@lanes-sh/link 0.5.3 → 0.6.0

package/src/cli/commands/knowledge/index.ts

@@ -230,7 +230,6 @@ async function useGithub(flags: KnowledgeFlags): Promise<void> {
 
     print('');
     print(ok(`memory and skills are now kept in ${facts.fullName}`));
-    reportOtherTargets(runtime.config, runtime.target, knowledge.token_ref);
   } finally {
     await runtime.close();
   }
@@ -242,7 +241,7 @@ async function useLocal(flags: KnowledgeFlags): Promise<void> {
     announce(runtime.resolution);
     const selection = ` --profile ${runtime.resolution.profile} --target ${runtime.target}`;
 
-    const knowledge = runtime.config.targets[runtime.target]?.knowledge;
+    const knowledge = runtime.config.knowledge;
     if (!knowledge) {
       print(style.dim('  This profile already keeps memory and skills on its own storage.'));
       return;
@@ -299,8 +298,7 @@ async function openLocalStores(
   runtime: Runtime,
 ): Promise<{ storage: BlobStore; skills: BlobStore }> {
   const { openStorage } = await import('#deployments/target.ts');
-  const declared = runtime.config.targets[runtime.target];
-  if (!declared) throw new ConfigError(`Target "${runtime.target}" is not declared`);
+  const declared = runtime.declared;
 
   const factory = await openStorage(
     {
@@ -314,7 +312,14 @@ async function openLocalStores(
   return { storage: factory(), skills: factory(layout.skills(runtime.config.instance.profile)) };
 }
 
-/** Write, or remove, the block on every target this profile declares. */
+/**
+ * Write, or remove, this profile's knowledge block.
+ *
+ * One place, not one per target. It used to loop over every target the profile
+ * declared and write the same block into each — which is what a per-target key
+ * holding a per-profile fact costs. The block is on the profile now (ADR-052),
+ * so there is one of it.
+ */
 async function writeBlock(
   config: Config,
   root: string,
@@ -322,12 +327,10 @@ async function writeBlock(
 ): Promise<void> {
   const document = await ConfigDocument.open(root, config.instance.profile);
 
-  for (const target of Object.keys(config.targets)) {
-    if (knowledge === undefined) {
-      document.removeIn(['targets', target, 'knowledge']);
-      continue;
-    }
-    document.setIn(['targets', target, 'knowledge'], {
+  if (knowledge === undefined) {
+    document.removeIn(['knowledge']);
+  } else {
+    document.setIn(['knowledge'], {
       adapter: knowledge.adapter,
       repo: knowledge.repo,
       ...(knowledge.branch ? { branch: knowledge.branch } : {}),
@@ -339,29 +342,6 @@ async function writeBlock(
   await document.save();
 }
 
-/**
- * The other targets need the same token in their own credential stores.
- *
- * Not written for them: a second target's store is Secret Manager, which needs
- * cloud credentials this command has no business assuming. `secrets push` is
- * the command that already does exactly this, so this points at it.
- */
-function reportOtherTargets(config: Config, current: string, ref: string): void {
-  const others = Object.keys(config.targets).filter((target) => target !== current);
-  if (others.length === 0) return;
-
-  const profile = config.instance.profile;
-
-  print(
-    style.dim(
-      `  Written into every target (${others.join(', ')} as well). Each reads "${ref}" from its own credential store:`,
-    ),
-  );
-  for (const target of others) {
-    print(style.dim(`    lanes link secrets push --from ${current} --to ${target} --profile ${profile}`));
-  }
-}
-
 async function decideMigration(hasContent: boolean, flags: KnowledgeFlags): Promise<boolean> {
   if (flags.migrate !== undefined) return flags.migrate;
   if (!hasContent) return false;

