@lanes-sh/link 0.8.0 → 0.9.1

package/src/cli/commands/owner/memory.ts

@@ -105,6 +105,6 @@ export async function memoryForget(id: string | undefined, flags: OwnerFlags): P
  * again, so the CLI cannot address a different directory from the provider.
  */
 export function memoryStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
-  const connection = ownerConnection(runtime.config, 'memory', flags);
-  return scopeBlobStore(runtime.storage, scopeNamespace('memory', connection));
+  const connection = ownerConnection(runtime.config, 'lanes_memory', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('lanes_memory', connection));
 }

package/src/cli/commands/owner/tasks.ts

@@ -189,6 +189,6 @@ function assertStatus(raw: string | undefined): TaskStatus | undefined {
  * CLI cannot address a different directory from the provider.
  */
 export function tasksStore(runtime: Runtime, flags: OwnerFlags): BlobStore {
-  const connection = ownerConnection(runtime.config, 'tasks', flags);
-  return scopeBlobStore(runtime.storage, scopeNamespace('tasks', connection));
+  const connection = ownerConnection(runtime.config, 'lanes_tasks', flags);
+  return scopeBlobStore(runtime.storage, scopeNamespace('lanes_tasks', connection));
 }

package/src/cli/commands/owner/vault.ts

@@ -50,7 +50,7 @@ export async function vaultGet(id: string | undefined, flags: OwnerFlags): Promi
   const itemId = required(id, 'lanes link vault get <id> [--show]');
 
   await withRuntime(flags, async (runtime) => {
-    const connection = ownerConnection(runtime.config, 'vault', flags);
+    const connection = ownerConnection(runtime.config, 'lanes_vault', flags);
     const item = await runtime.vault.get(connection, itemId);
     if (!item) throw new ConfigError(`No vault item "${itemId}" in this profile.`);
 
@@ -77,7 +77,7 @@ export async function vaultSet(id: string | undefined, flags: OwnerFlags): Promi
   const value = await readStdin(`lanes link vault set ${itemId}`, 'the secret');
 
   await withRuntime(flags, async (runtime) => {
-    const connection = ownerConnection(runtime.config, 'vault', flags);
+    const connection = ownerConnection(runtime.config, 'lanes_vault', flags);
     const replacing = (await runtime.vault.get(connection, itemId)) !== null;
 
     await runtime.vault.put(connection, {
@@ -104,7 +104,7 @@ export async function vaultRemove(id: string | undefined, flags: OwnerFlags): Pr
   const itemId = required(id, 'lanes link vault remove <id>');
 
   await withRuntime(flags, async (runtime) => {
-    const connection = ownerConnection(runtime.config, 'vault', flags);
+    const connection = ownerConnection(runtime.config, 'lanes_vault', flags);
     const item = await runtime.vault.get(connection, itemId);
     if (!item) throw new ConfigError(`No vault item "${itemId}" in this profile.`);
 

