and `off`), with `ak x host` as its plumbing spelling. Inference providers and bindings remain
+separate axes even though some provider controls share that workflow.
 
 ---
 
@@ -104,7 +97,7 @@ An interactive picker (or flags for scripts). Enable `codex` and `ak`:
 
 - installs it if it's missing (`npm i -g @openai/codex`) — but leaves an existing
   mise/brew/native install alone,
-- runs `ruflo init --dual` (ruflo's "Claude Code + Codex hybrid" mode),
+- maintains the Claude↔Codex bridge and generated host guidance,
 - writes `ENABLE_CLAUDE_CODE` / `ENABLE_CODEX` into `.claude/settings.local.json`.
 
 > [!NOTE]
@@ -213,8 +206,7 @@ ak run security "src/auth/" --route 'security-scan:opencode:provider/model'  # r
 Each OpenCode worker is an isolated, loopback-only supervised server session. A permission request
 is aborted and reported as `permission_required`; `ak` never auto-approves it. OpenCode routes are
 not written to AQE `agentOverrides`, cannot become `primaryHost`, and do not count as a separate
-AQE vendor. `ak dual` is deprecated and rejects OpenCode routes because it retains a Claude/Codex
-compatibility adapter; use `ak run` instead.
+AQE vendor. `ak run` is the only execution surface for an OpenCode route.
 
 **QE-Court validation stays upstream-owned.** `agentic-qe` 3.13.3 corrected its shipped
 QE-Court panel and now enforces the configured anti-collusion policy before convening.
@@ -264,7 +256,7 @@ Defaults (all overridable; your edits are marked `custom` and never re-seeded):
 > `claude-fable-5` is the escalation ceiling.
 
 `ak host pick --help` prints this list too. Tuning is per-route and reversible: hand-edit
-`kit.json` `providers.dualRouting`, pass `--route`, or `ak host off` to clear it entirely.
+`kit.json` `routing.routes`, pass `--route`, or use `ak host off` to clear it entirely.
 
 **Disabling is complete, not just a flag change.** `ak host pick --host <set>` treats the
 set as authoritative. Excluding a routing host removes it from persisted routes and escalation
@@ -274,11 +266,9 @@ while preserving foreign override keys. Excluding Codex additionally retires onl
 marker-owned Codex MCP bridges; user-registered MCP servers are left alone. Re-enabling Codex
 converges those bridges again.
 
-`dualRouting` intentionally names a host and model, not an inference provider. Provider resolution
+`routing.routes` intentionally names a host and model, not an inference provider. Provider resolution
 is a separate binding lookup; absent grounded evidence remains unknown or explicitly inferred.
-`ak run` is the canonical host-neutral executor. The deprecated `ak dual run` remains a
-Claude+Codex compatibility wrapper only; multiple providers behind those hosts do not turn its
-legacy adapter into three-host-or-more orchestration.
+`ak run` is the canonical host-neutral executor for Claude, Codex, and explicit OpenCode routes.
 
 ## Level 4 — drop down to raw ruflo / agentic-qe
 
@@ -292,7 +282,7 @@ The two config stores each knob below lives in — and their precedence — are
 
 | You want to…                         | `ak` way                          | The raw ruflo/aqe way it maps to                    |
 | ------------------------------------ | --------------------------------- | --------------------------------------------------- |
-| Enable claude/codex hosts            | `ak host pick`              | `ENABLE_CLAUDE_CODE` / `ENABLE_CODEX` env + `ruflo init --dual` |
+| Enable claude/codex hosts            | `ak host pick`              | `ENABLE_CLAUDE_CODE` / `ENABLE_CODEX` env + managed bridge/guidance |
 | Register a ruflo LLM provider        | `--provider openai:gpt-5.6`       | `ruflo providers configure -p openai -m gpt-5.6`    |
 | Set which LLM runs QE                | `--aqe-provider gemini`           | `AQE_LLM_PROVIDER=gemini` (env)                     |
 | Order QE's fallback chain            | `--aqe-fallback '…'`              | edit `.agentic-qe/llm-config.json` / `aqe llm-router config` |
diff --git a/docs/TROUBLESHOOTING.md b/docs/TROUBLESHOOTING.md
index 59a07e7..5d7f197 100644
--- a/docs/TROUBLESHOOTING.md
+++ b/docs/TROUBLESHOOTING.md
@@ -30,12 +30,10 @@ ak sync             # apply it
 | opencode: `claude-flow_*` tools / hooks / agents missing after `ak setup --opencode` or a sync | opencode loads config, plugins, MCP servers, and agents **once at startup** — a running session never sees the new wiring | quit and restart opencode; `ak status` (opencode rows) shows exactly which piece is missing |
 | opencode: `status` says `opencode.json is not plain JSON` | opencode legally allows JSONC comments; ak refuses to rewrite a file it can't parse rather than normalize (and silently drop) your comments | hand-merge the ak entries (`mcp`, `skills.paths`, `permission`) per `docs/adr/0017-opencode-host.md`, or remove the comments and run `ak sync` |
 | opencode: an agent/skill/plugin file you created yourself keeps ak's version away | deploys are no-clobber: a file without ak's generated marker at the destination is treated as user-owned and preserved (`status` reports it as `foreign`) | rename yours (or delete it and `ak sync` to get ak's managed copy) |
-| opencode: `status` says `no ruflo catalog source` | the agent/skill catalog resolves override → `$RUFLO_REPO` → claude marketplace clone → `@claude-flow/cli` (direct, then nested under ruflo) — all missing | install ruflo (`ak setup` does), or point `providers.opencodeCatalogDir` / `$RUFLO_REPO` at a ruflo checkout |
+| opencode: `status` says `no ruflo catalog source` | the agent/skill catalog resolves override → `$RUFLO_REPO` → claude marketplace clone → `@claude-flow/cli` (direct, then nested under ruflo) — all missing | install ruflo (`ak setup` does), or point `integrations.ownership.opencode.catalogDir` / `$RUFLO_REPO` at a ruflo checkout |
 | `ruflo memory store` says OK but reads return nothing | Absolute-DB-path pin missing, or an older check looked only at `.swarm/memory.db` while the native bridge selected `.swarm/agentdb-memory.db` | Run `ak x verify memory` for an isolated store/retrieve/on-disk/purge proof; `ak setup` re-pins and verifies the runtime-selected store |
 | `status` shows a `codex-plugins` warning such as unknown field `_note` | An enabled plugin's newest cached hook file does not match Codex's `description` + `hooks` top-level schema | Open Codex `/plugins`, refresh or disable the named plugin, then start a new session. `ak sync` deliberately does not rewrite Codex-owned cache |
 | `status` shows a `memory-pin` warning | `CLAUDE_FLOW_DB_PATH` is pinned to a dead or foreign path, so every memory op targets the wrong DB ("Database not initialized" beside a healthy in-repo DB). The pin may be deliberate, so `sync` never touches it | repoint (or remove) the pin in `.claude/settings.local.json` `env` |
-| Deprecated `ak dual run` refuses to start ("ruflo's memory runtime lacks a native better-sqlite3 binding AND … active native WAL") | Pre-flight guard: the legacy orchestrator's native WAL writer and the WASM `ruflo memory store` would share one DB and corrupt it. It refuses **before** spawning a worker rather than crashing mid-run | Prefer `ak run` for new work. If an existing dual-run workflow must continue, `ak sync` builds the native binding, then retry it. |
-| `ak provider` or `ak x provider` prints a deprecation warning | Alpha namespace correction: execution-host lifecycle and selection now belong to `host`; inference providers and bindings remain separate concepts | Use `ak host` (or `ak x host` for plumbing). The provider aliases will be removed before stable |
 | Suspicious token burn | Background automation vs interactive usage | ask Claude to run the **ruflo-token-audit** skill (deployed by `setup`) |
 | Live dashboard is empty or has no ruflo/AQE nodes | Live tails new Claude/Codex records by default; existing files start at EOF, while ruflo/AQE stores are not auto-discovered | open Live before producing activity; register a trusted JSONL file with repeatable `--live-source 'surface=path'`; see [Live Sessions](LIVE-SESSIONS.md) |
 | `status` shows `ruvnet-brain … not installed` | The RuvNet Brain (offline KB + `search_ruvnet` MCP) isn't on disk | `ak sync` (or `ak setup`) runs the installer; `npx ruvnet-brain --doctor` health-checks it |
diff --git a/docs/UPGRADING.md b/docs/UPGRADING.md
index c9e31b1..727d03e 100644
--- a/docs/UPGRADING.md
+++ b/docs/UPGRADING.md
@@ -26,9 +26,34 @@ family on your behalf.
 | `ak x statusline codex native\|extended` | opt into a user-wide Codex status-line preset | **yes** — records the preset |
 | `ak setup`           | first-time bootstrap of absent tooling          | only via explicit flags (`--codex`, `--opencode`, `--primary-host`) |
 
-| Migration surface   | What to know                                    |
-| ------------------- | ----------------------------------------------- |
-| `ak dual` → `ak run` | `ak dual` is a deprecated compatibility wrapper — existing scripts keep working (it warns on stderr and will be removed before the stable release); use `ak run` for new execution work. OpenCode routes require the current release — remove them before downgrading. `--escalate` exists on both, with deliberately different semantics: the wrapper retries the *whole pipeline* once on any failure; `ak run` advances only the *failed worker* one rung of its route's ladder per attempt (ADR-0019) and records the attempt trail in the result. |
+## 4.0 GA surface migration
+
+Version 4.0 removes the pre-GA compatibility surfaces in one direction:
+
+- Replace `ak dual` with `ak run`. The stable executor applies `--escalate` per failed worker and
+  records the attempt trail. The removed `--parallel` switch has no direct replacement because
+  `ak run` is concurrent by default; use `--max-concurrent 1` for sequential execution.
+  Templates, repeatable `--route` overrides, `--timeout`, and `--json` continue on `ak run`.
+- Replace `ak provider` with `ak host`, and replace `ak x provider` with `ak x host`. Removed
+  commands fail as unknown commands; provider bindings remain a separate domain concept.
+- On first load, host enablement moves from `providers.hosts` to `integrations.hosts`,
+  `providers.primaryHost` moves to `routing.primaryHost`, and `providers.dualRouting` moves to
+  `routing.routes`. Within each route, `source` becomes `provenance` and `escalate` becomes
+  `escalation`. `providers.bindings` merges without loss into `integrations.bindings`;
+  conflicting binding ids stop with a readable configuration error.
+- Adapter ownership markers such as Codex and OpenCode MCP/catalog fields move from `providers`
+  to `integrations.ownership`. A successful write records versioned `routing` and `integrations`
+  envelopes and removes the old fields; later loads use only the canonical shape.
+- Older alphas could install the global `@claude-flow/codex` package and run
+  `ruflo init --dual --force`. Those releases stored no ownership receipt, so GA cannot safely
+  uninstall the package or delete generated project agents automatically. If you installed the
+  package only for the removed executor, run `npm uninstall -g @claude-flow/codex`; review any
+  generated project agent files before removing them.
+
+The migration preserves user-pinned hosts, models, escalation order, and provenance. Review the
+result with `ak host status`, then use `ak run --dry-run` to inspect the materialized plan.
+`--json` emits machine-readable output while executing; combine it with `--dry-run` when
+execution must not start.
 
 A **host** runs the work; a **provider** serves inference. A binding can connect one provider to
 several hosts through separate native configuration **projections**, while **observability**
@@ -36,12 +61,6 @@ sources establish facts with observed, configured, inferred, or unknown provenan
 not silently create, adopt, or rewrite these bindings, and credentials remain environment-only.
 See [ADR-0016](adr/0016-capability-driven-integration-adapters.md).
 
-`ak provider` and `ak x provider` are deprecated alpha compatibility aliases for the former
-combined command. They warn on stderr and will be removed before stable. Use top-level `ak host`
-for execution-host lifecycle and selection (`ak x host` only when you specifically want the
-plumbing spelling). This namespace correction does not rename inference providers or provider
-bindings into hosts.
-
 ## QE-Court configs created before agentic-qe 3.13.3
 
 `agentic-qe` 3.13.3 fixed its shipped QE-Court default and made configuration validation
@@ -76,8 +95,8 @@ ak host status                 # 3. verify: hosts "enabled, wired" + routing tab
 
 Step 1 gets the newer code onto disk. Step 2 is what actually turns dual-host on — it
 records `codex` in `kit.json` and does the wiring: writes `ENABLE_CODEX` into
-`.claude/settings.local.json`, runs `ruflo init --dual`, seeds the per-activity routing
-policy, registers the Codex↔ruflo MCP bridge both ways, and generates the dual-mode agents.
+`.claude/settings.local.json`, seeds the per-activity routing policy, registers the
+Codex↔ruflo MCP bridge both ways, and generates the dual-host guidance.
 Add `--primary-host codex` if you want Codex to lead (Claude becomes the alternate).
 
 > [!NOTE]
diff --git a/docs/adr/0001-one-routing-policy-many-projections.md b/docs/adr/0001-one-routing-policy-many-projections.md
index d2bdb55..cebb0ca 100644
--- a/docs/adr/0001-one-routing-policy-many-projections.md
+++ b/docs/adr/0001-one-routing-policy-many-projections.md
@@ -1,9 +1,15 @@
 # ADR-0001 — One dual-host routing policy, many projections
 
-- **Status:** Accepted
+- **Status:** Superseded in part by [ADR-0020](0020-ga-stable-surfaces.md)
 - **Date:** 2026-07-23
+- **Updated:** 2026-07-30
+- **Update note:** Retained the one-policy decision while retiring the compatibility projection,
+  command, and persisted names for GA.
 - **Deciders:** agentic-kit maintainers
 
+> **Historical scope:** the one-policy principle remains, but the compatibility command,
+> adapter projection, and persisted field names recorded below were removed for 4.0 GA.
+
 ## Context
 
 agentic-qe 3.13.1 shipped issue #568 — on-disk per-agent LLM routing (`agentOverrides` in
diff --git a/docs/adr/0002-activity-vocabulary-defaults-from-ruv-templates.md b/docs/adr/0002-activity-vocabulary-defaults-from-ruv-templates.md
index 6fd33f7..959e09c 100644
--- a/docs/adr/0002-activity-vocabulary-defaults-from-ruv-templates.md
+++ b/docs/adr/0002-activity-vocabulary-defaults-from-ruv-templates.md
@@ -1,9 +1,15 @@
 # ADR-0002 — Activity vocabulary & defaults seeded from rUv's shipped templates
 
-- **Status:** Accepted
+- **Status:** Amended by [ADR-0020](0020-ga-stable-surfaces.md)
 - **Date:** 2026-07-23
+- **Updated:** 2026-07-30
+- **Update note:** Preserved the activity vocabulary and moved its runtime ownership to the
+  in-repository host-neutral runner.
 - **Deciders:** agentic-kit maintainers
 
+> **Historical source note:** the activity vocabulary remains, but 4.0 no longer installs or
+> executes through the dynamic adapter used to ground the original defaults.
+
 ## Context
 
 The routing policy (ADR-0001) is keyed by *activity*. We must choose (a) the canonical set of activities and
diff --git a/docs/adr/0003-auto-seed-dual-host-provenance.md b/docs/adr/0003-auto-seed-dual-host-provenance.md
index 46fd542..868888d 100644
--- a/docs/adr/0003-auto-seed-dual-host-provenance.md
+++ b/docs/adr/0003-auto-seed-dual-host-provenance.md
@@ -1,9 +1,15 @@
 # ADR-0003 — Auto-seed on dual-host, subscription-only, per-route provenance
 
-- **Status:** Accepted
+- **Status:** Amended by [ADR-0020](0020-ga-stable-surfaces.md)
 - **Date:** 2026-07-23
+- **Updated:** 2026-07-30
+- **Update note:** Preserved subscription-safe seeding and provenance while moving intent to the
+  canonical routing envelope.
 - **Deciders:** agentic-kit maintainers
 
+> **GA amendment:** subscription-safe seeding and user-intent preservation remain. The persisted
+> paths and command spellings below are historical; ADR-0020 defines the GA schema and commands.
+
 ## Context
 
 The desired UX: when a user has **both** the Claude and Codex hosts, per-activity routing should "just work"
diff --git a/docs/adr/0004-escalation-per-projection.md b/docs/adr/0004-escalation-per-projection.md
index ea7622c..8dff9e0 100644
--- a/docs/adr/0004-escalation-per-projection.md
+++ b/docs/adr/0004-escalation-per-projection.md
@@ -1,9 +1,16 @@
 # ADR-0004 — Escalation is per-projection, availability stated per path
 
-- **Status:** Accepted
+- **Status:** Superseded by [ADR-0019](0019-escalation-in-ak-run.md) and
+  [ADR-0020](0020-ga-stable-surfaces.md)
 - **Date:** 2026-07-23
+- **Updated:** 2026-07-30
+- **Update note:** Replaced projection-specific compatibility behavior with bounded per-worker
+  escalation in `ak run`.
 - **Deciders:** agentic-kit maintainers
 
+> **Historical record:** this comparison explains the pre-GA projections. Current escalation is
+> the bounded per-worker behavior of `ak run`; the compatibility projections were removed.
+
 ## Context
 
 The routing policy supports an optional per-activity **escalation ladder** (`escalate: [{host,model}, …]`) —
diff --git a/docs/adr/0005-dashboard-in-page-routing-reveal.md b/docs/adr/0005-dashboard-in-page-routing-reveal.md
index dc081d5..c832867 100644
--- a/docs/adr/0005-dashboard-in-page-routing-reveal.md
+++ b/docs/adr/0005-dashboard-in-page-routing-reveal.md
@@ -1,9 +1,15 @@
 # ADR-0005 — Dashboard surfaces routing via in-page reveal
 
-- **Status:** Accepted
+- **Status:** Amended by [ADR-0020](0020-ga-stable-surfaces.md)
 - **Date:** 2026-07-23
+- **Updated:** 2026-07-30
+- **Update note:** Kept the read-only routing reveal and changed it to display only canonical GA
+  configuration.
 - **Deciders:** agentic-kit maintainers
 
+> **GA amendment:** the read-only dashboard decision remains. References below to compatibility
+> configuration names and projections describe the implementation at adoption time only.
+
 ## Context
 
 At the time of this decision, `ak dashboard` was a single-page, poll-every-5s,
diff --git a/docs/adr/0006-primary-host-and-ambidextrous-mirroring.md b/docs/adr/0006-primary-host-and-ambidextrous-mirroring.md
index 21bd78c..ad7451e 100644
--- a/docs/adr/0006-primary-host-and-ambidextrous-mirroring.md
+++ b/docs/adr/0006-primary-host-and-ambidextrous-mirroring.md
@@ -1,6 +1,14 @@
-# 0006 — Primary host & ambidextrous mirroring
+# ADR-0006 — Primary host & ambidextrous mirroring
 
-Status: Accepted
+- **Status:** Amended by [ADR-0020](0020-ga-stable-surfaces.md)
+- **Date:** 2026-07-23
+- **Updated:** 2026-07-30
+- **Update note:** Preserved primary-host mirroring while removing the compatibility executor and
+  moving persisted intent to `routing.primaryHost`.
+- **Deciders:** agentic-kit maintainers
+
+> **GA amendment:** primary-host mirroring remains. The old command spelling, adapter dependency,
+> and persisted locations below are retained only as historical context.
 
 ## Context
 
diff --git a/docs/adr/0011-local-model-provenance-zero-cost-and-transcript-fidelity.md b/docs/adr/0011-local-model-provenance-zero-cost-and-transcript-fidelity.md
index 8f1dfa2..5d861c1 100644
--- a/docs/adr/0011-local-model-provenance-zero-cost-and-transcript-fidelity.md
+++ b/docs/adr/0011-local-model-provenance-zero-cost-and-transcript-fidelity.md
@@ -1,7 +1,11 @@
 # ADR-0011 — Local models: provenance out-of-band, $0 per model, and stated transcript fidelity
 
-- **Status:** Proposed — see *Validation required* before this may be marked Accepted
+- **Status:** Proposed; current command references amended by
+  [ADR-0020](0020-ga-stable-surfaces.md) — see *Validation required* before acceptance
 - **Date:** 2026-07-27
+- **Updated:** 2026-07-30
+- **Update note:** Repointed the provider-binding reference to the canonical host-management
+  module; the unmeasured local-model proposal remains unimplemented.
 - **Deciders:** agentic-kit maintainers
 - **Amends:** [ADR-0009](0009-usage-scorecard-local-transcript-analytics.md) §3 (cost) and §8 (transcripts)
 
@@ -10,7 +14,7 @@
 `ak` already treats `ollama` as a first-class provider on the *routing* axis: it is in
 `PROVIDERS` (`src/lib/routing.mjs:30`), in `SUBSCRIPTION_PROVIDERS` as a $0 local backend
 (`:36`), in the aqe provider matrix (`src/lib/providers.mjs:56`), and in the billing hint the
-provider picker prints — *"ollama/onnx = local ($0)"* (`src/commands/x/provider.mjs:54`).
+host-management picker prints — *"ollama/onnx = local ($0)"* (`src/commands/x/host.mjs`).
 
 The **usage** axis knows nothing about it. Grepping `ollama|OLLAMA|ANTHROPIC_BASE_URL|OPENAI_BASE_URL`
 across `src/` returns hits in exactly those three routing/provider files and none in
diff --git a/docs/adr/0012-live-sessions-observability.md b/docs/adr/0012-live-sessions-observability.md
index 0de29f2..6d338c8 100644
--- a/docs/adr/0012-live-sessions-observability.md
+++ b/docs/adr/0012-live-sessions-observability.md
@@ -1,12 +1,19 @@
 # ADR-0012 — Live sessions as local, evidence-graded observability
 
-- **Status:** Accepted
+- **Status:** Accepted; compatibility-source references amended by
+  [ADR-0020](0020-ga-stable-surfaces.md)
 - **Date:** 2026-07-27
+- **Updated:** 2026-07-30
+- **Update note:** Retained local evidence-graded observability, removed the compatibility source,
+  and mapped its historical records to internal provenance.
 - **Deciders:** agentic-kit maintainers
 - **Related:** [ADR-0005](0005-dashboard-in-page-routing-reveal.md),
   [ADR-0007](0007-maintainer-admin-local-telemetry.md),
   [ADR-0009](0009-usage-scorecard-local-transcript-analytics.md)
 
+> **GA amendment:** the local, read-only observability contract remains. References below to the
+> retired compatibility execution source describe the evidence model at adoption time only.
+
 ## Context
 
 Before this decision, `ak dashboard` reported configuration health and historical usage but could
diff --git a/docs/adr/0016-capability-driven-integration-adapters.md b/docs/adr/0016-capability-driven-integration-adapters.md
index 009fb39..b6584e1 100644
--- a/docs/adr/0016-capability-driven-integration-adapters.md
+++ b/docs/adr/0016-capability-driven-integration-adapters.md
@@ -1,11 +1,13 @@
 # ADR-0016 — Capability-driven host, provider, binding, projection, and observability adapters
 
-- **Status:** Accepted
+- **Status:** Accepted; compatibility clauses superseded by
+  [ADR-0020](0020-ga-stable-surfaces.md)
 - **Date:** 2026-07-28
 - **Updated:** 2026-07-30
 - **Update note:** Added read-only Codex plugin-hook compatibility facts,
   runtime-selected Ruflo project-memory store proofs, and the non-correlatable
-  OpenRouter account-analytics boundary.
+  OpenRouter account-analytics boundary; removed the pre-GA compatibility command,
+  persisted fields, and adapter bootstrap.
 - **Deciders:** agentic-kit maintainers
 - **Related:** [ADR-0001](0001-one-routing-policy-many-projections.md),
   [ADR-0003](0003-auto-seed-dual-host-provenance.md),
@@ -19,6 +21,9 @@
   [issue #59](https://github.com/pacphi/agentic-kit/issues/59),
   [issue #71](https://github.com/pacphi/agentic-kit/issues/71)
 
+> **GA amendment:** the capability axes and lifecycle contracts remain authoritative. Sections
+> that preserve compatibility exports, commands, or persisted fields are historical after 4.0.
+
 ## Context
 
 Agentic-kit currently describes related integration behavior in several adjacent structures:
diff --git a/docs/adr/0017-opencode-host.md b/docs/adr/0017-opencode-host.md
index 13f577a..c321122 100644
--- a/docs/adr/0017-opencode-host.md
+++ b/docs/adr/0017-opencode-host.md
@@ -1,9 +1,16 @@
 # ADR-0017 — OpenCode as a managed, observable host through native surfaces
 
-- **Status:** Accepted
+- **Status:** Accepted; compatibility references amended by
+  [ADR-0020](0020-ga-stable-surfaces.md)
 - **Date:** 2026-07-28
+- **Updated:** 2026-07-30
+- **Update note:** Made OpenCode explicitly routable only through `ak run` while retaining its
+  opt-in, non-primary, non-AQE safety boundary.
 - **Deciders:** agentic-kit maintainers
 
+> **GA amendment:** OpenCode remains opt-in, non-primary, and outside AQE. Historical references
+> to the removed compatibility executor do not describe a supported 4.0 surface.
+
 ## Context
 
 ADR-0016 separates execution hosts, inference providers, projections, observability,
@@ -40,7 +47,7 @@ the plugin, the config entries, and the guidance file are static artifacts with
 The ADR-0016 host registry declares `canDriveSession:true`, `canBePrimary:false`, and now
 `canRouteActivities:true`, plus the `opencode-ai` npm package and native OpenCode
 projection. Brew/mise/native installs report `external` and are never touched.
-`providers.hosts.opencode` remains the compatibility intent field and `--opencode` opts in.
+`integrations.hosts.opencode` is the canonical intent field and `--opencode` opts in.
 No `ENABLE_*` env exists for opencode (ruflo's ADR-034 backend flags don't cover it), so
 wiring is entirely config-file based — the `MANAGED_ENV_KEYS` surface is unchanged.
 ADR-0018 supplies the subsequent execution proof and limits this capability to explicit `ak run`
@@ -70,9 +77,10 @@ Every ak-managed byte on opencode's surfaces lives behind one module, following
   source changed) are pruned under the same ==-written guard. Scalar `permission`
   shorthand is lifted to its documented object equivalent (`{"*": v}`) before merging
   and restored on undo.
-- **Ownership:** on first write ak records `providers.opencodeMcp='ak'` plus value
-  receipts (`opencodeManaged: {mcp:{}, paths:[], permissions:{}, artifacts:{}}`) in
-  kit.json. Artifact receipts are SHA-256 hashes of the exact last-written content.
+- **Ownership:** on first write ak records `integrations.ownership.opencode.mcp='ak'` plus
+  value receipts under `integrations.ownership.opencode.managed`
+  (`{mcp:{}, paths:[], permissions:{}, artifacts:{}}`) in kit.json. Artifact receipts are
+  SHA-256 hashes of the exact last-written content.
   `undoOpencode` strips exactly that set — user MCP servers, user skills paths, and user
   permissions survive teardown (mirrors the `codexMcp`/`rufloCodexMcp` ownership guards,
   made precise for a shared JSON document).
@@ -239,7 +247,7 @@ which is the honest shape).
   `src/lib/providers.mjs` (registry-derived managed host projection,
   `--opencode` flag handling, `hostAuthState` home seam),
   `src/lib/blocks.mjs` (`agents-opencode` target, new registry rows),
-  `src/commands/{sync,status,setup,uninstall}.mjs`, `src/commands/x/provider.mjs`
+  `src/commands/{sync,status,setup,uninstall}.mjs`, `src/commands/x/host.mjs`
   (`pick` two-tier management + `off` teardown), `src/lib/nudge.mjs` (shared targets),
   `src/lib/dashboard/client.mjs` (Hosts-tab categorization),
   `src/lib/versions.mjs` (drift), `src/templates/opencode-ruflo-hooks.js`,
diff --git a/docs/adr/0018-generalized-host-worker-execution.md b/docs/adr/0018-generalized-host-worker-execution.md
index 190d4d1..115c607 100644
--- a/docs/adr/0018-generalized-host-worker-execution.md
+++ b/docs/adr/0018-generalized-host-worker-execution.md
@@ -1,11 +1,16 @@
 # ADR-0018 — Generalized host-worker execution; `ak run` canonical
 
-- **Status:** Accepted
+- **Status:** Accepted; compatibility retention superseded by
+  [ADR-0020](0020-ga-stable-surfaces.md)
 - **Date:** 2026-07-29
 - **Updated:** 2026-07-30
-- **Update note:** Added private bounded dependency handoffs and one absolute lifecycle deadline per attempt.
+- **Update note:** Added private bounded dependency handoffs and one absolute lifecycle deadline
+  per attempt; removed the temporary command, adapter, and persisted-schema compatibility clauses.
 - **Deciders:** agentic-kit maintainers
 
+> **GA amendment:** the host-neutral lifecycle, `ak run`, and OpenCode safety decisions remain.
+> The temporary command, adapter, and persisted-schema compatibility clauses were removed for GA.
+
 ## Context
 
 `ak` manages Claude, Codex, and OpenCode. The earlier `ak dual run` implementation
diff --git a/docs/adr/0019-escalation-in-ak-run.md b/docs/adr/0019-escalation-in-ak-run.md
index be936be..8b20b05 100644
--- a/docs/adr/0019-escalation-in-ak-run.md
+++ b/docs/adr/0019-escalation-in-ak-run.md
@@ -1,9 +1,16 @@
 # ADR-0019 — Bounded per-worker escalation in `ak run`
 
-- **Status:** Accepted
+- **Status:** Accepted; historical wrapper context closed by
+  [ADR-0020](0020-ga-stable-surfaces.md)
 - **Date:** 2026-07-29
+- **Updated:** 2026-07-30
+- **Update note:** Implemented bounded per-worker escalation in `ak run` and removed the
+  whole-pipeline compatibility wrapper.
 - **Deciders:** agentic-kit maintainers
 
+> **GA amendment:** the per-worker escalation decision remains current. The wrapper discussed in
+> the context section was removed before 4.0 and is not an available execution path.
+
 ## Context
 
 The #76 closure punch list requires that ordered, bounded cross-host escalation reach
diff --git a/docs/adr/0020-ga-stable-surfaces.md b/docs/adr/0020-ga-stable-surfaces.md
new file mode 100644
index 0000000..3e72b2a
--- /dev/null
+++ b/docs/adr/0020-ga-stable-surfaces.md
@@ -0,0 +1,105 @@
+# ADR-0020 — One stable GA surface per capability
+
+- **Status:** Implemented
+- **Date:** 2026-07-30
+- **Updated:** 2026-07-30
+- **Update note:** Completed the migrate/remove inventory, canonical config cutover, package
+  boundary, active-guidance cleanup, and regression guards for the 4.0 GA surface.
+- **Deciders:** agentic-kit maintainers
+- **Related:** [ADR-0016](0016-capability-driven-integration-adapters.md),
+  [ADR-0018](0018-generalized-host-worker-execution.md),
+  [ADR-0019](0019-escalation-in-ak-run.md), [issue #83](https://github.com/pacphi/agentic-kit/issues/83)
+
+## Context
+
+The 4.0 alpha accumulated compatibility commands, an adapter-specific execution projection,
+transitional configuration names, and generated guidance that described both the replacement and
+the path it replaced. Keeping those surfaces for GA would create multiple answers to basic
+questions: how to run a pipeline, how to manage hosts, where routing intent lives, and which
+component owns execution.
+
+OpenCode sharpens the boundary. It is a routable execution host, but it must remain explicit,
+supervised, non-primary, outside AQE provider routing, and absent from vendor-diversity facts unless
+its actual inference provider is independently observed.
+
+## Decision
+
+1. `ak run` is the only execution command. It owns host-neutral templates, run-local route
+   overrides, bounded concurrency, deadlines, JSON results, and per-worker escalation.
+2. `ak host` is the user command for host lifecycle, routing, and the colocated provider-binding
+   controls. `ak x host` is its plumbing spelling. Host and inference-provider concepts remain
+   separate.
+3. Routing intent uses one top-level, versioned envelope:
+
+   ```json
+   {
+     "routing": {
+       "version": 1,
+       "primaryHost": "claude",
+       "routes": {
+         "implementation": {
+           "host": "codex",
+           "model": "gpt-5.4",
+           "provenance": "user",
+           "escalation": []
+         }
+       }
+     }
+   }
+   ```
+
+   Migration is deterministic and one-way. It preserves route host, model, escalation order, and
+   provenance, removes the old fields after a successful write, and is idempotent on later loads.
+4. The runtime no longer installs or invokes a separate collaboration adapter or initializes an
+   adapter-specific dual-execution mode. Claude and Codex execute through the same supervised
+   worker contract as every other routable host.
+5. Active help, operational documentation, generated guidance, and examples describe only GA
+   surfaces. ADRs may retain old names as decision history when their status or amendment clearly
+   points here. The upgrading guide contains the single concise user migration.
+6. OpenCode remains disabled until explicitly enabled. Its routes execute only through `ak run`;
+   they never project to AQE, never make OpenCode primary, and never establish an inference vendor
+   from host identity or a configured model selector.
+
+## Inventory and disposition
+
+| Pre-GA surface | GA disposition |
+| -------------- | -------------- |
+| `ak dual`, `ak provider`, `ak x provider` and their aliases | **Remove.** Unknown-command behavior replaces compatibility dispatch. |
+| `src/commands/dual.mjs`, `tests/kit/dual-cli.test.mjs`, and `tests/kit/dual-preflight.test.mjs` | **Remove.** `ak run` owns the complete supervised execution contract. |
+| `src/commands/x/provider.mjs` | **Migrate.** The stable plumbing entry is `src/commands/x/host.mjs`. |
+| `DUAL_RUN_TEMPLATES`, `DUAL_RUN_TEMPLATE_NAMES` | **Migrate.** `RUN_TEMPLATES` and `RUN_TEMPLATE_NAMES` are the host-neutral registry used by `ak run`. |
+| `policyToDualRunConfig` | **Remove.** `materializeRunPlan` is the sole host-neutral plan materializer. |
+| `escalatePolicy` | **Remove.** The supervised runner applies each worker's bounded ladder and records attempt evidence. |
+| `seedDualRouting`, `seedDualRoutingIfDualHost` | **Migrate.** `seedActivityRoutes` and `seedActivityRoutesIfMultiHost` own canonical route seeding. |
+| `CODEX_ADAPTER_PKG`, `codexAdapterAction`, `ensureCodexAdapter`, `ensureDualAgents` | **Remove.** Host workers use the in-repository supervisor; the upgrading guide explains manual cleanup because old releases recorded no ownership receipt. |
+| `writeConfigModule`, `nativeWalConflict` | **Remove.** `ak run` neither writes adapter config modules nor shares the compatibility executor's native/WASM database. |
+| `adaptDualRunRecord`, `DUAL_TEMPLATES`, `DUAL_TEMPLATE_NAMES` | **Remove.** Structured supervised-worker events are the only live execution adapter. |
+| Historical `dual-run` event labels | **Migrate on read.** They retain truthful `internal` provenance instead of being overstated as native execution. |
+| `providers.dualRouting`, route `source`, and route `escalate` | **Migrate once.** Use versioned `routing.routes`, `provenance`, and `escalation`. |
+| `providers.primaryHost` and `providers.hosts` | **Migrate once.** Use `routing.primaryHost` and versioned `integrations.hosts`. |
+| `providers.bindings` | **Migrate once without loss.** Merge into versioned `integrations.bindings`; conflicting ids fail closed. |
+| Codex/OpenCode MCP, management, and catalog ownership fields under `providers` | **Migrate once.** Use versioned `integrations.ownership`. |
+| `legacyRouteProvider`, derived compatibility exports, and usage-output aliases | **Remove.** Registry selectors and canonical `byHost`/`provider` fields are the only live views. |
+| Templates, route overrides, concurrency, timeout, JSON output, escalation, and error behavior | **Migrate.** `ak run` preserves them through templates, repeatable `--route`, `--max-concurrent`, `--timeout`, `--json`, `--escalate`, and structured worker results; it is concurrent by default and uses `--max-concurrent 1` for sequential execution. |
+| Active help, templates, operational docs, dashboard copy, and examples | **Migrate.** Render only GA commands and canonical fields. |
+| Historical ADR vocabulary | **Retain as history.** Each affected ADR points to this implemented decision. |
+| Upgrade and GA release guidance | **Retain once.** `docs/UPGRADING.md` is the sole active compatibility vocabulary. |
+| npm package source enumeration and ignored/generated workspace artifacts | **Migrate.** The manifest excludes hidden QE/runtime state and the build gate rejects generated or private artifacts in the dry-run tarball. |
+
+## Consequences
+
+- Removed commands fail as unknown commands and do not emit deprecation warnings.
+- A clean install has one execution path and one host-management namespace.
+- Configuration readers may recognize the old shape only inside the one-way migration boundary;
+  writers and ordinary runtime code use the canonical envelope exclusively.
+- Generated machine guidance cannot revive removed commands after `ak sync`.
+- OpenCode routability does not weaken permission, provider-provenance, billing, or vendor-diversity
+  boundaries established by ADR-0018.
+
+## Verification
+
+- Negative command tests cover every removed spelling and assert absence from help.
+- A static guard scans active docs, help, dashboard copy, and generated templates for retired
+  command, configuration, adapter, and initialization advice.
+- Migration fixtures prove preservation, one-way removal, and idempotency.
+- Capability tests prove OpenCode is opt-in, non-primary, not AQE-projected, and not a vendor fact.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index e86954f..68aa882 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -9,25 +9,26 @@ Consequences**, and cites the grounded source it rests on where relevant.
 
 | ADR | Title | Status |
 |-----|-------|--------|
-| [0001](0001-one-routing-policy-many-projections.md) | One dual-host routing policy, many projections | Accepted |
-| [0002](0002-activity-vocabulary-defaults-from-ruv-templates.md) | Activity vocabulary & defaults seeded from rUv's shipped templates | Accepted |
-| [0003](0003-auto-seed-dual-host-provenance.md) | Auto-seed on dual-host, subscription-only, per-route provenance | Accepted |
-| [0004](0004-escalation-per-projection.md) | Escalation is per-projection, availability stated per path | Accepted |
-| [0005](0005-dashboard-in-page-routing-reveal.md) | Dashboard surfaces routing via in-page reveal | Accepted |
-| [0006](0006-primary-host-and-ambidextrous-mirroring.md) | Primary host & ambidextrous mirroring (which host leads) | Accepted |
+| [0001](0001-one-routing-policy-many-projections.md) | One dual-host routing policy, many projections | Superseded in part by 0020 |
+| [0002](0002-activity-vocabulary-defaults-from-ruv-templates.md) | Activity vocabulary & defaults seeded from rUv's shipped templates | Amended by 0020 |
+| [0003](0003-auto-seed-dual-host-provenance.md) | Auto-seed on dual-host, subscription-only, per-route provenance | Amended by 0020 |
+| [0004](0004-escalation-per-projection.md) | Escalation is per-projection, availability stated per path | Superseded by 0019/0020 |
+| [0005](0005-dashboard-in-page-routing-reveal.md) | Dashboard surfaces routing via in-page reveal | Amended by 0020 |
+| [0006](0006-primary-host-and-ambidextrous-mirroring.md) | Primary host & ambidextrous mirroring (which host leads) | Amended by 0020 |
 | [0007](0007-maintainer-admin-local-telemetry.md) | Maintainer admin: a loopback telemetry page with deliberate egress | Accepted |
 | [0008](0008-guidance-target-scope-split.md) | Machine-scoped guidance blocks land in machine files, not a repo's AGENTS.md | Accepted |
 | [0009](0009-usage-scorecard-local-transcript-analytics.md) | Usage scorecard: local transcript analytics with graded evidence | Accepted |
 | [0010](0010-provider-mediated-quota-reads.md) | Provider-mediated quota reads (the only honest denominators) | Accepted |
 | [0011](0011-local-model-provenance-zero-cost-and-transcript-fidelity.md) | Local models: provenance out-of-band, $0 per model, stated transcript fidelity | Proposed |
-| [0012](0012-live-sessions-observability.md) | Live sessions as local, evidence-graded observability | Accepted |
+| [0012](0012-live-sessions-observability.md) | Live sessions as local, evidence-graded observability | Accepted; compatibility source amended |
 | [0013](0013-admin-build-security-signals-and-honest-reach.md) | Admin: build/security signals, an honest Reach panel, and a pagination fix | Accepted |
 | [0014](0014-dashboard-auth-and-remediation.md) | Dashboard auth token, plus a security/quality remediation pass | Accepted |
 | [0015](0015-managed-codex-native-statusline.md) | Manage Codex's native user-wide status line without claiming rich-renderer parity | Accepted |
-| [0016](0016-capability-driven-integration-adapters.md) | Capability-driven host, provider, binding, projection, and observability adapters | Accepted |
-| [0017](0017-opencode-host.md) | OpenCode as a managed, observable host through native surfaces | Accepted |
-| [0018](0018-generalized-host-worker-execution.md) | Generalized host-worker execution; `ak run` canonical | Accepted |
-| [0019](0019-escalation-in-ak-run.md) | Bounded per-worker escalation in `ak run` | Accepted |
+| [0016](0016-capability-driven-integration-adapters.md) | Capability-driven host, provider, binding, projection, and observability adapters | Accepted; compatibility amended |
+| [0017](0017-opencode-host.md) | OpenCode as a managed, observable host through native surfaces | Accepted; compatibility amended |
+| [0018](0018-generalized-host-worker-execution.md) | Generalized host-worker execution; `ak run` canonical | Accepted; compatibility amended |
+| [0019](0019-escalation-in-ak-run.md) | Bounded per-worker escalation in `ak run` | Accepted; historical context closed |
+| [0020](0020-ga-stable-surfaces.md) | One stable GA surface per capability | Implemented |
 
 Theme: ADRs **0001–0006** define **dual-host LLM routing and leadership** — how `ak` lets ruflo route
 each development activity (architecture, implementation, testing, review, …) to the right host (Claude
@@ -54,8 +55,8 @@ normalized into a versioned, provenance-bearing event model, reduced into an int
 agent/tool canvas, and paired with a rich selected-session transcript rail. Separate SSE planes
 keep content out of broad topology snapshots/replay while preserving masked local evidence and
 keeping chat/control absent. Claude/Codex collection is
-implemented; ruflo, agentic-qe, and dual-run require explicit, repeatable `--live-source`
-registration. Independent plugin/skill/MCP discovery and a measured frame-time budget remain
+implemented; ruflo and agentic-qe require explicit, repeatable `--live-source` registration.
+Independent plugin/skill/MCP discovery and a measured frame-time budget remain
 documented limitations rather than implied capabilities. **0013** extends 0007's admin collector with
 CI-run and Dependabot-alert signals, fixes a releases-pagination cap that silently dropped older
 releases, replaces two GitHub-release-asset Reach tiles that were permanently dead for this npm-only
@@ -89,7 +90,12 @@ machine-guidance surfaces; preserves user values through ownership receipts and
 and preserves primary/AQE routing boundaries. ADR-0018 adds the OpenCode execution-worker
 contract and explicit activity routes through `ak run`.
 
-**0018** defines the host-neutral worker lifecycle and normalized terminal evidence, makes `ak run`
-the canonical execution surface, and preserves `ak dual` only as a deprecated Claude/Codex
-compatibility wrapper. It selects OpenCode's loopback HTTP/OpenAPI transport and documents its
-permission, timeout, cleanup, provenance, and AQE-boundary evidence.
+**0018** defines the host-neutral worker lifecycle and normalized terminal evidence and makes
+`ak run` canonical. It selects OpenCode's loopback HTTP/OpenAPI transport and documents its
+permission, timeout, cleanup, provenance, and AQE-boundary evidence. Its temporary compatibility
+clauses are superseded by ADR-0020.
+
+**0020** closes the 4.0 alpha compatibility window. It establishes one execution command, one
+host-management namespace, and the versioned top-level routing envelope; removes dynamic
+adapter-specific execution bootstrap; limits old vocabulary to marked decision history and one
+upgrade section; and preserves OpenCode's opt-in, supervised, non-primary, non-AQE boundary.
diff --git a/docs/ddd/README.md b/docs/ddd/README.md
index 8bdeeb1..1f5758c 100644
--- a/docs/ddd/README.md
+++ b/docs/ddd/README.md
@@ -10,7 +10,7 @@ describe the current system unless a section is explicitly marked as future work
 | [Ubiquitous language](ubiquitous-language.md) | Canonical meanings used across code, CLI, ADRs, and documentation |
 | [Context map](context-map.md) | Bounded contexts, ownership, and relationships |
 | [Integration management](integration-management.md) | Hosts, inference providers, bindings, capabilities, lifecycle, facts, and ownership |
-| [Routing and orchestration](routing-and-orchestration.md) | Activities, routes, leadership, escalation, projections, canonical `ak run`, and legacy dual compatibility |
+| [Routing and orchestration](routing-and-orchestration.md) | Activities, routes, leadership, escalation, projections, and canonical `ak run` execution |
 | [Live Sessions](live-sessions.md) | Evidence acquisition, live-session aggregates, replay, and dashboard delivery |
 
 ## Relationship to other documentation
@@ -31,7 +31,6 @@ A change that introduces or changes a domain concept should:
 4. add executable coverage for new invariants; and
 5. update operational documentation when user-visible behavior changes.
 
-Transitional implementation names remain documented until migration completes. In particular,
-`kit.json.providers` still contains both historical host settings and provider settings, and the
-deprecated `ak provider` aliases remain available during alpha. These names do not change the
-canonical distinction between a host and an inference provider.
+The GA model keeps host enablement under `integrations.hosts`, integration ownership under
+`integrations`, and activity intent under top-level `routing`. These persisted locations do not
+change the canonical distinction between a host and an inference provider.
diff --git a/docs/ddd/integration-management.md b/docs/ddd/integration-management.md
index 1187ff5..63b2e1f 100644
--- a/docs/ddd/integration-management.md
+++ b/docs/ddd/integration-management.md
@@ -58,7 +58,7 @@ protocols, and non-loopback plaintext HTTP.
 - Commands select adapters by capability rather than recognized ID.
 - Adding OpenCode does not make it primary; an explicit OpenCode route is eligible only after its
   execution adapter declares activity-routing capability, and runs through `ak run` rather than
-  AQE or `ak dual`.
+  AQE.
 - Adding OpenRouter does not make it a host.
 - Provider claims are rendered only when the provider declares and evidence supports them.
 - Compatibility collections are derived from registries.
@@ -121,17 +121,19 @@ normalizes legacy state in memory without writing. An explicit save persists the
 Migration is additive, preserves existing bindings, and infers legacy default bindings with
 `inferred` provenance.
 
-Future schema versions and malformed binding collections are preserved opaquely rather than
-downgraded or rewritten.
+Migration helpers preserve future schema versions opaquely rather than downgrading them. The CLI
+refuses to operate on an unsupported or malformed envelope with a readable configuration error,
+so ordinary consumers never crash on an unusable shape.
 
-Historical paths under `kit.json.providers` remain compatibility surfaces during alpha. Their name
-does not collapse the host and provider domains.
+Pre-GA paths under `kit.json.providers` are accepted only by the one-way 4.0 migration boundary.
+Ordinary runtime code consumes the versioned `integrations`, `routing`, and provider-axis
+envelopes and never reads the retired paths.
 
 ## Proving integrations
 
 | Case | What it proves |
 |------|----------------|
-| OpenCode host | A host can be managed and observed without becoming primary or routable |
+| OpenCode host | A non-primary host can run an explicitly routed `ak run` worker without AQE projection or inferred provider identity |
 | OpenRouter provider | A provider can serve existing hosts without becoming a host |
 | Ollama via Claude and Codex | One provider can have independent bindings to multiple hosts |
 
diff --git a/docs/ddd/live-sessions.md b/docs/ddd/live-sessions.md
index efe512c..f91c920 100644
--- a/docs/ddd/live-sessions.md
+++ b/docs/ddd/live-sessions.md
@@ -55,7 +55,6 @@ Source adapters are anti-corruption layers for:
 
 - Claude session and delegated-agent artifacts;
 - Codex rollouts and state-ledger spawn edges;
-- legacy ak dual-run workflow/routing metadata;
 - ruflo swarm, agent, hook, and daemon state;
 - agentic-qe tasks, workers, evaluations, gates, and court verdicts;
 - explicit skill, plugin, MCP, and tool lifecycle records.
@@ -516,7 +515,7 @@ Tests are written against ports and fixtures before each adapter or lifecycle tr
 1. **Contract tests:** event schema, action vocabulary, privacy allowlist, confidence ordering.
 2. **Tailer tests:** append, partial record, duplicate notification, rotation, truncation, checkpoint
    restart, and symlink/containment rejection.
-3. **Source-adapter fixtures:** known Claude, Codex, ruflo, agentic-qe, dual-run, skill, plugin,
+3. **Source-adapter fixtures:** known Claude, Codex, ruflo, agentic-qe, skill, plugin,
    and MCP records; unknown fields and schema generations.
 4. **Aggregate tests:** child-before-parent, conflict, terminal-state monotonicity, expiry, and
    idempotency.
@@ -584,7 +583,6 @@ process memory limits.
 
 ### Milestone 5: Ecosystem enrichment
 
-- Add dual-run planned topology and execution updates.
 - Add ruflo swarm/agent/hook/daemon source adapters.
 - Add agentic-qe task/evaluation/verdict source adapters.
 - Add explicit skill, plugin, MCP, and tool activity source adapters.
@@ -648,9 +646,9 @@ The server subscribes before taking the initial snapshot and reconciles buffered
 closing the snapshot-to-subscribe race. A slow-client queue overflow discards queued frames and
 sends a reset snapshot after drain.
 
