@orkestrel/scaffold 0.0.20 → 0.0.22

package/dist/bin/scaffold.js

@@ -2,11 +2,11 @@
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative } from "node:path";
 import * as tls from "node:tls";
-import { DEPENDENCY_NAME_PATTERN, ENVIRONMENTS, GROUPS, MAX_ARTIFACT_BYTES, NAME_PATTERN, SERVICE_SCRIPT_PATH, ScaffoldError, blueprint, catalogNames, catalogToBlock, createCompiler, dependency, diffPlan, isScaffoldError, manifestToDependencies, manifestToName, planToSummary } from "../src/core/index.js";
+import { CATALOG_AGENT_PATH, DEPENDENCY_NAME_PATTERN, ENVIRONMENTS, GROUPS, MAX_ARTIFACT_BYTES, NAME_PATTERN, SERVICE_SCRIPT_PATH, ScaffoldError, blueprint, catalogNames, catalogToBlock, createCompiler, dependency, diffPlan, isScaffoldError, manifestToDependencies, manifestToName, ownDataValue, planToSummary } from "../src/core/index.js";
 import { WriteTransaction, catalogPackages, commitWriteTransaction, createMaterializer, createSync, deriveBlueprint, digestFile, digestText, discardWriteTransaction, discoverPackages, hostRoot, hydratePlan, isFilesystemPath, isRealDirectory, isTerminalText, isVacant, locateHostSource, parseSyncOptions, pruneTargets, readFileText, readHostManifest, readManifest, readTarget, resolvePhysicalPath, validateWriteDirectories } from "../src/server/index.js";
 import { createReporter, createSpinner, createStyler } from "@orkestrel/console";
 import { createServerSink } from "@orkestrel/console/server";
-import { attempt } from "@orkestrel/contract";
+import { attempt, isRecord, parseJSON } from "@orkestrel/contract";
 import { isTerminalError } from "@orkestrel/terminal";
 import { createTerminal } from "@orkestrel/terminal/server";
 import { parseArgs } from "node:util";
@@ -48,10 +48,10 @@ var ACTION_LABEL = Object.freeze({
 	skipped: "unchanged",
 	removed: "removed"
 });
-/** Repair's deliberately limited ownership boundary. */
-var REPAIR_SCOPE = "repair scope: shared host-owned artifacts only — starter and generated files are never touched";
-/** Repair's opt-in generated-canon ownership boundary. */
-var REPAIR_GENERATED_SCOPE = "repair scope: shared host-owned and generated artifacts — starter files and package.json are never touched";
+/** The deliberately limited ownership boundary every write verb repairs within. */
+var REPAIR_SCOPE = "shared host-owned artifacts and absent service seams — missing files are restored; drifted files change only with --replace, which discards local changes; present starter and generated files are never touched";
+/** The opt-in generated-canon ownership boundary `--generated` widens that write to. */
+var REPAIR_GENERATED_SCOPE = "shared host-owned and generated artifacts plus service manifest scripts — missing files are restored; drifted files change only with --replace, which discards local changes; present starter files and package publication metadata are never touched";
 /** The dry-run note for `new`. */
 var NEW_DRY_RUN_NOTE = "dry run — pass --apply to write";
 /** The fallback message for a malformed command line without an error message. */
@@ -95,7 +95,7 @@ var VERB_SUMMARY = Object.freeze({
 	pull: "refresh vendored guides/versions, report drift",
 	mirror: "refresh every published Orkestrel package guide",
 	audit: "whole-plan conformance report",
-	repair: "restore host-owned files, plus generated canon with --generated",
+	repair: "restore missing host-owned files; replace drifted bytes only with --replace",
 	fleet: "audit/repair every workspace under the cwd's immediate children",
 	catalog: "regenerate the fleet package-catalog table"
 });
@@ -104,9 +104,9 @@ var VERB_FLAGS = Object.freeze({
 	new: "--src a,b --app a,b --deps x,y --apply --yes --target <path> --from <path>",
 	pull: "--target . --deps x,y --apply --yes --strict",
 	mirror: "--target . --apply --yes --strict",
-	audit: "--target . --live --generated --from <path> --groups a,b",
-	repair: "--target . --generated --apply --yes --prune --from <path>",
-	fleet: "--generated --apply --yes --prune --from <path>",
+	audit: "--target . --live --generated --replace --from <path> --groups a,b",
+	repair: "--target . --generated --replace --apply --yes --prune --from <path>",
+	fleet: "--generated --replace --apply --yes --prune --from <path>",
 	catalog: "--from <path> ... --target <repo> --offline --apply --yes"
 });
 /** Plain-language command flag descriptions. */
@@ -136,20 +136,23 @@ var VERB_FLAG_HELP = Object.freeze({
 	audit: [
 		["--target .", "directory to audit (default: current directory)"],
 		["--live", "also check upstream freshness over the network"],
-		["--generated", "include generated canon if the repair hand-off is accepted"],
+		["--generated", "widen an accepted repair hand-off to generated files"],
+		["--replace", "let the repair hand-off discard local changes in the drifted files it names"],
 		["--from <path>", "read the template from a local path instead of the bundled one"],
 		["--groups a,b", "limit the audit to these artifact groups"]
 	],
 	repair: [
 		["--target .", "directory to repair (default: current directory)"],
-		["--generated", "also restore generated canon except package.json"],
+		["--generated", "widen the scope to generated files, except package.json"],
+		["--replace", "discard local changes in the drifted files named by the repair report"],
 		["--apply", "write the fixes (default is a dry run)"],
 		["--yes", "skip the confirmation question"],
 		["--prune", "also DELETE unexpected files under .claude/agents, .codex/agents, and scripts"],
 		["--from <path>", "read the template from a local path instead of the bundled one"]
 	],
 	fleet: [
-		["--generated", "also restore generated canon except package.json in every package"],
+		["--generated", "widen the scope to generated files in every package, except package.json"],
+		["--replace", "discard local changes in the drifted files named in each package"],
 		["--apply", "write fixes across every package (default is a dry run)"],
 		["--yes", "skip the confirmation question"],
 		["--prune", "also DELETE unexpected files under .claude/agents, .codex/agents, and scripts, per package"],
@@ -186,19 +189,17 @@ var VERB_EXAMPLE = Object.freeze({
 /** Message used when a prune scan has no candidates. */
 var PRUNE_EMPTY = "no unexpected files to delete";
