@skaile/workspaces 6.0.0 → 6.2.0

package/dist/{chunk-OAHVKSQJ.js → chunk-PKBLJI23.js}

@@ -1,22 +1,23 @@
-import { unregisteredLibraryNames, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, missingRootAssets, storeManifestFile, missingLibraryDirMessage, filesEntryPaths } from './chunk-UL22SDGR.js';
-import { SEMVER_RE, invalidSemverMessage, flowFileNameError, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-QOM5Z62G.js';
-import { parseFlowDefinition } from './chunk-X3RMRJNR.js';
-import { installTargetOf, readKeptLegacyCopies, writeKeptLegacyCopies, canonicalEntryRef, diffDeployedAgent, deployedAssetDrift, assertNoLibrarySymlinks, deployAll, removeAsset, createScaffold, installAgent } from './chunk-3JKGY2YC.js';
+import { unregisteredLibraryNames, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, missingRootAssets, storeManifestFile, missingLibraryDirMessage, lastLibraryName, filesEntryPaths } from './chunk-6CYKTHNT.js';
+import { SEMVER_RE, invalidSemverMessage, flowFileNameError, computeDeterministicHash, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-MAZ3UXJK.js';
+import { parseFlowDefinition } from './chunk-JRN5QF4C.js';
+import { installTargetOf, readKeptLegacyCopies, writeKeptLegacyCopies, canonicalEntryRef, diffDeployedAgent, deployedAssetDrift, assertNoLibrarySymlinks, deployAll, removeAsset, composedDriftRefs, sourceComposedFiles, cachedComposedFiles, createScaffold, installAgent } from './chunk-S2H3RBK7.js';
 import { appendHistory, getRecentHistory, clearHistory } from './chunk-KTBKW2FI.js';
 import { commitChanges } from './chunk-UQ6LFBPZ.js';
-import { harnessTargetSupportsAgents, CODEX_IDENTITY_DIR } from './chunk-DUMTLYSO.js';
-import { isScaffoldBody, isScaffoldDescription } from './chunk-E572OHGY.js';
-import { resolveConfiguredHarnessName, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, writeLock, computeHash, buildLockFile, readLock, assertLockHashes, verifyLock, mergeLockFile, resyncLockSources, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-L4YKW5AY.js';
-import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-OTIB4D2K.js';
+import { harnessTargetSupportsAgents, CODEX_IDENTITY_DIR, agentRenderFiles } from './chunk-COAFAYBS.js';
+import { isScaffoldBody, isScaffoldDescription } from './chunk-76FLBODK.js';
+import { resolveConfiguredHarnessName, FACTORY_SOURCE_URL, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, writeLock, computeHash, buildLockFile, readLock, assertLockHashes, verifyLock, mergeLockFile, resyncLockSources, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-BRK5QZKI.js';
+import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-QPWR3YMY.js';
 import { deployedBase, isDeployed, deployedPaths, deployedDir } from './chunk-5KRMNUL4.js';
-import { resolveSkWorkspaceConfig, effectiveAgentInstances, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, resolveAll, agentSourceCacheDir, ensureRepo, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAgentDefinitionDir, resolveAsset, MAX_PRESET_DEPTH, PresetDepthError, DEFAULT_AGENT_INSTANCE_ID } from './chunk-OHNKYHRR.js';
+import { resolveSkWorkspaceConfig, effectiveAgentInstances, mcpDeclarationFromMdContent, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, findWorkspaceRoot, resolveAll, agentSourceCacheDir, ensureRepo, resolveAgentDefinitionDir, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, MAX_PRESET_DEPTH, PresetDepthError, DEFAULT_AGENT_INSTANCE_ID } from './chunk-KJSC2ZD6.js';
 import { globalSkaileDir, globalCacheRoot, migrateLegacyDir } from './chunk-L5VSIPQD.js';
 import { HARNESS_TARGETS, SUPPORTED_HARNESSES } from './chunk-VTETQCR6.js';
-import { loadSkPublishManifest, listAssetFiles, isNonAssetDir, isNonAssetFile } from './chunk-UQ33Y4DM.js';
-import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirements, readAssetBody } from './chunk-GOCWM7FN.js';
-import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-WDXZA7QW.js';
+import { listAssetFiles, loadSkPublishManifest, decodeSkaileManifest, isNonAssetDir, isNonAssetFile } from './chunk-KPKGWXUJ.js';
+import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirements, readAssetBody } from './chunk-JMIKGAUA.js';
+import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-IZQOO6MN.js';
 import { spawnSync } from 'child_process';
-import { existsSync, rmSync, readFileSync, readdirSync, lstatSync, writeFileSync, unlinkSync, mkdirSync } from 'fs';
+import { existsSync, rmSync, readFileSync, writeFileSync, readdirSync, lstatSync, statSync, unlinkSync, mkdirSync } from 'fs';
+import { homedir } from 'os';
 import path, { resolve, dirname, sep, join, relative, posix } from 'path';
 import { gt } from 'semver';
 import { parse, stringify } from 'yaml';
@@ -595,6 +596,14 @@ function requiredFieldsAdvice(id, keys) {
   const setting = keys.map((k) => `${k}: env:${k}`).join(", ");
   return `needs ${keys.join(", ")} (required): set it with an mcp_servers entry (id: ${id}, env: ${setting}) in skaile.yaml and export the variable, then run skaile install`;
 }
+function mcpNotRunnableReason(mdContent, name) {
+  try {
+    const decl = mcpDeclarationFromMdContent(mdContent, name);
+    return decl ? skipReason(decl) : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function mcpConfigFileOf(harnessTarget) {
   return TARGET_MCP_CONFIG[harnessTarget];
 }
@@ -616,6 +625,38 @@ async function mcpRenderedFootprint(projectDir, harnessTarget, name) {
     ...dir && hasPayload ? { payloadDir: `${path.relative(projectDir, dir).split(path.sep).join("/")}/` } : {}
   };
 }
+async function mcpCommittedRenderIntact(projectDir, harnessTarget, name) {
+  const relConfig = TARGET_MCP_CONFIG[harnessTarget];
+  if (!relConfig) return false;
+  if ((await readNotedSkips(projectDir, harnessTarget))[name] !== void 0) return true;
+  let ledger;
+  let servers;
+  try {
+    ledger = await readManaged(projectDir, harnessTarget);
+    const file = await readJsonStrict(path.join(projectDir, relConfig));
+    servers = file?.mcpServers ?? {};
+  } catch {
+    return false;
+  }
+  if (!Object.hasOwn(servers, name)) return false;
+  const entry = servers[name];
+  const recorded = ledger.ids.includes(name) ? ledger.rendered[name] : void 0;
+  if (recorded !== void 0 && entryHash(entry) !== recorded) return false;
+  const e = entry ?? {};
+  const strings = [e.command, ...Array.isArray(e.args) ? e.args : []].filter(
+    (v) => typeof v === "string"
+  );
+  for (const v of strings) {
+    const at = v.indexOf(".skaile/assets/");
+    if (at < 0) continue;
+    try {
+      await fs.stat(path.join(projectDir, v.slice(at)));
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
 async function renderMcpServerConfig(projectDir, harnessTarget, opts) {
   const warn = opts?.warn ?? ((m) => console.warn(`skaile: ${m}`));
   const relConfig = TARGET_MCP_CONFIG[harnessTarget];
@@ -839,6 +880,16 @@ function libraryDiskHashes(libPath, cache, registry) {
   }
   return hashes;
 }
+function repoManifestVersion(repoDir) {
+  try {
+    const { manifest } = decodeSkaileManifest(
+      readFileSync(join(repoDir, "skaile.manifest.yaml"), "utf8")
+    );
+    return manifest.version || void 0;
+  } catch {
+    return void 0;
+  }
+}
 function manifestFileHasAssetsArray(libPath) {
   try {
     const doc = parse(readFileSync(join(libPath, "skaile.manifest.yaml"), "utf8"));
@@ -847,6 +898,14 @@ function manifestFileHasAssetsArray(libPath) {
     return false;
   }
 }
+var libraryAssetCheck;
+function setLibraryAssetCheck(check) {
+  libraryAssetCheck = check;
+}
+var renamedEntryLookup;
+function setRenamedEntryLookup(lookup) {
+  renamedEntryLookup = lookup;
+}
 function isUnlistedLibraryAsset(entry, libPath) {
   const manifest = loadSkPublishManifest(libPath);
   const listed = manifest?.assets ?? [];
@@ -1045,6 +1104,13 @@ function parseCanonicalLockKey(key) {
     };
   }
 }
+function labelDiffHeaders(diff, from, to) {
+  const stamp = "\\t(?:\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)? [+-]\\d{4}|[A-Z][a-z]{2} [A-Z][a-z]{2} [ \\d]\\d \\d{2}:\\d{2}:\\d{2} \\d{4})";
+  return diff.replace(
+    new RegExp(`^(---|\\+\\+\\+) (.*?)${stamp}$`, "gm"),
+    (_m, mark, file) => `${mark} ${file} (${mark === "---" ? from : to})`
+  );
+}
 function softDepName(ref) {
   const at = ref.lastIndexOf("@");
   const base = at > 0 ? ref.slice(0, at) : ref;
@@ -1117,7 +1183,9 @@ function relockedRefs(prev, next) {
     e.library?.version ?? "",
     e.library && !e.library.installed ? e.library.name : "",
     e.library?.sha256 ?? e.sha256,
-    key.includes("#0.0.0-sha.") ? "" : e.source?.commit ?? ""
+    key.includes("#0.0.0-sha.") ? "" : e.source?.commit ?? "",
+    // The `../` compose folders are part of the lock: `update` moving them is a re-lock.
+    (e.composed ?? []).map((f) => `${f.path}:${f.sha256}`).join("\n")
   ].join("\0");
   const out = [];
   for (const [key, entry] of Object.entries(next.assets)) {
@@ -1133,6 +1201,9 @@ function relockedRefs(prev, next) {
   }
   return out;
 }
+function planPaths(folders, renders, files) {
+  return renders.length > 0 ? { folders: [], files: [], renders } : { folders, files, renders: [] };
+}
 function libraryMoves(prev, next) {
   if (!prev) return [];
   const out = [];
@@ -1152,9 +1223,13 @@ function libraryMoves(prev, next) {
   }
   return out;
 }
+function unregisteredLibraryName(origin) {
+  return lastLibraryName(origin.name) ?? origin.name;
+}
 function unregisteredLibraryFix(origin, ref) {
-  const register = origin.url ? `\`skaile library init ${origin.name} --git ${origin.url}\` (no registered library has the remote ${origin.url} either)` : `\`skaile library init ${origin.name} --path <dir>\``;
-  return `register library "${origin.name}" again with ${register}, or drop the dependency with \`skaile remove ${ref}\``;
+  const name = unregisteredLibraryName(origin);
+  const register = origin.url ? `\`skaile library init ${name} --git ${origin.url}\` (no registered library has the remote ${origin.url} either)` : `\`skaile library init ${name} --path <dir>\``;
+  return `register library "${name}" again with ${register}, or drop the dependency with \`skaile remove ${ref}\``;
 }
 function declaredNoHolderReason(ref) {
   return `is declared but no library or source holds it \u2014 register the library that holds it with \`skaile library init <name> --path <dir>\`, or drop it with \`skaile remove ${ref.split("#")[0]}\``;
@@ -1180,7 +1255,7 @@ function libraryCollisionSummary(all) {
   return `${all.length} assets exist in several libraries (${libraries.join(", ")}); using ${usedText.join(", ")}. Highest version wins; an equal version goes to the default library, then by name. ` + (differing.length > 0 ? `Same version, different bytes for: ${differing.join(", ")}. ` : "") + "Pin a version (<ref>#<version>) to choose another; `--verbose` lists each asset.";
 }
 function lockedLibraryProblem(lookup, origin, ref) {
-  return lookup.state === "dir-missing" ? missingLibraryDirMessage({ name: origin.name, path: lookup.path }) : `library "${origin.name}" is not registered \u2014 renamed or removed? ${unregisteredLibraryFix(origin, ref)}`;
+  return lookup.state === "dir-missing" ? missingLibraryDirMessage({ name: origin.name, path: lookup.path }) : `library "${unregisteredLibraryName(origin)}" is not registered \u2014 renamed or removed? ${unregisteredLibraryFix(origin, ref)}`;
 }
 function gapIdentity(ref) {
   const p = parseRefTolerant(ref);
@@ -1242,7 +1317,6 @@ function isSymlink(p) {
     return false;
   }
 }
-var FACTORY_SOURCE_URL = "https://github.com/skaile-ai/ai-assets";
 function resolveFactoryAssetsDir() {
   for (const dir of factoryAssetRoots()) {
     if (existsSync(join(dir, "skaile.manifest.yaml"))) return dir;
@@ -1429,6 +1503,43 @@ var AssetManager = class {
       return !recorded || recorded.includes(target);
     });
   }
+  /**
+   * A 5.12.0 global record has no `global_asset_harnesses:` key, yet `add --global --harness`
+   * wrote one copy only. On the first global `install`, an entry with exactly one existing copy
+   * among several default harnesses is that harness's subset (OQ6): record it, so the install
+   * does not fan the asset out to harnesses the user never asked for (p1442). A copy under the
+   * 5.12.0 omp folder (`~/.omp/skills`) counts as an omp copy. Nothing is inferred once the key
+   * exists (an entry without a row then means "every harness"), with one default harness, or
+   * with no copy yet. Global mode only; returns the rows written.
+   */
+  inferLegacyHarnessSubsets(entries) {
+    if (!this.global) return [];
+    const configPath = join(this.stateRoot, "skaile.yaml");
+    if (!existsSync(configPath)) return [];
+    let raw;
+    try {
+      raw = parse(readFileSync(configPath, "utf8"));
+    } catch {
+      return [];
+    }
+    if (!raw || typeof raw !== "object" || ENTRY_HARNESSES_KEY in raw) return [];
+    const all = this.defaultGlobalHarnesses();
+    if (all.length < 2) return [];
+    const rows = [];
+    for (const e of entries) {
+      const component = this.installTarget(e.kind);
+      if (!component || !e.name) continue;
+      const holding = all.filter(
+        (h) => isDeployed(component, e.name, h, true) || h === "omp" && legacyOmpPaths(component, e.name).length > 0
+      );
+      if (holding.length !== 1) continue;
+      const publisher = e.publisher?.replace(/^@/, "");
+      const ref = `${e.kind}:${publisher ? `@${publisher}/` : ""}${e.name}`;
+      if (this.setEntryHarnessRow(raw, ref, holding)) rows.push({ ref, harnesses: holding });
+    }
+    if (rows.length > 0) writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
+    return rows;
+  }
   /**
    * Set (or, with `harnesses` undefined, clear) the harness row of `ref` in the parsed
    * `~/.skaile/skaile.yaml` `raw`. Returns whether `raw` changed.
