agentwheel 0.20.0 → 0.20.2

package/dist/index.js

@@ -9,6 +9,8 @@ import {
   canonicalizeGraphLock,
   claudeInstructionBridgesAgents,
   combineMergeRemovals,
+  commitManifestMetadataJournal,
+  computeInstallManifestInventoryRevision,
   computeManifestRevision,
   computeTargetFingerprint,
   desiredManagedInstructionBlockHash,
@@ -19,6 +21,7 @@ import {
   managedInstructionBlockMode,
   managedInstructionPhysicalKey,
   managedInstructionSelector,
+  mergeContributionAbsent,
   mergeRemovalForInstall,
   normalizeImmutableCacheIdentity,
   normalizeOwners,
@@ -30,7 +33,7 @@ import {
   uninstall,
   withManifestRevision,
   writeInstallManifest
-} from "./chunk-USHT7FGV.js";
+} from "./chunk-BAJEWUI6.js";
 import {
   CURRENT_WORKSPACE_SCHEMA_VERSION,
   GovernedMutation,
@@ -38,6 +41,7 @@ import {
   acquireApplyLock,
   adapterSchema,
   adapterTargetSupport,
+  applyLockPath,
   artifactFormatSchema,
   artifactTypeSchema,
   assertGovernedRuntimeTransportSupported,
@@ -53,9 +57,12 @@ import {
   installRootForAdapterInstallationType,
   installRootForArtifacts,
   isCompositeWorkspaceProfile,
+  listAllApplyJournals,
+  listApplyJournals,
   listMutationReceipts,
   loadAdapterConfig,
   localTransport,
+  mutationMetadataForApplyJournal,
   mutationPolicyForWorkspace,
   packageAssetSchema,
   packageComposeEntrySchema,
@@ -85,8 +92,9 @@ import {
   workspaceConfigSchema,
   workspaceExportsSchema,
   workspaceSelectionImportSchema,
+  writeApplyJournal,
   writeWorkspaceConfig
-} from "./chunk-HOYIIUL5.js";
+} from "./chunk-Z4N7TB6Q.js";
 import {
   inferSourceDriverName
 } from "./chunk-EMDIG24I.js";
@@ -101,11 +109,11 @@ import {
 } from "./chunk-7VPI5J5Y.js";
 
 // src/cli/index.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import { existsSync } from "fs";
 import { mkdir as mkdir16, rm as rm10, writeFile as writeFile13 } from "fs/promises";
 import { homedir as homedir12 } from "os";
-import { dirname as dirname22, join as join45, resolve as resolve23 } from "path";
+import { dirname as dirname22, join as join45, resolve as resolve24 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { Command } from "commander";
 
@@ -1449,6 +1457,7 @@ async function createCombinedInstallPlan(desiredArtifacts, adapter, targetRoot,
   const installationType = resolveInstallationTypeForArtifacts(adapter, installableArtifacts.map((artifact) => artifact.type), requestedInstallationType);
   const installRoot = installRootForArtifacts(adapter, targetRoot, installationType, installableArtifacts.map((artifact) => artifact.type), transport.kind === "ssh");
   await validateArtifactsForInstall(installableArtifacts, adapter, installationType);
+  const runtimeStateRevision = await computeInstallManifestInventoryRevision(installRoot, adapter.name, transport);
   for (const artifact of installableArtifacts) {
     if (artifact.meta.dependencyRole !== "root" && isGuardedMergeTarget(artifact.type)) {
       throw new Error(`Dependency-provided ${artifact.type} artifacts cannot be installed until per-subentry ownership exists: ${artifact.type}/${artifact.name}`);
@@ -1462,7 +1471,7 @@ async function createCombinedInstallPlan(desiredArtifacts, adapter, targetRoot,
     }
   }
   await addProgrammaticOperations(desired, adapter, installRoot);
-  return createPlanFromOperations(desired, adapter, installRoot, manifest, transport, { ...options, installationType });
+  return createPlanFromOperations(desired, adapter, installRoot, manifest, transport, { ...options, installationType, runtimeStateRevision });
 }
 async function createPlanFromOperations(desiredOps, adapter, targetRoot, manifest, transport, options) {
   const workspaceOwner = options.workspaceOwner;
@@ -1512,7 +1521,7 @@ async function createPlanFromOperations(desiredOps, adapter, targetRoot, manifes
         }
       }