-The default command discovers Claude/Codex transcripts and reads Codex ledger edges. Ruflo,
-agentic-qe, and dual-run source adapters require explicit, repeatable `--live-source 'surface=path'`
-registration, where `surface` is `ruflo`, `aqe`, or `dual-run`. Explicit sources consume tailer
+The default command discovers Claude/Codex transcripts and reads Codex ledger edges. Ruflo and
+agentic-qe source adapters require explicit, repeatable `--live-source 'surface=path'`
+registration, where `surface` is `ruflo` or `aqe`. Explicit sources consume tailer
 capacity before Claude/Codex discovery. Paths resolve against the startup working directory and are
 not confined to the project, so registration is an operator authorization to read that file.
 Independent plugin, skill, MCP, and gate registries are not implemented. This is an explicit source
diff --git a/docs/ddd/routing-and-orchestration.md b/docs/ddd/routing-and-orchestration.md
index 66be8ab..3044c28 100644
--- a/docs/ddd/routing-and-orchestration.md
+++ b/docs/ddd/routing-and-orchestration.md
@@ -20,7 +20,7 @@ RoutingPolicy
                 provenance
                 escalation rungs[]
 
-RoutingPolicy -> eligible configuration projections -> AQE / legacy dual-run / MCP surfaces
+RoutingPolicy -> eligible configuration projections -> AQE / MCP surfaces
 RoutingPolicy + template + task -> materialized workers -> ak run
 ```
 
@@ -61,38 +61,27 @@ change the persisted base route.
 
 ## One policy, several configuration projections
 
-`kit.json.providers.dualRouting` is the current persisted compatibility path for routing intent.
-Pure projectors materialize that policy into:
+`kit.json.routing` is the persisted routing envelope: `version`, `primaryHost`, and per-activity
+`routes`. Each route carries host/model intent plus `provenance` and an optional `escalation`
+ladder. Pure projectors materialize that policy into:
 
 - AQE `agentOverrides` for AQE-eligible Claude/Codex routes;
 - `ak run`'s host-neutral worker plan;
-- deprecated dual-run worker configuration for Claude/Codex-only compatibility; and
 - Codex MCP availability/configuration.
 
 These are configuration projections, not independent routing policies. Native surfaces must not
 be edited back into domain truth without an explicit import or reconciliation design.
 
-## Canonical execution and deprecated dual compatibility
+## Canonical execution
 
 `ak run` is the canonical executor for materialized activity plans. It can select every host whose
 adapter declares `canRouteActivities`, including an explicit OpenCode route. It does not infer a
 provider from a host/model selector, make OpenCode primary, or project OpenCode into AQE.
 
-`ak dual run` is deprecated. It remains a Claude-and-Codex compatibility wrapper for existing
-`claude-flow-codex` workflows, including its legacy escalation semantics. Workers in that adapter
-may reach different inference providers through their bindings, but provider cardinality does not
-change the number of execution hosts.
-
-Therefore:
-
-- two hosts with three or more providers remain a dual run;
-- OpenRouter does not create a third orchestration host;
-- two Ollama bindings do not create two Ollama providers; and
-- OpenCode runs through `ak run` once its host adapter explicitly gains the required capability;
-  the deprecated `ak dual` rejects it rather than changing its compatibility contract.
-
-Generalized multi-host execution does not redefine the legacy word `dual`: only `ak run` owns that
-surface. `ak dual` remains a removable compatibility path rather than a second orchestration model.
+Host and provider cardinality remain separate: OpenRouter does not create another execution host,
+two Ollama bindings do not create two Ollama providers, and configured host/model routes do not
+prove which inference vendor served a session. OpenCode runs only through `ak run` after its host
+adapter declares the required capability.
 
 ## Cost safety
 
@@ -108,9 +97,9 @@ must distinguish per-token price from measured or expected per-task cost.
 1. Only capability-qualified hosts receive activity routes.
 2. Routing host and inference provider are separate axes.
 3. One canonical policy feeds all eligible downstream projections; ineligible OpenCode routes are
-   never fabricated into AQE or the deprecated dual adapter.
+   never fabricated into AQE.
 4. User-pinned routes are not overwritten by default refresh.
 5. Primary-host selection changes leadership defaults, not host enablement symmetry.
 6. Escalation is explicit, ordered, and per route.
 7. Automatic seeding cannot introduce a metered provider path.
-8. `ak run` is the canonical executor; `dual` remains a deprecated two-host compatibility wrapper.
+8. `ak run` is the sole executor for materialized activity plans.
diff --git a/docs/ddd/ubiquitous-language.md b/docs/ddd/ubiquitous-language.md
index 718b901..59a7628 100644
--- a/docs/ddd/ubiquitous-language.md
+++ b/docs/ddd/ubiquitous-language.md
@@ -53,14 +53,12 @@ missing price.
 | Route provenance | Whether a route is a default, seeded by `ak`, or deliberately set by the user |
 | Escalation rung | Alternate host and model tried after failure when escalation is requested |
 | `ak run` | Canonical host-neutral execution of a materialized routing plan |
-| Dual run | Deprecated Claude-and-Codex compatibility pipeline materialized from the routing policy |
 | Read-model projection | Derived query or UI state, distinct from a configuration projection |
 | Transcript host | Host whose native artifact supplied a transcript |
 | Inference identity | Provider and model supported by provider-specific or out-of-band evidence |
 
-`Dual` describes the two peer execution hosts in the deprecated compatibility substrate. The
-number of inference providers behind those hosts does not change that legacy pipeline into a
-three-host orchestration. Generalized execution belongs to `ak run`.
+`Dual-host` describes two enabled peer hosts, not an execution command and not evidence that two
+inference vendors served a workflow. Generalized execution belongs to `ak run`.
 
 ## Usage rules
 
@@ -74,11 +72,11 @@ three-host orchestration. Generalized execution belongs to `ak run`.
 - Do not infer an inference provider from a transcript host alone.
 - Do not replace an unknown fact with a convenient default.
 
-## Transitional names
+## Persisted names
 
-- `ak host` and `ak x host` are canonical. `ak provider` and `ak x provider` are deprecated alpha
-  aliases scheduled for removal before stable.
-- `kit.json.providers.hosts`, `providers.primaryHost`, and `providers.dualRouting` are historical
-  persisted paths. They remain compatibility surfaces, not permission to call hosts providers.
-- Compatibility exports in `hosts.mjs`, `providers.mjs`, and `routing.mjs` are derived views, not
-  independent domain registries.
+- `ak host` and `ak x host` manage execution hosts and routing; they do not redefine inference
+  providers.
+- `kit.json.integrations.hosts` records enabled hosts. Top-level `routing` records `version`,
+  `primaryHost`, and per-activity `routes`; route entries use `provenance` and `escalation`.
+- Derived exports in `hosts.mjs`, `providers.mjs`, and `routing.mjs` are views, not independent
+  domain registries.
diff --git a/package.json b/package.json
index bfd04a3..380efe1 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,13 @@
   "files": [
     "bin/agentic-kit.mjs",
     "src/",
+    "!src/**/.claude/**",
+    "!src/**/.agentic-qe/**",
+    "!src/**/.claude-flow/**",
     "claude/",
+    "!claude/**/.claude/**",
+    "!claude/**/.agentic-qe/**",
+    "!claude/**/.claude-flow/**",
     "docs/TROUBLESHOOTING.md",
     "docs/CODEX-STATUSLINE.md",
     "docs/adr/0015-managed-codex-native-statusline.md"
diff --git a/scripts/build-check.mjs b/scripts/build-check.mjs
index d70c01f..f8e8cdc 100644
--- a/scripts/build-check.mjs
+++ b/scripts/build-check.mjs
@@ -6,7 +6,7 @@
 // Catches the failure modes a transpile step would otherwise surface: a syntax
 // error in a shipped file, a broken bin, or a `files` glob that drops a module.
 import { spawnSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 
@@ -34,7 +34,14 @@ const listFiles = (dir) => {
   if (out.status !== 0) {
     throw new Error(`git ls-files ${dir} failed (exit ${out.status}): ${out.stderr || out.error || 'unknown error'}`);
   }
-  return out.stdout.split('\n').filter((f) => /\.(mjs|cjs|js)$/.test(f));
+  const candidates = out.stdout
+    .split('\n')
+    .filter((f) => /\.(mjs|cjs|js)$/.test(f));
+  const missing = candidates.filter((f) => !existsSync(path.join(root, f)));
+  if (missing.length) {
+    console.log(`  omitted ${missing.length} tracked deletion(s): ${missing.join(', ')}`);
+  }
+  return candidates.filter((f) => existsSync(path.join(root, f)));
 };
 const shipped = [...listFiles('bin'), ...listFiles('src')];
 // A gate that can pass having checked nothing is worse than no gate — assert
@@ -59,12 +66,24 @@ step('CLI loads + --version', v.status === 0 && /\d+\.\d+\.\d+/.test(v.stdout),
 const pack = spawnSync('npm', ['pack', '--dry-run', '--json'], { cwd: root, encoding: 'utf8' });
 let packOk = pack.status === 0;
 let fileCount = 0;
+let forbidden = [];
 try {
   const meta = JSON.parse(pack.stdout);
-  fileCount = meta[0]?.files?.length ?? 0;
-  const bundlesBin = meta[0]?.files?.some((f) => f.path.includes('agentic-kit.mjs'));
-  packOk = packOk && fileCount > 0 && !!bundlesBin;
+  const packedPaths = meta[0]?.files?.map((f) => f.path) ?? [];
+  fileCount = packedPaths.length;
+  const bundlesBin = packedPaths.includes('bin/agentic-kit.mjs');
+  const forbiddenPatterns = [
+    /(?:^|\/)\.(?:agentic-qe|claude-flow|swarm)(?:\/|$)/,
+    /(?:^|\/)\.claude(?:\/|$)/,
+    /(?:^|\/)\.env(?:\.|$)/,
+    /(?:^|\/)[^/]*\.key\.pem$/,
+  ];
+  forbidden = packedPaths.filter((file) => forbiddenPatterns.some((pattern) => pattern.test(file)));
+  packOk = packOk && fileCount > 0 && bundlesBin && forbidden.length === 0;
 } catch { packOk = false; }
+if (forbidden.length) {
+  console.error(`  refused generated/private package artifacts:\n  ${forbidden.join('\n  ')}`);
+}
 step('npm pack --dry-run resolves files', packOk, `${fileCount} files`);
 
 // Sanity: published version is readable.
diff --git a/src/commands/dual.mjs b/src/commands/dual.mjs
deleted file mode 100644
index 77faf71..0000000
--- a/src/commands/dual.mjs
+++ /dev/null
@@ -1,218 +0,0 @@
-// ak dual — run a Claude+Codex collaboration swarm using the managed per-activity
-// routing policy. Materializes the dual-run config from providers.dualRouting and
-// shells to `claude-flow-codex dual run --config` (ADR-0001 projection #2; ADR-0004
-// escalation). Thin wrapper: ak owns the policy + retry, the adapter runs the swarm.
-import { spawn } from 'node:child_process';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { pathToFileURL, fileURLToPath } from 'node:url';
-import { loadKitConfig } from '../lib/config.mjs';
-import { have } from '../lib/exec.mjs';
-import { rufloRuntimeNatives } from '../lib/natives.mjs';
-import { ok, warn, fail, info, dim, bold } from '../lib/output.mjs';
-import {
-  DUAL_RUN_TEMPLATES, DUAL_RUN_TEMPLATE_NAMES, policyToDualRunConfig, escalatePolicy, parseRouteSpecs,
-} from '../lib/routing.mjs';
-
-const ADAPTER = 'claude-flow-codex';
-
-export const options = {
-  route: { type: 'string', multiple: true },
-  parallel: { type: 'boolean', default: false },
-  escalate: { type: 'boolean', default: false },
-  'dry-run': { type: 'boolean', default: false },
-  'max-concurrent': { type: 'string' },
-  timeout: { type: 'string' },
-  json: { type: 'boolean', default: false },
-};
-
-export const help = `ak dual — deprecated Claude+Codex compatibility wrapper
-
-Use \`ak run <template> "<task>"\` for all new execution work. This legacy command
-retains its Claude+Codex ${ADAPTER} adapter and escalation behavior for existing scripts.
-
-Usage:
-  ak dual run <template> "<task>"   run a collaboration pipeline
-  ak dual templates                 list available templates
-
-Templates: ${DUAL_RUN_TEMPLATE_NAMES.join(', ')}
-
-Options (run):
-  --route 'act:host[:model]'   per-run routing override (repeatable; not persisted)
-  --parallel                   run independent workers in parallel (else sequential)
-  --escalate                   on failure, retry once up the escalation ladder
-  --dry-run                    print the materialized config + command, run nothing
-  --max-concurrent <n>         max concurrent workers (default 4)
-  --timeout <ms>               per-worker timeout
-
-Examples:
-  ak run feature "add token-bucket rate limiting"
-  ak dual run security "src/auth/" --escalate  # legacy compatibility
-  ak run refactor "extract the payment module" --dry-run`;
-
-/** Build the run-local policy (persisted policy + per-run --route overrides) and
- *  project it to a dual-run config. */
-function buildConfig(cfg, template, task, routeFlags) {
-  let policy = { ...(cfg.providers?.dualRouting ?? {}) };
-  if (routeFlags?.length) {
-    const { policy: overrides, warnings } = parseRouteSpecs(routeFlags);
-    for (const w of warnings) warn(w);
-    policy = { ...policy, ...overrides };
-  }
-  return { policy, config: policyToDualRunConfig(policy, { template, task }) };
-}
-
-/** Materialize the config as an ESM module and return its file:// URL. The adapter
- *  loads --config via `await import(path)` and reads the `workers` export, so a
- *  plain .json path fails (ERR_MODULE_NOT_FOUND / missing import assertion) — it
- *  must be an importable module referenced by absolute URL. (Verified against
- *  @claude-flow/codex dual-mode/cli.js.) */
-export function writeConfigModule(config, task) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ak-dual-'));
-  const file = path.join(dir, 'dual-run.config.mjs');
-  fs.writeFileSync(file,
-    `export const workers = ${JSON.stringify(config.workers, null, 2)};\n`
-    + `export const taskContext = ${JSON.stringify(task)};\n`);
-  return pathToFileURL(file).href;
-}
-
-/** Run the adapter with the swarm live (inherited stdio). Resolves to exit code. */
-function runSwarm(configUrl, task, flags) {
-  const args = ['dual', 'run', '--config', configUrl, '--task', task];
-  if (flags.parallel) args.push('--parallel-workers');
-  if (flags['max-concurrent']) args.push('--max-concurrent', flags['max-concurrent']);
-  if (flags.timeout) args.push('--timeout', flags.timeout);
-  // WORKAROUND (upstream @claude-flow/codex, ruvnet/ruflo#2766): the orchestrator
-  // bootstraps shared memory via `npx ruflo@alpha memory init`, whose default DB path
-  // differs from where the spawned workers read it → the whole run dies with "Database
-  // not initialized". Pinning CLAUDE_FLOW_DB_PATH makes the init and the workers share
-  // ONE db (verified: "✓ Shared memory initialized"). We only set it when the user
-  // hasn't, and the adapter inherits it via its own spawn env. Remove once #2766 ships
-  // (the adapter uses the local ruflo / a consistent path) — then re-verify a live run.
-  const dbPath = process.env.CLAUDE_FLOW_DB_PATH ?? path.join(process.cwd(), '.claude-flow', 'dual-run-memory.db');
-  fs.mkdirSync(path.dirname(dbPath), { recursive: true });
-  return new Promise((resolve) => {
-    const child = spawn(ADAPTER, args, { stdio: 'inherit', env: { ...process.env, CLAUDE_FLOW_DB_PATH: dbPath } });
-    child.on('error', () => resolve(1));
-    child.on('close', (code) => resolve(code ?? 1));
-  });
-}
-
-/** #45 defect 2: the dual orchestrator opens a NATIVE better-sqlite3 WAL on the
- *  shared DB, then shells `npx ruflo memory store`, which resolves the SAME global
- *  tree — if that tree is WASM-only, the sql.js writer refuses to whole-image-write
- *  over the live native WAL and the whole run dies at the first shared write. Refuse
- *  PRE-SPAWN when BOTH hold: the ruflo memory runtime lacks a native binding AND
- *  `-wal`/`-shm` sidecars sit beside the target DB. existsSync-based on purpose
- *  (EC-6): a false refusal costs one `ak sync`, a false pass corrupts the store.
- *  Pure + injectable so it's tested without a spawn or a global tree.
- *  @param {string} dbPath
- *  @param {{ runtime?: { installed: boolean, contexts: Array<{ ok: boolean }> } | null,
- *            existsSync?: typeof fs.existsSync }} [opts] */
-export function nativeWalConflict(dbPath, { runtime, existsSync = fs.existsSync } = {}) {
-  const wasmOnly = !!runtime?.installed && runtime.contexts.some((c) => !c.ok);
-  const sidecar = existsSync(`${dbPath}-wal`) || existsSync(`${dbPath}-shm`);
-  return { refuse: wasmOnly && sidecar, wasmOnly, sidecar };
-}
-
-function printPlan(template, task, config) {
-  console.log(bold(`dual run: ${template}`) + dim(`  "${task}"`));
-  for (const w of config.workers) {
-    const dep = w.dependsOn ? `after ${w.dependsOn.join(',')}` : 'start';
-    console.log(`  ${w.id.padEnd(12)} ${w.platform.padEnd(7)} ${(w.model ?? '').padEnd(22)} ${dim(dep)}`);
-  }
-}
-
-async function doRun({ positionals, flags }) {
-  const template = positionals[1];
-  const task = positionals.slice(2).join(' ').trim();
-  if (!template || !DUAL_RUN_TEMPLATE_NAMES.includes(template)) {
-    fail(`unknown template "${template ?? ''}" — expected: ${DUAL_RUN_TEMPLATE_NAMES.join(', ')}`);
-    return 2;
-  }
-  if (!task) { fail('a task description is required: ak dual run <template> "<task>"'); return 2; }
-
-  const cfg = loadKitConfig();
-  if (Object.keys(cfg.providers?.dualRouting ?? {}).length === 0) {
-    fail('no per-activity routing configured — enable dual-host first: ak host pick --host claude,codex');
-    return 1;
-  }
-
-  const { policy, config } = buildConfig(cfg, template, task, flags.route);
-
-  if (flags['dry-run'] || flags.json) {
-    const cmd = `${ADAPTER} dual run --config <file> --task ${JSON.stringify(task)}${flags.parallel ? ' --parallel-workers' : ''}`;
-    // --json emits ONLY the JSON object (no human table) so it stays pipeable.
-    if (flags.json) { console.log(JSON.stringify({ template, task, config, command: cmd }, null, 2)); return 0; }
-    printPlan(template, task, config);
-    console.log(dim(`\ncommand: ${cmd}\nconfig:`)); console.log(JSON.stringify(config, null, 2));
-    return 0;
-  }
-
-  printPlan(template, task, config);
-  if (!(await have(ADAPTER))) {
-    fail(`${ADAPTER} not found — enable dual-host to install the adapter: ak host pick --host claude,codex`);
-    return 1;
-  }
-
-  // #45 defect 2 pre-flight: refuse BEFORE spawning a worker (the crash is otherwise
-  // mid-run, at the first shared-memory write). Sidecar check is a cheap fs stat, so
-  // only pay for the runtime probe (a child `node`) when a WAL is actually live.
-  const dbPath = process.env.CLAUDE_FLOW_DB_PATH ?? path.join(process.cwd(), '.claude-flow', 'dual-run-memory.db');
-  if (fs.existsSync(`${dbPath}-wal`) || fs.existsSync(`${dbPath}-shm`)) {
-    const { refuse } = nativeWalConflict(dbPath, { runtime: await rufloRuntimeNatives() });
-    if (refuse) {
-      fail(`refusing to start: ruflo's memory runtime lacks a native better-sqlite3 binding AND ${dbPath} has an active native WAL (-wal/-shm sidecars). `
-        + 'The orchestrator\'s native WAL writer and the sql.js (WASM) `npx ruflo memory store` cannot share this DB — it would corrupt the store.');
-      info('fix: run: ak sync   (builds the native binding for ruflo\'s memory runtime), then retry');
-      return 1;
-    }
-  }
-
-  // track the temp config-module dirs so we don't leak them (L3).
-  const tmp = [];
-  const mkConfig = (c) => { const url = writeConfigModule(c, task); tmp.push(path.dirname(fileURLToPath(url))); return url; };
-  let code;
-  try {
-    code = await runSwarm(mkConfig(config), task, flags);
-    // escalation: retry once up the (cross-vendor) ladder on failure (ADR-0004)
-    if (code !== 0 && flags.escalate) {
-      const overlay = escalatePolicy(policy);
-      if (Object.keys(overlay).length) {
-        warn(`run failed (exit ${code}) — escalating: ${Object.entries(overlay).map(([a, r]) => `${a}→${r.host}`).join(', ')}`);
-        code = await runSwarm(mkConfig(policyToDualRunConfig({ ...policy, ...overlay }, { template, task })), task, flags);
-      } else {
-        warn('run failed and no escalation ladder is configured for these activities');
-      }
-    }
-  } finally {
-    for (const d of tmp) { try { fs.rmSync(d, { recursive: true, force: true }); } catch { /* best-effort */ } }
-  }
-
-  if (code === 0) { ok('dual run complete'); return 0; }
-  fail(`dual run failed (exit ${code})`);
-  // ak already pins CLAUDE_FLOW_DB_PATH to neutralize the upstream @claude-flow/codex
-  // shared-memory bootstrap bug (ruvnet/ruflo#2766), so a failure here is usually a worker (auth, sandbox,
-  // or model access) — not routing. The materialized config + host/model assignment
-  // are ak's part and are correct.
-  info('workers run as `claude -p` / `codex exec`; a failure here is typically host auth/sandbox/model access, not your routing. Re-run a single step with --route to isolate.');
-  return code;
-}
-
-function listTemplates() {
-  console.log(bold('dual-run templates') + dim('  (pipeline of activities; hosts come from your routing policy)'));
-  for (const name of DUAL_RUN_TEMPLATE_NAMES) {
-    const pipeline = DUAL_RUN_TEMPLATES[name].map((n) => n.activity).join(' → ');
-    console.log(`  ${name.padEnd(10)} ${dim(pipeline)}`);
-  }
-}
-
-export async function run({ flags, positionals }) {
-  const sub = positionals[0] ?? 'help';
-  if (sub === 'run') return doRun({ positionals, flags });
-  if (sub === 'templates') { listTemplates(); return 0; }
-  if (sub !== 'help') fail(`unknown dual subcommand: ${sub} (run|templates)`);
-  else console.log(help);
-  return sub === 'help' ? 0 : 2;
-}
diff --git a/src/commands/run.mjs b/src/commands/run.mjs
index aa42d1f..6260c6e 100644
--- a/src/commands/run.mjs
+++ b/src/commands/run.mjs
@@ -1,9 +1,8 @@
-// ak run — host-neutral execution of the managed activity routing plan. `ak dual`
-// remains the compatibility adapter for claude-flow-codex collaboration pipelines.
+// ak run — host-neutral execution of the managed activity routing plan.
 import { loadKitConfig } from '../lib/config.mjs';
 import { fail, ok, dim, bold } from '../lib/output.mjs';
 import { executeRunPlan } from '../lib/execution/runner.mjs';
-import { DUAL_RUN_TEMPLATE_NAMES, materializeRunPlan, parseRouteSpecs } from '../lib/routing.mjs';
+import { RUN_TEMPLATE_NAMES, materializeRunPlan, parseRouteSpecs } from '../lib/routing.mjs';
 
 export const options = {
   route: { type: 'string', multiple: true },
@@ -28,7 +27,7 @@ repositories you would trust with your full user privileges (ADR-0018).
 Usage:
   ak run <template> "<task>"
 
-Templates: ${DUAL_RUN_TEMPLATE_NAMES.join(', ')}
+Templates: ${RUN_TEMPLATE_NAMES.join(', ')}
 
 Options:
   --route 'act:host[:model]'   per-run routing override (repeatable; not persisted)
@@ -59,18 +58,18 @@ function positiveInt(value, name, { ceiling } = {}) {
   return n;
 }
 
-/** A persisted dualRouting entry (kit.json is hand-editable — CLI routes are
+/** A persisted routing.routes entry (kit.json is hand-editable — CLI routes are
  *  validated, file entries were not, and a bad one crashed plan *printing*
  *  far from the cause, #88). Returns an error string, or null when valid. */
 function routeEntryError(activity, entry) {
   if (!entry || typeof entry !== 'object') return `route "${activity}" must be an object`;
   if (typeof entry.host !== 'string' || !entry.host) return `route "${activity}" requires a non-empty host string`;
   if (entry.model != null && typeof entry.model !== 'string') return `route "${activity}".model must be a string when present`;
-  if (entry.escalate != null) {
-    if (!Array.isArray(entry.escalate)) return `route "${activity}".escalate must be an array when present`;
-    for (const [i, rung] of entry.escalate.entries()) {
-      if (!rung || typeof rung.host !== 'string' || !rung.host) return `route "${activity}".escalate[${i}] requires a non-empty host string`;
-      if (rung.model != null && typeof rung.model !== 'string') return `route "${activity}".escalate[${i}].model must be a string when present`;
+  if (entry.escalation != null) {
+    if (!Array.isArray(entry.escalation)) return `route "${activity}".escalation must be an array when present`;
+    for (const [i, rung] of entry.escalation.entries()) {
+      if (!rung || typeof rung.host !== 'string' || !rung.host) return `route "${activity}".escalation[${i}] requires a non-empty host string`;
+      if (rung.model != null && typeof rung.model !== 'string') return `route "${activity}".escalation[${i}].model must be a string when present`;
     }
   }
   return null;
@@ -82,7 +81,7 @@ function validatePolicy(policy) {
 }
 
 export function buildRunPlan(cfg, template, task, routeFlags = []) {
-  let policy = { ...(cfg.providers?.dualRouting ?? {}) };
+  let policy = { ...(cfg.routing?.routes ?? {}) };
   if (routeFlags.length) {
     const { policy: overrides, warnings } = parseRouteSpecs(routeFlags);
     policy = { ...policy, ...overrides };
@@ -115,8 +114,8 @@ function printResults(results) {
 export async function run({ flags, positionals, executePlan = executeRunPlan, cfg = loadKitConfig() }) {
   const template = positionals[0];
   const task = positionals.slice(1).join(' ').trim();
-  if (!template || !DUAL_RUN_TEMPLATE_NAMES.includes(template)) {
-    fail(`unknown template "${template ?? ''}" — expected: ${DUAL_RUN_TEMPLATE_NAMES.join(', ')}`);
+  if (!template || !RUN_TEMPLATE_NAMES.includes(template)) {
+    fail(`unknown template "${template ?? ''}" — expected: ${RUN_TEMPLATE_NAMES.join(', ')}`);
     return 2;
   }
   if (!task) { fail('a task description is required: ak run <template> "<task>"'); return 2; }
diff --git a/src/commands/setup.mjs b/src/commands/setup.mjs
index e88b4dc..ec35f79 100644
--- a/src/commands/setup.mjs
+++ b/src/commands/setup.mjs
@@ -15,7 +15,7 @@ import { register as mcpRegister, applyExclusions } from '../lib/mcp.mjs';
 import { OPENCODE_LIFECYCLE_ADAPTER, reconcileOpencodeGuidance } from '../lib/opencode.mjs';
 import { runLifecycle } from '../lib/adapters/lifecycle.mjs';
 import { loadKitConfig, saveKitConfig } from '../lib/config.mjs';
-import { HOSTS, applyHosts, applyProviders, ensureDualAgents, hostInstallState, installHost, applyAqeRouter, seedDualRoutingIfDualHost, printActivityRoutingTable, aqeSupportsAgentOverrides, ensureCodexMcp, ensureRufloMcpInCodex, applySetupHostFlags } from '../lib/providers.mjs';
+import { HOSTS, applyHosts, applyProviders, hostInstallState, installHost, applyAqeRouter, seedActivityRoutesIfMultiHost, printActivityRoutingTable, aqeSupportsAgentOverrides, ensureCodexMcp, ensureRufloMcpInCodex, applySetupHostFlags } from '../lib/providers.mjs';
 import { installedVersion } from '../lib/versions.mjs';
 import * as rb from '../lib/ruvnet-brain.mjs';
 import * as adb from '../lib/agentdb.mjs';
@@ -160,7 +160,7 @@ export async function run_machine({ flags, pkgRoot, cfg }) {
   // 6. frontier hosts — install any ENABLED host that is entirely absent (default
   //    enables claude only). External installs (mise/native/brew) are left alone.
   for (const h of HOSTS) {
-    if (!cfg.providers?.hosts?.[h.id]) continue;
+    if (!cfg.integrations?.hosts?.[h.id]) continue;
     const st = await hostInstallState(h);
     if (st.method === 'absent') {
       if (await ask(`${h.id} CLI not found — install ${h.pkg} globally?`, true, flags.yes)) {
@@ -176,7 +176,7 @@ export async function run_machine({ flags, pkgRoot, cfg }) {
   //     converted agents, platform skill (opencode.mjs owns all of it). Only
   //     when the CLI is actually present: a declined/failed install must not
   //     leave a freshly-created config home behind (codex-review #4).
-  if (cfg.providers?.hosts?.opencode) {
+  if (cfg.integrations?.hosts?.opencode) {
     if (!(await have('opencode'))) {
       warn('opencode: enabled but CLI not installed — wiring skipped (re-run `ak sync` after installing opencode-ai)');
     } else {
@@ -204,11 +204,11 @@ export async function run_machine({ flags, pkgRoot, cfg }) {
   }
 
   // 7. frontier host hint — codex detected but not enabled (opt-in via `ak host pick`)
-  if (!cfg.providers?.hosts?.codex && await have('codex')) {
+  if (!cfg.integrations?.hosts?.codex && await have('codex')) {
     info('codex CLI detected — run `ak host pick` to let ruflo use both claude and codex');
   }
   // opencode hint — detected but not enabled (post-install opt-in via provider pick)
-  if (!cfg.providers?.hosts?.opencode && await have('opencode')) {
+  if (!cfg.integrations?.hosts?.opencode && await have('opencode')) {
     info('opencode CLI detected — wire ruflo + ruvnet-brain into it with: ak host pick --host claude,opencode');
   }
   return true;
@@ -304,33 +304,31 @@ export async function run_project({ flags, cfg }) {
     }
     heal.healRvf(paths.projectAqeDir(root));
     // aqe ≥ 3.13.1 with codex enabled → install the Codex-native QE skills too.
-    const withCodex = !!cfg.providers?.hosts?.codex && aqeSupportsAgentOverrides();
+    const withCodex = !!cfg.integrations?.hosts?.codex && aqeSupportsAgentOverrides();
     const aqe = await runCmd('aqe', ['init', '--auto', ...(withCodex ? ['--with-codex'] : [])], { cwd: root, timeout: 300_000 });
     (aqe.code === 0 ? ok : warn)(`agentic-qe initialized${withCodex ? ' (+ codex skills)' : ''}`);
   }
 
   // 9.5 frontier host/provider wiring — reapply kit.json prefs (no-op at the
   //     claude-only default, so existing repos see zero change). When codex is
-  //     enabled: write ENABLE_* env, regenerate dual-mode agents, register providers.
+  //     enabled: write ENABLE_* env and register providers.
   const ph = applyHosts(cfg, root);
   if (ph.changed) ok(`providers: ${ph.detail}`);
   // dual-host: seed the per-activity routing policy from defaults (persist first
   // so the router materialization below writes agentOverrides). No-op single-host.
-  const seed = seedDualRoutingIfDualHost(cfg);
+  const seed = seedActivityRoutesIfMultiHost(cfg);
   if (seed.seeded) { saveKitConfig(cfg); ok(`per-activity routing seeded — ${seed.count} activities (dual-host defaults)`); }
   const rt = applyAqeRouter(cfg, root);
   if (rt.changed) (rt.ok ? ok : warn)(`aqe router: ${rt.detail}`);
-  if (Object.keys(cfg.providers?.dualRouting ?? {}).length) printActivityRoutingTable(cfg);
-  if (cfg.providers?.hosts?.codex) {
-    const dual = await ensureDualAgents(cfg, root);
-    (dual.ok ? ok : warn)(`dual agents: ${dual.detail}`);
+  if (Object.keys(cfg.routing?.routes ?? {}).length) printActivityRoutingTable(cfg);
+  if (cfg.integrations?.hosts?.codex) {
     const mcp = await ensureCodexMcp(cfg, root);
     if (mcp.changed) saveKitConfig(cfg); // persist the codexMcp ownership marker
     if (mcp.changed || !mcp.ok) (mcp.ok ? ok : warn)(`codex MCP: ${mcp.detail}`);
     // reverse bridge: register ruflo MCP into codex (codex→ruflo) so the bridge is
     // two-way — parity with `ak sync` / `ak host pick`.
     const rmcp = await ensureRufloMcpInCodex(cfg, root);
-    if (rmcp.changed) saveKitConfig(cfg); // persist the rufloCodexMcp ownership marker
+    if (rmcp.changed) saveKitConfig(cfg); // persist reverse MCP ownership
     if (rmcp.changed || !rmcp.ok) (rmcp.ok ? ok : warn)(`ruflo→codex MCP: ${rmcp.detail}`);
     const prov = await applyProviders(cfg, root);
     if (prov.changed) (prov.ok ? ok : warn)(`providers: ${prov.detail}`);
@@ -382,8 +380,8 @@ export async function run({ flags, pkgRoot }) {
     for (const w of hostFlags.warnings) warn(w);
     if (hostFlags.changed) {
       if (flags.codex || flags['primary-host'] === 'codex') {
-        const primary = cfg.providers.primaryHost && cfg.providers.primaryHost !== 'claude'
-          ? ` (primary: ${cfg.providers.primaryHost})` : '';
+        const primary = cfg.routing?.primaryHost && cfg.routing.primaryHost !== 'claude'
+          ? ` (primary: ${cfg.routing.primaryHost})` : '';
         info(`codex host enabled${primary} — will install + wire dual-mode`);
       }
       if (flags.opencode) info('opencode host enabled — will wire opencode.json and deploy plugin/agents/skills');
diff --git a/src/commands/status.mjs b/src/commands/status.mjs
index 88934ee..72f7573 100644
--- a/src/commands/status.mjs
+++ b/src/commands/status.mjs
@@ -174,7 +174,7 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
       const wasm = rt.contexts.filter((c) => !c.ok);
       if (wasm.length) {
         rows.push(row('natives', 'fail',
-          `ruflo memory runtime on WASM fallback (${wasm.map((c) => `@claude-flow/${c.context}`).join(', ')}) — memory store/dual run degrade`,
+          `ruflo memory runtime on WASM fallback (${wasm.map((c) => `@claude-flow/${c.context}`).join(', ')}) — memory and orchestration may degrade`,
           'sync builds the native binding'));
       } else {
         rows.push(row('natives', 'ok', `ruflo memory runtime native (${rt.contexts.map((c) => c.context).join(', ')})`));
@@ -320,7 +320,7 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
   // path (ADR-0001 projection #3). Only surfaces when the codex host is enabled;
   // setup/sync register it project-scoped via ensureCodexMcp. Spawn-free: reads the
   // project .mcp.json (== `claude mcp get codex`) plus the kit.json ownership marker.
-  if (cfg.providers?.hosts?.codex) {
+  if (cfg.integrations?.hosts?.codex) {
     try {
       const { registered, owned } = codexMcpStatus(cfg, cwd);
       if (registered) {
@@ -375,12 +375,12 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
   // bridge, the converted agent set, and the platform skill. Only surfaces when
   // the opencode host is enabled AND installed (enabled-but-absent is the
   // hosts row's story); probes are file reads + one bin check (codex-review #4).
-  if (cfg.providers?.hosts?.opencode) {
+  if (cfg.integrations?.hosts?.opencode) {
     try {
       if (!(await have('opencode'))) {
         rows.push(row('opencode', 'warn', 'enabled but opencode CLI not installed', 'sync installs opencode-ai (hosts step)'));
       } else {
-        const source = catalogSource({ override: cfg.providers?.opencodeCatalogDir });
+        const source = catalogSource({ override: cfg.integrations?.ownership?.opencode?.catalogDir });
         const st = opencodeMcpStatus(cfg);
         const conv = st.parseError ? null : await opencodeConverged(cfg);
         if (st.parseError) {
@@ -399,12 +399,12 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
           rows.push(row('opencode', 'ok',
             `opencode.json converged (claude-flow${st.brain ? ' + ruvnet-brain' : ''} MCP, ${st.paths?.length ?? 0} skills path(s))${st.owned ? '' : ' — pre-existing (not ak-managed)'}`));
         }
-        const receiptState = opencodeArtifactReceiptState(cfg.providers?.opencodeManaged);
+        const receiptState = opencodeArtifactReceiptState(cfg.integrations?.ownership?.opencode?.managed);
         const artifactReceipts = receiptState.receipts;
         if (receiptState.adoptionBlocked) {
           rows.push(row('opencode', 'warn',
             'artifact receipt ledger is malformed — ownership adoption blocked; artifacts left untouched',
-            'repair providers.opencodeManaged.artifacts in kit.json or restore it from backup'));
+            'repair integrations.ownership.opencode.managed.artifacts in kit.json or restore it from backup'));
         }
         const plug = pluginStatus({
           pkgRoot, receipt: artifactReceipts.plugin,
@@ -470,9 +470,9 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
   // install (mise/native/brew) is reported but never touched.
   try {
     // primary host absent = fail (nothing can drive); alternate absent = warn.
-    const primaryHost = cfg.providers?.primaryHost ?? 'claude';
+    const primaryHost = cfg.routing?.primaryHost ?? 'claude';
     for (const h of HOSTS) {
-      if (!cfg.providers.hosts[h.id]) continue;
+      if (!cfg.integrations.hosts[h.id]) continue;
       const detected = integrationFacts.hosts[h.id];
       if (detected?.present === false) {
         rows.push(row('hosts', h.id === primaryHost ? 'fail' : 'warn',
@@ -510,7 +510,7 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
       } else {
         rows.push(row('providers', 'info', 'claude-only (default host)'));
       }
-      if (!cfg.providers?.hosts?.opencode && await have('opencode')) {
+      if (!cfg.integrations?.hosts?.opencode && await have('opencode')) {
         rows.push(row('providers', 'info', 'opencode CLI installed but not enabled (`ak host pick --host claude,opencode` wires it)'));
       }
     } else {
@@ -524,7 +524,7 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
         const diskOrder = (disk?.fallbackChain?.entries ?? []).map((e) => e.provider).join('→');
         routerDrift = disk?._managedBy !== 'agentic-kit' || diskOrder !== chain.map((e) => e.provider).join('→');
       }
-      const on = HOSTS.filter((h) => cfg.providers.hosts[h.id]).map((h) => h.id).join('+') || 'none';
+      const on = HOSTS.filter((h) => cfg.integrations.hosts[h.id]).map((h) => h.id).join('+') || 'none';
       const chainStr = chain.length ? `; aqe chain ${chain.map((e) => e.provider).join('→')}` : '';
       if (envDrift || routerDrift) {
         rows.push(row('providers', 'warn', `provider config drifted (want ${on}${chainStr}, ${scope})`, 'sync re-applies provider env + aqe router'));
@@ -550,10 +550,10 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
     rows.push(row('providers', 'warn', `provider check unavailable: ${e.message}`));
   }
 
-  // per-activity routing (dualRouting → agentOverrides projection). Only surfaces
+  // Per-activity routing (canonical routes → agentOverrides projection). Only surfaces
   // once a policy is set; the dashboard renders this row like any other subsystem.
   try {
-    const policy = cfg.providers?.dualRouting ?? {};
+    const policy = cfg.routing?.routes ?? {};
     if (Object.keys(policy).length) {
       const s = routingSummary(policy);
       const want = policyToAgentOverrides(policy);
@@ -572,12 +572,12 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
       // "diverges from": which side wins is activity-dependent (a newer default
       // can cost 2-3× the agentic turns on routine work), so a `warn` would push
       // users to spend turns clearing a lint. No `fix` — sync must never
-      // auto-refresh a pin; `ak x provider refresh` is the opt-in path (#55).
+      // auto-refresh a pin; `ak host refresh` is the opt-in path (#55).
       const diverged = divergedRoutes(policy);
       if (diverged.length) {
         const pairs = [...new Set(diverged.flatMap((d) => [
           ...(d.modelDiverged ? [`${d.model} vs ${d.defaultModel}`] : []),
-          ...d.escalate.map((e) => `${e.model} vs ${e.defaultModel} (escalation)`),
+          ...d.escalation.map((e) => `${e.model} vs ${e.defaultModel} (escalation)`),
         ]))].join(', ');
         rows.push(row('routing', 'info',
           `${diverged.length} seeded route(s) diverge from current defaults (${pairs}) — ak host refresh`));
@@ -614,7 +614,7 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
     const resolve = (r) => (r.custom
       ? (r.template.startsWith('~/') ? path.join(paths.home, r.template.slice(2)) : r.template)
       : path.join(pkgRoot, 'claude', r.template));
-    const ctx = { flags: { dualMode: bothHostsEnabled(cfg), opencodeEnabled: !!cfg.providers?.hosts?.opencode } };
+    const ctx = { flags: { dualMode: bothHostsEnabled(cfg), opencodeEnabled: !!cfg.integrations?.hosts?.opencode } };
     for (const t of guidanceTargets({ cwd, cfg })) {
       const treg = [...blocksForTarget(rowsReg, t.name), ...retiredForTarget(rowsReg, t.name)];
       const res = await syncBlocks(t.file, treg, resolve, { dryRun: true, context: ctx });
@@ -682,7 +682,7 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
     rows.push(row('statusline', 'info', 'no project statusline here (created by setup)'));
   }
   // Codex has a native user-scoped line, but no command-backed rich renderer.
-  if (cfg.providers?.hosts?.codex || cfg.statusline?.codex) {
+  if (cfg.integrations?.hosts?.codex || cfg.statusline?.codex) {
     const codexLine = statuslineDrift(cfg);
     if (!codexLine.owned) {
       rows.push(row('codex-statusline', 'info',
@@ -696,7 +696,7 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
         `managed Codex ${codexLine.preset} native status line is current (rich ruflo/SONA/AQE segments remain Claude-only)`));
     }
   }
-  if (cfg.providers?.hosts?.opencode) {
+  if (cfg.integrations?.hosts?.opencode) {
     rows.push(row('statusline', 'info',
       'opencode has no statusline surface; its ruflo lifecycle ships via the plugins/ bridge + AGENTS.md'));
   }
diff --git a/src/commands/sync.mjs b/src/commands/sync.mjs
index fb1651d..0dda73a 100644
--- a/src/commands/sync.mjs
+++ b/src/commands/sync.mjs
@@ -12,7 +12,7 @@ import { OPENCODE_LIFECYCLE_ADAPTER } from '../lib/opencode.mjs';
 import { runLifecycle } from '../lib/adapters/lifecycle.mjs';
 import { listDaemons, staleDaemons, reap } from '../lib/daemons.mjs';
 import { loadKitConfig, saveKitConfig } from '../lib/config.mjs';
-import { commandHosts, applyHosts, applyProviders, hostInstallState, installHost, applyAqeRouter, seedDualRoutingIfDualHost, ensureCodexMcp, ensureRufloMcpInCodex, bothHostsEnabled } from '../lib/providers.mjs';
+import { commandHosts, applyHosts, applyProviders, hostInstallState, installHost, applyAqeRouter, seedActivityRoutesIfMultiHost, ensureCodexMcp, ensureRufloMcpInCodex, bothHostsEnabled } from '../lib/providers.mjs';
 import { driftReport, selfDrift } from '../lib/versions.mjs';
 import { RUVECTOR_PKG, managed as ruvectorManaged } from '../lib/ruvector.mjs';
 import { pruneNpxStale } from '../lib/npx.mjs';
@@ -154,7 +154,7 @@ export async function run({ flags, pkgRoot }) {
   // npm-managed hosts ride the versions branch above via driftReport).
   if (subsystems.has('hosts')) {
     for (const h of commandHosts()) {
-      if (!cfg.providers.hosts[h.id]) continue;
+      if (!cfg.integrations.hosts[h.id]) continue;
       if ((await hostInstallState(h)).method !== 'absent') continue;
       await step(`install ${h.id}`, () => installHost(h.id));
     }
@@ -167,7 +167,7 @@ export async function run({ flags, pkgRoot }) {
   // Runs BEFORE the blocks branch: the agents-opencode guidance target is gated
   // on the config home this branch creates — this order lets a fresh enable
   // converge guidance in the SAME sync (a second sync is then a true no-op).
-  if (subsystems.has('opencode') && cfg.providers?.hosts?.opencode) {
+  if (subsystems.has('opencode') && cfg.integrations?.hosts?.opencode) {
     if (!(await have('opencode'))) {
       info('opencode: enabled but CLI not installed — wiring skipped (hosts step installs it)');
     } else {
@@ -207,7 +207,7 @@ export async function run({ flags, pkgRoot }) {
     // (retiredForTarget) — the migration path that clears the dual block out of
     // any project AGENTS.md that still carries it after the re-scope
     // (ADR-0008).
-    const ctx = { flags: { dualMode: bothHostsEnabled(cfg), opencodeEnabled: !!cfg.providers?.hosts?.opencode } };
+    const ctx = { flags: { dualMode: bothHostsEnabled(cfg), opencodeEnabled: !!cfg.integrations?.hosts?.opencode } };
     for (const t of guidanceTargets({ cwd, cfg })) {
       const treg = [...blocksForTarget(rowsReg, t.name), ...retiredForTarget(rowsReg, t.name)];
       const res = await syncBlocks(t.file, treg, resolve, { context: ctx });
@@ -222,7 +222,7 @@ export async function run({ flags, pkgRoot }) {
     report('providers', applyHosts(cfg, cwd));
     // heal per-activity routing: seed from defaults if dual-host only just became
     // eligible (e.g. aqe upgraded ≥3.13.1 since enablement), before materializing.
-    const seed = seedDualRoutingIfDualHost(cfg);
+    const seed = seedActivityRoutesIfMultiHost(cfg);
     if (seed.seeded) { saveKitConfig(cfg); report('routing', { ok: true, changed: true, detail: `seeded ${seed.count} activities` }); }
     const router = applyAqeRouter(cfg, cwd);
     if (router.changed || !router.ok) report('aqe router', router);
diff --git a/src/commands/uninstall.mjs b/src/commands/uninstall.mjs
index 9779726..bed193a 100644
--- a/src/commands/uninstall.mjs
+++ b/src/commands/uninstall.mjs
@@ -124,7 +124,7 @@ export async function run({ flags }) {
   {
     // cfg comes from the top of run() (read before any purge of kit.json).
     // --purge removes kit.json above; persisting cfg here would recreate it.
-    if (cfg.providers?.opencodeMcp === 'ak') {
+    if (cfg.integrations?.ownership?.opencode?.mcp === 'ak') {
       if (dry) info('[dry-run] stripped ak-managed opencode wiring + artifacts (opencode.json, plugin, agents, skill)');
       else {
         const ret = retireOpencode(cfg);
diff --git a/src/commands/x/dashboard.mjs b/src/commands/x/dashboard.mjs
index 5aeea68..7357c47 100644
--- a/src/commands/x/dashboard.mjs
+++ b/src/commands/x/dashboard.mjs
@@ -3,7 +3,7 @@
 // Boots a loopback-only HTTP server (127.0.0.1) that serves a single
 // self-contained page plus read-only status, usage, and live-session endpoints.
 // The live view tails metadata from Claude/Codex and optional explicitly
-// registered ruflo/AQE/dual-run JSONL sources. Runs FOREGROUND and blocks until
+// registered ruflo/AQE JSONL sources. Runs FOREGROUND and blocks until
 // Ctrl-C; nothing is detached and nothing mutates state.
 import path from 'node:path';
 import { startDashboard } from '../../lib/dashboard-server.mjs';
@@ -44,7 +44,7 @@ Options:
   --no-open   don't auto-open the browser (just print the URL — for headless use)
   --live-source 'surface=path'
               observe an explicit structured JSONL source; repeatable.
-              surface is ruflo, aqe, or dual-run
+              surface is ruflo or aqe
 
 Examples:
   ak x dashboard              serve + open http://127.0.0.1:7431
@@ -57,9 +57,9 @@ export function parseLiveSources(raw, cwd = process.cwd()) {
   const values = Array.isArray(raw) ? raw : raw ? [raw] : [];
   const sources = [];
   for (const value of values) {
-    const match = /^(ruflo|aqe|dual-run)=(.+)$/.exec(String(value));
+    const match = /^(ruflo|aqe)=(.+)$/.exec(String(value));
     if (!match || !match[2].trim()) {
-      throw new TypeError(`invalid --live-source ${value}; expected ruflo|aqe|dual-run=path`);
+      throw new TypeError(`invalid --live-source ${value}; expected ruflo|aqe=path`);
     }
     sources.push({ surface: match[1], file: path.resolve(cwd, match[2].trim()) });
   }
diff --git a/src/commands/x/provider.mjs b/src/commands/x/host.mjs
similarity index 88%
rename from src/commands/x/provider.mjs
rename to src/commands/x/host.mjs
index eb6e102..0fe12c4 100644
--- a/src/commands/x/provider.mjs
+++ b/src/commands/x/host.mjs
@@ -1,4 +1,4 @@
-// x provider — frontier-host + LLM-provider detection and wiring.
+// x host — frontier-host + LLM-provider detection and wiring.
 //   status (default) : detected CLIs, aqe provider, ruflo providers, what's wired
 //   pick             : choose enabled hosts / aqe provider / ruflo providers → persist → apply
 //   off              : reversible teardown (strip managed env keys)
@@ -7,10 +7,10 @@
 import readline from 'node:readline/promises';
 import {
   HOSTS, API_PROVIDERS, AQE_PROVIDER_TYPES, detectHosts,
-  settingsTarget, isDefault, applyHosts, applyProviders, ensureDualAgents,
+  settingsTarget, isDefault, applyHosts, applyProviders,
   undoProviders, hostInstallState, hostAuthState, installHost, applyAqeRouter, undoAqeRouter,
   bothHostsEnabled, DUAL_ROLE_TIP, JUDGE_BIAS_TIP, QE_COURT_TIP, suggestedFallbackFor,
-  seedDualRoutingIfDualHost, printActivityRoutingTable, ensureCodexMcp, undoCodexMcp,
+  seedActivityRoutesIfMultiHost, printActivityRoutingTable, ensureCodexMcp, undoCodexMcp,
   ensureRufloMcpInCodex, undoRufloMcpInCodex, detectAqeProviders, aqeProviderCredential, credentialGaps, fallbackSource,
   collectIntegrationFacts,
 } from '../../lib/providers.mjs';
@@ -138,7 +138,7 @@ export async function run({ flags, positionals, pkgRoot }) {
   if (sub === 'pick') return pick({ flags, cwd, pkgRoot });
   if (sub === 'refresh') return refresh({ flags, cwd });
 
-  fail(`unknown provider subcommand: ${sub} (status|pick|refresh|off)`);
+  fail(`unknown host subcommand: ${sub} (status|pick|refresh|off)`);
   return 2;
 }
 
@@ -150,7 +150,16 @@ async function status({ flags, cwd }) {
   const { scope } = settingsTarget(cwd);
 
   if (flags.json) {
-    console.log(JSON.stringify({ scope, config: cfg.providers, hosts, providers }, null, 2));
+    console.log(JSON.stringify({
+      scope,
+      config: {
+        integrations: cfg.integrations,
+        routing: cfg.routing,
+        providers: cfg.providers,
+      },
+      hosts,
+      providers,
+    }, null, 2));
     return 0;
   }
 
@@ -158,7 +167,7 @@ async function status({ flags, cwd }) {
   console.log(bold('ruflo agent hosts') + dim(`  (wiring scope: ${scope})`));
   for (const h of HOSTS) {
     const d = hosts[h.id];
-    const enabled = !!cfg.providers.hosts[h.id];
+    const enabled = !!cfg.integrations.hosts[h.id];
     const state = !d.present ? dim('not installed')
       : !enabled ? 'installed, disabled'
       : dflt ? 'enabled (default — ruflo default-on, no env written)'
@@ -217,8 +226,8 @@ async function status({ flags, cwd }) {
   printActivityRoutingTable(cfg);
   printQeCourtStatus(cwd);
 
-  const codexIdle = hosts.codex.present && !cfg.providers.hosts.codex;
-  const ocIdle = hosts.opencode.present && !cfg.providers.hosts.opencode;
+  const codexIdle = hosts.codex.present && !cfg.integrations.hosts.codex;
+  const ocIdle = hosts.opencode.present && !cfg.integrations.hosts.opencode;
