diff --git a/.claude-config/backup/daily-sync.sh b/.claude-config/backup/daily-sync.sh
index 2161aeb..7f6ac55 100755
--- a/.claude-config/backup/daily-sync.sh
+++ b/.claude-config/backup/daily-sync.sh
@@ -32,6 +32,17 @@
 #     pull failed on every run, so nothing was ever backed up. When the pull
 #     fails and `git ls-remote --exit-code` says the branch is absent (exit 2,
 #     not a network or auth error), the run pushes through the gate instead.
+#   - No origin remote: a copy with no remote named `origin` is a supported
+#     setup (OPS works without GitHub). The day's work is still committed, then
+#     the OPS stage logs one INFO line ("no origin remote ...: nothing pulled or
+#     pushed") and returns success; the project and branch-gc stages run as on
+#     any other copy, and the briefing reads the INFO line as "local only". The
+#     test is `git remote` listing no `origin`, which reads only the local
+#     config: an origin that exists but cannot be reached (offline, a dead URL,
+#     no credentials) is never taken for "no origin" and stays a failed pull,
+#     an ERROR. deploy schedules this job on every copy and leaves this choice
+#     to this script (an earlier deploy skipped the schedule on such copies, so
+#     they lost the nightly project pull and branch cleanup too).
 
 set -uo pipefail
 
@@ -166,6 +177,27 @@ backup_ops() {
         committed=1
     fi
 
+    # No origin remote: the commit above is the whole backup (see Design).
+    # `git remote` reads only the local config, so a network or auth failure
+    # can never land here, and an origin that is configured but broken (a bad
+    # URL, a pushurl with no url) falls through to the pull and fails loudly.
+    # A `git remote` that itself fails is an ERROR, not a no-origin copy. The
+    # match is in bash, not `printf | grep -q`: under pipefail an early grep
+    # exit can fail the pipe and read as "no origin" on a copy that has one.
+    local remotes
+    if ! remotes="$(git remote 2>&1)"; then
+        log "OPS: ERROR could not list the git remotes; nothing pulled or pushed: $(printf '%s' "$remotes" | tail -1)"
+        return 1
+    fi
+    if [[ $'\n'"$remotes"$'\n' != *$'\n'origin$'\n'* ]]; then
+        if [ "$committed" = 1 ]; then
+            log "OPS: INFO no origin remote: the day's commit is kept locally; nothing pulled or pushed"
+        else
+            log "OPS: INFO no origin remote: no local changes to commit; nothing pulled or pushed"
+        fi
+        return 0
+    fi
+
     # Then pull, so the tree stays current across hosts. --no-autostash: the
     # tree is committed, and a stash is exactly what this order avoids. A
     # failed pull (offline, no credentials under cron, a conflicting rebase)
diff --git a/.claude-config/bin/tests/branch-gc-safety-test.py b/.claude-config/bin/tests/branch-gc-safety-test.py
index f8dffbc..3b228c2 100755
--- a/.claude-config/bin/tests/branch-gc-safety-test.py
+++ b/.claude-config/bin/tests/branch-gc-safety-test.py
@@ -493,6 +493,9 @@ def test_daily_sync_runs_gc_last_and_logs_auth_failure_nonfatally(self):
         (ops / "README.md").write_text("ops\n")
         self.git("add", "README.md", at=ops)
         self.git("commit", "-q", "-m", "seed", at=ops)
+        # An origin, so the backup stage pulls (a copy with no origin skips the
+        # pull by design). It is never contacted: the interceptor fakes the pull.
+        self.git("remote", "add", "origin", "git@example.invalid:acme/ops.git", at=ops)
         self.git_interceptor('''
 if "pull" in args:
     with (root / "order").open("a") as f: f.write("pull\\n")
diff --git a/.claude-config/bin/tests/daily-sync-test.sh b/.claude-config/bin/tests/daily-sync-test.sh
index d4e47d7..f2047f0 100755
--- a/.claude-config/bin/tests/daily-sync-test.sh
+++ b/.claude-config/bin/tests/daily-sync-test.sh
@@ -26,8 +26,18 @@
 #     gate: pushed to a private origin, held for a public one; an unreachable
 #     origin is still a failed pull, never a first push
 #
-# Run:  bash ~/OPS/.claude-config/bin/tests/daily-sync-test.sh
+#   - no origin remote: the day's commit is kept, the OPS stage logs one INFO
+#     line and no ERROR or WARN, nothing is pulled or pushed, and the project
+#     and branch-gc stages still run; a remote under another name is no origin;
+#     an origin that exists but cannot be reached, or has only a push URL, is
+#     still a failed pull (ERROR), and so is a `git remote` that fails
+#
+# It names branch-gc (a stub in its fixture, never the real tool), so like the
+# other suites that do it starts with the sandbox guard (verify-ops check 24):
+#   ~/OPS/.claude-config/bin/sandbox-run --no-bind --no-net --ro-bind ~/OPS -- \
+#     bash ~/OPS/.claude-config/bin/tests/daily-sync-test.sh
 set -uo pipefail
+. "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/../sandbox-guard.sh" && sandbox_guard || exit 97
 
 CFG="$(cd "$(dirname "$0")/../.." && pwd)"
 SYNC="$CFG/backup/daily-sync.sh"
@@ -57,11 +67,17 @@ case "${*: -1}" in
 esac
 exit 1
 STUB
-# Every git call passes through this wrapper, which records any stash.
+# Every git call passes through this wrapper, which records any stash and any
+# call that talks to a remote (the no-origin cases assert there are none).
+# FAIL_GIT_REMOTE=1 makes a bare `git remote` fail, as a broken config would.
 REAL_GIT="$(command -v git)"
 cat > "$WORK/bin/git" <<STUB
 #!/usr/bin/env bash
-for a in "\$@"; do [ "\$a" = stash ] && printf '%s\n' "\$*" >> "$WORK/stash-calls"; done
+for a in "\$@"; do
+  [ "\$a" = stash ] && printf '%s\n' "\$*" >> "$WORK/stash-calls"
+  case "\$a" in pull|push|fetch|ls-remote) printf '%s\n' "\$*" >> "$WORK/remote-calls" ;; esac
+done
+if [ "\${FAIL_GIT_REMOTE:-}" = 1 ] && [ "\$*" = remote ]; then echo "fatal: bad config line 1 in file .git/config" >&2; exit 128; fi
 exec "$REAL_GIT" "\$@"
 STUB
 chmod +x "$WORK/bin/gh" "$WORK/fake-ssh" "$WORK/bin/git"
@@ -314,4 +330,96 @@ grep -q 'OPS: backup pushed successfully' "$LOG" || fail "missing remote branch,
 if grep -q 'OPS: ERROR' "$LOG"; then fail "missing remote branch, private origin: logged as an error"; fi
 pass "an origin with no branch yet is a first push through the gate: held for a public origin, pushed to a private one"
 