       const incompleteMergeOwnership = existing2 && existing2.mergeStrategy && !("mergeCreatedDestination" in existing2 && existing2.mergeCreatedDestination === true) && !("mergeRemoval" in existing2 && hasMergeRemovalContent(existing2.mergeRemoval));
-      const adoptExisting = exists2 && (!existing2 || incompleteMergeOwnership) && options.forceConflict === true;
+      const adoptExisting = exists2 && (incompleteMergeOwnership || !existing2 && options.forceConflict === true);
       let mergeRemoval;
       try {
         mergeRemoval = await mergeRemovalForInstall(op.sourcePath, op.mergeStrategy, currentContent, {
@@ -1544,7 +1553,7 @@ async function createPlanFromOperations(desiredOps, adapter, targetRoot, manifes
           mergeCreatedDestination: existing2?.mergeCreatedDestination,
           currentHash: currentHash2,
           manifestHash: existing2?.hash,
-          reason: existing2 ? "force repairing exact incomplete merge ownership" : "force adopting exact unmanaged merge contribution"
+          reason: existing2 ? "repairing exact incomplete merge ownership" : "force adopting exact unmanaged merge contribution"
         });
         continue;
       }
@@ -1684,6 +1693,10 @@ async function createPlanFromOperations(desiredOps, adapter, targetRoot, manifes
   }
   for (const operation of operations) assertOperationContained(operation, targetRoot);
   operations.sort((a, b) => a.relativeDestPath.localeCompare(b.relativeDestPath));
+  const runtimeStateRevision = await computeInstallManifestInventoryRevision(targetRoot, adapter.name, transport);
+  if (options.runtimeStateRevision && runtimeStateRevision !== options.runtimeStateRevision) {
+    throw new Error("Runtime manifest inventory changed during planning; replan needed.");
+  }
   return {
     adapter: adapter.name,
     installationType: options.installationType ?? defaultInstallationType,
@@ -1692,6 +1705,7 @@ async function createPlanFromOperations(desiredOps, adapter, targetRoot, manifes
     operations,
     hasBlockingChanges: operations.some((op) => op.action === "drift" || op.action === "conflict"),
     baseRevision: options.baseRevision ?? manifest?.revision ?? null,
+    runtimeStateRevision,
     migrationReport: migration.report,
     graphLockDigest: options.graphLockDigest,
     adapterCode: adapter.programmatic ? { modulePath: adapter.programmatic.modulePath, hash: adapter.programmatic.hash } : void 0,
@@ -2182,6 +2196,7 @@ function isPendingInstallOperation(operation) {
 // src/install/uninstall.ts
 import { join as join13 } from "path";
 async function createUninstallPlan(manifest, transport = localTransport) {
+  const runtimeStateRevision = await computeInstallManifestInventoryRevision(manifest.targetRoot, manifest.adapter, transport);
   const operations = [];
   for (const entry of manifest.entries) {
     const semanticPlugin = "semanticPlugin" in entry ? entry.semanticPlugin : void 0;
@@ -2237,6 +2252,9 @@ async function createUninstallPlan(manifest, transport = localTransport) {
     }
   }
   operations.sort((a, b) => a.relativeDestPath.localeCompare(b.relativeDestPath));
+  if (runtimeStateRevision !== await computeInstallManifestInventoryRevision(manifest.targetRoot, manifest.adapter, transport)) {
+    throw new Error("Runtime manifest inventory changed during uninstall planning; replan needed.");
+  }
   return {
     adapter: manifest.adapter,
     installationType: "installationType" in manifest ? manifest.installationType : defaultInstallationType,
@@ -2245,10 +2263,12 @@ async function createUninstallPlan(manifest, transport = localTransport) {
     operations,
     hasBlockingChanges: operations.some((operation) => operation.action === "conflict"),
     baseRevision: manifest.revision,
+    runtimeStateRevision,
     adapterCode: manifest.adapterCode
   };
 }
 async function createOwnershipUninstallPlan(manifest, remainingDesired, adapter, transport = localTransport, options = {}) {
+  const runtimeStateRevision = await computeInstallManifestInventoryRevision(manifest.targetRoot, manifest.adapter, transport);