@@ -1456,6 +1567,78 @@ var AssetManager = class {
     else raw[ENTRY_HARNESSES_KEY] = rows;
     return true;
   }
+  /** The harness row of `kind:name` (publisher must agree when both sides have one) in the parsed `raw`. */
+  harnessRowIn(raw, id) {
+    const wantPub = id.publisher?.replace(/^@/, "");
+    for (const [key, harnesses] of Object.entries(decodeEntryHarnesses(raw[ENTRY_HARNESSES_KEY]))) {
+      const other = parseAssetRefLoose(key);
+      if (!other || other.kind !== id.kind || other.name !== id.name) continue;
+      const havePub = other.publisher?.replace(/^@/, "");
+      if (wantPub === void 0 || havePub === void 0 || havePub === wantPub) return harnesses;
+    }
+    return void 0;
+  }
+  /**
+   * The harness row `add --global --harness <requested>` leaves for `ref`: the recorded set plus
+   * `requested`. An asset declared with no row goes to every global harness, so its set is that
+   * default; `undefined` (no row) when `requested` is already part of it. A new asset gets
+   * `requested` alone.
+   */
+  widenedHarnessRow(raw, ref, requested, declared) {
+    const id = parseAssetRefLoose(ref);
+    if (!id) return [...requested];
+    const recorded = this.harnessRowIn(raw, id);
+    if (!recorded && !declared) return [...requested];
+    const current = recorded ?? this.defaultGlobalHarnesses();
+    const union = [.../* @__PURE__ */ new Set([...current, ...requested])];
+    if (!recorded && union.length === current.length) return void 0;
+    return union;
+  }
+  /**
+   * After `add --global --harness X`: widen the row of every other entry of the add that has one
+   * (a requirement declared on its own with `--harness`), so the copy now deployed into X stays
+   * managed. Entries with no row already go to every harness.
+   */
+  widenDependencyRows(entries, requested) {
+    const named = this.harnessesOverride;
+    if (!this.global || !named?.length) return;
+    const configPath = join(this.stateRoot, "skaile.yaml");
+    if (!existsSync(configPath)) return;
+    const raw = parse(readFileSync(configPath, "utf8")) ?? {};
+    let changed = false;
+    for (const e of entries) {
+      if (!e.name || e.kind === requested.kind && e.name === requested.name) continue;
+      const recorded = this.harnessRowIn(raw, e);
+      if (!recorded) continue;
+      const union = [.../* @__PURE__ */ new Set([...recorded, ...named])];
+      if (union.length === recorded.length) continue;
+      const publisher = e.publisher?.replace(/^@/, "");
+      const ref = `${e.kind}:${publisher ? `@${publisher}/` : ""}${e.name}`;
+      if (this.setEntryHarnessRow(raw, ref, union)) changed = true;
+    }
+    if (changed) writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
+  }
+  /**
+   * `add --global --harness X --only`: name each harness that leaves the asset's set but still
+   * holds a copy. The copy stays on disk; `remove --global --harness <h>` deletes it.
+   */
+  reportDroppedCopies(target, onDropped) {
+    const named = this.harnessesOverride;
+    const component = this.installTarget(target.kind);
+    const configPath = join(this.stateRoot, "skaile.yaml");
+    if (!named?.length || !component || !existsSync(configPath)) return;
+    const raw = parse(readFileSync(configPath, "utf8")) ?? {};
+    const publisher = target.publisher?.replace(/^@/, "");
+    const ref = `${target.kind}:${publisher ? `@${publisher}/` : ""}${target.name}`;
+    const declared = Array.isArray(raw.dependencies) && raw.dependencies.some((d) => this.sameDeclaredAsset(d, ref));
+    if (!declared) return;
+    const current = this.harnessRowIn(raw, target) ?? this.defaultGlobalHarnesses();
+    for (const h of current) {
+      if (named.includes(h) || !isDeployed(component, target.name, h, true)) continue;
+      const where = deployedPaths(component, target.name, h, true)[0];
+      onDropped(ref, h, where ?? deployedDir(component, target.name, h, true));
+    }
+  }
   /**
    * Delete the copies a 5.12.0 global install left in `~/.omp/skills`, `~/.omp/agents`,
    * `~/.omp/prompts` and `~/.omp/contracts` (omp reads `~/.omp/agent/<dir>`) for the assets just
@@ -1556,16 +1739,36 @@ var AssetManager = class {
   }
   /** Deploy options for one harness. In global mode, `harness` is the
    * fan-out target (not the constructor's `harness`, which is project-only). */
-  deployOptsFor(target, link, onSecretFile) {
+  deployOptsFor(target, link, onSecretFile, composed) {
+    const records = this.global ? void 0 : this.composedRecords();
     return {
       registry: this.registry,
       harness: target,
       global: this.global,
       cwd: this.projectDir,
       link: link === true,
-      ...onSecretFile ? { onSecretFile: (entry, p) => onSecretFile(canonicalEntryRef(entry), p) } : {}
+      ...onSecretFile ? { onSecretFile: (entry, p) => onSecretFile(canonicalEntryRef(entry), p) } : {},
+      ...records ? { lockedComposed: (agent) => records.get(agent) } : {},
+      ...composed ? {
+        refreshComposed: composed.refresh,
+        onComposedDrift: (entry, ref) => composed.onDrift(canonicalEntryRef(entry), ref)
+      } : {}
     };
   }
+  /** Agent name → the `../` compose folder files its lock entry records (`LockEntry.composed`). */
+  composedRecords() {
+    const out = /* @__PURE__ */ new Map();
+    for (const [key, entry] of Object.entries(this.tryReadLock()?.assets ?? {})) {
+      if (!entry.composed?.length) continue;
+      const { name } = parseCanonicalLockKey(key);
+      if (name) out.set(name, entry.composed);
+    }
+    return out;
+  }
+  /** `install`'s `Missing:` line for a `../` compose folder the library moved past the lock. */
+  composedDriftLine(agentRef, composeRef) {
+    return `${agentRef} (composes ${composeRef}: the library's copy changed since the lock; \`skaile update\` moves the lock to it)`;
+  }
   /**
    * Names of the `mcp-server` assets the lock holds (the declaration ids, unscoped); a missing
    * `.mcp.json` entry of one counts as drift even before skaile owned it.
@@ -1766,7 +1969,16 @@ var AssetManager = class {
     for (const [slug, decl] of Object.entries(repositories)) {
       const localPath = this.resolveRepoDir(decl, slug);
       if (!localPath || !existsSync(localPath)) continue;
-      const commit = getRepoCommit(localPath) ?? "0".repeat(40);
+      if (decl.url && normalizeRepoUrl(decl.url) !== normalizeRepoUrl(FACTORY_SOURCE_URL) && !existsSync(join(localPath, ".git"))) {
+        this.reportSourceError(
+          { localPath, sourceUrl: decl.url, commit: "" },
+          new Error(
+            `${decl.url}: its clone ${localPath} is not a git repository, so git pull fails - run \`skaile source sync\` to clone it again`
+          )
+        );
+        continue;
+      }
+      const commit = decl.factory ? "0".repeat(40) : getRepoCommit(localPath) ?? "0".repeat(40);
       clones.push({
         localPath,
         sourceUrl: decl.url ?? localPath,
@@ -2089,6 +2301,33 @@ var AssetManager = class {
     if (!scan) return [];
     return [...scan.byKey.values()].flat();
   }
+  /**
+   * The version `add` deploys for each asset of a source clone registered as a `reader`
+   * library, when its file declares none: the repo commit pseudo-version (p855). `search`
+   * reads this where no project is in scope, so it lists what `add` locks, not the index
+   * default.
+   *
+   * @returns `<library>\0<kind>:@<publisher>/<name>` -> version; only assets that declare none.
+   */
+  async sourceAssetVersions() {
+    const out = /* @__PURE__ */ new Map();
+    const scan = await this.scanLibraries();
+    if (!scan) return out;
+    const snap = await this.loadLibraryIndex();
+    for (const [key, candidates] of scan.byKey) {
+      for (const c of candidates) {
+        if (c.entry.version) continue;
+        const lib = snap?.libraries.find((l) => l.name === c.library);
+        if (lib?.ownership !== "reader" || !("url" in lib.backendConfig)) continue;
+        const manifestVersion = repoManifestVersion(lib.path);
+        const commit = getRepoCommit(lib.path);
+        if (manifestVersion) out.set(`${c.library}\0${key}`, manifestVersion);
+        else if (commit)
+          out.set(`${c.library}\0${key}`, `${PSEUDO_VERSION_PREFIX}${commit.slice(0, 7)}`);
+      }
+    }
+    return out;
+  }
   /**
    * Every origin that holds `ref` (`kind:@publisher/name`) with the version it holds, in
    * the order `add <ref>` prefers them, so the first row is the one `add` deploys: the
@@ -2598,7 +2837,14 @@ var AssetManager = class {
       if (!existsSync(indexPath)) return null;
       const index = new LocalIndex({ indexPath });
       try {
-        return { libraries: await index.listSources(), defs: await index.listAssetDefs() };
+        const libraries = await index.listSources();
+        const defs = await index.listAssetDefs();
+        const hidden = this.undeclaredSourceClones(libraries);
+        if (hidden.size === 0) return { libraries, defs };
+        return {
+          libraries: libraries.filter((l) => !hidden.has(l.id)),
+          defs: defs.filter((d) => !d.libraryId || !hidden.has(d.libraryId))
+        };
       } finally {
         index.close();
       }
@@ -2606,6 +2852,32 @@ var AssetManager = class {
       return null;
     }
   }
+  /**
+   * Ids of the registered libraries that are the clone of a source this project does not
+   * declare. `source add` registers the clone as a machine-wide reader library so `search`
+   * and the indexer can read it, but a `sources:` clone belongs to the projects that declare
+   * it (OQ12, p321): another project neither resolves it, nor ties with it by name, nor has
+   * `update` re-pin its locked assets to it. A reader library the user registered by hand
+   * (`library init --reader --git`) lives outside the sources cache and is never hidden.
+   */
+  undeclaredSourceClones(libraries) {
+    const hidden = /* @__PURE__ */ new Set();
+    if (!this.global && !findWorkspaceRoot(this.projectDir)) return hidden;
+    let declared;
+    try {
+      declared = new Set(this.loadConfig().sources.map((s) => sourceCacheKey(s.url)));
+    } catch {
+      return hidden;
+    }
+    const cloneRoots = [join(globalCacheRoot(), "sources"), this.reposDir].map((d) => resolve(d));
+    for (const l of libraries) {
+      if (l.ownership !== "reader" || !("url" in l.backendConfig)) continue;
+      const at = resolve(l.path);
+      if (!cloneRoots.some((root) => at.startsWith(root + sep))) continue;
+      if (!declared.has(sourceCacheKey(l.backendConfig.url))) hidden.add(l.id);
+    }
+    return hidden;
+  }
   /**
    * Library-origin lock entries for the assets {@link resolveLibraryEntries}
    * matched. The locked version is the one actually deployed: the on-disk
@@ -2749,14 +3021,19 @@ var AssetManager = class {
    * `install --locked`. An entry is restored only when its library is still
    * registered/on disk, still holds the asset, and still offers the locked
    * version; anything else is reported in `missing` with the reason.
+   *
+   * @param opts.storeFallback - `install --locked` only: an entry whose library is not registered
+   *   here is restored from a store that serves the locked sha256 (OQ15, p1490). Reads such as
+   *   the drift check never ask a store.
    */
-  async restoreLibraryLockEntries(lock) {
+  async restoreLibraryLockEntries(lock, opts) {
     const entries = [];
     const missing = [];
+    const viaStore = [];
     const locked = Object.entries(lock.assets).filter(
       ([, e]) => e.library !== void 0 && !e.library.installed
     );
-    if (locked.length === 0) return { entries, missing };
+    if (locked.length === 0) return { entries, missing, viaStore };
     const snap = await this.loadLibraryIndex();
     const diskHashes = /* @__PURE__ */ new Map();
     const fileSets = /* @__PURE__ */ new Map();
@@ -2769,6 +3046,12 @@ var AssetManager = class {
       }
       const lookup = this.lockedLibrary(origin, snap, { kind, publisher, name });
       if (lookup.state !== "ok") {
+        const fallback = lookup.state === "unregistered" && opts?.storeFallback ? await this.storeEntryForLockedLibraryAsset(publisher, kind, name, origin) : null;
+        if (fallback) {
+          entries.push(fallback);
+          viaStore.push(ref);
+          continue;
+        }
         missing.push(
           `${ref} (${lockedLibraryProblem(lookup, origin, `${kind}:@${publisher}/${name}`)})`
         );
@@ -2811,22 +3094,94 @@ var AssetManager = class {
       found.version = sameVersion ? origin.version : current;
       entries.push(withLibraryFiles(found, libPath, fileSets, this.registry));
     }
-    return { entries, missing };
+    return { entries, missing, viaStore };
+  }
+  /**
+   * Whether a library-origin lock entry was restored from its lock url: its library is not
+   * registered here, and the project's store cache holds the locked version (`install --locked`
+   * fetched and SHA-verified it there against the sha256 the lock recorded). Such an entry is
+   * as restorable as a source- or store-origin one: `check` and `doctor` read its requirements
+   * from the deployed copy and do not ask for the library (OQ8, p1655). An unregistered library
+   * that never restored anything here stays a gap.
+   */
+  async restoredFromLockUrl(key, entry, snap) {
+    const origin = entry.library;
+    if (!origin || origin.installed || !origin.sha256 || !origin.version) return false;
+    if (isPseudoVersion(origin.version)) return false;
+    const { publisher, kind, name } = parseCanonicalLockKey(key);
+    if (!publisher || !kind || !name) return false;
+    if (this.lockedLibrary(origin, snap, { kind, publisher, name }).state !== "unregistered") {
+      return false;
+    }
+    try {
+      return readdirSync(join(this.storeCacheDir, publisher, kind, name, origin.version)).length > 0;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * The store's copy of a library-origin lock entry whose library is not registered here: a
+   * store (project `stores:` or the global catalog) that serves `kind:@publisher/name#version`
+   * under the very sha256 the lock recorded holds the same bytes. The entry is fetched and
+   * verified like any store asset; the lock stays as it is. `null` when the lock has no hash,
+   * no store answers, or the hash differs (OQ15, p1490).