+# --- No origin remote: commit locally, one INFO line, every stage still runs -----
+# (2026-11-06: deploy stopped scheduling the job on a copy with no origin, so
+# such a copy also lost its nightly project pull and branch-gc. The job is
+# scheduled again everywhere, and this stage is what tells "no origin" apart.)
+# A fresh copy made with `git init` (the template copied, never cloned), with a
+# branch-gc stub so the third stage leaves a trace too.
+export HOME="$WORK/local-home"
+OPS="$HOME/OPS"; LOG="$OPS/.claude-config/backup/sync.log"
+git init -q -b main "$OPS" || fail "fixture: git init the local-only copy"
+mkdir -p "$OPS/.claude-config/bin" "$OPS/PROJECTS"
+cp "$CHECK" "$OPS/.claude-config/bin/origin-private-check"
+printf '.claude-config/backup/sync.log\n' > "$OPS/.gitignore"
+printf '#!/usr/bin/env bash\necho "projects stage ran ($1)"\n' > "$OPS/PROJECTS/sync-check.sh"
+printf '#!/usr/bin/env bash\necho "branch-gc stage ran ($1)"\n' > "$OPS/.claude-config/bin/branch-gc"
+chmod +x "$OPS/.claude-config/bin/branch-gc"
+git -C "$OPS" add -A && git -C "$OPS" commit -q -m seed || fail "fixture: seed the local-only copy"
+NO_ORIGIN_DIRTY="OPS: INFO no origin remote: the day's commit is kept locally; nothing pulled or pushed"
+NO_ORIGIN_CLEAN="OPS: INFO no origin remote: no local changes to commit; nothing pulled or pushed"
+ops_lines() { grep -E '^\[[^]]*\] OPS: ' "$LOG" | sed 's/^\[[^]]*\] //'; }
+all_stages_ran() {
+    grep -q 'projects stage ran (--auto)' "$LOG" && grep -q 'PROJECTS: sync-check.sh --auto completed' "$LOG" \
+      || fail "$1: the project stage did not run"
+    grep -q 'branch-gc stage ran (--apply)' "$LOG" && grep -q 'BRANCH-GC: branch-gc --apply completed' "$LOG" \
+      || fail "$1: the branch-gc stage did not run"
+    grep -q '===== daily-sync complete =====' "$LOG" || fail "$1: the run did not complete"
+}
+
+dirty_tree local
+head_before="$(local_head)"; rm -f "$WORK/remote-calls"
+run_sync
+[ "$(ops_lines)" = "$NO_ORIGIN_DIRTY" ] || fail "no origin: the OPS stage did not log exactly the one INFO line: $(ops_lines)"
+[ "$(git -C "$OPS" log -1 --format=%s)" = "Daily Backup $(date '+%Y-%m-%d')" ] && [ "$(git -C "$OPS" rev-parse HEAD^)" = "$head_before" ] \
+  || fail "no origin: the day's commit was not made"
+[ -z "$(git -C "$OPS" status --porcelain)" ] && git -C "$OPS" cat-file -e HEAD:untracked-local.md \
+  || fail "no origin: the day's work is not all in the day's commit"
+[ ! -s "$WORK/remote-calls" ] || fail "no origin: git talked to a remote: $(cat "$WORK/remote-calls")"
+all_stages_ran "no origin"
+no_stash "no origin"
+pass "no origin: the day's commit is kept, one INFO line and no ERROR or WARN, nothing pulled or pushed, every stage ran"
+
+head_before="$(local_head)"
+run_sync
+[ "$(ops_lines)" = "$NO_ORIGIN_CLEAN" ] || fail "no origin, clean tree: not the one INFO line: $(ops_lines)"
+[ "$(local_head)" = "$head_before" ] || fail "no origin, clean tree: a commit was made"
+[ ! -s "$WORK/remote-calls" ] || fail "no origin, clean tree: git talked to a remote: $(cat "$WORK/remote-calls")"
+all_stages_ran "no origin, clean tree"
+pass "no origin, clean tree: nothing committed, the INFO line says so, every stage ran"
+
+# A remote under another name is not an origin: the backup only ever pulls and
+# pushes origin, so the copy is local only (deploy used the same rule).
+git -C "$OPS" remote add upstream "$WORK/never-contacted.git"
+printf 'upstream day\n' > "$OPS/upstream-day.md"
+run_sync
+[ "$(ops_lines)" = "$NO_ORIGIN_DIRTY" ] || fail "remote named upstream: not read as no origin: $(ops_lines)"
+[ ! -s "$WORK/remote-calls" ] || fail "remote named upstream: git talked to a remote: $(cat "$WORK/remote-calls")"
+git -C "$OPS" remote remove upstream
+pass "a remote under another name does not count as an origin"
+
+# An origin that exists but cannot be reached is a failed pull, an ERROR, as
+# on any copy: never "no origin". A local path that does not exist fails
+# without any network, so the case is deterministic.
+git -C "$OPS" remote add origin "$WORK/no-such-dir/ops.git"
+printf 'dead origin day\n' > "$OPS/dead-origin.md"
+head_before="$(local_head)"
+run_sync
+grep -q "OPS: ERROR pull --rebase failed; the day's commit is kept locally, nothing pushed" "$LOG" \
+  || fail "unreachable origin on a local copy: not an ERROR: $(ops_lines)"
+if grep -q 'OPS: INFO no origin remote' "$LOG"; then fail "unreachable origin: read as no origin"; fi
+[ "$(git -C "$OPS" rev-parse HEAD^)" = "$head_before" ] && git -C "$OPS" cat-file -e HEAD:dead-origin.md \
+  || fail "unreachable origin on a local copy: the day's commit was not kept"
+all_stages_ran "unreachable origin on a local copy"
+pass "an origin that exists but cannot be reached is still an ERROR, never 'no origin'"
+
+# An origin with a push URL and no fetch URL is still an origin (git lists it):
+# the pull fails loudly instead of the copy passing as local only.
+git -C "$OPS" config --unset remote.origin.url
+git -C "$OPS" config remote.origin.pushurl "$WORK/no-such-dir/ops.git"
+run_sync
+grep -q 'OPS: ERROR pull --rebase failed' "$LOG" || fail "origin with only a push URL: not an ERROR: $(ops_lines)"
+if grep -q 'OPS: INFO no origin remote' "$LOG"; then fail "origin with only a push URL: read as no origin"; fi
+git -C "$OPS" remote remove origin
+pass "an origin with only a push URL is still an origin: the failed pull is an ERROR"
+
+# When git cannot list the remotes at all, that is an ERROR, not a local copy.
+printf 'broken config day\n' > "$OPS/broken-config.md"
+FAIL_GIT_REMOTE=1 run_sync
+grep -q 'OPS: ERROR could not list the git remotes; nothing pulled or pushed: fatal: bad config line 1' "$LOG" \
+  || fail "git remote failing: not an ERROR: $(ops_lines)"
+if grep -q 'OPS: INFO no origin remote' "$LOG"; then fail "git remote failing: read as no origin"; fi
+all_stages_ran "git remote failing"
+pass "a git remote that cannot list the remotes is an ERROR, not 'no origin'"
+
 echo "ALL PASS"
diff --git a/.claude-config/bin/tests/deploy-cron-test.sh b/.claude-config/bin/tests/deploy-cron-test.sh
index 2f894f5..886b44a 100755
--- a/.claude-config/bin/tests/deploy-cron-test.sh
+++ b/.claude-config/bin/tests/deploy-cron-test.sh
@@ -1,24 +1,24 @@
 #!/usr/bin/env bash
-# deploy-cron-test.sh: deploy.sh schedules the nightly backup only when the OPS
-# repo has an `origin` remote.
+# deploy-cron-test.sh: deploy.sh schedules the nightly backup on every copy,
+# with or without an `origin` remote.
 #
-# A copy with no remote is a supported setup (OPS works without GitHub). There
-# the backup's OPS stage logs "'origin' does not appear to be a git repository"
-# on every run and the session briefing reports a failed backup in every
-# session, so deploy must not schedule the job. daily-sync.sh is unchanged: a
-# copy that has a remote and cannot push still logs and reports loudly (that is
-# daily-sync-test.sh's ground).
+# A copy with no remote is a supported setup (OPS works without GitHub). An
+# earlier deploy did not schedule the job there, so such a copy also lost the
+# job's nightly project pull and branch-gc. Now daily-sync.sh is the one place
+# that decides what a copy with no origin does (it commits locally and logs one
+# INFO line; daily-sync-test.sh covers that), and deploy does not look at the
+# remotes at all.
 #
 # This runs the real cron block sliced out of deploy.sh, against a fake
 # `crontab` kept in a file and throwaway git repos as the OPS root, and asserts:
 #   - origin present: the cron line is installed once, exactly as before, and a
 #     second run installs nothing more
 #   - no origin (a fresh `git init`, a remote under another name, a directory
-#     that is not a repository): nothing is written to the crontab, the one
-#     "No git remote" line is printed, and the deploy does not count it a failure
+#     that is not a repository): the same line is installed once, nothing says
+#     "No git remote", and a rerun adds nothing
+#   - the cron block never runs git: the remotes are not deploy's decision
 #   - an existing cron line is left alone, with and without an origin: the
-#     crontab is byte-identical and written zero times; without an origin the
-#     deploy says so and names the fix, and still removes nothing
+#     crontab is byte-identical and written zero times, and no warning is printed
 #   - other crontab entries survive a run in every case
 #   - --no-system touches no crontab either way
 #
@@ -50,7 +50,14 @@ case "${1:-}" in
   *)  echo "fake crontab: unexpected arguments: $*" >&2; exit 2 ;;
 esac
 STUB
-chmod +x "$WORK/bin/crontab"
+# git, on the block's PATH only, records every call: the block must make none.
+REAL_GIT="$(command -v git)"
+cat > "$WORK/bin/git" <<STUB
+#!/usr/bin/env bash
+printf '%s\n' "\$*" >> "$WORK/git-calls"
+exec "$REAL_GIT" "\$@"
+STUB
+chmod +x "$WORK/bin/crontab" "$WORK/bin/git"
 