   const installationType = "installationType" in manifest ? manifest.installationType : defaultInstallationType;
   const stateKey = "stateKey" in manifest ? manifest.stateKey : void 0;
   const desiredPlan = await createCombinedInstallPlan(remainingDesired, adapter, manifest.targetRoot, void 0, transport, { installationType, stateKey });
@@ -2338,6 +2358,9 @@ async function createOwnershipUninstallPlan(manifest, remainingDesired, adapter,
     }
   }
   operations.sort((a, b) => a.relativeDestPath.localeCompare(b.relativeDestPath));
+  if (runtimeStateRevision !== await computeInstallManifestInventoryRevision(manifest.targetRoot, manifest.adapter, transport)) {
+    throw new Error("Runtime manifest inventory changed during ownership uninstall planning; replan needed.");
+  }
   return {
     adapter: manifest.adapter,
     installationType,
@@ -2346,6 +2369,7 @@ async function createOwnershipUninstallPlan(manifest, remainingDesired, adapter,
     operations,
     hasBlockingChanges: operations.some((operation) => operation.action === "conflict"),
     baseRevision: manifest.revision,
+    runtimeStateRevision,
     adapterCode: manifest.adapterCode,
     graphLockDigest: options.graphLockDigest
   };
@@ -3083,14 +3107,14 @@ async function writeMermaidAsset(response) {
     "content-type": "application/javascript; charset=utf-8",
     "cache-control": "public, max-age=3600"
   });
-  await new Promise((resolve24) => {
+  await new Promise((resolve25) => {
     const stream = createReadStream(assetPath);
     stream.on("error", () => {
       if (!response.headersSent) writeText(response, 404, "Mermaid asset unavailable.\n");
       else response.destroy();
-      resolve24();
+      resolve25();
     });
-    stream.on("end", resolve24);
+    stream.on("end", resolve25);
     stream.pipe(response);
   });
 }
@@ -3117,14 +3141,14 @@ function escapeHtml2(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
 function listen(server, port, bind) {
-  return new Promise((resolve24, reject) => {
+  return new Promise((resolve25, reject) => {
     const onError = (error) => {
       server.off("listening", onListening);
       reject(error);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve24();
+      resolve25();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -3132,7 +3156,7 @@ function listen(server, port, bind) {
   });
 }
 function waitForShutdown(server, beforeClose) {
-  return new Promise((resolve24) => {
+  return new Promise((resolve25) => {
     let closing = false;
     const shutdown = () => {
       if (closing) return;
@@ -3140,7 +3164,7 @@ function waitForShutdown(server, beforeClose) {
       process.off("SIGINT", shutdown);
       process.off("SIGTERM", shutdown);
       beforeClose();
-      server.close(() => resolve24());
+      server.close(() => resolve25());
     };
     process.once("SIGINT", shutdown);
     process.once("SIGTERM", shutdown);
@@ -3150,7 +3174,7 @@ function waitForShutdown(server, beforeClose) {
       process.off("SIGINT", shutdown);
       process.off("SIGTERM", shutdown);
       beforeClose();
-      resolve24();
+      resolve25();
     });
   });
 }
@@ -3703,7 +3727,7 @@ async function fetchClawHubPackage(fetchImpl, packageName) {
   throw new Error(`ClawHub lookup failed for ${packageName}`);
 }
 async function delay(ms) {
-  await new Promise((resolve24) => setTimeout(resolve24, ms));
+  await new Promise((resolve25) => setTimeout(resolve25, ms));
 }
 function parseClawHubSource(source) {
   if (!source.startsWith(sourcePrefix)) {
@@ -3874,7 +3898,7 @@ async function withGitCacheMaintenanceLock(cacheRoot, timeoutMs, fn) {
       if (Date.now() - started > timeoutMs) {
         throw new Error(`Timed out waiting for git cache maintenance lock at ${lockPath}`);
       }
-      await new Promise((resolve24) => setTimeout(resolve24, 50));
+      await new Promise((resolve25) => setTimeout(resolve25, 50));
     }
   }
   try {