+   */
+  async storeEntryForLockedLibraryAsset(publisher, kind, name, origin) {
+    if (!origin.sha256 || !origin.version || isPseudoVersion(origin.version)) return null;
+    const { repositories, stores: projectStores } = this.loadConfig();
+    const stores = [...projectStores, ...await this.globalStoreFallback(projectStores)];
+    const fetcher = this.storeFetcherFor(stores);
+    if (!fetcher) return null;
+    for (const store of stores) {
+      try {
+        const m = await fetcher.getInstallManifest(
+          store.url,
+          `${kind}:@${publisher}/${name}#${origin.version}`
+        );
+        if (!m || m.sha256 !== origin.sha256) continue;
+        const [entry] = await this.buildCatalogEntries(
+          [
+            {
+              publisher,
+              kind,
+              name,
+              version: origin.version,
+              sourceUrl: m.sourceUrl,
+              commit: m.commit,
+              files: m.files,
+              sha256: m.sha256,
+              ...m.deps?.length ? { deps: m.deps, storeRequires: m.deps } : {}
+            }
+          ],
+          repositories
+        );
+        if (entry) return entry;
+      } catch (err) {
+        this.noteStoreFailure(store.url, err);
+      }
+    }
+    return null;
   }
   /**
    * Whether a deployed copy exists for the lock entries `install` kept for the unresolved
-   * `ref`. A kind with no install target has no deployed copy.
+   * `ref`. A kind with no install target has none, except an `mcp-server`: its copy is the
+   * `.mcp.json` entry skaile wrote and the payload that entry points into (p792).
    */
-  keptCopyDeployed(kept, ref) {
+  async keptCopyDeployed(kept, ref) {
     const want = parseRefTolerant(ref.split(" ")[0] ?? ref);
     if (!want) return false;
-    return Object.keys(kept.assets).some((key) => {
+    for (const key of Object.keys(kept.assets)) {
       const id = parseCanonicalLockKey(key);
-      if (id.kind !== want.kind || id.name !== want.name) return false;
-      if (want.publisher && id.publisher !== want.publisher) return false;
+      if (id.kind !== want.kind || id.name !== want.name) continue;
+      if (want.publisher && id.publisher !== want.publisher) continue;
       const component = this.installTarget(id.kind);
-      return component !== void 0 && isDeployed(component, id.name, this.harness, this.global, this.projectDir);
-    });
+      if (component !== void 0) {
+        if (isDeployed(component, id.name, this.harness, this.global, this.projectDir)) return true;
+      } else if (id.kind === "mcp-server" && !this.global && await mcpCommittedRenderIntact(this.projectDir, this.harness, id.name)) {
+        return true;
+      }
+    }
+    return false;
   }
   /** Whether the deployed copy of a library asset is on disk; a kind with no install target has none to check. */
   lockedCopyDeployed(kind, name) {
@@ -2949,6 +3304,24 @@ var AssetManager = class {
   lockedRefsNamed(kind, name) {
     return Object.keys(this.tryReadLock()?.assets ?? {}).map(parseCanonicalLockKey).filter((id) => id.kind === kind && id.name === name).map((id) => id.publisher ? `${kind}:@${id.publisher}/${name}` : `${kind}:${name}`);
   }
+  /**
+   * The library a library-origin lock entry of `kind` and `name` (and `publisher`, when given)
+   * resolves to on this machine, or `undefined` when the lock holds no such entry, it is not
+   * from a library, or its library is not here. `info` prints it next to `source:`.
+   */
+  async lockedLibraryOf(kind, name, publisher) {
+    const bare = publisher?.replace(/^@/, "");
+    const names = await this.lockedLibraryNames();
+    for (const [key, entry] of Object.entries(this.tryReadLock()?.assets ?? {})) {
+      if (!entry.library || entry.library.installed) continue;
+      const id = parseCanonicalLockKey(key);
+      if (id.kind !== kind || id.name !== name || !id.publisher) continue;
+      if (bare && id.publisher !== bare) continue;
+      const lib = names.get(`${kind}:${id.publisher}/${name}`);
+      if (lib) return lib;
+    }
+    return void 0;
+  }
   /**
    * Where each library-origin lock entry of this project resolves on this machine: identity
    * `kind:publisher/name` (no scope sigil, no version) → the name the locked library is
@@ -2991,6 +3364,88 @@ var AssetManager = class {
     }
     return { libraries: await this.lockedLibraryNames(), shas };
   }
+  /**
+   * Canonical refs of the locked source assets that share a source URL with `resolved` but
+   * are locked at another commit than the one `resolved` carries for it. Assets in `resolved`
+   * and library-origin entries are skipped.
+   */
+  staleSourceSiblingRefs(resolved, declared = []) {
+    const pinOf = /* @__PURE__ */ new Map();
+    for (const d of declared) {
+      const id = refIdentity(d);
+      const pin = parseAssetRefLoose(d)?.pin;
+      if (id !== null && pin) pinOf.set(id.replace(/^@/, ""), pin);
+    }
+    const commitOf = /* @__PURE__ */ new Map();
+    const held = /* @__PURE__ */ new Set();
+    for (const c of resolved) {
+      if (!c.sourceUrl || !c.commit) continue;
+      commitOf.set(normalizeRepoUrl(c.sourceUrl), c.commit);
+      held.add(`${c.publisher.replace(/^@/, "")}/${c.kind}:${c.name}`);
+    }
+    const out = [];
+    for (const [key, entry] of Object.entries(this.tryReadLock()?.assets ?? {})) {
+      const src = entry.source;
+      if (!src?.url || entry.library) continue;
+      const commit = commitOf.get(normalizeRepoUrl(src.url));
+      if (!commit || src.commit === commit) continue;
+      const { publisher, kind, name } = parseCanonicalLockKey(key);
+      if (!publisher || !kind || !name || held.has(`${publisher}/${kind}:${name}`)) continue;
+      const pin = pinOf.get(`${publisher}/${kind}:${name}`);
+      out.push(`${kind}:@${publisher}/${name}${pin ? `#${pin}` : ""}`);
+    }
+    return out;
+  }
+  /**
+   * The lock entries that came from a source or the store (a `source:`, no `library:`), by
+   * identity `<publisher>/<kind>:<name>` -> locked version. The lock's origin
+   * wins: a library registered later that holds the same ref does not take such an asset
+   * (`update`, `install`, `add`; OQ15, p1490).
+   */
+  lockedOriginVersions() {
+    const out = /* @__PURE__ */ new Map();
+    for (const [key, e] of Object.entries(this.tryReadLock()?.assets ?? {})) {
+      if (!e.source || e.library) continue;
+      const { publisher, kind, name, version } = parseCanonicalLockKey(key);
+      if (publisher && kind && name) out.set(`${publisher}/${kind}:${name}`, version ?? "");
+    }
+    return out;
+  }
+  /**
+   * Say which registered library holds a ref the lock keeps on its source or the store: the
+   * candidate that lost, with the way to switch (p1490). Printed once per `add`.
+   */
+  async noteLosingLibraries(refs) {
+    const lock = this.tryReadLock();
+    for (const ref of refs) {
+      const plain = ref.split("#")[0] ?? ref;
+      let hit;
+      try {
+        hit = await this.resolveLibraryEntries([plain], { quiet: true });
+      } catch {
+        continue;
+      }
+      const entry = hit.entries[0];
+      const library = entry ? hit.libraryOf.get(entry) : void 0;
+      if (!entry || !library) continue;
+      const canonical = canonicalEntryRef(entry);
+      const plainCanonical = canonical.split("#")[0] ?? canonical;
+      const lockedUrl = Object.entries(lock?.assets ?? {}).find(([k, e]) => {
+        const id = parseCanonicalLockKey(k);
+        return e.source && !e.library && `${id.kind}:@${id.publisher}/${id.name}` === plainCanonical;
+      })?.[1].source?.url;
+      if (lockedUrl) {
+        const ownClone = (await this.loadLibraryIndex())?.libraries.some(
+          (l) => l.name === library && l.ownership === "reader" && "url" in l.backendConfig && sourceCacheKey(l.backendConfig.url) === sourceCacheKey(lockedUrl)
+        );
+        if (ownClone) continue;
+      }
+      this.emitLibraryCollision(
+        `${plainCanonical} is locked from ${lockedUrl ?? "its source"}, which wins; library "${library}" also holds it${entry.version ? ` (${entry.version})` : ""} and is not used. To switch, run \`skaile remove ${plainCanonical}\`, then \`skaile add ${plainCanonical}\`.`,
+        [plainCanonical]
+      );
+    }
+  }
   // ── Store fetch-then-deploy ────────────────────────────────────────────
   /** A candidate's stable identity key (`<publisher>/<kind>:<name>@<version>`). */
   candidateKey(c) {
@@ -3150,10 +3605,19 @@ var AssetManager = class {
         fresh.push(ref);
       }
       if (fresh.length === 0) break;
+      const keepsOrigin = (ref) => {
+        const id = refIdentity(ref);
+        const locked = id !== null ? opts.lockedOrigin?.get(id) : void 0;
+        if (locked === void 0) return false;
+        const pin = ref.includes("#") ? ref.slice(ref.indexOf("#") + 1).trim() : void 0;
+        return !pin || locked === "" || matchPin(pin, locked);
+      };
+      const originKept = fresh.filter(keepsOrigin);
+      if (opts.warnCollisions && originKept.length > 0) await this.noteLosingLibraries(originKept);
       const libraryTried = new Set(
         fresh.filter((ref) => {
           const id = refIdentity(ref);
-          return id !== null && (opts.provenanceIndex.get(id)?.length ?? 0) === 0;
+          return id !== null && (opts.provenanceIndex.get(id)?.length ?? 0) === 0 && !keepsOrigin(ref);
         })
       );
       const hit = await this.resolveLibraryEntries([...libraryTried], {
@@ -3181,7 +3645,7 @@ var AssetManager = class {
         }
         presets.push(...r.presets);
         const hit2 = await this.resolveLibraryEntries(
-          r.missing.filter((m) => !libraryTried.has(m)),
+          r.missing.filter((m) => !libraryTried.has(m) && !keepsOrigin(m)),
           {
             quiet: !opts.warnCollisions,
             lockedLibraries: opts.lockedLibraries,
@@ -3324,6 +3788,13 @@ var AssetManager = class {
         }
       });
       if (intact) {
+        const { restoreScriptModes } = await import('./library/index.js');
+        restoreScriptModes(
+          targetDir,
+          c.files.map(
+            (f) => root && f.path.startsWith(`${root}/`) ? f.path.slice(root.length + 1) : f.path
+          )
+        );
         staged.set(this.candidateKey(c), join(targetDir, this.stagedManifestRel(c)));
         continue;
       }
@@ -3484,7 +3955,8 @@ var AssetManager = class {
         };
       }
       const orphans = await this.orphanedSourceGaps(
-        await this.declaredLockKeys(lockForLibraries, dependencies)
+        await this.declaredLockKeys(lockForLibraries, dependencies),
+        true
       );
       if (orphans.size > 0) {
         return {
@@ -3527,6 +3999,7 @@ var AssetManager = class {
       // library holding the same ref does not move a locked asset. `update` re-resolves.
       ...opts?.moveLibraries ? { preferLocked: await this.lockedPreference() } : { lockedLibraries: await this.lockedLibraryNames() },
       ...keepLocked ? { keepLocked } : {},
+      lockedOrigin: this.lockedOriginVersions(),
       readStoreRequires: true
     });
     this.assertNoFolderCollision([...resolved, ...lib.entries.map((e) => this.entryIdentity(e))]);
@@ -3570,7 +4043,7 @@ var AssetManager = class {
     const missingHints = await this.publisherChangeHints(stillMissing);
     const prevLock = this.tryReadLock();
     const kept = keptLockEntries(prevLock, stillMissing);
-    const storeNotChecked = this.storeNotCheckedRefs(
+    const storeNotChecked = await this.storeNotCheckedRefs(
       kept,
       sources.map((s) => s.url)
     );
@@ -3578,7 +4051,7 @@ var AssetManager = class {
     for (const ref of /* @__PURE__ */ new Set([...kept.refs, ...fixes.keys()])) {
       const fix = fixes.get(ref);
       const notes = [
-        kept.refs.has(ref) ? this.keptCopyDeployed(kept, ref) ? "the deployed copy and its lock entry are kept" : "its lock entry is kept; no deployed copy exists" : void 0,
+        kept.refs.has(ref) ? await this.keptCopyDeployed(kept, ref) ? "the deployed copy and its lock entry are kept" : "its lock entry is kept; no deployed copy exists" : void 0,
         fix
       ].filter((n) => n !== void 0);
       missingHints[ref] = `${fix ? "" : missingHints[ref] ?? ""} (${notes.join("; ")})`;
@@ -3597,12 +4070,32 @@ var AssetManager = class {
     const entries = [...await this.buildCatalogEntries(resolved, repositories), ...lib.entries];
     assertFlowsLoad(entries, "installed");
     assertNoLibrarySymlinks(entries, this.registry, repositories, opts?.link === true);
+    const forceCommand = opts?.moveLibraries === true ? "skaile update --force" : "skaile install --force";
     if (!opts?.force) {
       await this.assertNoHandEditsPruned(
         resolved,
-        /* @__PURE__ */ new Set([...Object.keys(libraryLock), ...Object.keys(kept.assets)])
+        /* @__PURE__ */ new Set([...Object.keys(libraryLock), ...Object.keys(kept.assets)]),
+        forceCommand
+      );
+    }
+    const relockRemoved = await this.relockDeletions(
+      entries,
+      prevLock,
+      withKeptLockEntries(freshLock, kept),
+      opts?.force === true,
+      forceCommand,
+      lib.libraryOf
+    );
+    if (!opts?.force) this.assertNoUnrecordedAgentOverwrite(entries, prevLock, forceCommand);
+    if (!opts?.force) {
+      await this.assertNoHandEditsOverwritten(
+        entries,
+        prevLock,
+        withKeptLockEntries(freshLock, kept),
+        forceCommand
       );
     }
+    const inferredHarnesses = this.inferLegacyHarnessSubsets(entries);
     const { removed, replaced } = this.reconcileRemovedAssets(
       resolved,
       /* @__PURE__ */ new Set([...Object.keys(libraryLock), ...Object.keys(kept.assets)])
@@ -3610,6 +4103,7 @@ var AssetManager = class {
     const copyDrift = await this.lockedCopyDrift();
     const missingCopies = await this.incompleteDeploys();
     const unrecordedAgents = this.unrecordedAgentFiles(prevLock);
+    const composedDrift = /* @__PURE__ */ new Set();
     const deployed = [
       ...new Set(
         this.targetHarnesses().flatMap(
@@ -3617,7 +4111,10 @@ var AssetManager = class {
             this.entriesForHarness(entries, t),
             repositories,
             patches,
-            this.deployOptsFor(t, opts?.link)
+            this.deployOptsFor(t, opts?.link, void 0, {
+              refresh: opts?.moveLibraries === true,
+              onDrift: (ref, composeRef) => composedDrift.add(this.composedDriftLine(ref, composeRef))
+            })
           )
         )
       )
@@ -3625,14 +4122,24 @@ var AssetManager = class {
     this.sweepLegacyOmpCopies(entries);
     const mcpRestored = await this.renderHarnessMcpConfig();
     const agentRender = await this.renderAgentInstances();
-    const restored = [...this.restoredCopies(copyDrift, deployed, missingCopies), ...mcpRestored];
+    const restored = [
+      ...this.restoredCopies(copyDrift, deployed, missingCopies),
+      ...relockRemoved,
+      ...mcpRestored
+    ];
     const rewritten = this.rewrittenAgentFiles(unrecordedAgents);
     const lockWanted = resolved.length > 0 || lib.entries.length > 0 || existsSync(this.lockPath);
     let lockWritten = false;
     let relocked = [];
     let moved = [];
     if (lockWanted) {
-      const lockData = this.withRenderedAgents(withKeptLockEntries(freshLock, kept));
+      const lockData = this.withCopiedFiles(
+        this.withRenderedAgents(
+          withKeptLockEntries(freshLock, kept),
+          opts?.moveLibraries ? void 0 : prevLock
+        ),
+        prevLock
+      );
       moved = libraryMoves(prevLock, libraryLock);
       const movedRefs = new Set(moved.map((m) => m.ref));
       relocked = relockedRefs(prevLock, lockData).filter((k) => !movedRefs.has(k.split("#")[0]));
@@ -3648,12 +4155,17 @@ var AssetManager = class {
     return {
       deployed,
       removed,
-      missing: [...reportedMissing, ...versionBlocked.filter((b) => !reportedMissing.includes(b))],
+      missing: [
+        ...reportedMissing,
+        ...versionBlocked.filter((b) => !reportedMissing.includes(b)),
+        ...composedDrift
+      ],
       ...placeholderBodies.length > 0 ? { placeholderBodies } : {},
       ...placeholderDescriptions.length > 0 ? { placeholderDescriptions } : {},
       ...storeNotChecked.length > 0 ? { storeNotChecked } : {},
       ...Object.keys(missingHints).length > 0 ? { missingHints } : {},
       ...relocked.length > 0 ? { relocked } : {},
+      ...inferredHarnesses.length > 0 ? { inferredHarnesses } : {},
       ...moved.length > 0 ? { moved } : {},
       ...replaced.length > 0 ? { replaced } : {},
       ...restored.length > 0 ? { restored } : {},
@@ -3674,7 +4186,7 @@ var AssetManager = class {
    * @param declaredSourceUrls - The `sources:` URLs of `skaile.yaml`; a lock entry from one of
    *   them is that source's, not the store's.