 BLOCK="$(awk '/^# --- Daily backup cron job ---/ {p=1} p && /^# --- Claude Code plugins/ {exit} p {print}' "$DEPLOY")"
 printf '%s\n' "$BLOCK" | grep -q 'crontab' && printf '%s\n' "$BLOCK" | grep -q 'CRON_LINE' \
@@ -86,59 +93,61 @@ run_block() {
 new_crontab() { export CRONTAB_FILE="$WORK/crontab.$1"; rm -f "$CRONTAB_FILE" "$CRONTAB_FILE.writes"; }
 cron_count() { grep -cF '# OPS Daily Backup' "$CRONTAB_FILE" 2>/dev/null || true; }
 cron_writes() { if [ -f "$CRONTAB_FILE.writes" ]; then wc -l < "$CRONTAB_FILE.writes" | tr -d ' '; else echo 0; fi; }
-NOREMOTE_MSG='No git remote: the nightly backup is not scheduled. Add a GitHub remote (DEPLOYMENT.md), then rerun deploy.'
+cron_line() { echo "0 9 * * * $1/.claude-config/backup/daily-sync.sh # OPS Daily Backup"; }
+
+# installs_once <ops-root> <label>: one run installs exactly the cron line,
+# with no remote check and no warning; a second run adds nothing.
+installs_once() {
+  rm -f "$WORK/git-calls"
+  run_block "$1"
+  [ "$(cron_count)" = 1 ] || fail "$2: the cron line was not installed exactly once ($(cron_count))"
+  [ "$(grep -F '# OPS Daily Backup' "$CRONTAB_FILE")" = "$(cron_line "$1")" ] \
+    || fail "$2: the installed cron line changed shape: $(cat "$CRONTAB_FILE")"
+  grep -q '^OK Cron job installed' "$OUT" || fail "$2: no 'installed' message"
+  grep -q '^DEPLOY_FAILED=\[\]$' "$OUT" || fail "$2: a clean install counted as a failed deploy"
+  ! grep -q -e '^WARN' -e '^BAD' -e 'No git remote' "$OUT" || fail "$2: printed a warning or a failure"
+  [ ! -s "$WORK/git-calls" ] || fail "$2: the cron block ran git: $(cat "$WORK/git-calls")"
+  run_block "$1"
+  [ "$(cron_count)" = 1 ] && [ "$(cron_writes)" = 1 ] || fail "$2: a second run installed another line (lines $(cron_count), writes $(cron_writes))"
+  grep -q '^OK Cron job already installed' "$OUT" || fail "$2: no 'already installed' message on the second run"
+}
 
 # --- 1. origin present: scheduled as before ----------------------------------
 mk_repo "$WORK/with-origin" origin
 new_crontab 1
-run_block "$WORK/with-origin"
-[ "$(cron_count)" = 1 ] || fail "with an origin, the cron line was not installed exactly once ($(cron_count))"
-[ "$(grep -F '# OPS Daily Backup' "$CRONTAB_FILE")" = "0 9 * * * $WORK/with-origin/.claude-config/backup/daily-sync.sh # OPS Daily Backup" ] \
-  || fail "the installed cron line changed shape: $(cat "$CRONTAB_FILE")"
-grep -q '^OK Cron job installed' "$OUT" || fail "no 'installed' message with an origin"
-grep -q '^DEPLOY_FAILED=\[\]$' "$OUT" || fail "a clean install counted as a failed deploy"
-! grep -q 'No git remote' "$OUT" || fail "the no-remote line was printed with an origin"
-run_block "$WORK/with-origin"
-[ "$(cron_count)" = 1 ] && [ "$(cron_writes)" = 1 ] || fail "a second run installed another line (lines $(cron_count), writes $(cron_writes))"
-grep -q '^OK Cron job already installed' "$OUT" || fail "no 'already installed' message on the second run"
+installs_once "$WORK/with-origin" "origin present"
 pass "origin present: the cron line is installed once as before, and a rerun adds nothing"
 
-# --- 2. no origin: nothing scheduled, one clear line --------------------------
+# --- 2. no origin: scheduled the same way ---------------------------------------
 mk_repo "$WORK/bare-init"
 new_crontab 2
-run_block "$WORK/bare-init"
-[ ! -e "$CRONTAB_FILE" ] && [ "$(cron_writes)" = 0 ] || fail "with no origin, the crontab was written"
-[ "$(grep -c '^WARN No git remote' "$OUT")" = 1 ] && grep -qxF "WARN $NOREMOTE_MSG" "$OUT" || fail "the no-remote line is missing, duplicated or reworded"
-grep -q '^DEPLOY_FAILED=\[\]$' "$OUT" || fail "a copy with no remote counted as a failed deploy"
-! grep -q '^BAD' "$OUT" || fail "a copy with no remote printed a failure line"
-pass "no origin: nothing is scheduled, the one no-remote line is printed, and deploy still passes"
+installs_once "$WORK/bare-init" "no origin"
+pass "no origin: the cron line is installed once, with no warning, and a rerun adds nothing"
 