   console.log('');
   if (codexIdle) info('codex is installed but disabled — enable it with: ak host pick');
   if (ocIdle) info('opencode is installed but disabled — enable it with: ak host pick --host claude,opencode');
@@ -251,11 +260,11 @@ function printQeCourtStatus(cwd) {
  *  current defaults. Deliberately a separate command, never part of `ak sync`:
  *  sync is documented as idempotent reapplication of persisted choice, and the
  *  newer default is not uniformly better — on routine work it can cost 2-3× the
- *  agentic turns for the same result (#55). Only `source: 'seeded'` entries are
+ *  agentic turns for the same result (#55). Only `provenance: 'seeded'` entries are
  *  eligible; a user pin survives even when named. */
 async function refresh({ flags, cwd }) {
   const cfg = loadKitConfig();
-  const policy = cfg.providers?.dualRouting ?? {};
+  const policy = cfg.routing?.routes ?? {};
   const diverged = divergedRoutes(policy);
   if (!diverged.length) { ok('no seeded routes diverge from the current defaults'); return 0; }
 
@@ -263,12 +272,12 @@ async function refresh({ flags, cwd }) {
   for (const d of diverged) {
     const head = d.modelDiverged ? `${d.model} → ${d.defaultModel}` : d.model;
     console.log(`  ${d.activity.padEnd(18)} ${d.host.padEnd(7)} ${head}`);
-    for (const e of d.escalate) console.log(`    ${dim('escalation:')} ${e.model} → ${e.defaultModel}`);
+    for (const e of d.escalation) console.log(`    ${dim('escalation:')} ${e.model} → ${e.defaultModel}`);
     // The trade, not just the ids: choosing on a price axis while paying on a
     // turns axis is the misreading this whole surface exists to prevent.
     if (d.modelDiverged && d.currentNote) console.log(dim(`    now:     ${d.model} — ${d.currentNote}`));
     if (d.modelDiverged && d.defaultNote) console.log(dim(`    default: ${d.defaultModel} — ${d.defaultNote}`));
-    for (const e of d.escalate) {
+    for (const e of d.escalation) {
       const note = modelNote(e.defaultModel);
       if (note) console.log(dim(`    default: ${e.defaultModel} — ${note}`));
     }
@@ -292,7 +301,7 @@ async function refresh({ flags, cwd }) {
   }
   if (!picked.length) { info('nothing refreshed — routes left as they are'); return 0; }
 
-  cfg.providers.dualRouting = refreshSeededRoutes(policy, { activities: picked });
+  cfg.routing.routes = refreshSeededRoutes(policy, { activities: picked });
   saveKitConfig(cfg);
   ok(`refreshed ${picked.length} route(s): ${picked.join(', ')}`);
   const router = applyAqeRouter(cfg, cwd);
@@ -303,17 +312,30 @@ async function refresh({ flags, cwd }) {
 
 async function off({ cwd, pkgRoot }) {
   const cfg = loadKitConfig();
-  const codexMcpManaged = cfg.providers?.codexMcp === 'ak';
-  const rufloCodexManaged = cfg.providers?.rufloCodexMcp === 'ak';
-  // opencode teardown reads the ownership markers from cfg — strip BEFORE the
-  // reset below clears them (mirrors the codex managed-flag captures above).
-  // On a FAILED teardown (e.g. JSONC config) the markers are the only remaining
-  // proof — preserve them for the retry instead of nulling them into the reset.
+  const codexMcpManaged = cfg.integrations?.ownership?.codex?.mcp === 'ak';
+  const rufloCodexManaged = cfg.integrations?.ownership?.codex?.reverseMcp === 'ak';
+  // OpenCode teardown reads its ownership receipt before the host/routing reset.
+  // A failed teardown retains that receipt (including catalogDir) for a retry.
   const retired = await runLifecycle({ adapter: OPENCODE_LIFECYCLE_ADAPTER, action: 'undo', cfg });
   const ret = retired.result;
-  const keptMarkers = ret.ok ? { opencodeMcp: null, opencodeManaged: null }
-    : { opencodeMcp: cfg.providers.opencodeMcp, opencodeManaged: cfg.providers.opencodeManaged };
-  cfg.providers = { hosts: { claude: true, codex: false, opencode: false }, primaryHost: 'claude', aqeProvider: null, aqeFallback: [], models: [], maxBudgetUsd: null, dualRouting: {}, codexMcp: null, rufloCodexMcp: null, ...keptMarkers };
+  cfg.providers = {
+    aqeProvider: null,
+    aqeFallback: [],
+    models: [],
+    maxBudgetUsd: null,
+  };
+  cfg.integrations.hosts = { claude: true, codex: false, opencode: false };
+  cfg.routing.primaryHost = DEFAULT_PRIMARY_HOST;
+  cfg.routing.routes = {};
+  cfg.integrations.ownership ??= {};
+  cfg.integrations.ownership.codex = {
+    ...(cfg.integrations.ownership.codex ?? {}),
+    mcp: null,
+    reverseMcp: null,
+  };
+  if (ret.ok && cfg.integrations.ownership.opencode) {
+    delete cfg.integrations.ownership.opencode.catalogDir;
+  }
   saveKitConfig(cfg);
   // enablement-gated guidance strips regardless (user content preserved).
   if (pkgRoot) await reconcileOpencodeGuidance({ pkgRoot, cfg, cwd, enabled: false });
@@ -384,18 +406,19 @@ async function pick({ flags, cwd, pkgRoot }) {
   // --host is the complete desired enabled-host set on BOTH tiers; excluding an
   // enabled host disables it (ak-managed wiring stripped, user config kept).
   const ROUTING = new Set(routableHostIds());
-  const prevOpencode = !!cfg.providers?.hosts?.opencode || cfg.providers?.opencodeMcp === 'ak';
+  const prevOpencode = !!cfg.integrations?.hosts?.opencode
+    || cfg.integrations?.ownership?.opencode?.mcp === 'ak';
   let enabled;
   let aqeProvider = cfg.providers.aqeProvider ?? null;
   // A legacy chain written before provenance existed reads as 'user': we cannot
   // tell whether it was typed or accepted, so it must never be auto-touched.
   let aqeFallback = (cfg.providers.aqeFallback ?? []).map((e) => ({ ...e, source: fallbackSource(e) }));
   let models = cfg.providers.models ?? [];
-  const prevPrimary = cfg.providers.primaryHost ?? DEFAULT_PRIMARY_HOST;
-  const oldPolicy = cfg.providers.dualRouting ?? {};
-  const prevCodex = !!cfg.providers?.hosts?.codex;
-  const codexMcpManaged = cfg.providers?.codexMcp === 'ak';
-  const rufloCodexManaged = cfg.providers?.rufloCodexMcp === 'ak';
+  const prevPrimary = cfg.routing?.primaryHost ?? DEFAULT_PRIMARY_HOST;
+  const oldPolicy = cfg.routing?.routes ?? {};
+  const prevCodex = !!cfg.integrations?.hosts?.codex;
+  const codexMcpManaged = cfg.integrations?.ownership?.codex?.mcp === 'ak';
+  const rufloCodexManaged = cfg.integrations?.ownership?.codex?.reverseMcp === 'ak';
 
   const nonInteractive = flags.host !== undefined || flags['aqe-provider'] !== undefined
     || flags['aqe-fallback'] !== undefined || flags.provider !== undefined
@@ -403,7 +426,7 @@ async function pick({ flags, cwd, pkgRoot }) {
   if (nonInteractive) {
     enabled = flags.host !== undefined
       ? flags.host.split(',').map((s) => s.trim()).filter(Boolean)
-      : Object.entries(cfg.providers.hosts).filter(([, v]) => v).map(([k]) => k);
+      : Object.entries(cfg.integrations.hosts).filter(([, v]) => v).map(([k]) => k);
     if (flags['aqe-provider'] !== undefined) {
       const v = flags['aqe-provider'].trim().toLowerCase();
       aqeProvider = (v === 'none' || v === '') ? null : v;
@@ -415,8 +438,8 @@ async function pick({ flags, cwd, pkgRoot }) {
     if (flags.provider !== undefined) models = parseModels(flags.provider);
   } else {
     const installedRouting = HOSTS.filter((h) => hosts[h.id].present && ROUTING.has(h.id)
-      && (h.id !== 'opencode' || cfg.providers.hosts.opencode)).map((h) => h.id);
-    const installedOpenCode = hosts.opencode?.present && !cfg.providers.hosts.opencode;
+      && (h.id !== 'opencode' || cfg.integrations.hosts.opencode)).map((h) => h.id);
+    const installedOpenCode = hosts.opencode?.present && !cfg.integrations.hosts.opencode;
     if (installedRouting.length === 0 && !installedOpenCode) { fail('no frontier CLI (claude/codex/opencode) found on PATH'); return 1; }
     console.log(`Installed hosts: ${installedRouting.join(', ') || 'none'}${installedOpenCode ? dim('  (opencode is available; type it to opt in)') : ''}`);
     // Default: every currently ENABLED host (even one temporarily absent from
@@ -424,7 +447,7 @@ async function pick({ flags, cwd, pkgRoot }) {
     // see right now) ∪ newly detected routing hosts. An installed-but-disabled
     // OpenCode host remains opt-in by typing it — a bare enter must not opt a
     // third host's config home in sight unseen either.
-    const enabledHosts = HOSTS.filter((h) => cfg.providers.hosts[h.id]).map((h) => h.id);
+    const enabledHosts = HOSTS.filter((h) => cfg.integrations.hosts[h.id]).map((h) => h.id);
     const dflt = [...new Set([...enabledHosts, ...installedRouting])];
     const absentEnabled = enabledHosts.filter((h) => !hosts[h].present);
     if (absentEnabled.length) {
@@ -472,7 +495,8 @@ async function pick({ flags, cwd, pkgRoot }) {
   if (!routing.includes(primaryHost)) primaryHost = routing[0] ?? DEFAULT_PRIMARY_HOST;
   // re-seed when the primary changed AND the current policy is entirely seeded
   // (no user overrides to preserve) — so mirrored defaults reflect the new primary.
-  const policyAllSeeded = Object.keys(oldPolicy).length > 0 && Object.values(oldPolicy).every((r) => r.source === 'seeded');
+  const policyAllSeeded = Object.keys(oldPolicy).length > 0
+    && Object.values(oldPolicy).every((r) => r.provenance === 'seeded');
   const reseedForPrimary = primaryHost !== prevPrimary && policyAllSeeded;
   // validate aqe primary provider
   if (aqeProvider && !AQE_PROVIDER_TYPES.includes(aqeProvider)) {
@@ -502,55 +526,50 @@ async function pick({ flags, cwd, pkgRoot }) {
   }
 
   cfg.providers = {
-    hosts: {
-      claude: routing.includes('claude'),
-      codex: routing.includes('codex'),
-      opencode: enabled.includes('opencode'),
-    },
     aqeProvider,
     aqeFallback,
     models,
-    primaryHost,
     maxBudgetUsd: cfg.providers.maxBudgetUsd ?? null,
-    dualRouting: reseedForPrimary ? {} : { ...oldPolicy },
-    // Every ownership marker survives a retune (teardown contract): the codex
-    // MCP bridges AND the opencode wiring. Dropping these on rewrite would
-    // strand managed servers ak can no longer prove it owns — the data-loss
-    // class the ownership model exists to prevent.
-    codexMcp: cfg.providers?.codexMcp ?? null,
-    rufloCodexMcp: cfg.providers?.rufloCodexMcp ?? null,
-    opencodeMcp: cfg.providers?.opencodeMcp ?? null,
-    opencodeManaged: cfg.providers?.opencodeManaged ?? null,
-    opencodeCatalogDir: cfg.providers?.opencodeCatalogDir ?? null,
   };
-  // dual-host: seed per-activity routing from defaults (only when the policy is
+  cfg.integrations.hosts = {
+    claude: routing.includes('claude'),
+    codex: routing.includes('codex'),
+    opencode: enabled.includes('opencode'),
+  };
+  cfg.routing.primaryHost = primaryHost;
+  cfg.routing.routes = reseedForPrimary ? {} : { ...oldPolicy };
+  // Multi-host: seed per-activity routing from defaults (only when the policy is
   // empty), then layer any explicit --route overrides on top (marked user, never
   // re-seeded). Single-host / older aqe → no-op, policy stays empty (ADR-0003).
-  const seed = seedDualRoutingIfDualHost(cfg);
+  const seed = seedActivityRoutesIfMultiHost(cfg);
   if (flags.route?.length) {
     const { policy, warnings } = parseRouteSpecs(flags.route);
     for (const w of warnings) warn(w);
-    cfg.providers.dualRouting = { ...cfg.providers.dualRouting, ...policy };
+    cfg.routing.routes = { ...cfg.routing.routes, ...policy };
   }
-  const prunedRoutes = pruneRoutesForHosts(cfg.providers.dualRouting, { hosts: enabled });
-  cfg.providers.dualRouting = prunedRoutes.policy;
+  const prunedRoutes = pruneRoutesForHosts(cfg.routing.routes, { hosts: enabled });
+  cfg.routing.routes = prunedRoutes.policy;
   for (const message of prunedRoutes.warnings) warn(message);
 
   // Codex owns two directional MCP bridges. Disable only the marker-owned
   // bridges, matching OpenCode's receipt-based teardown semantics.
   let codexRetired = null;
-  if (prevCodex && !cfg.providers.hosts.codex) {
+  if (prevCodex && !cfg.integrations.hosts.codex) {
     const mcp = await undoCodexMcp(cwd, { managed: codexMcpManaged });
     const rmcp = await undoRufloMcpInCodex(cwd, { managed: rufloCodexManaged });
-    cfg.providers.codexMcp = null;
-    cfg.providers.rufloCodexMcp = null;
+    cfg.integrations.ownership ??= {};
+    cfg.integrations.ownership.codex = {
+      ...(cfg.integrations.ownership.codex ?? {}),
+      mcp: null,
+      reverseMcp: null,
+    };
     codexRetired = { mcp, rmcp };
   }
   saveKitConfig(cfg);
 
   // install any enabled host that is entirely absent (external installs untouched)
   for (const h of HOSTS) {
-    if (!cfg.providers.hosts[h.id]) continue;
+    if (!cfg.integrations.hosts[h.id]) continue;
     if ((await hostInstallState(h)).method !== 'absent') continue;
     info(`${h.id} not installed — installing ${h.pkg}…`);
     const r = await installHost(h.id);
@@ -563,7 +582,7 @@ async function pick({ flags, cwd, pkgRoot }) {
   // guided" is one contract, not two).
   // CLI-gated: an enabled-but-absent CLI never fabricates the config home.
   let incompleteTeardown = false;
-  if (cfg.providers.hosts.opencode) {
+  if (cfg.integrations.hosts.opencode) {
     if (!(await have('opencode'))) {
       warn('opencode: enabled but CLI not installed — wiring skipped (re-run `ak sync` after installing opencode-ai)');
     } else {
@@ -615,15 +634,13 @@ async function pick({ flags, cwd, pkgRoot }) {
   if (aqeProvider) ok(`aqe provider: AQE_LLM_PROVIDER=${aqeProvider}`);
   const router = applyAqeRouter(cfg, cwd);
   if (router.changed || !router.ok) (router.ok ? ok : warn)(`aqe router: ${router.detail}`);
-  const dual = await ensureDualAgents(cfg, cwd);
-  (dual.ok ? (dual.changed ? ok : info) : warn)(`dual agents: ${dual.detail}`);
   const mcp = await ensureCodexMcp(cfg, cwd);
-  if (mcp.changed) saveKitConfig(cfg); // persist the codexMcp ownership marker
+  if (mcp.changed) saveKitConfig(cfg); // persist forward MCP ownership
   if (mcp.changed || !mcp.ok) (mcp.ok ? ok : warn)(`codex MCP: ${mcp.detail}`);
   // reverse bridge — register ruflo MCP into codex (codex→ruflo) so the bridge is
   // two-way. aqe's codex MCP is handled by `aqe init --with-codex` (setup runs it).
   const rmcp = await ensureRufloMcpInCodex(cfg, cwd);
-  if (rmcp.changed) saveKitConfig(cfg); // persist the rufloCodexMcp ownership marker
+  if (rmcp.changed) saveKitConfig(cfg); // persist reverse MCP ownership
   if (rmcp.changed || !rmcp.ok) (rmcp.ok ? ok : warn)(`ruflo→codex MCP: ${rmcp.detail}`);
   const prov = await applyProviders(cfg, cwd);
   (prov.ok ? (prov.changed ? ok : info) : warn)(`ruflo providers: ${prov.detail}`);
diff --git a/src/commands/x/verify.mjs b/src/commands/x/verify.mjs
index 27ae3d8..bcd5a84 100644
--- a/src/commands/x/verify.mjs
+++ b/src/commands/x/verify.mjs
@@ -143,7 +143,7 @@ async function verifyProviders() {
   // enabled hosts must actually be installed
   const hosts = (await collectIntegrationFacts({ cwd: process.cwd(), cfg })).hosts;
   for (const h of HOSTS) {
-    if (!cfg.providers?.hosts?.[h.id]) continue;
+    if (!cfg.integrations?.hosts?.[h.id]) continue;
     if (hosts[h.id].present) ok(`host '${h.id}' enabled and installed${hosts[h.id].version ? ` (v${hosts[h.id].version})` : ''}`);
     else { fail(`host '${h.id}' enabled in kit.json but not on PATH`); good = false; }
   }
diff --git a/src/lib/adapters/config.mjs b/src/lib/adapters/config.mjs
index 511e507..d168484 100644
--- a/src/lib/adapters/config.mjs
+++ b/src/lib/adapters/config.mjs
@@ -1,6 +1,27 @@
+import { isDeepStrictEqual } from 'node:util';
 import { immutable } from './schema.mjs';
 
-export const CURRENT_INTEGRATIONS_VERSION = 1;
+export const CURRENT_INTEGRATIONS_VERSION = 2;
+
+const plain = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const own = (value, key) => plain(value) && Object.hasOwn(value, key);
+
+function mergeBindings(current = [], legacy = []) {
+  const merged = structuredClone(current);
+  for (const binding of legacy) {
+    if (merged.some((candidate) => isDeepStrictEqual(candidate, binding))) continue;
+    const conflict = typeof binding?.id === 'string'
+      ? merged.find((candidate) => candidate?.id === binding.id)
+      : null;
+    if (conflict) {
+      throw new TypeError(
+        `integrations binding conflict: providers.bindings entry ${binding.id} differs from integrations.bindings`,
+      );
+    }
+    merged.push(structuredClone(binding));
+  }
+  return merged;
+}
 
 export function validateEndpoint(endpoint) {
   let parsed;
@@ -18,7 +39,8 @@ export function validateEndpoint(endpoint) {
 }
 
 export function migrateIntegrationConfig(config = {}, _options = {}) {
-  const out = structuredClone(config);
+  const out = structuredClone(plain(config) ? config : {});
+  if (out.integrations !== undefined && !plain(out.integrations)) return immutable(out);
   const existing = out.integrations ?? {};
   if (Number.isInteger(existing.version) && existing.version > CURRENT_INTEGRATIONS_VERSION) {
     return immutable(out);
@@ -26,9 +48,24 @@ export function migrateIntegrationConfig(config = {}, _options = {}) {
   if (Object.hasOwn(existing, 'bindings') && !Array.isArray(existing.bindings)) {
     return immutable(out);
   }
-  const enabled = Object.entries(out.providers?.hosts ?? {}).filter(([, on]) => on).map(([host]) => host);
+  if (Object.hasOwn(existing, 'hosts') && !plain(existing.hosts)) return immutable(out);
+  if (Object.hasOwn(existing, 'ownership') && !plain(existing.ownership)) return immutable(out);
+
+  const providers = plain(out.providers) ? out.providers : {};
+  if (own(providers, 'hosts') && !plain(providers.hosts)) return immutable(out);
+  if (own(providers, 'bindings') && !Array.isArray(providers.bindings)) return immutable(out);
+
+  // The alpha writer's host set deliberately wins once at cutover over an
+  // older additive integrations.hosts snapshot.
+  const hosts = own(providers, 'hosts')
+    ? structuredClone(providers.hosts)
+    : structuredClone(existing.hosts ?? {});
+  const enabled = Object.entries(hosts).filter(([, on]) => on).map(([host]) => host);
   const defaults = { claude: 'anthropic', codex: 'openai' };
-  const priorBindings = Array.isArray(existing.bindings) ? existing.bindings : [];
+  const priorBindings = mergeBindings(
+    Array.isArray(existing.bindings) ? existing.bindings : [],
+    Array.isArray(providers.bindings) ? providers.bindings : [],
+  );
   const seenHosts = new Set(priorBindings.map((binding) => binding.host));
   const inferred = enabled.filter((host) => !seenHosts.has(host)).map((host) => ({
     id: `${defaults[host] ?? 'unknown'}-via-${host}`,
@@ -40,24 +77,46 @@ export function migrateIntegrationConfig(config = {}, _options = {}) {
     provenance: defaults[host] ? 'inferred' : 'unknown',
     managedBy: 'unknown',
   }));
-  const legacyOpenCode = out.providers?.opencodeMcp === 'ak'
-    || out.providers?.opencodeManaged != null
-    || out.providers?.opencodeCatalogDir != null;
-  const ownership = {
-    ...(existing.ownership ?? {}),
-    ...(legacyOpenCode && !existing.ownership?.opencode ? { opencode: {
+  const ownership = structuredClone(existing.ownership ?? {});
+  const reverseMarker = 'rufloCodexMcp';
+  const hasLegacyCodex = (own(providers, 'codexMcp') && providers.codexMcp != null)
+    || (own(providers, reverseMarker) && providers[reverseMarker] != null);
+  if (hasLegacyCodex) {
+    ownership.codex = {
       source: 'legacy-providers',
-      mcp: out.providers?.opencodeMcp ?? null,
-      managed: structuredClone(out.providers?.opencodeManaged ?? null),
-      catalogDir: out.providers?.opencodeCatalogDir ?? null,
-    } } : {}),
-  };
+      ...(plain(ownership.codex) ? ownership.codex : {}),
+      ...(own(providers, 'codexMcp') ? { mcp: structuredClone(providers.codexMcp) } : {}),
+      ...(own(providers, reverseMarker)
+        ? { reverseMcp: structuredClone(providers[reverseMarker]) } : {}),
+    };
+  }
+  const hasLegacyOpenCode = ['opencodeMcp', 'opencodeManaged', 'opencodeCatalogDir']
+    .some((key) => own(providers, key) && providers[key] != null);
+  if (hasLegacyOpenCode) {
+    ownership.opencode = {
+      source: 'legacy-providers',
+      ...(plain(ownership.opencode) ? ownership.opencode : {}),
+      ...(own(providers, 'opencodeMcp')
+        ? { mcp: structuredClone(providers.opencodeMcp) } : {}),
+      ...(own(providers, 'opencodeManaged')
+        ? { managed: structuredClone(providers.opencodeManaged) } : {}),
+      ...(own(providers, 'opencodeCatalogDir')
+        ? { catalogDir: structuredClone(providers.opencodeCatalogDir) } : {}),
+    };
+  }
   out.integrations = {
     ...existing,
     version: CURRENT_INTEGRATIONS_VERSION,
-    hosts: { ...(out.providers?.hosts ?? {}), ...(existing.hosts ?? {}) },
+    hosts,
     bindings: [...priorBindings, ...inferred],
     ...(Object.keys(ownership).length ? { ownership } : {}),
   };
+  delete out.integrations.schemaVersion;
+  if (plain(out.providers)) {
+    for (const key of [
+      'hosts', 'bindings', 'codexMcp', reverseMarker,
+      'opencodeMcp', 'opencodeManaged', 'opencodeCatalogDir',
+    ]) delete out.providers[key];
+  }
   return immutable(out);
 }
diff --git a/src/lib/adapters/migration.mjs b/src/lib/adapters/migration.mjs
index 8f4805a..9de0887 100644
--- a/src/lib/adapters/migration.mjs
+++ b/src/lib/adapters/migration.mjs
@@ -1,71 +1,22 @@
+import { isDeepStrictEqual } from 'node:util';
+import {
+  CURRENT_INTEGRATIONS_VERSION,
+  migrateIntegrationConfig,
+} from './config.mjs';
 import { immutable } from './schema.mjs';
 
-export const INTEGRATIONS_SCHEMA_VERSION = 1;
+export const INTEGRATIONS_SCHEMA_VERSION = CURRENT_INTEGRATIONS_VERSION;
 
 export function normalizeIntegrations(config = {}) {
-  const source = /** @type {any} */ (config && typeof config === 'object' ? config : {});
-  const existing = source.integrations && typeof source.integrations === 'object'
-    ? source.integrations : {};
-  if (Number.isInteger(existing.version) && existing.version > INTEGRATIONS_SCHEMA_VERSION) {
-    return immutable(structuredClone(existing));
-  }
-  if (Object.hasOwn(existing, 'bindings') && !Array.isArray(existing.bindings)) {
-    return immutable(structuredClone(existing));
-  }
-  const legacyHosts = source.providers?.hosts && typeof source.providers.hosts === 'object'
-    ? source.providers.hosts : {};
-  const hosts = { ...legacyHosts, ...(existing.hosts ?? {}) };
-  // Migration preserves user intent byte-for-byte structurally. Validation and
-  // resolution are separate operations; enriching a binding here would make
-  // the two public migration entry points oscillate between shapes.
-  const bindings = structuredClone(existing.bindings ?? source.providers?.bindings ?? []);
-  if (!Array.isArray(bindings)) throw new TypeError('integrations.bindings must be an array');
-  const legacyOpenCode = source.providers?.opencodeMcp === 'ak'
-    || source.providers?.opencodeManaged != null
-    || source.providers?.opencodeCatalogDir != null;
-  const ownership = {
-    ...(existing.ownership ?? {}),
-    ...(legacyOpenCode && !existing.ownership?.opencode ? { opencode: {
-      source: 'legacy-providers',
-      mcp: source.providers?.opencodeMcp ?? null,
-      managed: structuredClone(source.providers?.opencodeManaged ?? null),
-      catalogDir: source.providers?.opencodeCatalogDir ?? null,
-    } } : {}),
-  };
-  return immutable({
-    version: INTEGRATIONS_SCHEMA_VERSION,
-    hosts,
-    bindings,
-    ...(Object.keys(ownership).length ? { ownership } : {}),
-  });
+  const migrated = migrateIntegrationConfig(config);
+  return immutable(structuredClone(migrated.integrations ?? {}));
 }
 
 export function migrateConfig(config = {}) {
-  const before = /** @type {any} */ (config && typeof config === 'object' ? config : {});
-  if ((Number.isInteger(before.integrations?.version)
-      && before.integrations.version > INTEGRATIONS_SCHEMA_VERSION)
-    || (Object.hasOwn(before.integrations ?? {}, 'bindings')
-      && !Array.isArray(before.integrations.bindings))) {
-    return immutable({ changed: false, config: structuredClone(before) });
-  }
-  const integrations = normalizeIntegrations(before);
-  const current = before.integrations;
-  const changed = !current || current.version !== integrations.version
-    || Object.hasOwn(current, 'schemaVersion')
-    || JSON.stringify(current.hosts ?? {}) !== JSON.stringify(integrations.hosts)
-    || JSON.stringify(current.bindings ?? []) !== JSON.stringify(integrations.bindings);
-  const ownershipChanged = JSON.stringify(current?.ownership ?? null)
-    !== JSON.stringify(integrations.ownership ?? null);
+  const before = config && typeof config === 'object' ? structuredClone(config) : {};
+  const next = migrateIntegrationConfig(before);
   return immutable({
-    changed: changed || ownershipChanged,
-    config: changed || ownershipChanged ? { ...structuredClone(before), integrations } : structuredClone(before),
+    changed: !isDeepStrictEqual(before, next),
+    config: structuredClone(next),
   });
 }
-
-export function legacyRouteProvider(route, bindings = []) {
-  if (!route?.host) return { provider: null, provenance: 'unknown', binding: null };
-  const candidates = bindings.filter((binding) => binding.host === route.host
-    && (!route.model || !binding.model || binding.model === route.model));
-  if (candidates.length !== 1) return { provider: null, provenance: 'unknown', binding: null };
-  return immutable({ provider: candidates[0].provider, provenance: 'inferred', binding: candidates[0].id });
-}
diff --git a/src/lib/adapters/registries.mjs b/src/lib/adapters/registries.mjs
index 1967628..70b137d 100644
--- a/src/lib/adapters/registries.mjs
+++ b/src/lib/adapters/registries.mjs
@@ -224,19 +224,6 @@ export function validateActivityHost(id, hosts = HOST_REGISTRY) {
     ? { ok: true } : { ok: false, reason: 'capability-canRouteActivities-required' };
 }
 
-export function deriveCompatibilityExports({
-  hosts = HOST_REGISTRY, providers = PROVIDER_REGISTRY,
-} = {}) {
-  const custom = hosts !== HOST_REGISTRY || providers !== PROVIDER_REGISTRY;
-  return {
-    hostIds: hosts.map(({ id }) => id),
-    managedHostIds: hosts.filter((host) => host.capabilities.canDriveSession).map(({ id }) => id),
-    primaryHostIds: hosts.filter((host) => host.capabilities.canBePrimary).map(({ id }) => id),
-    routableHostIds: hosts.filter((host) => host.capabilities.canRouteActivities).map(({ id }) => id),
-    apiProviderIds: providers.filter((provider) => custom || provider.legacy?.apiProvider).map(({ id }) => id),
-  };
-}
-
 export function validateRegistries(registries) {
   const errors = [];
   const axes = ['hosts', 'providers', 'projections', 'observability'];
diff --git a/src/lib/blocks.mjs b/src/lib/blocks.mjs
index d4cc942..93de316 100644
--- a/src/lib/blocks.mjs
+++ b/src/lib/blocks.mjs
@@ -82,7 +82,7 @@ export const BUILTIN_BLOCKS = [
   },
   {
     // Only surfaces once the codex CLI is on PATH — mirrors the aqe block gated on
-    // `command: aqe`. Documents the claude/codex host axis + `ak x provider`.
+    // `command: aqe`. Documents the claude/codex host axis + `ak x host`.
     slug: 'ruflo-providers-reference',
     template: 'providers-reference.md',
     position: 'append',
@@ -95,7 +95,7 @@ export const BUILTIN_BLOCKS = [
     // so it lands in the two MACHINE-scoped guidance files — ~/.claude/CLAUDE.md
     // (claude) and ~/.codex/AGENTS.md (agents-user) — never a repo's checked-in
     // AGENTS.md, which would leak machine truths into shared git history (ADR-0008).
-    // Documents `ak dual`, the Claude↔Codex bridge, and per-activity routing.
+    // Documents `ak run`, the Claude↔Codex bridge, and per-activity routing.
     slug: 'ruflo-dual-mode-reference',
     template: 'dual-mode-reference.md',
     position: 'append',
diff --git a/src/lib/config.mjs b/src/lib/config.mjs
index 8e47592..718026f 100644
--- a/src/lib/config.mjs
+++ b/src/lib/config.mjs
@@ -4,7 +4,15 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { kitConfigPath, legacyKitConfigPath } from './paths.mjs';
-import { migrateIntegrationConfig } from './adapters/config.mjs';
+import {
+  CURRENT_INTEGRATIONS_VERSION,
+  migrateIntegrationConfig,
+} from './adapters/config.mjs';
+import {
+  DEFAULT_PRIMARY_HOST,
+  ROUTING_SCHEMA_VERSION,
+  migrateRoutingConfig,
+} from './routing-config.mjs';
 
 const DEFAULTS = {
   aqe: true,            // manage agentic-qe alongside ruflo
@@ -15,53 +23,139 @@ const DEFAULTS = {
   harvest: false,       // opt-in learning-write (`ak x harvest`); off = never runs writes
   health: { ring: [] }, // persisted stack-health snapshot ring (see health-history.mjs)
   mcp: { register: true, excludeFamilies: [] },
-  // Frontier hosts + LLM providers (prompts-once via `ak x provider pick`).
+  integrations: {
+    version: CURRENT_INTEGRATIONS_VERSION,
+    hosts: { claude: true, codex: false, opencode: false },
+    bindings: [],
+  },
+  routing: {
+    version: ROUTING_SCHEMA_VERSION,
+    primaryHost: DEFAULT_PRIMARY_HOST,
+    routes: {},
+  },
+  // Frontier hosts + LLM providers (prompts-once via `ak host pick`).
   // Default = claude-only, codex opt-in — preserves today's behavior exactly:
   // when this stays at defaults, the provider heal is a deliberate no-op.
   providers: {
-    hosts: { claude: true, codex: false, opencode: false }, // which agent CLIs ak wires (ADR-034 ENABLE_*; opencode has no enable-env — wiring is config-file based)
     aqeProvider: null,                      // AQE_LLM_PROVIDER (claude-code|openai|gemini|…); null = aqe default
     aqeFallback: [],                        // [{ provider, models:[...] }] — ordered aqe fallback chain (.agentic-qe/llm-config.json)
     models: [],                             // [{ id:'openai', model:'gpt-5.6' }] — ruflo API-key providers
     maxBudgetUsd: null,                     // → AQE_MAX_BUDGET_USD when set
-    dualRouting: {},                        // activity → {host,model,escalate?,source} per-activity routing policy (ADR-0001; seeded on dual-host)
-    codexMcp: null,                         // 'ak' when ak registered the codex MCP server (ownership guard for teardown)
-    opencodeMcp: null,                      // 'ak' when ak wrote opencode.json's mcp/skills/permission wiring (ownership guard for teardown)
-    opencodeManaged: null,                  // {mcp[], paths[], permissions[]} — exact opencode.json keys ak wrote (surgical teardown)
-    opencodeCatalogDir: null,               // optional override: ruflo repo checkout used as the agents/skills catalog source (default: marketplace clone → npm package)
   },
   statusline: { codex: null }, // {preset,lastProjection}: explicit ownership of Codex [tui] keys
   customBlocks: [],     // [{slug, templatePath, detector:{type:'command'|'dir'|'file', target}}]
   versionCheck: { ttlHours: 24, last: null, seen: {} },
 };
 
+const plain = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+
+function assertLoadableEnvelopes(config) {
+  if (!plain(config.integrations)) {
+    throw new TypeError(
+      'integrations must be an object; repair kit.json or rerun `ak setup --reconfigure`',
+    );
+  }
+  if (config.integrations.version !== CURRENT_INTEGRATIONS_VERSION) {
+    throw new TypeError(
+      `unsupported integrations.version ${String(config.integrations.version)}; update agentic-kit before using this config`,
+    );
+  }
+  if (!plain(config.integrations.hosts)) {
+    throw new TypeError('integrations.hosts must be an object');
+  }
+  if (!Array.isArray(config.integrations.bindings)) {
+    throw new TypeError('integrations.bindings must be an array');
+  }
+  if (config.integrations.ownership !== undefined && !plain(config.integrations.ownership)) {
+    throw new TypeError('integrations.ownership must be an object');
+  }
+  if (!plain(config.routing)) {
+    throw new TypeError(
+      'routing must be an object; repair kit.json or rerun `ak setup --reconfigure`',
+    );
+  }
+  if (config.routing.version !== ROUTING_SCHEMA_VERSION) {
+    throw new TypeError(
+      `unsupported routing.version ${String(config.routing.version)}; update agentic-kit before using this config`,
+    );
+  }
+}
+
+export class KitConfigError extends Error {
+  constructor(configPath, reason, options = {}) {
+    super(`invalid kit config ${configPath}: ${reason}`, options);
+    this.name = 'KitConfigError';
+    this.configPath = configPath;
+    this.reason = reason;
+  }
+}
+
+export function migrateKitConfig(config = {}) {
+  // Integration migration must consume legacy hosts and ownership first; routing
+  // then consumes primaryHost/dualRouting from the same still-raw providers map.
+  return migrateRoutingConfig(migrateIntegrationConfig(config));
+}
+
+function withDefaults(config) {
+  assertLoadableEnvelopes(config);
+  const integrations = config.integrations?.version === CURRENT_INTEGRATIONS_VERSION
+    ? {
+      ...structuredClone(DEFAULTS.integrations),
+      ...config.integrations,
+      hosts: { ...DEFAULTS.integrations.hosts, ...config.integrations.hosts },
+    }
+    : config.integrations;
+  const routing = config.routing?.version === ROUTING_SCHEMA_VERSION
+    ? {
+      ...structuredClone(DEFAULTS.routing),
+      ...config.routing,
+      routes: { ...DEFAULTS.routing.routes, ...config.routing.routes },
+    }
+    : config.routing;
+  const merged = {
+    ...structuredClone(DEFAULTS),
+    ...config,
+    health: { ...DEFAULTS.health, ...config.health },
+    mcp: { ...DEFAULTS.mcp, ...config.mcp },
+    integrations,
+    routing,
+    providers: { ...DEFAULTS.providers, ...config.providers },
+    statusline: { ...DEFAULTS.statusline, ...config.statusline },
+  };
+  // Defaults can enable a host omitted by a partial legacy file. Normalize once
+  // more so inferred bindings and the saved representation already converge.
+  return migrateKitConfig(merged);
+}
+
 export function loadKitConfig(file = kitConfigPath()) {
   // Migration: fall back to the ruflo-era location; the next save lands at the
   // new path (saves always write `file`, i.e. ~/.config/agentic-kit/kit.json).
   for (const cand of file === kitConfigPath() ? [file, legacyKitConfigPath()] : [file]) {
+    let raw;
+    try {
+      raw = fs.readFileSync(cand, 'utf8');
+    } catch (error) {
+      if (error?.code === 'ENOENT') continue;
+      throw error;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (error) {
+      throw new KitConfigError(cand, error.message, { cause: error });
+    }
+    // Migrate raw presence before defaults can masquerade as legacy user intent.
     try {
-      const parsed = JSON.parse(fs.readFileSync(cand, 'utf8'));
-      const merged = {
-        ...structuredClone(DEFAULTS),
-        ...parsed,
-        health: { ...DEFAULTS.health, ...parsed.health },
-        mcp: { ...DEFAULTS.mcp, ...parsed.mcp },
-        providers: {
-          ...DEFAULTS.providers,
-          ...parsed.providers,
-          hosts: { ...DEFAULTS.providers.hosts, ...parsed.providers?.hosts },
-        },
-        statusline: { ...DEFAULTS.statusline, ...parsed.statusline },
-      };
-      // Normalize additively in memory. Loading never writes; the next explicit
-      // save persists the versioned integration view alongside legacy fields.
-      return structuredClone(migrateIntegrationConfig(merged));
-    } catch { /* try next */ }
+      return structuredClone(withDefaults(migrateKitConfig(parsed)));
+    } catch (error) {
+      if (error instanceof KitConfigError) throw error;
+      throw new KitConfigError(cand, error?.message ?? String(error), { cause: error });
+    }
   }
-  return structuredClone(migrateIntegrationConfig(structuredClone(DEFAULTS)));
+  return structuredClone(withDefaults(migrateKitConfig({})));
 }
 
 export function saveKitConfig(cfg, file = kitConfigPath()) {
   fs.mkdirSync(path.dirname(file), { recursive: true });
-  fs.writeFileSync(file, JSON.stringify(migrateIntegrationConfig(cfg), null, 2) + '\n');
+  fs.writeFileSync(file, JSON.stringify(migrateKitConfig(cfg), null, 2) + '\n');
 }
diff --git a/src/lib/dashboard-server.mjs b/src/lib/dashboard-server.mjs
index afbc837..9d4260d 100644
--- a/src/lib/dashboard-server.mjs
+++ b/src/lib/dashboard-server.mjs
@@ -146,21 +146,21 @@ async function collectData({ cwd, fetchStatus }) {
 }
 
 /** The per-activity routing matrix for the dashboard (ADR-0005). Null unless a
- *  dualRouting policy is set, so single-host projects render nothing new. */
+ *  routing policy is set, so single-host projects render nothing new. */
 export function routingPayload(cfg = loadKitConfig()) {
   try {
-    const policy = cfg.providers?.dualRouting ?? {};
+    const policy = cfg.routing?.routes ?? {};
     if (!Object.keys(policy).length) return null;
     const routes = resolveRoutes(policy);
     return {
-      primaryHost: cfg.providers?.primaryHost ?? 'claude',
+      primaryHost: cfg.routing?.primaryHost ?? 'claude',
       summary: routingSummary(policy),
       routes: ACTIVITIES.map((activity) => {
         const r = routes[activity];
         return {
           activity, host: r.host, model: r.model ?? '',
-          source: r.source, akOriginated: !!r.akOriginated,
-          escalate: (r.escalate ?? []).map((e) => e.host),
+          provenance: r.provenance, akOriginated: !!r.akOriginated,
+          escalation: (r.escalation ?? []).map((e) => e.host),
         };
       }),
     };
diff --git a/src/lib/dashboard/client.mjs b/src/lib/dashboard/client.mjs
index 2e56018..cc9b60a 100644
--- a/src/lib/dashboard/client.mjs
+++ b/src/lib/dashboard/client.mjs
@@ -315,13 +315,13 @@ export const JS = `
     for(var i=0;i<rt.routes.length;i++){
       var r=rt.routes[i];
       var tag=r.akOriginated?' <span class="r-tag">ak</span>':'';
-      var escHtml=(r.escalate&&r.escalate.length)?'<span class="r-esc mono">↑ '+esc(r.escalate.join("→"))+"</span>":"";
+      var escHtml=(r.escalation&&r.escalation.length)?'<span class="r-esc mono">↑ '+esc(r.escalation.join("→"))+"</span>":"";
       var primAttr=(r.host===primary)?' data-primary="1"':'';
       html+='<div class="r-row">'
         +'<span class="r-act mono">'+esc(r.activity)+tag+"</span>"
         +'<span class="r-host r-host-'+esc(r.host)+'"'+primAttr+' title="'+(r.host===primary?"primary host":"alternate host")+'">'+esc(r.host)+"</span>"
         +'<span class="r-model mono">'+esc(r.model)+"</span>"
-        +'<span class="r-meta">'+escHtml+'<span class="r-src r-src-'+esc(r.source)+'">'+esc(r.source)+"</span></span>"
+        +'<span class="r-meta">'+escHtml+'<span class="r-src r-src-'+esc(r.provenance)+'">'+esc(r.provenance)+"</span></span>"
       +"</div>";
     }
     document.getElementById("route-matrix").innerHTML=html;
@@ -632,9 +632,8 @@ export const JS = `
         +'<span class="db-lab">'+esc(x.day.slice(8))+"</span></div>";
     }).join(""):'<div class="empty">no days in window.</div>';
 
-    // Host and inference-provider are independent axes. Fall back to the
-    // historical byProvider host map only for pre-migration cached payloads.
-    var prov=d.byHost||d.byTranscriptProvider||d.byProvider||{};
+    // Host and inference-provider are independent canonical axes.
+    var prov=d.byHost||{};
     var order=["claude","codex"];
     for(k in prov)if(order.indexOf(k)<0)order.push(k);
     document.getElementById("u-hosts").innerHTML=order.map(function(name){
@@ -921,8 +920,8 @@ export const JS = `
   // block-level sibling inside .pbody, not a grid child of .srow, so it spans
   // the full width without joining the column layout.
   function sessionRow(sx){
-    var host=sx.host||sx.transcriptProvider||((sx.provider==="codex")?"codex":"claude");
-    var provider=sx.provider||sx.inferenceProvider||"unknown";
+    var host=sx.host||"unknown";
+    var provider=sx.provider||"unknown";
     var cat=sx.category||"Unclassified";
     var uncl=(cat==="Unclassified");
     var weak=(typeof sx.confidence==="number"&&sx.confidence<0.6)?"0":"1";
diff --git a/src/lib/dashboard/page.mjs b/src/lib/dashboard/page.mjs
index d42f92e..b318496 100644
--- a/src/lib/dashboard/page.mjs
+++ b/src/lib/dashboard/page.mjs
@@ -108,7 +108,7 @@ export function renderPage({ name, version }) {
       </div>
       <div class="note"><span class="i">&#8505;</span><span>This is your <b>per-activity routing policy</b> &mdash;
         which host and model ak <i>assigns</i> to each kind of work. It is projected into
-        <b>agentic-qe</b> agent overrides and <b>ak dual run</b> pipelines; agentic-qe also has its own
+        <b>agentic-qe</b> agent overrides and <b>ak run</b> pipelines; agentic-qe also has its own
         model router, so a route here is the assignment, not a guarantee.
         It does <b>not</b> establish which inference provider served a session.
         For the models and providers that <b>actually ran</b>, see <b>Usage &rarr; Scorecard</b>.</span></div>
diff --git a/src/lib/hosts.mjs b/src/lib/hosts.mjs
index a8b6ba6..bed8b70 100644
--- a/src/lib/hosts.mjs
+++ b/src/lib/hosts.mjs
@@ -57,11 +57,11 @@ export function statuslineSupported(id) {
 /**
  * Which host is driving the current session, as a first-class detected axis.
  * Precedence: explicit override → confirmed claude markers → any CODEX_* marker
- * (heuristic) → configured primary (kit.json providers.primaryHost) → 'claude'.
+ * (heuristic) → configured primary (kit.json routing.primaryHost) → 'claude'.
  * Pure: reads only env + the passed cfg; never spawns.
  *
  * @param {NodeJS.ProcessEnv} [env]
- * @param {any} [cfg] kit.json config (for providers.primaryHost)
+ * @param {any} [cfg] kit.json config (for routing.primaryHost)
  * @returns {'claude'|'codex'|'opencode'}
  */
 export function drivingHost(env = process.env, cfg = null) {
@@ -71,7 +71,7 @@ export function drivingHost(env = process.env, cfg = null) {
   // codex sets no single documented session marker; a CODEX_* prefix is a safe
   // heuristic because the fallback below covers the miss.
   if (Object.keys(env).some((k) => k.startsWith('CODEX_'))) return 'codex';
-  const primary = cfg?.providers?.primaryHost;
+  const primary = cfg?.routing?.primaryHost;
   const primaryCapable = HOST_REGISTRY.some((host) => host.id === primary && host.capabilities.canBePrimary);
   if (primary && primaryCapable) return /** @type {'claude'|'codex'} */ (primary);
   return 'claude';
diff --git a/src/lib/live/event-schema.mjs b/src/lib/live/event-schema.mjs
index ed02910..2fe2b26 100644
--- a/src/lib/live/event-schema.mjs
+++ b/src/lib/live/event-schema.mjs
@@ -1,7 +1,9 @@
 export const LIVE_SCHEMA_VERSION = 1;
 
 const HOSTS = new Set(['claude', 'codex', 'internal']);
-const SURFACES = new Set(['native', 'ruflo', 'aqe', 'plugin', 'skill', 'dual-run']);
+// `internal` is read-only historical vocabulary. Live-source registration still
+// admits only ruflo/aqe, and no current writer emits the retired dual-run label.
+const SURFACES = new Set(['native', 'ruflo', 'aqe', 'plugin', 'skill', 'internal']);
 const CONFIDENCE = new Set(['observed', 'configured', 'correlated', 'inferred', 'unknown', 'assumed', 'planned']);
 const PROVIDER_PROVENANCE = new Set(['observed', 'configured', 'inferred', 'unknown']);
 const EVIDENCE_FIELDS = ['host', 'project', 'provider', 'model', 'status', 'hierarchy'];
@@ -46,7 +48,11 @@ export function createLiveEvent(input, { now = () => new Date().toISOString() }
     : (PROVIDER_PROVENANCE.has(input.source?.fields?.provider)
         ? input.source.fields.provider : 'unknown');
   const project = safeProjectLabel(input.project);
-  const surface = SURFACES.has(input.surface) ? input.surface : 'native';
+  // Preserve the fact that a pre-GA compatibility record was internally
+  // synthesized; relabeling it "native" would overstate its provenance.
+  const surface = input.surface === 'dual-run'
+    ? 'internal'
+    : (SURFACES.has(input.surface) ? input.surface : 'native');
   const actorKind = ACTOR_KINDS.has(input.actor?.kind) ? input.actor.kind : 'agent';
   const observedAt = timestamp(input.observedAt) ?? timestamp(now());
   if (!observedAt) throw new TypeError('live event requires a valid observedAt');
diff --git a/src/lib/live/index.mjs b/src/lib/live/index.mjs
index 672ff7e..f26f73a 100644
--- a/src/lib/live/index.mjs
+++ b/src/lib/live/index.mjs
@@ -10,7 +10,7 @@ export {
 export { TranscriptStreams } from './transcript-streams.mjs';
 export { adaptClaudeRecord } from './claude-adapter.mjs';
 export { adaptCodexRecord, adaptCodexLedger } from './codex-adapter.mjs';
-export { adaptStructuredEvent, adaptDualRunRecord } from './structured-adapter.mjs';
+export { adaptStructuredEvent } from './structured-adapter.mjs';
 export { classifyToolName } from './tool-classify.mjs';
 export {
   canonicalSessionKey, resolveProjectLabel, safeProjectLabel, stableProjectKey,
diff --git a/src/lib/live/live-sessions-service.mjs b/src/lib/live/live-sessions-service.mjs
index 8937501..0212c1c 100644
--- a/src/lib/live/live-sessions-service.mjs
+++ b/src/lib/live/live-sessions-service.mjs
@@ -9,7 +9,7 @@ import {
   emptyLiveProjection, reduceLiveEvent, serializeLiveProjection, sweepLiveProjection,
 } from './projection.mjs';
 import { LiveReplayStream } from './replay-stream.mjs';
-import { adaptDualRunRecord, adaptStructuredEvent } from './structured-adapter.mjs';
+import { adaptStructuredEvent } from './structured-adapter.mjs';
 import { resolveProjectLabel } from './project-label.mjs';
 
 const safeEntries = (dir) => {
@@ -170,7 +170,7 @@ export class LiveSessionsService {
     // discovery. Otherwise saturated Claude + Codex stores can consume every
     // tailer slot before a --live-source file is considered.
     for (const source of this.#options.structuredSources.slice(0, this.#options.maxFiles)) {
-      if (!source?.file || !['ruflo', 'aqe', 'dual-run'].includes(source.surface)) continue;
+      if (!source?.file || !['ruflo', 'aqe'].includes(source.surface)) continue;
       this.#add(source.file, {
         adapter: source.surface, surface: source.surface,
         sessionId: source.sessionId,
@@ -230,10 +230,6 @@ export class LiveSessionsService {
         context.meta = record.payload;
       }
       events = adaptCodexRecord(record, common);
-    } else if (context.surface === 'dual-run') {
-      events = adaptDualRunRecord(record, {
-        observedAt: common.observedAt, artifact: path.basename(file),
-      });
     } else {
       events = adaptStructuredEvent(record, {
         ...common, artifact: path.basename(file),
diff --git a/src/lib/live/structured-adapter.mjs b/src/lib/live/structured-adapter.mjs
index 7429f22..07e16f8 100644
--- a/src/lib/live/structured-adapter.mjs
+++ b/src/lib/live/structured-adapter.mjs
@@ -33,31 +33,3 @@ export function adaptStructuredEvent(record, {
     attributes: { durationMs: record.durationMs },
   })];
 }
-
-/** Planned nodes exist only when emitted by an explicit materialized dual run. */
-/**
- * @param {Record<string, any>} record
- * @param {{ observedAt?: string, artifact?: string }} [options]
- */
-export function adaptDualRunRecord(record, { observedAt, artifact } = {}) {
-  if (record?.type !== 'dual-run.plan' || typeof record.runId !== 'string'
-    || !Array.isArray(record.steps)) return [];
-  const out = [];
-  for (const step of record.steps) {
-    if (typeof step?.id !== 'string') continue;
-    out.push(createLiveEvent({
-      sessionId: record.runId, host: ['claude', 'codex'].includes(step.host)
-        ? step.host : 'internal',
-      surface: 'dual-run', project: record.project, observedAt,
-      sourceTimestamp: record.timestamp,
-      actor: {
-        id: record.runId, kind: 'session', role: 'orchestrator',
-        provider: null, model: null,
-      },
-      action: 'agent.planned', target: { id: step.id, kind: 'agent' },
-      status: 'queued',
-      source: { adapter: 'dual-run-plan', artifact, confidence: 'planned' },
-    }));
-  }
-  return out;
-}
diff --git a/src/lib/mcp.mjs b/src/lib/mcp.mjs
index 9bf305a..60ac0b8 100644
--- a/src/lib/mcp.mjs
+++ b/src/lib/mcp.mjs
@@ -57,13 +57,13 @@ export function ruvectorRegistered() {
  * at the repo root — so reading that file is the spawn-free equivalent of
  * `claude mcp get codex` (deterministic + testable, matching `registrationStatus`'s
  * file-read approach). `owned` reflects kit.json's ak-ownership marker
- * (`providers.codexMcp === 'ak'`), which gates teardown.
+ * (`integrations.ownership.codex.mcp === 'ak'`), which gates teardown.
  * @returns {{ registered: boolean, owned: boolean }}
  */
 export function codexMcpStatus(cfg, cwd = process.cwd()) {
   const root = repoRoot(cwd) ?? cwd;
   const servers = readJson(path.join(root, '.mcp.json'), {})?.mcpServers ?? {};
-  return { registered: 'codex' in servers, owned: cfg?.providers?.codexMcp === 'ak' };
+  return { registered: 'codex' in servers, owned: cfg?.integrations?.ownership?.codex?.mcp === 'ak' };
 }
 
 /**
@@ -71,7 +71,8 @@ export function codexMcpStatus(cfg, cwd = process.cwd()) {
  * runs `codex mcp add ruflo …`, which writes a `[mcp_servers.ruflo]` table into
  * ~/.codex/config.toml — so a spawn-free presence check reads that file (mirrors
  * codexMcpStatus's file-read approach; no TOML parser needed for a header check).
- * `owned` reflects kit.json's ak-ownership marker (`providers.rufloCodexMcp === 'ak'`).
+ * `owned` reflects kit.json's ak-ownership marker
+ * (`integrations.ownership.codex.reverseMcp === 'ak'`).
  * @returns {{ registered: boolean, owned: boolean }}
  */
 export function rufloCodexMcpStatus(cfg, { home = os.homedir() } = {}) {
@@ -79,7 +80,7 @@ export function rufloCodexMcpStatus(cfg, { home = os.homedir() } = {}) {
   try {
     registered = /^\s*\[mcp_servers\.ruflo\]/m.test(fs.readFileSync(path.join(home, '.codex', 'config.toml'), 'utf8'));
   } catch { /* config absent → not registered */ }
-  return { registered, owned: cfg?.providers?.rufloCodexMcp === 'ak' };