    */
-  storeNotCheckedRefs(kept, declaredSourceUrls) {
+  async storeNotCheckedRefs(kept, declaredSourceUrls) {
     const skipped = this.catalogUrlOverride === "";
     if (!skipped && this.storeFailures.size === 0) return [];
     const declared = new Set(declaredSourceUrls.map(normalizeRepoUrl));
@@ -3685,7 +4197,7 @@ var AssetManager = class {
         const entry = kept.assets[key];
         return entry !== void 0 && !entry.library && entry.source !== void 0 && !declared.has(normalizeRepoUrl(entry.source.url));
       });
-      if (!fromStore || !this.keptCopyDeployed(kept, ref)) continue;
+      if (!fromStore || !await this.keptCopyDeployed(kept, ref)) continue;
       if (skipped && this.storeFailures.size === 0) {
         out.push({ ref, reason: "skipped", detail: "--no-catalog: the store was not asked" });
         continue;
@@ -3831,7 +4343,7 @@ var AssetManager = class {
    * other version taking its place) whose deployed folder holds hand edits: the files that differ
    * from the lock are named, nothing is removed, and `--force` prunes anyway (OQ6).
    */
-  async assertNoHandEditsPruned(resolved, keep) {
+  async assertNoHandEditsPruned(resolved, keep, forceCommand) {
     const oldLock = this.tryReadLock();
     if (!oldLock) return;
     const resolvedRefs = [
@@ -3863,7 +4375,202 @@ var AssetManager = class {
     throw new Error(
       `Not pruned: skaile.yaml no longer declares ${lines.length === 1 ? "an asset" : "assets"} whose deployed copy holds your edits:
   ${lines.join("\n  ")}
-Nothing was changed. Declare it again to keep it, or run \`skaile install --force\` to prune it with its edits.`
+Nothing was changed. Declare it again to keep it, or run \`${forceCommand}\` to prune it with its edits.`
+    );
+  }
+  /**
+   * Report (and, without `force`, guard) the files a re-lock deletes from a deployed copy
+   * (OQ5, p1441): the asset is locked already and its library or source now holds other content
+   * (`next` re-locks it), and the deployed folder holds files the new content does not ship. The
+   * deploy clears them. Two cases:
+   *  - the deployed copy still equals what `prevLock` recorded (per-file sha256 for a source
+   *    or store asset, the library hash for a library asset): the new version dropped those
+   *    files, nobody edited them, so they are deleted and come back as `removed` rows (an
+   *    `install`/`update` prints `Removed <file> (not part of <ref>)`), without a refusal;
+   *  - the copy diverged (a file the previous content did not ship, an edited file, or no hash
+   *    to compare): without `force` this throws one error naming the files and changes nothing.
+   *    A source or store asset names only the files the previous content did not ship (or that
+   *    were edited); a library asset records no file list, so it names every file to delete.
+   *
+   * @param entries - The catalog entries about to be deployed.
+   * @param next - The lock the run is about to write (or merge).
+   * @param libraryOf - The library each library-origin entry came from.
+   */
+  async relockDeletions(entries, prevLock, next, force, forceCommand, libraryOf) {
+    if (!prevLock) return [];
+    const relocked = relockedRefs(prevLock, next).map((key) => ({
+      key,
+      id: parseCanonicalLockKey(key)
+    }));
+    if (relocked.length === 0) return [];
+    const shown = (p) => (this.global ? p : relative(this.projectDir, p)).split(sep).join("/");
+    let snap;
+    const rows = [];
+    const refused = [];
+    for (const e of entries) {
+      const hit = relocked.find(({ id }) => id.kind === e.kind && id.name === e.name);
+      const component = hit ? this.installTarget(e.kind) : void 0;
+      if (!hit || !component) continue;
+      const prevEntry = Object.entries(prevLock.assets).find(([k]) => {
+        const o = parseCanonicalLockKey(k);
+        return o.kind === hit.id.kind && o.name === hit.id.name && o.publisher === hit.id.publisher;
+      })?.[1];
+      const removed = [];
+      const blocked = [];
+      for (const t of this.targetHarnesses()) {
+        const drift = deployedAssetDrift(e, this.deployOptsFor(t));
+        if (!drift || drift.extra.length === 0) continue;
+        const dir = deployedDir(component, e.name, t, this.global, this.projectDir);
+        const files = drift.extra;
+        let untouched;
+        if (prevEntry && prevEntry.files.length > 0) {
+          const locked = new Map(
+            lockedAssetFiles(e.kind, prevEntry.files).map((f) => [f.rel, f.sha256])
+          );
+          untouched = files.filter((rel) => {
+            const want = locked.get(rel);
+            if (want === void 0) return false;
+            try {
+              return computeHash(join(dir, rel)) === want;
+            } catch {
+              return false;
+            }
+          });
+        } else if (prevEntry?.library?.sha256 && !prevEntry.library.installed) {
+          const libName = libraryOf.get(e);
+          snap ??= await this.loadLibraryIndex();
+          const libPath = libName ? this.libraryPath({ name: libName }, snap) : null;
+          if (libPath) {
+            const assetRoot = statSync(e.source).isDirectory() ? e.source : dirname(e.source);
+            const hash = computeDeterministicHash(
+              dir,
+              listAssetFiles(dir),
+              posix.normalize(relative(libPath, assetRoot).split(sep).join("/"))
+            );
+            if (hash === prevEntry.library.sha256) untouched = [...files];
+          }
+        }
+        const own = new Set(untouched ?? []);
+        for (const f of files) (own.has(f) ? removed : blocked).push(shown(join(dir, f)));
+      }
+      if (removed.length > 0) rows.push({ ref: hit.key, restored: [], removed });
+      if (blocked.length > 0) refused.push({ ref: hit.key, restored: [], removed: blocked });
+    }
+    if (refused.length === 0 || force) return [...rows, ...refused];
+    const lines = refused.map((r) => `${r.ref} (${r.removed.join(", ")})`);
+    throw new Error(
+      `Not re-locked: the deployed copy of ${refused.length === 1 ? "an asset" : "assets"} holds files its locked content did not ship or that were edited, and the deploy would delete them:
+  ${lines.join("\n  ")}
+Nothing was changed. Copy what you need, or run \`${forceCommand}\` to delete them.`
+    );
+  }
+  /**
+   * Stop `install` from overwriting a hand-edited rendered agent file that no lock entry
+   * records (OQ5, p1440): the lock is gone (or never held the agent), so nothing tells an edit
+   * from a stale render, and the deploy would replace the file without a word. Checks the file
+   * named after each agent about to be deployed and the file of each agent instance whose bound
+   * agent has no lock entry. Throws one error naming each file that exists and differs from its
+   * render and changes nothing; `--force` (the caller skips this check) overwrites. A file that
+   * equals its render is not an edit. Project mode only.
+   */
+  assertNoUnrecordedAgentOverwrite(entries, prevLock, forceCommand) {
+    if (this.global) return;
+    const lockedAgents = new Set(
+      Object.keys(prevLock?.assets ?? {}).map(parseCanonicalLockKey).filter((k) => k.kind && this.installTarget(k.kind) === "agent").map((k) => k.name)
+    );
+    const opts = this.deployOptsFor(this.harness);
+    const lines = /* @__PURE__ */ new Set();
+    const collect = (diff, what) => {
+      if (!diff) return;
+      for (const m of diff.matchAll(/^--- (.+?)\t/gm)) {
+        const abs = m[1];
+        if (!existsSync(abs)) continue;
+        lines.add(
+          `${relative(this.projectDir, abs).split(sep).join("/")} (${what} differs from its render)`
+        );
+      }
+    };
+    for (const e of entries) {
+      if (this.installTarget(e.kind) !== "agent" || lockedAgents.has(e.name)) continue;
+      try {
+        collect(diffDeployedAgent(e, opts), `agent ${e.name}`);
+      } catch {
+      }
+    }
+    let instances = {};
+    try {
+      instances = effectiveAgentInstances(resolveSkWorkspaceConfig(this.projectDir));
+    } catch {
+    }
+    for (const [id, config] of Object.entries(instances)) {
+      if (!config.ref.startsWith("agent:")) continue;
+      const bound = parseRefTolerant(config.ref);
+      if (bound?.kind === "agent" && lockedAgents.has(bound.name)) continue;
+      try {
+        const srcDir = resolveAgentDefinitionDir(this.projectDir, config.ref);
+        if (srcDir === void 0) continue;
+        const entry = {
+          kind: "agent",
+          name: id,
+          description: "",
+          source: srcDir,
+          version: "",
+          requires: [],
+          dependencies: []
+        };
+        collect(diffDeployedAgent(entry, opts, { id, srcDir, config }), `agent instance ${id}`);
+      } catch {
+      }
+    }
+    if (lines.size === 0) return;
+    throw new Error(
+      `Not deployed: the deploy would overwrite ${lines.size === 1 ? "a rendered agent file" : "rendered agent files"} that no lock entry records:
+  ${[...lines].join("\n  ")}
+Nothing was changed. Move your edits away, or run \`${forceCommand}\` to overwrite the file.`
+    );
+  }
+  /**
+   * Stop a re-lock from replacing a hand edit of a deployed copy (OQ6, p1641): the asset is locked
+   * already, its library or source now holds other content (`next` re-locks it), and a deployed
+   * file differs from what the lock covers and from the new content. The deploy would replace
+   * the file without a word. Throws one error naming each file and changes nothing; `--force`
+   * (the caller skips this check) replaces them. An agent's rendered files are compared with the
+   * hashes the lock records. A file the new content brings back byte for byte loses nothing.
+   * Project mode only.