package/src/cli/commands/profile/disposition.ts

@@ -0,0 +1,236 @@
+import { ConfigError } from '#profile';
+import type { Prompter } from '../../prompt.ts';
+
+/**
+ * What becomes of the bytes a removed profile owns.
+ *
+ * Split from `removal.ts` and `remove.ts` on the seam the question already has:
+ * both files grew past the size budget when this arrived, and it is one
+ * decision — asked once, answered once, and then applied by the plan and the
+ * execution without either re-deciding anything.
+ */
+
+/**
+ * What to do with the bytes a profile owns.
+ *
+ * There has to be an answer and there is no safe default, which is why this is
+ * a discriminated choice rather than a flag with a fallback. Deleting by
+ * default destroys the material somebody kept; migrating by default puts one
+ * profile's notes into another without being asked, which is the thing ADR-066
+ * exists to stop happening by accident.
+ */
+export type Disposition =
+  | { readonly kind: 'delete' }
+  | { readonly kind: 'migrate'; readonly into: string };
+
+/**
+ * `note.md` becomes `note-2.md`, before the extension rather than after it.
+ *
+ * An asset's key is whatever the file was called, and `note.md-2` is a file
+ * nothing will open. Memory entries and tasks are `<id>.md`, so the same rule
+ * keeps the id readable.
+ */
+export function suffixed(key: string, taken: (candidate: string) => boolean): string {
+  const dot = key.lastIndexOf('.');
+  const cut = dot <= key.lastIndexOf('/') ? key.length : dot;
+  const [stem, extension] = [key.slice(0, cut), key.slice(cut)];
+
+  for (let n = 2; ; n += 1) {
+    const candidate = `${stem}-${n}${extension}`;
+    if (!taken(candidate)) return candidate;
+  }
+}
+
+/**
+ * What to do with the bytes, decided before anything is planned.
+ *
+ * **`--yes` does not imply a disposition.** Everything else `--yes` skips is a
+ * confirmation of something the command was already told to do; this is a
+ * question it has not been asked, and picking either answer silently is a way
+ * to lose somebody's notes — or to put them somewhere they did not ask for
+ * them, which under ADR-066 is the failure the whole change exists to prevent.
+ * So a non-interactive caller must say, and one that does not is refused with
+ * both spellings named.
+ */
+export async function settleDisposition(
+  profile: string,
+  flags: { readonly deleteData?: boolean | undefined; readonly migrateTo?: string | undefined },
+  prompter: Prompter,
+  someoneToAsk: boolean,
+): Promise<Disposition | null> {
+  if (flags.migrateTo !== undefined && flags.deleteData === true) {
+    throw new ConfigError(
+      '--delete-data and --migrate-to say opposite things about the same bytes. Pass one.',
+    );
+  }
+
+  if (flags.migrateTo !== undefined) return { kind: 'migrate', into: flags.migrateTo };
+  if (flags.deleteData === true) return { kind: 'delete' };
+
+  if (!someoneToAsk) {
+    throw new ConfigError(
+      `"${profile}" owns memory, tasks, assets and skills, and this does not guess at what ` +
+        'becomes of them.\n' +
+        '  Say which: --delete-data, or --migrate-to <profile>',
+    );
+  }
+
+  const answer = (
+    await prompter.ask(
+      `What becomes of ${profile}'s memory, tasks, assets and skills?\n` +
+        `  [d] delete them   [m] move them into another profile   [anything else] stop: `,
+    )
+  ).trim().toLowerCase();
+
+  if (answer === 'd') return { kind: 'delete' };
+  if (answer !== 'm') return null;
+
+  const into = (await prompter.ask('  Move them into which profile? ')).trim();
+  return into.length === 0 ? null : { kind: 'migrate', into };
+}
+
+
+/**
+ * The skill a key belongs to, or null when the key is not a skill's.
+ *
+ * Both layouts: `<name>/SKILL.md` and whatever it ships beside it, and the flat
+ * `<name>.md`.
+ */
+export function skillNameIn(key: string): string | null {
+  const parts = key.split('/');
+  if (parts[0] !== 'skills.d' || parts.length < 3) return null;
+
+  const third = parts[2]!;
+  return parts.length > 3 ? third : third.replace(/\.md$/, '');
+}
+
+/**
+ * Two skills of one name have no union either, so this refuses like the vault.
+ *
+ * A skill's name is not a filename — it becomes the capability id
+ * `skills.<name>`, which is what a policy rule grants and what an MCP prompt is
+ * called. So the suffix that resolves a colliding note resolves nothing here: a
+ * skill arriving as `proc-b-2` is granted by no rule the destination holds and
+ * offered to no client, which is `refuseSealedVault`'s argument — a copy under a
+ * name no command opens — reached by a different route. Renaming only the
+ * directory is worse still, because the frontmatter keeps declaring the old
+ * name: two skills then claim one capability id and `skills list` refuses for
+ * the whole profile rather than for the one skill.
+ *
+ * Which of the two to keep is a decision about the operator's procedures, and
+ * they are the only one who can make it.
+ */
+export function refuseCollidingSkill(into: string, name: string): never {