+  return { registered, owned: cfg?.integrations?.ownership?.codex?.reverseMcp === 'ak' };
 }
 
 export async function register() {
diff --git a/src/lib/nudge.mjs b/src/lib/nudge.mjs
index c849002..1e61c39 100644
--- a/src/lib/nudge.mjs
+++ b/src/lib/nudge.mjs
@@ -24,7 +24,7 @@ import { fixStatusline, helperStampStale } from './statusline.mjs';
 /**
  * Probe the locally-rendered artifacts for drift.
  * @param {{ pkgRoot?: string, cwd?: string,
- *           cfg?: { customBlocks?: any[], providers?: any },
+ *           cfg?: { customBlocks?: any[], providers?: any, integrations?: { hosts?: Record<string, boolean> } },
  *           targets?: Array<{name: string, label: string, file: string}> }} [opts]
  *   `cfg` and `targets` are injectable for tests; defaults read the real
  *   kit.json and the real CLAUDE.md/AGENTS.md targets.
@@ -40,7 +40,7 @@ export async function localDrift({ pkgRoot, cwd = process.cwd(), cfg, targets }
     const resolve = (r) => (r.custom
       ? (r.template.startsWith('~/') ? path.join(paths.home, r.template.slice(2)) : r.template)
       : path.join(pkgRoot, 'claude', r.template));
-    const ctx = { flags: { dualMode: bothHostsEnabled(cfg), opencodeEnabled: !!cfg.providers?.hosts?.opencode } };
+    const ctx = { flags: { dualMode: bothHostsEnabled(cfg), opencodeEnabled: !!cfg.integrations?.hosts?.opencode } };
     // The SHARED target list + retired-strip composition (blocks.mjs) — the
     // nudge's contract is "never disagrees with ak status", which a hardcoded
     // subset silently breaks every time a guidance target is added (codex's
@@ -56,7 +56,7 @@ export async function localDrift({ pkgRoot, cwd = process.cwd(), cfg, targets }
 
   // Claude↔Codex MCP bridge (both directions; spawn-free file reads)
   try {
-    if (cfg.providers?.hosts?.codex) {
+    if (cfg.integrations?.hosts?.codex) {
       if (!codexMcpStatus(cfg, cwd).registered) lines.push('codex MCP unregistered');
       if (!rufloCodexMcpStatus(cfg).registered) lines.push('ruflo→codex MCP unregistered');
     }
diff --git a/src/lib/opencode.mjs b/src/lib/opencode.mjs
index e125434..b3ede3d 100644
--- a/src/lib/opencode.mjs
+++ b/src/lib/opencode.mjs
@@ -36,8 +36,21 @@ import { createHash } from 'node:crypto';
 import { have } from './exec.mjs';
 import { readJson, writeJsonWithBackup } from './settings.mjs';
 import { registry, syncBlocks, blocksForTarget, retiredForTarget, guidanceTargets } from './blocks.mjs';
+import { CURRENT_INTEGRATIONS_VERSION } from './adapters/config.mjs';
 import * as paths from './paths.mjs';
 
+const opencodeOwnership = (cfg) => cfg?.integrations?.ownership?.opencode ?? {};
+function mutableOpencodeOwnership(cfg) {
+  cfg.integrations ??= {
+    version: CURRENT_INTEGRATIONS_VERSION,
+    hosts: {},
+    bindings: [],
+  };
+  cfg.integrations.ownership ??= {};
+  cfg.integrations.ownership.opencode ??= {};
+  return cfg.integrations.ownership.opencode;
+}
+
 // ── config-file wiring (opencode.json) ──────────────────────────────────────
 
 /** ruflo init/mcp-generator.ts's env block, mirrored for parity. */
@@ -116,7 +129,7 @@ export function opencodeMcpStatus(cfg, { configFile = paths.opencodeConfigPath()
   const exists = fs.existsSync(configFile);
   const { ok, doc } = exists ? readJsonStrict(configFile) : { ok: true, doc: {} };
   if (!ok) {
-    return { exists, parseError: true, claudeFlow: false, brain: false, owned: cfg?.providers?.opencodeMcp === 'ak' };
+    return { exists, parseError: true, claudeFlow: false, brain: false, owned: opencodeOwnership(cfg).mcp === 'ak' };
   }
   return {
     exists,
@@ -124,7 +137,7 @@ export function opencodeMcpStatus(cfg, { configFile = paths.opencodeConfigPath()
     claudeFlow: !!doc?.mcp?.['claude-flow'],
     brain: !!doc?.mcp?.['ruvnet-brain'],
     paths: doc?.skills?.paths ?? [],
-    owned: cfg?.providers?.opencodeMcp === 'ak',
+    owned: opencodeOwnership(cfg).mcp === 'ak',
   };
 }
 
@@ -147,7 +160,7 @@ export async function opencodeConverged(cfg, { configFile = paths.opencodeConfig
     else if (!deepEqual(doc.mcp[name], want)) reasons.push(`${name} drifted`);
   }
   if (doc.mcp?.['ruvnet-brain'] && !entries['ruvnet-brain']) reasons.push('ruvnet-brain stale (brain shim gone)');
-  const source = catalogSource({ override: cfg.providers?.opencodeCatalogDir });
+  const source = catalogSource({ override: opencodeOwnership(cfg).catalogDir });
   for (const p of skillPathsFor(source)) {
     if (!(doc.skills?.paths ?? []).includes(p)) reasons.push(`skills path missing: ${p}`);
   }
@@ -252,7 +265,7 @@ export function opencodeArtifactReceiptState(managed) {
  *  spread character-by-character. Backup-first, idempotent, JSONC-refusing.
  *  @param {any} cfg @param {{ dryRun?: boolean, configFile?: string, brainShim?: string }} [opts] */
 export async function applyOpencode(cfg, { dryRun = false, configFile = paths.opencodeConfigPath(), brainShim } = {}) {
-  if (!cfg.providers?.hosts?.opencode) return { ok: true, changed: false, detail: 'opencode not enabled — unmanaged' };
+  if (!cfg.integrations?.hosts?.opencode) return { ok: true, changed: false, detail: 'opencode not enabled — unmanaged' };
   const exists = fs.existsSync(configFile);
   const { ok: parsedOk, doc } = exists ? readJsonStrict(configFile) : { ok: true, doc: {} };
   if (!parsedOk) {
@@ -262,9 +275,9 @@ export async function applyOpencode(cfg, { dryRun = false, configFile = paths.op
     };
   }
   const entries = await mcpEntriesFor({ brainShim });
-  const source = catalogSource({ override: cfg.providers?.opencodeCatalogDir });
+  const source = catalogSource({ override: opencodeOwnership(cfg).catalogDir });
   const skillPaths = skillPathsFor(source);
-  const prevManaged = normalizeManaged(cfg.providers?.opencodeManaged);
+  const prevManaged = normalizeManaged(opencodeOwnership(cfg).managed);
   const collisions = [];
   const pruned = [];
 
@@ -364,9 +377,10 @@ export async function applyOpencode(cfg, { dryRun = false, configFile = paths.op
   }
 
   const changed = JSON.stringify(next) !== JSON.stringify(doc);
-  if (!dryRun && cfg.providers) {
-    cfg.providers.opencodeMcp = 'ak';
-    cfg.providers.opencodeManaged = managed;
+  if (!dryRun) {
+    const ownership = mutableOpencodeOwnership(cfg);
+    ownership.mcp = 'ak';
+    ownership.managed = managed;
   }
   if (changed && !dryRun) writeJsonWithBackup(configFile, next);
   const brain = entries['ruvnet-brain'] ? ' + ruvnet-brain' : ' (brain shim absent — ruflo only)';
@@ -380,7 +394,8 @@ export async function applyOpencode(cfg, { dryRun = false, configFile = paths.op
 }
 
 /** Surgical teardown of ak's opencode.json wiring — ONLY the recorded managed
- *  keys, and ONLY when ak wrote them (providers.opencodeMcp === 'ak'). For each
+ *  keys, and ONLY when ak wrote them
+ *  (`integrations.ownership.opencode.mcp === 'ak'`). For each
  *  managed key: when the current value still equals what ak wrote, the user's
  *  PRIOR value is restored (or the key removed if there was none); a value the
  *  user edited since is left and reported, never silently deleted. Scalar
@@ -389,15 +404,17 @@ export async function applyOpencode(cfg, { dryRun = false, configFile = paths.op
  *  (removeArtifacts).
  *  @param {any} cfg @param {{ configFile?: string }} [opts] */
 export function undoOpencode(cfg, { configFile = paths.opencodeConfigPath() } = {}) {
-  if (cfg?.providers?.opencodeMcp !== 'ak') {
+  if (opencodeOwnership(cfg).mcp !== 'ak') {
     return { ok: true, changed: false, detail: 'opencode.json left as-is (not ak-managed)' };
   }
-  const managed = normalizeManaged(cfg.providers?.opencodeManaged);
+  const managed = normalizeManaged(opencodeOwnership(cfg).managed);
   if (!fs.existsSync(configFile)) {
     // Nothing left to strip — but the markers would otherwise survive as a lie
     // (a later teardown would chase a phantom config). Clear them; the change
     // is the marker cleanup itself (codex-review r3).
-    if (cfg.providers) { cfg.providers.opencodeMcp = null; cfg.providers.opencodeManaged = null; }
+    const ownership = mutableOpencodeOwnership(cfg);
+    ownership.mcp = null;
+    ownership.managed = null;
     return { ok: true, changed: true, detail: 'opencode.json absent — ownership markers cleared (nothing to strip)' };
   }
   const { ok: parsedOk, doc } = readJsonStrict(configFile);
@@ -447,7 +464,9 @@ export function undoOpencode(cfg, { configFile = paths.opencodeConfigPath() } =
   }
 
   if (changed) writeJsonWithBackup(configFile, doc);
-  if (cfg.providers) { cfg.providers.opencodeMcp = null; cfg.providers.opencodeManaged = null; }
+  const ownership = mutableOpencodeOwnership(cfg);
+  ownership.mcp = null;
+  ownership.managed = null;
   const detail = [
     changed ? 'ak-managed opencode.json wiring stripped (user priors restored)' : 'nothing managed found in opencode.json',
     kept.length ? `left untouched: ${kept.join(', ')}` : null,
@@ -478,15 +497,18 @@ export function undoOpencode(cfg, { configFile = paths.opencodeConfigPath() } =
  *  developer's real machine (codex-review r4).
  *  @param {any} cfg @param {{ pkgRoot: string, configFile?: string, brainShim?: string, pluginsDir?: string, agentsDir?: string, skillsDir?: string }} opts */
 export async function opencodeStack(cfg, { pkgRoot, configFile, brainShim, pluginsDir, agentsDir, skillsDir }) {
-  const before = JSON.stringify([cfg.providers?.opencodeMcp ?? null, cfg.providers?.opencodeManaged ?? null]);
+  const before = JSON.stringify([
+    opencodeOwnership(cfg).mcp ?? null,
+    opencodeOwnership(cfg).managed ?? null,
+  ]);
   const oc = await applyOpencode(cfg, { ...(configFile ? { configFile } : {}), ...(brainShim ? { brainShim } : {}) });
   if (oc.fatal) {
     const skipped = { ok: false, changed: false, detail: 'skipped because opencode.json did not converge' };
     return { oc, plugin: skipped, agents: skipped, skill: skipped, source: null, markersChanged: false };
   }
-  const receiptState = opencodeArtifactReceiptState(cfg.providers?.opencodeManaged);
+  const receiptState = opencodeArtifactReceiptState(opencodeOwnership(cfg).managed);
   const { receipts, adoptionBlocked } = receiptState;
-  const source = catalogSource({ override: cfg.providers?.opencodeCatalogDir });
+  const source = catalogSource({ override: opencodeOwnership(cfg).catalogDir });
   if (adoptionBlocked) {
     const detail = 'skipped because the artifact receipt ledger is malformed';
     const plugin = { ok: false, changed: false, receipt: receipts.plugin, adoptionBlocked: true, detail };
@@ -496,8 +518,8 @@ export async function opencodeStack(cfg, { pkgRoot, configFile, brainShim, plugi
     };
     const skill = { ok: false, changed: false, receipt: receipts.skill, adoptionBlocked: true, detail };
     const markersChanged = JSON.stringify([
-      cfg.providers?.opencodeMcp ?? null,
-      cfg.providers?.opencodeManaged ?? null,
+      opencodeOwnership(cfg).mcp ?? null,
+      opencodeOwnership(cfg).managed ?? null,
     ]) !== before;
     return { oc, plugin, agents, skill, source, markersChanged };
   }
@@ -515,14 +537,17 @@ export async function opencodeStack(cfg, { pkgRoot, configFile, brainShim, plugi
     ...(skillsDir ? { skillsDir } : {}),
   });
   if (!adoptionBlocked) {
-    cfg.providers.opencodeManaged.artifacts = {
+    mutableOpencodeOwnership(cfg).managed.artifacts = {
       plugin: plugin.receipt ?? receipts.plugin ?? null,
       agents: agents.receipts ?? receipts.agents ?? {},
       agentStamp: agents.stampReceipt ?? receipts.agentStamp ?? null,
       skill: skill.receipt ?? receipts.skill ?? null,
     };
   }
-  const markersChanged = JSON.stringify([cfg.providers?.opencodeMcp ?? null, cfg.providers?.opencodeManaged ?? null]) !== before;
+  const markersChanged = JSON.stringify([
+    opencodeOwnership(cfg).mcp ?? null,
+    opencodeOwnership(cfg).managed ?? null,
+  ]) !== before;
   return { oc, plugin, agents, skill, source, markersChanged };
 }
 
@@ -536,7 +561,7 @@ export async function opencodeStack(cfg, { pkgRoot, configFile, brainShim, plugi
 /** @param {any} cfg
  *  @param {{configFile?:string,pluginsDir?:string,agentsDir?:string,skillsDir?:string}} [opts] */
 export function retireOpencode(cfg, { configFile, pluginsDir, agentsDir, skillsDir } = {}) {
-  const receipts = normalizeManaged(cfg.providers?.opencodeManaged).artifacts;
+  const receipts = normalizeManaged(opencodeOwnership(cfg).managed).artifacts;
   const undo = undoOpencode(cfg, { ...(configFile ? { configFile } : {}) });
   const artifacts = undo.ok
     ? removeArtifacts({
@@ -552,8 +577,8 @@ export function retireOpencode(cfg, { configFile, pluginsDir, agentsDir, skillsD
 /**
  * ADR-0016 lifecycle adapter for OpenCode's managed native surfaces.
  * Configuration lifecycle is deliberately separate from activity routing:
- * this adapter can drive setup/sync/status/teardown while the registry keeps
- * `canRouteActivities:false`.
+ * this adapter drives setup/sync/status/teardown while the host-neutral runner
+ * separately honors the registry's explicit `canRouteActivities:true`.
  *
  * The factory keeps filesystem destinations injectable for hermetic conformance
  * tests. `detect`, `plan`, and `verify` are read-only. `runLifecycle` owns the
@@ -564,12 +589,12 @@ export function createOpencodeLifecycleAdapter(defaults = {}) {
   const detect = async (request = {}) => {
     const cfg = request.cfg ?? {};
     const opts = options(request);
-    const source = catalogSource({ override: cfg.providers?.opencodeCatalogDir });
+    const source = catalogSource({ override: opencodeOwnership(cfg).catalogDir });
     const convergence = await opencodeConverged(cfg, {
       ...(opts.configFile ? { configFile: opts.configFile } : {}),
       ...(opts.brainShim ? { brainShim: opts.brainShim } : {}),
     });
-    const receiptState = opencodeArtifactReceiptState(cfg.providers?.opencodeManaged);
+    const receiptState = opencodeArtifactReceiptState(opencodeOwnership(cfg).managed);
     const { receipts, adoptionBlocked } = receiptState;
     const plugin = opts.pkgRoot
       ? pluginStatus({
@@ -586,7 +611,7 @@ export function createOpencodeLifecycleAdapter(defaults = {}) {
       source, receipt: receipts.skill, adoptionBlocked,
       ...(opts.skillsDir ? { skillsDir: opts.skillsDir } : {}),
     });
-    return { enabled: !!cfg.providers?.hosts?.opencode, convergence, plugin, agents, skill };
+    return { enabled: !!cfg.integrations?.hosts?.opencode, convergence, plugin, agents, skill };
   };
   return {
     id: 'opencode',
@@ -638,7 +663,12 @@ export async function reconcileOpencodeGuidance({ pkgRoot, cfg, cwd = process.cw
   const resolve = (r) => (r.custom
     ? (r.template.startsWith('~/') ? path.join(paths.home, r.template.slice(2)) : r.template)
     : path.join(pkgRoot, 'claude', r.template));
-  const ctx = { flags: { dualMode: !!cfg.providers?.hosts?.claude && !!cfg.providers?.hosts?.codex, opencodeEnabled: enabled } };
+  const ctx = {
+    flags: {
+      dualMode: !!cfg.integrations?.hosts?.claude && !!cfg.integrations?.hosts?.codex,
+      opencodeEnabled: enabled,
+    },
+  };
   const treg = [...blocksForTarget(rows, 'agents-opencode'), ...retiredForTarget(rows, 'agents-opencode')];
   const res = await syncBlocks(target.file, treg, resolve, { context: ctx });
   const changed = res.filter((r) => r.action !== 'unchanged' && r.action !== 'skipped')
@@ -649,7 +679,8 @@ export async function reconcileOpencodeGuidance({ pkgRoot, cfg, cwd = process.cw
 // ── ruflo catalog source (agents + skills) ──────────────────────────────────
 
 /** Resolve where ruflo's agent/skill catalog comes from. Order: explicit
- *  override (kit.json providers.opencodeCatalogDir) → $RUFLO_REPO → the claude
+ *  override (kit.json integrations.ownership.opencode.catalogDir) →
+ *  $RUFLO_REPO → the claude
  *  marketplace clone (full repo mirror, auto-updated by claude) → the
  *  published @claude-flow/cli package (subset: ADR-128 agents + core skills)
  *  → the nested copy under global ruflo/node_modules (the layout a plain
diff --git a/src/lib/providers.mjs b/src/lib/providers.mjs
index 887a4a6..d22fbb3 100644
--- a/src/lib/providers.mjs
+++ b/src/lib/providers.mjs
@@ -5,8 +5,6 @@
 //   - ruflo ADR-034 "Optional MCP Backends" (ACCEPTED): Claude Code / Gemini / OpenAI
 //     Codex backends are enabled via env vars ENABLE_CLAUDE_CODE / ENABLE_CODEX /
 //     ENABLE_GEMINI_MCP.
-//   - @claude-flow/codex adapter (bin claude-flow-codex); `ruflo init --dual` =
-//     "Initialize for both Claude Code and OpenAI Codex".
 //   - `ruflo providers configure -p <id> -m <model>` persists API-key providers
 //     (anthropic/openai/google/ollama) to ruflo's config.
 //   - agentic-qe LLM selector `AQE_LLM_PROVIDER=<type>` (ADR-123,
@@ -19,7 +17,7 @@
 //
 // Two independent axes:
 //   host axis     — which agent CLI executes a managed worker (claude, codex,
-//                   opencode). Ruvlo's dual mode itself remains Claude/Codex.
+//                   opencode).
 //   provider axis — which LLM the *routers* use: ruflo's API-key providers
 //                   (`ruflo providers configure`) and aqe's `AQE_LLM_PROVIDER`.
 //                   Independent of the host axis; keys live in the env, never kit.json.
@@ -31,29 +29,27 @@ import { readJson, writeJsonWithBackup } from './settings.mjs';
 import { installedVersion, cmpVersions } from './versions.mjs';
 import * as paths from './paths.mjs';
 import { bold, dim, cyan } from './output.mjs';
-import { configuredPolicyToAgentOverrides, seedDualRouting, resolveRoutes, routingSummary, divergedRoutes, ACTIVITIES, AGENT_ACTIVITY_MAP, DEFAULT_PRIMARY_HOST, PRIMARY_HOSTS } from './routing.mjs';
+import { configuredPolicyToAgentOverrides, seedActivityRoutes, resolveRoutes, routingSummary, divergedRoutes, ACTIVITIES, AGENT_ACTIVITY_MAP, PRIMARY_HOSTS } from './routing.mjs';
 import { HOST_ADAPTERS } from './hosts.mjs';
 import {
   HOST_REGISTRY, PROVIDER_REGISTRY, normalizeIntegrationFacts,
 } from './adapters/index.mjs';
+import { CURRENT_INTEGRATIONS_VERSION } from './adapters/config.mjs';
 import { opencodeMcpStatus } from './opencode.mjs';
+import {
+  DEFAULT_PRIMARY_HOST,
+  ROUTING_SCHEMA_VERSION,
+} from './routing-config.mjs';
 
 /** Frontier agent-CLI hosts. `pkg` is the npm global package; `enableEnv` is
  *  ruflo's ADR-034 backend flag; `aqe` is the AQE_LLM_PROVIDER value (null when
  *  aqe can't host it). */
-/** ruflo's dual-mode adapter — a SEPARATE npm global from the codex CLI. Without
- *  it, `ruflo init --dual` aborts with "The @claude-flow/codex package is not
- *  installed". ak treats it as a managed prerequisite of dual-mode (installed
- *  only when codex is opted-in AND the codex CLI is detected). */
-export const CODEX_ADAPTER_PKG = '@claude-flow/codex';
-
 export const HOSTS = HOST_REGISTRY
   .filter((host) => host.capabilities.canDriveSession)
   .map((host) => ({
     id: host.id, bin: host.install.bin, pkg: host.install.npmPackage,
     enableEnv: host.legacy?.enableEnv ?? null,
     aqe: host.id === 'claude' ? host.legacy?.aqeProvider : null,
-    ...(host.id === 'codex' ? { adapterPkg: CODEX_ADAPTER_PKG } : {}),
   }));
 
 /** API-key LLM providers ruflo's router understands (`ruflo providers`). */
@@ -154,7 +150,7 @@ export function credentialGaps(chain = [], { env = process.env, hostAuth } = {})
     .map((c) => ({ provider: c.provider, missing: c.missing }));
 }
 
-/** Credential state for every aqe provider type — what `ak x provider status`
+/** Credential state for every aqe provider type — what `ak x host status`
  *  renders, so a credentialed provider (e.g. openrouter) is never invisible. */
 export function detectAqeProviders({ env = process.env } = {}) {
   return Object.fromEntries(AQE_PROVIDER_TYPES.map((p) => [p, aqeProviderCredential(p, { env })]));
@@ -282,7 +278,7 @@ export async function collectIntegrationFacts({
   }
   const hosts = Object.fromEntries(Object.entries(detectedHosts).map(([id, fact]) => [id, {
     ...fact,
-    enabled: cfg?.providers?.hosts?.[id] ?? null,
+    enabled: cfg?.integrations?.hosts?.[id] ?? null,
   }]));
   const providers = Object.fromEntries(Object.entries(detectedProviders).map(([id, fact]) => {
     const adapter = PROVIDER_REGISTRY.find((entry) => entry.id === id);
@@ -298,7 +294,7 @@ export async function collectIntegrationFacts({
   return normalizeIntegrationFacts({
     hosts,
     providers,
-    bindings: cfg?.integrations?.bindings ?? cfg?.providers?.bindings ?? [],
+    bindings: cfg?.integrations?.bindings ?? [],
   });
 }
 
@@ -331,7 +327,8 @@ function currentEnv(cwd) {
  *  an enabled opencode host is not "claude-only" (codex-review r2). */
 export function isDefault(cfg) {
   const p = cfg.providers ?? {};
-  return !!p.hosts?.claude && !p.hosts?.codex && !p.hosts?.opencode && p.aqeProvider == null
+  const hosts = cfg.integrations?.hosts ?? {};
+  return !!hosts.claude && !hosts.codex && !hosts.opencode && p.aqeProvider == null
     && (!p.models || p.models.length === 0) && (p.maxBudgetUsd == null)
     && (!p.aqeFallback || p.aqeFallback.length === 0);
 }
@@ -340,24 +337,20 @@ export function isDefault(cfg) {
  *  regardless of whether the env is wired yet — this is the same source
  *  `status()` already keys "enabled" off of. Guards the dual-mode/judge-bias
  *  guidance below: only relevant once both are actually opted in. */
-export const bothHostsEnabled = (cfg) => !!cfg.providers?.hosts?.claude && !!cfg.providers?.hosts?.codex;
+export const bothHostsEnabled = (cfg) => !!cfg.integrations?.hosts?.claude && !!cfg.integrations?.hosts?.codex;
 
-/** Guidance printed once both hosts are enabled — pointers to capability that
- *  already exists one layer up from ak's own wiring (see issue #36):
- *   - role-based dual-mode delegation lives in the separate @claude-flow/codex
- *     npm package's `dual` CLI, which ak installs as a prerequisite but never
- *     surfaces itself.
+/** Guidance printed once both hosts are enabled:
+ *   - ak run executes role-based activity pipelines through the configured hosts.
  *   - judge-vendor-bias: a same-vendor LLM judge scores ~8-10pp inflated versus
  *     a cross-vendor judge (still ordinally correct, not calibrated) — measured
  *     in openrouter-alts.json's judge_bias_check_2026_06_15. */
-export const DUAL_ROLE_TIP = 'both hosts enabled — try role delegation: claude-flow-codex dual run --template feature|security|refactor (or custom --worker specs)';
+export const DUAL_ROLE_TIP = 'both hosts enabled — run a role-based pipeline with: ak run feature|security|refactor "<task>"';
 export const JUDGE_BIAS_TIP = 'tip: for LLM-judged scoring, use a different vendor than the writer as judge — same-vendor judges run ~8-10pp inflated (still ordinally correct, but not calibrated)';
 
 /** Cross-sell for agentic-qe's qe-court (ADR-124, shipped 3.13.0): its jury
- *  requires >= 2 distinct vendors seated, which a dual-host setup already
- *  satisfies. Only meaningful once both hosts are enabled AND aqe is new
- *  enough to ship the skill — callers gate on both. */
-export const QE_COURT_TIP = 'agentic-qe ships qe-court (adversarial review; upgrade to ≥ 3.13.3 for enforced config validation) — its jury requires ≥ 2 distinct vendors, which your dual-host setup already satisfies';
+ *  requires >= 2 distinct vendors seated. Host count is not sufficient
+ *  evidence because a host can route to a provider from the same vendor. */
+export const QE_COURT_TIP = 'agentic-qe ships qe-court (adversarial review; upgrade to ≥ 3.13.3 for enforced config validation) — its jury requires evidence from ≥ 2 distinct vendors; host count alone is not provider evidence';
 
 /** Suggested aqe-fallback chain when codex is among the enabled hosts: codex's
  *  models are reached via the `openai` provider type (not as an aqe provider
@@ -410,13 +403,13 @@ function buildChain(entries) {
  *  into any existing file (backup-first, never persisting apiKey):
  *    - the ordered fallback chain + enabled set + default provider (from
  *      `aqeFallback`), and
- *    - the per-activity `agentOverrides` map projected from `dualRouting`
+ *    - the per-activity `agentOverrides` map projected from `routing.routes`
  *      (issue #568; only when installed aqe ≥ 3.13.1).
  *  No-op unless at least one of those is configured and we are in a project.
  *  Returns {ok, changed, detail}. */
 export function applyAqeRouter(cfg, cwd = process.cwd()) {
   const chain = cfg.providers?.aqeFallback ?? [];
-  const policy = cfg.providers?.dualRouting ?? {};
+  const policy = cfg.routing?.routes ?? {};
   const hasChain = chain.length > 0;
   const hasPolicy = Object.keys(policy).length > 0;
   // Same repo-root resolution as settingsTarget — the three scope gates must
@@ -443,7 +436,7 @@ export function applyAqeRouter(cfg, cwd = process.cwd()) {
     const valid = chain.filter((e) => e?.provider && AQE_PROVIDER_TYPES.includes(e.provider));
     if (valid.length === 0) {
       // A bad chain must NOT block the independent agentOverrides projection — the
-      // dualRouting policy is validated separately. Record it and carry on.
+      // Activity routing is validated separately. Record it and carry on.
       chainError = 'no valid providers in fallback chain';
       details.push(`chain: ⚠ ${chainError}`);
     } else {
@@ -501,23 +494,30 @@ export function undoAqeRouter(cwd = process.cwd()) {
   return { ok: true, changed: true, detail: 'removed ak-created llm-config.json' };
 }
 
-// ── per-activity dual-host routing (kit.json providers.dualRouting) ──────────
-// Seed/format helpers shared by `ak x provider` and `ak setup`. The pure policy
+// ── per-activity host routing (kit.json routing.routes) ─────────────────────
+// Seed/format helpers shared by `ak x host` and `ak setup`. The pure policy
 // core + projectors live in routing.mjs; these bridge it to kit.json + the CLI.
 
 /** Seed the per-activity routing policy from defaults when BOTH hosts are enabled
  *  and aqe supports agentOverrides — but only if the user has no policy yet (empty
- *  map). Subscription-only targeting + `seeded` provenance come from seedDualRouting
- *  (ADR-0003). Mutates cfg.providers.dualRouting. Returns {seeded, count}. */
-export function seedDualRoutingIfDualHost(cfg) {
-  const p = cfg.providers ?? (cfg.providers = {});
-  const existing = p.dualRouting ?? {};
+ *  map). Subscription-only targeting + `seeded` provenance come from
+ *  seedActivityRoutes (ADR-0003). Mutates cfg.routing.routes. */
+export function seedActivityRoutesIfMultiHost(cfg) {
+  const routing = cfg.routing ?? (cfg.routing = {
+    version: ROUTING_SCHEMA_VERSION,
+    primaryHost: DEFAULT_PRIMARY_HOST,
+    routes: {},
+  });
+  const existing = routing.routes ?? {};
   if (Object.keys(existing).length > 0) return { seeded: false, count: Object.keys(existing).length };
   if (!bothHostsEnabled(cfg) || !aqeSupportsAgentOverrides()) return { seeded: false, count: 0 };
   // primary host (default claude) biases the seed: codex-primary mirrors the
   // default routes so codex leads and claude is the alternate (ADR-0004 escalation).
-  p.dualRouting = seedDualRouting({ hosts: ['claude', 'codex'], primary: p.primaryHost ?? DEFAULT_PRIMARY_HOST });
-  return { seeded: true, count: Object.keys(p.dualRouting).length };
+  routing.routes = seedActivityRoutes({
+    hosts: ['claude', 'codex'],
+    primary: routing.primaryHost ?? DEFAULT_PRIMARY_HOST,
+  });
+  return { seeded: true, count: Object.keys(routing.routes).length };
 }
 
 /** Apply `ak setup` host flags to a kit.json cfg IN PLACE (before setup's
@@ -526,24 +526,32 @@ export function seedDualRoutingIfDualHost(cfg) {
  *  default claude-only behavior untouched when neither flag is passed. Returns
  *  {changed, warnings} — pure except for the intended cfg mutation. */
 export function applySetupHostFlags(cfg, flags = {}) {
-  const p = cfg.providers ?? (cfg.providers = {});
-  p.hosts ?? (p.hosts = { claude: true, codex: false, opencode: false });
+  const integrations = cfg.integrations ?? (cfg.integrations = {
+    version: CURRENT_INTEGRATIONS_VERSION,
+    bindings: [],
+  });
+  integrations.hosts ?? (integrations.hosts = { claude: true, codex: false, opencode: false });
+  const routing = cfg.routing ?? (cfg.routing = {
+    version: ROUTING_SCHEMA_VERSION,
+    primaryHost: DEFAULT_PRIMARY_HOST,
+    routes: {},
+  });
   const warnings = [];
   let changed = false;
   const wantPrimary = typeof flags['primary-host'] === 'string' ? flags['primary-host'].trim().toLowerCase() : null;
   // choosing codex as primary implies wanting codex enabled
   if (flags.codex || wantPrimary === 'codex') {
-    if (!p.hosts.codex || !p.hosts.claude) changed = true;
-    p.hosts = { ...p.hosts, claude: true, codex: true };
+    if (!integrations.hosts.codex || !integrations.hosts.claude) changed = true;
+    integrations.hosts = { ...integrations.hosts, claude: true, codex: true };
   }
   // --opencode opts the opencode host in (config-file wiring, no env flags)
   if (flags.opencode) {
-    if (!p.hosts.opencode) changed = true;
-    p.hosts = { ...p.hosts, opencode: true };
+    if (!integrations.hosts.opencode) changed = true;
+    integrations.hosts = { ...integrations.hosts, opencode: true };
   }
   if (wantPrimary) {
     if (PRIMARY_HOSTS.includes(wantPrimary)) {
-      if (p.primaryHost !== wantPrimary) { p.primaryHost = wantPrimary; changed = true; }
+      if (routing.primaryHost !== wantPrimary) { routing.primaryHost = wantPrimary; changed = true; }
     } else {
       warnings.push(`unknown --primary-host '${wantPrimary}' (valid: ${PRIMARY_HOSTS.join('|')}) — ignored`);
     }
@@ -554,7 +562,7 @@ export function applySetupHostFlags(cfg, flags = {}) {
 /** Render the effective per-activity routing as a colorized table, or null when
  *  no policy is set. Shared by `pick`/`status`/`setup` so the view never drifts. */
 export function formatRoutingTable(cfg) {
-  const policy = cfg.providers?.dualRouting ?? {};
+  const policy = cfg.routing?.routes ?? {};
   if (Object.keys(policy).length === 0) return null;
   const routes = resolveRoutes(policy);
   const s = routingSummary(policy);
@@ -566,12 +574,12 @@ export function formatRoutingTable(cfg) {
   const diverged = Object.fromEntries(divergedRoutes(policy).map((d) => [d.activity, d]));
   for (const act of ACTIVITIES) {
     const r = routes[act];
-    const src = r.source === 'user' ? cyan('custom') : dim(r.source);
-    const esc = r.escalate?.length ? dim(`  ↑ ${r.escalate.map((e) => e.host).join('→')}`) : '';
+    const src = r.provenance === 'user' ? cyan('custom') : dim(r.provenance);
+    const esc = r.escalation?.length ? dim(`  ↑ ${r.escalation.map((e) => e.host).join('→')}`) : '';
     const tag = r.akOriginated ? dim(' [ak]') : '';
     const d = diverged[act];
     const div = d
-      ? dim(`  diverges from default ${d.modelDiverged ? d.defaultModel : d.escalate.map((e) => `↑${e.defaultModel}`).join(',')}`)
+      ? dim(`  diverges from default ${d.modelDiverged ? d.defaultModel : d.escalation.map((e) => `↑${e.defaultModel}`).join(',')}`)
       : '';
     lines.push(`  ${act.padEnd(18)} ${r.host.padEnd(7)} ${(r.model ?? '').padEnd(24)} ${src}${tag}${esc}${div}`);
   }
@@ -594,14 +602,17 @@ export function printActivityRoutingTable(cfg) {
 // undoCodexMcp. Best-effort: a failure here never fails the caller.
 // Ownership: a `codex` MCP server that PRE-EXISTS ak's registration is the user's
 // and must never be torn down (there's no `_managedBy` on an MCP entry). ak only
-// removes a server it actually added, tracked by `providers.codexMcp === 'ak'` in
+// removes a server it actually added, tracked by
+// `integrations.ownership.codex.mcp === 'ak'` in
 // kit.json. On mutation ak sets the marker; the caller persists cfg.
 export async function ensureCodexMcp(cfg, cwd = process.cwd()) {
-  if (!cfg.providers?.hosts?.codex) return { ok: true, changed: false, detail: 'codex not enabled — codex MCP unmanaged' };
+  if (!cfg.integrations?.hosts?.codex) return { ok: true, changed: false, detail: 'codex not enabled — codex MCP unmanaged' };
   if (!(await have('codex'))) return { ok: true, changed: false, detail: 'codex CLI not installed' };
   const r = await run('claude', ['mcp', 'add', 'codex', '-s', 'project', '--', 'codex', 'mcp-server'], { cwd });
   if (r.code === 0) {
-    if (cfg.providers) cfg.providers.codexMcp = 'ak'; // ak owns it → safe to remove later
+    cfg.integrations.ownership ??= {};
+    cfg.integrations.ownership.codex ??= {};
+    cfg.integrations.ownership.codex.mcp = 'ak';
     return { ok: true, changed: true, detail: 'codex MCP registered (mcp__codex__codex)' };
   }
   if (/already exists|already configured/i.test(`${r.stderr}${r.stdout}`)) {
@@ -623,19 +634,21 @@ export async function undoCodexMcp(cwd = process.cwd(), { managed = false, runne
 // ensureCodexMcp above wires claude→codex (Claude calls Codex via mcp__codex__codex).
 // This is the MIRROR: register the ruflo MCP server INTO Codex so a Codex-driven
 // session can reach ruflo's tools — the codex→ruflo half that makes the bridge
-// bidirectional (ambidextrous parity). Grounded in @claude-flow/codex mcp-config.ts:
+// bidirectional (ambidextrous parity). The reverse bridge intentionally uses:
 // `codex mcp add ruflo -- <cmd> mcp start` writes a [mcp_servers.ruflo] table into
 // ~/.codex/config.toml. aqe's own codex MCP is handled by `aqe init --with-codex`
 // (setup runs it), and Claude Code is not itself an MCP server, so those two legs
 // live elsewhere; this owns the ruflo leg. Best-effort; a failure never fails the
-// caller. Ownership marker: providers.rufloCodexMcp === 'ak'.
+// caller. Ownership marker: integrations.ownership.codex.reverseMcp === 'ak'.
 export async function ensureRufloMcpInCodex(cfg, cwd = process.cwd()) {
-  if (!cfg.providers?.hosts?.codex) return { ok: true, changed: false, detail: 'codex not enabled — ruflo→codex MCP unmanaged' };
+  if (!cfg.integrations?.hosts?.codex) return { ok: true, changed: false, detail: 'codex not enabled — ruflo→codex MCP unmanaged' };
   if (!(await have('codex'))) return { ok: true, changed: false, detail: 'codex CLI not installed' };
   if (!(await have('ruflo'))) return { ok: true, changed: false, detail: 'ruflo not on PATH — ruflo→codex MCP skipped' };
   const r = await run('codex', ['mcp', 'add', 'ruflo', '--', 'ruflo', 'mcp', 'start'], { cwd });
   if (r.code === 0) {
-    if (cfg.providers) cfg.providers.rufloCodexMcp = 'ak'; // ak owns it → safe to remove later
+    cfg.integrations.ownership ??= {};
+    cfg.integrations.ownership.codex ??= {};
+    cfg.integrations.ownership.codex.reverseMcp = 'ak';
     return { ok: true, changed: true, detail: 'ruflo MCP registered into codex ([mcp_servers.ruflo])' };
   }
   if (/already exists|already configured/i.test(`${r.stderr}${r.stdout}`)) {
@@ -658,9 +671,10 @@ export async function undoRufloMcpInCodex(cwd = process.cwd(), { managed = false
  *  default/env detection. Omitting a key means "remove if present". */
 export function managedEnv(cfg) {
   const p = cfg.providers ?? {};
+  const hosts = cfg.integrations?.hosts ?? {};
   const e = {
-    ENABLE_CLAUDE_CODE: String(!!p.hosts?.claude),
-    ENABLE_CODEX: String(!!p.hosts?.codex),
+    ENABLE_CLAUDE_CODE: String(!!hosts.claude),
+    ENABLE_CODEX: String(!!hosts.codex),
   };
   if (cfg.aqe !== false && p.aqeProvider && AQE_PROVIDER_TYPES.includes(p.aqeProvider)) {
     e.AQE_LLM_PROVIDER = p.aqeProvider;
@@ -684,7 +698,7 @@ export function applyHosts(cfg, cwd = process.cwd()) {
     } else if (k in s.env) { delete s.env[k]; changed = true; }
   }
   if (changed) writeJsonWithBackup(file, s);
-  const on = HOSTS.filter((h) => cfg.providers.hosts[h.id]).map((h) => h.id).join('+') || 'none';
+  const on = HOSTS.filter((h) => cfg.integrations?.hosts?.[h.id]).map((h) => h.id).join('+') || 'none';
   return { ok: true, changed, detail: `hosts=${on} (${scope}${changed ? ', written' : ', in sync'})` };
 }
 
@@ -721,47 +735,6 @@ export async function applyProviders(cfg, cwd = process.cwd()) {
   return { ok: done.every((d) => !d.includes('failed') && !d.includes('invalid')), changed: true, detail: `configured: ${done.join(', ')}` };
 }
 
-/** Pure decision for the codex dual-mode adapter, factored out for tests:
- *  install ONLY when codex is opted-in, the codex CLI is present, and the adapter
- *  is not already installed. Never install the adapter for an absent CLI. */
-export function codexAdapterAction({ opted, cliPresent, adapterInstalled }) {
-  if (!opted) return 'skip-not-opted';
-  if (!cliPresent) return 'skip-no-cli';
-  if (adapterInstalled) return 'already-installed';
-  return 'install';
-}
-
-/** Ensure ruflo's dual-mode adapter (@claude-flow/codex) is installed before we
- *  run `ruflo init --dual`. Guarded: opted-in codex host + detected codex CLI. */
-export async function ensureCodexAdapter(cfg, cwd = process.cwd()) {
-  const opted = !!cfg.providers?.hosts?.codex;
-  if (!opted) return { ok: true, changed: false, detail: 'codex disabled — adapter not needed' };
-  const cliPresent = await have('codex');
-  const adapterInstalled = !!installedVersion(CODEX_ADAPTER_PKG);
-  const action = codexAdapterAction({ opted, cliPresent, adapterInstalled });
-  if (action === 'skip-no-cli') return { ok: true, changed: false, detail: 'codex CLI not detected — adapter install skipped' };
-  if (action === 'already-installed') return { ok: true, changed: false, detail: `${CODEX_ADAPTER_PKG} already installed` };
-  const r = await run('npm', ['install', '-g', `${CODEX_ADAPTER_PKG}@latest`], { cwd, timeout: 600_000 });
-  return { ok: r.code === 0, changed: r.code === 0, detail: r.code === 0 ? `installed ${CODEX_ADAPTER_PKG}` : r.stderr.split('\n').slice(-2).join(' ').slice(0, 200) };
-}
-
-/** Heavy, pick/setup-time only: regenerate dual-mode agents when codex is on.
- *  Kept OUT of the sync hot path (it force-regenerates project files). */
-export async function ensureDualAgents(cfg, cwd = process.cwd()) {
-  if (!cfg.providers?.hosts?.codex) return { ok: true, changed: false, detail: 'codex disabled — no dual agents' };
-  // Repo-root walk, matching settingsTarget/applyAqeRouter — and init runs at
-  // the ROOT, so a subdir invocation can't scatter project files mid-tree.
-  const root = paths.repoRoot(cwd);
-  if (!root) return { ok: true, changed: false, detail: 'not a project — skipped `ruflo init --dual`' };
-  if (!(await have('ruflo'))) return { ok: false, detail: 'ruflo not on PATH' };
-  // Prerequisite: dual-init aborts unless @claude-flow/codex is present. Install
-  // it first (guarded on opted-in codex + detected CLI) so a fresh machine just works.
-  const adapter = await ensureCodexAdapter(cfg, root);
-  if (!adapter.ok) return { ok: false, changed: adapter.changed, detail: `adapter prerequisite failed: ${adapter.detail}` };
-  const r = await run('ruflo', ['init', '--dual', '--force'], { cwd: root, timeout: 300_000 });
-  return { ok: r.code === 0, changed: r.code === 0, detail: r.code === 0 ? 'ruflo init --dual applied' : 'ruflo init --dual failed' };
-}
-
 /** Reversible teardown: strip every managed env key from the target file. */
 export function undoProviders(cwd = process.cwd()) {
   const { file } = settingsTarget(cwd);
diff --git a/src/lib/routing-config.mjs b/src/lib/routing-config.mjs
new file mode 100644
index 0000000..c7e2b4a
--- /dev/null
+++ b/src/lib/routing-config.mjs
@@ -0,0 +1,143 @@
+import { isDeepStrictEqual } from 'node:util';
+import { immutable } from './adapters/schema.mjs';
+
+export const ROUTING_SCHEMA_VERSION = 1;
+export const DEFAULT_PRIMARY_HOST = 'claude';
+
+const plain = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const own = (value, key) => plain(value) && Object.hasOwn(value, key);
+// Frozen at the pre-GA cutover: migration must preserve the host that an
+// omitted alpha route inherited then, even if live defaults change later.
+const LEGACY_DEFAULT_HOSTS = {
+  specification: 'claude',
+  architecture: 'claude',
+  design: 'claude',
+  implementation: 'codex',
+  testing: 'codex',
+  review: 'claude',
+  'security-scan': 'codex',
+  'security-analysis': 'claude',
+  documentation: 'codex',
+  debugging: 'claude',
+  packaging: 'codex',
+  release: 'claude',
+};
+
+/** Convert the persisted alpha route shape without resolving defaults.
+ * Absence is meaningful: a missing escalation inherits the built-in ladder,
+ * while an empty escalation deliberately suppresses it. */
+export function legacyRoutesToCanonical(routes = {}) {
+  if (!plain(routes)) throw new TypeError('providers.dualRouting must be an object');
+  const out = {};
+  for (const [activity, route] of Object.entries(routes)) {
+    if (!plain(route)) {
+      throw new TypeError(`providers.dualRouting.${activity} must be an object`);
+    }
+    const next = {};
+    for (const [key, value] of Object.entries(route)) {
+      if (key === 'source' || key === 'escalate') continue;
+      next[key] = structuredClone(value);
+    }
+    if (!own(next, 'host')) {
+      const defaultHost = LEGACY_DEFAULT_HOSTS[activity];
+      if (!defaultHost) {
+        throw new TypeError(
+          `providers.dualRouting.${activity}.host is required because the activity has no default host`,
+        );
+      }
+      next.host = defaultHost;
+    }
+    next.provenance = own(route, 'source') ? structuredClone(route.source) : 'user';
+    if (own(route, 'escalate')) next.escalation = structuredClone(route.escalate);
+    out[activity] = next;
+  }
+  return out;
+}
+
+export function validateRoutingEnvelope(envelope) {
+  if (!plain(envelope)) throw new TypeError('routing must be an object');
+  if (envelope.version !== ROUTING_SCHEMA_VERSION) {
+    throw new TypeError(`unsupported routing.version ${String(envelope.version)}`);
+  }
+  if (typeof envelope.primaryHost !== 'string' || envelope.primaryHost.length === 0) {
+    throw new TypeError('routing.primaryHost must be a non-empty string');
+  }
+  if (!plain(envelope.routes)) throw new TypeError('routing.routes must be an object');
+  for (const [activity, route] of Object.entries(envelope.routes)) {
+    if (!plain(route)) throw new TypeError(`routing.routes.${activity} must be an object`);
+    if (typeof route.host !== 'string' || route.host.length === 0) {
+      throw new TypeError(`routing.routes.${activity}.host must be a non-empty string`);
+    }
+    if (own(route, 'model') && route.model !== null
+      && (typeof route.model !== 'string' || route.model.length === 0)) {
+      throw new TypeError(`routing.routes.${activity}.model must be a non-empty string or null`);
+    }
+    if (!['default', 'seeded', 'user'].includes(route.provenance)) {
+      throw new TypeError(`routing.routes.${activity}.provenance must be default, seeded, or user`);
+    }
+    if (own(route, 'escalation')) {
+      if (!Array.isArray(route.escalation)) {
+        throw new TypeError(`routing.routes.${activity}.escalation must be an array`);
+      }
+      for (const [index, rung] of route.escalation.entries()) {
+        if (!plain(rung) || typeof rung.host !== 'string' || rung.host.length === 0) {
+          throw new TypeError(`routing.routes.${activity}.escalation[${index}].host must be a non-empty string`);
+        }
+        if (own(rung, 'model') && rung.model !== null
+          && (typeof rung.model !== 'string' || rung.model.length === 0)) {
+          throw new TypeError(`routing.routes.${activity}.escalation[${index}].model must be a non-empty string or null`);
+        }
+      }
+    }
+  }
+  return envelope;
+}
+
+/** Normalize the top-level routing envelope and retire only the legacy fields
+ * that were successfully represented. Future versions remain fully opaque. */
+export function migrateRoutingConfig(config = {}) {
+  const out = structuredClone(plain(config) ? config : {});
+  const providers = plain(out.providers) ? out.providers : {};
+  const hasLegacyRoutes = own(providers, 'dualRouting');
+  const hasLegacyPrimary = own(providers, 'primaryHost');
+  const existing = out.routing;
+
+  if (plain(existing) && Number.isInteger(existing.version)
+    && existing.version > ROUTING_SCHEMA_VERSION) {
+    return immutable(out);
+  }
+
+  let routing;
+  if (existing !== undefined) {
+    validateRoutingEnvelope(existing);
+    if (hasLegacyPrimary && providers.primaryHost !== existing.primaryHost) {
+      throw new TypeError('routing conflict: providers.primaryHost differs from routing.primaryHost');
+    }
+    if (hasLegacyRoutes) {
+      const legacyRoutes = legacyRoutesToCanonical(providers.dualRouting);
+      if (!isDeepStrictEqual(legacyRoutes, existing.routes)) {
+        throw new TypeError('routing conflict: providers.dualRouting differs from routing.routes');
+      }
+    }
+    routing = structuredClone(existing);
+  } else {
+    routing = {
+      version: ROUTING_SCHEMA_VERSION,
+      primaryHost: hasLegacyPrimary ? structuredClone(providers.primaryHost) : DEFAULT_PRIMARY_HOST,
+      routes: hasLegacyRoutes ? legacyRoutesToCanonical(providers.dualRouting) : {},
+    };
+    validateRoutingEnvelope(routing);
+  }
+
+  out.routing = routing;
+  if (plain(out.providers)) {
+    delete out.providers.primaryHost;
+    delete out.providers.dualRouting;
+  }
+  return immutable(out);
+}
+
+/** Validated read API for routing consumers. */
+export function routingIntent(config = {}) {
+  return immutable(structuredClone(validateRoutingEnvelope(config.routing)));
+}
diff --git a/src/lib/routing.mjs b/src/lib/routing.mjs
index 2ea8749..ecd8e76 100644
--- a/src/lib/routing.mjs
+++ b/src/lib/routing.mjs
@@ -1,8 +1,8 @@
-// Dual-host per-activity LLM routing — the pure policy core (ADR-0001..0005).
+// Host-neutral per-activity LLM routing — the pure policy core (ADR-0001..0006).
 //
-// One policy (kit.json `providers.dualRouting`) is the single source of truth for
+// One policy (kit.json `routing.routes`) is the single source of truth for
 // "which host + model runs which activity", and is PROJECTED into downstream
-// artifacts (aqe agentOverrides, dual-run config, codex MCP). This module is pure
+// artifacts (aqe agentOverrides, host-neutral run plans, codex MCP). This module is pure
 // (no I/O) so the projectors and defaults are unit-testable in isolation; the
 // writers/UX that consume it live in providers.mjs / the commands.
 import { vendorOf } from './qeCourt.mjs';
@@ -39,7 +39,7 @@ export const AQE_CONSTRUCTIBLE_PROVIDERS = [
 export const SUBSCRIPTION_PROVIDERS = new Set(['claude-code', 'codex', 'ollama', 'onnx']);
 
 // ── Model catalog ────────────────────────────────────────────────────────────
-// Known-good model choices per host, surfaced as help in `ak x provider pick`,
+// Known-good model choices per host, surfaced as help in `ak x host pick`,
 // `--help`, and docs/PROVIDERS.md. NOT a hard allow-list: any model your host CLI
 // accepts also works — these are ak's curated picks. Web-verified on the date
 // below; model lines move fast, so re-check and let users override (ADR-0002/0003).
@@ -133,12 +133,12 @@ export function swapHostModel(host, model) {
 }
 
 /** Mirror a route to the opposite host (host + model + escalation ladder). Pure.
- *  @param {{host: string, model?: string, escalate?: Array<{host: string, model?: string}>}} route */
+ *  @param {{host: string, model?: string, escalation?: Array<{host: string, model?: string}>}} route */
 export function swapRoute(route) {
   const { host, model } = swapHostModel(route.host, route.model);
-  /** @type {{host: string, model?: string, escalate?: Array<{host: string, model?: string}>}} */
+  /** @type {{host: string, model?: string, escalation?: Array<{host: string, model?: string}>}} */
   const out = { host, ...(model ? { model } : {}) };
-  if (route.escalate?.length) out.escalate = route.escalate.map((e) => swapHostModel(e.host, e.model));
+  if (route.escalation?.length) out.escalation = route.escalation.map((e) => swapHostModel(e.host, e.model));
   return out;
 }
 
@@ -147,7 +147,7 @@ export function swapRoute(route) {
 // coder/tester→codex, reviewer→claude, securityAudit scanner/fixer→codex,
 // analyzer→claude. packaging/release are ak-originated gap-fills. Model IDs are
 // soft defaults, web-verified (see MODEL_CATALOG_VERIFIED); users override freely.
-const R = (host, model, escalate) => ({ host, model, ...(escalate ? { escalate } : {}) });
+const R = (host, model, escalation) => ({ host, model, ...(escalation ? { escalation } : {}) });
 export const DEFAULT_ROUTES = {
   specification:       R('claude', 'claude-sonnet-5'),
   architecture:        R('claude', 'claude-opus-5'),
@@ -164,7 +164,7 @@ export const DEFAULT_ROUTES = {
 };
 
 // Curated aqe agent-type → activity map for the agentOverrides projection.
-// Only the QE-relevant activities have aqe agents; the rest are dual-run roles.
+// Only the QE-relevant activities have aqe agents; the rest are pipeline roles.
 export const AGENT_ACTIVITY_MAP = {
   'qe-security-scanner': 'security-scan',
   'qe-security-auditor': 'security-scan',
@@ -189,15 +189,16 @@ export function isRoutableHost(host) {
 
 /**
  * Effective routes = DEFAULT_ROUTES overlaid with the persisted policy, each
- * carrying provenance. A persisted entry defaults its `source` to 'user' (a hand
- * edit is intent); `seedDualRouting` stamps 'seeded'; an unset activity is 'default'.
+ * carrying provenance. A persisted entry defaults its `provenance` to 'user' (a
+ * hand edit is intent); `seedActivityRoutes` stamps 'seeded'; an unset activity
+ * is 'default'.
  */
 export function resolveRoutes(policy = {}) {
   const out = {};
   for (const act of ACTIVITIES) {
     const def = DEFAULT_ROUTES[act];
     const p = policy[act];
-    if (!p) { out[act] = { ...def, source: 'default', akOriginated: AK_ORIGINATED.has(act) }; continue; }
+    if (!p) { out[act] = { ...def, provenance: 'default', akOriginated: AK_ORIGINATED.has(act) }; continue; }