 /** Guidance for unexpected files outside a non-pruning repair handoff. */
-var FOREIGN_HINT = "unexpected files found — run 'scaffold repair --prune' to delete them";
+var FOREIGN_HINT = "unexpected files are never deleted by default — run 'scaffold repair --prune --apply' to delete them; a file you added yourself is unexpected too, so check the paths above first";
 /** Interactive dependency prompt. */
 var ORKESTREL_DEPS_PROMPT = "@orkestrel dependencies (comma-separated short names, e.g. contract, emitter — installed as dependencies)";
 /** Catalog-degraded validation note. */
 var CATALOG_UNRESOLVED_NOTE = "couldn't resolve the vendored @orkestrel catalog — validating names by shape only";
-/** Catalog block destination in a scaffolded repository. */
-var CATALOG_AGENT_PATH = ".claude/agents/orkestrel.md";
 /** Opening marker for the generated package catalog block. */
 var CATALOG_START_MARKER = "<!-- catalog:start -->";
 /** Closing marker for the generated package catalog block. */
 var CATALOG_END_MARKER = "<!-- catalog:end -->";
 /** Non-terminal prune safety note. */
-var PRUNE_SKIPPED = "prune skipped — not a terminal; add --apply (or --yes) to delete non-interactively";
+var PRUNE_SKIPPED = "prune skipped — pass --apply to authorize deletion; --yes only skips confirmation";
 /** Degraded unexpected-file scan note. */
 var SCAN_SKIPPED = "unexpected-file scanning skipped — couldn't establish the template source";
 //#endregion
@@ -213,47 +214,57 @@ var CLIExitError = class extends Error {
 };
 //#endregion
 //#region src/bin/shapers.ts
-/** Partition findings by whether repair owns their artifact origin. */
+/** Partition findings by whether repair owns their artifact origin. The `owned` and `generated` buckets carry no foreign findings by construction. */
 function partitionFindings(findings, plan) {
 	const origins = new Map(plan.artifacts.map((artifact) => [artifact.path, artifact.origin]));
 	let ownedDrifted = 0;
 	let ownedMissing = 0;
-	let ownedForeign = 0;
 	let generatedDrifted = 0;
 	let generatedMissing = 0;
-	let generatedForeign = 0;
+	let foreign = 0;
 	for (const finding of findings) {
 		const origin = origins.get(finding.path);
 		const owned = origin === "host" || origin === "template";
 		if (finding.drift === "aligned") continue;
-		if (finding.drift === "stale") if (owned) ownedDrifted += 1;
-		else generatedDrifted += 1;
-		else if (finding.drift === "missing") if (owned) ownedMissing += 1;
-		else generatedMissing += 1;
-		else if (owned) ownedForeign += 1;
-		else generatedForeign += 1;
+		if (finding.drift === "foreign") {
+			foreign += 1;
+			continue;
+		}
+		if (finding.drift === "stale") {
+			if (owned) ownedDrifted += 1;
+			else generatedDrifted += 1;
+		} else if (finding.drift === "missing") {
+			if (owned) ownedMissing += 1;
+			else generatedMissing += 1;
+		}
 	}
 	return {
 		owned: {
 			drifted: ownedDrifted,
 			missing: ownedMissing,
-			foreign: ownedForeign
+			foreign: 0
 		},
 		generated: {
 			drifted: generatedDrifted,
 			missing: generatedMissing,
-			foreign: generatedForeign
+			foreign: 0
+		},
+		foreign: {
+			drifted: 0,
+			missing: 0,
+			foreign
 		}
 	};
 }
 /** Create one deterministic fleet result entry. */
-function fleetEntryOf(name, counts, failed) {
+function fleetEntryOf(name, counts, failed, outside = 0) {
 	return {
 		name,
 		drifted: counts?.drifted ?? 0,
 		missing: counts?.missing ?? 0,
 		foreign: counts?.foreign ?? 0,
-		failed
+		failed,
+		outside
 	};
 }
 /** Create the command-line interface's machine-readable failure envelope. */
@@ -275,7 +286,14 @@ function summaryToNewResult(summary, applied) {
 		applied
 	};
 }
-/** Add a materialization result to an audit. */
+/** Add repair's outside-scope count to its selected audit. */
+function repairAuditOf(audit, outside) {
+	return {
+		...audit,
+		outside
+	};
+}
+/** Add a materialization result to a repair audit. */
 function auditToRepairResult(audit, result) {
 	return {
 		...audit,
@@ -302,9 +320,9 @@ function countPart(count, label) {
 /** Render nonzero audit buckets or `clean`. */
 function bucketText(counts) {
 	const parts = [];
-	if (counts.drifted > 0) parts.push(countPart(counts.drifted, "drifted"));
-	if (counts.missing > 0) parts.push(countPart(counts.missing, "missing"));
-	if (counts.foreign > 0) parts.push(countPart(counts.foreign, "unexpected"));
+	if (counts.drifted > 0) parts.push(`${counts.drifted} drifted`);
+	if (counts.missing > 0) parts.push(`${counts.missing} missing`);
+	if (counts.foreign > 0) parts.push(`${counts.foreign} unexpected`);
 	return parts.length > 0 ? parts.join(", ") : "clean";
 }
 /** Render audit's origin-aware verdict. */
@@ -312,7 +330,12 @@ function auditVerdict(audit, plan) {
 	const count = audit.findings.length;
 	if (audit.clean) return `audit: ${countPart(count, "artifact")} — clean`;
 	const split = partitionFindings(audit.findings, plan);
-	return split.owned.drifted === 0 && split.owned.missing === 0 && split.owned.foreign === 0 ? `audit: ${countPart(count, "artifact")} — host-owned clean; ${bucketText(split.generated)} (generated)` : `audit: ${countPart(count, "artifact")} — host-owned: ${bucketText(split.owned)}; generated: ${bucketText(split.generated)}`;
+	const owned = split.owned.drifted === 0 && split.owned.missing === 0;
+	const generated = bucketText(split.generated);
+	const foreign = bucketText(split.foreign);
+	if (owned && generated === "clean") return `audit: ${countPart(count, "artifact")} — host-owned clean; ${foreign}`;
+	const suffix = foreign === "clean" ? "" : `; unexpected: ${foreign}`;
+	return owned ? `audit: ${countPart(count, "artifact")} — host-owned clean; ${generated} (generated)${suffix}` : `audit: ${countPart(count, "artifact")} — host-owned: ${bucketText(split.owned)}; generated: ${generated}${suffix}`;
 }
 /** Render non-aligned audit findings as terminal table rows. */
 function findingRows(findings, plan) {
@@ -339,6 +362,43 @@ function auditTable(audit, plan) {
 	};
 }
 /**
+* Count the files one authorized write will create or overwrite.
+*
+* @param counts - The drift tallies of every target the write covers.
+* @param replace - Whether stale byte replacement was explicitly authorized.
+* @returns Every missing file, plus drifted files only under `replace`.