+  throw new ConfigError(
+    `"${into}" already has a skill named "${name}", and the one arriving cannot take another ` +
+      `name: it becomes the capability id "skills.${name}", which policy rules grant and MCP ` +
+      'prompts are called by.\n' +
+      `  Rename one of the two first — lanes link skills show ${name} --profile ${into} — then ` +
+      'run this again, or remove the profile with --delete-data.',
+  );
+}
+
+/**
+ * Rename anything the destination already holds, before a byte moves.
+ *
+ * Resolved while this is still a plan, so the operator sees every rename in the
+ * preview they confirm from and the execution has no decision left to make. A
+ * destination that is occupied holds the *destination profile's* own note, task
+ * or asset — overwriting one would be the quiet half of a migration nobody
+ * asked for, and merging two is not a thing bytes can do.
+ *
+ * Mutates `items` in place because the caller is still assembling the plan;
+ * the warnings come back for it to attach.
+ */
+export async function resolveCollisions(
+  items: { kind: string; movedTo?: readonly [string, string]; note?: string }[],
+  profile: string,
+  into: string,
+  open: (area: string) => Promise<{ list(): Promise<{ key: string }[]> }>,
+): Promise<string[]> {
+  const warnings: string[] = [];
+
+  // **Throws rather than warning.** It returned a warning saying "nothing has
+  // run" and then left every `movedTo` in place — and `executeRemoval` writes
+  // each one without checking, on the stated ground that "a collision was
+  // resolved while this was still a plan". With `--yes` there is no prompt to
+  // stop at, so an unreadable destination meant the destination profile's own
+  // notes were overwritten by the removed profile's files of the same name, and
+  // the command reported success. A plan that cannot be made safe must not
+  // become one.
+  let held: Set<string>;
+  try {
+    held = new Set((await (await open(into)).list()).map((blob) => blob.key));
+  } catch (cause) {
+    throw new ConfigError(
+      `"${profile}"'s storage could not be read (${
+        cause instanceof Error ? cause.message : String(cause)
+      }), so a name it already holds cannot be found — and migrating into it ` +
+        'would overwrite one.\n  Nothing has run. Fix the store and try again, or pass ' +
+        '--delete-data instead.',
+    );
+  }
+
+  for (let index = 0; index < items.length; index += 1) {
+    const item = items[index]!;
+    if (item.kind !== 'blob' || item.movedTo === undefined) continue;
+
+    const key = item.movedTo[1];
+    if (!held.has(key)) {
+      held.add(key);
+      continue;
+    }
+
+    // Before the suffix, because for one kind of key there is no suffix that
+    // works and the answer is to stop rather than to invent one.
+    const skill = skillNameIn(key);
+    if (skill !== null) refuseCollidingSkill(profile, skill);
+
+    const renamed = suffixed(key, (candidate) => held.has(candidate));
+    held.add(renamed);
+    items[index] = {
+      ...item,
+      movedTo: [into, renamed] as const,
+      note: `renamed — ${profile} already holds ${key}`,
+    };
+    warnings.push(`${key} is already in "${profile}", so it arrives as ${renamed}.`);
+  }
+
+  return warnings;
+}
+
+/**
+ * Whether one key inside a profile's directory can cross into another profile.
+ *
+ * Only the owner's material can. The prompt asks about memory, tasks, assets
+ * and skills; the directory holds two more things and neither may travel.
+ *
+ * `state.kv/` is derived and disposable, and adopting it would hand the
+ * destination another profile's cursor — resuming a mailbox from a position it
+ * never read and never seeing the messages in between, which is the
+ * cross-profile cursor sharing ADR-066 exists to remove.
+ *
+ * `vault.d/` is refused by `refuseSealedVault` rather than copied. Because the
+ * owner layer merges to one row per surface, both profiles hold
+ * `vault.d/lan5.enc` — so a copy always collided, landed as `lan5-2.enc`, and
+ * had its source deleted, leaving every item in it unreachable by any command.
+ */
+export function migratesAcross(key: string): boolean {
+  return !key.startsWith('state.kv/') && !key.startsWith('vault.d/');
+}
+
+/**
+ * Two sealed documents have no union, so the command says so and stops.
+ *
+ * Deleting one silently is the outcome nobody would accept, and a copy under
+ * another name is one no command opens — so neither is offered. The refusal
+ * names the two ways forward, which is the rule every refusal here follows.
+ */
+export function refuseSealedVault(profile: string, into: string): never {
+  throw new ConfigError(
+    `"${profile}" holds a sealed vault, and a vault cannot be merged into "${into}"'s: two ` +
+      'encrypted documents have no union, and a copy under another name is one no command opens.\n' +
+      `  Move what you need first — lanes link vault list --profile ${profile} — then remove it ` +
+      'with --delete-data.',
+  );
+}