+   */
+  async assertNoHandEditsOverwritten(entries, prevLock, next, forceCommand) {
+    if (this.global || !prevLock) return;
+    const relocked = relockedRefs(prevLock, next).map((k) => parseCanonicalLockKey(k));
+    if (relocked.length === 0) return;
+    const opts = this.deployOptsFor(this.harness);
+    const lines = [];
+    for (const d of await this.lockedCopyDrift()) {
+      const id = parseCanonicalLockKey(d.key);
+      if (!relocked.some(
+        (r) => r.kind === id.kind && r.name === id.name && r.publisher === id.publisher
+      )) {
+        continue;
+      }
+      let files = d.modified;
+      if (!d.rendered) {
+        const component = id.kind ? this.installTarget(id.kind) : void 0;
+        if (!id.kind || !id.name || !component) continue;
+        const entry = entries.find((e) => e.kind === id.kind && e.name === id.name);
+        const differs = entry ? deployedAssetDrift(entry, opts)?.modified : void 0;
+        if (differs) files = files.filter((f) => differs.includes(f));
+        const dir = relative(
+          this.projectDir,
+          deployedDir(component, id.name, this.harness, this.global, this.projectDir)
+        ).split(sep).join("/");
+        files = files.map((f) => `${dir}/${f}`);
+      }
+      if (files.length > 0) lines.push(`${d.ref} (${files.join(", ")} was edited)`);
+    }
+    if (lines.length === 0) return;
+    throw new Error(
+      `Not re-locked: the new content would replace ${lines.length === 1 ? "a file" : "files"} you edited in the deployed copy:
+  ${lines.join("\n  ")}
+Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace them.`
     );
   }
   /**
@@ -4091,7 +4798,7 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
     }
     assertLockHashes(lock);
     this.assertNoFolderCollision(Object.keys(lock.assets).map(parseCanonicalLockKey));
-    const orphaned = [...(await this.orphanedSourceGaps()).values()];
+    const orphaned = [...(await this.orphanedSourceGaps(void 0, true)).values()];
     if (orphaned.length > 0) {
       throw new Error(
         `Lock file verification failed:
@@ -4166,20 +4873,47 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
       throw new Error(`Lock file verification failed:
   ${reason}`);
     }
-    const library = await this.restoreLibraryLockEntries(lock);
+    const library = await this.restoreLibraryLockEntries(lock, { storeFallback: true });
     assertFlowsLoad([...resolved, ...library.entries], "installed");
     assertNoLibrarySymlinks([...resolved, ...library.entries], this.registry, repositories);
-    const copyDrift = await this.lockedCopyDrift();
-    const missingCopies = await this.incompleteDeploys();
-    const unrecordedAgents = this.unrecordedAgentFiles(lock);
-    const deployed = [
+    const inferredHarnesses = this.inferLegacyHarnessSubsets([...resolved, ...library.entries]);
+    const composedPre = /* @__PURE__ */ new Set();
+    if (!this.global) {
+      for (const e of [...resolved, ...library.entries]) {
+        if (this.installTarget(e.kind) !== "agent") continue;
+        try {
+          for (const composeRef of composedDriftRefs(e, this.deployOptsFor(this.harness))) {
+            composedPre.add(this.composedDriftLine(canonicalEntryRef(e), composeRef));
+          }
+        } catch {
+        }
+      }
+    }
+    if (library.missing.length > 0 || composedPre.size > 0) {
+      return {
+        deployed: [],
+        removed: [],
+        missing: [...library.missing, ...composedPre],
+        lockWritten: false,
+        npmInstalled: [],
+        npmFailed: []
+      };
+    }
+    const copyDrift = await this.lockedCopyDrift();
+    const missingCopies = await this.incompleteDeploys();
+    const unrecordedAgents = this.unrecordedAgentFiles(lock);
+    const composedDrift = /* @__PURE__ */ new Set();
+    const deployed = [
       ...new Set(
         this.targetHarnesses().flatMap(
           (t) => deployAll(
             this.entriesForHarness([...resolved, ...library.entries], t),
             repositories,
             patches,
-            this.deployOptsFor(t)
+            this.deployOptsFor(t, void 0, void 0, {
+              refresh: false,
+              onDrift: (ref, composeRef) => composedDrift.add(this.composedDriftLine(ref, composeRef))
+            })
           )
         )
       )
@@ -4195,25 +4929,53 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
         return p ? `${p.kind}:${p.name}` : m;
       })
     );
+    const viaStoreIds = new Set(library.viaStore.map(gapIdentity));
     const gaps = (await this.projectState()).gaps.filter((g) => {
       if (g.type === "agent") return false;
+      if (g.unreadableSource) return false;
+      if ((g.type === "library" || g.type === "unresolved") && viaStoreIds.has(gapIdentity(g.ref))) {
+        return false;
+      }
       const p = parseRefTolerant(g.ref);
       return !(p && alreadyMissing.has(`${p.kind}:${p.name}`));
     }).map((g) => g.message);
+    const libraryNotices = this.lockUrlRestoreNotices(lock, library.viaStore);
     const placeholderBodies = scaffoldBodyRefs(library.entries, deployed);
     const placeholderDescriptions = scaffoldDescriptionRefs(library.entries, deployed);
     return {
       deployed,
       removed: [],
-      missing: [...library.missing, ...gaps],
+      missing: [...library.missing, ...gaps, ...composedDrift],
       ...placeholderBodies.length > 0 ? { placeholderBodies } : {},
       ...placeholderDescriptions.length > 0 ? { placeholderDescriptions } : {},
       lockWritten: false,
+      ...inferredHarnesses.length > 0 ? { inferredHarnesses } : {},
       ...restored.length > 0 ? { restored } : {},
       ...rewritten.length > 0 ? { rewritten } : {},
+      ...libraryNotices.length > 0 ? { libraryNotices } : {},
       ...agentRender
     };
   }
+  /**
+   * One notice line per locked library that is not registered here and whose assets
+   * `install --locked` restored from the lock url: names the library, how many assets came from
+   * the url, and how to register the library to move the lock later (OQ8, p1655).
+   */
+  lockUrlRestoreNotices(lock, viaStore) {
+    const byLibrary = /* @__PURE__ */ new Map();
+    for (const key of viaStore) {
+      const origin = lock.assets[key]?.library;
+      if (!origin) continue;
+      const name = unregisteredLibraryName(origin);
+      const row = byLibrary.get(name) ?? { ...origin.url ? { url: origin.url } : {}, refs: [] };
+      row.refs.push(key);
+      byLibrary.set(name, row);
+    }
+    return [...byLibrary].map(([name, { url, refs }]) => {
+      const register = url ? `skaile library init ${name} --git ${url}` : `skaile library init ${name} --path <dir>`;
+      return `Library "${name}" is not registered here: restored ${refs.length} asset${refs.length === 1 ? "" : "s"} from the lock url${url ? ` ${url}` : ""}. Register it with \`${register}\` to move the lock later.`;
+    });
+  }
   /**
    * The versions of `parsed`'s name that a source, a library or a store holds, newest first,
    * for the `Asset not found` of a pinned ref. Empty for an unpinned ref (nothing was ruled
@@ -4236,6 +4998,120 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
     }
     return [...found].sort((a, b) => gt(coerceVersion(a), coerceVersion(b)) ? -1 : 1);
   }
+  /**
+   * The refs of the other kinds that a source or a library holds under the same publisher and
+   * name as `parsed` (`agent:@pub/captain` for a `@pub/captain` that is no skill), for the
+   * `Did you mean` of an `add` that missed.
+   */
+  async otherKindRefs(parsed) {
+    if (!parsed.publisher) return [];
+    const publisher = parsed.publisher.replace(/^@/, "");
+    const found = [];
+    for (const kind of [...this.knownKinds].sort()) {
+      if (kind === parsed.kind) continue;
+      const candidate = `${kind}:@${publisher}/${parsed.name}`;
+      try {
+        if (await this.info(candidate) !== null) found.push(candidate);
+      } catch {
+      }
+    }
+    return found;
+  }
+  /**
+   * The `Did you mean agent:@pub/name?` sentence for a ref written without a kind (`@pub/name`,
+   * which means `skill`) that names no asset: the refs of other kinds under the same name that
+   * a source, a library, the lock or `skaile.yaml` holds (p1425). `undefined` when the ref has a
+   * kind or nothing of another kind answers to it. `add`, `diff`, `update`, `info`, `remove` and
+   * `why` end their not-found line with it.
+   */
+  async otherKindHint(ref) {
+    if (/^[^@/#\s]+:/.test(ref.trim())) return void 0;
+    const parsed = parseRefTolerant(ref);
+    if (!parsed) return void 0;
+    const wantPublisher = parsed.publisher?.replace(/^@/, "");
+    const found = new Set(await this.otherKindRefs(parsed));
+    const note = (id) => {
+      if (!id.kind || !id.name || id.kind === parsed.kind || id.name !== parsed.name) return;
+      const publisher = id.publisher?.replace(/^@/, "");
+      if (wantPublisher && publisher !== wantPublisher) return;
+      found.add(
+        assetRefToStr({ kind: id.kind, name: id.name, ...publisher ? { publisher } : {} })
+      );
+    };
+    for (const key of Object.keys(this.tryReadLock()?.assets ?? {})) {
+      note(parseCanonicalLockKey(key));
+    }
+    try {
+      for (const dep of resolveSkWorkspaceConfig(this.projectDir).dependencies ?? []) {
+        if (typeof dep === "string") note(parseRefTolerant(dep) ?? {});
+      }
+    } catch {
+    }
+    const refs = [...found].sort();
+    if (refs.length === 0) return void 0;
+    return refs.length === 1 ? `Did you mean ${refs[0]}?` : `Did you mean one of: ${refs.join(", ")}?`;
+  }
+  /**
+   * What `add` would deploy for the resolved candidates and library entries, without touching
+   * the project: one item per asset with its origin, version, deploy folders and files.
+   */
+  planAddItems(resolved, lib, stores, parsed) {
+    const storeUrls = new Set(stores.map((s) => normalizeRepoUrl(s.url)));
+    const factoryUrl = normalizeRepoUrl(FACTORY_SOURCE_URL);
+    const shownPath = (dir) => {
+      const rel = relative(this.projectDir, dir);
+      return this.global || rel.startsWith("..") ? dir.replace(homedir(), "~") : `${rel}${dir.endsWith(sep) ? sep : ""}`;
+    };
+    const folders = (kind, name) => {
+      const component = this.installTarget(kind);
+      if (!component) return [];
+      return this.targetHarnesses().map(
+        (t) => shownPath(deployedDir(component, name, t, this.global, this.projectDir))
+      );
+    };
+    const renders = (kind, name) => {
+      if (this.installTarget(kind) !== "agent") return [];
+      return this.targetHarnesses().flatMap(
+        (t) => agentRenderFiles(
+          t,
+          dirname(deployedDir("agent", name, t, this.global, this.projectDir)),
+          name
+        ).map(shownPath)
+      );
+    };
+    const asked = (kind, name, publisher) => kind === parsed.kind && name === parsed.name && (!parsed.publisher || (publisher ?? "").replace(/^@/, "") === parsed.publisher.replace(/^@/, ""));
+    const items = [];
+    for (const c of resolved) {
+      const url = normalizeRepoUrl(c.sourceUrl);
+      items.push({
+        ref: assetRefToStr({
+          kind: c.kind,
+          name: c.name,
+          publisher: c.publisher.replace(/^@/, "")
+        }),
+        version: c.version,
+        origin: storeUrls.has(url) ? `store ${c.sourceUrl}` : url === factoryUrl ? "factory" : `source ${sourceShortName(c.sourceUrl)}`,
+        requested: asked(c.kind, c.name, c.publisher),
+        ...planPaths(
+          folders(c.kind, c.name),
+          renders(c.kind, c.name),
+          c.files.map((f) => f.path)
+        )
+      });
+    }
+    for (const e of lib.entries) {
+      const id = this.entryIdentity(e);
+      items.push({
+        // The ref is printed once: `canonicalEntryRef` carries the version as a pin, `version` has it.
+        ref: canonicalEntryRef(e).replace(/#.*$/, ""),
+        version: e.version ?? "",
+        origin: `library ${lib.libraryOf.get(e) ?? ""}`.trim(),
+        requested: asked(e.kind, e.name, id.publisher),
+        ...planPaths(folders(e.kind, e.name), renders(e.kind, e.name), [...e.files ?? []])
+      });
+    }
+    return items.sort((a, b) => Number(b.requested) - Number(a.requested));
+  }
   /**
    * Parse the ref `add` was given. A ref the grammar rejects fails with the parser's message
    * minus its manifest-migration advice (it points at a skill that is not for `add`), and:
@@ -4253,7 +5129,7 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
       const plain = err.message.endsWith(advice) ? err.message.slice(0, -advice.length) : err.message;
       if (plain.startsWith("publisher required")) {
         const matches = await this.resolvableMatches(ref, repositories, sources);
-        const hint = matches.length === 0 ? "" : matches.length === 1 ? ` Did you mean ${matches[0]}?` : ` Did you mean one of: ${matches.join(", ")}?`;
+        const hint = matches.length === 0 ? ` Find the publisher with \`skaile store search ${ref.trim().replace(/^[^:@/#\s]+:/, "").replace(/#.*$/, "")}\`.` : matches.length === 1 ? ` Did you mean ${matches[0]}?` : ` Did you mean one of: ${matches.join(", ")}?`;
         throw new Error(`${plain}${hint}`);
       }
       const pinned = /^(.*\/[^@#/]+)@([^@#/]+)$/.exec(ref.trim());
@@ -4334,6 +5210,7 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
         stores,
         declaredRefs: dependencies,
         warnCollisions: true,
+        lockedOrigin: this.lockedOriginVersions(),
         readStoreRequires: true,
         ...opts?.preferLockedLibrary ? { preferLocked: await this.lockedPreference() } : {}
       });
@@ -4370,6 +5247,25 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
           );
         }
       }
+      if (renamedEntryLookup) {
+        for (const l of snap?.libraries ?? []) {
+          const libPath = this.libraryPath({ name: l.name }, snap);
+          if (!libPath) continue;
+          const renamed = renamedEntryLookup(libPath).find(
+            (r) => r.kind === parsed.kind && r.name === parsed.name && (!parsed.publisher || bare(r.publisher) === bare(parsed.publisher))
+          );
+          if (renamed) {
+            const shown = renamed.publisher ? assetRefToStr({
+              kind: renamed.kind,
+              name: renamed.name,
+              publisher: bare(renamed.publisher)
+            }) : `${renamed.kind}:${renamed.name}`;
+            throw new Error(
+              `${shown}: ${renamed.file} now names "${renamed.now}", so the library entry is a ref \`add\` cannot resolve. Run \`skaile library index ${l.name}\` to rename the entry, or restore the name.`
+            );
+          }
+        }
+      }
       const unreachable = [...this.storeFailures.values()];
       if (unreachable.length > 0) {
         throw new Error(
@@ -4377,8 +5273,13 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
         );
       }
       const available = await this.availableVersions(parsed, stores);
+      const otherKind = await this.otherKindHint(ref);
+      const others = missing.filter((m) => {
+        const id = parseRefTolerant(m);
+        return !(id && id.kind === parsed.kind && id.name === parsed.name && (id.publisher ?? "") === (parsed.publisher ?? ""));
+      });
       throw new Error(
-        `Asset not found: ${ref}${(await this.publisherChangeHints([ref]))[ref] ?? ""}${missing.length ? ` (missing: ${missing.join(", ")})` : ""}${available.length ? `; ${parsed.name} has version(s): ${available.join(", ")}` : ""}`
+        `Asset not found: ${ref}${(await this.publisherChangeHints([ref]))[ref] ?? ""}${others.length ? ` (missing: ${others.join(", ")})` : ""}${available.length ? `; ${parsed.name} has version(s): ${available.join(", ")}` : ""}` + (otherKind ? `. ${otherKind}` : "")
       );
     }
     if (parsed.kind === "preset" && missing.length > 0) {
@@ -4401,6 +5302,62 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
             )
           );
         }
+        const problems = origin && libPath && !(e.kind === "flow" && flowLoadError(e) !== void 0) ? libraryAssetCheck?.({ kind: e.kind, name: e.name, source: e.source }, libPath) ?? [] : [];
+        if (problems.length > 0) {
+          throw new Error(
+            `${canonicalEntryRef(e)} in library "${origin}" fails the checks of \`skaile validate\` - nothing was added:
+${problems.map((l) => `  ${l}`).join("\n")}
+Fix the asset, then run \`skaile library index ${origin}\` and add it again.`
+          );
+        }
+      }
+    }
+    if (libraryAssetCheck) {
+      for (const c of resolved) {
+        const decl = Object.entries(repositories).find(([, d]) => d.url === c.sourceUrl);
+        const cloneDir = decl ? this.resolveRepoDir(decl[1], decl[0]) : null;
+        const entry = cloneDir ? this.candidateToCatalogEntry(c, repositories) : null;
+        if (!cloneDir || !entry) continue;