+* @remarks
+* The one figure every write confirmation asks about, so `repair` and `fleet`
+* cannot drift apart on it. An unexpected file is never counted here: only
+* `--prune` deletes one, and only after its own separate question.
+*/
+function countWrites(counts, replace) {
+	let total = 0;
+	for (const count of counts) total += count.missing + (replace ? count.drifted : 0);
+	return total;
+}
+/**
+* Test whether a reported repository remains dirty inside or outside the selected scope.
+*
+* @param audit - The selected-scope audit.
+* @param outside - Findings outside that scope.
+* @returns Whether either source reports drift.
+*/
+function hasFindings(audit, outside) {
+	return !audit.clean || outside > 0;
+}
+/**
+* Render one write verb's ownership boundary in that verb's own voice.
+*
+* @param verb - The command whose scope this is.
+* @param generated - Whether generated canon was included in the scope.
+* @param repos - The number of repositories the write covers, absent for a single target.
+* @returns The scope line naming what the command restores, what it replaces only with `--replace`, and what it never touches.
+*/
+function scopeLine(verb, generated, repos) {
+	return `${verb} scope${repos === void 0 ? "" : ` across ${countPart(repos, "repo")}`}: ${generated ? REPAIR_GENERATED_SCOPE : REPAIR_SCOPE}`;
+}
+/**
 * Render drift outside repair's selected ownership boundary.
 *
 * @param count - The number of findings outside the selected scope.
@@ -347,24 +407,84 @@ function auditTable(audit, plan) {
 */
 function scopeNote(count, generated) {
 	if (count === 0) return void 0;
-	return generated ? `note: ${countPart(count, "finding")} outside host-owned and generated repair scope — run 'audit' for the list; starter files and package.json remain protected` : `note: ${countPart(count, "finding")} outside host-owned repair scope — run 'audit' for the list`;
+	return generated ? `note: ${countPart(count, "finding")} outside host-owned and generated repair scope — run 'audit' for the list; present starter files and package publication metadata remain protected` : `note: ${countPart(count, "finding")} outside host-owned repair scope — run 'audit' for the list`;
 }
 /**
 * Render repair's dry-run verdict.
 *
 * @param audit - The audit over the selected repair plan.
-* @param generated - Whether generated canon was included in the repair scope.
+* @param options - The selected scope and write authorizations.
 * @returns The scope-aware clean or drifted verdict.
 */
-function repairVerdict(audit, generated) {
-	const scope = generated ? "host-owned and generated" : "host-owned";
+function repairVerdict(audit, options) {
+	const scope = options.generated ? "host-owned and generated" : "host-owned";
 	if (audit.clean) return `repair: ${countPart(audit.findings.length, `${scope} artifact`)} aligned — nothing to write`;
-	return `repair: ${scope}: ${bucketText(audit)} — pass --apply to write`;
+	const head = `repair: ${scope}: ${bucketText(audit)}`;
+	if (audit.drifted === 0) return options.apply ? `${head} — missing files will be restored` : `${head} — pass --apply to write`;
+	if (audit.missing === 0) return options.replace ? `${head} — --apply overwrites drifted files, discarding local changes` : `${head} — drifted files change only with --replace, which discards local changes`;
+	return options.replace ? `${head} — --apply restores missing files and overwrites drifted ones, discarding local changes` : `${head} — --apply restores missing files; drifted files change only with --replace, which discards local changes`;
 }
-/** Render repair's materialization tally. */
-function repairSuccess(result, removed) {
-	const written = result.written.length + result.copied.length;
-	return `${ACTION_LABEL.written} ${written}, ${ACTION_LABEL.skipped} ${result.skipped.length}, ${ACTION_LABEL.removed} ${removed.length}`;
+/**
+* Merge only generated service scripts into an existing manifest.
+*
+* @param current - The existing consumer manifest text.
+* @param generated - The canonical manifest text for the derived service blueprint.
+* @param services - The declared service vendor names.
+* @returns Formatter-stable manifest text preserving publication metadata and unrelated scripts.
+*/
+function mergeServiceManifest(current, generated, services) {
+	const currentManifest = parseJSON(current);
+	const generatedManifest = parseJSON(generated);
+	if (!isRecord(currentManifest) || !isRecord(generatedManifest)) throw new ScaffoldError("INVALID", "Service adoption requires object package manifests");
+	const currentScriptsValue = ownDataValue(currentManifest, "scripts");
+	const generatedScriptsValue = ownDataValue(generatedManifest, "scripts");
+	if (!isRecord(currentScriptsValue) || !isRecord(generatedScriptsValue)) throw new ScaffoldError("INVALID", "Service adoption requires object package scripts");
+	const serviceKeys = ["test:service", ...services.map((service) => `test:service:${service}`)];
+	const serviceNames = new Set(serviceKeys);
+	const currentPublish = ownDataValue(currentScriptsValue, "prepublishOnly");
+	const generatedPublish = ownDataValue(generatedScriptsValue, "prepublishOnly");
+	if (typeof currentPublish !== "string" || typeof generatedPublish !== "string") throw new ScaffoldError("INVALID", "Service adoption requires a prepublishOnly script");
+	const suffix = " && npm run test:service";
+	const publish = currentPublish.endsWith(suffix) ? currentPublish : `${currentPublish}${suffix}`;
+	const scripts = {};
+	for (const name of Object.keys(generatedScriptsValue)) {
+		if (serviceNames.has(name)) {
+			const value = ownDataValue(generatedScriptsValue, name);
+			if (typeof value !== "string") throw new ScaffoldError("INVALID", `Generated service script is missing at ${name}`);
+			scripts[name] = value;
+			continue;
+		}
+		if (name === "prepublishOnly") {
+			scripts[name] = publish;
+			continue;
+		}
+		const value = ownDataValue(currentScriptsValue, name);
+		if (value !== void 0) scripts[name] = value;
+	}
+	for (const name of Object.keys(currentScriptsValue)) {
+		if (Object.hasOwn(scripts, name)) continue;
+		if (name === "test:service" || name.startsWith("test:service:")) continue;
+		const value = ownDataValue(currentScriptsValue, name);
+		if (value !== void 0) scripts[name] = value;
+	}
+	return `${JSON.stringify({
+		...currentManifest,
+		scripts
+	}, void 0, "	")}\n`;
+}
+/**
+* Render repair's closing tally.
+*
+* @param tally - The displayed counts of one repair run.
+* @returns The tally line, in the same words the audit table above it used.
+* @remarks
+* A drifted file repair was not authorized to overwrite is counted on its own
+* rather than folded in with the aligned files, because `unchanged` is already
+* the audit table's word for a file that matches canon.