-# Other crontab entries survive, byte for byte, with no write.
+# Other crontab entries survive, byte for byte, ahead of the new line.
 new_crontab 2b
 printf '30 2 * * * /usr/local/bin/other-job\n' > "$CRONTAB_FILE"
 cp "$CRONTAB_FILE" "$WORK/before"
 run_block "$WORK/bare-init"
-cmp -s "$CRONTAB_FILE" "$WORK/before" && [ "$(cron_writes)" = 0 ] || fail "no-origin deploy changed an unrelated crontab"
-pass "no origin: unrelated crontab entries are untouched"
+[ "$(head -n 1 "$CRONTAB_FILE")" = "$(cat "$WORK/before")" ] && [ "$(cron_count)" = 1 ] && [ "$(wc -l < "$CRONTAB_FILE")" = 2 ] \
+  || fail "no-origin deploy lost or changed an unrelated crontab entry: $(cat "$CRONTAB_FILE")"
+pass "no origin: unrelated crontab entries are kept and the line is added once"
 
-# A remote under another name is not an origin: daily-sync.sh pushes origin.
+# A remote under another name, or no repository at all (a tarball copy): the
+# same. What the job does there is daily-sync.sh's to decide, not deploy's (on
+# a directory that is not a repository its OPS stage logs an ERROR each night).
 mk_repo "$WORK/other-remote" upstream
 new_crontab 2c
-run_block "$WORK/other-remote"
-[ ! -e "$CRONTAB_FILE" ] && grep -q '^WARN No git remote' "$OUT" || fail "a remote named upstream was treated as an origin"
-pass "no origin: a remote under another name does not count"
-
-# Not a repository at all (a tarball copy): no origin either, and no crash.
+installs_once "$WORK/other-remote" "remote named upstream"
+pass "no origin: a remote under another name is scheduled the same way"
 mkdir -p "$WORK/not-a-repo/.claude-config/backup"
 printf '#!/usr/bin/env bash\n' > "$WORK/not-a-repo/.claude-config/backup/daily-sync.sh"
 new_crontab 2d
-run_block "$WORK/not-a-repo"
-[ ! -e "$CRONTAB_FILE" ] && grep -q '^WARN No git remote' "$OUT" && grep -q '^DEPLOY_FAILED=\[\]$' "$OUT" \
-  || fail "a directory that is not a repository was scheduled or failed the deploy"
-pass "no origin: a directory that is not a git repository is handled the same way"
+installs_once "$WORK/not-a-repo" "not a repository"
+pass "no origin: a directory that is not a git repository is scheduled the same way"
 
 # --- 3. an existing cron line is left alone ------------------------------------
-EXISTING="0 9 * * * $WORK/with-origin/.claude-config/backup/daily-sync.sh # OPS Daily Backup"
+EXISTING="$(cron_line "$WORK/with-origin")"
 for case in with-origin bare-init; do
   new_crontab "3-$case"
   printf '30 2 * * * /usr/local/bin/other-job\n%s\n' "$EXISTING" > "$CRONTAB_FILE"
@@ -148,15 +157,10 @@ for case in with-origin bare-init; do
   [ "$(cron_writes)" = 0 ] || fail "an existing cron line was rewritten ($case)"
   [ "$(cron_count)" = 1 ] || fail "an existing cron line was removed or duplicated ($case)"
   grep -q '^DEPLOY_FAILED=\[\]$' "$OUT" || fail "an existing cron line failed the deploy ($case)"
-  if [ "$case" = with-origin ]; then
-    grep -q '^OK Cron job already installed' "$OUT" || fail "no 'already installed' message with an origin"
-  else
-    grep -q '^WARN Cron job already installed, but this copy has no git remote' "$OUT" && grep -q 'crontab -e' "$OUT" \
-      || fail "an existing line with no origin did not say so and name the fix"
-    ! grep -q 'No git remote: the nightly backup is not scheduled' "$OUT" || fail "claimed 'not scheduled' while a line exists"
-  fi
+  grep -q '^OK Cron job already installed\.$' "$OUT" || fail "no 'already installed' message ($case)"
+  ! grep -q -e '^WARN' -e 'no git remote' "$OUT" || fail "an existing cron line drew a warning ($case)"
 done
-pass "an existing cron line is left alone with and without an origin (no write, nothing removed); without one the deploy names the fix"
+pass "an existing cron line is left alone with and without an origin (no write, nothing removed, no warning)"
 
 # --- 4. --no-system touches no crontab, with or without an origin --------------
 for case in with-origin bare-init; do
diff --git a/.claude-config/bin/tests/deploy-windows-test.ps1 b/.claude-config/bin/tests/deploy-windows-test.ps1
index 3bdbccc..4bdfe08 100644
--- a/.claude-config/bin/tests/deploy-windows-test.ps1
+++ b/.claude-config/bin/tests/deploy-windows-test.ps1
@@ -239,11 +239,11 @@ esac
     }
     finally { $env:USERPROFILE = $previousProfile }
 
-    # The nightly task is registered only when the OPS repo has an origin remote
-    # (deploy.sh follows the same rule; a copy with no remote would log an error
-    # every night and the briefing would report a failed backup). Run the real
-    # block with the ScheduledTask cmdlets replaced by recorders; git is the
-    # real git, on throwaway repos.
+    # The nightly task is registered on every copy, with or without an origin
+    # remote (deploy.sh follows the same rule): daily-sync.sh decides what a
+    # copy with no origin does, so the block never runs git. Run the real block
+    # with the ScheduledTask cmdlets replaced by recorders; the repos are real,
+    # made with the real git, and a git recorder is in scope only for the block.
     $taskBlock = Extract-Block '# --- Register daily backup scheduled task ---' '# --- Mount the shared skills'
     $bashLine = '$BashExe = Resolve-BashExe'
     Assert ($taskBlock.Contains($bashLine)) 'The task block no longer resolves bash with Resolve-BashExe'
@@ -281,42 +281,45 @@ esac
     function Invoke-TaskBlock {
         param([string]$Root, [bool]$System = $true, [bool]$Existing = $false)
         $script:registerCalls = 0; $script:registeredAction = $null; $script:taskExists = $Existing
-        $script:taskWarns = @(); $script:taskGoods = @()
+        $script:taskWarns = @(); $script:taskGoods = @(); $script:gitCalls = @()
         $OpsRoot = $Root; $BackupDir = Join-Path $Root '.claude-config/backup'; $NoSystem = -not $System
+        # Records the call, then runs the real git, so a remote check brought
+        # back into the block fails both on the call and on what it decides.
+        function git { $script:gitCalls += @("$args"); & (Get-Command git -CommandType Application | Select-Object -First 1) @args }
         Invoke-Expression $taskBlock
     }
-    $noRemote = 'No git remote: the nightly backup is not scheduled. Add a GitHub remote (DEPLOYMENT.md), then rerun deploy.'
+    function Assert-Registered {
+        param([string]$Label)
+        Assert ($script:registerCalls -eq 1) "${Label}: the task was not registered once ($script:registerCalls)"
+        Assert (@($script:taskGoods | Where-Object { $_ -like 'Daily backup task registered + verified*' }).Count -eq 1) "${Label}: no verified-registration line: $($script:taskGoods -join ' | ')"
+        Assert ($script:taskWarns.Count -eq 0) "${Label}: a warning was printed: $($script:taskWarns -join ' | ')"
+        Assert ($script:gitCalls.Count -eq 0) "${Label}: the task block ran git: $($script:gitCalls -join ' | ')"
+    }
 