+        if (entry.kind === "flow" && flowLoadError(entry) !== void 0) continue;
+        const problems = libraryAssetCheck(
+          { kind: entry.kind, name: entry.name, source: entry.source },
+          cloneDir
+        );
+        if (problems.length > 0) {
+          throw new Error(
+            `${canonicalEntryRef(entry)} from source ${c.sourceUrl} fails the checks of \`skaile validate\` - nothing was added:
+${problems.map((l) => `  ${l}`).join("\n")}
+Fix the asset in the source repo, then run \`skaile source sync\` and add it again.`
+          );
+        }
+      }
+    }
+    const staleSiblings = this.staleSourceSiblingRefs(resolved, dependencies);
+    if (staleSiblings.length > 0) {
+      const siblings = await this.resolveLibraryFirst(staleSiblings, {
+        provenanceIndex,
+        overrides,
+        stores,
+        declaredRefs: dependencies,
+        lockedOrigin: this.lockedOriginVersions(),
+        readStoreRequires: true
+      });
+      for (const sib of staleSiblings) {
+        const pin = parseAssetRefLoose(sib)?.pin;
+        if (!pin) continue;
+        const id = refIdentity(sib.replace(/#.*$/, ""));
+        const kept = siblings.resolved.some(
+          (c) => `${c.publisher.replace(/^@/, "")}/${c.kind}:${c.name}` === id?.replace(/^@/, "") && matchPin(pin, c.version ?? "")
+        );
+        if (!kept) {
+          throw new Error(
+            `${sib.replace(/#.*$/, "")} is pinned to ${pin} in skaile.yaml, but its source moved on and no longer holds ${pin}, so adding ${ref} would break the lock - nothing was added. Change the pin in skaile.yaml, or drop the pinned asset, then add again.`
+          );
+        }
+      }
+      const held = new Set(resolved.map((c) => this.candidateKey(c)));
+      for (const c of siblings.resolved) {
+        if (!held.has(this.candidateKey(c))) resolved.push(c);
       }
     }
     this.assertSourceCommitsPublished(resolved, repositories);
@@ -4437,9 +5394,22 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
         `${ref.split("#")[0]} requires ${missing.join(", ")} (not found \u2014 ${REGISTER_HOLDER}, or remove the requirement from the asset's manifest) \u2014 nothing was added`
       );
     }
+    if (opts?.dryRun) {
+      const plan = this.planAddItems(resolved, lib, stores, parsed);
+      opts.onPlan?.(plan);
+      return [];
+    }
     const entries = [...await this.buildCatalogEntries(resolved, repositories), ...lib.entries];
     assertFlowsLoad(entries, "added");
     assertNoLibrarySymlinks(entries, this.registry, repositories, opts?.link === true);
+    if (!opts?.force && !this.global && (resolved.length > 0 || lib.entries.length > 0)) {
+      await this.assertNoHandEditsOverwritten(
+        entries,
+        this.tryReadLock(),
+        buildLockFile(resolved, overridesApplied, await this.libraryLockEntries(lib)),
+        opts?.preferLockedLibrary ? "skaile update --force" : `skaile add ${ref} --force`
+      );
+    }
     if (parsed.kind === "mcp-server" && !this.global) {
       const decls = await loadMcpServerDeclarations(this.projectDir, { alsoDeclared: [ref] });
       const mine = decls.find(
@@ -4452,14 +5422,21 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
         );
       }
     }
+    const harnessNamed = this.global && (this.harnessesOverride?.length ?? 0) > 0;
+    if (harnessNamed && opts?.only && opts.onDroppedCopy)
+      this.reportDroppedCopies(parsed, opts.onDroppedCopy);
     const deployed = [
       ...new Set(
         this.targetHarnesses().flatMap(
           (t) => deployAll(
-            this.entriesForHarness(entries, t),
+            harnessNamed ? entries : this.entriesForHarness(entries, t),
             repositories,
             patches,
-            this.deployOptsFor(t, opts?.link, opts?.onSecretFile)
+            this.deployOptsFor(t, opts?.link, opts?.onSecretFile, {
+              refresh: true,
+              onDrift: () => {
+              }
+            })
           )
         )
       )
@@ -4479,7 +5456,8 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
     for (const placeholder of scaffoldDescriptionRefs(lib.entries, deployed)) {
       opts?.onPlaceholderDescription?.(placeholder);
     }
-    this.addDependencyToConfig(ref);
+    this.addDependencyToConfig(ref, opts?.only === true);
+    this.widenDependencyRows(entries, parsed);
     await this.renderHarnessMcpConfig();
     await this.renderAgentInstances();
     if (resolved.length > 0 || lib.entries.length > 0) {
@@ -4494,7 +5472,9 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
       }
       writeLock(
         this.lockPath,
-        this.withInstanceRenderings(mergeLockFile(prevLock, this.withRenderedAgents(fresh)))
+        this.withInstanceRenderings(
+          mergeLockFile(prevLock, this.withCopiedFiles(this.withRenderedAgents(fresh), prevLock))
+        )
       );
     }
     for (const d of deployed) {
@@ -4816,10 +5796,18 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
     }
     const kept = [];
     const ownedBy = [];
+    const mcpPublishers = target.kind === "mcp-server" && !this.global ? [
+      .../* @__PURE__ */ new Set([
+        ...this.lockHolders("mcp-server", target.name).map((h) => h.publisher),
+        target.publisher?.replace(/^@/, "")
+      ])
+    ].filter((p) => !!p) : [];
     const changed = this.removeResolved(target, { force: opts?.force, kept, ownedBy });
+    const droppedSettings = changed && mcpPublishers.length > 0 ? this.dropRemovedMcpServerSettings(target.name, mcpPublishers) : [];
     const keptNote = {
       ...kept.length > 0 ? { kept } : {},
-      ...ownedBy.length > 0 ? { ownedBy } : {}
+      ...ownedBy.length > 0 ? { ownedBy } : {},
+      ...droppedSettings.length > 0 ? { droppedSettings } : {}
     };
     const pruned = changed && requiredRefs.length > 0 ? await this.pruneOrphans(requiredRefs) : [];
     if (changed && (target.kind === "mcp-server" || pruned.some((r) => r.startsWith("mcp-server:")))) {
@@ -4876,6 +5864,25 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
       return kind ? { kind, name } : null;
     }
   }
+  /**
+   * The refs among `refs` (`skill:@publisher/name`, `skill:name`, with or without `#version`)
+   * that are not deployed for this manager's harnesses and scope, judged as `check` judges a
+   * requirement. A ref that does not parse or names a kind this build does not install is
+   * never reported. `run <flow> --dry-run` names the node skills a flow still lacks (p1757).
+   */
+  undeployedSkills(refs) {
+    const out = [];
+    for (const ref of refs) {
+      const parsed = parseRefTolerant(ref);
+      if (!parsed) continue;
+      const component = this.installTarget(parsed.kind);
+      if (!component) continue;
+      if (!isDeployed(component, parsed.name, this.harness, this.global, this.projectDir)) {
+        out.push(ref);
+      }
+    }
+    return out;
+  }
   /**
    * The reverse guard of {@link removeWithDependencies}: which other locked assets (and
    * declared presets) require `target`. Their requirements are read the way {@link lockedGraph}
@@ -4987,6 +5994,40 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
     }
     return changed;
   }
+  /**
+   * After an `mcp-server` asset left the project: drop what would keep it rendered. Its staged
+   * store bytes under `.skaile/cache/store/<publisher>/mcp-server/<name>/` go (an `mcp_servers:`
+   * entry of the same id would otherwise keep loading them), and so does an `mcp_servers:` entry
+   * that only sets values for it: `env` and the like, with no `command`, `url` or recipe of its
+   * own. An entry that can run alone is the user's own server and stays.
+   *
+   * @returns The dropped `mcp_servers` entries, as `mcp_servers entry "<id>"`.
+   */
+  dropRemovedMcpServerSettings(name, publishers) {
+    for (const publisher of publishers) {
+      rmSync(join(this.storeCacheDir, publisher, "mcp-server", name), {
+        recursive: true,
+        force: true
+      });
+    }
+    const configPath = join(this.stateRoot, "skaile.yaml");
+    if (!existsSync(configPath)) return [];
+    const raw = parse(readFileSync(configPath, "utf8")) ?? {};
+    if (!Array.isArray(raw.mcp_servers)) return [];
+    const dropped = [];
+    const standalone = ["command", "url", "recipe", "launcher"];
+    raw.mcp_servers = raw.mcp_servers.filter((entry) => {
+      const e = entry;
+      if (!e || typeof e.id !== "string" || unscopedName(e.id) !== name) return true;
+      if (standalone.some((k) => e[k] !== void 0 && e[k] !== null)) return true;
+      dropped.push(`mcp_servers entry "${e.id}"`);
+      return false;
+    });
+    if (dropped.length === 0) return [];
+    if (raw.mcp_servers.length === 0) delete raw.mcp_servers;
+    writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
+    return dropped;
+  }
   /**
    * After `remove --global --harness X`: the harnesses outside `X` that still hold a copy of the
    * asset, or `undefined` when none does (or this is not a harness-limited global remove).
@@ -5158,7 +6199,11 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
       }
     }
     if (best) return best;
-    const lib = await this.resolveLibraryEntries([ref], { quiet: true });
+    const lockedLibraries = await this.lockedLibraryNames();
+    const lib = await this.resolveLibraryEntries([ref], {
+      quiet: true,
+      ...lockedLibraries.size > 0 ? { lockedLibraries } : {}
+    });
     return lib.entries[0] ?? null;
   }
   /**
@@ -5211,18 +6256,18 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
   }
   /**
    * Tracked assets (`skaile.lock.yaml` or declared in `skaile.yaml`) whose copy
-   * still sits in the project's `.claude/…` dirs although this manager deploys
-   * to another harness. Before the default followed the configured harness every
-   * project deployed to `.claude/`, so an omp/codex project upgraded from then
-   * holds orphans there that `remove` / `clean` / `list` no longer look at.
+   * still sits in the project dirs of another harness (`.claude/…`, `.omp/…`,
+   * `.codex/…`) although this manager deploys to {@link AssetManager.harness}.
+   * A project that moved with `skaile harness set` holds orphans there that
+   * `remove` / `clean` / `list` no longer look at.
    *
-   * Read-only: nothing is deleted. Empty for `claude-code`, for global mode, and
-   * for kinds whose dir is shared with the active target (flows).
+   * Read-only: nothing is deleted. Empty for global mode and for kinds whose
+   * dir is shared with the active target (flows).
    *
-   * @returns One {@link LegacyDeployedAsset} per stale copy, sorted by kind then name.
+   * @returns One {@link StaleHarnessCopy} per stale copy, sorted by harness, kind, then name.
    */
-  listLegacyClaudeDeployed() {
-    if (this.global || this.harness === "claude-code") return [];
+  listStaleHarnessCopies() {
+    if (this.global) return [];
     const tracked = /* @__PURE__ */ new Map();
     const track = (kind, name) => {
       const component = kind ? this.installTarget(kind) : void 0;
@@ -5248,20 +6293,34 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
     } catch {
     }
     const out = [];
-    for (const { kind, name, component: k } of tracked.values()) {
-      const legacy = deployedDir(k, name, "claude-code", false, this.projectDir);
-      if (legacy === deployedDir(k, name, this.harness, false, this.projectDir)) continue;
-      const found = deployedPaths(k, name, "claude-code", false, this.projectDir).find((p) => {
-        try {
-          lstatSync(p);
-          return true;
-        } catch {
-          return false;
+    for (const other of SUPPORTED_HARNESSES) {
+      if (other === this.harness) continue;
+      for (const { kind, name, component: k } of tracked.values()) {
+        if (deployedDir(k, name, other, false, this.projectDir) === deployedDir(k, name, this.harness, false, this.projectDir)) {
+          continue;
         }
-      });
-      if (found) out.push({ kind, name, path: found });
+        const found = deployedPaths(k, name, other, false, this.projectDir).find((p) => {
+          try {
+            lstatSync(p);
+            return true;
+          } catch {
+            return false;
+          }
+        });
+        if (found) out.push({ harness: other, kind, name, path: found });
+      }
     }
-    return out.sort((a, b) => a.kind.localeCompare(b.kind) || a.name.localeCompare(b.name));
+    return out.sort(
+      (a, b) => a.harness.localeCompare(b.harness) || a.kind.localeCompare(b.kind) || a.name.localeCompare(b.name)
+    );
+  }
+  /**
+   * @deprecated Use {@link AssetManager.listStaleHarnessCopies}, which covers every
+   * other harness folder. This returns only its `.claude/` rows (the old default
+   * deploy dir), in the old shape.
+   */
+  listLegacyClaudeDeployed() {
+    return this.listStaleHarnessCopies().filter((c) => c.harness === "claude-code").map(({ kind, name, path: path2 }) => ({ kind, name, path: path2 }));
   }
   /**
    * List the **declared** top-level dependencies from `skaile.yaml`, each tagged
@@ -5325,7 +6384,11 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
         state = "declared";
       } else if (parsed.kind === "mcp-server") {
         const wired = await wiredMcpNames();
-        const isWired = wired.has(parsed.name) || wired.has(unscopedName(parsed.name));
+        const isWired = wired.has(parsed.name) || wired.has(unscopedName(parsed.name)) || !this.global && await mcpCommittedRenderIntact(
+          this.projectDir,
+          this.harness,
+          unscopedName(parsed.name)
+        );
         const skippedReason = Object.entries(
           await readSkippedMcpServers(this.projectDir, this.harness)
         ).find(([id]) => id === parsed.name || unscopedName(id) === parsed.name)?.[1];
@@ -5670,11 +6733,12 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
     if (!lock) return [];
     const bare = (s) => s.includes("#") ? s.slice(0, s.indexOf("#")) : s;
     const asked = parseRefTolerant(ref);
+    const askedPublisher = asked?.publisher?.replace(/^@/, "");
     const matchesIdentity = (k) => {
       if (bare(k) === bare(ref)) return true;
-      if (!asked || asked.publisher) return false;
+      if (!asked) return false;
       const locked = parseCanonicalLockKey(k);
-      return locked.kind === asked.kind && locked.name === asked.name;
+      return locked.kind === asked.kind && locked.name === asked.name && (!askedPublisher || locked.publisher === askedPublisher);
     };
     const key = lock.assets[ref] ? ref : Object.keys(lock.assets).find(matchesIdentity);
     if (!key) return asked?.kind === "preset" ? this.whyPreset(lock, asked) : [];
@@ -5810,6 +6874,7 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
     const libraryAssets = Object.entries(lock.assets).filter(
       ([, e]) => e.library && !e.library.installed
     );
+    const declaredPins = this.declaredPinsByIdentity();
     if (libraryAssets.length > 0) {
       const snap = await this.loadLibraryIndex();
       const diskHashes = /* @__PURE__ */ new Map();
@@ -5835,6 +6900,8 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
           { kind, publisher, name },
           found.version
         );
+        const declaredPin = declaredPins.get(`${kind}:${publisher}/${name}`);
+        if (declaredPin && diskVersion && !matchPin(declaredPin, diskVersion)) continue;
         if (diskVersion && !isPseudoVersion(diskVersion) && gt(coerceVersion(diskVersion), coerceVersion(origin.version))) {
           result.push({
             kind,
@@ -5873,6 +6940,26 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
               library: lookup.name,
               contentChanged: true
             });
+            continue;
+          }
+        }
+        if (entry.composed && kind === "agent") {
+          const srcDir = statSync(found.source).isDirectory() ? found.source : dirname(found.source);
+          const now = new Map(
+            sourceComposedFiles(srcDir, name, this.projectDir).map((f) => [f.path, f.sha256])
+          );
+          const locked = new Map(entry.composed.map((f) => [f.path, f.sha256]));
+          const same = now.size === locked.size && [...now].every(([f, h]) => locked.get(f) === h);
+          if (!same) {
+            result.push({
+              kind,
+              name,
+              publisher,
+              currentVersion: origin.version,
+              behind: 0,
+              library: lookup.name,
+              contentChanged: true
+            });
           }
         }
       }
@@ -5882,6 +6969,23 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
     await this.addPinnedRows(lock, result);
     return this.addLockGapRows(result);
   }
+  /**
+   * The `#pin` of every publisher-qualified `skaile.yaml` dependency, keyed `kind:publisher/name`
+   * (no scope sigil). `update` honours it, so `outdated` must not list a move it keeps.