+*/
+function repairTally(tally) {
+	const left = tally.drifted === 0 ? "" : `, ${countPart(tally.drifted, `${DRIFT_LABEL.stale} file`)} left alone`;
+	return `${ACTION_LABEL.written} ${tally.written}, ${ACTION_LABEL.skipped} ${tally.unchanged}${left}, ${ACTION_LABEL.removed} ${tally.removed}`;
 }
 /** Render synchronization freshness as table rows. */
 function syncRows(report) {
@@ -413,7 +533,7 @@ function fleetRepoLine(name, outcome) {
 }
 /** Render fleet's repository totals. */
 function fleetTotals(drifted, failed) {
-	return `total: ${countPart(drifted, "drifted repo")}, ${countPart(failed, "failed")}`;
+	return `total: ${countPart(drifted, "dirty repo")}, ${failed} failed`;
 }
 /** Create catalog's terminal table. */
 function catalogTable(entries) {
@@ -445,13 +565,25 @@ function newPlanTable(summary) {
 		]
 	};
 }
+/**
+* Render one contained write destination as the operator's own path to it.
+*
+* @param root - The invocation directory every write is confined beneath.
+* @param destination - The contained physical destination.
+* @returns The destination relative to the invocation directory, or the absolute path when it is not beneath it.
+*/
+function describeDestination(root, destination) {
+	const path = relative(root, destination).replaceAll("\\", "/");
+	if (path === "") return ".";
+	return path.startsWith("..") ? destination : `./${path}`;
+}
 /** Render `new`'s dry-run destination. */
-function newPlanPreview(name) {
-	return `will write into ./${name}`;
+function newPlanPreview(destination) {
+	return `will write into ${destination}`;
 }
 /** Render `new`'s write result. */
-function newApplySuccess(count, name) {
-	return `wrote ${countPart(count, "file")} into ./${name}`;
+function newApplySuccess(count, destination) {
+	return `wrote ${countPart(count, "file")} into ${destination}`;
 }
 /** Render catalog's write result. */
 function catalogApplySuccess(path) {
@@ -466,12 +598,21 @@ function applyConfirmMessage(files, repos) {
 function pruneConfirmMessage(count) {
 	return `Also delete ${countPart(count, "unexpected file")} under .claude/agents, .codex/agents, and scripts? `;
 }
-/** Render the interactive audit-to-repair handoff. */
-function repairHandoff(owned, foreign, prune) {
+/**
+* Render the interactive audit-to-repair handoff as the list of actions it authorizes.
+*
+* @param missing - The number of missing host-owned files the inherited repair would restore.
+* @param drifted - The number of drifted host-owned files it would overwrite, zero unless `--replace` authorized replacement.
+* @param foreign - The number of unexpected files found.
+* @param prune - Whether `--prune` authorized deletion, without which no unexpected file is touched.
+* @returns The confirmation question, naming each authorized action and the cost of overwriting.
+*/
+function repairHandoff(missing, drifted, foreign, prune) {
 	const parts = [];
-	if (owned > 0) parts.push(`${countPart(owned, "host-owned file")} ${owned === 1 ? "has" : "have"} drift`);
-	if (prune && foreign > 0) parts.push(`${countPart(foreign, "unexpected file")} will be deleted`);
-	return `${parts.join(" and ")} — run repair now? `;
+	if (missing > 0) parts.push(`restore ${countPart(missing, "missing host-owned file")}`);
+	if (drifted > 0) parts.push(`overwrite ${countPart(drifted, "drifted host-owned file")}, discarding local changes`);
+	if (prune && foreign > 0) parts.push(`delete ${countPart(foreign, "unexpected file")}`);
+	return `${parts.join("; ")} — run repair now? `;
 }
 /** Render one unresolved Orkestrel dependency token. */
 function unknownOrkestrelToken(token, suggestion) {
@@ -565,9 +706,23 @@ function invalidName(name, pattern) {
 function unresolvedVersion(names) {
 	return `could not resolve the latest version for ${names.map((name) => `"${name}"`).join(", ")} — check the name or pass name@range`;
 }
-/** Render drift that belongs to generated artifacts. */
+/**
+* Render drift that belongs to generated artifacts.
+*
+* @param count - The number of findings on generated artifacts.
+* @returns The guidance line, stating what each repair scope does rather than how the files differ.
+*/
 function generatedNote(count) {
-	return `${countPart(count, "finding")} in generated files — these are regenerated, not hand-edited; run 'scaffold repair --generated' to restore them`;
+	return `${countPart(count, "finding")} in generated files — run 'scaffold repair --generated' to restore missing ones; add --replace to overwrite drifted ones, discarding local changes`;
+}
+/**
+* Render the explicit destructive opt-in for stale host-owned files.
+*
+* @param count - The number of stale host-owned files.
+* @returns The replacement guidance line, naming the safe default before its destructive opt-in.
+*/
+function replacementNote(count) {
+	return `${countPart(count, "drifted host-owned file")} — repair leaves drifted files alone; 'scaffold repair --replace' overwrites them, discarding local changes`;
 }
 /**
 * Render honest repair guidance for computed and protected manifest drift.
@@ -587,16 +742,19 @@ function renderComputedNotes(findings, plan) {
 	}
 	const notes = [];
 	if (computed > 0) notes.push(generatedNote(computed));
-	if (manifest > 0) notes.push(`${countPart(manifest, "finding")} in package.json — repair does not rewrite protected publication metadata; review and edit it directly`);
+	if (manifest > 0 && plan.blueprint.services.length > 0) notes.push(`${countPart(manifest, "finding")} in package.json — 'scaffold repair --generated' repairs generated service scripts; review any remaining publication metadata directly`);
+	else if (manifest > 0) notes.push(`${countPart(manifest, "finding")} in package.json — repair does not rewrite protected publication metadata; review and edit it directly`);
 	return notes;
 }
 /** Render live dependency freshness tallies. */
 function auditLiveNote(current, behind, failed) {
-	return `live: ${countPart(current, "current")}, ${countPart(behind, "behind")}, ${countPart(failed, "failed")}`;
+	return `live: ${current} current, ${behind} behind, ${failed} failed`;
 }
 /** Render whether an audit compared content or presence. */
-function comparisonLine(aware) {
-	return aware ? "comparing: file contents for host-owned files" : "comparing: file names only for host-owned files (no vendored source found)";
+function comparisonLine(compared, presence) {
+	if (presence === 0) return "comparing: file contents for host-owned files";
+	if (compared === 0) return `comparing: file presence for ${countPart(presence, "presence-owned file")}`;
+	return `comparing: file contents for ${countPart(compared, "host-owned file")}; presence for ${countPart(presence, "presence-owned file")}`;
 }
 /** Render catalog's final verdict. */
 function catalogVerdict(clean) {
@@ -660,6 +818,10 @@ function parseArguments(argv) {
 				type: "boolean",
 				default: false
 			},
+			replace: {
+				type: "boolean",
+				default: false
+			},
 			strict: {
 				type: "boolean",
 				default: false
@@ -822,8 +984,8 @@ var CLI = class {
 			compiler.destroy();
 		}
 	}
-	#prunePaths(target, host, service) {
-		const seam = service ? SERVICE_SCRIPT_PATH : void 0;
+	#prunePaths(target, host, services) {
+		const seam = services.length > 0 ? SERVICE_SCRIPT_PATH : void 0;
 		return pruneTargets(target, host).filter((path) => path !== seam);
 	}
 	/**
@@ -836,8 +998,8 @@ var CLI = class {
 	* unclean, so an "unexpected file" is honestly counted as drift (exit 1)
 	* instead of the structurally-always-zero `diffPlan.foreign`.