@@ -6665,8 +6689,8 @@ function verifyIntegrity(integrity, sourceHash, label) {
 async function withCachePathLock(path, fn) {
   const previous = cacheLocks.get(path) ?? Promise.resolve();
   let release = () => void 0;
-  const current = previous.then(() => new Promise((resolve24) => {
-    release = resolve24;
+  const current = previous.then(() => new Promise((resolve25) => {
+    release = resolve25;
   }));
   cacheLocks.set(path, current);
   await previous;
@@ -6742,8 +6766,8 @@ function detectDirectCollisions(nodes) {
   }
 }
 function graphNodeId(name, version, normalizedSource, resolvedCommit, sourceHash) {
-  const digest = createHash6("sha256").update(normalizedSource).update("\0").update(resolvedCommit ?? sourceHash).digest("hex").slice(0, 12);
-  return `${name}@${version}+${digest}`;
+  const digest2 = createHash6("sha256").update(normalizedSource).update("\0").update(resolvedCommit ?? sourceHash).digest("hex").slice(0, 12);
+  return `${name}@${version}+${digest2}`;
 }
 function sortedUnique2(values) {
   return [...new Set(values)].sort((a, b) => a.localeCompare(b));
@@ -6914,7 +6938,7 @@ import { rm as rm7 } from "fs/promises";
 // src/lifecycle/source-plan.ts
 import { createHash as createHash8 } from "crypto";
 import { mkdir as mkdir14 } from "fs/promises";
-import { dirname as dirname17, join as join33, resolve as resolve14 } from "path";
+import { dirname as dirname17, join as join33, resolve as resolve15 } from "path";
 
 // src/resolve/graph-diff.ts
 function diffGraphLocks(previous, next) {
@@ -7735,6 +7759,185 @@ async function createExactMcpRetirementPlan(desiredArtifacts, adapter, targetRoo
   };
 }
 
+// src/model/fleet.ts
+import { lstat as lstat2, readFile as readFile20, realpath } from "fs/promises";
+import { homedir as homedir7 } from "os";
+import { isAbsolute as isAbsolute2, relative as relative7, resolve as resolve14 } from "path";
+async function resolveWorkspaceScope(request = {}) {
+  const selected = [request.user === true, request.local === true, request.fleet !== void 0].filter(Boolean).length;
+  if (selected > 1) {
+    throw new Error("Choose exactly one workspace selector: --user, --local, or --fleet <id>.");
+  }
+  const globalRoot = resolve14(request.globalRoot ?? homedir7());
+  if (request.user) {
+    const config2 = await readWorkspaceConfig(globalRoot);
+    assertNonFleetScope("user", config2);
+    return { kind: "user", root: globalRoot, config: config2 };
+  }
+  if (request.fleet !== void 0) {
+    const id = fleetIdSchema.parse(request.fleet);
+    const registration = await showRegisteredFleet(id, { globalRoot });
+    const root = await assertCanonicalDirectory(registration.root, `Registered fleet '${id}' root`);
+    const config2 = await readRequiredConfig(root, `fleet '${id}'`);
+    assertFleetContract(id, registration, config2);
+    return { kind: "fleet", root, fleetId: id, config: config2 };
+  }
+  const cwd = resolve14(request.cwd ?? process.cwd());
+  const discoveredRoot = await findExistingWorkspaceRoot(cwd);
+  if (!discoveredRoot || discoveredRoot === globalRoot) {
+    if (request.local === true && cwd !== globalRoot) {
+      return { kind: "local", root: cwd, config: await readWorkspaceConfig(cwd) };
+    }
+    throw missingScopeError(request.local === true ? "local" : "implicit local");
+  }
+  const config = await readRequiredConfig(discoveredRoot, "local");
+  assertNonFleetScope("local", config);
+  return { kind: "local", root: discoveredRoot, config };
+}
+async function registerFleet(request) {
+  const id = fleetIdSchema.parse(request.id);
+  const requiredPackages = sortedUnique4(request.requiredPackages);
+  if (requiredPackages.length === 0) throw new Error("Fleet registration requires at least one --required-package <name>.");
+  const globalRoot = resolve14(request.globalRoot ?? homedir7());
+  const home = await readWorkspaceConfig(globalRoot);
+  if (supportsFleetConfig(home) && home.fleetId) {