     out[act] = {
       host: p.host ?? def.host,
       // A host-only override must NOT inherit the previous host's default
@@ -206,8 +207,10 @@ export function resolveRoutes(policy = {}) {
       // default only falls forward for the SAME host; a cross-host override
       // leaves the model to the adapter's own default (null).
       model: p.model ?? (p.host && p.host !== def.host ? null : def.model),
-      ...((p.escalate ?? def.escalate) ? { escalate: p.escalate ?? def.escalate } : {}),
-      source: p.source ?? 'user',
+      ...((p.escalation ?? def.escalation)
+        ? { escalation: p.escalation ?? def.escalation }
+        : {}),
+      provenance: p.provenance ?? 'user',
       akOriginated: AK_ORIGINATED.has(act),
     };
   }
@@ -220,10 +223,10 @@ export function resolveRoutes(policy = {}) {
  * only for the hosts the caller passes as usable. When `primary` is 'codex', each
  * default route is mirrored to the opposite host (swapRoute) so codex leads and
  * claude is the alternate. Gating on enablement + aqe version is the caller's job
- * (seedDualRoutingIfDualHost); this does NOT verify the host CLI is installed.
- * Returns entries stamped `source: 'seeded'`.
+ * (seedActivityRoutesIfMultiHost); this does NOT verify the host CLI is installed.
+ * Returns entries stamped `provenance: 'seeded'`.
  */
-export function seedDualRouting({ hosts = HOSTS, primary = DEFAULT_PRIMARY_HOST } = {}) {
+export function seedActivityRoutes({ hosts = HOSTS, primary = DEFAULT_PRIMARY_HOST } = {}) {
   const usable = new Set(hosts);
   const swap = primary === 'codex';
   const policy = {};
@@ -233,8 +236,8 @@ export function seedDualRouting({ hosts = HOSTS, primary = DEFAULT_PRIMARY_HOST
     if (!SUBSCRIPTION_PROVIDERS.has(HOST_PROVIDER[def.host])) continue;
     policy[act] = {
       host: def.host, model: def.model,
-      ...(def.escalate ? { escalate: def.escalate } : {}),
-      source: 'seeded',
+      ...(def.escalation ? { escalation: def.escalation } : {}),
+      provenance: 'seeded',
     };
   }
   return policy;
@@ -265,7 +268,7 @@ function currentSeedFor(act, entry = {}) {
  * ak chose these values, the defaults have since moved, and nothing re-seeds them.
  * Pure.
  *
- * Only `source === 'seeded'` entries are reported: a 'user' pin is deliberate
+ * Only `provenance === 'seeded'` entries are reported: a 'user' pin is deliberate
  * intent and is never divergence.
  *
  * Which side is better is activity-dependent (a newer default can cost 2-3× the
@@ -276,20 +279,20 @@ export function divergedRoutes(policy = {}) {
   const out = [];
   for (const act of ACTIVITIES) {
     const p = policy[act];
-    if (!p || p.source !== 'seeded') continue;
+    if (!p || p.provenance !== 'seeded') continue;
     const want = currentSeedFor(act, p);
     if (!want) continue;
     const modelDiverged = !!(want.model && p.model && p.model !== want.model);
     // An escalation rung is a routing decision too, and it diverges on its own
     // schedule: a seed whose primary model never moved can still escalate into a
     // model the defaults have since replaced.
-    const escalate = (p.escalate ?? []).map((rung, i) => {
-      const wantRung = want.escalate?.[i];
+    const escalation = (p.escalation ?? []).map((rung, i) => {
+      const wantRung = want.escalation?.[i];
       return wantRung && rung.model !== wantRung.model
         ? { host: rung.host, model: rung.model, defaultModel: wantRung.model }
         : null;
     }).filter(Boolean);
-    if (!modelDiverged && escalate.length === 0) continue;
+    if (!modelDiverged && escalation.length === 0) continue;
     out.push({
       activity: act,
       host: p.host ?? want.host,
@@ -297,7 +300,7 @@ export function divergedRoutes(policy = {}) {
       defaultHost: want.host,
       defaultModel: want.model,
       modelDiverged,
-      escalate,
+      escalation,
       defaultNote: modelNote(want.model),
       currentNote: modelNote(p.model),
     });
@@ -307,7 +310,7 @@ export function divergedRoutes(policy = {}) {
 
 /**
  * Re-seed the named activities from the current defaults, returning a NEW policy.
- * Only `source === 'seeded'` entries are eligible — a user pin survives untouched
+ * Only `provenance === 'seeded'` entries are eligible — a user pin survives untouched
  * even when named. `activities` defaults to every diverged activity. Pure.
  * @param {Record<string, any>} [policy]
  * @param {{ activities?: string[] }} [opts]
@@ -322,8 +325,8 @@ export function refreshSeededRoutes(policy = {}, { activities } = {}) {
     out[act] = {
       host: seed.host,
       model: seed.model,
-      ...(seed.escalate ? { escalate: seed.escalate } : {}),
-      source: 'seeded',
+      ...(seed.escalation ? { escalation: seed.escalation } : {}),
+      provenance: 'seeded',
     };
   }
   return out;
@@ -371,31 +374,30 @@ export function pruneRoutesForHosts(policy = {}, { hosts = HOSTS } = {}) {
   const warnings = [];
   const pruned = [];
   for (const [activity, route] of Object.entries(policy)) {
-    const source = route?.source ?? 'user';
+    const provenance = route?.provenance ?? 'user';
     if (!enabled.has(route?.host)) {
-      pruned.push({ activity, kind: 'route', host: route?.host ?? null, source });
-      if (source !== 'seeded') warnings.push(`removed user route '${activity}' — host '${route?.host ?? 'unknown'}' is disabled`);
+      pruned.push({ activity, kind: 'route', host: route?.host ?? null, provenance });
+      if (provenance !== 'seeded') warnings.push(`removed user route '${activity}' — host '${route?.host ?? 'unknown'}' is disabled`);
       continue;
     }
-    const before = Array.isArray(route.escalate) ? route.escalate : [];
-    const escalate = before.filter((rung) => enabled.has(rung?.host));
+    const before = Array.isArray(route.escalation) ? route.escalation : [];
+    const escalation = before.filter((rung) => enabled.has(rung?.host));
     const removed = before.filter((rung) => !enabled.has(rung?.host));
     for (const rung of removed) {
-      pruned.push({ activity, kind: 'escalation', host: rung?.host ?? null, source });
-      if (source !== 'seeded') warnings.push(`removed user escalation for '${activity}' — host '${rung?.host ?? 'unknown'}' is disabled`);
+      pruned.push({ activity, kind: 'escalation', host: rung?.host ?? null, provenance });
+      if (provenance !== 'seeded') warnings.push(`removed user escalation for '${activity}' — host '${rung?.host ?? 'unknown'}' is disabled`);
     }
-    next[activity] = { ...route, ...(escalate.length ? { escalate } : {}) };
-    if (removed.length && !escalate.length) delete next[activity].escalate;
+    next[activity] = { ...route, ...(escalation.length ? { escalation } : {}) };
+    if (removed.length && !escalation.length) delete next[activity].escalation;
   }
   return { policy: next, pruned, warnings };
 }
 
-// ── Projection #2: dual-run collaboration config ────────────────────────────
+// ── Host-neutral run templates ──────────────────────────────────────────────
 // A template is an ordered DAG of activities; the policy fills host+model per
 // node. Grounded in rUv's CollaborationTemplates (feature/security/refactor);
-// packaging/release are ak-added (ADR-0002). Consumed by `claude-flow-codex dual
-// run --config` (each node → a worker {id, platform, role, model, prompt, dependsOn}).
-export const DUAL_RUN_TEMPLATES = {
+// packaging/release are ak-added (ADR-0002).
+export const RUN_TEMPLATES = {
   feature: [
     { id: 'architect', role: 'architect', activity: 'architecture', maxTurns: 10, prompt: (t) => `Design the architecture for: ${t}. Define components, interfaces, and data flow.` },
     { id: 'coder', role: 'coder', activity: 'implementation', dependsOn: ['architect'], maxTurns: 15, prompt: (t) => `Implement "${t}" from the architecture. Write clean, typed code.` },
@@ -422,16 +424,16 @@ export const DUAL_RUN_TEMPLATES = {
     { id: 'reviewer', role: 'reviewer', activity: 'review', dependsOn: ['preparer'], maxTurns: 6, prompt: () => 'Review the release plan for correctness and completeness.' },
   ],
 };
-export const DUAL_RUN_TEMPLATE_NAMES = Object.keys(DUAL_RUN_TEMPLATES);
+export const RUN_TEMPLATE_NAMES = Object.keys(RUN_TEMPLATES);
 
 /**
- * Projection #2 → `claude-flow-codex dual run --config` JSON. Each template node
- * becomes a worker whose platform + model come from the policy's effective route
- * for that node's activity. Throws on an unknown template.
+ * Build a host-neutral execution plan. Each template node becomes a worker whose
+ * host + model come from the policy's effective route for that node's activity.
+ * Throws on an unknown template.
  */
 export function materializeRunPlan(policy = {}, { template = 'feature', task = '' } = {}) {
-  const nodes = DUAL_RUN_TEMPLATES[template];
-  if (!nodes) throw new Error(`unknown template "${template}" (expected: ${DUAL_RUN_TEMPLATE_NAMES.join(', ')})`);
+  const nodes = RUN_TEMPLATES[template];
+  if (!nodes) throw new Error(`unknown template "${template}" (expected: ${RUN_TEMPLATE_NAMES.join(', ')})`);
   const routes = resolveRoutes(policy);
   return {
     template,
@@ -445,7 +447,7 @@ export function materializeRunPlan(policy = {}, { template = 'feature', task = '
     // rungs are dropped here (escalating to the same host+model would re-run
     // the identical attempt — the legacy L4 rule), and every rung must be a
     // routable host or materialization fails the same way the primary does.
-    const ladder = (r.escalate ?? [])
+    const ladder = (r.escalation ?? [])
       .filter((rung) => rung && (rung.host !== r.host || (rung.model ?? null) !== (r.model ?? null)))
       .map((rung) => {
         const rungEligibility = validateActivityHost(rung.host);
@@ -469,48 +471,6 @@ export function materializeRunPlan(policy = {}, { template = 'feature', task = '
   };
 }
 
-/**
- * Compatibility projection to `claude-flow-codex dual run --config`. It deliberately
- * remains Claude/Codex-specific while the generalized runner is introduced.
- */
-export function policyToDualRunConfig(policy = {}, opts = {}) {
-  const plan = materializeRunPlan(policy, opts);
-  const unsupported = plan.workers.filter((worker) => !['claude', 'codex'].includes(worker.host));
-  if (unsupported.length) {
-    throw new Error(`ak dual supports Claude/Codex workers only; use ak run for ${[...new Set(unsupported.map((worker) => worker.host))].join(', ')}`);
-  }
-  return {
-    workers: plan.workers.map((worker) => ({
-      id: worker.id,
-      platform: worker.host,
-      role: worker.role,
-      model: worker.configuredModel ?? undefined,
-      prompt: worker.prompt,
-      ...(worker.dependsOn ? { dependsOn: worker.dependsOn } : {}),
-      ...(worker.maxTurns ? { maxTurns: worker.maxTurns } : {}),
-    })),
-  };
-}
-
-/**
- * One escalation step (ADR-0004): a partial policy that bumps every activity with
- * an escalation ladder to its next rung (host+model). Overlay it onto the policy
- * and re-project to retry a failed dual-run on a different (cross-vendor) rung.
- */
-export function escalatePolicy(policy = {}) {
-  const routes = resolveRoutes(policy);
-  const next = {};
-  for (const [act, r] of Object.entries(routes)) {
-    const rung = r.escalate?.[0];
-    // skip a rung that equals the current host+model — a user override can retain
-    // the default ladder, so escalating there would just re-run the same thing (L4).
-    if (rung && (rung.host !== r.host || rung.model !== r.model)) {
-      next[act] = { host: rung.host, model: rung.model, source: 'user' };
-    }
-  }
-  return next;
-}
-
 /**
  * Distinct vendors across the routed activities, via qe-court's classifier.
  * ≥2 = cross-vendor coverage (the qe-court diversity property; ADR-0004).
@@ -531,8 +491,8 @@ export function routingSummary(policy = {}) {
   for (const r of routes) byHost[r.host] = (byHost[r.host] ?? 0) + 1;
   return {
     total: routes.length,
-    seeded: routes.filter((r) => r.source === 'seeded').length,
-    custom: routes.filter((r) => r.source === 'user').length,
+    seeded: routes.filter((r) => r.provenance === 'seeded').length,
+    custom: routes.filter((r) => r.provenance === 'user').length,
     byHost,
     vendors: routedVendors(policy).size,
   };
@@ -554,7 +514,7 @@ export function validateRoute(route = {}) {
 
 /**
  * Parse a repeatable `--route "activity:host[:model]"` CLI spec into a partial
- * policy (source:'user'). Sibling to provider.mjs's parseFallback. Unknown
+ * policy (`provenance:'user'`). Sibling to provider.mjs's parseFallback. Unknown
  * activities/hosts are collected as warnings, not thrown.
  */
 export function parseRouteSpecs(specs = []) {
@@ -568,7 +528,7 @@ export function parseRouteSpecs(specs = []) {
     if (!ACTIVITIES.includes(activity)) { warnings.push(`unknown activity "${activity}" — ignored`); continue; }
     const errs = validateRoute({ host, model });
     if (errs.length) { warnings.push(`route "${spec}": ${errs.join('; ')} — ignored`); continue; }
-    policy[activity] = { host, ...(model ? { model } : {}), source: 'user' };
+    policy[activity] = { host, ...(model ? { model } : {}), provenance: 'user' };
   }
   return { policy, warnings };
 }
diff --git a/src/lib/usage-index.mjs b/src/lib/usage-index.mjs
index 71bc119..376f847 100644
--- a/src/lib/usage-index.mjs
+++ b/src/lib/usage-index.mjs
@@ -932,7 +932,6 @@ function aggregate(records, { days, now, cutoff, deps }) {
       id: rec.id, host: rec.host ?? rec.provider,
       provider: rec.inferenceProvider ?? null,
       transcriptProvider: rec.provider,
-      inferenceProvider: rec.inferenceProvider ?? null, // compatibility alias
       providerProvenance: rec.providerProvenance ?? 'unknown',
       title: rec.title, project: rec.project,
       worktree: rec.worktree ?? null,
@@ -1050,7 +1049,6 @@ function aggregate(records, { days, now, cutoff, deps }) {
     windowDays: days,
     pricesAsOf: deps.pricesAsOf ?? null,
     totals, byDay, byModel, byHost, byProvider,
-    byTranscriptProvider: byHost, // compatibility alias for the historical map
     byProject, byCategory,
     punchcard, projectTree, sessions, codexRateLimits, insights: [],
   };
@@ -1376,7 +1374,6 @@ function sessionPayload(rec, turns, deps) {
       id: rec.id, host: rec.host ?? rec.provider,
       provider: rec.inferenceProvider ?? null,
       transcriptProvider: rec.provider,
-      inferenceProvider: rec.inferenceProvider ?? null, // compatibility alias
       providerProvenance: rec.providerProvenance ?? 'unknown',
       title: rec.title, project: rec.project,
       worktree: rec.worktree ?? null,
diff --git a/tests/dashboard.test.cjs b/tests/dashboard.test.cjs
index 86988ca..1d0c75e 100644
--- a/tests/dashboard.test.cjs
+++ b/tests/dashboard.test.cjs
@@ -436,10 +436,6 @@ async function main() {
       anthropic: { cost: 10, sessions: 1, tokens: 1000 },
       unknown: { cost: null, sessions: 1, tokens: 250 },
     },
-    byTranscriptProvider: {
-      claude: { cost: 10, sessions: 1, tokens: 1000 },
-      codex: { cost: 2.5, sessions: 1, tokens: 250 },
-    },
     byProject: { demo: { cost: 12.5, sessions: 2 } },
     byCategory: { 'Security review': { cost: 12.5, sessions: 2, confidence: 0.8 } },
     punchcard: { '0-13': 4 },
@@ -657,9 +653,9 @@ async function main() {
 
     await test('Usage rendering treats host and inference provider as independent axes', async () => {
       const r = await get(uiSrv.url);
-      contains(r.body, 'd.byHost||d.byTranscriptProvider||d.byProvider');
-      contains(r.body, 'var host=sx.host||sx.transcriptProvider');
-      contains(r.body, 'var provider=sx.provider||sx.inferenceProvider||"unknown"');
+      contains(r.body, 'var prov=d.byHost||{}');
+      contains(r.body, 'var host=sx.host||"unknown"');
+      contains(r.body, 'var provider=sx.provider||"unknown"');
       contains(r.body, 'title="host: ');
       contains(r.body, 'class="s-provider"');
     });
diff --git a/tests/kit/capability-derived.test.mjs b/tests/kit/capability-derived.test.mjs
index 671960c..8c656ec 100644
--- a/tests/kit/capability-derived.test.mjs
+++ b/tests/kit/capability-derived.test.mjs
@@ -3,16 +3,9 @@ import assert from 'node:assert/strict';
 import {
   hostsWithCapability,
   providersWithCapability,
-  deriveCompatibilityExports,
   validatePrimaryHost,
   validateActivityHost,
 } from '../../src/lib/adapters/index.mjs';
-import { HOSTS as LEGACY_PROVIDER_HOSTS, API_PROVIDERS } from '../../src/lib/providers.mjs';
-import {
-  HOSTS as LEGACY_ROUTING_HOSTS,
-  PRIMARY_HOSTS,
-  isRoutableHost,
-} from '../../src/lib/routing.mjs';
 import { validHost, validProvider } from './helpers/integration-builders.mjs';
 
 const hosts = [
@@ -69,20 +62,3 @@ test('provider selectors add a future provider without adding a host', () => {
     ['future-provider']);
   assert.equal(hosts.some(({ id }) => id === 'future-provider'), false);
 });
-
-test('compatibility exports are derived views of registries', () => {
-  const compatibility = deriveCompatibilityExports({ hosts, providers });
-  assert.deepEqual(compatibility.hostIds, ['claude', 'codex', 'future-host']);
-  assert.deepEqual(compatibility.primaryHostIds, ['claude', 'codex']);
-  assert.deepEqual(compatibility.routableHostIds, ['claude', 'codex']);
-  assert.deepEqual(compatibility.apiProviderIds, ['anthropic', 'openai', 'future-provider']);
-});
-
-test('current compatibility exports remain aligned with built-in registry views', () => {
-  const compatibility = deriveCompatibilityExports();
-  assert.deepEqual(LEGACY_ROUTING_HOSTS, compatibility.routableHostIds);
-  assert.deepEqual(PRIMARY_HOSTS, compatibility.primaryHostIds);
-  assert.deepEqual(LEGACY_PROVIDER_HOSTS.map(({ id }) => id), compatibility.managedHostIds);
-  assert.deepEqual(API_PROVIDERS.map(({ id }) => id), compatibility.apiProviderIds);
-  for (const id of compatibility.routableHostIds) assert.equal(isRoutableHost(id), true);
-});
diff --git a/tests/kit/cli-help.test.mjs b/tests/kit/cli-help.test.mjs
index f9e4903..9746ccc 100644
--- a/tests/kit/cli-help.test.mjs
+++ b/tests/kit/cli-help.test.mjs
@@ -30,8 +30,8 @@ test('mutating commands intercept both --help and -h before running', () => {
 });
 
 test('every command exposes an Examples section in its help', () => {
-  for (const cmd of [['setup'], ['status'], ['sync'], ['usage'], ['run'], ['dual'], ['dashboard'], ['uninstall'],
-    ['host'], ['provider'], ['x', 'mcp'], ['x', 'host'], ['x', 'provider'],
+  for (const cmd of [['setup'], ['status'], ['sync'], ['usage'], ['run'], ['dashboard'], ['uninstall'],
+    ['host'], ['x', 'mcp'], ['x', 'host'],
     ['x', 'verify'], ['x', 'reference'], ['x', 'daemon-gc']]) {
     const r = ak(...cmd, '--help');
     assert.equal(r.status, 0, `${cmd.join(' ')} exit`);
@@ -64,3 +64,15 @@ test('unknown plumbing command exits 2 and prints the plumbing index', () => {
   assert.equal(r.status, 2);
   assert.match(r.stdout, /unknown plumbing command: bogus/);
 });
+
+test('removed dual/provider commands exit 2 and are omitted from help', () => {
+  for (const args of [['dual'], ['provider'], ['x', 'provider']]) {
+    const r = ak(...args);
+    assert.equal(r.status, 2, `${args.join(' ')} exit`);
+    assert.match(r.stdout, args[0] === 'x' ? /unknown plumbing command: provider/ : /unknown command:/);
+  }
+  const top = ak('--help');
+  assert.doesNotMatch(top.stdout, /^\s+ak (?:dual|provider)\s+/m);
+  const all = ak('--help', '--all');
+  assert.doesNotMatch(all.stdout, /^\s+ak x provider\s+/m);
+});
diff --git a/tests/kit/codex-mcp.test.mjs b/tests/kit/codex-mcp.test.mjs
index eb44993..afe6fd9 100644
--- a/tests/kit/codex-mcp.test.mjs
+++ b/tests/kit/codex-mcp.test.mjs
@@ -43,8 +43,8 @@ test('owned reflects the kit.json ak-ownership marker', () => {
   const dir = tmpProject();
   try {
     writeMcp(dir, { codex: {} });
-    assert.equal(codexMcpStatus({ providers: { codexMcp: 'ak' } }, dir).owned, true);
-    assert.equal(codexMcpStatus({ providers: { codexMcp: null } }, dir).owned, false);
+    assert.equal(codexMcpStatus({ integrations: { ownership: { codex: { mcp: 'ak' } } } }, dir).owned, true);
+    assert.equal(codexMcpStatus({ integrations: { ownership: { codex: { mcp: null } } } }, dir).owned, false);
     assert.equal(codexMcpStatus({}, dir).owned, false);
   } finally { rm(dir); }
 });
@@ -53,7 +53,7 @@ test('a pre-existing (unowned) codex server is registered but not owned', () =>
   const dir = tmpProject();
   try {
     writeMcp(dir, { codex: {} });
-    assert.deepEqual(codexMcpStatus({ providers: { codexMcp: null } }, dir),
+    assert.deepEqual(codexMcpStatus({ integrations: { ownership: { codex: { mcp: null } } } }, dir),
       { registered: true, owned: false });
   } finally { rm(dir); }
 });
diff --git a/tests/kit/dashboard-integration-identity.test.mjs b/tests/kit/dashboard-integration-identity.test.mjs
index 76c8ec7..e911c75 100644
--- a/tests/kit/dashboard-integration-identity.test.mjs
+++ b/tests/kit/dashboard-integration-identity.test.mjs
@@ -4,13 +4,13 @@ import { routingPayload } from '../../src/lib/dashboard-server.mjs';
 
 test('dashboard routing describes host assignment without manufacturing a provider', () => {
   const payload = routingPayload({
-    providers: {
+    routing: {
       primaryHost: 'claude',
-      dualRouting: {
+      routes: {
         implementation: {
           host: 'codex',
           model: 'gpt-5.4',
-          source: 'user',
+          provenance: 'user',
         },
       },
     },
@@ -20,9 +20,9 @@ test('dashboard routing describes host assignment without manufacturing a provid
     activity: 'implementation',
     host: 'codex',
     model: 'gpt-5.4',
-    source: 'user',
+    provenance: 'user',
     akOriginated: false,
-    escalate: ['claude'],
+    escalation: ['claude'],
   });
   assert.equal(Object.hasOwn(route, 'provider'), false);
 });
diff --git a/tests/kit/dashboard-live-source.test.mjs b/tests/kit/dashboard-live-source.test.mjs
index e291b29..062d520 100644
--- a/tests/kit/dashboard-live-source.test.mjs
+++ b/tests/kit/dashboard-live-source.test.mjs
@@ -8,16 +8,14 @@ test('dashboard parses repeatable explicit structured live sources', () => {
   assert.deepEqual(parseLiveSources([
     'ruflo=.claude-flow/live.jsonl',
     'aqe=/tmp/aqe.jsonl',
-    'dual-run=plans/run.jsonl',
   ], cwd), [
     { surface: 'ruflo', file: path.resolve(cwd, '.claude-flow/live.jsonl') },
     { surface: 'aqe', file: path.resolve('/tmp/aqe.jsonl') },
-    { surface: 'dual-run', file: path.resolve(cwd, 'plans/run.jsonl') },
   ]);
 });
 
 test('dashboard rejects ambiguous or unsupported live-source specifications', () => {
-  for (const value of ['ruflo', 'plugin=events.jsonl', 'aqe=', '=events.jsonl']) {
+  for (const value of ['ruflo', 'plugin=events.jsonl', 'dual-run=plans.jsonl', 'aqe=', '=events.jsonl']) {
     assert.throws(() => parseLiveSources(value, '/tmp'), /invalid --live-source/);
   }
 });
diff --git a/tests/kit/dispatch-surface.test.mjs b/tests/kit/dispatch-surface.test.mjs
index 8e93ede..6e3fce4 100644
--- a/tests/kit/dispatch-surface.test.mjs
+++ b/tests/kit/dispatch-surface.test.mjs
@@ -34,15 +34,15 @@ function dispatchTable() {
   return cmds;
 }
 
-test('dispatch table parses and covers the previously-omitted commands', () => {
+test('dispatch table exposes canonical commands and omits removed aliases', () => {
   // Arrange
   const table = dispatchTable();
   // Act / Assert
   assert.ok(table.size >= 6, `expected several commands, parsed ${table.size}`);
-  assert.ok(table.has('dual'), 'dual must be in the dispatch table');
   assert.ok(table.has('dashboard'), 'dashboard must be in the dispatch table');
   assert.ok(table.has('host'), 'canonical host management must be in the dispatch table');
-  assert.ok(table.has('provider'), 'deprecated provider shim must remain in the dispatch table');
+  assert.equal(table.has('dual'), false, 'removed dual command must stay absent');
+  assert.equal(table.has('provider'), false, 'removed provider aliases must stay absent');
 });
 
 // One test per command: loads, and exposes a complete help surface.
diff --git a/tests/kit/dual-cli.test.mjs b/tests/kit/dual-cli.test.mjs
deleted file mode 100644
index 4e97d29..0000000
--- a/tests/kit/dual-cli.test.mjs
+++ /dev/null
@@ -1,89 +0,0 @@
-// ak dual — CLI spawn tests for the dual-run wrapper (dry-run only; no live swarm).
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { seedDualRouting, policyToDualRunConfig } from '../../src/lib/routing.mjs';
-import { writeConfigModule } from '../../src/commands/dual.mjs';
-
-const BIN = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../bin/agentic-kit.mjs');
-
-function sandbox({ dualRouting }) {
-  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'kit-dual-home-'));
-  const cfgDir = path.join(home, '.config', 'agentic-kit');
-  fs.mkdirSync(cfgDir, { recursive: true });
-  const last = Date.now();
-  fs.writeFileSync(path.join(cfgDir, 'kit.json'),
-    JSON.stringify({
-      providers: { hosts: { claude: true, codex: true }, dualRouting },
-      // Real CLI spawns must not turn an isolated unit test into an npm network probe.
-      versionCheck: { last, seen: {}, self: { last, best: null } },
-    }));
-  const project = fs.mkdtempSync(path.join(os.tmpdir(), 'kit-dual-proj-'));
-  fs.mkdirSync(path.join(project, '.git'));
-  return { home, project };
-}
-
-function ak(args, { cwd, home }) {
-  const cfgDir = path.join(home, '.config');
-  return spawnSync(process.execPath, [BIN, ...args], {
-    encoding: 'utf8',
-    cwd,
-    // POSIX + Windows env isolation (see provider-cli.test.mjs lesson).
-    env: { ...process.env, NO_COLOR: '1', HOME: home, USERPROFILE: home, XDG_CONFIG_HOME: cfgDir, APPDATA: cfgDir },
-  });
-}
-const rm = (d) => fs.rmSync(d, { recursive: true, force: true });
-
-test('ak dual run --dry-run materializes the feature pipeline from the policy', () => {
-  const { home, project } = sandbox({ dualRouting: seedDualRouting() });
-  const r = ak(['dual', 'run', 'feature', 'add auth', '--dry-run'], { cwd: project, home });
-  assert.equal(r.status, 0, r.stderr);
-  assert.match(r.stdout, /dual run: feature/);
-  assert.match(r.stderr, /ak dual is deprecated/i);
-  assert.match(r.stderr, /use `ak run`/i);
-  assert.match(r.stdout, /"platform": "claude"/);
-  assert.match(r.stdout, /"platform": "codex"/);
-  assert.match(r.stdout, /add auth/);
-  rm(home); rm(project);
-});
-
-test('ak dual run fails clearly when no routing policy is configured', () => {
-  const { home, project } = sandbox({ dualRouting: {} });
-  const r = ak(['dual', 'run', 'feature', 'x'], { cwd: project, home });
-  assert.notEqual(r.status, 0);
-  assert.match(r.stdout + r.stderr, /no per-activity routing configured/);
-  rm(home); rm(project);
-});
-
-test('ak dual run rejects an unknown template', () => {
-  const { home, project } = sandbox({ dualRouting: seedDualRouting() });
-  const r = ak(['dual', 'run', 'nope', 'x', '--dry-run'], { cwd: project, home });
-  assert.notEqual(r.status, 0);
-  assert.match(r.stdout + r.stderr, /unknown template/);
-  rm(home); rm(project);
-});
-
-test('materialized --config is an importable module exporting workers (adapter contract)', async () => {
-  // The adapter loads --config via `await import()` and reads `.workers`, so a
-  // plain .json path fails. Guard that we emit an import-loadable module.
-  const config = policyToDualRunConfig(seedDualRouting(), { template: 'feature', task: 'x' });
-  const url = writeConfigModule(config, 'x');
-  assert.match(url, /^file:\/\/.*\.mjs$/);
-  const mod = await import(url);
-  assert.ok(Array.isArray(mod.workers), 'workers export is an array');
-  assert.equal(mod.workers.length, config.workers.length);
-  assert.ok(mod.workers.every((w) => w.platform === 'claude' || w.platform === 'codex'));
-});
-
-test('ak dual templates lists the pipelines', () => {
-  const { home, project } = sandbox({ dualRouting: {} });
-  const r = ak(['dual', 'templates'], { cwd: project, home });
-  assert.equal(r.status, 0, r.stderr);
-  assert.match(r.stdout, /feature/);
-  assert.match(r.stdout, /security/);
-  rm(home); rm(project);
-});
diff --git a/tests/kit/dual-preflight.test.mjs b/tests/kit/dual-preflight.test.mjs
deleted file mode 100644
index 18501e0..0000000
--- a/tests/kit/dual-preflight.test.mjs
+++ /dev/null
@@ -1,44 +0,0 @@
-// #45 defect 2 pre-flight: ak dual run must refuse BEFORE spawning a worker when
-// the ruflo memory runtime is WASM-only AND the target DB has an active native WAL
-// (`-wal`/`-shm` sidecars). Unit-tests the pure predicate with an injected
-// existsSync + a supplied runtime probe — no spawn, no global tree.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { nativeWalConflict } from '../../src/commands/dual.mjs';
-
-const WASM_ONLY = { installed: true, contexts: [{ context: 'cli', ok: false }, { context: 'memory', ok: true }] };
-const ALL_NATIVE = { installed: true, contexts: [{ context: 'cli', ok: true }, { context: 'memory', ok: true }] };
-const NOT_INSTALLED = { installed: false, contexts: [] };
-
-const sidecarPresent = (f) => f.endsWith('-wal') || f.endsWith('-shm');
-const noSidecar = () => false;
-
-test('refuses when the runtime is WASM-only AND a WAL sidecar is present', () => {
-  const c = nativeWalConflict('/proj/.swarm/memory.db', { runtime: WASM_ONLY, existsSync: sidecarPresent });
-  assert.equal(c.refuse, true);
-  assert.equal(c.wasmOnly, true);
-  assert.equal(c.sidecar, true);
-});
-
-test('proceeds when the runtime is native even with a live WAL', () => {
-  const c = nativeWalConflict('/proj/.swarm/memory.db', { runtime: ALL_NATIVE, existsSync: sidecarPresent });
-  assert.equal(c.refuse, false, 'native writer + native store is safe');
-});
-
-test('proceeds when there are no sidecars even on a WASM-only runtime', () => {
-  const c = nativeWalConflict('/proj/.swarm/memory.db', { runtime: WASM_ONLY, existsSync: noSidecar });
-  assert.equal(c.refuse, false, 'no active WAL → nothing to conflict with');
-});
-
-test('proceeds when ruflo is not installed at all', () => {
-  const c = nativeWalConflict('/proj/.swarm/memory.db', { runtime: NOT_INSTALLED, existsSync: sidecarPresent });
-  assert.equal(c.refuse, false);
-});
-
-test('a stale zero-length sidecar still counts as active (EC-6, presence not size)', () => {
-  // existsSync-based on purpose: false-refusal costs one `ak sync`, false-pass
-  // corrupts the DB. A -shm alone is enough.
-  const onlyShm = (f) => f.endsWith('-shm');
-  const c = nativeWalConflict('/proj/.swarm/memory.db', { runtime: WASM_ONLY, existsSync: onlyShm });
-  assert.equal(c.refuse, true);
-});
diff --git a/tests/kit/ga-surface-guard.test.mjs b/tests/kit/ga-surface-guard.test.mjs
new file mode 100644
index 0000000..7f60b34
--- /dev/null
+++ b/tests/kit/ga-surface-guard.test.mjs
@@ -0,0 +1,245 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+const UPGRADE = path.join(ROOT, 'docs', 'UPGRADING.md');
+const MIGRATION_HEADING = '## 4.0 GA surface migration';
+
+const retired = [
+  {
+    label: 'removed command or alias',
+    pattern: /\bak(?:\s+x)?\s+(?:dual|provider)\b/gi,
+  },
+  {
+    label: 'removed routing configuration name',
+    pattern: /\b(?:providers\.)?dualRouting\b/g,
+  },
+  {
+    label: 'removed persisted integration field',
+    pattern: /\bproviders\.(?:hosts|bindings|primaryHost|codexMcp|rufloCodexMcp|opencodeMcp|opencodeManaged|opencodeCatalogDir)\b/g,
+  },
+  {
+    label: 'removed collaboration adapter advice',
+    pattern: /(?:\bdual-run\b|\bclaude-flow-codex\s+dual\s+run\b|@claude-flow\/codex\b)/gi,
+  },
+  {
+    label: 'removed dynamic dual initialization advice',
+    pattern: /\bruflo\s+init\s+--dual\b/gi,
+  },
+  {
+    label: 'removed command module',
+    pattern: /\bsrc\/commands\/(?:dual|x\/provider)\.mjs\b/g,
+  },
+];
+
+function markdownFiles(root) {
+  return filesWithExtension(root, '.md');
+}
+
+function filesWithExtension(root, extension) {
+  const files = [];
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    const full = path.join(root, entry.name);
+    if (entry.isDirectory()) files.push(...filesWithExtension(full, extension));
+    else if (entry.isFile() && entry.name.endsWith(extension)) files.push(full);
+  }
+  return files;
+}
+
+function withoutSection(text, heading) {
+  const start = text.indexOf(heading);
+  assert.notEqual(start, -1, `${heading} is required`);
+  assert.equal(text.indexOf(heading, start + heading.length), -1, `${heading} must occur once`);
+  const next = text.indexOf('\n## ', start + heading.length);
+  return `${text.slice(0, start)}${next === -1 ? '' : text.slice(next + 1)}`;
+}
+
+function lineOf(text, offset) {
+  return text.slice(0, offset).split('\n').length;
+}
+
+function violations(file, text) {
+  const found = [];
+  for (const { label, pattern } of retired) {
+    pattern.lastIndex = 0;
+    for (const match of text.matchAll(pattern)) {
+      found.push(`${path.relative(ROOT, file)}:${lineOf(text, match.index)} ${label}: ${match[0]}`);
+    }
+  }
+  return found;
+}
+
+function stripJavaScriptComments(text) {
+  return text
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/^\s*\/\/.*$/gm, '');
+}
+
+test('active docs, generated guidance, and rendered help contain only GA surfaces', () => {
+  const activeDocs = [
+    path.join(ROOT, 'README.md'),
+    path.join(ROOT, 'MAINTAINER.md'),
+    path.join(ROOT, 'AGENTS.md'),
+    path.join(ROOT, 'CLAUDE.md'),
+    path.join(ROOT, 'docs', 'adr', 'README.md'),
+    ...markdownFiles(path.join(ROOT, 'claude')),
+    ...markdownFiles(path.join(ROOT, 'docs')).filter((file) => (
+      file !== UPGRADE
+      && !file.includes(`${path.sep}docs${path.sep}adr${path.sep}`)
+      && !file.includes(`${path.sep}docs${path.sep}archive${path.sep}`)
+    )),
+  ];
+  const renderedSource = [
+    path.join(ROOT, 'bin', 'agentic-kit.mjs'),
+    ...fs.readdirSync(path.join(ROOT, 'src', 'commands'), { withFileTypes: true })
+      .filter((entry) => entry.isFile() && entry.name.endsWith('.mjs'))
+      .map((entry) => path.join(ROOT, 'src', 'commands', entry.name)),
+    ...fs.readdirSync(path.join(ROOT, 'src', 'commands', 'x'), { withFileTypes: true })
+      .filter((entry) => entry.isFile() && entry.name.endsWith('.mjs'))
+      .map((entry) => path.join(ROOT, 'src', 'commands', 'x', entry.name)),
+    path.join(ROOT, 'src', 'lib', 'providers.mjs'),
+    path.join(ROOT, 'src', 'lib', 'dashboard', 'page.mjs'),
+  ];
+
+  const found = [];
+  for (const file of activeDocs) found.push(...violations(file, fs.readFileSync(file, 'utf8')));
+  for (const file of renderedSource) {
+    found.push(...violations(file, stripJavaScriptComments(fs.readFileSync(file, 'utf8'))));
+  }
+  assert.deepEqual(found, [], `retired GA surfaces remain:\n${found.join('\n')}`);
+});
+
+test('ordinary runtime source cannot revive retired GA surfaces', () => {
+  const migrationBoundaries = new Set([
+    path.join(ROOT, 'src', 'lib', 'adapters', 'config.mjs'),
+    path.join(ROOT, 'src', 'lib', 'live', 'event-schema.mjs'),
+    path.join(ROOT, 'src', 'lib', 'routing-config.mjs'),
+  ]);
+  const removedSymbols = [
+    {
+      label: 'removed command module',
+      pattern: /commands\/(?:dual|x\/provider)\.mjs/g,
+    },
+    {
+      label: 'removed routing helper',
+      pattern: /\b(?:seedDualRouting|seedDualRoutingIfDualHost|policyToDualRunConfig|escalatePolicy|DUAL_RUN_TEMPLATES|DUAL_RUN_TEMPLATE_NAMES)\b/g,
+    },
+    {
+      label: 'removed live-session adapter',
+      pattern: /\b(?:adaptDualRunRecord|DUAL_TEMPLATES|DUAL_TEMPLATE_NAMES)\b/g,
+    },
+    {
+      label: 'removed adapter bootstrap',
+      pattern: /\b(?:CODEX_ADAPTER_PKG|codexAdapterAction|ensureCodexAdapter|ensureDualAgents)\b/g,
+    },
+    {
+      label: 'removed compatibility writer or guard',
+      pattern: /\b(?:writeConfigModule|nativeWalConflict|legacyRouteProvider|deriveCompatibilityExports|byTranscriptProvider)\b/g,
+    },
+  ];
+  const runtimeFiles = [
+    path.join(ROOT, 'package.json'),
+    path.join(ROOT, 'pnpm-lock.yaml'),
+    ...filesWithExtension(path.join(ROOT, 'bin'), '.mjs'),
+    ...filesWithExtension(path.join(ROOT, 'scripts'), '.mjs'),
+    ...filesWithExtension(path.join(ROOT, 'src'), '.mjs'),
+  ];
+  const found = [];
+
+  for (const file of runtimeFiles) {
+    const text = stripJavaScriptComments(fs.readFileSync(file, 'utf8'));
+    if (!migrationBoundaries.has(file)) found.push(...violations(file, text));
+    for (const { label, pattern } of removedSymbols) {
+      pattern.lastIndex = 0;
+      for (const match of text.matchAll(pattern)) {
+        found.push(`${path.relative(ROOT, file)}:${lineOf(text, match.index)} ${label}: ${match[0]}`);
+      }
+    }
+  }
+
+  assert.deepEqual(found, [], `retired runtime surfaces remain:\n${found.join('\n')}`);
+});
+
+test('the upgrading guide contains the only active migration vocabulary', () => {
+  const text = fs.readFileSync(UPGRADE, 'utf8');
+  const sectionStart = text.indexOf(MIGRATION_HEADING);
+  const next = text.indexOf('\n## ', sectionStart + MIGRATION_HEADING.length);
+  const section = text.slice(sectionStart, next === -1 ? text.length : next);
+
+  for (const expected of [
+    '`ak dual`',
+    '`ak provider`',
+    '`ak x provider`',
+    '`providers.dualRouting`',
+    '`providers.hosts`',
+    '`providers.bindings`',
+    '`providers.primaryHost`',
+    '`integrations.hosts`',
+    '`integrations.ownership`',
+    '`routing`',
+    '`routing.primaryHost`',
+    '`routing.routes`',
+    '`provenance`',
+    '`escalation`',
+    '--max-concurrent',
+    '`@claude-flow/codex`',
+  ]) {
+    assert.ok(section.includes(expected), `migration section must name ${expected}`);
+  }
+  assert.match(section, /unknown commands/);
+  assert.deepEqual(
+    violations(UPGRADE, withoutSection(text, MIGRATION_HEADING)),
+    [],
+    'retired vocabulary must remain inside the single migration section',
+  );
+});
+
+test('ADRs that retain retired vocabulary are explicitly marked by the GA decision', () => {
+  const adrDir = path.join(ROOT, 'docs', 'adr');
+  for (const file of markdownFiles(adrDir)) {
+    if (file.endsWith(`${path.sep}README.md`) || file.endsWith('0020-ga-stable-surfaces.md')) continue;
+    const text = fs.readFileSync(file, 'utf8');
+    if (violations(file, text).length === 0) continue;
+    assert.match(
+      text.slice(0, 1_200),
+      /ADR-0020|0020-ga-stable-surfaces/,
+      `${path.relative(ROOT, file)} retains historical vocabulary without a GA amendment`,
+    );
+  }
+});
+
+test('GA-amended ADRs carry living-plan metadata', () => {
+  const adrDir = path.join(ROOT, 'docs', 'adr');
+  for (const file of markdownFiles(adrDir)) {
+    if (file.endsWith(`${path.sep}README.md`)) continue;
+    const text = fs.readFileSync(file, 'utf8');
+    if (!/ADR-0020|0020-ga-stable-surfaces/.test(text.slice(0, 1_200))) continue;
+    assert.match(text.slice(0, 1_200), /- \*\*Updated:\*\* 2026-07-30/,
+      `${path.relative(ROOT, file)} needs an Updated date`);
+    assert.match(text.slice(0, 1_200), /- \*\*Update note:\*\*/,
+      `${path.relative(ROOT, file)} needs an update note`);
+  }
+});
+
+test('maintainer command and package inventories match the stable manifest', () => {
+  const maintainer = fs.readFileSync(path.join(ROOT, 'MAINTAINER.md'), 'utf8');
+  assert.doesNotMatch(
+    maintainer,
+    /\*\*(?:Porcelain|Plumbing)\*\*[^\n]*`(?:dual|provider)`/,
+    'maintainer command inventory must not revive a removed bare command',
+  );
+  for (const command of ['`usage`', '`run`', '`host`']) {
+    assert.ok(maintainer.includes(command), `maintainer command inventory must include ${command}`);
+  }
+
+  const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
+  for (const entry of pkg.files.filter((file) => !file.startsWith('!'))) {
+    assert.ok(
+      maintainer.includes(`\`${entry}\``),
+      `maintainer package inventory must include ${entry}`,
+    );
+  }
+});
diff --git a/tests/kit/host-cli-migration.test.mjs b/tests/kit/host-cli-migration.test.mjs
index 9084059..3460c34 100644
--- a/tests/kit/host-cli-migration.test.mjs
+++ b/tests/kit/host-cli-migration.test.mjs
@@ -70,48 +70,101 @@ test('ak host preserves pick option parsing without performing an interactive ru
   assert.match(result.stdout, /--provider <csv>/);
 });
 
-test('legacy top-level ak provider remains a functional deprecation shim', () => {
-  const sb = sandbox();
-  const result = ak(sb, 'provider', '--help');
-  assert.equal(result.status, 0, output(result));
-  assert.match(result.stdout, /status\s+\(default\)/);
-  assert.match(output(result), /ak provider is deprecated/i);
-  assert.match(output(result), /use `?ak host`?/i);
-  assert.match(output(result), /removed before (?:the )?stable release/i);
-});
+for (const [name, body, detail] of [
+  ['malformed JSON', '{ invalid json', /Unexpected token|Expected property name/],
+  ['non-object integrations envelope', JSON.stringify({ integrations: [] }),
+    /integrations must be an object/],
+  ['future integrations envelope', JSON.stringify({ integrations: { version: 99 } }),
+    /unsupported integrations\.version 99/],
+  ['future routing envelope', JSON.stringify({ routing: { version: 99, future: true } }),
+    /unsupported routing\.version 99/],
+  ['conflicting routing state', JSON.stringify({
+    routing: { version: 1, primaryHost: 'claude', routes: {} },
+    providers: { primaryHost: 'codex' },
+  }), /providers\.primaryHost differs from routing\.primaryHost/],
+]) {
+  test(`a ${name} config reports a path, cause, and non-destructive recovery without a stack`, () => {
+    const sb = sandbox();
+    const file = path.join(sb.env.XDG_CONFIG_HOME, 'agentic-kit', 'kit.json');
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, body);
+    const result = ak(sb, 'status');
+    const text = output(result);
+    assert.equal(result.status, 1, text);
+    assert.match(text, /invalid kit config/);
+    assert.ok(text.includes(file), `must name the exact file\n${text}`);
+    assert.match(text, detail);
+    assert.match(text, /Recovery \(the original is preserved\)/);
+    assert.match(text, /\.invalid/);
+    assert.match(text, /ak status/);
+    assert.doesNotMatch(text, /\n\s+at\s/, `must not leak a stack trace\n${text}`);
+    assert.equal(fs.readFileSync(file, 'utf8'), body, 'diagnosis must not alter the invalid file');
+  });
+}
 
-test('legacy provider shim delegates status and warns exactly once', () => {
+test('removed top-level provider alias exits as an unknown command', () => {
   const sb = sandbox();
-  const result = ak(sb, 'provider', 'status', '--json');
-  assert.equal(result.status, 0, output(result));
-  assert.doesNotThrow(() => JSON.parse(result.stdout));
-  const warnings = output(result).match(/ak provider is deprecated/gi) ?? [];
-  assert.equal(warnings.length, 1);
+  const result = ak(sb, 'provider', '--help');
+  assert.equal(result.status, 2, output(result));
+  assert.match(result.stdout, /unknown command: provider/);
 });
 
-test('plumbing host and provider aliases remain available during migration', () => {
+test('removed plumbing provider alias exits as an unknown plumbing command', () => {
   const sb = sandbox();
-  for (const name of ['host', 'provider']) {
-    const result = ak(sb, 'x', name, '--help');
-    assert.equal(result.status, 0, `${name}\n${output(result)}`);
-    assert.match(result.stdout, /status\s+\(default\)/);
-  }
+  const result = ak(sb, 'x', 'provider', '--help');
+  assert.equal(result.status, 2, output(result));
+  assert.match(result.stdout, /unknown plumbing command: provider/);
 });
 
-test('top-level help advertises host canonically and labels provider deprecated', () => {
+test('top-level help advertises only the canonical host command', () => {
   const sb = sandbox();
   const result = ak(sb, '--help');
   assert.equal(result.status, 0, output(result));
   assert.match(result.stdout, /^\s+ak host\s+/m);
-  assert.match(result.stdout, /^\s+ak provider\s+.*deprecated/im);
-  assert.ok(result.stdout.indexOf('ak host') < result.stdout.indexOf('ak provider'),
-    'canonical host command should be listed before its legacy shim');
+  assert.doesNotMatch(result.stdout, /^\s+ak provider\s+/m);
 });
 
-test('plumbing index advertises x host canonically and marks x provider deprecated', () => {
+test('plumbing index advertises only x host', () => {
   const sb = sandbox();
   const result = ak(sb, '--help', '--all');
   assert.equal(result.status, 0, output(result));
   assert.match(result.stdout, /^\s+ak x host\s+/m);
-  assert.match(result.stdout, /^\s+ak x provider\s+.*deprecated/im);
+  assert.doesNotMatch(result.stdout, /^\s+ak x provider\s+/m);
+});
+
+test('ak host off retains the OpenCode teardown receipt when config parsing fails', () => {
+  const sb = sandbox();
+  const kitFile = path.join(sb.env.XDG_CONFIG_HOME, 'agentic-kit', 'kit.json');
+  const opencodeFile = path.join(sb.env.XDG_CONFIG_HOME, 'opencode', 'opencode.json');
+  fs.mkdirSync(path.dirname(kitFile), { recursive: true });
+  fs.mkdirSync(path.dirname(opencodeFile), { recursive: true });
+  fs.writeFileSync(opencodeFile, '{ /* JSONC prevents safe teardown */ "mcp": {} }\n');
+  fs.writeFileSync(kitFile, `${JSON.stringify({
+    integrations: {
+      version: 2,
+      hosts: { claude: true, codex: false, opencode: true },
+      bindings: [],
+      ownership: {
+        opencode: {
+          mcp: 'ak',
+          managed: { mcp: {}, paths: [], permissions: {}, artifacts: {} },
+          catalogDir: '/retained/catalog',
+        },
+      },
+    },
+    routing: { version: 1, primaryHost: 'claude', routes: {} },
+    providers: {
+      aqeProvider: null, aqeFallback: [], models: [], maxBudgetUsd: null,
+    },
+  }, null, 2)}\n`);
+
+  const result = ak(sb, 'host', 'off');
+  assert.equal(result.status, 1, output(result));
+  assert.match(output(result), /opencode teardown incomplete/);
+  const saved = JSON.parse(fs.readFileSync(kitFile, 'utf8'));
+  assert.equal(saved.integrations.hosts.opencode, false);
+  assert.equal(saved.integrations.ownership.opencode.mcp, 'ak');
+  assert.equal(saved.integrations.ownership.opencode.catalogDir, '/retained/catalog');
+  assert.ok(saved.integrations.ownership.opencode.managed,
+    'the retry proof must survive a failed direct off');
 });
diff --git a/tests/kit/hosts.test.mjs b/tests/kit/hosts.test.mjs
index 516058d..f49e2f2 100644
--- a/tests/kit/hosts.test.mjs
+++ b/tests/kit/hosts.test.mjs
@@ -64,11 +64,11 @@ test('drivingHost detects codex from a CODEX_* marker', () => {
 });
 
 test('drivingHost falls back to the configured primary host', () => {
-  assert.equal(drivingHost({}, { providers: { primaryHost: 'codex' } }), 'codex');
+  assert.equal(drivingHost({}, { routing: { primaryHost: 'codex' } }), 'codex');
 });
 
 test('drivingHost rejects a non-primary-capable host from hand-edited config', () => {
-  assert.equal(drivingHost({}, { providers: { primaryHost: 'opencode' } }), 'claude');
+  assert.equal(drivingHost({}, { routing: { primaryHost: 'opencode' } }), 'claude');
 });
 
 test('drivingHost defaults to claude with no signal', () => {
diff --git a/tests/kit/integration-command-facts.test.mjs b/tests/kit/integration-command-facts.test.mjs
index 35676a5..ea9e383 100644
--- a/tests/kit/integration-command-facts.test.mjs
+++ b/tests/kit/integration-command-facts.test.mjs
@@ -5,8 +5,8 @@ import { HOST_REGISTRY } from '../../src/lib/adapters/index.mjs';
 
 test('commands share one immutable normalized integration snapshot', async () => {
   const cfg = {
-    providers: { hosts: { claude: true, codex: false } },
     integrations: {
+      hosts: { claude: true, codex: false },
       bindings: [{
         host: 'claude', provider: 'ollama', model: 'qwen3.6:latest',
         provenance: 'configured',
diff --git a/tests/kit/integration-config.test.mjs b/tests/kit/integration-config.test.mjs
index 9560e1b..f0c2749 100644
--- a/tests/kit/integration-config.test.mjs
+++ b/tests/kit/integration-config.test.mjs
@@ -6,6 +6,7 @@ import {
   validateEndpoint,
 } from '../../src/lib/adapters/config.mjs';
 import { migrateConfig } from '../../src/lib/adapters/migration.mjs';
+import { migrateKitConfig } from '../../src/lib/config.mjs';
 
 const legacyDual = {
   providers: {
@@ -22,17 +23,51 @@ const legacyDual = {
   unrelated: 'keep-me',
 };
 
-test('legacy migration is additive, versioned, deterministic, and idempotent', () => {
+test('integration migration is versioned, deterministic, and idempotent', () => {
   const input = structuredClone(legacyDual);
   const first = migrateIntegrationConfig(input);
   const second = migrateIntegrationConfig(structuredClone(first));
+  assert.equal(CURRENT_INTEGRATIONS_VERSION, 2,
+    'v2 distinguishes completed GA cutover from additive v1 snapshots');
   assert.equal(first.integrations.version, CURRENT_INTEGRATIONS_VERSION);
   assert.deepEqual(second, first);
   assert.deepEqual(input, legacyDual, 'migration must not mutate its input');
   assert.equal(first.unrelated, 'keep-me');
   assert.deepEqual(first.providers.customUserField, { preserve: true });
+  assert.equal(Object.hasOwn(first.providers, 'hosts'), false);
   assert.deepEqual(first.providers.dualRouting, legacyDual.providers.dualRouting,
-    'legacy routing intent must survive byte-for-byte structurally');
+    'the independent routing migration still owns this field');
+});
+
+test('top-level migration retires routing compatibility fields but keeps provider-axis state', () => {
+  const migrated = migrateKitConfig({
+    ...structuredClone(legacyDual),
+    providers: {
+      ...structuredClone(legacyDual.providers),
+      primaryHost: 'codex',
+      aqeFallback: [{ provider: 'openrouter', models: ['z-ai/glm-5'], source: 'user' }],
+      maxBudgetUsd: 7,
+    },
+  });