     Invoke-TaskBlock -Root (New-TaskRepo 'with-origin' 'origin')
-    Assert ($script:registerCalls -eq 1) "With an origin the task was not registered once ($script:registerCalls)"
-    Assert (@($script:taskGoods | Where-Object { $_ -like 'Daily backup task registered + verified*' }).Count -eq 1) "No verified-registration line: $($script:taskGoods -join ' | ')"
-    Assert (@($script:taskWarns | Where-Object { $_ -like 'No git remote*' }).Count -eq 0) 'The no-remote line was printed with an origin'
+    Assert-Registered 'origin present'
     Write-Host 'PASS: origin present: the daily backup task is registered and verified as before'
 
     Invoke-TaskBlock -Root (New-TaskRepo 'no-origin')
-    Assert ($script:registerCalls -eq 0) 'With no origin the task was registered'
-    Assert (@($script:taskWarns | Where-Object { $_ -ceq $noRemote }).Count -eq 1) "The no-remote line is missing or reworded: $($script:taskWarns -join ' | ')"
-    Assert ($script:taskGoods.Count -eq 0) 'A registration success line was printed with no origin'
-    Write-Host 'PASS: no origin: nothing is registered and the one no-remote line is printed'
+    Assert-Registered 'no origin'
+    Write-Host 'PASS: no origin: the task is registered and verified the same way, with no warning'
 
     Invoke-TaskBlock -Root (New-TaskRepo 'other-remote' 'upstream')
-    Assert ($script:registerCalls -eq 0 -and @($script:taskWarns | Where-Object { $_ -ceq $noRemote }).Count -eq 1) 'A remote named upstream was treated as an origin'
+    Assert-Registered 'remote named upstream'
     Invoke-TaskBlock -Root (New-TaskRepo 'not-a-repo' -NoGit)
-    Assert ($script:registerCalls -eq 0 -and @($script:taskWarns | Where-Object { $_ -ceq $noRemote }).Count -eq 1) 'A directory that is not a repository was treated as having an origin'
-    Write-Host 'PASS: no origin: a remote under another name, or no repository at all, does not count'
+    Assert-Registered 'not a repository'
+    Write-Host 'PASS: no origin: a remote under another name, or no repository at all, is registered the same way'
 
     Invoke-TaskBlock -Root (Join-Path $taskRoot 'no-origin') -Existing $true
-    Assert ($script:registerCalls -eq 0) 'An existing task with no origin was re-registered'
-    Assert (@($script:taskWarns | Where-Object { $_ -like 'Daily backup task already registered, but this copy has no git remote*Unregister-ScheduledTask*' }).Count -eq 1) "An existing task with no origin did not say so and name the fix: $($script:taskWarns -join ' | ')"
-    Assert (@($script:taskWarns | Where-Object { $_ -like 'No git remote: the nightly backup is not scheduled*' }).Count -eq 0) 'Claimed not scheduled while a task exists'
-    Write-Host 'PASS: an existing task with no origin is left alone and the fix is named'
+    Assert-Registered 'existing task, no origin'
+    Write-Host 'PASS: an existing task on a copy with no origin is re-registered like any other, with no warning'
 
     Invoke-TaskBlock -Root (Join-Path $taskRoot 'with-origin') -System $false
     Invoke-TaskBlock -Root (Join-Path $taskRoot 'no-origin') -System $false
     Assert ($script:registerCalls -eq 0) '-NoSystem registered a task'
     Write-Host 'PASS: -NoSystem registers nothing'
 
-    foreach ($fn in 'New-TaskRepo', 'New-ScheduledTaskAction', 'New-ScheduledTaskTrigger', 'New-ScheduledTaskSettingsSet', 'Register-ScheduledTask', 'Get-ScheduledTask', 'Write-Good', 'Invoke-TaskBlock') {
+    foreach ($fn in 'New-TaskRepo', 'New-ScheduledTaskAction', 'New-ScheduledTaskTrigger', 'New-ScheduledTaskSettingsSet', 'Register-ScheduledTask', 'Get-ScheduledTask', 'Write-Good', 'Invoke-TaskBlock', 'Assert-Registered') {
         Remove-Item "Function:\$fn" -ErrorAction SilentlyContinue
     }
     function Write-Warn { param($Msg) }
diff --git a/.claude-config/bin/tests/session-briefing-backup-test.sh b/.claude-config/bin/tests/session-briefing-backup-test.sh
index 096bc32..b4be502 100755
--- a/.claude-config/bin/tests/session-briefing-backup-test.sh
+++ b/.claude-config/bin/tests/session-briefing-backup-test.sh
@@ -9,6 +9,9 @@
 #   - read only the LAST run: an earlier run's problem that a later clean run
 #     resolved stays quiet
 #   - stay quiet on a clean run and when there is no log at all
+#   - say "local only (no origin remote)" when the last run logged the no-origin
+#     INFO line: neither a failure nor quiet, and an ERROR or WARN in the same
+#     run still wins
 # It also pins the memory flush-queue count beside it (same hook, same boot).
 # HOME and the OPS copy are fixtures in this test's own temp dir.
 set -uo pipefail
@@ -62,6 +65,34 @@ case "$line" in
 esac
 case "$line" in *"push skipped"*) bad "failed stage: an older run's line leaked in" ;; *) ok "failed stage: no older run's line" ;; esac
 