+    throw new Error(`The home config is fleet '${home.fleetId}', so it cannot own the global fleet registry.`);
+  }
+  const existing = supportsFleetConfig(home) ? await canonicalizeExistingFleetRoots(home.fleets, globalRoot) : {};
+  if (existing[id]) throw new Error(`Fleet '${id}' is already registered.`);
+  const root = await assertCanonicalDirectory(request.root, `Fleet '${id}' root`);
+  const duplicateRoot = Object.entries(existing).find(([, value]) => value.root === root);
+  if (duplicateRoot) throw new Error(`Fleet root ${root} is already registered as '${duplicateRoot[0]}'.`);
+  if (root === globalRoot) throw new Error("A fleet root must be outside the user config root contract.");
+  const target = await readRequiredConfig(root, `fleet '${id}'`);
+  const registration = registeredFleetSchema.parse({ root, requiredPackages });
+  assertFleetContract(id, registration, target);
+  const upgraded = workspaceConfigSchema.parse({
+    ...home,
+    schemaVersion: CURRENT_WORKSPACE_SCHEMA_VERSION,
+    exports: home.schemaVersion >= 2 ? home.exports : { selections: {} },
+    fleets: { ...existing, [id]: registration }
+  });
+  const configPath = globalWorkspaceConfigPath(globalRoot);
+  declareMutationPath(configPath);
+  await writeJsonAtomic(configPath, upgraded);
+  return { id, ...registration };
+}
+async function canonicalizeExistingFleetRoots(fleets, globalRoot) {
+  const canonical = /* @__PURE__ */ new Map();
+  const normalized = {};
+  for (const [id, registration] of Object.entries(fleets).sort(([a], [b]) => a.localeCompare(b))) {
+    const root = await canonicalizeDirectory(registration.root, `Registered fleet '${id}' root`);
+    if (root === globalRoot) throw new Error(`Registered fleet '${id}' root must be outside the user config root contract.`);
+    const incumbent = canonical.get(root);
+    if (incumbent) {
+      throw new Error(`Fleet root ${root} is registered more than once as '${incumbent}' and '${id}'.`);
+    }
+    canonical.set(root, id);
+    normalized[id] = registeredFleetSchema.parse({ ...registration, root });
+  }
+  return normalized;
+}
+async function listRegisteredFleets(options = {}) {
+  const globalRoot = resolve14(options.globalRoot ?? homedir7());
+  const home = await readWorkspaceConfig(globalRoot);
+  if (!supportsFleetConfig(home)) return [];
+  return Object.entries(home.fleets).sort(([a], [b]) => a.localeCompare(b)).map(([id, registration]) => ({ id, ...registration }));
+}
+async function showRegisteredFleet(idInput, options = {}) {
+  const id = fleetIdSchema.parse(idInput);
+  const fleets = await listRegisteredFleets(options);
+  const registration = fleets.find((candidate) => candidate.id === id);
+  if (!registration) {
+    throw new Error(`Unknown fleet '${id}'. Use 'agentwheel fleet list' or register it with 'agentwheel fleet register'.`);
+  }
+  return registration;
+}
+async function resolveWorkspaceOwnershipScope(workspaceRootInput, options = {}) {
+  const workspaceRoot = await canonicalizeDirectory(resolve14(workspaceRootInput), "Workspace ownership root");
+  if (options.fleetId) {
+    return { root: workspaceRoot, fleetId: fleetIdSchema.parse(options.fleetId) };
+  }
+  const syntacticallyContaining = (await listRegisteredFleets({ globalRoot: options.globalRoot })).filter((fleet2) => containsPath(resolve14(fleet2.root), workspaceRoot));
+  const registered = await Promise.all(syntacticallyContaining.map(async (fleet2) => ({
+    ...fleet2,
+    root: await canonicalizeDirectory(fleet2.root, `Registered fleet '${fleet2.id}' root`)
+  })));
+  const containing = registered.filter((fleet2) => containsPath(fleet2.root, workspaceRoot));
+  if (containing.length > 1) {
+    throw new Error(
+      `Workspace ${workspaceRoot} is contained by multiple registered fleets: ` + containing.map((fleet2) => `'${fleet2.id}' at ${fleet2.root}`).join(", ") + ". Resolve the overlapping registrations before planning ownership."