+  assert.deepEqual(migrated.routing, {
+    version: 1,
+    primaryHost: 'codex',
+    routes: {
+      implementation: {
+        host: 'codex',
+        model: 'gpt-5.4',
+        provenance: 'user',
+        escalation: [{ host: 'claude', model: 'claude-opus-5' }],
+      },
+    },
+  });
+  for (const key of ['hosts', 'primaryHost', 'dualRouting']) {
+    assert.equal(Object.hasOwn(migrated.providers, key), false);
+  }
+  assert.deepEqual(migrated.providers.aqeFallback,
+    [{ provider: 'openrouter', models: ['z-ai/glm-5'], source: 'user' }]);
+  assert.equal(migrated.providers.maxBudgetUsd, 7);
+  assert.deepEqual(migrateKitConfig(structuredClone(migrated)), migrated);
 });
 
 test('public migration helpers converge on one canonical integrations.version field', () => {
@@ -76,7 +111,7 @@ test('legacy host routes never manufacture observed provider provenance', () =>
   assert.notEqual(route.provenance, 'observed');
 });
 
-test('legacy OpenCode ownership markers migrate additively without inferring a provider', () => {
+test('legacy OpenCode ownership markers migrate canonically without inferring a provider', () => {
   const legacy = {
     providers: {
       hosts: { claude: true, codex: false, opencode: true },
@@ -88,20 +123,111 @@ test('legacy OpenCode ownership markers migrate additively without inferring a p
   const migrated = migrateIntegrationConfig(legacy);
   assert.equal(migrated.integrations.ownership.opencode.source, 'legacy-providers');
   assert.deepEqual(migrated.integrations.ownership.opencode.managed, legacy.providers.opencodeManaged);
-  assert.equal(migrated.providers.opencodeMcp, 'ak', 'migration is additive; legacy receipt remains');
+  for (const key of ['opencodeMcp', 'opencodeManaged', 'opencodeCatalogDir']) {
+    assert.equal(Object.hasOwn(migrated.providers, key), false);
+  }
   const binding = migrated.integrations.bindings.find(({ host }) => host === 'opencode');
   assert.equal(binding.provider, null);
   assert.equal(binding.provenance, 'unknown');
 });
 
+test('legacy Codex ownership markers migrate together and are retired', () => {
+  const reverseMarker = 'rufloCodexMcp';
+  const migrated = migrateIntegrationConfig({
+    providers: { codexMcp: 'ak', [reverseMarker]: 'ak', aqeProvider: 'openai' },
+  });
+  assert.deepEqual(migrated.integrations.ownership.codex, {
+    source: 'legacy-providers',
+    mcp: 'ak',
+    reverseMcp: 'ak',
+  });
+  assert.equal(Object.hasOwn(migrated.providers, 'codexMcp'), false);
+  assert.equal(Object.hasOwn(migrated.providers, reverseMarker), false);
+  assert.equal(migrated.providers.aqeProvider, 'openai');
+});
+
+test('null legacy markers are retired without manufacturing ownership', () => {
+  const reverseMarker = 'rufloCodexMcp';
+  const migrated = migrateIntegrationConfig({
+    providers: {
+      codexMcp: null,
+      [reverseMarker]: null,
+      opencodeMcp: null,
+      opencodeManaged: null,
+      opencodeCatalogDir: null,
+    },
+    integrations: { schemaVersion: 1 },
+  });
+  assert.equal(Object.hasOwn(migrated.integrations, 'ownership'), false);
+  assert.equal(Object.hasOwn(migrated.integrations, 'schemaVersion'), false);
+  assert.deepEqual(migrated.providers, {});
+});
+
+test('active legacy hosts win once over a stale additive integration snapshot', () => {
+  const migrated = migrateIntegrationConfig({
+    providers: { hosts: { claude: false, codex: true, opencode: true } },
+    integrations: {
+      version: 1,
+      hosts: { claude: true, codex: false, opencode: false },
+      bindings: [],
+    },
+  });
+  assert.equal(migrated.integrations.version, CURRENT_INTEGRATIONS_VERSION);
+  assert.deepEqual(migrated.integrations.hosts,
+    { claude: false, codex: true, opencode: true });
+  assert.equal(Object.hasOwn(migrated.providers, 'hosts'), false);
+});
+
+test('legacy bindings survive a stale additive integration snapshot without duplication', () => {
+  const legacyBinding = {
+    id: 'openrouter-via-codex',
+    host: 'codex',
+    provider: 'openrouter',
+    model: 'openai/gpt-5.4',
+    transport: 'native',
+    endpoint: null,
+    provenance: 'user',
+    managedBy: 'user',
+  };
+  const migrated = migrateIntegrationConfig({
+    providers: { bindings: [legacyBinding] },
+    integrations: { version: 1, hosts: {}, bindings: [] },
+  });
+  assert.deepEqual(migrated.integrations.bindings, [legacyBinding]);
+  assert.equal(Object.hasOwn(migrated.providers, 'bindings'), false);
+  assert.deepEqual(migrateIntegrationConfig(structuredClone(migrated)), migrated);
+});
+
+test('conflicting canonical and legacy binding ids fail closed', () => {
+  const canonical = {
+    id: 'shared', host: 'codex', provider: 'openai', model: null,
+    transport: 'native', endpoint: null, provenance: 'user', managedBy: 'user',
+  };
+  assert.throws(() => migrateIntegrationConfig({
+    providers: { bindings: [{ ...canonical, provider: 'openrouter' }] },
+    integrations: { version: 1, hosts: {}, bindings: [canonical] },
+  }), /integrations binding conflict/);
+});
+
 test('legacy OpenCode ownership merges beside an existing ownership receipt', () => {
   const legacy = {
     providers: { opencodeMcp: 'ak', opencodeManaged: { mcp: {} } },
-    integrations: { ownership: { codex: { source: 'existing' } } },
+    integrations: {
+      version: 1,
+      ownership: {
+        codex: { source: 'existing' },
+        opencode: { source: 'v1-snapshot', mcp: null, keep: true },
+      },
+    },
   };
   const migrated = migrateIntegrationConfig(legacy);
   assert.deepEqual(migrated.integrations.ownership.codex, { source: 'existing' });
-  assert.equal(migrated.integrations.ownership.opencode.source, 'legacy-providers');
+  assert.deepEqual(migrated.integrations.ownership.opencode, {
+    source: 'v1-snapshot',
+    mcp: 'ak',
+    keep: true,
+    managed: { mcp: {} },
+  }, 'active legacy values override a stale v1 snapshot without dropping canonical fields');
 });
 
 test('migration never persists API keys found in process environment', () => {
diff --git a/tests/kit/live-adapters.test.mjs b/tests/kit/live-adapters.test.mjs
index d281900..8de1329 100644
--- a/tests/kit/live-adapters.test.mjs
+++ b/tests/kit/live-adapters.test.mjs
@@ -2,7 +2,6 @@ import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import {
   adaptClaudeRecord, adaptCodexRecord, adaptCodexLedger, adaptStructuredEvent,
-  adaptDualRunRecord,
 } from '../../src/lib/live/index.mjs';
 
 const now = '2026-07-27T12:00:00Z';
@@ -127,13 +126,3 @@ test('tool identity has a dedicated allowlisted field without carrying arguments
   assert.equal(events[0].attributes.toolName, 'exec_command');
   assert.equal(JSON.stringify(events).includes('sk-private-never-serialize'), false);
 });
-
-test('dual-run planned topology requires an explicit plan record', () => {
-  const events = adaptDualRunRecord({
-    type: 'dual-run.plan', runId: 'run-1',
-    steps: [{ id: 'architect', host: 'claude' }, { id: 'coder', host: 'codex' }],
-  }, { observedAt: now, artifact: 'run.jsonl' });
-  assert.equal(events.length, 2);
-  assert.ok(events.every((event) => event.source.confidence === 'planned'));
-  assert.deepEqual(adaptDualRunRecord({ type: 'routing.config', runId: 'x', steps: [] }), []);
-});
diff --git a/tests/kit/live-core.test.mjs b/tests/kit/live-core.test.mjs
index 3f4f6a0..74f0867 100644
--- a/tests/kit/live-core.test.mjs
+++ b/tests/kit/live-core.test.mjs
@@ -41,6 +41,10 @@ test('event schema preserves explicit blocked evidence', () => {
   assert.equal(createLiveEvent(base({ status: 'blocked' })).status, 'blocked');
 });
 
+test('event schema preserves retired compatibility provenance as internal', () => {
+  assert.equal(createLiveEvent(base({ surface: 'dual-run' })).surface, 'internal');
+});
+
 test('event schema assigns privacy-safe project and host-qualified session identities', () => {
   const event = createLiveEvent(base({
     sessionId: 'shared:id',
diff --git a/tests/kit/opencode.test.mjs b/tests/kit/opencode.test.mjs
index 5abe487..b8676e4 100644
--- a/tests/kit/opencode.test.mjs
+++ b/tests/kit/opencode.test.mjs
@@ -15,7 +15,16 @@ import { guidanceTargets, BUILTIN_BLOCKS } from '../../src/lib/blocks.mjs';
 
 const tmp = (prefix) => fs.mkdtempSync(path.join(os.tmpdir(), prefix));
 const rm = (d) => fs.rmSync(d, { recursive: true, force: true });
-const cfgOn = () => ({ providers: { hosts: { opencode: true }, opencodeMcp: null, opencodeManaged: null } });
+const cfgOn = () => ({
+  integrations: {
+    version: 2,
+    hosts: { claude: true, codex: false, opencode: true },
+    bindings: [],
+    ownership: { opencode: { mcp: null, managed: null, catalogDir: null } },
+  },
+  routing: { version: 1, primaryHost: 'claude', routes: {} },
+  providers: {},
+});
 
 /** Fixture ruflo catalog source: .claude/agents (+ frontmatter variants),
  *  .claude/skills, plugins, SKILL.md, package.json. */
@@ -113,7 +122,7 @@ test('applyOpencode merges wiring, preserves user keys, records value-precise ow
   }, null, 2));
 
   const cfg = cfgOn();
-  cfg.providers.opencodeCatalogDir = srcRoot;
+  cfg.integrations.ownership.opencode.catalogDir = srcRoot;
   const r = await applyOpencode(cfg, { configFile: file, brainShim: shim });
   assert.equal(r.ok, true);
   assert.equal(r.changed, true);
@@ -127,9 +136,9 @@ test('applyOpencode merges wiring, preserves user keys, records value-precise ow
   assert.ok(doc.skills.paths.includes(path.join(srcRoot, 'plugins')), 'catalog plugins path added');
   assert.equal(doc.permission.edit, 'ask', 'user permission preserved');
   for (const k of PERMISSION_KEYS) assert.equal(doc.permission[k], 'allow');
-  assert.equal(cfg.providers.opencodeMcp, 'ak');
+  assert.equal(cfg.integrations.ownership.opencode.mcp, 'ak');
   // value-precise ownership: claude-flow had no prior → prior null, written recorded
-  const rec = cfg.providers.opencodeManaged.mcp['claude-flow'];
+  const rec = cfg.integrations.ownership.opencode.managed.mcp['claude-flow'];
   assert.equal(rec.prior, null);
   assert.deepEqual(rec.written, doc.mcp['claude-flow']);
 
@@ -147,7 +156,7 @@ test('applyOpencode merges wiring, preserves user keys, records value-precise ow
   assert.deepEqual(after.skills.paths, ['/user/path']);
   assert.equal(after.permission.edit, 'ask');
   for (const k of PERMISSION_KEYS) assert.equal(after.permission[k], undefined);
-  assert.equal(cfg.providers.opencodeMcp, null);
+  assert.equal(cfg.integrations.ownership.opencode.mcp, null);
   rm(d);
 });
 
@@ -166,7 +175,9 @@ test('applyOpencode refuses an unparseable config file (never clobbers JSONC)',
 test('applyOpencode is a no-op when the host is not enabled', async () => {
   const d = tmp('ak-oc-off-');
   const file = path.join(d, 'opencode.json');
-  const r = await applyOpencode({ providers: { hosts: { opencode: false } } }, { configFile: file });
+  const r = await applyOpencode({
+    integrations: { hosts: { opencode: false } },
+  }, { configFile: file });
   assert.equal(r.changed, false);
   assert.equal(fs.existsSync(file), false);
   rm(d);
@@ -678,7 +689,7 @@ test('collision → user aligns to desired value: stays unmanaged, undo never re
   fs.writeFileSync(file, JSON.stringify({ mcp: { 'claude-flow': want } }));
   // 3. re-apply: must NOT adopt with the stale pre-collision prior
   await applyOpencode(cfg, { configFile: file, brainShim: shim });
-  assert.equal(cfg.providers.opencodeManaged.mcp['claude-flow'].written, null, 'never owned (not ak-authored)');
+  assert.equal(cfg.integrations.ownership.opencode.managed.mcp['claude-flow'].written, null, 'never owned (not ak-authored)');
   // 4. undo: the user's aligned value must survive — no stale-prior restore
   undoOpencode(cfg, { configFile: file });
   assert.deepEqual(JSON.parse(fs.readFileSync(file, 'utf8')).mcp['claude-flow'], want);
@@ -767,7 +778,10 @@ test('opencode guidance blocks are enablement-gated (flag): absent when disabled
 test('isDefault is false when the opencode host is enabled', async () => {
   const { isDefault } = await import('../../src/lib/providers.mjs');
   assert.equal(isDefault(cfgOn()), false);
-  assert.equal(isDefault({ providers: { hosts: { claude: true, codex: false, opencode: false } } }), true);
+  assert.equal(isDefault({
+    integrations: { hosts: { claude: true, codex: false, opencode: false } },
+    providers: {},
+  }), true);
 });
 
 test('the deployed plugin template uses schema-valid PartIDs (prt prefix) for injected parts', () => {
@@ -809,24 +823,24 @@ test('opencodeStack reports markersChanged when a converged file has stale/missi
     skillsDir: path.join(d, 'skills'),
   };
   const cfg = cfgOn();
-  cfg.providers.opencodeCatalogDir = srcRoot;
+  cfg.integrations.ownership.opencode.catalogDir = srcRoot;
   await opencodeStack(cfg, { pkgRoot, ...seams }); // initial wire (markers recorded)
   assert.ok(fs.existsSync(seams.configFile), 'wiring landed in the tmp config, not the real one');
   // Simulate staleness: the markers vanish from kit.json while the file stays.
-  cfg.providers.opencodeMcp = null;
-  cfg.providers.opencodeManaged = null;
+  cfg.integrations.ownership.opencode.mcp = null;
+  cfg.integrations.ownership.opencode.managed = null;
   const second = await opencodeStack(cfg, { pkgRoot, ...seams });
   assert.equal(second.oc.changed, false, 'the file itself is already converged');
   assert.equal(second.markersChanged, true, 'but the refreshed markers must be persisted by the caller');
   assert.equal(second.plugin.adopted, true);
   assert.ok(second.agents.adopted > 0);
   assert.equal(second.skill.adopted, true);
-  assert.equal(cfg.providers.opencodeMcp, 'ak');
-  assert.ok(cfg.providers.opencodeManaged?.mcp?.['claude-flow']?.written);
-  assert.ok(cfg.providers.opencodeManaged?.artifacts?.plugin);
-  assert.ok(cfg.providers.opencodeManaged?.artifacts?.agents?.['coder.md']);
-  assert.ok(cfg.providers.opencodeManaged?.artifacts?.agentStamp);
-  assert.ok(cfg.providers.opencodeManaged?.artifacts?.skill);
+  assert.equal(cfg.integrations.ownership.opencode.mcp, 'ak');
+  assert.ok(cfg.integrations.ownership.opencode.managed?.mcp?.['claude-flow']?.written);
+  assert.ok(cfg.integrations.ownership.opencode.managed?.artifacts?.plugin);
+  assert.ok(cfg.integrations.ownership.opencode.managed?.artifacts?.agents?.['coder.md']);
+  assert.ok(cfg.integrations.ownership.opencode.managed?.artifacts?.agentStamp);
+  assert.ok(cfg.integrations.ownership.opencode.managed?.artifacts?.skill);
   // A third run with truthful markers is then fully quiet.
   const third = await opencodeStack(cfg, { pkgRoot, ...seams });
   assert.equal(third.markersChanged, false, 'no kit.json churn once the markers are truthful');
@@ -844,17 +858,17 @@ test('opencodeStack normalizes poisoned null artifact maps before adopting exact
     skillsDir: path.join(d, 'skills'),
   };
   const cfg = cfgOn();
-  cfg.providers.opencodeCatalogDir = makeCatalog(path.join(d, 'catalog'));
+  cfg.integrations.ownership.opencode.catalogDir = makeCatalog(path.join(d, 'catalog'));
   const pkgRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
   await opencodeStack(cfg, { pkgRoot, ...seams });
-  cfg.providers.opencodeManaged.artifacts = {
+  cfg.integrations.ownership.opencode.managed.artifacts = {
     plugin: null, agents: null, agentStamp: null, skill: null,
   };
   const adopted = await opencodeStack(cfg, { pkgRoot, ...seams });
   assert.equal(adopted.plugin.adopted, true);
   assert.ok(adopted.agents.adopted > 0);
   assert.equal(adopted.skill.adopted, true);
-  assert.ok(cfg.providers.opencodeManaged.artifacts.agents['coder.md']);
+  assert.ok(cfg.integrations.ownership.opencode.managed.artifacts.agents['coder.md']);
   rm(d);
 });
 
@@ -869,11 +883,11 @@ test('non-null poisoned receipts are preserved and never treated as an adoption
     skillsDir: path.join(d, 'skills'),
   };
   const cfg = cfgOn();
-  cfg.providers.opencodeCatalogDir = makeCatalog(path.join(d, 'catalog'));
+  cfg.integrations.ownership.opencode.catalogDir = makeCatalog(path.join(d, 'catalog'));
   const pkgRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
   await opencodeStack(cfg, { pkgRoot, ...seams });
-  const agentNames = Object.keys(cfg.providers.opencodeManaged.artifacts.agents);
-  cfg.providers.opencodeManaged.artifacts = {
+  const agentNames = Object.keys(cfg.integrations.ownership.opencode.managed.artifacts.agents);
+  cfg.integrations.ownership.opencode.managed.artifacts = {
     plugin: '',
     agents: Object.fromEntries(agentNames.map((name) => [name, ''])),
     agentStamp: '',
@@ -883,11 +897,11 @@ test('non-null poisoned receipts are preserved and never treated as an adoption
   assert.notEqual(refused.plugin.adopted, true);
   assert.equal(refused.agents.adopted, 0);
   assert.notEqual(refused.skill.adopted, true);
-  assert.equal(cfg.providers.opencodeManaged.artifacts.plugin, '');
-  assert.deepEqual(cfg.providers.opencodeManaged.artifacts.agents,
+  assert.equal(cfg.integrations.ownership.opencode.managed.artifacts.plugin, '');
+  assert.deepEqual(cfg.integrations.ownership.opencode.managed.artifacts.agents,
     Object.fromEntries(agentNames.map((name) => [name, ''])));
-  assert.equal(cfg.providers.opencodeManaged.artifacts.agentStamp, '');
-  assert.equal(cfg.providers.opencodeManaged.artifacts.skill, '');
+  assert.equal(cfg.integrations.ownership.opencode.managed.artifacts.agentStamp, '');
+  assert.equal(cfg.integrations.ownership.opencode.managed.artifacts.skill, '');
   rm(d);
 });
 
@@ -902,12 +916,12 @@ test('malformed non-null receipt containers fail closed without adopting or rewr
     skillsDir: path.join(d, 'skills'),
   };
   const cfg = cfgOn();
-  cfg.providers.opencodeCatalogDir = makeCatalog(path.join(d, 'catalog'));
+  cfg.integrations.ownership.opencode.catalogDir = makeCatalog(path.join(d, 'catalog'));
   const pkgRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
   await opencodeStack(cfg, { pkgRoot, ...seams });
   const artifactFiles = [
     path.join(seams.pluginsDir, PLUGIN_NAME),
-    ...Object.keys(cfg.providers.opencodeManaged.artifacts.agents)
+    ...Object.keys(cfg.integrations.ownership.opencode.managed.artifacts.agents)
       .map((file) => path.join(seams.agentsDir, file)),
     path.join(seams.agentsDir, '.ak-agents-stamp.json'),
     path.join(seams.skillsDir, 'ruflo', 'SKILL.md'),
@@ -915,12 +929,12 @@ test('malformed non-null receipt containers fail closed without adopting or rewr
   const exactBytes = artifactFiles.map((file) => fs.readFileSync(file, 'utf8'));
 
   for (const malformed of ['corrupt', [], { agents: 'corrupt' }]) {
-    cfg.providers.opencodeManaged.artifacts = structuredClone(malformed);
+    cfg.integrations.ownership.opencode.managed.artifacts = structuredClone(malformed);
     const result = await opencodeStack(cfg, { pkgRoot, ...seams });
     assert.notEqual(result.plugin.adopted, true);
     assert.equal(result.agents.adopted, 0);
     assert.notEqual(result.skill.adopted, true);
-    assert.deepEqual(cfg.providers.opencodeManaged.artifacts, malformed,
+    assert.deepEqual(cfg.integrations.ownership.opencode.managed.artifacts, malformed,
       'a non-null malformed container is preserved byte-for-byte as repair evidence');
     assert.deepEqual(artifactFiles.map((file) => fs.readFileSync(file, 'utf8')), exactBytes,
       'fail-closed reconciliation never rewrites artifact files');
@@ -939,8 +953,8 @@ test('a malformed receipt ledger cannot create absent artifacts across repeated
     skillsDir: path.join(d, 'skills'),
   };
   const cfg = cfgOn();
-  cfg.providers.opencodeCatalogDir = makeCatalog(path.join(d, 'catalog'));
-  cfg.providers.opencodeManaged = { artifacts: 'corrupt' };
+  cfg.integrations.ownership.opencode.catalogDir = makeCatalog(path.join(d, 'catalog'));
+  cfg.integrations.ownership.opencode.managed = { artifacts: 'corrupt' };
   const pkgRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
 
   for (let pass = 1; pass <= 2; pass++) {
@@ -953,7 +967,7 @@ test('a malformed receipt ledger cannot create absent artifacts across repeated
     assert.equal(result.skill.changed, false);
     assert.equal(result.markersChanged, pass === 1,
       'only the independently managed opencode.json receipt may converge');
-    assert.equal(cfg.providers.opencodeManaged.artifacts, 'corrupt');
+    assert.equal(cfg.integrations.ownership.opencode.managed.artifacts, 'corrupt');
     for (const dir of [seams.pluginsDir, seams.agentsDir, seams.skillsDir]) {
       assert.equal(fs.existsSync(dir), false, `${path.basename(dir)} must remain absent`);
     }
@@ -968,7 +982,7 @@ test('opencodeStack deploys no executable artifacts when JSONC config is refused
   const configFile = path.join(d, 'opencode.json');
   fs.writeFileSync(configFile, '{\n// legal JSONC\n"mcp": {}\n}\n');
   const cfg = cfgOn();
-  cfg.providers.opencodeCatalogDir = makeCatalog(path.join(d, 'catalog'));
+  cfg.integrations.ownership.opencode.catalogDir = makeCatalog(path.join(d, 'catalog'));
   const result = await opencodeStack(cfg, {
     pkgRoot: path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..'),
     configFile,
@@ -991,7 +1005,7 @@ test('opencodeStack preserves a valid config collision while converging independ
   const userMcp = { type: 'local', command: ['my', 'server'] };
   fs.writeFileSync(configFile, JSON.stringify({ mcp: { 'claude-flow': userMcp } }));
   const cfg = cfgOn();
-  cfg.providers.opencodeCatalogDir = makeCatalog(path.join(d, 'catalog'));
+  cfg.integrations.ownership.opencode.catalogDir = makeCatalog(path.join(d, 'catalog'));
   const result = await opencodeStack(cfg, {
     pkgRoot: path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..'),
     configFile,
@@ -1020,7 +1034,7 @@ test('OpenCode lifecycle detect/plan/dry-run are read-only; apply and undo are i
     skillsDir: path.join(d, 'skills'),
   };
   const cfg = cfgOn();
-  cfg.providers.opencodeCatalogDir = srcRoot;
+  cfg.integrations.ownership.opencode.catalogDir = srcRoot;
   const adapter = createOpencodeLifecycleAdapter(options);
   const before = JSON.stringify(cfg);
   await runLifecycle({ adapter, action: 'detect', cfg });
@@ -1030,7 +1044,7 @@ test('OpenCode lifecycle detect/plan/dry-run are read-only; apply and undo are i
   assert.equal(fs.existsSync(options.configFile), false, 'dry-run creates no OpenCode surface');
 
   const first = await runLifecycle({ adapter, action: 'apply', cfg });
-  cfg.providers.opencodeManaged.artifacts = {
+  cfg.integrations.ownership.opencode.managed.artifacts = {
     plugin: null, agents: {}, agentStamp: null, skill: null,
   };
   const adoptionPlan = await runLifecycle({ adapter, action: 'plan', cfg });
@@ -1039,7 +1053,7 @@ test('OpenCode lifecycle detect/plan/dry-run are read-only; apply and undo are i
   assert.equal(adoptionPlan.facts.agents.adoptable, true);
   assert.equal(adoptionPlan.facts.skill.adoptable, true);
   const migrated = await runLifecycle({ adapter, action: 'apply', cfg });
-  cfg.providers.opencodeManaged.artifacts.agentStamp = null;
+  cfg.integrations.ownership.opencode.managed.artifacts.agentStamp = null;
   const stampPlan = await runLifecycle({ adapter, action: 'plan', cfg });
   assert.equal(stampPlan.facts.agents.adoptable, true,
     'an exact stamp with independently receipted agents is itself adoptable');
diff --git a/tests/kit/provider-cli.test.mjs b/tests/kit/provider-cli.test.mjs
index 252c768..e43269b 100644
--- a/tests/kit/provider-cli.test.mjs
+++ b/tests/kit/provider-cli.test.mjs
@@ -1,4 +1,4 @@
-// `ak x provider status` is read-only (detect + report), so — unlike `pick`,
+// `ak x host status` is read-only (detect + report), so — unlike `pick`,
 // which can trigger real installs/network calls — it's safe to exercise via a
 // real CLI spawn. HOME/XDG_CONFIG_HOME (POSIX) and USERPROFILE/APPDATA
 // (Windows) are all pointed at a throwaway sandbox so this never touches the
@@ -22,7 +22,9 @@ function sandbox({ hosts }) {
   fs.mkdirSync(cfgDir, { recursive: true });
   const last = Date.now();
   fs.writeFileSync(path.join(cfgDir, 'kit.json'), JSON.stringify({
-    providers: { hosts },
+    integrations: { version: 2, hosts: { opencode: false, ...hosts }, bindings: [] },
+    routing: { version: 1, primaryHost: 'claude', routes: {} },
+    providers: {},
     // Real CLI spawns must not turn an isolated unit test into an npm network probe.
     versionCheck: { last, seen: {}, self: { last, best: null } },
   }));
@@ -73,18 +75,18 @@ test('ak host status preserves key presence without exposing the key value', ()
   rm(home, project);
 });
 
-test('ak x provider status prints the dual-host guidance tips once both hosts are enabled', () => {
+test('ak x host status prints the dual-host guidance tips once both hosts are enabled', () => {
   const { home, project } = sandbox({ hosts: { claude: true, codex: true } });
-  const r = ak(['x', 'provider', 'status'], { cwd: project, home });
+  const r = ak(['x', 'host', 'status'], { cwd: project, home });
   assert.equal(r.status, 0, r.stderr);
   assert.ok(r.stdout.includes(DUAL_ROLE_TIP), 'dual-role tip printed');
   assert.ok(r.stdout.includes(JUDGE_BIAS_TIP), 'judge-bias tip printed');
   rm(home, project);
 });
 
-test('ak x provider status omits the dual-host guidance tips with only one host enabled', () => {
+test('ak x host status omits the dual-host guidance tips with only one host enabled', () => {
   const { home, project } = sandbox({ hosts: { claude: true, codex: false } });
-  const r = ak(['x', 'provider', 'status'], { cwd: project, home });
+  const r = ak(['x', 'host', 'status'], { cwd: project, home });
   assert.equal(r.status, 0, r.stderr);
   assert.ok(!r.stdout.includes(DUAL_ROLE_TIP), 'dual-role tip withheld');
   assert.ok(!r.stdout.includes(JUDGE_BIAS_TIP), 'judge-bias tip withheld');
@@ -126,12 +128,28 @@ function fakeCatalog(root) {
 /** A sandbox whose kit.json carries a FRESH versionCheck cache (the post-command
  *  drift nudge then never reaches the network), plus fake claude/opencode CLIs
  *  and a fixture catalog. */
-function pickSandbox({ hosts, providers = {} }) {
+function pickSandbox({
+  hosts,
+  providers = {},
+  routing = {},
+  ownership = {},
+}) {
   const home = fs.mkdtempSync(path.join(os.tmpdir(), 'kit-pick-home-'));
   const cfgDir = path.join(home, '.config', 'agentic-kit');
   fs.mkdirSync(cfgDir, { recursive: true });
   fs.writeFileSync(path.join(cfgDir, 'kit.json'), JSON.stringify({
-    providers: { hosts, ...providers },
+    integrations: {
+      version: 2,
+      hosts: { opencode: false, ...hosts },
+      bindings: [],
+      ownership,
+    },
+    routing: {
+      version: 1,
+      primaryHost: routing.primaryHost ?? 'claude',
+      routes: routing.routes ?? {},
+    },
+    providers,
     versionCheck: {
       ttlHours: 24, last: Date.now(),
       seen: { ruflo: '9.9.9', 'agentic-qe': '9.9.9' },
@@ -181,7 +199,7 @@ test('pick --host claude,opencode enables + wires opencode (config, plugin, agen
       mcp: { 'my-server': { type: 'local', command: ['x'] } },
     }, null, 2));
 
-    const r = akPick(['x', 'provider', 'pick', '--host', 'claude,opencode', '--yes'], sb);
+    const r = akPick(['x', 'host', 'pick', '--host', 'claude,opencode', '--yes'], sb);
     assert.equal(r.status, 0, `pick failed\nstdout: ${r.stdout}\nstderr: ${r.stderr}`);
     assert.match(r.stdout, /restart opencode to load the hooks/, 'restart guidance printed after wiring');
 
@@ -202,9 +220,9 @@ test('pick --host claude,opencode enables + wires opencode (config, plugin, agen
       'enablement-gated guidance converges on enable — "wired + guided" is one contract');
 
     const cfg = kitJson(sb.home);
-    assert.deepEqual(cfg.providers.hosts, { claude: true, codex: false, opencode: true });
-    assert.equal(cfg.providers.opencodeMcp, 'ak', 'ownership marker persisted');
-    assert.ok(cfg.providers.opencodeManaged?.mcp?.['claude-flow']?.written, 'value-precise ownership recorded');
+    assert.deepEqual(cfg.integrations.hosts, { claude: true, codex: false, opencode: true });
+    assert.equal(cfg.integrations.ownership.opencode.mcp, 'ak', 'ownership marker persisted');
+    assert.ok(cfg.integrations.ownership.opencode.managed?.mcp?.['claude-flow']?.written, 'value-precise ownership recorded');
   } finally {
     rm(sb.home, sb.project);
   }
@@ -220,11 +238,11 @@ test('pick --host claude on an opencode-enabled machine disables it: ak wiring s
     fs.mkdirSync(agentsDir, { recursive: true });
     fs.writeFileSync(path.join(agentsDir, 'my-agent.md'), '---\ndescription: mine\n---\n\nUser agent.\n');
 
-    const on = akPick(['x', 'provider', 'pick', '--host', 'claude,opencode', '--yes'], sb);
+    const on = akPick(['x', 'host', 'pick', '--host', 'claude,opencode', '--yes'], sb);
     assert.equal(on.status, 0, on.stderr);
     assert.ok(fs.existsSync(path.join(agentsDir, 'coder.md')), 'ak agents deployed in the enable run');
 
-    const off = akPick(['x', 'provider', 'pick', '--host', 'claude', '--yes'], sb);
+    const off = akPick(['x', 'host', 'pick', '--host', 'claude', '--yes'], sb);
     assert.equal(off.status, 0, `disable failed\nstdout: ${off.stdout}\nstderr: ${off.stderr}`);
     assert.match(off.stdout, /opencode disabled/, 'disable is reported, never silent');
 
@@ -239,21 +257,24 @@ test('pick --host claude on an opencode-enabled machine disables it: ak wiring s
       'ak plugin removed');
 
     const cfg = kitJson(sb.home);
-    assert.deepEqual(cfg.providers.hosts, { claude: true, codex: false, opencode: false });
-    assert.equal(cfg.providers.opencodeMcp, null, 'ownership markers nulled on disable');
-    assert.equal(cfg.providers.opencodeManaged, null);
+    assert.deepEqual(cfg.integrations.hosts, { claude: true, codex: false, opencode: false });
+    assert.equal(cfg.integrations.ownership.opencode.mcp, null, 'ownership markers nulled on disable');
+    assert.equal(cfg.integrations.ownership.opencode.managed, null);
   } finally {
     rm(sb.home, sb.project);
   }
 });
 
 test('pick --primary-host opencode is rejected; the prior primary is left unchanged', () => {
-  const sb = pickSandbox({ hosts: { claude: true, codex: false }, providers: { primaryHost: 'claude' } });
+  const sb = pickSandbox({
+    hosts: { claude: true, codex: false },
+    routing: { primaryHost: 'claude' },
+  });
   try {
-    const r = akPick(['x', 'provider', 'pick', '--host', 'claude', '--primary-host', 'opencode', '--yes'], sb);
+    const r = akPick(['x', 'host', 'pick', '--host', 'claude', '--primary-host', 'opencode', '--yes'], sb);
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.stdout, /unknown primary host 'opencode'/, 'rejection is explained');
-    assert.notEqual(kitJson(sb.home).providers.primaryHost, 'opencode', 'opencode can never become primary');
+    assert.notEqual(kitJson(sb.home).routing.primaryHost, 'opencode', 'opencode can never become primary');
   } finally {
     rm(sb.home, sb.project);
   }
@@ -262,16 +283,40 @@ test('pick --primary-host opencode is rejected; the prior primary is left unchan
 test('a provider retune preserves every ownership marker (codex MCP bridges + opencode wiring)', () => {
   const sb = pickSandbox({
     hosts: { claude: true, codex: false, opencode: false },
-    providers: { codexMcp: 'ak', rufloCodexMcp: 'ak', opencodeCatalogDir: '/custom/catalog' },
+    ownership: {
+      codex: { mcp: 'ak', reverseMcp: 'ak' },
+      opencode: { catalogDir: '/custom/catalog' },
+    },
   });
   try {
-    const r = akPick(['x', 'provider', 'pick', '--aqe-provider', 'openai', '--yes'], sb);
+    const r = akPick(['x', 'host', 'pick', '--aqe-provider', 'openai', '--yes'], sb);
     assert.equal(r.status, 0, r.stderr);
-    const p = kitJson(sb.home).providers;
-    assert.equal(p.codexMcp, 'ak', 'codexMcp marker survives a rewrite');
-    assert.equal(p.rufloCodexMcp, 'ak', 'rufloCodexMcp marker survives a rewrite');
-    assert.equal(p.opencodeCatalogDir, '/custom/catalog', 'catalog override survives a rewrite');
-    assert.equal(p.aqeProvider, 'openai', 'the actual retune landed');
+    const cfg = kitJson(sb.home);
+    assert.equal(cfg.integrations.ownership.codex.mcp, 'ak', 'codex MCP marker survives a rewrite');
+    assert.equal(cfg.integrations.ownership.codex.reverseMcp, 'ak', 'reverse MCP marker survives a rewrite');
+    assert.equal(cfg.integrations.ownership.opencode.catalogDir, '/custom/catalog', 'catalog override survives a rewrite');
+    assert.equal(cfg.providers.aqeProvider, 'openai', 'the actual retune landed');
+  } finally {
+    rm(sb.home, sb.project);
+  }
+});
+
+test('host off clears the OpenCode catalog override after a successful teardown', () => {
+  const sb = pickSandbox({
+    hosts: { claude: true, codex: false, opencode: false },
+    ownership: {
+      opencode: { catalogDir: '/custom/catalog', mcp: null, managed: null },
+    },
+  });
+  try {
+    const result = akPick(['x', 'host', 'off'], sb);
+    assert.equal(result.status, 0, `off failed\nstdout: ${result.stdout}\nstderr: ${result.stderr}`);
+    const cfg = kitJson(sb.home);
+    assert.equal(
+      Object.hasOwn(cfg.integrations.ownership.opencode, 'catalogDir'),
+      false,
+      'off restores the pre-GA reset behavior after the teardown receipt is no longer needed',
+    );
   } finally {
     rm(sb.home, sb.project);
   }
@@ -280,23 +325,25 @@ test('a provider retune preserves every ownership marker (codex MCP bridges + op
 test('excluding codex tears down only owned bridges and removes disabled routes', () => {
   const sb = pickSandbox({
     hosts: { claude: true, codex: true, opencode: false },
-    providers: {
-      codexMcp: 'ak', rufloCodexMcp: 'ak',
-      dualRouting: {
-        implementation: { host: 'codex', model: 'gpt-5.4', source: 'seeded' },
-        testing: { host: 'claude', model: 'claude-sonnet-5', source: 'user', escalate: [{ host: 'codex', model: 'gpt-5.4' }] },
+    ownership: { codex: { mcp: 'ak', reverseMcp: 'ak' } },
+    routing: {
+      routes: {
+        implementation: { host: 'codex', model: 'gpt-5.4', provenance: 'seeded' },
+        testing: { host: 'claude', model: 'claude-sonnet-5', provenance: 'user', escalation: [{ host: 'codex', model: 'gpt-5.4' }] },
       },
     },
   });
   try {
-    const r = akPick(['x', 'provider', 'pick', '--host', 'claude', '--yes'], sb);
+    const r = akPick(['x', 'host', 'pick', '--host', 'claude', '--yes'], sb);
     assert.equal(r.status, 0, `disable failed\nstdout: ${r.stdout}\nstderr: ${r.stderr}`);
     assert.match(r.stdout, /removed user escalation.*codex.*disabled/);
-    const p = kitJson(sb.home).providers;
-    assert.equal(p.codexMcp, null);
-    assert.equal(p.rufloCodexMcp, null);
-    assert.equal(p.dualRouting.implementation, undefined);
-    assert.deepEqual(p.dualRouting.testing, { host: 'claude', model: 'claude-sonnet-5', source: 'user' });
+    const cfg = kitJson(sb.home);
+    assert.equal(cfg.integrations.ownership.codex.mcp, null);
+    assert.equal(cfg.integrations.ownership.codex.reverseMcp, null);
+    assert.equal(cfg.routing.routes.implementation, undefined);
+    assert.deepEqual(cfg.routing.routes.testing, {
+      host: 'claude', model: 'claude-sonnet-5', provenance: 'user',
+    });
   } finally {
     rm(sb.home, sb.project);
   }
@@ -305,18 +352,18 @@ test('excluding codex tears down only owned bridges and removes disabled routes'
 test('excluding claude keeps codex-owned bridges while pruning claude routes', () => {
   const sb = pickSandbox({
     hosts: { claude: true, codex: true, opencode: false },
-    providers: {
-      codexMcp: 'ak', rufloCodexMcp: 'ak',
-      dualRouting: { review: { host: 'claude', model: 'claude-sonnet-5', source: 'seeded' } },
+    ownership: { codex: { mcp: 'ak', reverseMcp: 'ak' } },
+    routing: {
+      routes: { review: { host: 'claude', model: 'claude-sonnet-5', provenance: 'seeded' } },
     },
   });
   try {
-    const r = akPick(['x', 'provider', 'pick', '--host', 'codex', '--yes'], sb);
+    const r = akPick(['x', 'host', 'pick', '--host', 'codex', '--yes'], sb);
     assert.equal(r.status, 0, r.stderr);
-    const p = kitJson(sb.home).providers;
-    assert.equal(p.dualRouting.review, undefined);
-    assert.equal(p.codexMcp, 'ak');
-    assert.equal(p.rufloCodexMcp, 'ak');
+    const cfg = kitJson(sb.home);
+    assert.equal(cfg.routing.routes.review, undefined);
+    assert.equal(cfg.integrations.ownership.codex.mcp, 'ak');
+    assert.equal(cfg.integrations.ownership.codex.reverseMcp, 'ak');
   } finally {
     rm(sb.home, sb.project);
   }
@@ -326,11 +373,11 @@ test('interactive pick keeps installed OpenCode opt-in until explicitly selected
   const sb = pickSandbox({ hosts: { claude: true, codex: false, opencode: false } });
   try {
     // Blank answers to every prompt: accept the defaults.
-    const r = akPick(['x', 'provider', 'pick'], sb, { input: '\n\n\n\n' });
+    const r = akPick(['x', 'host', 'pick'], sb, { input: '\n\n\n\n' });
     assert.equal(r.status, 0, `interactive pick failed\nstdout: ${r.stdout}\nstderr: ${r.stderr}`);
     assert.match(r.stdout, /opencode is available; type it to opt in/,
       'OpenCode is displayed but not implicitly enabled');
-    assert.equal(kitJson(sb.home).providers.hosts.opencode, false,
+    assert.equal(kitJson(sb.home).integrations.hosts.opencode, false,
       'a bare enter must not opt a third host in sight unseen');
   } finally {
     rm(sb.home, sb.project);
@@ -340,9 +387,9 @@ test('interactive pick keeps installed OpenCode opt-in until explicitly selected
 test('interactive pick: an already-enabled opencode stays enabled on a bare enter', () => {
   const sb = pickSandbox({ hosts: { claude: true, codex: false, opencode: true } });
   try {
-    const r = akPick(['x', 'provider', 'pick'], sb, { input: '\n\n\n\n' });
+    const r = akPick(['x', 'host', 'pick'], sb, { input: '\n\n\n\n' });
     assert.equal(r.status, 0, `interactive pick failed\nstdout: ${r.stdout}\nstderr: ${r.stderr}`);
-    assert.equal(kitJson(sb.home).providers.hosts.opencode, true,
+    assert.equal(kitJson(sb.home).integrations.hosts.opencode, true,
       'enabled opencode is part of the default set and survives a retune');
   } finally {
     rm(sb.home, sb.project);
@@ -352,13 +399,13 @@ test('interactive pick: an already-enabled opencode stays enabled on a bare ente
 test('an unknown --host token is a hard error BEFORE any mutation (a typo never tears a host down)', () => {
   const sb = pickSandbox({ hosts: { claude: true, codex: false } });
   try {
-    const on = akPick(['x', 'provider', 'pick', '--host', 'claude,opencode', '--yes'], sb);
+    const on = akPick(['x', 'host', 'pick', '--host', 'claude,opencode', '--yes'], sb);
     assert.equal(on.status, 0, on.stderr);
     const kitPath = path.join(sb.home, '.config', 'agentic-kit', 'kit.json');
     const wiredCfg = fs.readFileSync(kitPath, 'utf8');
     const wiredOc = fs.readFileSync(ocJsonPath(sb.home), 'utf8');
 
-    const r = akPick(['x', 'provider', 'pick', '--host', 'claude,opencdoe', '--yes'], sb);
+    const r = akPick(['x', 'host', 'pick', '--host', 'claude,opencdoe', '--yes'], sb);
     assert.equal(r.status, 2, `a typo'd host set must fail, got ${r.status}`);
     assert.match(r.stdout + r.stderr, /unknown host\(s\): opencdoe/);
     assert.equal(fs.readFileSync(kitPath, 'utf8'), wiredCfg, 'kit.json untouched');
@@ -371,19 +418,19 @@ test('an unknown --host token is a hard error BEFORE any mutation (a typo never
 test('disable against a JSONC config warns honestly and RETAINS the markers (never claims disabled over live wiring)', () => {
   const sb = pickSandbox({ hosts: { claude: true, codex: false } });
   try {
-    const on = akPick(['x', 'provider', 'pick', '--host', 'claude,opencode', '--yes'], sb);
+    const on = akPick(['x', 'host', 'pick', '--host', 'claude,opencode', '--yes'], sb);
     assert.equal(on.status, 0, on.stderr);
     // Make the config unparseable (legal JSONC) after wiring.
     fs.writeFileSync(ocJsonPath(sb.home), '{\n  // user converted this file to JSONC\n  "mcp": {}\n}\n');
 
-    const off = akPick(['x', 'provider', 'pick', '--host', 'claude', '--yes'], sb);
+    const off = akPick(['x', 'host', 'pick', '--host', 'claude', '--yes'], sb);
     assert.equal(off.status, 1, 'automation must be able to detect incomplete teardown');
     assert.match(off.stdout, /opencode disable incomplete/, 'the incomplete teardown is surfaced, never hidden');
     assert.ok(!/opencode disabled:/.test(off.stdout), '"disabled" is never claimed over active wiring');
-    const p = kitJson(sb.home).providers;
-    assert.equal(p.hosts.opencode, false, 'the enablement intent still flips (user asked)');
-    assert.equal(p.opencodeMcp, 'ak', 'markers RETAINED for the retry — teardown proof is never nulled over live wiring');
-    assert.ok(p.opencodeManaged?.mcp?.['claude-flow'], 'value-precise records survive');
+    const cfg = kitJson(sb.home);
+    assert.equal(cfg.integrations.hosts.opencode, false, 'the enablement intent still flips (user asked)');
+    assert.equal(cfg.integrations.ownership.opencode.mcp, 'ak', 'markers RETAINED for the retry — teardown proof is never nulled over live wiring');
+    assert.ok(cfg.integrations.ownership.opencode.managed?.mcp?.['claude-flow'], 'value-precise records survive');
     assert.match(fs.readFileSync(ocJsonPath(sb.home), 'utf8'), /JSONC/, 'the JSONC file itself is untouched');
   } finally {
     rm(sb.home, sb.project);
@@ -393,15 +440,15 @@ test('disable against a JSONC config warns honestly and RETAINS the markers (nev
 test('disable with the config file absent clears the stale markers (no phantom ownership)', () => {
   const sb = pickSandbox({ hosts: { claude: true, codex: false } });
   try {
-    const on = akPick(['x', 'provider', 'pick', '--host', 'claude,opencode', '--yes'], sb);
+    const on = akPick(['x', 'host', 'pick', '--host', 'claude,opencode', '--yes'], sb);
     assert.equal(on.status, 0, on.stderr);
     fs.rmSync(ocJsonPath(sb.home), { force: true }); // user deleted the config
 
-    const off = akPick(['x', 'provider', 'pick', '--host', 'claude', '--yes'], sb);
+    const off = akPick(['x', 'host', 'pick', '--host', 'claude', '--yes'], sb);
     assert.equal(off.status, 0, off.stderr);
-    const p = kitJson(sb.home).providers;
-    assert.equal(p.opencodeMcp, null, 'markers cleared — nothing left to own');
-    assert.equal(p.opencodeManaged, null);
+    const ownership = kitJson(sb.home).integrations.ownership.opencode;
+    assert.equal(ownership.mcp, null, 'markers cleared — nothing left to own');
+    assert.equal(ownership.managed, null);
   } finally {
     rm(sb.home, sb.project);
   }
@@ -414,10 +461,10 @@ test('interactive pick: an enabled host absent from PATH right now is kept enabl
     fs.rmSync(path.join(sb.binDir, 'opencode'), { force: true });
     fs.rmSync(path.join(sb.binDir, 'opencode.cmd'), { force: true });
     fs.rmSync(path.join(sb.binDir, 'opencode.ps1'), { force: true });
-    const r = akPick(['x', 'provider', 'pick'], sb, { input: '\n\n\n\n' });
+    const r = akPick(['x', 'host', 'pick'], sb, { input: '\n\n\n\n' });
     assert.equal(r.status, 0, `interactive pick failed\nstdout: ${r.stdout}\nstderr: ${r.stderr}`);
     assert.match(r.stdout, /enabled but not detected right now: opencode \(kept enabled on Enter\)/);
-    assert.equal(kitJson(sb.home).providers.hosts.opencode, true,
+    assert.equal(kitJson(sb.home).integrations.hosts.opencode, true,
       'an absent host is never torn down by invisibility');
   } finally {
     rm(sb.home, sb.project);
@@ -427,20 +474,20 @@ test('interactive pick: an enabled host absent from PATH right now is kept enabl
 test('a converged re-pick re-persists stale/missing ownership markers (teardown keeps its proof)', () => {
   const sb = pickSandbox({ hosts: { claude: true, codex: false } });
   try {
-    const on = akPick(['x', 'provider', 'pick', '--host', 'claude,opencode', '--yes'], sb);
+    const on = akPick(['x', 'host', 'pick', '--host', 'claude,opencode', '--yes'], sb);
     assert.equal(on.status, 0, on.stderr);
     // Stale the markers out of kit.json while the file stays converged.
     const kitPath = path.join(sb.home, '.config', 'agentic-kit', 'kit.json');
     const cfg = kitJson(sb.home);
-    cfg.providers.opencodeMcp = null;
-    cfg.providers.opencodeManaged = null;
+    cfg.integrations.ownership.opencode.mcp = null;
+    cfg.integrations.ownership.opencode.managed = null;
     fs.writeFileSync(kitPath, JSON.stringify(cfg, null, 2));
 
-    const again = akPick(['x', 'provider', 'pick', '--host', 'claude,opencode', '--yes'], sb);
+    const again = akPick(['x', 'host', 'pick', '--host', 'claude,opencode', '--yes'], sb);
     assert.equal(again.status, 0, again.stderr);
-    const after = kitJson(sb.home).providers;
-    assert.equal(after.opencodeMcp, 'ak', 'the marker is re-persisted even though the file was converged');
-    assert.ok(after.opencodeManaged?.mcp?.['claude-flow']?.written, 'value-precise ownership restored');
+    const after = kitJson(sb.home).integrations.ownership.opencode;
+    assert.equal(after.mcp, 'ak', 'the marker is re-persisted even though the file was converged');
+    assert.ok(after.managed?.mcp?.['claude-flow']?.written, 'value-precise ownership restored');
   } finally {
     rm(sb.home, sb.project);
   }
diff --git a/tests/kit/provider-credentials.test.mjs b/tests/kit/provider-credentials.test.mjs
index 7ee4fc9..696d37b 100644
--- a/tests/kit/provider-credentials.test.mjs
+++ b/tests/kit/provider-credentials.test.mjs
@@ -268,7 +268,7 @@ test('credentialGaps propagates an injected host-auth failure across the whole c
   assert.deepEqual(gaps.map((g) => g.provider), ['claude-code', 'openai']);
 });
 
-// ── detectAqeProviders (what `ak x provider status` renders) ────────────────
+// ── detectAqeProviders (what `ak x host status` renders) ───────────────────
 
 test('detectAqeProviders covers every aqe provider type', () => {
   const got = detectAqeProviders({ env: BARE_ENV });
diff --git a/tests/kit/provider-refresh-cli.test.mjs b/tests/kit/provider-refresh-cli.test.mjs
index 55099b9..abdda5e 100644
--- a/tests/kit/provider-refresh-cli.test.mjs
+++ b/tests/kit/provider-refresh-cli.test.mjs
@@ -1,6 +1,6 @@
 // The user-facing halves of #54 and #55, exercised through a real CLI spawn.
 //
-// `ak x provider status` is read-only, and `refresh` only ever writes kit.json +
+// `ak x host status` is read-only, and `refresh` only ever writes kit.json +
 // the sandbox project's llm-config.json, so both are safe to run for real here
 // (unlike `pick`, which can trigger installs). Everything is redirected at a
 // throwaway HOME — see provider-cli.test.mjs for why all four env vars matter.
@@ -23,7 +23,7 @@ const ALL_CREDENTIAL_ENV = [...new Set(
   Object.values(AQE_PROVIDER_CREDENTIALS).flatMap((d) => [...(d.keyEnv ?? []), ...(d.also ?? [])]),
 )];
 
-function sandbox(providers) {
+function sandbox({ hosts = { claude: true, codex: false, opencode: false }, routes = {}, ...providers }) {
   const home = fs.mkdtempSync(path.join(os.tmpdir(), 'kit-refresh-home-'));
   const cfgDir = path.join(home, '.config', 'agentic-kit');
   fs.mkdirSync(cfgDir, { recursive: true });
@@ -34,6 +34,8 @@ function sandbox(providers) {
   // cache shape a completed drift probe would persist.
   const last = Date.now();
   fs.writeFileSync(path.join(cfgDir, 'kit.json'), JSON.stringify({
+    integrations: { version: 2, hosts, bindings: [] },
+    routing: { version: 1, primaryHost: 'claude', routes },
     providers,
     versionCheck: { last, seen: {}, self: { last, best: null } },
   }));
@@ -66,29 +68,29 @@ const FORBIDDEN_FRAMING = /\b(stale|outdated|superseded)\b/i;
  *  deliberate user pin that must survive everything. */
 const divergedProviders = () => ({
   hosts: { ...DUAL },
-  dualRouting: {
-    architecture: { host: 'claude', model: 'claude-opus-4-8', source: 'seeded' },
-    design: { host: 'claude', model: 'claude-opus-4-8', source: 'seeded' },
-    debugging: { host: 'claude', model: 'claude-opus-4-8', source: 'user' },
+  routes: {
+    architecture: { host: 'claude', model: 'claude-opus-4-8', provenance: 'seeded' },
+    design: { host: 'claude', model: 'claude-opus-4-8', provenance: 'seeded' },
+    debugging: { host: 'claude', model: 'claude-opus-4-8', provenance: 'user' },
   },
 });
 
-// ── #54: `ak x provider status` credential visibility ──────────────────────
+// ── #54: `ak x host status` credential visibility ──────────────────────────
 
-test('x provider status shows openrouter as credentialed when OPENROUTER_API_KEY is set', () => {
+test('x host status shows openrouter as credentialed when OPENROUTER_API_KEY is set', () => {
   // The reported machine's one live key was invisible to every ak surface,
   // while keyless openai displayed as a configured fallback.
   const { home, project } = sandbox({ hosts: { claude: true } });
-  const r = ak(['x', 'provider', 'status'], { cwd: project, home, env: { OPENROUTER_API_KEY: 'sk-test' } });
+  const r = ak(['x', 'host', 'status'], { cwd: project, home, env: { OPENROUTER_API_KEY: 'sk-test' } });
   const line = r.all.split('\n').find((l) => /^\s*openrouter\b/.test(l));
   assert.ok(line, `openrouter must appear in the provider table:\n${r.all}`);
   assert.match(line, /key present/, `openrouter is credentialed here, got: ${line}`);
   rm(home, project);
 });
 
-test('x provider status shows a keyless provider as having no key, naming the var', () => {
+test('x host status shows a keyless provider as having no key, naming the var', () => {
   const { home, project } = sandbox({ hosts: { claude: true } });
-  const r = ak(['x', 'provider', 'status'], { cwd: project, home });
+  const r = ak(['x', 'host', 'status'], { cwd: project, home });
   const line = r.all.split('\n').find((l) => /^\s*openai\b/.test(l));
   assert.ok(line, `openai must appear in the provider table:\n${r.all}`);