+# A copy with no origin remote: daily-sync logs one INFO line, and the briefing
+# says "local only", neither a failure nor quiet (quiet reads as backed up).
+LOCAL_LINE=' Backup:  local only (no origin remote): the nightly run at 2026-10-21 09:00 kept the work in local commits, nothing pulled or pushed; to back it up off this machine, add a private origin (DEPLOYMENT.md step 8)'
+for info in "OPS: INFO no origin remote: the day's commit is kept locally; nothing pulled or pushed" \
+            "OPS: INFO no origin remote: no local changes to commit; nothing pulled or pushed"; do
+  { run_block "2026-10-20 09:00:01" "OPS: ERROR pull --rebase failed; nothing pushed: fatal: 'origin' does not appear to be a git repository"
+    run_block "2026-10-21 09:00:01" "$info"; } > "$LOG"
+  out="$(briefing)"
+  [ "$(grep '^ Backup:' <<< "$out")" = "$LOCAL_LINE" ] && ok "no origin (${info:28:12}): reported as local only" \
+    || bad "no origin (${info:28:12}): $(grep '^ Backup:' <<< "$out")"
+  case "$out" in *"did not finish clean"*|*"ERROR"*) bad "no origin: an older run's error leaked in, or read as a failure" ;; *) ok "no origin: not a failure" ;; esac
+done
+
+# Once an origin is added and a run pushes, the local-only line goes away.
+{ run_block "2026-10-21 09:00:01" "OPS: INFO no origin remote: the day's commit is kept locally; nothing pulled or pushed"
+  run_block "2026-10-22 09:00:01" "OPS: backup pushed successfully (origin-private-check: private: github.com/acme/ops is private)"; } > "$LOG"
+out="$(briefing)"
+case "$out" in *"Backup:"*) bad "a later pushed run still reported local only" ;; *) ok "no origin, then a pushed run: quiet" ;; esac
+
+# An ERROR or WARN in the same run wins over the INFO line: that is the one to act on.
+run_block "2026-10-23 09:00:01" "OPS: INFO no origin remote: the day's commit is kept locally; nothing pulled or pushed" \
+  "OPS: WARN could not restore the mode of note.md (was 600)" > "$LOG"
+line="$(grep '^ Backup:' <<< "$(briefing)")"
+case "$line" in
+  *"did not finish clean: WARN could not restore the mode of note.md (was 600)"*) ok "no origin plus a WARN: the WARN is reported" ;;
+  *) bad "no origin plus a WARN: $line" ;;
+esac
+
 # The memory flush queue (secrets-guard's write-time nudges) is counted at boot.
 mkdir -p "$HOME/.claude-compact-cycle"
 printf '2026-10-18T10:00:00-04:00\t/x/memory/a.md\tproject:alpha\n2026-10-19T11:00:00-04:00\t/x/memory/b.md\tproject:beta\n' \
diff --git a/.claude-config/deploy.ps1 b/.claude-config/deploy.ps1
index 1088f27..3828475 100644
--- a/.claude-config/deploy.ps1
+++ b/.claude-config/deploy.ps1
@@ -17,7 +17,7 @@
       5. Seed the trust anchor ($HOME trusted, no folder-trust prompt)
       6. Emit the always-on ultracode shim to the profile.local.ps1 seam
       7. Register the daily backup scheduled task (dynamic bash + WorkingDirectory),
-         only when the OPS repo has an origin remote
+         on every copy (one with no origin remote commits locally)
       8. Mount the shared skills: clone the public skill source under
          PROJECTS/ when absent, then run bin/skills-vendor.sh sync in Git Bash
       9. Retire the caveman + ponytail Claude Code plugins (uninstall if present)
@@ -479,26 +479,12 @@ function Resolve-BashExe {
 
 $BashExe = Resolve-BashExe
 
-# The nightly task backs the copy up to its `origin` remote. A copy with no
-# remote is a supported setup (OPS works without GitHub), but there the task's
-# OPS stage fails on every run ("'origin' does not appear to be a git
-# repository") and the session briefing then reports a failed backup in every
-# session, so a copy with no origin is not scheduled. daily-sync.sh itself is
-# unchanged: a copy that has a remote and cannot push still logs and reports
-# loudly. A task that is already registered is never touched. Same rule as
+# Registered whether or not the copy has an `origin` remote: daily-sync.sh is
+# the one place that decides what a copy with no origin does (it commits the
+# day's work locally, logs one INFO line, and still runs the project pull and
+# branch-gc). An earlier deploy skipped the task on such a copy, which cost it
+# those two stages as well; do not bring that check back here. Same rule as
 # deploy.sh.
-function Test-GitOrigin {
-    param([string]$Repo)
-    $prevEap = $ErrorActionPreference
-    $ErrorActionPreference = 'Continue'
-    try {
-        $null = @(& git -C $Repo remote get-url origin 2>&1)
-        return ($LASTEXITCODE -eq 0)
-    }
-    catch { return $false }
-    finally { $ErrorActionPreference = $prevEap }
-}
-$HasOrigin = Test-GitOrigin -Repo $OpsRoot
 
 if ($NoSystem) {
     Write-Warn "-NoSystem: daily backup task not registered."
@@ -510,14 +496,6 @@ elseif (-not $BashExe) {
 elseif (-not (Test-Path $BackupScript)) {
     Write-Warn "Backup script not found at $BackupScript -- skipping backup task."
 }
-elseif (-not $HasOrigin) {
-    if (Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue) {
-        Write-Warn "Daily backup task already registered, but this copy has no git remote, so each nightly run logs an error. Add a GitHub remote (DEPLOYMENT.md), or remove the task: Unregister-ScheduledTask -TaskName '$TaskName'"
-    }
-    else {
-        Write-Warn "No git remote: the nightly backup is not scheduled. Add a GitHub remote (DEPLOYMENT.md), then rerun deploy."
-    }
-}
 else {
     try {
         # -l (login shell) so PATH/gh/git identity are present, matching cron.
diff --git a/.claude-config/deploy.sh b/.claude-config/deploy.sh
index 9e86566..d8ec4fc 100755
--- a/.claude-config/deploy.sh
+++ b/.claude-config/deploy.sh
@@ -18,8 +18,8 @@
 #   6. Write the ultracode-only claude() shim to ~/.<shell>rc.local
 #   7. Check the git identity, then initialize Claude Code auto-memory git-sync
 #      (bin/memory-init)
-#   8. Schedule the daily backup cron entry (only when the OPS repo has an
-#      `origin` remote; with none it prints that and schedules nothing)
+#   8. Schedule the daily backup cron entry (on every copy: one with no
+#      `origin` remote commits locally and still runs the other stages)
 #   9. Retire the caveman + ponytail Claude Code plugins (uninstall if present)
 #  10. Seed the trust anchor
 #
@@ -657,15 +657,12 @@ BACKUP_SCRIPT="${CONFIG_DIR}/backup/daily-sync.sh"
 CRON_TAG="# OPS Daily Backup"
 CRON_LINE="0 9 * * * ${BACKUP_SCRIPT} ${CRON_TAG}"
 
-# The nightly job backs the copy up to its `origin` remote. A copy with no
-# remote is a supported setup (OPS works without GitHub), but there the job's
-# OPS stage fails on every run ("'origin' does not appear to be a git
-# repository") and the session briefing then reports a failed backup in every
-# session, so a copy with no origin is not scheduled. daily-sync.sh itself is
-# unchanged: a copy that has a remote and cannot push still logs and reports
-# loudly. An entry that is already installed is never touched.
-HAS_ORIGIN=0
-git -C "$OPS_ROOT" remote get-url origin >/dev/null 2>&1 && HAS_ORIGIN=1
+# Scheduled whether or not the copy has an `origin` remote: daily-sync.sh is
+# the one place that decides what a copy with no origin does (it commits the
+# day's work locally, logs one INFO line, and still runs the project pull and
+# branch-gc). An earlier deploy skipped the schedule on such a copy, which cost
+# it those two stages as well; do not bring that check back here. An entry that
+# is already installed is never touched. Same rule as deploy.ps1.
 