+    );
+  }
+  const fleet = containing[0];
+  if (fleet) assertFleetContract(fleet.id, fleet, await readRequiredConfig(fleet.root, `fleet '${fleet.id}'`));
+  return fleet ? { root: fleet.root, fleetId: fleet.id } : { root: workspaceRoot };
+}
+async function readRequiredConfig(root, label) {
+  const path = workspaceConfigPath(root);
+  if (!await pathExists(path)) throw missingScopeError(label);
+  try {
+    return workspaceConfigSchema.parse(JSON.parse(await readFile20(path, "utf8")));
+  } catch (error) {
+    throw new Error(`Invalid ${label} Agentwheel config at ${path}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function assertFleetContract(id, registration, config) {
+  if (!supportsFleetConfig(config)) {
+    throw new Error(`Fleet '${id}' config must use schemaVersion 3 or newer before registration or selection.`);
+  }
+  if (config.fleetId !== id) {
+    throw new Error(`Fleet fleetId mismatch: expected '${id}', found '${config.fleetId ?? "missing"}'.`);
+  }
+  if (Object.keys(config.fleets).length > 0) {
+    throw new Error(`Fleet '${id}' config may not contain the home fleets registry.`);
+  }
+  const names = new Set(config.packages.map((pkg) => pkg.name));
+  for (const packageName of registration.requiredPackages) {
+    if (!names.has(packageName)) throw new Error(`Fleet '${id}' is missing required package '${packageName}'.`);
+  }
+}
+async function assertCanonicalDirectory(input, label) {
+  const canonical = await canonicalizeDirectory(input, label);
+  const normalized = resolve14(input);
+  const stats = await lstat2(input);
+  if (stats.isSymbolicLink() || canonical !== normalized || input !== normalized) {
+    throw new Error(`${label} must be canonical and symlink-unambiguous: ${input} resolves to ${canonical}.`);
+  }
+  return canonical;
+}
+async function canonicalizeDirectory(input, label) {
+  if (!isAbsolute2(input)) throw new Error(`${label} must be an absolute canonical path.`);
+  let canonical;
+  try {
+    canonical = await realpath(input);
+  } catch {
+    throw new Error(`${label} does not exist: ${input}`);
+  }
+  const stats = await lstat2(canonical);
+  if (!stats.isDirectory()) throw new Error(`${label} is not a directory: ${input}`);
+  return canonical;
+}
+function missingScopeError(label) {
+  return new Error(
+    `Missing ${label} Agentwheel workspace config. Select --user, --local, or --fleet <id>, or run 'agentwheel init workspace' in the intended local root. Agentwheel never falls back to home desired state.`
+  );
+}
+function assertNonFleetScope(kind, config) {
+  if (supportsFleetConfig(config) && config.fleetId) {
+    throw new Error(
+      `The ${kind} config declares fleetId '${config.fleetId}'. Select it through the registered --fleet <id> scope.`
+    );
+  }
+}
+function sortedUnique4(values) {
+  return [...new Set(values.map((value) => value.trim()).filter(Boolean))].sort((a, b) => a.localeCompare(b));
+}
+function containsPath(parent, candidate) {
+  const path = relative7(parent, candidate);
+  return path === "" || !path.startsWith("..") && !isAbsolute2(path);
+}
+
 // src/lifecycle/source-plan.ts
 async function createGraphSourcePlan(options) {
   if (options.roots.length === 0) {
@@ -7813,7 +8016,11 @@ async function createGraphSourcePlan(options) {
   const graphLockDigest = digestGraphLock(bundle.graphLock);
   const graphDiff = diffGraphLocks(previousLock, bundle.graphLock);
   const manifest = await readInstallManifest(resolvedInstallRoot, options.adapter.name, transport, { installationType: resolvedInstallationType, stateKey });
-  const workspaceOwner = workspaceOwnerForRoot(workspaceRoot, options.fleetId);
+  const ownership = await resolveWorkspaceOwnershipScope(workspaceRoot, {
+    fleetId: options.fleetId,
+    globalRoot: options.globalRoot
+  });
+  const workspaceOwner = workspaceOwnerForRoot(ownership.root, ownership.fleetId);
   const plan = options.retireExactMcp ? await createExactMcpRetirementPlan(
     desiredArtifacts,
     options.adapter,
@@ -7847,7 +8054,8 @@ async function createGraphSourcePlan(options) {
       workspaceOwner,
       globalRoot: options.globalRoot,
       stateKey,
-      plannedPaths: plan.operations.map((operation) => operation.relativeDestPath)
+      plannedPaths: plan.operations.map((operation) => operation.relativeDestPath),
+      plannedOperations: plan.operations
     });
   }
   return {