package/src/cli/commands/mcp/register.ts

@@ -77,7 +77,7 @@ export async function mcpAdd(target: string | undefined, options: McpAddOptions)
     // `http://<host>:<port>/mcp` unconditionally, so `mcp add --target cloud`
     // registered loopback with the agent: a registration that reports success,
     // names the right server, and points at a port with nothing behind it.
-    const url = await endpointUrl(runtime.config, runtime.target);
+    const url = await endpointUrl(runtime.config, runtime.declared);
     const input: AddInput = {
       name,
       url,

package/src/cli/commands/operate/dashboard.ts

@@ -36,10 +36,10 @@ export async function dashboard(flags: DashboardFlags): Promise<void> {
   // still be correct and nobody would ever read it, because a storage 403
   // arrives first. This is the seam `runtime.ts` documents `deploy` and
   // `secrets push` stopping at, for the same reason.
-  const { resolution, config, target } = await resolveProfile(flags);
+  const { resolution, config, target, resolved } = await resolveProfile(flags);
   announce(resolution);
 
-  const deployed = deploymentIdentity(config.targets[target]?.deploy);
+  const deployed = deploymentIdentity(resolved?.declared.deploy);
   if (deployed) {
     throw new Error(
       `Target "${target}" is deployed to ${deployed.platform}, and the dashboard is served only ` +

package/src/cli/commands/operate/inspect.ts

@@ -5,7 +5,7 @@ import { staleNudge } from '../../release.ts';
 import { openRuntime, resolveProfileOnly, type GlobalFlags, type Runtime } from '../../runtime.ts';
 import type { FetchLike } from '#deployments/knowledge.ts';
 import { credentialAge, reportCapabilityDrift } from './findings.ts';
-import { migratedRenamedProviders } from './migrate.ts';
+import { migratedContract, migratedRenamedProviders } from './migrate.ts';
 
 /**
  * The gate order — check, doctor, plan, start — exists so failures surface in
@@ -75,6 +75,10 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
   try {
     runtime = await openRuntime(flags, { fetch: flags.fetch });
   } catch (refusal) {
+    // Contract first: it is checked before the schema, so a profile carrying
+    // both problems reports the contract one and the rename cannot be seen until
+    // that is settled.
+    if (await migratedContract(flags, refusal)) return;
     if (await migratedRenamedProviders(flags, refusal)) return;
     throw refusal;
   }

package/src/cli/commands/operate/migrate.ts

@@ -1,6 +1,7 @@
-import { ConfigError, resolveSelection } from '#profile';
+import { ConfigError, resolveSelection, resolveTargetWorkspace, resolveWorkspaceRoot } from '#profile';
 import { ConfigDocument } from '../../config-edit.ts';
 import { migrateRenamedProviders, pendingRenames, shapeOf } from '../../config-migrate.ts';
+import { migrateWorkspace, needsMigration } from '../../workspace-migrate.ts';
 import { emit, fail, ok, print, style, warn } from '../../output.ts';
 import { openSecretStoreFor, type GlobalFlags } from '../../runtime.ts';
 