 if [[ "$NO_SYSTEM" == 1 ]]; then
   msg_warn "--no-system: crontab not touched. Manual: $CRON_LINE"
@@ -675,13 +672,7 @@ else
   chmod +x "$BACKUP_SCRIPT"
 
   if crontab -l 2>/dev/null | grep -qF "$CRON_TAG"; then
-    if [[ "$HAS_ORIGIN" == 1 ]]; then
-      msg_ok "Cron job already installed."
-    else
-      msg_warn "Cron job already installed, but this copy has no git remote, so each nightly run logs an error. Add a GitHub remote (DEPLOYMENT.md), or remove the entry with: crontab -e"
-    fi
-  elif [[ "$HAS_ORIGIN" != 1 ]]; then
-    msg_warn "No git remote: the nightly backup is not scheduled. Add a GitHub remote (DEPLOYMENT.md), then rerun deploy."
+    msg_ok "Cron job already installed."
   else
     if (crontab -l 2>/dev/null; echo "$CRON_LINE") | crontab -; then
       msg_ok "Cron job installed (daily at 9:00 AM): $BACKUP_SCRIPT"
diff --git a/.claude-config/hooks/session-briefing.sh b/.claude-config/hooks/session-briefing.sh
index 807cdf8..00e115a 100755
--- a/.claude-config/hooks/session-briefing.sh
+++ b/.claude-config/hooks/session-briefing.sh
@@ -194,21 +194,34 @@ fi
 # WARN lines back from sync.log and say them here, with their continuation
 # lines: each line already names its reason and its fix. Only the log's tail is
 # read: a run is a few dozen lines, and the project stage adds one per repo.
+# A copy with no origin remote logs "OPS: INFO no origin remote" instead: its
+# commit stayed on this machine by design, so that run reads as "local only",
+# never as a failure and never as quiet (quiet means backed up off the box).
+# An ERROR or WARN in the same run still wins: that is the line to act on.
 SYNC_LOG="$OPS_DIR/.claude-config/backup/sync.log"
 if [ -f "$SYNC_LOG" ]; then
   bk="$(tail -n 3000 "$SYNC_LOG" 2>/dev/null | awk '
-    /\] ===== daily-sync start =====/ { n = 0; cont = 0; ts = substr($0, 2, 16); next }
+    /\] ===== daily-sync start =====/ { n = 0; cont = 0; local_only = 0; ts = substr($0, 2, 16); next }
     {
       msg = $0; sub(/^\[[^]]*\] /, "", msg)
       if (msg ~ /^OPS: (ERROR|WARN) /) { sub(/^OPS: /, "", msg); line[++n] = msg; cont = 1; next }
       if (cont && msg ~ /^     /) { sub(/^ +/, "", msg); line[n] = line[n] "; " msg; next }
       cont = 0
+      if (msg ~ /^OPS: INFO no origin remote/) local_only = 1
     }
-    END { if (n) { printf "%s|", ts; for (i = 1; i <= n; i++) printf "%s%s", (i > 1 ? " / " : ""), line[i] } }')"
+    END {
+      if (n) { printf "fail|%s|", ts; for (i = 1; i <= n; i++) printf "%s%s", (i > 1 ? " / " : ""), line[i] }
+      else if (local_only) printf "local|%s|", ts
+    }')"
   if [ -n "$bk" ]; then
+    bk_kind="${bk%%|*}"; bk="${bk#*|}"
     bk_ts="${bk%%|*}"; bk_msg="${bk#*|}"
-    [ "${#bk_msg}" -le 400 ] || bk_msg="${bk_msg:0:397}..."
-    printf ' Backup:  the nightly backup at %s did not finish clean: %s (full log: %s)\n' "$bk_ts" "$bk_msg" "${SYNC_LOG/#$HOME/\~}"
+    if [ "$bk_kind" = local ]; then
+      printf ' Backup:  local only (no origin remote): the nightly run at %s kept the work in local commits, nothing pulled or pushed; to back it up off this machine, add a private origin (DEPLOYMENT.md step 8)\n' "$bk_ts"
+    else
+      [ "${#bk_msg}" -le 400 ] || bk_msg="${bk_msg:0:397}..."
+      printf ' Backup:  the nightly backup at %s did not finish clean: %s (full log: %s)\n' "$bk_ts" "$bk_msg" "${SYNC_LOG/#$HOME/\~}"
+    fi
   fi
 fi
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2882a82..d26d453 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,8 +4,31 @@ Notable changes to OPS, newest first. Format: the date, then what changed and wh
 matters. This file starts fresh at the public release; the harness's private
 prehistory is deliberately not part of it.
 
+## 2026-11-06: a copy with no git remote keeps its nightly job
+
+The 2026-11-05 change below stopped deploy from scheduling the nightly job on a copy with
+no `origin` remote, which also cost that copy the job's nightly project pull and
+`branch-gc --apply`. The job is scheduled on every copy again, and `daily-sync.sh` is now
+the one place that decides what a copy with no origin does: it commits the day's work as
+always, then logs `OPS: INFO no origin remote: the day's commit is kept locally; nothing
+pulled or pushed` (or `no local changes to commit` on a clean day) instead of an error, and
+the project and branch-gc stages run as on any copy. "No origin" is read from the local
+config (`git remote` lists no `origin`), so an origin that exists but cannot be reached is
+still a failed pull and an `ERROR`, and a `git remote` that fails is an `ERROR` too. The
+session briefing reads the INFO line as `Backup:  local only (no origin remote)`, neither a
+failure nor quiet; an `ERROR` or `WARN` in the same run still wins. `deploy.sh` and
+`deploy.ps1` no longer look at the remotes, so their no-remote messages are gone; a copy
+deployed on 2026-11-05 without an origin gets its job back on the next `deploy.sh` run. Kept
+from that change: its deploy test harnesses (now asserting the job is scheduled with and
+without an origin, and that the cron and task blocks run no git) and the `deploy.sh --help`
+fix. Tests: `daily-sync-test.sh` (no origin, dirty and clean days, a remote named
+`upstream`, an unreachable origin, an origin with only a push URL, a failing `git remote`),
+`deploy-cron-test.sh`, `deploy-windows-test.ps1` and `session-briefing-backup-test.sh`.
+
 ## 2026-11-05: a copy with no git remote does not schedule the nightly backup
 
+Superseded by the 2026-11-06 entry above: the job is scheduled on every copy again.
+
 OPS works without GitHub, but deploy installed the nightly backup on every run. With no
 `origin` remote its OPS stage logged `'origin' does not appear to be a git repository` each
 night, and the session briefing then showed `Backup: ... did not finish clean` in every
diff --git a/CONTEXT/how-i-work.md b/CONTEXT/how-i-work.md
index 8442f91..ee98133 100644
--- a/CONTEXT/how-i-work.md
+++ b/CONTEXT/how-i-work.md
@@ -106,8 +106,7 @@ only when the why is not obvious, and no AI attribution.
 For an eligible green `MERGEABLE` PR, use `gh pr merge --squash` and report
 the SHA. Never add `--delete-branch`: worktrees share a ref store and that
 flag can rotate another session's checkout. `.claude-config/bin/branch-gc`
-cleans up instead: nightly from `backup/daily-sync.sh` (scheduled only on a
-copy with an `origin` remote) on every repo it
+cleans up instead: nightly from `backup/daily-sync.sh` on every repo it
 manages (`~/OPS`, `~/OPS/PROJECTS/<org>/<repo>`, `~/linuxploitacious`), at
 pre-compaction for the repo holding the cwd, and at closeout on each repo
 touched. It deletes a branch only when a merged PR's head or the default
diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md
index bf084ff..002de5b 100644
--- a/DEPLOYMENT.md
+++ b/DEPLOYMENT.md
@@ -202,23 +202,23 @@ In order:
    always exits 0, so the session briefing's `Backup:` line repeats the last
    run's OPS-stage errors and skipped pushes at boot. Skipped with `--no-system`.
 