package/src/cli/commands/profile/removal.ts

@@ -1,8 +1,22 @@
-import { layout, profilePath, vaultRef, workspacePath, type Config, type TargetConfig } from '#profile';
+import {
+  layout,
+  PROFILE_FILE,
+  profilePath,
+  vaultRef,
+  workspacePath,
+  type Config,
+  type TargetConfig,
+} from '#profile';
 import type { SecretStore } from '#secrets';
 import type { BlobStore } from '#stores/blobs';
 import { credentialRefFor, ownClientRefsFor, type ProviderRegistry } from '#registry';
 import { print, style, warn } from '../../output.ts';
+import {
+  migratesAcross,
+  refuseSealedVault,
+  resolveCollisions,
+  type Disposition,
+} from './disposition.ts';
 
 /**
  * What a profile's removal is allowed to delete, worked out before any of it
@@ -103,8 +117,21 @@ export interface RemovalItem {
   readonly kind: 'secret' | 'blob' | 'file' | 'config' | 'workspace-key';
   readonly id: string;
   readonly note?: string;
+  /**
+   * The area `id` is a key within, for a blob.
+   *
+   * Carried rather than derived: the two ends of a migration are two areas and
+   * the executor opens both. Derived once, the plan prefixed the profile
+   * directory onto `id` while the executor opened its default area — the copy
+   * found nothing at the doubled path, wrote nothing, and the directory removal
+   * took the bytes. A `--migrate-to` reported success and lost the data.
+   */
+  readonly area?: string;
+  /** Where this object goes instead of being deleted, as `[area, key]`. */
+  readonly movedTo?: readonly [string, string];
 }
 
+
 export interface RemovalPlan {
   readonly profile: string;
   readonly items: readonly RemovalItem[];
@@ -128,6 +155,8 @@ export interface PlanOptions {
   readonly openSecrets: (target: string) => Promise<SecretStore>;
   readonly openBlobs: (target: string, area?: string) => Promise<BlobStore>;
   readonly readDefaultProfile?: (() => Promise<string | undefined>) | undefined;
+  /** What becomes of this profile's own bytes. */
+  readonly disposition: Disposition;
   /**
    * The profiles that are staying.
    *
@@ -140,6 +169,7 @@ export interface PlanOptions {
 
 const reason = (cause: unknown): string => (cause instanceof Error ? cause.message : String(cause));
 
+
 /**
  * Everything removing this profile would delete, before any of it is deleted.
  *
@@ -156,6 +186,9 @@ export async function removalPlan(
   options: PlanOptions,
 ): Promise<RemovalPlan> {
   const items: RemovalItem[] = [];
+  const migrateInto =
+    options.disposition.kind === 'migrate' ? options.disposition.into : undefined;
+  const sealed: string[] = [];
   const untouched: { target: string; refs: string[] }[] = [];
   const warnings: string[] = [];
 