@@ -98,3 +99,86 @@ export async function migratedRenamedProviders(
 
   return true;
 }
+
+
+/**
+ * Whether a refusal to load was a stale contract, and — with `--fix` — raise it.
+ *
+ * The sibling of `migratedRenamedProviders` above, and asked *before* it: a
+ * contract-1 profile is refused by `assertSupportedContract`, which runs before
+ * the schema, so a file with both problems reports this one and the rename is
+ * invisible until it is fixed.
+ *
+ * Here for the reason this file's header already gives — `doctor` is what
+ * someone runs when something is broken, so it has to be the command that works
+ * when everything else refuses. `update` migrates the local workspace on its own
+ * and most people will never reach this; the ones who do are the ones whose
+ * `--target` is a bucket, which `update` deliberately leaves alone.
+ *
+ * **It will migrate a remote workspace, and says what that costs.** The endpoint
+ * in front of a bucket runs a pinned image, and one built before contract 2
+ * cannot read what this writes. That is a real consequence and it is the
+ * operator's to accept, so the line naming the redeploy is printed whether or
+ * not `--fix` was passed.
+ */
+export async function migratedContract(flags: RenameFlags, refusal: unknown): Promise<boolean> {
+  if (!(refusal instanceof ConfigError)) return false;
+
+  const root = resolveWorkspaceRoot();
+  const target = flags.target ?? '';
+  // Where the profiles actually are. For a pointer that is the bucket, which is
+  // the case this exists for; a target the registry cannot resolve is not a
+  // migration problem and falls through to the original refusal.
+  const where = await resolveTargetWorkspace(root, target).catch(() => null);
+  if (where === null) return false;
+
+  if (!(await needsMigration(where))) return false;
+
+  const migration = await migrateWorkspace(where, { apply: flags.fix === true });
+  const applied = flags.fix === true;
+  const remote = where !== root;
+
+  if (!applied) process.exitCode = 1;
+
+  await emit(
+    flags.json,
+    {
+      ok: applied,
+      workspace: where,
+      target,
+      applied,
+      remote,
+      profiles: migration.profiles,
+      targets: migration.targets,
+      changes: migration.changes,
+    },
+    () => {
+      print(`workspace ${style.bold(where)}  target ${style.bold(target)}`);
+      print();
+      print(
+        applied
+          ? ok('migrated to contract 2 — a target is declared by the workspace, not by each profile')
+          : warn('this workspace is contract 1, and nothing here reads that any more'),
+      );
+      for (const change of migration.changes) print(`  ${change}`);
+
+      if (remote) {
+        print();
+        print(
+          style.dim(
+            applied
+              ? '  The endpoint serving this bucket is running an older image and cannot read\n' +
+                `  what was just written. Roll a new one: lanes link deploy --target ${target}`
+              : `  lanes link deploy --target ${target} migrates it and ships the image that\n` +
+                '  understands it, in one step. Prefer that to --fix here.',
+          ),
+        );
+        return;
+      }
+
+      if (!applied) print(style.dim(`  Fix it with: lanes link doctor --fix --target ${target}`));
+    },
+  );
+
+  return true;
+}

package/src/cli/commands/operate/outputs.ts

@@ -1,5 +1,4 @@
 import { listProfiles } from '#profile';
-import { unservableProfiles } from '#deployments/servable.ts';
 import { fileURLToPath } from 'node:url';
 import { deployedUrl, endpointHealth, localUrl } from '../../endpoint-url.ts';
 import { announce, heading, print, style, warn } from '../../output.ts';
@@ -28,7 +27,7 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
 
   try {
     const { token } = await ensureProfileToken(runtime.credentials, runtime.config.auth.token_ref);
-    const declared = runtime.config.targets[runtime.target]?.deploy;
+    const declared = runtime.declared.deploy;
     const deployed = await deployedUrl(declared);
     // Not `endpointUrl`, which would ask the platform a second time for an
     // answer this line already has.
@@ -37,14 +36,12 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
     const live = await endpointHealth(url, token);
     const mine = live?.profile === runtime.resolution.profile;
 
-    // Live if it is up, otherwise what `start` would serve — which is every
-    // profile in the workspace *that declares this target*, not every profile
-    // full stop. `start` opens them all against one target and skips the ones
-    // that cannot run on it, so listing those here would promise a reach the
-    // endpoint will not have.
-    const profiles = mine
-      ? live.profiles
-      : await servable(runtime.resolution.workspaceRoot, runtime.target);
+    // Live if it is up, otherwise every profile in this target's workspace.
+    // Those are the same set now: a profile lives in exactly one target
+    // (ADR-052), so every profile here is one this target can open. The filter
+    // that used to sit between them answered "which of these declare it", a
+    // question no profile has an opinion on any more.
+    const profiles = mine ? live.profiles : await listProfiles(runtime.resolution.workspaceRoot);
 
     if (flags.json) {
       print(
@@ -138,18 +135,6 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
   }
 }
 