 	*/
-	#scan(audit, target, host, service) {
-		const paths = this.#prunePaths(target, host, service);
+	#scan(audit, target, host, services) {
+		const paths = this.#prunePaths(target, host, services);
 		if (paths.length === 0) return audit;
 		const findings = paths.map((path) => ({
 			path,
@@ -856,8 +1018,8 @@ var CLI = class {
 	* When fail-closed allowlist discovery raises a coded `TARGET` failure, retain
 	* the existing findings and mark the audit incomplete instead of crashing.
 	*/
-	#scanSafe(audit, target, host, service) {
-		const scanned = attempt(() => this.#scan(audit, target, host, service));
+	#scanSafe(audit, target, host, services) {
+		const scanned = attempt(() => this.#scan(audit, target, host, services));
 		if (scanned.success) return {
 			audit: scanned.value,
 			skipped: false
@@ -882,21 +1044,63 @@ var CLI = class {
 	* caller compiles the full plan anyway. Diff it too so a clean scoped verdict can point at drift
 	* outside the selected boundary. The count feeds the shared `scopeNote` renderer.
 	*/
-	#outside(compiled, target) {
-		const full = diffPlan(compiled, readTarget(target, compiled.artifacts.map((artifact) => artifact.path)));
-		return full.drifted + full.missing + full.foreign;
+	#outside(compiled, selected, target, host) {
+		const full = hydratePlan(compiled, host);
+		const selectedPaths = new Set(selected.artifacts.map((artifact) => artifact.path));
+		return diffPlan(full, readTarget(target, full.artifacts.map((artifact) => artifact.path))).findings.filter((finding) => finding.drift !== "aligned" && !selectedPaths.has(finding.path)).length;
 	}
-	/** Compile and audit the selected repair ownership boundary for one structural snapshot. */
-	#prepareRepair(spec, target, host, generated, json) {
-		const [compiled] = this.#compile(spec, json);
-		const scoped = {
-			...compiled,
+	#emitRepair(audit, generated, json, result) {
+		if (json) {
+			this.#write(result === void 0 ? audit : auditToRepairResult(audit, result));
+			return;
+		}
+		const note = scopeNote(audit.outside, generated);
+		if (note !== void 0) this.#reporter.line(note);
+	}
+	/** Promote only absent service-owned starter seams into repairable missing artifacts. */
+	#promoteServices(plan, target) {
+		if (plan.blueprint.services.length === 0) return plan;
+		const paths = [SERVICE_SCRIPT_PATH, "tests/config/services.test.ts"];
+		const current = readTarget(target, paths);
+		return {
+			...plan,
+			artifacts: plan.artifacts.map((artifact) => artifact.origin === "template" && paths.includes(artifact.path) && !Object.hasOwn(current, artifact.path) ? {
+				...artifact,
+				origin: "computed"
+			} : artifact)
+		};
+	}
+	/** Select repair ownership and merge only the manifest's generated service-script keys. */
+	#scopeRepair(compiled, target, generated) {
+		const promoted = this.#promoteServices(compiled, target);
+		const currentManifest = generated && promoted.blueprint.services.length > 0 ? readManifest(target) : void 0;
+		const artifacts = [];
+		for (const artifact of promoted.artifacts) {
+			if (artifact.origin === "host" || artifact.path === SERVICE_SCRIPT_PATH || artifact.path === "tests/config/services.test.ts" || generated && artifact.origin === "computed" && artifact.path !== "package.json") {
+				artifacts.push(artifact);
+				continue;
+			}
+			if (currentManifest !== void 0 && artifact.origin === "computed" && artifact.path === "package.json") {
+				const content = mergeServiceManifest(currentManifest, artifact.content, promoted.blueprint.services);
+				if (content !== currentManifest) artifacts.push({
+					...artifact,
+					content
+				});
+			}
+		}
+		return {
+			...promoted,
 			blueprint: {
-				...compiled.blueprint,
+				...promoted.blueprint,
 				overrides: []
 			},
-			artifacts: compiled.artifacts.filter((artifact) => artifact.origin === "host" || generated && artifact.origin === "computed" && artifact.path !== "package.json")
+			artifacts
 		};
+	}
+	/** Compile and audit the selected repair ownership boundary for one structural snapshot. */
+	#prepareRepair(spec, target, host, generated, json) {
+		const [compiled] = this.#compile(spec, json);
+		const scoped = this.#scopeRepair(compiled, target, generated);
 		let plan;
 		try {
 			plan = hydratePlan(scoped, host);
@@ -928,14 +1132,12 @@ var CLI = class {
 	}
 	/**
 	* The shared write-confirmation gate every verb calls before it touches disk.
-	* `--apply` writes without asking; `--json` (without `--apply`) is a pure
-	* dry-run and NEVER prompts; `--yes` auto-answers yes; otherwise a real
-	* confirm with `default: false` (EOF on stdin resolves to the default).
+	* `--apply` is the sole write authorization. JSON and non-terminal calls do
+	* not prompt once authorized; `--yes` skips the terminal confirmation.
 	*/
 	async #apply(terminal, message, values, json) {
-		if (values.apply) return true;
-		if (json) return false;
-		if (values.yes) return true;
+		if (!values.apply) return false;
+		if (json || values.yes || !this.#tty) return true;
 		return this.#guard(terminal.confirm({
 			message,
 			default: false
@@ -943,18 +1145,16 @@ var CLI = class {
 	}
 	/**
 	* The SECOND, separate confirm for `--prune`-eligible deletions — never
-	* bundled into `resolveApply`'s question. `--yes` only auto-answers this
-	* when `--prune` was also passed (it never enables pruning by itself).
+	* bundled into the write question. Both `--prune` and `--apply` are required;
+	* `--yes` only skips this confirmation and never authorizes deletion.