   assert.match(line, /no key/);
@@ -96,7 +98,7 @@ test('x provider status shows a keyless provider as having no key, naming the va
   rm(home, project);
 });
 
-test('x provider status warns that a keyless chain rung fails over into nothing', () => {
+test('x host status warns that a keyless chain rung fails over into nothing', () => {
   // The exact reproduction: claude-code + openai, no OPENAI_API_KEY.
   const { home, project } = sandbox({
     hosts: { ...DUAL },
@@ -105,27 +107,27 @@ test('x provider status warns that a keyless chain rung fails over into nothing'
       { provider: 'openai', models: ['gpt-5.6'] },
     ],
   });
-  const r = ak(['x', 'provider', 'status'], { cwd: project, home });
+  const r = ak(['x', 'host', 'status'], { cwd: project, home });
   assert.match(r.all, /openai.*no credential|no credential.*openai/is);
   assert.match(r.all, /fail over into nothing/i, 'the consequence must be stated, not just the gap');
   rm(home, project);
 });
 
-test('x provider status emits no credential warning when every rung is viable', () => {
+test('x host status emits no credential warning when every rung is viable', () => {
   const { home, project } = sandbox({
     hosts: { ...DUAL },
     aqeFallback: [{ provider: 'openrouter', models: ['z-ai/glm-5.2'] }],
   });
-  const r = ak(['x', 'provider', 'status'], { cwd: project, home, env: { OPENROUTER_API_KEY: 'sk-test' } });
+  const r = ak(['x', 'host', 'status'], { cwd: project, home, env: { OPENROUTER_API_KEY: 'sk-test' } });
   assert.ok(!/fail over into nothing/i.test(r.all), `unexpected warning:\n${r.all}`);
   rm(home, project);
 });
 
 // ── #55: divergence shown neutrally in the routing table ──────────────────
 
-test('x provider status marks a diverged seeded route against its current default', () => {
+test('x host status marks a diverged seeded route against its current default', () => {
   const { home, project } = sandbox(divergedProviders());
-  const r = ak(['x', 'provider', 'status'], { cwd: project, home });
+  const r = ak(['x', 'host', 'status'], { cwd: project, home });
   const line = r.all.split('\n').find((l) => /^\s*architecture\b/.test(l));
   assert.ok(line, `routing table must list architecture:\n${r.all}`);
   assert.match(line, /diverges from default/i);
@@ -133,97 +135,97 @@ test('x provider status marks a diverged seeded route against its current defaul
   rm(home, project);
 });
 
-test('x provider status never frames a diverged route as stale, outdated, or superseded', () => {
+test('x host status never frames a diverged route as stale, outdated, or superseded', () => {
   const { home, project } = sandbox(divergedProviders());
-  const r = ak(['x', 'provider', 'status'], { cwd: project, home });
+  const r = ak(['x', 'host', 'status'], { cwd: project, home });
   for (const line of r.all.split('\n').filter((l) => /diverge/i.test(l))) {
     assert.ok(!FORBIDDEN_FRAMING.test(line), `neutral framing violated: ${line}`);
   }
   rm(home, project);
 });
 
-test('x provider status does not mark a user-pinned older model as diverged', () => {
+test('x host status does not mark a user-pinned older model as diverged', () => {
   const { home, project } = sandbox(divergedProviders());
-  const r = ak(['x', 'provider', 'status'], { cwd: project, home });
+  const r = ak(['x', 'host', 'status'], { cwd: project, home });
   const line = r.all.split('\n').find((l) => /^\s*debugging\b/.test(l));
   assert.ok(line, `routing table must list debugging:\n${r.all}`);
   assert.ok(!/diverges from default/i.test(line), `a deliberate pin is not drift: ${line}`);
   rm(home, project);
 });
 
-// ── #55: `ak x provider refresh` ──────────────────────────────────────────
+// ── #55: `ak x host refresh` ───────────────────────────────────────────────
 
-test('x provider refresh re-seeds only the activities named with --activity', () => {
+test('x host refresh re-seeds only the activities named with --activity', () => {
   const { home, project } = sandbox(divergedProviders());
-  const r = ak(['x', 'provider', 'refresh', '--activity', 'architecture'], { cwd: project, home });
+  const r = ak(['x', 'host', 'refresh', '--activity', 'architecture'], { cwd: project, home });
   assert.equal(r.status, 0, r.all);
-  const routing = readKit(home).providers.dualRouting;
+  const routing = readKit(home).routing.routes;
   assert.equal(routing.architecture.model, DEFAULT_ROUTES.architecture.model, 'named route refreshed');
   assert.equal(routing.design.model, 'claude-opus-4-8', 'unnamed route deliberately left as it was');
   rm(home, project);
 });
 
-test('x provider refresh leaves a user-pinned route untouched even when named', () => {
+test('x host refresh leaves a user-pinned route untouched even when named', () => {
   const { home, project } = sandbox(divergedProviders());
-  ak(['x', 'provider', 'refresh', '--activity', 'debugging'], { cwd: project, home });
-  const routing = readKit(home).providers.dualRouting;
+  ak(['x', 'host', 'refresh', '--activity', 'debugging'], { cwd: project, home });
+  const routing = readKit(home).routing.routes;
   assert.equal(routing.debugging.model, 'claude-opus-4-8');
-  assert.equal(routing.debugging.source, 'user');
+  assert.equal(routing.debugging.provenance, 'user');
   rm(home, project);
 });
 
-test('x provider refresh --yes re-seeds every diverged route and converges', () => {
+test('x host refresh --yes re-seeds every diverged route and converges', () => {
   const { home, project } = sandbox(divergedProviders());
-  const r = ak(['x', 'provider', 'refresh', '--yes'], { cwd: project, home });
+  const r = ak(['x', 'host', 'refresh', '--yes'], { cwd: project, home });
   assert.equal(r.status, 0, r.all);
-  const routing = readKit(home).providers.dualRouting;
+  const routing = readKit(home).routing.routes;
   assert.equal(routing.architecture.model, DEFAULT_ROUTES.architecture.model);
   assert.equal(routing.design.model, DEFAULT_ROUTES.design.model);
   assert.equal(routing.debugging.model, 'claude-opus-4-8', 'user pins survive an all-refresh');
 
-  const second = ak(['x', 'provider', 'refresh'], { cwd: project, home });
+  const second = ak(['x', 'host', 'refresh'], { cwd: project, home });
   assert.match(second.all, /no seeded routes diverge/i, 'refreshing converges — the second run is a no-op');
   rm(home, project);
 });
 
-test('x provider refresh prints the cost-per-task trade for BOTH models, not just ids', () => {
+test('x host refresh prints the cost-per-task trade for BOTH models, not just ids', () => {
   // The whole point of the neutral framing: the user is being handed a decision
   // that genuinely goes both ways, so both sides need their characteristic.
   const { home, project } = sandbox(divergedProviders());
-  const r = ak(['x', 'provider', 'refresh', '--activity', 'architecture'], { cwd: project, home });
+  const r = ak(['x', 'host', 'refresh', '--activity', 'architecture'], { cwd: project, home });
   assert.match(r.all, /turns/i, 'the work-per-task axis must appear, not only price');
   assert.match(r.all, /claude-opus-4-8/);
   assert.match(r.all, new RegExp(DEFAULT_ROUTES.architecture.model));
   rm(home, project);
 });
 
-test('x provider refresh is a no-op on a policy seeded from current defaults', () => {
+test('x host refresh is a no-op on a policy seeded from current defaults', () => {
   const { home, project } = sandbox({
     hosts: { ...DUAL },
-    dualRouting: {
-      architecture: { host: 'claude', model: DEFAULT_ROUTES.architecture.model, source: 'seeded' },
+    routes: {
+      architecture: { host: 'claude', model: DEFAULT_ROUTES.architecture.model, provenance: 'seeded' },
     },
   });
-  const r = ak(['x', 'provider', 'refresh', '--yes'], { cwd: project, home });
+  const r = ak(['x', 'host', 'refresh', '--yes'], { cwd: project, home });
   assert.equal(r.status, 0);
   assert.match(r.all, /no seeded routes diverge/i);
   rm(home, project);
 });
 
-test('x provider refresh ignores an unknown activity instead of failing', () => {
+test('x host refresh ignores an unknown activity instead of failing', () => {
   const { home, project } = sandbox(divergedProviders());
-  const r = ak(['x', 'provider', 'refresh', '--activity', 'not-an-activity'], { cwd: project, home });
+  const r = ak(['x', 'host', 'refresh', '--activity', 'not-an-activity'], { cwd: project, home });
   assert.equal(r.status, 0, r.all);
   assert.match(r.all, /unknown activity/i);
-  assert.equal(readKit(home).providers.dualRouting.architecture.model, 'claude-opus-4-8', 'nothing refreshed');
+  assert.equal(readKit(home).routing.routes.architecture.model, 'claude-opus-4-8', 'nothing refreshed');
   rm(home, project);
 });
 
 test('refresh is advertised as a subcommand and rejects an unknown one', () => {
   const { home, project } = sandbox({ hosts: { claude: true } });
-  const help = ak(['x', 'provider', '--help'], { cwd: project, home });
+  const help = ak(['x', 'host', '--help'], { cwd: project, home });
   assert.match(help.all, /refresh/, 'the opt-in path must be discoverable');
-  const bad = ak(['x', 'provider', 'bogus'], { cwd: project, home });
+  const bad = ak(['x', 'host', 'bogus'], { cwd: project, home });
   assert.match(bad.all, /status\|pick\|refresh\|off/);
   rm(home, project);
 });
diff --git a/tests/kit/providers.test.mjs b/tests/kit/providers.test.mjs
index 59b20b4..57284e6 100644
--- a/tests/kit/providers.test.mjs
+++ b/tests/kit/providers.test.mjs
@@ -8,9 +8,9 @@ import { loadKitConfig } from '../../src/lib/config.mjs';
 import {
   isDefault, managedEnv, applyHosts, undoProviders, MANAGED_ENV_KEYS,
   HOSTS, installHost, applyAqeRouter, undoAqeRouter, aqeRouterFile,
-  CODEX_ADAPTER_PKG, codexAdapterAction, ensureCodexAdapter, AQE_PROVIDER_TYPES,
-  bothHostsEnabled, suggestedFallbackFor, AQE_FALLBACK_CODEX_SUGGESTION,
-  PROVIDER_TOKEN_RE, seedDualRoutingIfDualHost,
+  AQE_PROVIDER_TYPES,
+  bothHostsEnabled, DUAL_ROLE_TIP, suggestedFallbackFor, AQE_FALLBACK_CODEX_SUGGESTION,
+  PROVIDER_TOKEN_RE, seedActivityRoutesIfMultiHost,
 } from '../../src/lib/providers.mjs';
 import * as paths from '../../src/lib/paths.mjs';
 import { managedHostIds, routableHostIds } from '../../src/lib/adapters/index.mjs';
@@ -58,13 +58,13 @@ test('isDefault is true for the claude-only default config', () => {
 
 test('isDefault is false once codex is enabled', () => {
   const cfg = defaultCfg();
-  cfg.providers.hosts.codex = true;
+  cfg.integrations.hosts.codex = true;
   assert.equal(isDefault(cfg), false);
 });
 
 test('managedEnv leaves AQE_LLM_PROVIDER unset when no aqe provider is pinned', () => {
   const cfg = defaultCfg();
-  cfg.providers.hosts.codex = true; // host axis is independent of the aqe provider
+  cfg.integrations.hosts.codex = true; // host axis is independent of the aqe provider
   const env = managedEnv(cfg);
   assert.equal(env.ENABLE_CLAUDE_CODE, 'true');
   assert.equal(env.ENABLE_CODEX, 'true');
@@ -87,7 +87,7 @@ test('managedEnv ignores an unknown aqe provider value', () => {
 
 test('managedEnv adds AQE_MAX_BUDGET_USD only when a budget is set', () => {
   const cfg = defaultCfg();
-  cfg.providers.hosts.codex = true;
+  cfg.integrations.hosts.codex = true;
   cfg.providers.maxBudgetUsd = 5;
   assert.equal(managedEnv(cfg).AQE_MAX_BUDGET_USD, '5');
 });
@@ -106,7 +106,7 @@ test('applyHosts writes managed env into project settings.local.json when codex
   fs.mkdirSync(path.dirname(localFile(dir)), { recursive: true });
   fs.writeFileSync(localFile(dir), JSON.stringify({ env: { FOO: 'bar' } }));
   const cfg = defaultCfg();
-  cfg.providers.hosts.codex = true;
+  cfg.integrations.hosts.codex = true;
   // Act
   const res = applyHosts(cfg, dir);
   // Assert
@@ -121,7 +121,7 @@ test('applyHosts writes managed env into project settings.local.json when codex
 test('applyHosts is idempotent — second run reports no change', () => {
   const dir = tmpProject();
   const cfg = defaultCfg();
-  cfg.providers.hosts.codex = true;
+  cfg.integrations.hosts.codex = true;
   applyHosts(cfg, dir);
   const second = applyHosts(cfg, dir);
   assert.equal(second.changed, false);
@@ -131,7 +131,7 @@ test('applyHosts is idempotent — second run reports no change', () => {
 test('undoProviders strips every managed key and leaves others intact', () => {
   const dir = tmpProject();
   const cfg = defaultCfg();
-  cfg.providers.hosts.codex = true;
+  cfg.integrations.hosts.codex = true;
   applyHosts(cfg, dir);
   // seed an unrelated key alongside the managed ones
   const seeded = readJson(localFile(dir));
@@ -231,13 +231,13 @@ test('installHost rejects an unknown host id without shelling out', async () =>
   assert.match(r.detail, /unknown host/);
 });
 
-test('config merge: providers partial merges over defaults (hosts deep-merged)', () => {
+test('config migration moves legacy provider hosts into canonical integrations', () => {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'kit-merge-'));
   const f = path.join(dir, 'kit.json');
   fs.writeFileSync(f, JSON.stringify({ providers: { hosts: { codex: true } } }));
   const cfg = loadKitConfig(f);
-  assert.equal(cfg.providers.hosts.codex, true, 'user value applied');
-  assert.equal(cfg.providers.hosts.claude, true, 'unspecified host keeps default');
+  assert.equal(cfg.integrations.hosts.codex, true, 'legacy user value applied');
+  assert.equal(cfg.integrations.hosts.claude, true, 'unspecified host keeps default');
   assert.equal(cfg.providers.aqeProvider, null, 'unspecified field keeps default');
   rm(dir);
 });
@@ -259,38 +259,9 @@ test('AQE_PROVIDER_TYPES mirrors aqe ALL_PROVIDER_TYPES (incl. local onnx)', ()
   assert.equal(AQE_PROVIDER_TYPES.includes('onnx'), true, 'onnx (local) is a valid aqe provider');
 });
 
-test('the codex host descriptor carries the dual-mode adapter package name', () => {
-  const codex = HOSTS.find((h) => h.id === 'codex');
-  assert.equal(codex.adapterPkg, CODEX_ADAPTER_PKG);
-  assert.equal(CODEX_ADAPTER_PKG, '@claude-flow/codex');
-});
-
-test('codexAdapterAction skips when codex host is not opted in', () => {
-  const action = codexAdapterAction({ opted: false, cliPresent: true, adapterInstalled: false });
-  assert.equal(action, 'skip-not-opted');
-});
-
-test('codexAdapterAction skips when opted in but the codex CLI is not detected', () => {
-  const action = codexAdapterAction({ opted: true, cliPresent: false, adapterInstalled: false });
-  assert.equal(action, 'skip-no-cli');
-});
-
-test('codexAdapterAction is a no-op when the adapter is already installed', () => {
-  const action = codexAdapterAction({ opted: true, cliPresent: true, adapterInstalled: true });
-  assert.equal(action, 'already-installed');
-});
-
-test('codexAdapterAction installs only when opted in, CLI present, adapter absent', () => {
-  const action = codexAdapterAction({ opted: true, cliPresent: true, adapterInstalled: false });
-  assert.equal(action, 'install');
-});
-
-test('ensureCodexAdapter is a no-op without shelling out when codex is disabled', async () => {
-  const cfg = defaultCfg(); // claude-only default → hosts.codex false
-  const res = await ensureCodexAdapter(cfg);
-  assert.equal(res.ok, true);
-  assert.equal(res.changed, false);
-  assert.match(res.detail, /codex disabled/);
+test('dual-host guidance points to the canonical ak run executor', () => {
+  assert.match(DUAL_ROLE_TIP, /ak run/);
+  assert.doesNotMatch(DUAL_ROLE_TIP, /claude-flow-codex|ruflo init --dual/);
 });
 
 // ── settingsTarget repo-root walk (scope-leak regression pin) ───────────────
@@ -303,13 +274,13 @@ test('bothHostsEnabled is false at the claude-only default', () => {
 
 test('bothHostsEnabled is false with only codex enabled', () => {
   const cfg = defaultCfg();
-  cfg.providers.hosts = { claude: false, codex: true };
+  cfg.integrations.hosts = { claude: false, codex: true };
   assert.equal(bothHostsEnabled(cfg), false);
 });
 
 test('bothHostsEnabled is true once both hosts are enabled', () => {
   const cfg = defaultCfg();
-  cfg.providers.hosts.codex = true;
+  cfg.integrations.hosts.codex = true;
   assert.equal(bothHostsEnabled(cfg), true);
 });
 
@@ -325,7 +296,7 @@ test('suggestedFallbackFor returns null when codex is not among the enabled host
 // ADR-0017 two-tier model: all three hosts coexist in one enabled set, but the
 // seeded per-activity policy only ever names the ROUTING pair. opencode is
 // additive — never a substitute for either routing host, never a route target.
-test('dual routing seeds claude/codex routes ONLY, even with opencode co-enabled', () => {
+test('activity routing seeds claude/codex routes only, even with opencode co-enabled', () => {
   const realRoot = paths.globalRoot();
   const fakeRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'kit-seed-root-'));
   // aqe ≥ 3.13.1 is the seed gate — fabricate just enough of the install.
@@ -333,10 +304,18 @@ test('dual routing seeds claude/codex routes ONLY, even with opencode co-enabled
   fs.writeFileSync(path.join(fakeRoot, 'agentic-qe', 'package.json'), JSON.stringify({ name: 'agentic-qe', version: '3.13.1' }));
   paths._setGlobalRootForTest(fakeRoot);
   try {
-    const cfg = { providers: { hosts: { claude: true, codex: true, opencode: true }, primaryHost: 'claude', dualRouting: {} } };
-    const seed = seedDualRoutingIfDualHost(cfg);
+    const cfg = {
+      integrations: {
+        version: 2,
+        hosts: { claude: true, codex: true, opencode: true },
+        bindings: [],
+      },
+      routing: { version: 1, primaryHost: 'claude', routes: {} },
+      providers: {},
+    };
+    const seed = seedActivityRoutesIfMultiHost(cfg);
     assert.equal(seed.seeded, true, 'dual-host seed runs with opencode alongside');
-    const policy = cfg.providers.dualRouting;
+    const policy = cfg.routing.routes;
     assert.ok(Object.keys(policy).length > 0);
     assert.ok(!JSON.stringify(policy).includes('opencode'),
       'opencode never appears in the routing policy (not a route target, not a model host)');
@@ -345,7 +324,7 @@ test('dual routing seeds claude/codex routes ONLY, even with opencode co-enabled
         `${activity} routes to a routing host, got ${route.host}`);
     }
     // …and the enablement flags themselves are untouched by seeding.
-    assert.equal(cfg.providers.hosts.opencode, true, 'opencode stays co-enabled — additive, not a substitute');
+    assert.equal(cfg.integrations.hosts.opencode, true, 'opencode stays co-enabled — additive, not a substitute');
   } finally {
     paths._setGlobalRootForTest(realRoot);
     fs.rmSync(fakeRoot, { recursive: true, force: true });
diff --git a/tests/kit/reverse-bridge.test.mjs b/tests/kit/reverse-bridge.test.mjs
index 0579ec8..17f45fe 100644
--- a/tests/kit/reverse-bridge.test.mjs
+++ b/tests/kit/reverse-bridge.test.mjs
@@ -35,8 +35,10 @@ test('rufloCodexMcpStatus reports not-registered when config.toml is missing', (
 
 test('rufloCodexMcpStatus reflects ak ownership from the kit.json marker', () => {
   const home = tempHome('[mcp_servers.ruflo]\n');
-  const owned = rufloCodexMcpStatus({ providers: { rufloCodexMcp: 'ak' } }, { home });
-  const unowned = rufloCodexMcpStatus({ providers: {} }, { home });
+  const owned = rufloCodexMcpStatus({
+    integrations: { ownership: { codex: { reverseMcp: 'ak' } } },
+  }, { home });
+  const unowned = rufloCodexMcpStatus({ integrations: {} }, { home });
   assert.equal(owned.owned, true);
   assert.equal(unowned.owned, false);
 });
diff --git a/tests/kit/routing-config.test.mjs b/tests/kit/routing-config.test.mjs
new file mode 100644
index 0000000..babd30c
--- /dev/null
+++ b/tests/kit/routing-config.test.mjs
@@ -0,0 +1,212 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import {
+  ROUTING_SCHEMA_VERSION,
+  legacyRoutesToCanonical,
+  migrateRoutingConfig,
+  routingIntent,
+} from '../../src/lib/routing-config.mjs';
+import { loadKitConfig, saveKitConfig } from '../../src/lib/config.mjs';
+
+test('legacy routes migrate without resolving absence and preserve an explicit empty ladder', () => {
+  const legacy = {
+    architecture: { host: 'claude', model: 'claude:custom', source: 'seeded' },
+    implementation: { host: 'codex', escalate: [] },
+    testing: {
+      host: 'codex',
+      source: 'user',
+      escalate: [
+        { host: 'claude', model: 'claude-opus-5' },
+        { host: 'codex', model: null },
+      ],
+    },
+  };
+  const input = structuredClone(legacy);
+  const routes = legacyRoutesToCanonical(input);
+  assert.deepEqual(input, legacy, 'conversion must be pure');
+  assert.deepEqual(routes.architecture, {
+    host: 'claude',
+    model: 'claude:custom',
+    provenance: 'seeded',
+  });
+  assert.deepEqual(routes.implementation, {
+    host: 'codex',
+    provenance: 'user',
+    escalation: [],
+  });
+  assert.deepEqual(routes.testing.escalation, [
+    { host: 'claude', model: 'claude-opus-5' },
+    { host: 'codex', model: null },
+  ]);
+});
+
+test('routing migration is one-way and idempotent', () => {
+  const legacy = {
+    providers: {
+      primaryHost: 'codex',
+      dualRouting: {
+        implementation: {
+          host: 'codex',
+          model: 'gpt-5.4',
+          source: 'user',
+          escalate: [{ host: 'claude', model: 'claude-opus-5' }],
+        },
+      },
+      aqeProvider: 'openai',
+    },
+  };
+  const first = migrateRoutingConfig(legacy);
+  assert.deepEqual(first.routing, {
+    version: ROUTING_SCHEMA_VERSION,
+    primaryHost: 'codex',
+    routes: {
+      implementation: {
+        host: 'codex',
+        model: 'gpt-5.4',
+        provenance: 'user',
+        escalation: [{ host: 'claude', model: 'claude-opus-5' }],
+      },
+    },
+  });
+  assert.equal(Object.hasOwn(first.providers, 'primaryHost'), false);
+  assert.equal(Object.hasOwn(first.providers, 'dualRouting'), false);
+  assert.equal(first.providers.aqeProvider, 'openai');
+  assert.deepEqual(migrateRoutingConfig(structuredClone(first)), first);
+});
+
+test('equivalent canonical and legacy routing converges; disagreement is a hard conflict', () => {
+  const routing = {
+    version: ROUTING_SCHEMA_VERSION,
+    primaryHost: 'claude',
+    routes: {
+      review: { host: 'claude', model: 'claude-sonnet-5', provenance: 'seeded' },
+    },
+  };
+  const equivalent = migrateRoutingConfig({
+    routing,
+    providers: {
+      primaryHost: 'claude',
+      dualRouting: {
+        review: { host: 'claude', model: 'claude-sonnet-5', source: 'seeded' },
+      },
+    },
+  });
+  assert.deepEqual(equivalent.routing, routing);
+  assert.deepEqual(equivalent.providers, {});
+
+  assert.throws(() => migrateRoutingConfig({
+    routing,
+    providers: {
+      dualRouting: {
+        review: { host: 'codex', model: 'gpt-5.4', source: 'user' },
+      },
+    },
+  }), /routing conflict: providers\.dualRouting differs from routing\.routes/);
+  assert.throws(() => migrateRoutingConfig({
+    routing,
+    providers: { primaryHost: 'codex' },
+  }), /routing conflict: providers\.primaryHost differs from routing\.primaryHost/);
+});
+
+test('future routing versions remain opaque and retain compatibility state', () => {
+  const future = {
+    routing: {
+      version: ROUTING_SCHEMA_VERSION + 4,
+      routes: { future: ['opaque'] },
+      futureField: { keep: true },
+    },
+    providers: {
+      primaryHost: 'codex',
+      dualRouting: { implementation: { host: 'codex' } },
+    },
+  };
+  assert.deepEqual(migrateRoutingConfig(structuredClone(future)), future);
+  assert.throws(() => routingIntent(future), /unsupported routing\.version/);
+});
+
+test('host-less legacy routes inherit the activity default host', () => {
+  const migrated = migrateRoutingConfig({
+    providers: {
+      dualRouting: {
+        review: { model: 'claude-opus-5', source: 'user' },
+      },
+    },
+  });
+  assert.deepEqual(migrated.routing.routes.review, {
+    host: 'claude',
+    model: 'claude-opus-5',
+    provenance: 'user',
+  });
+});
+
+test('load migrates raw legacy presence without writing; save persists only canonical state', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'kit-routing-config-'));
+  const file = path.join(dir, 'kit.json');
+  const legacy = {
+    providers: {
+      hosts: { codex: true },
+      primaryHost: 'codex',
+      dualRouting: {
+        implementation: { host: 'codex', escalate: [], source: 'user' },
+      },
+      aqeProvider: 'openai',
+    },
+  };
+  fs.writeFileSync(file, JSON.stringify(legacy));
+  const before = fs.readFileSync(file, 'utf8');
+  const loaded = loadKitConfig(file);
+  assert.equal(fs.readFileSync(file, 'utf8'), before, 'load is read-only');
+  assert.deepEqual(loaded.integrations.hosts,
+    { claude: true, codex: true, opencode: false });
+  assert.equal(loaded.routing.primaryHost, 'codex');
+  assert.deepEqual(loaded.routing.routes.implementation.escalation, []);
+  assert.equal(loaded.providers.aqeProvider, 'openai');
+  for (const key of ['hosts', 'primaryHost', 'dualRouting']) {
+    assert.equal(Object.hasOwn(loaded.providers, key), false);
+  }
+
+  saveKitConfig(loaded, file);
+  const persisted = JSON.parse(fs.readFileSync(file, 'utf8'));
+  assert.deepEqual(persisted.routing, loaded.routing);
+  assert.deepEqual(persisted.integrations, loaded.integrations);
+  assert.equal(persisted.providers.aqeProvider, 'openai');
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+test('an invalid existing config is reported instead of silently replaced with defaults', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'kit-routing-invalid-'));
+  const file = path.join(dir, 'kit.json');
+  fs.writeFileSync(file, '{ invalid json');
+  assert.throws(() => loadKitConfig(file), (error) => {
+    assert.equal(error.name, 'KitConfigError');
+    assert.equal(error.configPath, file);
+    assert.match(error.message, /invalid kit config/);
+    return true;
+  });
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+test('load rejects unusable or future envelopes without mutating the file', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'kit-routing-unsupported-'));
+  const file = path.join(dir, 'kit.json');
+  for (const input of [
+    { integrations: [] },
+    { integrations: { version: 99 } },
+    { routing: { version: 99, future: true } },
+  ]) {
+    const bytes = `${JSON.stringify(input, null, 2)}\n`;
+    fs.writeFileSync(file, bytes);
+    assert.throws(() => loadKitConfig(file), (error) => {
+      assert.equal(error.name, 'KitConfigError');
+      assert.equal(error.configPath, file);
+      assert.match(error.message, /invalid kit config/);
+      assert.doesNotMatch(error.message, /\n\s+at /);
+      return true;
+    });
+    assert.equal(fs.readFileSync(file, 'utf8'), bytes, 'failed load is read-only');
+  }
+  fs.rmSync(dir, { recursive: true, force: true });
+});
diff --git a/tests/kit/routing-divergence.test.mjs b/tests/kit/routing-divergence.test.mjs
index 6b2d86c..d923c64 100644
--- a/tests/kit/routing-divergence.test.mjs
+++ b/tests/kit/routing-divergence.test.mjs
@@ -15,7 +15,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import {
   MODEL_CATALOG, PROVIDER_MODEL_CATALOG, formatModelHelp,
-  DEFAULT_ROUTES, ACTIVITIES, seedDualRouting, divergedRoutes, refreshSeededRoutes,
+  DEFAULT_ROUTES, ACTIVITIES, seedActivityRoutes, divergedRoutes, refreshSeededRoutes,
   resolveRoutes, COST_AXIS_NOTE,
 } from '../../src/lib/routing.mjs';
 
@@ -60,7 +60,7 @@ test('formatModelHelp headers that per-token price is not per-task cost', () =>
 // ── divergedRoutes: pure detection ──────────────────────────────────────────
 
 test('divergedRoutes returns [] for a policy seeded from the CURRENT defaults', () => {
-  assert.deepEqual(divergedRoutes(seedDualRouting({ hosts: ['claude', 'codex'] })), []);
+  assert.deepEqual(divergedRoutes(seedActivityRoutes({ hosts: ['claude', 'codex'] })), []);
 });
 
 test('divergedRoutes returns [] for an empty policy (nothing persisted, nothing to diverge)', () => {
@@ -71,7 +71,7 @@ test('divergedRoutes returns [] for an empty policy (nothing persisted, nothing
 test('divergedRoutes reports a seeded entry whose model no longer matches the default', () => {
   // The exact #55 reproduction: a machine seeded pre-alpha.22 still pinned to
   // the prior Opus generation while DEFAULT_ROUTES moved to claude-opus-5.
-  const policy = { architecture: { host: 'claude', model: 'claude-opus-4-8', source: 'seeded' } };
+  const policy = { architecture: { host: 'claude', model: 'claude-opus-4-8', provenance: 'seeded' } };
   const out = divergedRoutes(policy);
   assert.equal(out.length, 1);
   assert.equal(out[0].activity, 'architecture');
@@ -79,15 +79,15 @@ test('divergedRoutes reports a seeded entry whose model no longer matches the de
   assert.equal(out[0].defaultModel, DEFAULT_ROUTES.architecture.model, 'and the default it diverges from');
 });
 
-test('divergedRoutes NEVER reports a source:user entry, even pinned to an older model', () => {
+test('divergedRoutes NEVER reports a provenance:user entry, even pinned to an older model', () => {
   // A deliberate pin is intent, not drift. Reporting it would nag the user
   // about a choice they made on purpose.
-  const policy = { architecture: { host: 'claude', model: 'claude-opus-4-8', source: 'user' } };
+  const policy = { architecture: { host: 'claude', model: 'claude-opus-4-8', provenance: 'user' } };
   assert.deepEqual(divergedRoutes(policy), []);
 });
 
 test('divergedRoutes treats an unstamped persisted entry as a user pin (never reported)', () => {
-  // resolveRoutes already defaults a source-less entry to 'user' (a hand edit is
+  // resolveRoutes already defaults a provenance-less entry to 'user' (a hand edit is
   // intent). Divergence detection must inherit that, or a legacy hand-edited
   // kit.json gets flagged as machine drift.
   assert.deepEqual(divergedRoutes({ architecture: { host: 'claude', model: 'claude-opus-4-8' } }), []);
@@ -95,27 +95,27 @@ test('divergedRoutes treats an unstamped persisted entry as a user pin (never re
 
 test('the unstamped→user rule is pinned on BOTH mechanisms that implement it', () => {
   // "unstamped is never reported" is enforced twice, independently: resolveRoutes
-  // defaults `source` to 'user' (routing.mjs), and divergedRoutes reads
-  // policy[act].source directly and skips anything !== 'seeded'. Asserting only
+  // defaults `provenance` to 'user' (routing.mjs), and divergedRoutes reads
+  // policy[act].provenance directly and skips anything !== 'seeded'. Asserting only
   // the divergedRoutes half would let a future change to resolveRoutes' defaulting
   // silently split the two — this pins the equivalence itself.
-  const legacy = { architecture: { host: 'claude', model: 'claude-opus-4-8' } }; // no `source`
-  assert.equal(resolveRoutes(legacy).architecture.source, 'user');
+  const legacy = { architecture: { host: 'claude', model: 'claude-opus-4-8' } }; // no `provenance`
+  assert.equal(resolveRoutes(legacy).architecture.provenance, 'user');
   assert.deepEqual(divergedRoutes(legacy), []);
 });
 
 test('the codex-primary clean-seed assertion actually covers a LADDER-bearing activity', () => {
   // Guards a bug one level down from the top-level mirroring one: if the default
-  // were mirrored via a top-level host/model swap while `def.escalate` were left
+  // were mirrored via a top-level host/model swap while `def.escalation` were left
   // unmirrored, a codex-primary seed would pass the top-level check and then
   // false-positive on every rung. `[]` over a ladder-less sample would not catch
   // that — so first prove ladders are present, THEN prove they are clean.
-  const seed = seedDualRouting({ primary: 'codex' });
-  const withLadders = Object.entries(seed).filter(([, r]) => r.escalate?.length);
+  const seed = seedActivityRoutes({ primary: 'codex' });
+  const withLadders = Object.entries(seed).filter(([, r]) => r.escalation?.length);
   assert.ok(withLadders.length > 0,
     'anti-vacuity: a codex-primary seed must carry ladders, else this proves nothing');
   for (const [, r] of withLadders) {
-    for (const rung of r.escalate) {
+    for (const rung of r.escalation) {
       assert.equal(rung.host, 'codex', 'the LADDER must be mirrored too, not just the top-level route');
     }
   }
@@ -123,39 +123,39 @@ test('the codex-primary clean-seed assertion actually covers a LADDER-bearing ac
 });
 
 test('a corrupted rung on a MIRRORED activity is still reported (mirroring is not amnesty)', () => {
-  const seed = seedDualRouting({ primary: 'codex' });
-  const [act] = Object.entries(seed).find(([, r]) => r.escalate?.length);
-  seed[act].escalate[0].model = 'gpt-5-codex-mini';
+  const seed = seedActivityRoutes({ primary: 'codex' });
+  const [act] = Object.entries(seed).find(([, r]) => r.escalation?.length);
+  seed[act].escalation[0].model = 'gpt-5-codex-mini';
   const [d] = divergedRoutes(seed);
   assert.equal(d.activity, act);
   assert.equal(d.modelDiverged, false, 'only the rung moved — the primary model is untouched');
-  assert.equal(d.escalate[0].model, 'gpt-5-codex-mini');
-  assert.equal(d.escalate[0].defaultModel, 'gpt-5.4', 'compared against the MIRRORED default rung');
+  assert.equal(d.escalation[0].model, 'gpt-5-codex-mini');
+  assert.equal(d.escalation[0].defaultModel, 'gpt-5.4', 'compared against the MIRRORED default rung');
 });
 
 test('divergedRoutes ignores a seeded entry that still matches the default', () => {
   const policy = {
-    architecture: { host: 'claude', model: DEFAULT_ROUTES.architecture.model, source: 'seeded' },
-    design: { host: 'claude', model: 'claude-opus-4-8', source: 'seeded' },
+    architecture: { host: 'claude', model: DEFAULT_ROUTES.architecture.model, provenance: 'seeded' },
+    design: { host: 'claude', model: 'claude-opus-4-8', provenance: 'seeded' },
   };
   assert.deepEqual(divergedRoutes(policy).map((d) => d.activity), ['design']);
 });
 
 /** The pre-alpha.22 seed: a REAL seeded policy (escalation ladders included,
- *  exactly as seedDualRouting writes them) with every claude-opus-5 pin rewound
+ *  exactly as seedActivityRoutes writes them) with every claude-opus-5 pin rewound
  *  to claude-opus-4-8 — primary models and escalation rungs alike. Building this
- *  from seedDualRouting rather than by hand matters: a fixture that silently
- *  dropped `escalate` would under-report divergence and hide the escalate-only
+ *  from seedActivityRoutes rather than by hand matters: a fixture that silently
+ *  dropped `escalation` would under-report divergence and hide the escalation-only
  *  case entirely. */
 function priorCatalogSeed({ primary = 'claude' } = {}) {
   const rewind = (m) => (m === 'claude-opus-5' ? 'claude-opus-4-8' : m);
-  const policy = seedDualRouting({ hosts: ['claude', 'codex'], primary });
+  const policy = seedActivityRoutes({ hosts: ['claude', 'codex'], primary });
   const out = {};
   for (const [act, r] of Object.entries(policy)) {
     out[act] = {
       ...r,
       model: rewind(r.model),
-      ...(r.escalate ? { escalate: r.escalate.map((e) => ({ ...e, model: rewind(e.model) })) } : {}),
+      ...(r.escalation ? { escalation: r.escalation.map((e) => ({ ...e, model: rewind(e.model) })) } : {}),
     };
   }
   return out;
@@ -164,7 +164,7 @@ function priorCatalogSeed({ primary = 'claude' } = {}) {
 test('divergedRoutes reports the full #55 reproduction: SIX routes, escalation rungs included', () => {
   // The issue observed exactly six on a machine tracking main. Four diverge on
   // their primary model; implementation/testing still pin gpt-5.4 (unchanged)
-  // but escalate into the prior Opus — a routing decision that diverged on its
+  // but escalation into the prior Opus — a routing decision that diverged on its
   // own schedule and would be missed by a primary-model-only comparison.
   const diverged = divergedRoutes(priorCatalogSeed());
   assert.deepEqual(diverged.map((d) => d.activity).sort(),
@@ -172,21 +172,21 @@ test('divergedRoutes reports the full #55 reproduction: SIX routes, escalation r
   assert.equal(diverged.length, 6);
 });
 
-test('an escalate-only divergence is flagged as such, never as a bogus same-model diff', () => {
+test('an escalation-only divergence is flagged as such, never as a bogus same-model diff', () => {
   // implementation's primary model did not move, so rendering it as
   // "gpt-5.4 vs gpt-5.4" would be nonsense. `modelDiverged` lets callers branch.
   const d = divergedRoutes(priorCatalogSeed()).find((x) => x.activity === 'implementation');
   assert.equal(d.modelDiverged, false, 'the primary model is unchanged');
   assert.equal(d.model, d.defaultModel, 'and both sides agree on it');
-  assert.ok(d.escalate.length > 0, 'the divergence lives entirely in the escalation ladder');
-  assert.equal(d.escalate[0].model, 'claude-opus-4-8');
-  assert.equal(d.escalate[0].defaultModel, DEFAULT_ROUTES.implementation.escalate[0].model);
+  assert.ok(d.escalation.length > 0, 'the divergence lives entirely in the escalation ladder');
+  assert.equal(d.escalation[0].model, 'claude-opus-4-8');
+  assert.equal(d.escalation[0].defaultModel, DEFAULT_ROUTES.implementation.escalation[0].model);
 });
 
 test('a primary-model divergence carries modelDiverged and an empty escalation delta', () => {
   const d = divergedRoutes(priorCatalogSeed()).find((x) => x.activity === 'architecture');
   assert.equal(d.modelDiverged, true);
-  assert.deepEqual(d.escalate, [], 'architecture has no ladder to diverge');
+  assert.deepEqual(d.escalation, [], 'architecture has no ladder to diverge');
 });
 
 // ── swapRoute mirroring, attacked directly ─────────────────────────────────
@@ -197,15 +197,15 @@ test('a primary-model divergence carries modelDiverged and an empty escalation d
 // blanket amnesty that hides real drift. Both directions are attacked here.
 
 test('divergedRoutes returns [] for a CODEX-PRIMARY seed (mirrored routes are not drift)', () => {
-  assert.deepEqual(divergedRoutes(seedDualRouting({ hosts: ['claude', 'codex'], primary: 'codex' })), []);
+  assert.deepEqual(divergedRoutes(seedActivityRoutes({ hosts: ['claude', 'codex'], primary: 'codex' })), []);
 });
 
 test('a codex-primary seed really is host-mirrored — the fixture is not vacuous', () => {
   // Guards the test above from passing for the wrong reason. If swapRoute ever
   // became a no-op, the codex-primary seed would equal the claude-primary one
   // and "[] means mirroring works" would prove nothing at all.
-  const claudePrimary = seedDualRouting({ hosts: ['claude', 'codex'], primary: 'claude' });
-  const codexPrimary = seedDualRouting({ hosts: ['claude', 'codex'], primary: 'codex' });
+  const claudePrimary = seedActivityRoutes({ hosts: ['claude', 'codex'], primary: 'claude' });
+  const codexPrimary = seedActivityRoutes({ hosts: ['claude', 'codex'], primary: 'codex' });
   const flipped = ACTIVITIES.filter((a) => claudePrimary[a] && codexPrimary[a]
     && claudePrimary[a].host !== codexPrimary[a].host);
   assert.ok(flipped.length > 0, 'a codex-primary seed must actually mirror hosts, or this suite is vacuous');
@@ -215,7 +215,7 @@ test('mirroring is scoped to the host swap — it does not excuse a wrong model
   // The dangerous failure: treating "host differs from default" as licence to
   // skip the model comparison entirely. Here the host legitimately differs
   // (codex-primary mirror) AND the model is wrong; it must still be reported.
-  const seed = seedDualRouting({ hosts: ['claude', 'codex'], primary: 'codex' });
+  const seed = seedActivityRoutes({ hosts: ['claude', 'codex'], primary: 'codex' });
   const act = ACTIVITIES.find((a) => seed[a] && seed[a].host !== DEFAULT_ROUTES[a].host);
   assert.ok(act, 'need at least one mirrored activity to attack');
   const policy = { ...seed, [act]: { ...seed[act], model: 'definitely-not-the-seeded-model' } };
@@ -228,7 +228,7 @@ test('mirroring is scoped to the host swap — it does not excuse a wrong model
 test('a claude-primary seed is not silently excused by the mirroring branch either', () => {
   // Same attack from the unmirrored side: hosts match the default, so the
   // mirroring branch must not engage at all.
-  const seed = seedDualRouting({ hosts: ['claude', 'codex'], primary: 'claude' });
+  const seed = seedActivityRoutes({ hosts: ['claude', 'codex'], primary: 'claude' });
   const policy = { ...seed, architecture: { ...seed.architecture, model: 'definitely-not-the-seeded-model' } };
   const hit = divergedRoutes(policy).find((d) => d.activity === 'architecture');
   assert.ok(hit);
@@ -238,7 +238,7 @@ test('a claude-primary seed is not silently excused by the mirroring branch eith
 test('a hand-moved host with a current model is not reported as divergence', () => {
   // A user (or a primary swap) can put an activity on the other host while its
   // model is exactly what seeding would produce there. That is not drift.
-  const mirrored = seedDualRouting({ hosts: ['claude', 'codex'], primary: 'codex' });
+  const mirrored = seedActivityRoutes({ hosts: ['claude', 'codex'], primary: 'codex' });
   const act = ACTIVITIES.find((a) => mirrored[a] && mirrored[a].host !== DEFAULT_ROUTES[a].host);
   assert.deepEqual(divergedRoutes({ [act]: { ...mirrored[act] } }), []);
 });
@@ -248,17 +248,17 @@ test('a codex-primary seed on the PRIOR catalog still reports real divergence',
   const diverged = divergedRoutes(priorCatalogSeed({ primary: 'codex' }));
   assert.ok(diverged.length > 0, 'a mirrored seed pinned to the prior catalog still diverges');
   for (const d of diverged) {
-    assert.ok(d.modelDiverged || d.escalate.length > 0, `${d.activity} reported with no actual delta`);
+    assert.ok(d.modelDiverged || d.escalation.length > 0, `${d.activity} reported with no actual delta`);
   }
 });
 
-test('refreshSeededRoutes clears an escalate-only divergence too', () => {
+test('refreshSeededRoutes clears an escalation-only divergence too', () => {
   const policy = priorCatalogSeed();
   const out = refreshSeededRoutes(policy, { activities: ['implementation'] });
   assert.deepEqual(divergedRoutes(out).map((d) => d.activity).sort(),
     ['architecture', 'debugging', 'design', 'security-analysis', 'testing'],
     'implementation converged, including its ladder');
-  assert.equal(out.implementation.escalate[0].model, DEFAULT_ROUTES.implementation.escalate[0].model);
+  assert.equal(out.implementation.escalation[0].model, DEFAULT_ROUTES.implementation.escalation[0].model);
 });
 
 test('refreshing the full prior-catalog seed converges every one of the six', () => {
@@ -266,7 +266,7 @@ test('refreshing the full prior-catalog seed converges every one of the six', ()
 });
 
 test('divergedRoutes is pure — it does not mutate the policy it is given', () => {
-  const policy = { architecture: { host: 'claude', model: 'claude-opus-4-8', source: 'seeded' } };
+  const policy = { architecture: { host: 'claude', model: 'claude-opus-4-8', provenance: 'seeded' } };
   const before = JSON.stringify(policy);
   divergedRoutes(policy);
   assert.equal(JSON.stringify(policy), before);
@@ -276,7 +276,7 @@ test('each diverged entry carries BOTH models cost-per-task characteristics, not
   // The refresh diff has to let the user decide, and the decision genuinely goes
   // both ways — so the note (the work-per-task vehicle) must ride along for the
   // current pin AND the default it would move to.
-  const [d] = divergedRoutes({ architecture: { host: 'claude', model: 'claude-opus-4-8', source: 'seeded' } });
+  const [d] = divergedRoutes({ architecture: { host: 'claude', model: 'claude-opus-4-8', provenance: 'seeded' } });
   for (const key of ['currentNote', 'defaultNote']) {
     assert.equal(typeof d[key], 'string', `${key} present`);
     assert.ok(d[key].trim().length > 0, `${key} non-empty`);
@@ -288,8 +288,8 @@ test('each diverged entry carries BOTH models cost-per-task characteristics, not
 
 test('refreshSeededRoutes re-seeds every diverged activity when none are named', () => {
   const policy = {
-    architecture: { host: 'claude', model: 'claude-opus-4-8', source: 'seeded' },
-    design: { host: 'claude', model: 'claude-opus-4-8', source: 'seeded' },
+    architecture: { host: 'claude', model: 'claude-opus-4-8', provenance: 'seeded' },
+    design: { host: 'claude', model: 'claude-opus-4-8', provenance: 'seeded' },
   };
   const out = refreshSeededRoutes(policy);
   assert.equal(out.architecture.model, DEFAULT_ROUTES.architecture.model);
@@ -297,20 +297,20 @@ test('refreshSeededRoutes re-seeds every diverged activity when none are named',
   assert.deepEqual(divergedRoutes(out), [], 'refreshing converges — nothing diverges afterwards');
 });
 
-test('refreshSeededRoutes leaves a source:user pin untouched even when explicitly named', () => {
+test('refreshSeededRoutes leaves a provenance:user pin untouched even when explicitly named', () => {
   // The acceptance criterion that matters most: a deliberate pin must survive a
   // refresh the user aimed straight at it.
-  const policy = { architecture: { host: 'claude', model: 'claude-opus-4-8', source: 'user' } };
+  const policy = { architecture: { host: 'claude', model: 'claude-opus-4-8', provenance: 'user' } };
   const out = refreshSeededRoutes(policy, { activities: ['architecture'] });
   assert.deepEqual(out.architecture, policy.architecture);
-  assert.equal(out.architecture.source, 'user');
+  assert.equal(out.architecture.provenance, 'user');
 });
 
 test('refreshSeededRoutes is per-activity selectable — unnamed diverged routes stay put', () => {
   // The right answer differs across the six, so refresh must not be all-or-nothing.
   const policy = {
-    architecture: { host: 'claude', model: 'claude-opus-4-8', source: 'seeded' },
-    design: { host: 'claude', model: 'claude-opus-4-8', source: 'seeded' },
+    architecture: { host: 'claude', model: 'claude-opus-4-8', provenance: 'seeded' },
+    design: { host: 'claude', model: 'claude-opus-4-8', provenance: 'seeded' },
   };
   const out = refreshSeededRoutes(policy, { activities: ['architecture'] });
   assert.equal(out.architecture.model, DEFAULT_ROUTES.architecture.model, 'named route refreshed');
@@ -318,12 +318,12 @@ test('refreshSeededRoutes is per-activity selectable — unnamed diverged routes
 });
 
 test('refreshSeededRoutes keeps the refreshed entry stamped seeded (so it stays refreshable)', () => {
-  const out = refreshSeededRoutes({ architecture: { host: 'claude', model: 'claude-opus-4-8', source: 'seeded' } });
-  assert.equal(out.architecture.source, 'seeded');
+  const out = refreshSeededRoutes({ architecture: { host: 'claude', model: 'claude-opus-4-8', provenance: 'seeded' } });
+  assert.equal(out.architecture.provenance, 'seeded');
 });
 
 test('refreshSeededRoutes is pure — the input policy is not mutated', () => {
-  const policy = { architecture: { host: 'claude', model: 'claude-opus-4-8', source: 'seeded' } };
+  const policy = { architecture: { host: 'claude', model: 'claude-opus-4-8', provenance: 'seeded' } };
   const before = JSON.stringify(policy);
   const out = refreshSeededRoutes(policy);
   assert.equal(JSON.stringify(policy), before, 'input untouched');
@@ -331,7 +331,7 @@ test('refreshSeededRoutes is pure — the input policy is not mutated', () => {
 });
 
 test('refreshSeededRoutes is a no-op on a policy seeded from current defaults', () => {
-  const policy = seedDualRouting({ hosts: ['claude', 'codex'] });
+  const policy = seedActivityRoutes({ hosts: ['claude', 'codex'] });
   assert.deepEqual(refreshSeededRoutes(policy), policy);
 });
 
diff --git a/tests/kit/routing-primary.test.mjs b/tests/kit/routing-primary.test.mjs
index 50e784e..a6d34be 100644
--- a/tests/kit/routing-primary.test.mjs
+++ b/tests/kit/routing-primary.test.mjs
@@ -1,6 +1,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { swapHostModel, swapRoute, seedDualRouting, DEFAULT_ROUTES, DEFAULT_PRIMARY_HOST, PRIMARY_HOSTS } from '../../src/lib/routing.mjs';
+import { swapHostModel, swapRoute, seedActivityRoutes, DEFAULT_ROUTES, DEFAULT_PRIMARY_HOST, PRIMARY_HOSTS } from '../../src/lib/routing.mjs';
 
 // ── swapHostModel ────────────────────────────────────────────────────────────
 test('swapHostModel maps a claude model to the codex host', () => {
@@ -20,25 +20,25 @@ test('swapRoute inverts the host and mirrors the escalation ladder', () => {
   // implementation default: codex primary, escalates to claude
   const swapped = swapRoute(DEFAULT_ROUTES.implementation);
   assert.equal(swapped.host, 'claude');
-  assert.equal(swapped.escalate[0].host, 'codex');
+  assert.equal(swapped.escalation[0].host, 'codex');
 });
 
-// ── seedDualRouting primary bias ─────────────────────────────────────────────
-test('seedDualRouting default (claude primary) keeps rUv host assignments', () => {
-  const policy = seedDualRouting({ hosts: ['claude', 'codex'] });
+// ── seedActivityRoutes primary bias ─────────────────────────────────────────────
+test('seedActivityRoutes default (claude primary) keeps rUv host assignments', () => {
+  const policy = seedActivityRoutes({ hosts: ['claude', 'codex'] });
   assert.equal(policy.architecture.host, 'claude'); // reasoning stays on claude
   assert.equal(policy.implementation.host, 'codex'); // impl stays on codex
 });
 
-test('seedDualRouting with codex primary mirrors host assignments', () => {
-  const policy = seedDualRouting({ hosts: ['claude', 'codex'], primary: 'codex' });
+test('seedActivityRoutes with codex primary mirrors host assignments', () => {
+  const policy = seedActivityRoutes({ hosts: ['claude', 'codex'], primary: 'codex' });
   assert.equal(policy.architecture.host, 'codex'); // codex now leads reasoning
   assert.equal(policy.implementation.host, 'claude'); // claude becomes the alternate
 });
 
-test('seedDualRouting stamps every seeded entry with source:seeded', () => {
-  const policy = seedDualRouting({ hosts: ['claude', 'codex'], primary: 'codex' });