-/** The profiles a `start` on this target would actually open. */
-async function servable(workspaceRoot: string, target: string): Promise<string[]> {
-  const all = await listProfiles(workspaceRoot);
-  const cannot = new Set(
-    (await unservableProfiles({ workspaceRoot, profiles: undefined, target })).map(
-      (one) => one.profile,
-    ),
-  );
-
-  return all.filter((name) => !cannot.has(name));
-}
-
 /**
  * The command that prints this endpoint's token, verified to actually work.
  *

package/src/cli/commands/operate/status.ts

@@ -1,4 +1,13 @@
-import { listProfiles, loadWorkspaceProfiles, resolveWorkspaceRoot } from '#profile';
+import {
+  isPointer,
+  listProfiles,
+  loadWorkspaceProfiles,
+  notInRegistry,
+  openTarget,
+  readRegistry,
+  resolveWorkspaceRoot,
+  type ResolvedTarget,
+} from '#profile';
 import { oneProfile, visibleCapabilities } from '#server/mcp';
 import { toPolicyDocument } from '#registry';
 import { announce, emit, heading, print, style, table } from '../../output.ts';
@@ -46,6 +55,9 @@ export async function status(flags: StatusFlags): Promise<void> {
         provider: connection.provider,
         id: connection.id,
         account: connection.account,
+        // Null rather than absent: a caller reading this to prefill a rename box
+        // needs to tell "called nothing in particular" from a field it forgot.
+        label: connection.label ?? null,
         state: byKey.get(key)?.status ?? 'not reconciled',
       };
     });
@@ -74,7 +86,7 @@ export async function status(flags: StatusFlags): Promise<void> {
     // replaces it. Silently turning a string into an object would be a cost
     // paid by every reader for the benefit of none.
     const local = `http://${runtime.config.instance.host}:${runtime.config.instance.port}/mcp`;
-    const deployment = deploymentIdentity(runtime.config.targets[runtime.target]?.deploy);
+    const deployment = deploymentIdentity(runtime.declared.deploy);
     const endpoint = deployment ? null : local;
 
     return emit(
@@ -102,7 +114,14 @@ export async function status(flags: StatusFlags): Promise<void> {
               connection.state === 'active'
                 ? style.green(connection.state)
                 : style.yellow(connection.state),
-              style.dim(connection.account),
+              // Both, where they differ. The label is what the operator called
+              // it and the account is which mailbox it is; a row answering only
+              // one of those is the row this column already was.
+              style.dim(
+                connection.label && connection.label !== connection.account
+                  ? `${connection.label} — ${connection.account}`
+                  : connection.account,
+              ),
             ]),
           );
         }
@@ -142,97 +161,103 @@ export async function status(flags: StatusFlags): Promise<void> {
  * profile narrows it to the detailed view above; naming none is not a missing
  * answer, it is the wider one.
  *
- * **Opens no store and makes no network call.** The view above already declines
- * to probe, for the reasons in this file's header; this one additionally
- * declines to open a target's adapters, so it stays instant and — more to the
- * point — still answers for a target whose stores are unreachable, misdeclared,
- * or gone. A summary that needs the deployment to be healthy cannot report that
- * it is not.
+ * **Opens no profile store.** The view above already declines to probe, for the
+ * reasons in this file's header; this one additionally declines to open a
+ * target's adapters, so it stays fast and — more to the point — still answers
+ * for a target whose stores are unreachable or gone. A summary that needs the
+ * deployment to be healthy cannot report that it is not.
  *
- * That is what makes the row it exists for legible: a target declared by one
- * profile and not its sibling. From inside either profile that state is
- * invisible, and it is what a vanished deployment looks like from the outside.
+ * It does read the target's workspace, which for a pointer is a bucket. That is
+ * the one call it cannot avoid: the profiles it is reporting on live there
+ * (ADR-052). When that read fails it says so under the target's own heading
+ * rather than printing an empty profile list, because "no profiles" and "could
+ * not look" are the two answers this command must never blur.
+ *
+ * The row it used to exist for — a target declared by one profile and not its
+ * sibling — cannot happen now. A target is declared once, by its workspace, so
+ * there is no per-profile disagreement left to surface.
  */
 async function workspaceStatus(flags: StatusFlags): Promise<void> {
   const target = flags.target!;
-  const root = resolveWorkspaceRoot();
-  const workspace = await loadWorkspaceProfiles(root);
-
-  const profiles = workspace.loaded.map((entry) => ({
-    name: entry.profile,
-    declares: target in entry.config.targets,
-    connections: entry.config.connections.length,
-    deployment: deploymentIdentity(entry.config.targets[target]?.deploy),
-  }));
+  const localRoot = resolveWorkspaceRoot();
+  const registry = await readRegistry(localRoot);
+  const entry = registry[target];
 