 	*/
 	async #prune(terminal, message, values, json) {
 		if (!values.prune) return false;
-		if (values.apply) return true;
-		if (json) return false;
-		if (values.yes) return true;
-		if (!this.#tty) {
-			this.#reporter.line(PRUNE_SKIPPED);
+		if (!values.apply) {
+			if (!json && !this.#tty) this.#reporter.line(PRUNE_SKIPPED);
 			return false;
 		}
+		if (json || values.yes || !this.#tty) return true;
 		return this.#guard(terminal.confirm({
 			message,
 			default: false
@@ -983,13 +1183,13 @@ var CLI = class {
 	* Best-effort vendored `@orkestrel` catalog names, resolved via `host`
 	* (`hostRoot()`, or the active `--from` override) through the host manifest
 	* — `undefined` when the catalog cannot be established (a missing/unreadable
-	* manifest, no `.claude/agents/orkestrel.md` entry, or any other failure),
+	* manifest, no `CATALOG_AGENT_PATH` entry, or any other failure),
 	* degrading the dependency prompt to shape-only validation instead of blocking on it.
 	*/
 	#names(host) {
 		const names = attempt(() => {
 			const manifest = readHostManifest(host);
-			const full = locateHostSource(manifest, ".claude/agents/orkestrel.md", host);
+			const full = locateHostSource(manifest, CATALOG_AGENT_PATH, host);
 			if (full === void 0 || !existsSync(full)) return void 0;
 			const relative$1 = relative(host, full).replaceAll("\\", "/");
 			return catalogNames(readFileText(host, relative$1, "TARGET", "host"));
@@ -1086,10 +1286,11 @@ var CLI = class {
 			dependencies: deps
 		}), json);
 		const summary = planToSummary(plan);
+		const label = describeDestination(process.cwd(), destination);
 		if (!json) {
 			this.#reporter.section("Plan");
 			this.#reporter.table(newPlanTable(summary));
-			this.#reporter.line(newPlanPreview(name));
+			this.#reporter.line(newPlanPreview(label));
 		}
 		if (!await this.#apply(terminal, applyConfirmMessage(summary.host + summary.template + summary.computed), values, json)) {
 			if (json) this.#write(summaryToNewResult(summary, false));
@@ -1105,7 +1306,7 @@ var CLI = class {
 			const result = materializer.materialize(plan, destination);
 			const count = result.written.length + result.copied.length;
 			if (json) this.#write(summaryToNewResult(summary, true));
-			else this.#succeed(spinner, json, newApplySuccess(count, name));
+			else this.#succeed(spinner, json, newApplySuccess(count, label));
 		} catch (error) {
 			this.#reject(spinner, json, error);
 		} finally {
@@ -1173,7 +1374,7 @@ var CLI = class {
 				this.#reject(spinner, json, error);
 			}
 		} else if (json) this.#write(report);
-		process.exitCode = report.clean ? 0 : proceed ? 0 : 1;
+		process.exitCode = report.failed > 0 ? 1 : report.clean || proceed ? 0 : 1;
 	}
 	/** `scaffold audit` — whole-plan conformance report; offers a repair handoff on drift. */
 	async #audit(values, json) {
@@ -1200,7 +1401,7 @@ var CLI = class {
 		const host = values.from?.[0] ?? hostRoot();
 		let plan;
 		try {
-			plan = hydratePlan(compiled, host);
+			plan = hydratePlan(this.#promoteServices(compiled, target), host);
 		} catch (error) {
 			this.#error(error, json);
 		}
@@ -1209,7 +1410,7 @@ var CLI = class {
 			...diffPlan(plan, readTarget(target, artifactPaths)),
 			questions
 		};
-		const scanned = this.#scanSafe(rawAudit, target, host, spec.service);
+		const scanned = this.#scanSafe(rawAudit, target, host, spec.services);
 		const audit = scanned.audit;
 		let drifted = !audit.clean;
 		let live;
@@ -1243,19 +1444,22 @@ var CLI = class {
 		}
 		if (scanned.skipped) this.#reporter.line(SCAN_SKIPPED);
 		for (const question of audit.questions) if (!question.blocking) this.#reporter.line(`warning: ${question.text}`);
-		this.#reporter.line(comparisonLine(true));
+		const hostArtifacts = plan.artifacts.filter((artifact) => artifact.origin === "host");
+		const presenceOwned = hostArtifacts.filter((artifact) => artifact.hex === void 0).length;
+		this.#reporter.line(comparisonLine(hostArtifacts.length - presenceOwned, presenceOwned));
 		this.#reporter.table(auditTable(audit, plan));
 		this.#reporter.line(auditVerdict(audit, plan));
 		if (live !== void 0) this.#reporter.line(auditLiveNote(live.current, live.behind, live.failed));
 		if (!audit.clean) {
 			const split = partitionFindings(audit.findings, plan);
-			const ownedCount = split.owned.drifted + split.owned.missing;
+			const replace = values.replace === true;
+			const ownedCount = split.owned.missing + (replace ? split.owned.drifted : 0);
 			const pruneRequested = values.prune === true;
 			const offerHandoff = this.#tty && (ownedCount > 0 || audit.foreign > 0 && pruneRequested);
 			let handoffAccepted = false;
 			if (offerHandoff) {
 				const terminal = createTerminal();
-				const message = repairHandoff(ownedCount, audit.foreign, pruneRequested);
+				const message = repairHandoff(split.owned.missing, replace ? split.owned.drifted : 0, audit.foreign, pruneRequested);
 				handoffAccepted = await this.#guard(terminal.confirm({
 					message,
 					default: false
@@ -1263,12 +1467,13 @@ var CLI = class {
 				if (handoffAccepted) {
 					await this.#repair(values, false);
 					const rawFinal = diffPlan(plan, readTarget(target, artifactPaths));
-					const finalScanned = this.#scanSafe(rawFinal, target, host, spec.service);
+					const finalScanned = this.#scanSafe(rawFinal, target, host, spec.services);
 					process.exitCode = finalScanned.audit.clean ? 0 : 1;
 					return;
 				}
 			}
 			if (!handoffAccepted) {
+				if (split.owned.drifted > 0 && !replace) this.#reporter.line(replacementNote(split.owned.drifted));
 				if (audit.foreign > 0 && !pruneRequested) this.#reporter.line(FOREIGN_HINT);
 				for (const note of renderComputedNotes(audit.findings, plan)) this.#reporter.line(note);
 			}
@@ -1285,39 +1490,56 @@ var CLI = class {
 			this.#error(error, json);
 		}
 		const generated = values.generated === true;
+		const replace = values.replace === true;
 		const host = values.from?.[0] ?? hostRoot();
 		const prepared = this.#prepareRepair(spec, target, host, generated, json);
-		const compiled = prepared[0];