-   **Only with an `origin` remote.** A copy with no remote is a supported setup
-   (OPS works without GitHub), but there every run's OPS stage would log
-   `'origin' does not appear to be a git repository` and the briefing would
-   report a failed backup in every session. With no `origin` (a remote under
-   another name does not count: the sync script pushes `origin`), deploy prints
-   `No git remote: the nightly backup is not scheduled. Add a GitHub remote
-   (DEPLOYMENT.md), then rerun deploy.` and installs nothing; it is not a
-   failure. An entry already in your crontab is left alone: on a copy with no
-   remote deploy warns that it will log an error each night and names
-   `crontab -e`. The job is also what pulls your project repos and runs
-   `branch-gc --apply` nightly, so without it run `PROJECTS/sync-check.sh
-   --auto` and `.claude-config/bin/branch-gc --apply` by hand (branch cleanup
-   also runs at pre-compaction and closeout). To turn the backup on later:
-   `git -C ~/OPS remote add origin <url>` (a private repo; see the push gate
-   below), then rerun `deploy.sh`. A copy that has a remote and cannot push is
-   a different case and stays loud: the script's own error reaches the
-   briefing as before.
+   **A copy with no `origin` remote.** That is a supported setup (OPS works
+   without GitHub), and deploy schedules the job there too. Each run still
+   commits the day's work, then its OPS stage logs one line, `OPS: INFO no
+   origin remote: the day's commit is kept locally; nothing pulled or pushed`
+   (or `no local changes to commit` on a clean day), instead of an error, and
+   the project pull and `branch-gc --apply` run as on any copy (branch-gc skips
+   the OPS repo itself, which has no GitHub origin, and cleans the project
+   repos). A remote under another name does not count: the sync script pulls
+   and pushes only `origin`. The briefing then reads `Backup:  local only (no
+   origin remote)`, so a copy whose work never leaves the machine does not
+   pass as backed up. To back it up off the machine: `git -C ~/OPS remote add
+   origin <url>` (a private repo; see the push gate below); the next run pulls
+   and pushes every local commit. An origin that exists but cannot be reached
+   (offline, a dead URL, no credentials) is a different case and stays loud:
+   the failed pull is an `ERROR` in the log and the briefing. (A deploy from
+   2026-11-05 skipped the schedule on a copy with no origin; rerun `deploy.sh`
+   to add it.)
 
    **The push gate.** Your copy holds your memory, context, and notes, so the
    two automatic pushes (memory-init's and the daily backup's) run only when
@@ -290,9 +290,8 @@ which is tied to the public linuxploitacious repo); the git identity check
 (step 7); auto-memory git-sync
 (`bin\memory-init.ps1`, behind the same push gate as step 8); the trust
 anchor; the ultracode shim in the seam; an `OPS Daily Backup` scheduled task
-that runs `daily-sync.sh` in Git Bash (skipped with `-NoSystem`, and when the
-repo has no `origin` remote: it prints the same no-remote line; a task already
-registered is left alone); the skill mount
+that runs `daily-sync.sh` in Git Bash (skipped with `-NoSystem`; registered
+with or without an `origin` remote, as on Linux); the skill mount
 (clone, then `skills-vendor.sh sync` through Git Bash); plugin retirement (same
 CLI calls as step 9); and a Git Bash pin plus the guard self-test.
 
@@ -322,8 +321,8 @@ git -C ~/linuxploitacious status --short -- claude/.claude/settings.json
 bash ~/OPS/.claude-config/bin/verify-ops.sh
 
 # Backup scheduler
-crontab -l | grep OPS                       # Linux (no line on a copy with no origin remote: deploy skips it)
-schtasks /Query /TN "OPS Daily Backup"      # Windows (same: not registered without an origin remote)
+crontab -l | grep OPS                       # Linux
+schtasks /Query /TN "OPS Daily Backup"      # Windows
 
 # The backup may push (expect exit 0 and the line
 # "origin-private-check: private: github.com/<you>/<repo> is private";
diff --git a/README.md b/README.md
index b421b56..342b7ea 100644
--- a/README.md
+++ b/README.md
@@ -215,8 +215,8 @@ idempotent and safe to re-run after any pull. On Linux, in order:
    `~/.bashrc.local`.
 7. Check the git identity, then link each Claude auto-memory directory into
    `.claude-memory/` (`memory-init --auto-commit`).
-8. Install the daily backup cron entry, when the copy has an `origin` remote
-   (with none it prints one line and schedules nothing; see "The daily backup").
+8. Install the daily backup cron entry (on every copy, with or without an
+   `origin` remote; see "The daily backup").
 9. Retire the caveman and ponytail plugins through the `claude plugin` CLI.
 10. Mark `$HOME` trusted in `~/.claude.json`, so the repos under it raise no
     folder-trust prompt.
@@ -274,24 +274,22 @@ Bash). Each run:
    request provably carried and parks their worktrees in a 7-day trash.
 
 The script always exits 0, so a failure cannot be seen from the exit code.
-
-**No GitHub remote.** A copy with no `origin` remote is a supported setup: OPS
-works without GitHub. Deploy then does not schedule the job, because its first
-stage would fail on every run (`'origin' does not appear to be a git
-repository`) and the session briefing would report a failed backup in every
-session. It prints `No git remote: the nightly backup is not scheduled.` and
-goes on; an entry already in your crontab (or the `OPS Daily Backup` task on
-Windows) is never touched. The job also does the project pull and the branch
-cleanup above, so a copy with no remote has neither nightly: run
-`PROJECTS/sync-check.sh --auto` and `.claude-config/bin/branch-gc --apply` by
-hand when you want them (branch cleanup also runs at pre-compaction and
-closeout). To turn the backup on, add a private GitHub remote
-(`git -C ~/OPS remote add origin <url>`, see the push gate above) and rerun
-`deploy.sh`.
 It logs to `.claude-config/backup/sync.log` instead, and the session briefing's
 `Backup:` line repeats the last run's errors and skipped pushes at the next
 boot.
 
+**No GitHub remote.** A copy with no `origin` remote is a supported setup: OPS
+works without GitHub, and deploy schedules the job there too. Steps 2 and 3
+are skipped: the run commits the day's work (step 1), logs `OPS: INFO no
+origin remote: the day's commit is kept locally; nothing pulled or pushed`
+instead of an error, and still does steps 4 and 5. The briefing then says
+`Backup:  local only (no origin remote)`, so work that never leaves the
+machine does not read as backed up. A remote under another name does not
+count; the script pulls and pushes only `origin`. To back the copy up, add a
+private GitHub remote (`git -C ~/OPS remote add origin <url>`, see the push
+gate above); the next run pulls and pushes every local commit. An origin that
+exists but cannot be reached is still a failed pull, reported as an error.
+
 ## Skill mounts
 
 Portable technique skills are mounted, not copied. `SKILLS/VENDORED.tsv` lists