-  const declaring = profiles.filter((entry) => entry.declares);
+  if (!entry) throw notInRegistry(target, registry, localRoot);
 
-  // Distinct deployments, not the first one found. Two profiles declaring the
-  // same target name against different services is drift worth printing rather
-  // than a tie to break silently — and picking one would make the wrong half of
-  // the workspace look correctly configured.
-  const deployments = [
-    ...new Map(
-      declaring
-        .filter((entry) => entry.deployment !== null)
-        .map((entry) => [JSON.stringify(entry.deployment), entry.deployment!] as const),
-    ).values(),
-  ];
+  let resolved: ResolvedTarget | undefined;
+  let unreachable: string | undefined;
+  try {
+    resolved = await openTarget(localRoot, target);
+  } catch (error) {
+    // The whole message, not its first line. Truncating to `split('\n')[0]` is
+    // exactly what the sync command used to do, and it is why a bucket refusing
+    // for a nameable reason reported an empty one instead — a `ConfigError`
+    // carries its fix on the lines after the first.
+    unreachable = error instanceof Error ? error.message : String(error);
+  }
+
+  const root = resolved?.workspaceRoot ?? (isPointer(entry) ? entry.workspace : localRoot);
+  const workspace = resolved ? await loadWorkspaceProfiles(root) : undefined;
+
+  const profiles = (workspace?.loaded ?? []).map((loaded) => ({
+    name: loaded.profile,
+    connections: loaded.config.connections.length,
+  }));
+
+  const deployment = deploymentIdentity(resolved?.declared.deploy);
 
   return emit(
     flags.json,
-    { workspace: root, target, profiles, deployments, unreadable: workspace.unreadable },
+    {
+      workspace: root,
+      target,
+      remote: resolved?.remote ?? isPointer(entry),
+      reachable: unreachable === undefined,
+      ...(unreachable ? { error: unreachable } : {}),
+      profiles,
+      deployment,
+      unreadable: workspace?.unreadable ?? [],
+    },
     () => {
       print(style.dim(`workspace ${style.bold(root)}  target ${style.bold(target)}`));
 
-      heading('Profiles');
-      table(
-        profiles.map((entry) => [
-          `  ${style.bold(entry.name)}`,
-          entry.declares ? style.green(`${target} declared`) : style.yellow('not declared'),
-          style.dim(entry.declares ? `${entry.connections} connection(s)` : '—'),
-        ]),
-      );
-      for (const bad of workspace.unreadable) {
-        print(`  ${style.bold(bad.profile)}  ${style.yellow(bad.reason)}`);
-      }
-
-      heading('Endpoint');
-      if (declaring.length === 0) {
-        print(style.yellow(`  No profile declares "${target}".`));
-        print(
-          style.dim(
-            '  If it was deployed once, the deployment still exists and only the\n' +
-              `  declaration is gone — recover it with: lanes link sync targets --target ${target}`,
-          ),
-        );
+      if (unreachable !== undefined) {
+        heading('Unreachable');
+        // The refusal's own wording, and nothing after it. A generic trailer
+        // here read as a second, vaguer diagnosis of a problem the message above
+        // had already named precisely.
+        for (const line of unreachable.split('\n')) print(`  ${style.yellow(line)}`);
         return;
       }
 