+		let compiled = prepared[0];
 		let plan = prepared[1];
 		let audit = prepared[2];
+		let outcome = repairAuditOf(this.#scanSafe(audit, target, host, spec.services).audit, this.#outside(compiled, plan, target, host));
+		const verdict = {
+			generated,
+			replace,
+			apply: values.apply === true
+		};
 		if (!json) {
-			this.#reporter.line(generated ? REPAIR_GENERATED_SCOPE : REPAIR_SCOPE);
+			if (!outcome.clean) this.#reporter.line(scopeLine("repair", generated));
 			this.#reporter.section("Audit");
-			this.#reporter.table(auditTable(audit, plan));
+			this.#reporter.table(auditTable(outcome, plan));
 		}
-		const prunePaths = values.prune ? this.#prunePaths(target, host, spec.service) : [];
+		const prunePaths = values.prune ? this.#prunePaths(target, host, spec.services) : [];
 		const pruneSnapshot = readTarget(target, prunePaths);
-		if (audit.clean && prunePaths.length === 0) {
-			if (json) this.#write(audit);
-			else {
-				this.#reporter.line(repairVerdict(audit, generated));
-				const note = scopeNote(this.#outside(compiled, target), generated);
-				if (note !== void 0) this.#reporter.line(note);
-			}
-			process.exitCode = 0;
+		if (outcome.clean && prunePaths.length === 0) {
+			if (!json) this.#reporter.line(repairVerdict(outcome, verdict));
+			this.#emitRepair(outcome, generated, json);
+			process.exitCode = hasFindings(outcome, outcome.outside) ? 1 : 0;
+			return;
+		}
+		if (!json) this.#reporter.line(repairVerdict(outcome, verdict));
+		const repairable = countWrites([audit], replace);
+		if (repairable === 0 && prunePaths.length === 0) {
+			if (!json) this.#reporter.line(repairTally({
+				written: 0,
+				unchanged: audit.findings.length - audit.drifted - audit.missing - audit.foreign,
+				drifted: audit.drifted,
+				removed: 0
+			}));
+			this.#emitRepair(outcome, generated, json);
+			process.exitCode = 1;
 			return;
 		}
-		if (!json) this.#reporter.line(repairVerdict(audit, generated));
 		const terminal = createTerminal();
 		let proceed = true;
-		if (!audit.clean) proceed = await this.#apply(terminal, applyConfirmMessage(audit.drifted + audit.missing + audit.foreign), values, json);
+		if (!audit.clean) proceed = await this.#apply(terminal, applyConfirmMessage(repairable), values, json);
 		if (!proceed) {
-			if (json) this.#write(audit);
+			this.#emitRepair(outcome, generated, json);
 			process.exitCode = 1;
 			return;
 		}
-		if (values.prune && !json) if (prunePaths.length === 0) this.#reporter.line(PRUNE_EMPTY);
-		else for (const line of prunePreview(prunePaths)) this.#reporter.line(line);
+		if (values.prune && !json) {
+			if (prunePaths.length === 0) this.#reporter.line(PRUNE_EMPTY);
+			else for (const line of prunePreview(prunePaths)) this.#reporter.line(line);
+		}
 		const doPrune = prunePaths.length > 0 && await this.#prune(terminal, pruneConfirmMessage(prunePaths.length), values, json);
 		let currentGlobal;
 		try {
@@ -1331,31 +1553,41 @@ var CLI = class {
 				global: currentGlobal
 			};
 			const refreshed = this.#prepareRepair(spec, target, host, generated, json);
+			compiled = refreshed[0];
 			plan = refreshed[1];
 			audit = refreshed[2];
+			outcome = repairAuditOf(this.#scanSafe(audit, target, host, spec.services).audit, this.#outside(compiled, plan, target, host));
 		}
 		const spinner = this.#spinner("repairing", json);
 		spinner?.start();
 		const materializer = createMaterializer({ host });
 		try {
-			const result = materializer.repair(plan, audit, target);
+			const result = materializer.repair(plan, audit, target, replace);
 			const removed = doPrune ? materializer.prune(target, pruneSnapshot).removed : [];
-			if (json) this.#write(auditToRepairResult(audit, {
+			const finalAudit = repairAuditOf(this.#scanSafe(diffPlan(plan, readTarget(target, plan.artifacts.map((artifact) => artifact.path))), target, host, spec.services).audit, outcome.outside);
+			const left = replace ? 0 : audit.drifted;
+			if (!json) this.#succeed(spinner, json, repairTally({
+				written: result.written.length + result.copied.length,
+				unchanged: result.skipped.length - left,
+				drifted: left,
+				removed: removed.length
+			}));
+			this.#emitRepair(finalAudit, generated, json, {
 				...result,
 				removed
-			}));
-			else this.#succeed(spinner, json, repairSuccess(result, removed));
+			});
+			process.exitCode = hasFindings(finalAudit, finalAudit.outside) ? 1 : 0;
 		} catch (error) {
 			this.#reject(spinner, json, error);
 		} finally {
 			materializer.destroy();
 		}
-		process.exitCode = 0;
 	}
 	/** `scaffold fleet` — audit/repair every `@orkestrel` package beneath the current directory's immediate children. */
 	async #fleet(values, json) {
 		const root = this.#contain(".", json);
 		const generated = values.generated === true;
+		const replace = values.replace === true;
 		const packages = discoverPackages(root);
 		if (packages.length === 0) this.#fail(`no @orkestrel packages under "${root}" — fleet scans the immediate children of the current directory; stand in the folder that contains your checkouts (cd ..), or use 'repair' to true up just this repo.`, json);
 		const host = values.from?.[0] ?? hostRoot();
@@ -1365,6 +1597,7 @@ var CLI = class {
 			const name = basename(directory);
 			try {
 				const compiler = createCompiler();
+				let compiled;
 				let scoped;
 				let questions;
 				try {
@@ -1374,14 +1607,8 @@ var CLI = class {
 						const message = scaffolding.questions.map((question) => question.text).join("; ");
 						throw new ScaffoldError("INVALID", message);
 					}
-					scoped = {
-						...scaffolding.plan,
-						blueprint: {
-							...scaffolding.plan.blueprint,
-							overrides: []
-						},
-						artifacts: scaffolding.plan.artifacts.filter((artifact) => artifact.origin === "host" || generated && artifact.origin === "computed" && artifact.path !== "package.json")
-					};
+					compiled = scaffolding.plan;
+					scoped = this.#scopeRepair(compiled, directory, generated);
 					questions = scaffolding.questions;
 				} finally {
 					compiler.destroy();
@@ -1392,12 +1619,15 @@ var CLI = class {