@@ -7874,7 +8082,8 @@ async function assertNoForeignWorkspaceStateForPlan(plan, options) {
     workspaceOwner: options.workspaceOwner,
     globalRoot: options.globalRoot,
     stateKey: plan.stateKey,
-    plannedPaths: options.plannedPaths ?? plan.operations.map((operation) => operation.relativeDestPath)
+    plannedPaths: options.plannedPaths ?? plan.operations.map((operation) => operation.relativeDestPath),
+    plannedOperations: plan.operations
   });
 }
 function graphLockPathForTarget(workspaceRoot, targetKey2, adapter, targetFingerprintParts2) {
@@ -7924,8 +8133,15 @@ var workspaceOwnerPrefix2 = "workspace-root:";
 async function assertNoForeignWorkspaceState(check) {
   const planned = new Set(check.plannedPaths);
   if (planned.size === 0) return;
+  const plannedOperations = /* @__PURE__ */ new Map();
+  for (const operation of check.plannedOperations) {
+    if (!planned.has(operation.relativeDestPath)) continue;
+    const operations = plannedOperations.get(operation.relativeDestPath) ?? [];
+    operations.push(operation);
+    plannedOperations.set(operation.relativeDestPath, operations);
+  }
   const manifests = await listInstallManifests(check.installRoot, check.adapter, check.transport);
-  const root = resolve14(check.workspaceRoot);
+  const root = resolve15(check.workspaceRoot);
   const ownsSubWorkspaces = root !== globalConfigRoot(check.globalRoot);
   const foreign = [];
   for (const entry of manifests) {
@@ -7937,7 +8153,15 @@ async function assertNoForeignWorkspaceState(check) {
       if (ownedByWorkspace(owner, check.workspaceOwner, root, ownsSubWorkspaces)) continue;
       const bucket = byOwner.get(owner) ?? { entryCount: 0, collidingPaths: [] };
       bucket.entryCount += 1;
-      if (planned.has(manifestEntry.path)) bucket.collidingPaths.push(manifestEntry.path);
+      if (planned.has(manifestEntry.path) && !await isDisjointVerifiedMergeContribution(
+        check,
+        manifestEntry.path,
+        manifestEntry.mergeStrategy,
+        manifestEntry.mergeRemoval,
+        plannedOperations.get(manifestEntry.path) ?? []
+      )) {
+        bucket.collidingPaths.push(manifestEntry.path);
+      }
       byOwner.set(owner, bucket);
     }
     for (const [owner, bucket] of byOwner) {
@@ -7959,6 +8183,34 @@ async function assertNoForeignWorkspaceState(check) {
     parseWorkspaceOwner(check.workspaceOwner)?.fleetId ? "Reconcile the owners with an explicit agentwheel fleet normalize operation before planning this fleet." : "Re-run from the owning workspace, or pass --force-foreign-state to plan against it anyway."
   ].join("\n"));
 }
+async function isDisjointVerifiedMergeContribution(check, relativePath, foreignStrategy, foreignRemoval, operations) {
+  if (!foreignStrategy || !hasMergeRemovalContent(foreignRemoval) || operations.length !== 1) return false;
+  const operation = operations[0];
+  if (operation.mergeStrategy !== foreignStrategy || !hasMergeRemovalContent(operation.mergeRemoval)) return false;
+  if (!disjointMcpMergeContributions(foreignStrategy, foreignRemoval, operation.mergeRemoval)) return false;
+  try {
+    const content = await check.transport.readFile(join33(check.installRoot, relativePath));
+    assertExactMergeContribution(foreignRemoval, foreignStrategy, content);
+    assertExactMergeContribution(operation.mergeRemoval, foreignStrategy, content);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function disjointMcpMergeContributions(strategy, left, right) {
+  const leftNames = mcpServerNames(strategy, left);
+  const rightNames = mcpServerNames(strategy, right);
+  if (!leftNames || !rightNames) return false;
+  return [...leftNames].every((name) => !rightNames.has(name));
+}
+function mcpServerNames(strategy, removal) {
+  if (strategy !== "codex-toml-mcp" && strategy !== "json-deep") return void 0;
+  const keys = Object.keys(removal);
+  if (strategy === "json-deep" && (keys.length !== 1 || keys[0] !== "mcpServers")) return void 0;
+  const servers = removal.mcpServers ?? (strategy === "codex-toml-mcp" ? removal : void 0);
+  if (!servers || Array.isArray(servers) || typeof servers !== "object") return void 0;
+  return new Set(Object.keys(servers));
+}
 function globalConfigRoot(globalRoot) {
   return dirname17(dirname17(globalWorkspaceConfigPath(globalRoot)));
 }
@@ -8031,17 +8283,17 @@ function selectionImportKey2(selection) {
     exportHash: selection.exportHash,