@@ -205,16 +238,58 @@ export async function removalPlan(
       );
     }
 
-    // **No blob sweep, and no profile directory.** Both existed because a
-    // profile owned `data/<profile>/`, and `rm -r` on it was exactly "what could
-    // this profile reach". It owns nothing now (ADR-057, ADR-059): the blob root
-    // is the workspace's, and the stores under it belong to connections other
-    // profiles may grant. Listing it here would queue every byte in the
-    // workspace for deletion because one profile is going.
-    //
-    // What replaces it is `lanes link disconnect`, which takes one connection,
-    // its grants, and its credential — after checking whether anything else
-    // still needs them. That check is the whole reason this cannot happen here.
+    // **The sweep is back, bounded by the profile's own directory.** It went
+    // away under ADR-059, when a profile owned no bytes and the blob root was
+    // the whole workspace — listing it then queued every byte in the workspace
+    // for deletion because one profile was going. ADR-066 gives the directory
+    // back, so it means what it used to: what this profile owns, and nothing an
+    // account owns. `lanes link disconnect` is still the command for an
+    // account, and nothing here touches one.
+    try {
+      const blobs = await options.openBlobs(name, layout.profileDir(profile));
+      for (const blob of await blobs.list()) {
+        // **Not the declaration.** It is config rather than data, deleted below
+        // as its own item after everything it is the record of. Swept here it
+        // would be counted twice, and on a `--migrate-to` copied into the
+        // destination as a second `profile.yaml` — one profile's grants and
+        // members landing inside another's directory.
+        if (blob.key === PROFILE_FILE) continue;
+
+        const migratable = migrateInto !== undefined && migratesAcross(blob.key);
+
+        items.push({
+          target: name,
+          kind: 'blob',
+          id: blob.key,
+          area: layout.profileDir(profile),
+          ...(migratable
+            ? { movedTo: [layout.profileDir(migrateInto), blob.key] as const }
+            : {}),
+          ...(migrateInto !== undefined && !migratable
+            ? { note: 'not migrated — deleted with the profile' }
+            : {}),
+        });
+
+        if (migrateInto !== undefined && blob.key.startsWith('vault.d/')) sealed.push(blob.key);
+      }
+    } catch (cause) {
+      warnings.push(
+        `Target "${name}": its storage could not be opened (${reason(cause)}), so nothing in it will be removed.`,
+      );
+    }
+
+    // The store's root is the profile's own directory, and an adapter must never
+    // delete the root it was configured with — so emptying it leaves the
+    // directory, and one left behind is silently reused by a later `profile add`
+    // of the same name.
+    if (declared.storage.adapter === 'filesystem') {
+      items.push({
+        target: name,
+        kind: 'file',
+        id: layout.profileDir(profile),
+        note: 'the profile directory, once emptied',
+      });
+    }
 
     // A deployed revision reads its config from the bucket rather than the
     // image (ADR-023), so that copy is the profile too — and it is outside the
@@ -223,7 +298,7 @@ export async function removalPlan(
       items.push({
         target: name,
         kind: 'config',
-        id: `profiles/${profile}.yaml`,
+        id: layout.profileConfig(profile),
         note: 'the copy a deployed revision reads',
       });
     }
@@ -253,6 +328,16 @@ export async function removalPlan(
     });
   }
 
+  if (sealed.length > 0) refuseSealedVault(profile, migrateInto!);
+
+  if (migrateInto !== undefined) {
+    warnings.push(
+      ...(await resolveCollisions(items, migrateInto, layout.profileDir(migrateInto), (area) =>
+        options.openBlobs(options.target, area),
+      )),
+    );
+  }
+
   // Last. It is the only record of where everything else lives, so a failure
   // before this point leaves data a later run can still find.
   items.push({ target: null, kind: 'config', id: profilePath(root, profile) });
@@ -290,7 +375,9 @@ export function renderPlan(plan: RemovalPlan): void {
     print(`  ${style.bold(target ?? 'workspace')}`);
     for (const item of items) {
       const note = item.note ? style.dim(` — ${item.note}`) : '';
-      print(`    ${KIND_LABEL[item.kind].padEnd(10)} ${item.id}${note}`);
+      const shown = item.area === undefined ? item.id : `${item.area}/${item.id}`;
+      const into = item.movedTo ? style.dim(` → ${item.movedTo[0]}/${item.movedTo[1]}`) : '';
+      print(`    ${KIND_LABEL[item.kind].padEnd(10)} ${shown}${into}${note}`);
     }
     print();
   }

package/src/cli/commands/profile/remove.ts

@@ -24,6 +24,7 @@ import {
 } from '../../runtime.ts';
 import { loadWorkspaceProfiles } from '#profile';
 import { removalPlan, renderPlan, type RemovalItem, type RemovalPlan } from './removal.ts';
+import { settleDisposition, type Disposition } from './disposition.ts';
 
 /**
  * Performing a removal, and being honest about the parts that did not happen.
@@ -62,9 +63,21 @@ export interface RunDeps {
 
 const reason = (cause: unknown): string => (cause instanceof Error ? cause.message : String(cause));
 