-      if (deployments.length === 0) {
-        print(style.dim('  No deployment — this target runs wherever the CLI does.'));
-        return;
+      heading('Profiles');
+      if (profiles.length === 0) {
+        print(style.dim('  None yet.'));
+        print(style.dim(`  Create one with: lanes link profile add <name> --target ${target}`));
+      } else {
+        table(
+          profiles.map((profile) => [
+            `  ${style.bold(profile.name)}`,
+            style.dim(`${profile.connections} connection(s)`),
+          ]),
+        );
       }
-
-      for (const deployment of deployments) {
-        const { platform, service, region } = deployment;
-        print(`  ${platform} service ${style.bold(service)} in ${region}`);
+      for (const bad of workspace?.unreadable ?? []) {
+        print(`  ${style.bold(bad.profile)}  ${style.yellow(bad.reason)}`);
       }
 
-      if (deployments.length > 1) {
-        print(
-          style.yellow(
-            `  ${deployments.length} profiles declare "${target}" against different services.`,
-          ),
-        );
-        print(style.dim('  They are separate endpoints sharing a name. Check each profile.'));
+      heading('Endpoint');
+      if (!deployment) {
+        print(style.dim('  No deployment — this target runs wherever the CLI does.'));
         return;
       }
 
+      print(`  ${deployment.platform} service ${style.bold(deployment.service)} in ${deployment.region}`);
       print(
         style.dim(
           "  the address is the platform's to assign — run: " +
-            `lanes link outputs --target ${target} --profile ${declaring[0]!.name}`,
+            `lanes link outputs --target ${target} --profile ${profiles[0]?.name ?? '<name>'}`,
         ),
       );
     },

package/src/cli/commands/operate/tools.ts

@@ -28,7 +28,7 @@ export async function tools(flags: ToolsFlags): Promise<void> {
 
   try {
     const { token } = await ensureProfileToken(runtime.credentials, runtime.config.auth.token_ref);
-    const declared = runtime.config.targets[runtime.target]?.deploy;
+    const declared = runtime.declared.deploy;
     const deployed = await deployedUrl(declared);
     // Not `endpointUrl`, which asks the platform a second time for an answer
     // this line already has.

package/src/cli/commands/profile/removal.ts

@@ -82,8 +82,17 @@ export interface RemovalPlan {
 }
 
 export interface PlanOptions {
-  /** Restrict to one target. The profile itself then survives. */
-  readonly target?: string | undefined;
+  /**
+   * The target whose stores this plans against.
+   *
+   * Required now, and not a restriction: a profile lives in exactly one target
+   * (ADR-052), so there is no "all of them" left for this to mean. It used to be
+   * optional because a profile could declare several and removing it meant
+   * emptying each.
+   */
+  readonly target: string;
+  /** That target's adapter set, from the workspace declaring it (ADR-052). */
+  readonly declared: TargetConfig;
   readonly openSecrets: (target: string) => Promise<SecretStore>;
   readonly openBlobs: (target: string, area?: string) => Promise<BlobStore>;
   readonly readDefaultProfile?: (() => Promise<string | undefined>) | undefined;
@@ -110,14 +119,13 @@ export async function removalPlan(
   const untouched: { target: string; refs: string[] }[] = [];
   const warnings: string[] = [];
 