+   */
+  declaredPinsByIdentity() {
+    const pins = /* @__PURE__ */ new Map();
+    for (const dep of this.loadConfig().dependencies) {
+      try {
+        const p = parseAssetRef(dep);
+        if (p.pin && p.publisher) {
+          pins.set(`${p.kind}:${p.publisher.replace(/^@/, "")}/${p.name}`, p.pin);
+        }
+      } catch {
+      }
+    }
+    return pins;
+  }
   /**
    * List a locked asset whose `skaile.yaml` ref carries a `#version` pin while a source, a
    * library or a store holds a newer one: `locked 0.7.0 -> 0.9.0 (pinned)`. The pin is the
@@ -5986,20 +7090,20 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
   async addLibraryMoves(libraryAssets, rows) {
     const refs = [];
     const lockedIn = /* @__PURE__ */ new Map();
+    const declaredPins = this.declaredPinsByIdentity();
     for (const [key, entry] of libraryAssets) {
       const { publisher, kind, name } = parseCanonicalLockKey(key);
       if (!publisher || !kind || !name || !entry.library) continue;
       const ref = `${kind}:@${publisher}/${name}`;
-      refs.push(ref);
+      const pin = declaredPins.get(`${kind}:${publisher}/${name}`);
+      refs.push(pin ? `${ref}#${pin}` : ref);
       lockedIn.set(ref, { name: entry.library.name, key });
     }
     if (refs.length === 0) return;
     let res;
+    const preferLocked = await this.lockedPreference();
     try {
-      res = await this.resolveLibraryEntries(refs, {
-        quiet: true,
-        preferLocked: await this.lockedPreference()
-      });
+      res = await this.resolveLibraryEntries(refs, { quiet: true, preferLocked });
     } catch {
       return;
     }
@@ -6009,9 +7113,11 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
       const ref = `${e.kind}:@${publisher}/${e.name}`;
       const from = lockedIn.get(ref);
       if (!to || !from || from.name === to) continue;
+      const renamedOnly = preferLocked.libraries.get(`${e.kind}:${publisher}/${e.name}`) === to;
       const row = rows.find(
         (r) => r.kind === e.kind && r.name === e.name && r.publisher.replace(/^@/, "") === publisher
       );
+      if (renamedOnly && !row) continue;
       if (row) {
         row.library = from.name;
         row.movesTo = to;
@@ -6143,7 +7249,7 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
           (r) => unscopedName(r.drift.id) === unscopedName(parsed.name)
         );
         if (!row) return { status: "identical" };
-        const fileSetDiffers = row.drift.extra.length > 0 || row.drift.missing.some((f) => !f.includes(" entry "));
+        const fileSetDiffers = row.drift.extra.length > 0 || row.drift.missing.length > 0;
         return {
           status: "differs",
           diff: mcpDriftDiff(row.drift),
@@ -6151,8 +7257,10 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
         };
       }
     }
-    const entry = await this.lockedLibraryEntry(parsed) ?? this.lockedSourceEntry(parsed) ?? await this.info(ref);
+    const libraryEntry = await this.lockedLibraryEntry(parsed);
+    const entry = libraryEntry ?? this.lockedSourceEntry(parsed) ?? await this.info(ref);
     if (!entry || !existsSync(entry.source)) return { status: "not-found" };
+    const toLabel = libraryEntry ? "library" : "source";
     const wantPublisher = parsed.publisher?.replace(/^@/, "");
     if (wantPublisher) {
       const lockedHere = Object.keys(this.tryReadLock()?.assets ?? {}).map(parseCanonicalLockKey).filter((id) => id.kind === parsed.kind && id.name === parsed.name);
@@ -6170,7 +7278,11 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
         parts.push(diffDeployedAgent(entry, opts, inst));
       }
       if (parts.every((d) => d === null)) return { status: "not-deployed" };
-      const diff = parts.filter((d) => d !== null).join("");
+      const diff = labelDiffHeaders(
+        parts.filter((d) => d !== null).join(""),
+        "deployed",
+        "rendered"
+      );
       return diff === "" ? { status: "identical" } : { status: "differs", diff };
     }
     const deployedPath = join(
@@ -6191,7 +7303,7 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
         );
       }
     }
-    return diffs.length > 0 ? { status: "differs", diff: diffs.join("") } : { status: "identical" };
+    return diffs.length > 0 ? { status: "differs", diff: labelDiffHeaders(diffs.join(""), "deployed", toLabel) } : { status: "identical" };
   }
   /**
    * The agent instances of `skaile.yaml` whose `ref` names `want` (an `agent:` ref, matched on
@@ -6241,7 +7353,8 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
       provenanceIndex,
       overrides,
       stores,
-      declaredRefs: dependencies
+      declaredRefs: dependencies,
+      lockedOrigin: this.lockedOriginVersions()
     });
     this.assertSourceCommitsPublished(resolved, repositories);
     const libraryLock = await this.libraryLockEntries(lib);
@@ -6250,6 +7363,12 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
     for (const [key, entry] of Object.entries(lockData.assets)) {
       const rendered = prior?.assets[key]?.rendered;
       if (rendered) entry.rendered = rendered;
+      const copied = prior?.assets[key]?.copied;
+      if (copied && prior?.assets[key]?.library?.sha256 === entry.library?.sha256) {
+        entry.copied = copied;
+      }
+      const composed = prior?.assets[key]?.composed;
+      if (composed) entry.composed = composed;
     }
     writeLock(this.lockPath, lockData);
     return lockData;
@@ -6363,15 +7482,30 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
       const { kind, name, publisher } = parseCanonicalLockKey(key);
       if (kind && name && publisher) lockedPublisher[`${kind}:${name}`] = publisher;
     }
+    let librarySnap;
     for (const entry of deployed) {
       const publisher = lockedPublisher[`${entry.kind}:${entry.name}`];
       const full = await this.info(
         publisher ? `${entry.kind}:@${publisher}/${entry.name}` : `${entry.kind}:${entry.name}`
       );
-      const restorable = !full && publisher !== void 0 && Object.entries(lock?.assets ?? {}).some(([key, e]) => {
-        const id = parseCanonicalLockKey(key);
-        return e.source !== void 0 && id.kind === entry.kind && id.name === entry.name && id.publisher === publisher;
-      });
+      let restorable = false;
+      if (!full && publisher !== void 0) {
+        for (const [key, e] of Object.entries(lock?.assets ?? {})) {
+          const id = parseCanonicalLockKey(key);
+          if (id.kind !== entry.kind || id.name !== entry.name || id.publisher !== publisher) {
+            continue;
+          }
+          if (e.source !== void 0) {
+            restorable = true;
+            break;
+          }
+          librarySnap ??= { snap: await this.loadLibraryIndex() };
+          if (await this.restoredFromLockUrl(key, e, librarySnap.snap)) {
+            restorable = true;
+            break;
+          }
+        }
+      }
       if (!full && !restorable) {
         if (publisher) {
           const canonical = `${entry.kind}:@${publisher}/${entry.name}`;
@@ -6554,7 +7688,7 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
       return want !== null && gaps.some((g) => g.type === "library" && sameAsset(g.ref, want));
     };
     gaps = gaps.filter((g) => !(g.type === "requires" && libraryHeld(g.ref)));
-    for (const gap of this.undeployedLockGaps(lock, named)) {
+    for (const gap of await this.undeployedLockGaps(lock, named)) {
       gaps.push(gap);
       named.add(gapIdentity(gap.ref));
     }
@@ -6576,7 +7710,7 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
         }),
         ...d.extra.map((f) => `${f} is not part of the asset`)
       ];
-      const reason = `is locked, but its deployed copy differs from the lock (${parts.join("; ")}) \u2014 run \`skaile install --locked\` to restore it`;
+      const reason = d.libraryChanged ? `is locked, but its deployed copy differs from the lock (${parts.join("; ")}) \u2014 the library holds other content now: copy your edit away, then run \`skaile update --force\` to replace it` : `is locked, but its deployed copy differs from the lock (${parts.join("; ")}) \u2014 run \`skaile install --locked\` to restore it`;
       gaps.push({ type: "modified", ref: d.ref, reason, message: `${d.ref} ${reason}` });
       named.add(gapIdentity(d.ref));
     }
@@ -6609,7 +7743,8 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
         ref: s.url,
         reason,
         message: `source ${s.url} ${reason}`,
-        manualFix: true
+        manualFix: true,
+        unreadableSource: true
       });
     }
     for (const u of unboundAgentInstances(this.projectDir, this.harness)) {
@@ -6629,6 +7764,22 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
       )
     };
   }
+  /**
+   * The first `../` compose folder of the locked library agent `kind:name` whose library copy
+   * changed since the lock, or `undefined` (project scope only). `install --locked` cannot
+   * restore such an agent; `update` moves the lock to the library's copy.
+   */
+  async lockedComposeDrift(lock, kind, name) {
+    if (this.global) return void 0;
+    const { entries } = await this.restoreLibraryLockEntries(lock);
+    const entry = entries.find((x) => x.kind === kind && x.name === name);
+    if (!entry) return void 0;
+    try {
+      return composedDriftRefs(entry, this.deployOptsFor(this.harness))[0];
+    } catch {
+      return void 0;
+    }
+  }
   /**
    * Why the `agent:` ref of agent instance `id` binds to nothing, as the phrase that follows
    * the ref in a {@link LockGap}; see {@link AssetManager.unboundAgentAdvice}.
@@ -6652,6 +7803,15 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
       return k.kind === "agent" && k.name === parsedRef?.name && (!publisher || !k.publisher || k.publisher === publisher);
     });
     if (lockedAgentKey !== void 0) {
+      const lock = this.tryReadLock();
+      const locked = parseCanonicalLockKey(lockedAgentKey);
+      const composeRef = lock && locked.kind && locked.name ? await this.lockedComposeDrift(lock, locked.kind, locked.name) : void 0;
+      if (composeRef) {
+        return {
+          lead: `its agent composes ${composeRef}, whose library copy changed since the lock`,
+          advice: `run \`skaile update\` (it moves the lock to the library's copy), ${drop}`
+        };
+      }
       const libraryFix = await this.lockedAgentLibraryHolds(lockedAgentKey) ? void 0 : (await this.unresolvedFixes([ref])).get(ref);
       if (libraryFix) {
         const register = libraryFix.replace(
@@ -6835,7 +7995,8 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
         continue;
       }
       if (lookup.state === "unregistered") {
-        const reason2 = `is locked, but library "${origin.name}" is not registered (renamed or removed?) \u2014 ${unregisteredLibraryFix(origin, ref)}`;
+        if (await this.restoredFromLockUrl(key, entry, snap)) continue;
+        const reason2 = `is locked, but library "${unregisteredLibraryName(origin)}" is not registered (renamed or removed?) \u2014 ${unregisteredLibraryFix(origin, ref)}`;
         gaps.push({ type: "library", ref, reason: reason2, message: `${ref} ${reason2}`, manualFix: true });
         continue;
       }
@@ -6855,12 +8016,15 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
    * The locked source assets whose source is no longer in `skaile.yaml` `sources:` (`source
    * remove`, a hand edit), keyed by lock key. ONE sentence for it: `check`, `doctor`, `outdated`,
    * `install`, `install --locked` and `update` all say it (p1062), and none re-clones the source.
-   * A source of a store-resolved lock entry is not told apart from one, so no GitHub source is
-   * called missing while a `stores:` entry exists.
+   * A GitHub lock entry that no source declares counts as store-supplied only when a store
+   * lists the ref (OQ3): a configured store alone proves nothing, as it may never have held
+   * the asset. `check`, `doctor` and `outdated` read the store's cached catalog and never touch
+   * the network; `install` and `update` (`online`) ask the store itself.
    *
    * @param inScope - Only these lock keys count (`install` prunes an undeclared entry as usual).
+   * @param online - Ask the stores when the cached catalog does not list the ref.
    */
-  async orphanedSourceGaps(inScope) {
+  async orphanedSourceGaps(inScope, online = false) {
     const out = /* @__PURE__ */ new Map();
     let config;
     try {
@@ -6868,23 +8032,53 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
     } catch {
       return out;
     }
-    const storeBacked = config.stores.length > 0 || (await this.globalStoreFallback(config.stores, false)).length > 0;
+    const stores = [...config.stores, ...await this.globalStoreFallback(config.stores, false)];
     const registered = new Set(config.sources.map((s) => sourceCacheKey(s.url)));
     for (const [key, entry] of Object.entries(this.tryReadLock()?.assets ?? {})) {
       const url = entry.source?.url;
       if (!url || entry.library || !GIT_URL.test(url)) continue;
       if (inScope && !inScope.has(key)) continue;
       if (normalizeRepoUrl(url) === normalizeRepoUrl(FACTORY_SOURCE_URL)) continue;
-      const { publisher, kind, name } = parseCanonicalLockKey(key);
+      const { publisher, kind, name, version } = parseCanonicalLockKey(key);
       if (!publisher || !kind || !name) continue;
       if (registered.has(sourceCacheKey(url))) continue;
-      if (storeBacked && GITHUB_REPO_URL.test(url)) continue;
       const ref = `${kind}:@${publisher}/${name}`;
+      const locked = version ? `${ref}#${version}` : void 0;
+      if (GITHUB_REPO_URL.test(url) && await this.storeListsRef(stores, ref, online, locked))
+        continue;
       const reason = `is locked, but its source ${url} is not in skaile.yaml sources: any more \u2014 register it again with \`skaile source add ${url}\`, or drop the dependency with \`skaile remove ${ref}\``;
       out.set(key, { type: "source", ref, reason, message: `${ref} ${reason}`, manualFix: true });
     }
     return out;
   }
+  /**
+   * `true` when one of `stores` lists `ref` (a canonical lock key): its cached catalog holds it
+   * or, with `online`, the store answers for it. An injected store fetcher is the store client
+   * itself, so it is asked either way. A store an online install cannot ask (unreachable,
+   * air-gapped, `--no-catalog`) may hold the ref; `check` never asks, so a store lists only what
+   * its cached catalog holds.