-/** The items that only make sense once everything else is actually gone. */
+/**
+ * The items that only make sense once everything else is actually gone.
+ *
+ * **`file` is in here, and that is the whole of its reason.** It is
+ * `rm -rf profiles/<profile>`, and it carries a target rather than `null`, so
+ * the original `target === null` test let it run after a failed object — taking
+ * the bytes a `--migrate-to` had not managed to copy, and `profile.yaml`, which
+ * the sweep deliberately leaves for last. `renderOutcome` then printed "the
+ * profile's config was kept, so nothing is stranded" about a directory that no
+ * longer existed. Same shape as the defect this file records having shipped
+ * once already.
+ */
 const isRecordOfWhereThingsAre = (item: RemovalItem): boolean =>
-  item.target === null && (item.kind === 'config' || item.kind === 'workspace-key');
+  item.kind === 'file' ||
+  (item.target === null && (item.kind === 'config' || item.kind === 'workspace-key'));
 
 export async function executeRemoval(
   plan: RemovalPlan,
@@ -107,9 +120,30 @@ export async function executeRemoval(
           await (await secretStore(item.target!)).delete(item.id);
           break;
 
-        case 'blob':
-          await (await blobStore(item.target!)).delete(item.id);
+        case 'blob': {
+          const store = await blobStore(item.target!, item.area);
+
+          // Read across *before* deleting, and verify it landed — the same rule
+          // the contract migrations follow, for the same reason: a copy that
+          // half happened and a source that is already gone is the one state
+          // with nothing to retry from. A collision was resolved while this was
+          // still a plan, so the destination is free.
+          if (item.movedTo !== undefined) {
+            const [area, key] = item.movedTo;
+            const bytes = await store.get(item.id);
+
+            if (bytes !== null) {
+              const into = await blobStore(item.target!, area);
+              await into.put(key, bytes);
+              if ((await into.get(key)) === null) {
+                throw new Error(`${area}/${key} did not read back after being written`);
+              }
+            }
+          }
+
+          await store.delete(item.id);
           break;
+        }
 
         case 'config':
           if (item.target === null) await deps.removeConfig(item.id);
@@ -241,10 +275,15 @@ export interface RemoveFlags extends GlobalFlags {
   readonly dryRun?: boolean | undefined;
   readonly yes?: boolean | undefined;
   readonly json?: boolean | undefined;
+  /** Delete this profile's memory, tasks, assets, entities, vault and skills. */
+  readonly deleteData?: boolean | undefined;
+  /** Move them into this profile instead. */
+  readonly migrateTo?: string | undefined;
   /** Injected by a caller that has already asked — the console, and tests. */
   readonly prompter?: Prompter | undefined;
 }
 
+
 /**
  * `lanes link profile remove <name>` — the profile, and everything it owns.
  *
@@ -261,10 +300,32 @@ export async function removeProfile(name: string, flags: RemoveFlags): Promise<v
   const files = workspaceFiles(root);
   const { declared } = await openTarget(root, target);
 
+  const prompter = flags.prompter ?? terminalPrompter;
+  const someoneToAsk = flags.prompter ? prompter.interactive : process.stdin.isTTY;
+  const disposition = await settleDisposition(name, flags, prompter, someoneToAsk);
+
+  if (disposition === null) {
+    print(style.dim('  cancelled — nothing was removed'));
+    return;
+  }
+
+  if (disposition.kind === 'migrate') {
+    // Before the plan, because a plan against a profile that does not exist
+    // would name destinations nothing will ever read.
+    const staying = (await loadWorkspaceProfiles(root)).loaded.map((one) => one.profile);
+    if (disposition.into === name || !staying.includes(disposition.into)) {
+      throw new ConfigError(
+        `Cannot migrate "${name}" into "${disposition.into}".\n` +
+          `  Staying: ${staying.filter((one) => one !== name).join(', ') || 'nothing'}`,
+      );
+    }
+  }
+
   const plan = await removalPlan(config, root, name, registry, {
     target,
     declared,
-    openSecrets: (target) => openSecretStoreFor(config, root, target),
+    disposition,
+    openSecrets: (target) => openSecretStoreFor(root, target),
     openBlobs: (target, area) => openBlobStoreFor(config, root, target, area),
     readDefaultProfile: async () => (await readWorkspace(root))?.default_profile,
     // What the workspace keeps. The credential store is one file for all of
@@ -285,7 +346,7 @@ export async function removeProfile(name: string, flags: RemoveFlags): Promise<v
   if (!(await confirmedByName(name, { yes: flags.yes, prompter: flags.prompter }))) return;
 