 					...diffPlan(plan, readTarget(directory, paths)),
 					questions
 				};
-				const audit = this.#scan(rawAudit, directory, host, plan.blueprint.service);
+				const audit = this.#scan(rawAudit, directory, host, plan.blueprint.services);
+				const outside = this.#outside(compiled, plan, directory, host);
 				repos.push({
 					name,
 					directory,
 					plan,
-					audit
+					rawAudit,
+					audit,
+					outside
 				});
 			} catch (error) {
 				failures.push({
@@ -1415,6 +1645,8 @@ var CLI = class {
 					foreign: repo.audit.foreign
 				}));
 				for (const question of repo.audit.questions) if (!question.blocking) this.#reporter.line(`${repo.name}: warning: ${question.text}`);
+				const note = scopeNote(repo.outside, generated);
+				if (note !== void 0) this.#reporter.line(`${repo.name}: ${note}`);
 			}
 			for (const failure of failures) this.#reporter.line(fleetRepoLine(failure.name, {
 				state: "failed",
@@ -1422,45 +1654,49 @@ var CLI = class {
 			}));
 		}
 		const dirty = repos.filter((repo) => !repo.audit.clean);
+		const reportedDirty = repos.filter((repo) => hasFindings(repo.audit, repo.outside));
 		if (dirty.length === 0) {
-			if (json) this.#write([...repos.map((repo) => fleetEntryOf(repo.name, repo.audit, false)), ...failures.map((failure) => fleetEntryOf(failure.name, void 0, true))]);
-			else this.#reporter.line(fleetTotals(0, failures.length));
-			process.exitCode = failures.length > 0 ? 1 : 0;
+			if (json) this.#write([...repos.map((repo) => fleetEntryOf(repo.name, repo.audit, false, repo.outside)), ...failures.map((failure) => fleetEntryOf(failure.name, void 0, true))]);
+			else this.#reporter.line(fleetTotals(reportedDirty.length, failures.length));
+			process.exitCode = reportedDirty.length > 0 || failures.length > 0 ? 1 : 0;
 			return;
 		}
-		const fileCount = dirty.reduce((total, repo) => total + repo.audit.drifted + repo.audit.missing + repo.audit.foreign, 0);
+		const fileCount = countWrites(dirty.map((repo) => repo.audit), replace);
+		if (!json && values.apply === true) this.#reporter.line(scopeLine("fleet", generated, dirty.length));
 		const terminal = createTerminal();
 		const proceed = await this.#apply(terminal, applyConfirmMessage(fileCount, dirty.length), values, json);
 		const pruneSets = proceed && values.prune ? new Map(dirty.map((repo) => {
-			const paths = this.#prunePaths(repo.directory, host, repo.plan.blueprint.service);
+			const paths = this.#prunePaths(repo.directory, host, repo.plan.blueprint.services);
 			return [repo.name, readTarget(repo.directory, paths)];
 		})) : /* @__PURE__ */ new Map();
 		const prunePaths = dirty.flatMap((repo) => Object.keys(pruneSets.get(repo.name) ?? {}).map((path) => `${repo.name}/${path}`));
-		if (proceed && values.prune && !json) if (prunePaths.length === 0) this.#reporter.line(PRUNE_EMPTY);
-		else for (const line of prunePreview(prunePaths)) this.#reporter.line(line);
+		if (proceed && values.prune && !json) {
+			if (prunePaths.length === 0) this.#reporter.line(PRUNE_EMPTY);
+			else for (const line of prunePreview(prunePaths)) this.#reporter.line(line);
+		}
 		const doPrune = proceed && prunePaths.length > 0 && await this.#prune(terminal, pruneConfirmMessage(prunePaths.length), values, json);
 		if (!proceed) {
-			if (json) this.#write([...repos.map((repo) => fleetEntryOf(repo.name, repo.audit, false)), ...failures.map((failure) => fleetEntryOf(failure.name, void 0, true))]);
-			else this.#reporter.line(fleetTotals(dirty.length, failures.length));
+			if (json) this.#write([...repos.map((repo) => fleetEntryOf(repo.name, repo.audit, false, repo.outside)), ...failures.map((failure) => fleetEntryOf(failure.name, void 0, true))]);
+			else this.#reporter.line(fleetTotals(reportedDirty.length, failures.length));
 			process.exitCode = 1;
 			return;
 		}
 		const materializer = createMaterializer({ host });
-		let drifted = 0;
+		let drifted = repos.filter((repo) => repo.audit.clean && repo.outside > 0).length;
 		let failedCount = failures.length;
-		const entries = repos.filter((repo) => repo.audit.clean).map((repo) => fleetEntryOf(repo.name, repo.audit, false));
+		const entries = repos.filter((repo) => repo.audit.clean).map((repo) => fleetEntryOf(repo.name, repo.audit, false, repo.outside));
 		try {
 			for (const repo of dirty) try {
-				materializer.repair(repo.plan, repo.audit, repo.directory);
+				materializer.repair(repo.plan, repo.rawAudit, repo.directory, replace);
 				if (doPrune) materializer.prune(repo.directory, pruneSets.get(repo.name) ?? {});
 				const paths = repo.plan.artifacts.map((artifact) => artifact.path);
 				const rawFinal = diffPlan(repo.plan, readTarget(repo.directory, paths));
-				const finalAudit = this.#scan(rawFinal, repo.directory, host, repo.plan.blueprint.service);
-				if (!finalAudit.clean) drifted += 1;
-				entries.push(fleetEntryOf(repo.name, finalAudit, false));
+				const finalAudit = this.#scan(rawFinal, repo.directory, host, repo.plan.blueprint.services);
+				if (hasFindings(finalAudit, repo.outside)) drifted += 1;
+				entries.push(fleetEntryOf(repo.name, finalAudit, false, repo.outside));
 				if (!json) this.#reporter.line(fleetRepoLine(repo.name, {
 					state: "repaired",
-					remaining: finalAudit.drifted + finalAudit.missing + finalAudit.foreign
+					remaining: finalAudit.drifted + finalAudit.missing + finalAudit.foreign + repo.outside
 				}));
 			} catch (error) {
 				failedCount += 1;
@@ -1637,6 +1873,7 @@ var CLI = class {
 		if (!isVerb(command)) this.#usage(didYouMean(command), json);
 		if (command !== "catalog" && values.from !== void 0 && values.from.length > 1) this.#usage(`--from may be provided only once for '${command}'`, json);
 		if (command === "mirror" && values.deps !== void 0) this.#usage("--deps is not supported for 'mirror'; use 'pull --deps'", json);
+		if (command === "fleet" && values.target !== void 0) this.#usage("--target is not supported for 'fleet'; change into the fleet root", json);
 		if (values.help) {
 			process.stdout.write(`${verbHelp(command)}\n`);
 			process.exitCode = 0;