+   */
+  async storeListsRef(stores, ref, online, lockedRef) {
+    for (const store of stores) {
+      try {
+        if (this.injectedStoreFetcher) {
+          if (await this.injectedStoreFetcher.getInstallManifest(store.url, ref)) return true;
+          continue;
+        }
+        const remote = this.remoteStore(store.url);
+        if (remote.holdsCached(ref)) return true;
+        if (!online) {
+          if (lockedRef && remote.holdsCached(lockedRef)) return true;
+          continue;
+        }
+        if (this.catalogUrlOverride === "") return true;
+        if (await (lockedRef ? remote.revalidate(lockedRef) : remote.resolve(ref))) return true;
+      } catch {
+        if (online) return true;
+      }
+    }
+    return false;
+  }
   /**
    * Locked source assets whose source cannot supply them any more: the source is no longer in
    * `skaile.yaml` `sources:` (`source remove`, a hand edit), or it is there but now publishes
@@ -6936,13 +8130,55 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
     }
     return out;
   }
+  /**
+   * Record, on every library-origin entry of `lock` that is copied into a harness folder, the
+   * files of the deployed copy and their sha256 (`LockEntry.copied`), so a hand edit is named
+   * even after the library moved past the lock (p1641). Call it after the deploy. An entry that
+   * is unchanged since `prev` keeps its record, or stays without one: the deployed bytes may
+   * carry an edit the deploy did not touch. Project mode only; a `--link` deploy and a patched
+   * asset are not recorded.
+   */
+  withCopiedFiles(lock, prev) {
+    if (this.global) return lock;
+    const { patches } = this.loadConfig();
+    for (const [key, entry] of Object.entries(lock.assets)) {
+      if (!entry.library || entry.library.installed) continue;
+      const before = prev?.assets[key];
+      if (before && before.library?.sha256 === entry.library.sha256) {
+        if (before.copied) entry.copied = before.copied;
+        else delete entry.copied;
+        continue;
+      }
+      delete entry.copied;
+      const { kind, name } = parseCanonicalLockKey(key);
+      const component = kind ? this.installTarget(kind) : void 0;
+      if (!kind || !name || !component || component === "agent") continue;
+      if (patches[`${kind}:${name}`]) continue;
+      const dest = deployedDir(component, name, this.harness, this.global, this.projectDir);
+      try {
+        const st = lstatSync(dest);
+        if (st.isSymbolicLink() || !st.isDirectory()) continue;
+        const rows = listAssetFiles(dest).map((path2) => ({
+          path: path2,
+          sha256: computeHash(join(dest, path2))
+        }));
+        if (rows.length > 0) entry.copied = rows.sort((a, b) => a.path.localeCompare(b.path));
+      } catch {
+      }
+    }
+    return lock;
+  }
   /**
    * Record, on every agent entry of `lock` that has none, the files the agent's harness
    * rendering occupies and their sha256. Call it after the deploy, so the bytes hashed are the
    * ones `install` just wrote; {@link lockedCopyDrift} compares later edits with them.
    * Entries that carry a record (kept from an earlier lock) are left as they are.
+   *
+   * @param keepComposedOf - The lock an `install` read: an agent whose `../` compose folder is
+   *   not in the cache keeps that lock's `composed:` record. Omitted by `update` and `add`,
+   *   which copy the library's current bytes.
    */
-  withRenderedAgents(lock) {
+  withRenderedAgents(lock, keepComposedOf) {
     if (this.global) return lock;
     for (const [key, entry] of Object.entries(lock.assets)) {
       if (entry.rendered || entry.library?.installed) continue;
@@ -6951,6 +8187,18 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
       const rendered = this.renderedAgentFiles(name);
       if (rendered.length > 0) entry.rendered = rendered;
     }
+    for (const [key, entry] of Object.entries(lock.assets)) {
+      if (entry.library?.installed) continue;
+      const { kind, name } = parseCanonicalLockKey(key);
+      if (!kind || !name || this.installTarget(kind) !== "agent") continue;
+      const composed = cachedComposedFiles(name, this.projectDir);
+      if (composed.length > 0) entry.composed = composed;
+      else {
+        const earlier = keepComposedOf?.assets[key]?.composed;
+        if (earlier?.length) entry.composed = earlier;
+        else delete entry.composed;
+      }
+    }
     return this.withInstanceRenderings(lock);
   }
   /**
@@ -7129,6 +8377,73 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
     }
     return out;
   }
+  /**
+   * Hand edits in the deployed copy of a library asset whose library moved past the lock (a
+   * version bump, or an in-place edit of the same version): {@link restoreLibraryLockEntries}
+   * drops such an entry, so {@link lockedCopyDrift} would not see the edit and `update` would
+   * replace the file without a word (p1641). `covered` holds the `kind:@publisher/name` of the
+   * entries that were compared already. The lock's per-file record (`copied:`) names the edited
+   * files; a lock without one (written before it existed) compares the deployed folder with the
+   * one library hash and names the files that also differ from the library's new content.
+   */
+  async changedLibraryCopyEdits(lock, covered, patches) {
+    const out = [];
+    let snap;
+    const fileSets = /* @__PURE__ */ new Map();
+    for (const [key, entry] of Object.entries(lock.assets)) {
+      const origin = entry.library;
+      if (!origin || origin.installed) continue;
+      const { kind, name, publisher } = parseCanonicalLockKey(key);
+      if (!kind || !name || !publisher) continue;
+      const ref = `${kind}:@${publisher}/${name}`;
+      if (covered.has(ref) || patches[`${kind}:${name}`]) continue;
+      const component = this.installTarget(kind);
+      if (!component || component === "agent") continue;
+      const dest = deployedDir(component, name, this.harness, this.global, this.projectDir);
+      try {
+        const st = lstatSync(dest);
+        if (st.isSymbolicLink() || !st.isDirectory()) continue;
+      } catch {
+        continue;
+      }
+      let modified = [];
+      if (entry.copied && entry.copied.length > 0) {
+        for (const f of entry.copied) {
+          const file = join(dest, f.path);
+          if (!existsSync(file)) continue;
+          try {
+            if (computeHash(file) !== f.sha256) modified.push(f.path);
+          } catch {
+            modified.push(f.path);
+          }
+        }
+      } else if (origin.sha256) {
+        snap ??= await this.loadLibraryIndex();
+        const lookup = this.lockedLibrary(origin, snap, { kind, publisher, name });
+        if (lookup.state !== "ok") continue;
+        const found = (await scanDirectory(lookup.path, publisher, { knownKinds: this.knownKinds })).find((x) => x.kind === kind && x.name === name);
+        if (!found) continue;
+        const current = withLibraryFiles(found, lookup.path, fileSets, this.registry);
+        const assetRoot = statSync(current.source).isDirectory() ? current.source : dirname(current.source);
+        const hash = computeDeterministicHash(
+          dest,
+          listAssetFiles(dest),
+          posix.normalize(relative(lookup.path, assetRoot).split(sep).join("/"))
+        );
+        if (hash === origin.sha256) continue;
+        modified = deployedAssetDrift(current, {
+          registry: this.registry,
+          harness: this.harness,
+          global: this.global,
+          cwd: this.projectDir
+        })?.modified ?? [];
+      }
+      if (modified.length > 0) {
+        out.push({ ref, key, modified, extra: [], library: true, libraryChanged: true });
+      }
+    }
+    return out;
+  }
   /**
    * Locked assets whose deployed copy differs from the bytes the lock covers: a file edited by
    * hand, or a file the asset does not ship. One row per asset, `ref` being `kind:@publisher/name`
@@ -7172,6 +8487,15 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
       const ref = `${e.kind}:@${(e.publisher ?? "").replace(/^@/, "")}/${e.name}`;
       out.push({ ref, key: keyOf.get(ref) ?? ref, ...drift, library: true });
     }
+    out.push(
+      ...await this.changedLibraryCopyEdits(
+        lock,
+        new Set(
+          entries.map((e) => `${e.kind}:@${(e.publisher ?? "").replace(/^@/, "")}/${e.name}`)
+        ),
+        patches
+      )
+    );
     for (const [key, entry] of Object.entries(lock.assets)) {
       if (!entry.source || entry.files.length === 0) continue;
       const { kind, name } = parseCanonicalLockKey(key);
@@ -7206,12 +8530,13 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
         out.push({ ref: refOf(key), key, modified, extra, library: false });
     }
     for (const [key, entry] of Object.entries(lock.assets)) {
-      if (!entry.rendered || entry.rendered.length === 0 || entry.library?.installed) continue;
+      const recorded = [...entry.rendered ?? [], ...entry.composed ?? []];
+      if (recorded.length === 0 || entry.library?.installed) continue;
       const { kind, name } = parseCanonicalLockKey(key);
       if (!kind || !name || this.installTarget(kind) !== "agent") continue;
       if (patches[`${kind}:${name}`]) continue;
       const modified = [];
-      for (const f of entry.rendered) {
+      for (const f of recorded) {
         const file = join(this.projectDir, f.path);
         if (!existsSync(file)) continue;
         try {
@@ -7232,7 +8557,7 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
           extra: [],
           library: false,
           rendered: true,
-          lockedSha: new Map(entry.rendered.map((f) => [f.path, f.sha256])),
+          lockedSha: new Map(recorded.map((f) => [f.path, f.sha256])),
           instanceOf
         });
       }
@@ -7245,7 +8570,7 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
    *
    * @param named - `kind:name` identities already reported; they are skipped.
    */
-  undeployedLockGaps(lock, named) {
+  async undeployedLockGaps(lock, named) {
     const gaps = [];
     for (const [key, entry] of Object.entries(lock?.assets ?? {})) {
       if (entry.library?.installed) continue;
@@ -7264,7 +8589,8 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
         this.global,
         this.projectDir
       ).find((p) => isSymlink(p) && !existsSync(p));
-      const reason = dangling ? `is locked but its deployed copy is a symlink to nothing (${relative(this.projectDir, dangling)}) \u2014 run \`skaile install --locked\`` : "is locked but its deployed copy is missing \u2014 run `skaile install --locked`";
+      const composeDrift = component === "agent" && !dangling && lock ? await this.lockedComposeDrift(lock, kind, name) : void 0;
+      const reason = composeDrift ? `(composes ${composeDrift}: the library's copy changed since the lock; \`skaile update\` moves the lock to it)` : dangling ? `is locked but its deployed copy is a symlink to nothing (${relative(this.projectDir, dangling)}) \u2014 run \`skaile install --locked\`` : "is locked but its deployed copy is missing \u2014 run `skaile install --locked`";
       gaps.push({ type: "drift", ref, reason, message: `${ref} ${reason}` });
     }
     return gaps;
@@ -7345,10 +8671,23 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
           ({ id }) => id.kind === want.kind && id.name === want.name && (!want.publisher || id.publisher === want.publisher)
         );
         if (held.length > 0 && !held.some(({ id }) => !id.version || matchPin(want.pin, id.version))) {
-          gap = {
-            type: "pin",
-            reason: `is pinned in skaile.yaml but the lock holds ${held.map((h) => h.key).join(", ")} \u2014 run \`skaile install\``
-          };
+          const lockHolds = held.map((h) => h.key).join(", ");
+          const pinned = await this.info(d.ref);
+          const pinHeld = pinned !== null && matchPin(want.pin, pinned.version ?? "");
+          if (!pinHeld && this.loadConfig().stores.length === 0) {
+            const plainRef = d.ref.split("#")[0] ?? d.ref;
+            const other = pinned ?? await this.info(plainRef);
+            gap = {
+              type: "pin",
+              reason: `is pinned in skaile.yaml but the lock holds ${lockHolds}, and no library or source holds ${want.pin}${other?.version ? ` (${want.name} has version(s): ${other.version})` : ""} \u2014 change the pin in skaile.yaml`,
+              manualFix: true
+            };
+          } else {
+            gap = {
+              type: "pin",
+              reason: `is pinned in skaile.yaml but the lock holds ${lockHolds} \u2014 run \`skaile install\``
+            };
+          }
         }
       }
       if (gap) gaps.push({ ...gap, ref: d.ref, message: `${d.ref} ${gap.reason}` });
@@ -7641,20 +8980,26 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
    * user-scope SSOT `~/.skaile/skaile.yaml`, **bootstrapping** the file (and its
    * parent dir) when absent so `skaile add --global` works on a fresh machine.
    */
-  addDependencyToConfig(ref) {
+  addDependencyToConfig(ref, only = false) {
     const configPath = join(this.stateRoot, "skaile.yaml");
-    const limit = this.global && this.harnessesOverride?.length ? this.harnessesOverride : void 0;
+    const requested = this.global && this.harnessesOverride?.length ? this.harnessesOverride : void 0;
     if (!existsSync(configPath)) {
       if (!this.global) return;
       mkdirSync(this.stateRoot, { recursive: true });
       const fresh = { dependencies: [ref] };
-      if (limit) this.setEntryHarnessRow(fresh, ref, limit);
+      if (requested) this.setEntryHarnessRow(fresh, ref, requested);
       writeFileSync(configPath, stringify(fresh, { lineWidth: 120 }));
       return;
     }
     const raw = parse(readFileSync(configPath, "utf8")) ?? {};
     if (!Array.isArray(raw.dependencies)) raw.dependencies = [];
     const deps = raw.dependencies;
+    const limit = requested ? only ? requested : this.widenedHarnessRow(
+      raw,
+      ref,
+      requested,
+      deps.some((d) => this.sameDeclaredAsset(d, ref))
+    ) : void 0;
     const limitChanged = this.global ? this.setEntryHarnessRow(raw, ref, limit) : false;
     if (deps.includes(ref) && deps.filter((d) => this.sameDeclaredAsset(d, ref)).length === 1) {
       if (limitChanged) writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
@@ -7821,6 +9166,6 @@ Nothing was changed. Declare it again to keep it, or run \`skaile install --forc
   }
 };
 
-export { AssetManager, FACTORY_SOURCE_URL, LibraryEntryError, MissingManifestError, installAgentInstances, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, softDepName };
-//# sourceMappingURL=chunk-OAHVKSQJ.js.map
-//# sourceMappingURL=chunk-OAHVKSQJ.js.map
+export { AssetManager, LibraryEntryError, MissingManifestError, installAgentInstances, labelDiffHeaders, mcpNotRunnableReason, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, setLibraryAssetCheck, setRenamedEntryLookup, softDepName };
+//# sourceMappingURL=chunk-PKBLJI23.js.map
+//# sourceMappingURL=chunk-PKBLJI23.js.map