   const outcome = await executeRemoval(plan, {
-    openSecrets: (target) => openSecretStoreFor(config, root, target),
+    openSecrets: (target) => openSecretStoreFor(root, target),
     openBlobs: (target, area) => openBlobStoreFor(config, root, target, area),
     removeConfig: async (path) => await files.delete(relativeToRoot(root, path)),
     removeDirectory: async (path) => await rm(workspacePath(root, path), { recursive: true, force: true }),

package/src/cli/commands/profile.ts

@@ -6,6 +6,8 @@ import {
   CONNECTIONS_FILE,
   ConfigError,
   WORKSPACE_FILE,
+  LEGACY_WORKSPACE_FILE,
+  legacyProfileConfig,
   listProfiles,
   profilePath,
   readWorkspace,
@@ -14,6 +16,7 @@ import {
   writeWorkspaceFile,
   resolveTargetWorkspace,
   resolveWorkspaceRoot,
+  layout,
 } from '#profile';
 
 import { recordConfigChange } from '../audit-change.ts';
@@ -77,9 +80,26 @@ export async function createProfile(
   // <name> --workspace local` on an empty directory is how a workspace comes into
   // existence, and the target it names is declared *by* that file — so writing
   // it second means resolving a target nothing has declared yet.
-  if (!isRemoteWorkspace(local) && !existsSync(join(local, WORKSPACE_FILE))) {
-    await mkdir(local, { recursive: true });
-    await writeFile(join(local, WORKSPACE_FILE), newWorkspaceTemplate(), { mode: 0o600 });
+  // **Either name, and an unmigrated workspace is refused rather than
+  // shadowed.** `resolveWorkspaceRoot` accepts both markers, so this ran
+  // against a contract-3 workspace, found no `workspaces.yaml`, and wrote a
+  // fresh template beside `lanes-link.yaml` — `readWorkspace` prefers the new
+  // name, so every declared target and deployment record vanished, and
+  // `renameRegistry` returns early once the new file exists, so no migration
+  // could put them back.
+  if (!isRemoteWorkspace(local)) {
+    if (existsSync(join(local, LEGACY_WORKSPACE_FILE)) && !existsSync(join(local, WORKSPACE_FILE))) {
+      throw new ConfigError(
+        `${local} is still laid out the way contract 3 kept it, and adding a profile here would ` +
+          'write a second registry beside the one it already has.\n' +
+          '  Migrate it first: lanes link doctor --fix --profile <name> --workspace <name>',
+      );
+    }
+
+    if (!existsSync(join(local, WORKSPACE_FILE))) {
+      await mkdir(local, { recursive: true });
+      await writeFile(join(local, WORKSPACE_FILE), newWorkspaceTemplate(), { mode: 0o600 });
+    }
   }
 
   const root = await resolveTargetWorkspace(local, target);
@@ -93,8 +113,15 @@ export async function createProfile(
     await writeWorkspaceFile(workspaceFiles(root), CONNECTIONS_FILE, newConnectionsTemplate());
   }
 
-  if (await workspaceFiles(root).has(`profiles/${name}.yaml`)) {
-    throw new Error(`Profile "${name}" already exists at ${path}`);
+  // Both shapes, for the same reason: `listProfiles` sees a contract-3
+  // `profiles/<name>.yaml` and this did not, so `profile add personal` wrote a
+  // fresh template alongside the operator's own — one name, two files, and the
+  // empty one opened. `doctor --fix` then planned a move onto an occupied
+  // destination and threw on every rerun.
+  for (const key of [layout.profileConfig(name), legacyProfileConfig(name)]) {
+    if (await workspaceFiles(root).has(key)) {
+      throw new Error(`Profile "${name}" already exists at ${root}/${key}`);
+    }
   }
 
   // Only a directory needs making. A bucket has no directories, and the write
@@ -127,7 +154,7 @@ export async function createProfile(
 
   await writeWorkspaceFile(
     workspaceFiles(root),
-    `profiles/${name}.yaml`,
+    layout.profileConfig(name),
     newProfileTemplate(name, port, session?.subject),
   );