-  assert.ok(Object.values(policy).every((r) => r.source === 'seeded'));
+test('seedActivityRoutes stamps every seeded entry with provenance:seeded', () => {
+  const policy = seedActivityRoutes({ hosts: ['claude', 'codex'], primary: 'codex' });
+  assert.ok(Object.values(policy).every((r) => r.provenance === 'seeded'));
 });
 
 // ── constants ────────────────────────────────────────────────────────────────
diff --git a/tests/kit/routing-projection.test.mjs b/tests/kit/routing-projection.test.mjs
index e1c3ae2..6665949 100644
--- a/tests/kit/routing-projection.test.mjs
+++ b/tests/kit/routing-projection.test.mjs
@@ -1,12 +1,12 @@
 // Slice 1 — the agentOverrides projection: applyAqeRouter materializes the
-// dualRouting policy into .agentic-qe/llm-config.json, version-gated on aqe ≥ 3.13.1.
+// routes policy into .agentic-qe/llm-config.json, version-gated on aqe ≥ 3.13.1.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { applyAqeRouter, aqeRouterFile, undoAqeRouter, ensureCodexMcp, undoCodexMcp, undoRufloMcpInCodex } from '../../src/lib/providers.mjs';
-import { seedDualRouting } from '../../src/lib/routing.mjs';
+import { seedActivityRoutes } from '../../src/lib/routing.mjs';
 import { _setGlobalRootForTest } from '../../src/lib/paths.mjs';
 
 function tmpProject() {
@@ -28,13 +28,16 @@ function fakeAqe(version) {
   return groot;
 }
 
-const cfgWith = (extra) => ({ providers: { aqeProvider: null, aqeFallback: [], dualRouting: {}, ...extra } });
+const cfgWith = ({ routes = {}, ...providers } = {}) => ({
+  routing: { version: 1, primaryHost: 'claude', routes },
+  providers: { aqeProvider: null, aqeFallback: [], ...providers },
+});
 const readDisk = (dir) => JSON.parse(fs.readFileSync(aqeRouterFile(dir), 'utf8'));
 
 test('writes agentOverrides from a seeded policy when aqe ≥ 3.13.1', () => {
   const groot = fakeAqe('3.13.1');
   const dir = tmpProject();
-  const res = applyAqeRouter(cfgWith({ dualRouting: seedDualRouting() }), dir);
+  const res = applyAqeRouter(cfgWith({ routes: seedActivityRoutes() }), dir);
 
   assert.equal(res.changed, true);
   const disk = readDisk(dir);
@@ -50,7 +53,7 @@ test('writes agentOverrides from a seeded policy when aqe ≥ 3.13.1', () => {
 test('skips agentOverrides on aqe < 3.13.1 and says so', () => {
   const groot = fakeAqe('3.13.0');
   const dir = tmpProject();
-  const res = applyAqeRouter(cfgWith({ dualRouting: seedDualRouting() }), dir);
+  const res = applyAqeRouter(cfgWith({ routes: seedActivityRoutes() }), dir);
 
   assert.match(res.detail, /skipped/);
   assert.equal(res.changed, false, 'nothing written when only a gated-out policy exists');
@@ -61,7 +64,7 @@ test('skips agentOverrides on aqe < 3.13.1 and says so', () => {
 test('a policy-only project (no fallback chain) still materializes the file', () => {
   const groot = fakeAqe('3.13.1');
   const dir = tmpProject();
-  const res = applyAqeRouter(cfgWith({ dualRouting: seedDualRouting() }), dir);
+  const res = applyAqeRouter(cfgWith({ routes: seedActivityRoutes() }), dir);
 
   assert.equal(res.changed, true);
   const disk = readDisk(dir);
@@ -77,7 +80,7 @@ test('chain and agentOverrides are written together and never persist apiKey', (
   const cfg = cfgWith({
     aqeProvider: 'claude-code',
     aqeFallback: [{ provider: 'claude-code', models: ['claude-opus-4-8'] }],
-    dualRouting: seedDualRouting(),
+    routes: seedActivityRoutes(),
   });
   const res = applyAqeRouter(cfg, dir);
 
@@ -99,7 +102,7 @@ test('agentOverrides MERGES — a foreign entry survives (H1: never clobbered)',
     _managedBy: 'agentic-kit',
     agentOverrides: { 'qe-custom-agent': { provider: 'ollama' } }, // outside ak's curated map
   }));
-  applyAqeRouter(cfgWith({ dualRouting: seedDualRouting() }), dir);
+  applyAqeRouter(cfgWith({ routes: seedActivityRoutes() }), dir);
 
   const disk = readDisk(dir);
   assert.deepEqual(disk.agentOverrides['qe-custom-agent'], { provider: 'ollama' }, 'foreign entry preserved');
@@ -119,8 +122,8 @@ test('stale curated overrides are pruned while configured and foreign entries su
       'qe-custom-agent': { provider: 'ollama' },
     },
   }));
-  const res = applyAqeRouter(cfgWith({ dualRouting: {
-    review: { host: 'claude', model: 'claude-sonnet-5', source: 'user' },
+  const res = applyAqeRouter(cfgWith({ routes: {
+    review: { host: 'claude', model: 'claude-sonnet-5', provenance: 'user' },
   } }), dir);
   const disk = readDisk(dir);
   assert.match(res.detail, /stale ak entries pruned/);
@@ -133,7 +136,7 @@ test('stale curated overrides are pruned while configured and foreign entries su
 test('an invalid fallback chain does not block the agentOverrides projection (M3)', () => {
   const groot = fakeAqe('3.13.1');
   const dir = tmpProject();
-  const res = applyAqeRouter(cfgWith({ aqeFallback: [{ provider: 'not-a-provider', models: [] }], dualRouting: seedDualRouting() }), dir);
+  const res = applyAqeRouter(cfgWith({ aqeFallback: [{ provider: 'not-a-provider', models: [] }], routes: seedActivityRoutes() }), dir);
 
   assert.equal(res.changed, true, 'still wrote agentOverrides');
   assert.equal(res.ok, false, 'but surfaces the chain error');
@@ -147,7 +150,9 @@ test('codex MCP teardown is a no-op unless ak owns it (H2), and never shells whe
   const off = await undoCodexMcp(process.cwd(), { managed: false });
   assert.equal(off.changed, false);
   assert.match(off.detail, /left as-is/);
-  const ensure = await ensureCodexMcp({ providers: { hosts: { claude: true, codex: false } } });
+  const ensure = await ensureCodexMcp({
+    integrations: { hosts: { claude: true, codex: false } },
+  });
   assert.equal(ensure.changed, false);
   assert.match(ensure.detail, /not enabled/);
 });
@@ -174,7 +179,7 @@ test('owned bridge teardown sends the precise safe argv on every platform', asyn
 test('undoAqeRouter removes the ak-created file (agentOverrides included)', () => {
   const groot = fakeAqe('3.13.1');
   const dir = tmpProject();
-  applyAqeRouter(cfgWith({ dualRouting: seedDualRouting() }), dir);
+  applyAqeRouter(cfgWith({ routes: seedActivityRoutes() }), dir);
   assert.equal(fs.existsSync(aqeRouterFile(dir)), true);
 
   const undo = undoAqeRouter(dir);
diff --git a/tests/kit/routing.test.mjs b/tests/kit/routing.test.mjs
index 7e6d419..89ba320 100644
--- a/tests/kit/routing.test.mjs
+++ b/tests/kit/routing.test.mjs
@@ -3,10 +3,10 @@ import assert from 'node:assert/strict';
 import {
   ACTIVITIES, AK_ORIGINATED, DEFAULT_ROUTES, HOST_PROVIDER, SUBSCRIPTION_PROVIDERS,
   AQE_CONSTRUCTIBLE_PROVIDERS, MODEL_CATALOG, MODEL_CATALOG_VERIFIED, modelChoices, formatModelHelp,
-  resolveRoutes, seedDualRouting, policyToAgentOverrides, routedVendors, routingSummary,
+  resolveRoutes, seedActivityRoutes, policyToAgentOverrides, routedVendors, routingSummary,
   configuredPolicyToAgentOverrides, pruneRoutesForHosts, materializeRunPlan,
   validateRoute, parseRouteSpecs,
-  DUAL_RUN_TEMPLATE_NAMES, policyToDualRunConfig, escalatePolicy,
+  RUN_TEMPLATE_NAMES,
 } from '../../src/lib/routing.mjs';
 
 // ── Vocabulary + defaults ────────────────────────────────────────────────────
@@ -53,24 +53,24 @@ test('formatModelHelp names both hosts and cites a verified date', () => {
 
 // ── resolveRoutes / provenance ──────────────────────────────────────────────
 
-test('empty policy resolves every activity to source=default', () => {
+test('empty policy resolves every activity to provenance=default', () => {
   const routes = resolveRoutes({});
   assert.equal(Object.keys(routes).length, ACTIVITIES.length);
-  assert.ok(Object.values(routes).every((r) => r.source === 'default'));
+  assert.ok(Object.values(routes).every((r) => r.provenance === 'default'));
   assert.equal(routes.packaging.akOriginated, true);
   assert.equal(routes.architecture.akOriginated, false);
 });
 
-test('a persisted user route overlays defaults and keeps source=user', () => {
-  const routes = resolveRoutes({ implementation: { host: 'claude', model: 'claude-opus-4-8', source: 'user' } });
+test('a persisted user route overlays defaults and keeps provenance=user', () => {
+  const routes = resolveRoutes({ implementation: { host: 'claude', model: 'claude-opus-4-8', provenance: 'user' } });
   assert.equal(routes.implementation.host, 'claude');
   assert.equal(routes.implementation.model, 'claude-opus-4-8');
-  assert.equal(routes.implementation.source, 'user');
+  assert.equal(routes.implementation.provenance, 'user');
 });
 
-test('a persisted entry with no explicit source is treated as a user edit', () => {
+test('a persisted entry with no explicit provenance is treated as a user edit', () => {
   const routes = resolveRoutes({ testing: { host: DEFAULT_ROUTES.testing.host } });
-  assert.equal(routes.testing.source, 'user');
+  assert.equal(routes.testing.provenance, 'user');
   assert.equal(routes.testing.model, DEFAULT_ROUTES.testing.model, 'same-host: unset field falls back to default');
 });
 
@@ -87,19 +87,19 @@ test('a host-only override never inherits the previous host default model (qe-co
   assert.equal(pinned[activity].model, 'claude-sonnet-5');
 });
 
-// ── seedDualRouting (cost-safety gate) ──────────────────────────────────────
+// ── seedActivityRoutes (cost-safety gate) ──────────────────────────────────────
 
 test('seeding both hosts stamps every route seeded and only subscription providers', () => {
-  const policy = seedDualRouting({ hosts: ['claude', 'codex'] });
+  const policy = seedActivityRoutes({ hosts: ['claude', 'codex'] });
   assert.equal(Object.keys(policy).length, ACTIVITIES.length);
   for (const r of Object.values(policy)) {
-    assert.equal(r.source, 'seeded');
+    assert.equal(r.provenance, 'seeded');
     assert.ok(SUBSCRIPTION_PROVIDERS.has(HOST_PROVIDER[r.host]), 'never seeds a metered provider');
   }
 });
 
 test('seeding a single host omits the other host’s activities', () => {
-  const policy = seedDualRouting({ hosts: ['claude'] });
+  const policy = seedActivityRoutes({ hosts: ['claude'] });
   assert.ok(Object.values(policy).every((r) => r.host === 'claude'));
   assert.ok(!('implementation' in policy), 'codex activity not seeded when codex absent');
 });
@@ -114,24 +114,24 @@ test('policyToAgentOverrides maps QE agents to their activity host+model', () =>
 });
 
 test('overriding an activity flows through to its agent overrides', () => {
-  const ov = policyToAgentOverrides({ testing: { host: 'claude', model: 'claude-sonnet-5', source: 'user' } });
+  const ov = policyToAgentOverrides({ testing: { host: 'claude', model: 'claude-sonnet-5', provenance: 'user' } });
   assert.equal(ov['qe-test-architect'].provider, 'claude-code');
   assert.equal(ov['qe-test-architect'].model, 'claude-sonnet-5');
 });
 
 test('configured projection never recreates a missing route from dual-host defaults', () => {
-  const ov = configuredPolicyToAgentOverrides({ review: { host: 'claude', model: 'claude-sonnet-5', source: 'user' } });
+  const ov = configuredPolicyToAgentOverrides({ review: { host: 'claude', model: 'claude-sonnet-5', provenance: 'user' } });
   assert.equal(ov['qe-code-reviewer'].provider, 'claude-code');
   assert.equal(ov['qe-test-architect'], undefined);
 });
 
 test('pruning disabled hosts drops primary routes and only invalid escalation rungs', () => {
   const out = pruneRoutesForHosts({
-    implementation: { host: 'codex', model: 'gpt-5.4', source: 'seeded' },
-    testing: { host: 'claude', model: 'claude-sonnet-5', source: 'user', escalate: [{ host: 'codex', model: 'gpt-5.4' }] },
+    implementation: { host: 'codex', model: 'gpt-5.4', provenance: 'seeded' },
+    testing: { host: 'claude', model: 'claude-sonnet-5', provenance: 'user', escalation: [{ host: 'codex', model: 'gpt-5.4' }] },
   }, { hosts: ['claude'] });
   assert.equal(out.policy.implementation, undefined);
-  assert.deepEqual(out.policy.testing, { host: 'claude', model: 'claude-sonnet-5', source: 'user' });
+  assert.deepEqual(out.policy.testing, { host: 'claude', model: 'claude-sonnet-5', provenance: 'user' });
   assert.equal(out.pruned.length, 2);
   assert.deepEqual(out.warnings, ["removed user escalation for 'testing' — host 'codex' is disabled"]);
 });
@@ -143,7 +143,7 @@ test('default routing spans at least two vendors (qe-court diversity)', () => {
 });
 
 test('routingSummary counts totals, provenance, and per-host tallies', () => {
-  const s = routingSummary({ testing: { host: 'claude', source: 'user' } });
+  const s = routingSummary({ testing: { host: 'claude', provenance: 'user' } });
   assert.equal(s.total, ACTIVITIES.length);
   assert.equal(s.custom, 1);
   assert.ok(s.byHost.claude > 0 && s.byHost.codex > 0);
@@ -165,83 +165,60 @@ test('parseRouteSpecs parses valid specs and warns on bad ones', () => {
     'nonsense:claude',       // unknown activity
     'review:gemini',         // unknown host
   ]);
-  assert.deepEqual(policy.implementation, { host: 'claude', model: 'claude-opus-4-8', source: 'user' });
-  assert.deepEqual(policy.testing, { host: 'codex', source: 'user' });
+  assert.deepEqual(policy.implementation, { host: 'claude', model: 'claude-opus-4-8', provenance: 'user' });
+  assert.deepEqual(policy.testing, { host: 'codex', provenance: 'user' });
   assert.equal(warnings.length, 2);
   assert.ok(!('nonsense' in policy) && !('review' in policy));
 });
 
-// ── Projection #2: dual-run config ──────────────────────────────────────────
+// ── Host-neutral run plans ──────────────────────────────────────────────────
 
-test('policyToDualRunConfig(feature) builds the grounded worker DAG with policy host+model', () => {
-  const { workers } = policyToDualRunConfig(seedDualRouting(), { template: 'feature', task: 'add auth' });
+test('materializeRunPlan(feature) builds the grounded worker DAG with policy host+model', () => {
+  const { workers } = materializeRunPlan(seedActivityRoutes(), { template: 'feature', task: 'add auth' });
   assert.equal(workers.length, 4);
   const byId = Object.fromEntries(workers.map((w) => [w.id, w]));
-  assert.equal(byId.architect.platform, 'claude');
-  assert.equal(byId.coder.platform, 'codex');
+  assert.equal(byId.architect.host, 'claude');
+  assert.equal(byId.coder.host, 'codex');
   assert.deepEqual(byId.reviewer.dependsOn, ['coder', 'tester']);
-  assert.ok(byId.coder.model, 'model comes from the route');
+  assert.ok(byId.coder.configuredModel, 'model comes from the route');
   assert.match(byId.architect.prompt, /add auth/, 'task is interpolated');
 });
 
-test('every dual-run template projects to platforms of claude|codex only', () => {
-  for (const name of DUAL_RUN_TEMPLATE_NAMES) {
-    const { workers } = policyToDualRunConfig(seedDualRouting(), { template: name, task: 'x' });
+test('every run template materializes a host-neutral worker plan', () => {
+  for (const name of RUN_TEMPLATE_NAMES) {
+    const { workers } = materializeRunPlan(seedActivityRoutes(), { template: name, task: 'x' });
     assert.ok(workers.length >= 1, `${name} has workers`);
-    assert.ok(workers.every((w) => w.platform === 'claude' || w.platform === 'codex'), `${name} platforms valid`);
+    assert.ok(workers.every((w) => w.activity && w.host && !('platform' in w)), `${name} workers are host-neutral`);
   }
 });
 
-test('host-neutral run plan preserves every legacy dual worker assignment', () => {
-  const policy = seedDualRouting();
-  const plan = materializeRunPlan(policy, { template: 'feature', task: 'add auth' });
-  const dual = policyToDualRunConfig(policy, { template: 'feature', task: 'add auth' });
+test('host-neutral run plan preserves dependencies, routes, and static prompts', () => {
+  const plan = materializeRunPlan(seedActivityRoutes(), { template: 'feature', task: 'add auth' });
   assert.equal(plan.template, 'feature');
-  // `escalate` is run-only ladder metadata (ADR-0019); the legacy projection
-  // has its own escalatePolicy overlay instead, so it is excluded from parity.
-  assert.deepEqual(plan.workers.map(({ host, configuredModel, activity: _activity, escalate: _ladder, ...worker }) => ({
-    ...worker, platform: host, model: configuredModel ?? undefined,
-  })), dual.workers);
   assert.ok(plan.workers.every((worker) => worker.activity && worker.host && !('platform' in worker)));
+  assert.deepEqual(plan.workers.find((worker) => worker.id === 'reviewer').dependsOn, ['coder', 'tester']);
   assert.ok(plan.workers.every((worker) => !/AK_HANDOFF|AK_DEPENDENCY_DATA/.test(worker.prompt)),
     'handoff protocol is appended only by the runtime runner; dry-run/materialization stays static');
 });
 
-test('an explicit OpenCode route materializes for ak run but not the legacy dual adapter', () => {
+test('an explicit OpenCode route materializes for ak run', () => {
   const policy = { implementation: {
-    host: 'opencode', model: 'openrouter/example', source: 'user',
+    host: 'opencode', model: 'openrouter/example', provenance: 'user',
   } };
   const plan = materializeRunPlan(policy, { template: 'feature', task: 'x' });
   assert.equal(plan.workers.find((worker) => worker.activity === 'implementation').host, 'opencode');
-  assert.throws(() => policyToDualRunConfig(policy, { template: 'feature', task: 'x' }), /ak dual supports Claude\/Codex/);
 });
 
 test('host-neutral run plan rejects a host without activity-routing capability', () => {
-  const policy = { implementation: { host: 'gemini', source: 'user' } };
+  const policy = { implementation: { host: 'gemini', provenance: 'user' } };
   assert.throws(
     () => materializeRunPlan(policy, { template: 'feature', task: 'x' }),
     /route for "implementation" cannot materialize: host "gemini" requires canRouteActivities/,
   );
 });
 
-test('policyToDualRunConfig throws on an unknown template', () => {
-  assert.throws(() => policyToDualRunConfig({}, { template: 'nope' }), /unknown template/);
-});
-
-test('escalatePolicy bumps ladder activities to their next (cross-vendor) rung', () => {
-  const esc = escalatePolicy(seedDualRouting());
-  // implementation & testing carry a codex→claude ladder in the defaults
-  assert.equal(esc.implementation.host, 'claude');
-  assert.equal(esc.testing.host, 'claude');
-  // activities without a ladder are not escalated
-  assert.ok(!('review' in esc));
-});
-
-test('escalatePolicy skips a rung that equals the current route (no same-model retry)', () => {
-  // a user override to the ladder rung itself must not "escalate" to the same thing
-  const rung = DEFAULT_ROUTES.implementation.escalate[0];
-  const policy = { implementation: { host: rung.host, model: rung.model, source: 'user' } };
-  assert.ok(!('implementation' in escalatePolicy(policy)));
+test('materializeRunPlan throws on an unknown template', () => {
+  assert.throws(() => materializeRunPlan({}, { template: 'nope' }), /unknown template/);
 });
 
 test('parseRouteSpecs preserves a model id containing a colon', () => {
diff --git a/tests/kit/run-command.test.mjs b/tests/kit/run-command.test.mjs
index bd1e97b..6483a78 100644
--- a/tests/kit/run-command.test.mjs
+++ b/tests/kit/run-command.test.mjs
@@ -1,7 +1,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { buildRunPlan, run } from '../../src/commands/run.mjs';
-import { seedDualRouting } from '../../src/lib/routing.mjs';
+import { seedActivityRoutes } from '../../src/lib/routing.mjs';
 
 /** Run `fn` with console.log captured; returns { result, out }. */
 async function captureLog(fn) {
@@ -20,16 +20,16 @@ const succeededResult = (worker) => ({
 });
 
 test('ak run materializes the host-neutral plan and keeps run-local route overrides ephemeral', () => {
-  const cfg = { providers: { dualRouting: seedDualRouting() } };
+  const cfg = { routing: { routes: seedActivityRoutes() } };
   const { plan } = buildRunPlan(cfg, 'feature', 'add a queue', ['implementation:claude:claude-sonnet-5']);
   assert.equal(plan.template, 'feature');
   assert.equal(plan.workers.find((entry) => entry.id === 'coder').host, 'claude');
-  assert.equal(cfg.providers.dualRouting.implementation.host, 'codex');
+  assert.equal(cfg.routing.routes.implementation.host, 'codex');
 });
 
 test('ak run materializes an explicit OpenCode route', () => {
-  const cfg = { providers: { dualRouting: { ...seedDualRouting(), 'security-scan': {
-    host: 'opencode', model: 'openrouter/example', source: 'user',
+  const cfg = { routing: { routes: { ...seedActivityRoutes(), 'security-scan': {
+    host: 'opencode', model: 'openrouter/example', provenance: 'user',
   } } } };
   const { plan } = buildRunPlan(cfg, 'security', 'src/auth');
   const scanner = plan.workers.find((entry) => entry.activity === 'security-scan');
@@ -40,7 +40,7 @@ test('ak run materializes an explicit OpenCode route', () => {
 // qe-court B8: `--json` must emit exactly one parseable document — the human
 // status line ("✓ run complete" / the failure text) is gated on !json.
 // The cfg seam keeps these fully deterministic (no real kit.json is read).
-const testCfg = () => ({ providers: { dualRouting: seedDualRouting() } });
+const testCfg = () => ({ routing: { routes: seedActivityRoutes() } });
 
 test('ak run --json emits exactly one parseable JSON document (qe-court B8)', async () => {
   const executePlan = async (plan) => plan.workers.map(succeededResult);
@@ -66,9 +66,9 @@ test('ak run without --json still prints the human status line', async () => {
 // ── bounded escalation: plan materialization + CLI surface (ADR-0019) ────────
 
 test('materializeRunPlan attaches the route ladder, dropping self-equal rungs', () => {
-  const cfg = { providers: { dualRouting: { implementation: {
-    host: 'opencode', model: 'opencode/kimi-k3', source: 'user',
-    escalate: [
+  const cfg = { routing: { routes: { implementation: {
+    host: 'opencode', model: 'opencode/kimi-k3', provenance: 'user',
+    escalation: [
       { host: 'opencode', model: 'opencode/kimi-k3' }, // self-equal: re-running this changes nothing
       { host: 'claude', model: 'claude-sonnet-5' },
     ],
@@ -80,17 +80,17 @@ test('materializeRunPlan attaches the route ladder, dropping self-equal rungs',
 });
 
 test('materializeRunPlan rejects an escalation rung to a non-routable host', () => {
-  const cfg = { providers: { dualRouting: { implementation: {
-    host: 'claude', source: 'user', escalate: [{ host: 'not-a-host' }],
+  const cfg = { routing: { routes: { implementation: {
+    host: 'claude', provenance: 'user', escalation: [{ host: 'not-a-host' }],
   } } } };
   assert.throws(() => buildRunPlan(cfg, 'feature', 'probe'),
     /escalation rung for "implementation" cannot materialize: host "not-a-host" requires canRouteActivities/);
 });
 
 test('--dry-run shows the escalation ladder on ladder-carrying workers', async () => {
-  const cfg = { providers: { dualRouting: { implementation: {
-    host: 'opencode', model: 'opencode/kimi-k3', source: 'user',
-    escalate: [{ host: 'claude', model: 'claude-sonnet-5' }],
+  const cfg = { routing: { routes: { implementation: {
+    host: 'opencode', model: 'opencode/kimi-k3', provenance: 'user',
+    escalation: [{ host: 'claude', model: 'claude-sonnet-5' }],
   } } } };
   const { out } = await captureLog(() => run({
     flags: { 'dry-run': true }, positionals: ['feature', 'probe'], cfg,
@@ -130,16 +130,16 @@ test('--timeout above the Node timer ceiling fails with a clear error', async ()
   assert.match(out, /timeout must not exceed 2147483647/);
 });
 
-// #88: a hand-edited dualRouting is schema-checked at load — a bad entry
+// #88: a hand-edited routing.routes map is schema-checked at load — a bad entry
 // fails with the entry named, not a padEnd crash at print time.
 test('a malformed persisted route fails at build with the entry named', () => {
   for (const [policy, needle] of [
     [{ implementation: { host: 'claude', model: 123 } }, /route "implementation"\.model must be a string/],
     [{ implementation: { host: '' } }, /route "implementation" requires a non-empty host/],
-    [{ implementation: { host: 'claude', escalate: [{ host: '' }] } }, /route "implementation"\.escalate\[0\] requires a non-empty host/],
+    [{ implementation: { host: 'claude', escalation: [{ host: '' }] } }, /route "implementation"\.escalation\[0\] requires a non-empty host/],
     [{ implementation: 'codex' }, /route "implementation" must be an object/],
   ]) {
-    assert.throws(() => buildRunPlan({ providers: { dualRouting: policy } }, 'feature', 'probe'),
+    assert.throws(() => buildRunPlan({ routing: { routes: policy } }, 'feature', 'probe'),
       (error) => error.message.startsWith('invalid routing policy:') && needle.test(error.message),
       `expected a named policy error for ${needle}`);
   }
diff --git a/tests/kit/setup-command.test.mjs b/tests/kit/setup-command.test.mjs
index 5713416..b324fec 100644
--- a/tests/kit/setup-command.test.mjs
+++ b/tests/kit/setup-command.test.mjs
@@ -91,7 +91,7 @@ test('--dry-run reports what --codex/--primary-host WOULD do without enabling th
     setup.run({ flags: FLAGS({ 'dry-run': true, minimal: true, codex: true }), pkgRoot: PKG_ROOT }));
   assert.equal(result, 0);
   assert.match(out, /dry-run: --codex\/--primary-host would enable \+ install the codex host/);
-  assert.equal(loadKitConfig().providers.hosts.codex, false,
+  assert.equal(loadKitConfig().integrations.hosts.codex, false,
     'a previewed --codex must not persist the host opt-in');
   assertUnchanged(before, HOME, '`ak setup --codex --dry-run` must not touch the filesystem');
 });
@@ -200,8 +200,8 @@ test('ak setup --opencode --yes persists the host and wires it via the shared st
       assert.match(out, /restart opencode to load the hooks/, 'restart guidance after successful wiring');
     });
     const cfg = loadKitConfig();
-    assert.equal(cfg.providers.hosts.opencode, true, 'enabled host persisted to kit.json');
-    assert.equal(cfg.providers.opencodeMcp, 'ak', 'ownership marker persisted');
+    assert.equal(cfg.integrations.hosts.opencode, true, 'enabled host persisted to kit.json');
+    assert.equal(cfg.integrations.ownership.opencode.mcp, 'ak', 'ownership marker persisted');
     const doc = JSON.parse(fs.readFileSync(path.join(ocHome(), 'opencode.json'), 'utf8'));
     assert.ok(doc.mcp['claude-flow'], 'claude-flow MCP wired');
     assert.ok(fs.existsSync(path.join(ocHome(), 'plugins', 'ruflo-hooks.js')), 'lifecycle plugin deployed');
@@ -224,7 +224,7 @@ test('ak setup --opencode --dry-run writes nothing anywhere (kit.json, opencode
     setup.run({ flags: FLAGS({ 'dry-run': true, minimal: true, opencode: true }), pkgRoot: PKG_ROOT }));
   assert.equal(result, 0);
   assert.match(out, /dry-run: --opencode would enable the opencode host/);
-  assert.equal(loadKitConfig().providers.hosts.opencode, false, 'a previewed --opencode must not persist');
+  assert.equal(loadKitConfig().integrations.hosts.opencode, false, 'a previewed --opencode must not persist');
   assert.ok(!fs.existsSync(ocHome()), 'no opencode config home fabricated by a dry run');
   assertUnchanged(before, HOME, '`ak setup --opencode --dry-run` must not touch the filesystem');
 });
@@ -252,7 +252,7 @@ test('ak setup --opencode with an ABSENT CLI never fabricates the config home',
     setup.run({ flags: FLAGS({ opencode: true, yes: true, minimal: true }), pkgRoot: PKG_ROOT }));
   assert.equal(result, 0, out);
   assert.match(out, /opencode: enabled but CLI not installed — wiring skipped/);
-  assert.equal(loadKitConfig().providers.hosts.opencode, true,
+  assert.equal(loadKitConfig().integrations.hosts.opencode, true,
     'the enablement intent is still persisted (sync completes it once installed)');
   assert.ok(!fs.existsSync(ocHome()), 'no config home created for a host that is not there');
 });
diff --git a/tests/kit/setup-host-flags.test.mjs b/tests/kit/setup-host-flags.test.mjs
index d2da161..5c08e1d 100644
--- a/tests/kit/setup-host-flags.test.mjs
+++ b/tests/kit/setup-host-flags.test.mjs
@@ -1,48 +1,61 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
 import { applySetupHostFlags } from '../../src/lib/providers.mjs';
+import { loadKitConfig, saveKitConfig } from '../../src/lib/config.mjs';
 
-const freshCfg = () => ({ providers: { hosts: { claude: true, codex: false } } });
+const freshCfg = () => ({
+  integrations: {
+    version: 2,
+    hosts: { claude: true, codex: false, opencode: false },
+    bindings: [],
+  },
+  routing: { version: 1, primaryHost: 'claude', routes: {} },
+  providers: {},
+});
 
 test('no flags → claude-only default is left untouched', () => {
   const cfg = freshCfg();
   const r = applySetupHostFlags(cfg, {});
-  assert.equal(cfg.providers.hosts.codex, false);
+  assert.equal(cfg.integrations.hosts.codex, false);
   assert.equal(r.changed, false);
 });
 
 test('--codex enables both hosts and reports changed', () => {
   const cfg = freshCfg();
   const r = applySetupHostFlags(cfg, { codex: true });
-  assert.equal(cfg.providers.hosts.claude, true);
-  assert.equal(cfg.providers.hosts.codex, true);
+  assert.equal(cfg.integrations.hosts.claude, true);
+  assert.equal(cfg.integrations.hosts.codex, true);
   assert.equal(r.changed, true);
 });
 
 test('--primary-host codex implies enabling codex', () => {
   const cfg = freshCfg();
   applySetupHostFlags(cfg, { 'primary-host': 'codex' });
-  assert.equal(cfg.providers.hosts.codex, true);
-  assert.equal(cfg.providers.primaryHost, 'codex');
+  assert.equal(cfg.integrations.hosts.codex, true);
+  assert.equal(cfg.routing.primaryHost, 'codex');
 });
 
 test('--primary-host claude does not enable codex', () => {
   const cfg = freshCfg();
   applySetupHostFlags(cfg, { 'primary-host': 'claude' });
-  assert.equal(cfg.providers.hosts.codex, false);
-  assert.equal(cfg.providers.primaryHost, 'claude');
+  assert.equal(cfg.integrations.hosts.codex, false);
+  assert.equal(cfg.routing.primaryHost, 'claude');
 });
 
 test('an unknown --primary-host is ignored with a warning, codex untouched', () => {
   const cfg = freshCfg();
   const r = applySetupHostFlags(cfg, { 'primary-host': 'gemini' });
-  assert.equal(cfg.providers.primaryHost, undefined);
-  assert.equal(cfg.providers.hosts.codex, false);
+  assert.equal(cfg.routing.primaryHost, 'claude');
+  assert.equal(cfg.integrations.hosts.codex, false);
   assert.equal(r.warnings.length, 1);
 });
 
 test('--codex is idempotent — a second application reports no change', () => {
-  const cfg = { providers: { hosts: { claude: true, codex: true } } };
+  const cfg = freshCfg();
+  cfg.integrations.hosts.codex = true;
   const r = applySetupHostFlags(cfg, { codex: true });
   assert.equal(r.changed, false);
 });
@@ -50,15 +63,16 @@ test('--codex is idempotent — a second application reports no change', () => {
 test('--opencode opts the opencode host in without touching claude/codex or primary', () => {
   const cfg = freshCfg();
   const r = applySetupHostFlags(cfg, { opencode: true });
-  assert.equal(cfg.providers.hosts.opencode, true);
-  assert.equal(cfg.providers.hosts.claude, true, 'claude is not replaced');
-  assert.equal(cfg.providers.hosts.codex, false, 'codex is not pulled in');
-  assert.equal(cfg.providers.primaryHost, undefined, 'no primary is implied by an integration host');
+  assert.equal(cfg.integrations.hosts.opencode, true);
+  assert.equal(cfg.integrations.hosts.claude, true, 'claude is not replaced');
+  assert.equal(cfg.integrations.hosts.codex, false, 'codex is not pulled in');
+  assert.equal(cfg.routing.primaryHost, 'claude', 'an integration host does not alter primary');
   assert.equal(r.changed, true);
 });
 
 test('--opencode is idempotent — a second application reports no change', () => {
-  const cfg = { providers: { hosts: { claude: true, codex: false, opencode: true } } };
+  const cfg = freshCfg();
+  cfg.integrations.hosts.opencode = true;
   const r = applySetupHostFlags(cfg, { opencode: true });
   assert.equal(r.changed, false);
 });
@@ -66,7 +80,29 @@ test('--opencode is idempotent — a second application reports no change', () =
 test('--primary-host opencode is ignored with a warning (integration hosts never lead)', () => {
   const cfg = freshCfg();
   const r = applySetupHostFlags(cfg, { opencode: true, 'primary-host': 'opencode' });
-  assert.equal(cfg.providers.hosts.opencode, true, 'the enablement itself still lands');
-  assert.notEqual(cfg.providers.primaryHost, 'opencode');
+  assert.equal(cfg.integrations.hosts.opencode, true, 'the enablement itself still lands');
+  assert.notEqual(cfg.routing.primaryHost, 'opencode');
   assert.equal(r.warnings.length, 1);
 });
+
+test('an empty config gets complete canonical envelopes and survives persistence', () => {
+  const cfg = {};
+  applySetupHostFlags(cfg, { codex: true });
+  assert.deepEqual(cfg.routing, {
+    version: 1,
+    primaryHost: 'claude',
+    routes: {},
+  });
+  assert.equal(cfg.integrations.version, 2);
+  assert.deepEqual(cfg.integrations.hosts, {
+    claude: true,
+    codex: true,
+    opencode: false,
+  });
+
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ak-setup-empty-'));
+  const file = path.join(dir, 'kit.json');
+  saveKitConfig(cfg, file);
+  assert.equal(loadKitConfig(file).routing.primaryHost, 'claude');
+  fs.rmSync(dir, { recursive: true, force: true });
+});
diff --git a/tests/kit/status-command.test.mjs b/tests/kit/status-command.test.mjs
index 9260688..721442e 100644
--- a/tests/kit/status-command.test.mjs
+++ b/tests/kit/status-command.test.mjs
@@ -333,11 +333,10 @@ test('run() without --hint suggests nothing (bare rows only)', async () => {
   } finally { process.chdir(cwd); }
 });
 
-test('a corrupt kit.json degrades to defaults instead of throwing', async () => {
+test('a corrupt kit.json is reported instead of silently replaced with defaults', async () => {
   seedHome();
   fs.writeFileSync(paths.kitConfigPath(), '{ this is not json');
-  const rows = await collect();
-  assert.ok(rows.length > 0, 'status still reports on an unreadable config');
+  await assert.rejects(collect(), /invalid kit config/);
 });
 
 // ── opencode subsystem rows ──────────────────────────────────────────────────
@@ -375,10 +374,11 @@ async function seedConvergedOpencode() {
   fs.writeFileSync(path.join(catalog, 'SKILL.md'), '---\nname: ruflo\ndescription: platform\n---\n\n# Ruflo\n');
   const { opencodeStack } = await import('../../src/lib/opencode.mjs');
   const cfg = loadKitConfig();
-  cfg.providers = {
-    ...(cfg.providers ?? {}),
-    hosts: { claude: true, codex: false, opencode: true },
-    opencodeCatalogDir: catalog,
+  cfg.integrations.hosts = { claude: true, codex: false, opencode: true };
+  cfg.integrations.ownership ??= {};
+  cfg.integrations.ownership.opencode = {
+    ...(cfg.integrations.ownership.opencode ?? {}),
+    catalogDir: catalog,
   };
   await withOpencodeCli(() => opencodeStack(cfg, { pkgRoot: PKG_ROOT }));
   writeKitConfig(HOME, cfg); // persist the ownership markers the stack recorded
@@ -401,7 +401,7 @@ test('enabled + converged: every opencode row is ok with no fix planned', async
 test('exact legacy artifacts without receipts surface as read-only adoption work', async () => {
   seedHome();
   const cfg = await seedConvergedOpencode();
-  cfg.providers.opencodeManaged.artifacts = {
+  cfg.integrations.ownership.opencode.managed.artifacts = {
     plugin: null, agents: {}, agentStamp: null, skill: null,
   };
   writeKitConfig(HOME, cfg);
@@ -422,7 +422,7 @@ test('exact legacy artifacts without receipts surface as read-only adoption work
 test('a malformed artifact receipt ledger blocks adoption and remains read-only', async () => {
   seedHome();
   const cfg = await seedConvergedOpencode();
-  cfg.providers.opencodeManaged.artifacts = 'corrupt';
+  cfg.integrations.ownership.opencode.managed.artifacts = 'corrupt';
   writeKitConfig(HOME, cfg);
   const before = snapshot(HOME);
 
@@ -432,7 +432,7 @@ test('a malformed artifact receipt ledger blocks adoption and remains read-only'
   assert.equal(blocked.length, 1, `one actionable malformed-ledger row expected: ${oc.map((r) => r.message)}`);
   assert.equal(blocked[0].level, 'warn');
   assert.match(blocked[0].message, /ownership adoption blocked; artifacts left untouched/);
-  assert.match(blocked[0].fix, /repair providers\.opencodeManaged\.artifacts/);
+  assert.match(blocked[0].fix, /repair integrations\.ownership\.opencode\.managed\.artifacts/);
   assert.equal(oc.some((r) => /ownership receipt|user-owned ruflo-hooks|converted agents/.test(r.message)), false,
     'blocked ownership evidence must not be reinterpreted as adoption, foreign files, or healthy agents');
   assertUnchanged(before, HOME, 'status must preserve malformed recovery evidence byte-for-byte');
diff --git a/tests/kit/status-viability.test.mjs b/tests/kit/status-viability.test.mjs
index 5fb2508..cb5689a 100644
--- a/tests/kit/status-viability.test.mjs
+++ b/tests/kit/status-viability.test.mjs
@@ -25,7 +25,7 @@ const paths = await import('../../src/lib/paths.mjs');
 const status = await import('../../src/commands/status.mjs');
 const sync = await import('../../src/commands/sync.mjs');
 const { AQE_PROVIDER_CREDENTIALS, aqeProviderCredential, credentialGaps } = await import('../../src/lib/providers.mjs');
-const { DEFAULT_ROUTES, ACTIVITIES, seedDualRouting, divergedRoutes } = await import('../../src/lib/routing.mjs');
+const { DEFAULT_ROUTES, ACTIVITIES, seedActivityRoutes, divergedRoutes } = await import('../../src/lib/routing.mjs');
 assertSandboxed(paths, HOME);
 
 const PKG_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
@@ -71,27 +71,36 @@ const rowsFor = (rows, subsystem) => rows.filter((r) => r.subsystem === subsyste
 
 /** A non-default provider config (isDefault() must be false or the providers
  *  branch short-circuits to its advisory row) carrying the given chain. */
+const routeConfig = (routes = {}) => ({
+  integrations: {
+    version: 2,
+    hosts: { claude: true, codex: true, opencode: false },
+    bindings: [],
+  },
+  routing: { version: 1, primaryHost: 'claude', routes },
+});
 const cfgWithChain = (aqeFallback) => ({
-  providers: { hosts: { claude: true, codex: true }, aqeFallback },
+  ...routeConfig(),
+  providers: { aqeFallback },
 });
 
 /** A dual-routing policy pinned to the PRIOR Opus generation — the exact #55
  *  reproduction, a machine seeded before the alpha.22 catalog bump. Built from
- *  seedDualRouting so the escalation ladders are present exactly as a real seed
+ *  seedActivityRoutes so the escalation ladders are present exactly as a real seed
  *  writes them: two of the six diverge ONLY on their escalation rung, and a
- *  hand-built fixture that dropped `escalate` would silently under-report. */
+ *  hand-built fixture that dropped `escalation` would silently under-report. */
 function divergedPolicy() {
   const rewind = (m) => (m === 'claude-opus-5' ? 'claude-opus-4-8' : m);
-  const seed = seedDualRouting({ hosts: ['claude', 'codex'] });
-  const dualRouting = {};
+  const seed = seedActivityRoutes({ hosts: ['claude', 'codex'] });
+  const activityRoutes = {};
   for (const [act, r] of Object.entries(seed)) {
-    dualRouting[act] = {
+    activityRoutes[act] = {
       ...r,
       model: rewind(r.model),
-      ...(r.escalate ? { escalate: r.escalate.map((e) => ({ ...e, model: rewind(e.model) })) } : {}),
+      ...(r.escalation ? { escalation: r.escalation.map((e) => ({ ...e, model: rewind(e.model) })) } : {}),
     };
   }
-  return dualRouting;
+  return activityRoutes;
 }
 
 /** The six the issue reported, named rather than recomputed — if a catalog bump
@@ -197,7 +206,7 @@ test('credentialGaps reports a dead codex rung through the real env path', () =>
 const FORBIDDEN_FRAMING = /\b(stale|outdated|superseded)\b/i;
 
 test('diverged seeded routes are reported as INFO, not WARN', async () => {
-  seedHome({ providers: { hosts: { claude: true, codex: true }, dualRouting: divergedPolicy() } });
+  seedHome(routeConfig(divergedPolicy()));
   const row = rowsFor(await collect(), 'routing').find((r) => /diverge/i.test(r.message));
   assert.ok(row, 'divergence must surface somewhere — invisibility is the defect');
   assert.equal(row.level, 'info',
@@ -205,13 +214,13 @@ test('diverged seeded routes are reported as INFO, not WARN', async () => {
 });
 
 test('the divergence row never calls a diverged route stale, outdated, or superseded', async () => {
-  seedHome({ providers: { hosts: { claude: true, codex: true }, dualRouting: divergedPolicy() } });
+  seedHome(routeConfig(divergedPolicy()));
   const row = rowsFor(await collect(), 'routing').find((r) => /diverge/i.test(r.message));
   assert.ok(!FORBIDDEN_FRAMING.test(row.message), `row must stay neutral, got: ${row.message}`);
 });
 
 test('the divergence row shows both models so the trade is visible', async () => {
-  seedHome({ providers: { hosts: { claude: true, codex: true }, dualRouting: divergedPolicy() } });
+  seedHome(routeConfig(divergedPolicy()));
   const row = rowsFor(await collect(), 'routing').find((r) => /diverge/i.test(r.message));
   assert.match(row.message, /claude-opus-4-8/, 'the pin the machine is on');
   assert.match(row.message, /claude-opus-5/, 'and the default it diverges from');
@@ -221,7 +230,7 @@ test('the divergence row counts all SIX activities of the reported reproduction'
   // Four diverge on their primary model; implementation/testing diverge only on
   // their escalation rung. A row that counted four would under-report the very
   // state the issue documented.
-  seedHome({ providers: { hosts: { claude: true, codex: true }, dualRouting: divergedPolicy() } });
+  seedHome(routeConfig(divergedPolicy()));
   const row = rowsFor(await collect(), 'routing').find((r) => /diverge/i.test(r.message));
   assert.match(row.message, new RegExp(`\\b${REPRODUCTION_ACTIVITIES.length}\\b`));
 });
@@ -234,17 +243,17 @@ test('divergedRoutes and the status row agree on exactly which six diverge', asy
 });
 
 test('a policy seeded from CURRENT defaults produces no divergence row at all', async () => {
-  const dualRouting = {};
+  const activityRoutes = {};
   for (const act of ACTIVITIES) {
-    dualRouting[act] = { host: DEFAULT_ROUTES[act].host, model: DEFAULT_ROUTES[act].model, source: 'seeded' };
+    activityRoutes[act] = { host: DEFAULT_ROUTES[act].host, model: DEFAULT_ROUTES[act].model, provenance: 'seeded' };
   }
-  seedHome({ providers: { hosts: { claude: true, codex: true }, dualRouting } });
+  seedHome(routeConfig(activityRoutes));
   assert.equal(rowsFor(await collect(), 'routing').filter((r) => /diverge/i.test(r.message)).length, 0);
 });
 
 test('user-pinned routes are never reported as divergence, however old the model', async () => {
-  const dualRouting = { architecture: { host: 'claude', model: 'claude-opus-4-8', source: 'user' } };
-  seedHome({ providers: { hosts: { claude: true, codex: true }, dualRouting } });
+  const activityRoutes = { architecture: { host: 'claude', model: 'claude-opus-4-8', provenance: 'user' } };
+  seedHome(routeConfig(activityRoutes));
   assert.equal(rowsFor(await collect(), 'routing').filter((r) => /diverge/i.test(r.message)).length, 0);
 });
 
@@ -253,13 +262,13 @@ test('user-pinned routes are never reported as divergence, however old the model
 test('the divergence row carries no fix — the mechanism that keeps it out of syncs plan', async () => {
   // sync's plan is *defined* as the rows carrying a `fix`. A null fix is
   // therefore not cosmetic: it is what structurally prevents an auto-refresh.
-  seedHome({ providers: { hosts: { claude: true, codex: true }, dualRouting: divergedPolicy() } });
+  seedHome(routeConfig(divergedPolicy()));
   const row = rowsFor(await collect(), 'routing').find((r) => /diverge/i.test(r.message));
   assert.equal(row.fix, null);
 });
 
 test('ak sync never plans a routing refresh for a diverged policy', async () => {
-  seedHome({ providers: { hosts: { claude: true, codex: true }, dualRouting: divergedPolicy() } });
+  seedHome(routeConfig(divergedPolicy()));
   const cwd = process.cwd();
   process.chdir(PROJECT);
   let out;
@@ -274,7 +283,7 @@ test('ak sync never plans a routing refresh for a diverged policy', async () =>
 });
 
 test('a dry-run sync leaves the diverged policy byte-identical on disk', async () => {
-  seedHome({ providers: { hosts: { claude: true, codex: true }, dualRouting: divergedPolicy() } });
+  seedHome(routeConfig(divergedPolicy()));
   const before = fs.readFileSync(paths.kitConfigPath(), 'utf8');
   const cwd = process.cwd();
   process.chdir(PROJECT);
@@ -300,7 +309,7 @@ test('sync.mjs does not reference the seeded-route refresh path at all', async (
 // ── neutral framing is a whole-surface property, not one row ───────────────
 
 test('no status row anywhere frames a diverged route as stale/outdated/superseded', async () => {
-  seedHome({ providers: { hosts: { claude: true, codex: true }, dualRouting: divergedPolicy() } });
+  seedHome(routeConfig(divergedPolicy()));
   for (const r of await collect()) {
     if (!/diverge|seeded route/i.test(r.message)) continue;
     assert.ok(!FORBIDDEN_FRAMING.test(r.message), `neutral framing violated: ${r.message}`);
diff --git a/tests/kit/sync-command.test.mjs b/tests/kit/sync-command.test.mjs
index 7e94da4..ada514e 100644
--- a/tests/kit/sync-command.test.mjs
+++ b/tests/kit/sync-command.test.mjs
@@ -189,7 +189,14 @@ function syncCfg(catalog) {
   return offlineKitConfig({
     agentdb: false,
     mcp: { register: false, excludeFamilies: [] },
-    providers: { hosts: { claude: true, codex: false, opencode: true }, opencodeCatalogDir: catalog },
+    integrations: {
+      version: 2,
+      hosts: { claude: true, codex: false, opencode: true },
+      bindings: [],
+      ownership: { opencode: { catalogDir: catalog } },
+    },
+    routing: { version: 1, primaryHost: 'claude', routes: {} },
+    providers: {},
   });
 }
 
@@ -242,7 +249,7 @@ test('converged claude guidance + fresh opencode enable: opencode guidance lands
   // Step 1: converge everything except opencode (opencode disabled here).
   seedHome(syncCfg(catalog), { ruflo: '9.9.9' });
   const disabledCfg = syncCfg(catalog);
-  disabledCfg.providers.hosts = { claude: true, codex: false, opencode: false };
+  disabledCfg.integrations.hosts = { claude: true, codex: false, opencode: false };
   writeKitConfig(HOME, disabledCfg);
   paths._setGlobalRootForTest(fakeSyncRoot());
   await withOpencodeCli(() => realSync()); // CLAUDE.md blocks now converged
diff --git a/tests/kit/uninstall-command.test.mjs b/tests/kit/uninstall-command.test.mjs
index b527def..1c33fd5 100644
--- a/tests/kit/uninstall-command.test.mjs
+++ b/tests/kit/uninstall-command.test.mjs
@@ -238,22 +238,30 @@ function seedManagedOpencode() {
     '# my notes\n\n<!-- BEGIN ruflo-opencode-reference -->\nguidance\n<!-- END ruflo-opencode-reference -->\n');
   writeKitConfig(HOME, {
     aqe: true,
-    providers: {
+    integrations: {
+      version: 2,
       hosts: { claude: true, codex: false, opencode: true },
-      opencodeMcp: 'ak',
-      opencodeManaged: {
-        mcp: { 'claude-flow': { prior: null, written: { type: 'local', command: ['ruflo', 'mcp', 'start'], enabled: true } } },
-        paths: [],
-        permissions: { 'claude-flow_*': { prior: null, written: 'allow' } },
-        permissionScalar: null,
-        artifacts: {
-          plugin: hash(plugin),
-          agents: { 'coder.md': hash(agent) },
-          agentStamp: hash(stamp),
-          skill: hash(skill),
+      bindings: [],
+      ownership: {
+        opencode: {
+          mcp: 'ak',
+          managed: {
+            mcp: { 'claude-flow': { prior: null, written: { type: 'local', command: ['ruflo', 'mcp', 'start'], enabled: true } } },
+            paths: [],
+            permissions: { 'claude-flow_*': { prior: null, written: 'allow' } },
+            permissionScalar: null,
+            artifacts: {
+              plugin: hash(plugin),
+              agents: { 'coder.md': hash(agent) },
+              agentStamp: hash(stamp),
+              skill: hash(skill),
+            },
+          },
         },
       },
     },
+    routing: { version: 1, primaryHost: 'claude', routes: {} },
+    providers: {},
   });
 }
 
@@ -277,7 +285,7 @@ test('default uninstall strips ak opencode wiring + artifacts and restores user
   assert.ok(!md.includes('ruflo-opencode-reference'), 'guidance block stripped');
   assert.ok(md.includes('# my notes'), 'user guidance survives');
   const cfg = JSON.parse(fs.readFileSync(paths.kitConfigPath(), 'utf8'));
-  assert.equal(cfg.providers.opencodeMcp, null, 'ownership markers nulled (kit.json kept without --purge)');
+  assert.equal(cfg.integrations.ownership.opencode.mcp, null, 'ownership markers nulled (kit.json kept without --purge)');
 });
 
 test('repeated uninstall is harmless for the opencode footprint', async () => {
diff --git a/tests/kit/usage-index.test.mjs b/tests/kit/usage-index.test.mjs
index a6a0ae1..1d83b29 100644
--- a/tests/kit/usage-index.test.mjs
+++ b/tests/kit/usage-index.test.mjs
@@ -450,7 +450,7 @@ test('buildIndex emits the documented Aggregate shape', async () => {
   const agg = await buildIndex(opts(sb));
 
   for (const k of ['generatedAt', 'windowDays', 'pricesAsOf', 'totals', 'byDay', 'byModel',
-    'byHost', 'byProvider', 'byTranscriptProvider', 'byProject', 'byCategory',
+    'byHost', 'byProvider', 'byProject', 'byCategory',
     'punchcard', 'projectTree', 'sessions', 'insights']) {
     assert.ok(k in agg, `missing ${k}`);
   }
@@ -606,7 +606,6 @@ test('byDay, byModel, byHost, byProvider, byProject and byCategory partition the
   assert.equal(sum(agg.byCategory), agg.totals.tokens);
   assert.deepEqual(Object.keys(agg.byHost).sort(), ['claude', 'codex']);
   assert.deepEqual(Object.keys(agg.byProvider), ['unknown']);
-  assert.deepEqual(agg.byTranscriptProvider, agg.byHost);
   // byDay keys are LOCAL calendar days, so a far-eastern tz may split the
   // fixtures' 09:00–12:00Z across two adjacent days. Both are in-window.
   for (const day of Object.keys(agg.byDay)) {