-  const names = options.target ? [options.target] : Object.keys(config.targets);
+  // One target, always. A profile lived in as many as it declared and this
+  // planned across all of them; it lives in exactly one now (ADR-052), and that
+  // one is whichever workspace the caller resolved to reach this file.
+  const names: string[] = [options.target];
+  const declared = options.declared;
 
   for (const name of names) {
-    const declared = config.targets[name];
-    if (!declared) {
-      warnings.push(`Target "${name}" is not declared by this profile, so nothing was planned.`);
-      continue;
-    }
 
     // A repository this profile keeps memory and skills in is not this
     // command's to empty, and it is not reachable from here either: the routing
@@ -128,9 +136,9 @@ export async function removalPlan(
     // `rm -r data/<profile>` used to be the whole of "what could this profile
     // reach". So it is said before the operator confirms rather than discovered
     // afterwards.
-    if (declared.knowledge) {
+    if (config.knowledge) {
       warnings.push(
-        `Target "${name}" keeps this profile's memory and skills in ${declared.knowledge.repo}. ` +
+        `This profile keeps its memory and skills in ${config.knowledge.repo}. ` +
           'Nothing here touches a repository, so they survive this removal — delete them there ' +
           'if you want them gone.',
       );
@@ -226,23 +234,26 @@ export async function removalPlan(
     }
   }
 
-  // Only when the whole profile is going. With `--target` it still exists.
-  if (!options.target) {
-    const defaultProfile = await options.readDefaultProfile?.();
-    if (defaultProfile === profile) {
-      items.push({
-        target: null,
-        kind: 'workspace-key',
-        id: 'default_profile',
-        note: 'cleared, not repointed at whatever remains',
-      });
-    }
-
-    // Last. It is the only record of where everything else lives, so a failure
-    // before this point leaves data a later run can still find.
-    items.push({ target: null, kind: 'config', id: profilePath(root, profile) });
+  // Always, now. `--target` used to mean "decommission this one target and leave
+  // the profile behind", which was a coherent thing to want while a profile
+  // could be declared against several. It lives in exactly one (ADR-052), and
+  // the file itself is *in* that target's workspace — so emptying the target and
+  // keeping the profile would leave a config nothing can open, in a workspace it
+  // no longer belongs to.
+  const defaultProfile = await options.readDefaultProfile?.();
+  if (defaultProfile === profile) {
+    items.push({
+      target: null,
+      kind: 'workspace-key',
+      id: 'default_profile',
+      note: 'cleared, not repointed at whatever remains',
+    });
   }
 
+  // Last. It is the only record of where everything else lives, so a failure
+  // before this point leaves data a later run can still find.
+  items.push({ target: null, kind: 'config', id: profilePath(root, profile) });
+
   return { profile, items, untouched, warnings };
 }
 

package/src/cli/commands/profile/remove.ts

@@ -3,6 +3,7 @@ import type { BlobStore } from '#stores/blobs';
 import {
   ConfigError,
   WORKSPACE_FILE,
+  openTarget,
   readWorkspace,
   readWorkspaceFile,
   workspaceFiles,
@@ -250,15 +251,17 @@ export interface RemoveFlags extends GlobalFlags {
  * in the tool.
  */
 export async function removeProfile(name: string, flags: RemoveFlags): Promise<void> {
-  const { selection, config } = await resolveProfileOnly({ ...flags, profile: name });
+  const { selection, config, target } = await resolveProfileOnly({ ...flags, profile: name });
   announceProfile(selection);
 
   const root = selection.workspaceRoot;
   const registry = await buildRegistryWithWorkspace(root, name);
   const files = workspaceFiles(root);
+  const { declared } = await openTarget(root, target);
 
   const plan = await removalPlan(config, root, name, registry, {
-    target: flags.target,
+    target,
+    declared,
     openSecrets: (target) => openSecretStoreFor(config, root, target),
     openBlobs: (target, area) => openBlobStoreFor(config, root, target, area),
     readDefaultProfile: async () => (await readWorkspace(root))?.default_profile,