     exportName: selection.exportName,
     extends: selection.extends,
-    inherited: sortedUnique4(selection.inherited),
-    additions: sortedUnique4(selection.additions),
-    exclusions: sortedUnique4(selection.exclusions),
-    effective: sortedUnique4(selection.effective)
+    inherited: sortedUnique5(selection.inherited),
+    additions: sortedUnique5(selection.additions),
+    exclusions: sortedUnique5(selection.exclusions),
+    effective: sortedUnique5(selection.effective)
   });
 }
-function sortedUnique4(values) {
+function sortedUnique5(values) {
   return [...new Set(values)].sort((a, b) => a.localeCompare(b));
 }
 function selectorKey(selectors) {
-  return sortedUnique4(selectors).join("\0");
+  return sortedUnique5(selectors).join("\0");
 }
 async function assertTrusted(sources, options) {
   if (sources.length === 0) return;
@@ -8102,7 +8354,7 @@ function targetLabel(target) {
 }
 
 // src/runtime/target.ts
-import { basename as basename18, dirname as dirname18, join as join34, resolve as resolve15 } from "path";
+import { basename as basename18, dirname as dirname18, join as join34, resolve as resolve16 } from "path";
 var runtimeMarkers = [
   { adapter: "openclaw", dirs: [".openclaw", ".clawdbot", ".moltbot"] },
   { adapter: "claude", dirs: [".claude"] },
@@ -8111,9 +8363,9 @@ var runtimeMarkers = [
   { adapter: "copilot", dirs: [".github"] }
 ];
 async function resolveRuntimeTarget(request = {}) {
-  const cwd = resolve15(request.cwd ?? process.cwd());
+  const cwd = resolve16(request.cwd ?? process.cwd());
   if (request.targetRoot) {
-    const targetRoot = resolve15(request.targetRoot);
+    const targetRoot = resolve16(request.targetRoot);
     return {
       adapter: request.adapter ?? "openclaw",
       installationType: request.installationType,
@@ -8145,7 +8397,7 @@ async function resolveRuntimeTarget(request = {}) {
 async function resolveAllRuntimeTargets(request = {}) {
   if (request.targetRoot) return [await resolveRuntimeTarget(request)];
   if (request.agent) return [await resolveRuntimeTarget(request)];
-  const cwd = resolve15(request.cwd ?? process.cwd());
+  const cwd = resolve16(request.cwd ?? process.cwd());
   const workspaceRoot = await findWorkspaceRoot(cwd);
   const config = await readMergedWorkspaceConfig(workspaceRoot, { globalRoot: request.globalRoot });
   const targets = Object.entries(config.agents).map(([name]) => targetFromAgent(name, config, workspaceRoot, request.installationType, request.fleetId));
@@ -8155,8 +8407,8 @@ async function resolveAllRuntimeTargets(request = {}) {
   return targets;
 }
 async function resolveProfileRuntimeTargets(request) {
-  const cwd = resolve15(request.cwd ?? process.cwd());
-  const workspaceRoot = request.targetRoot ? resolve15(request.targetRoot) : await findWorkspaceRoot(cwd);
+  const cwd = resolve16(request.cwd ?? process.cwd());
+  const workspaceRoot = request.targetRoot ? resolve16(request.targetRoot) : await findWorkspaceRoot(cwd);
   const config = await readMergedWorkspaceConfig(workspaceRoot, { globalRoot: request.globalRoot });
   const profile = config.profiles[request.profile];
   if (!profile) {
@@ -8222,7 +8474,7 @@ async function detectRuntimeTarget(cwd = process.cwd(), adapterFilter) {
   return unique[0];
 }
 async function detectRuntimeTargets(cwd = process.cwd(), adapterFilter) {
-  const root = resolve15(cwd);
+  const root = resolve16(cwd);
   const matches = [];
   for (const marker of runtimeMarkers) {
     if (adapterFilter && marker.adapter !== adapterFilter) continue;
@@ -8271,7 +8523,7 @@ function dedupeTargets(matches) {
   return [...byKey.values()];
 }
 function runtimeScanRoot(request) {
-  const root = resolve15(request.targetRoot ?? request.cwd ?? process.cwd());
+  const root = resolve16(request.targetRoot ?? request.cwd ?? process.cwd());
   if (request.targetRoot) return root;
   return runtimeMarkers.some((marker) => marker.dirs.includes(basename18(root))) ? dirname18(root) : root;
 }
@@ -8581,8 +8833,8 @@ function shellQuoteArg(value) {
 }
 
 // src/cli/update-check.ts
-import { mkdir as mkdir15, readFile as readFile20, writeFile as writeFile11 } from "fs/promises";
-import { homedir as homedir7 } from "os";
+import { mkdir as mkdir15, readFile as readFile21, writeFile as writeFile11 } from "fs/promises";
+import { homedir as homedir8 } from "os";
 import { dirname as dirname19, join as join35 } from "path";
 var DEFAULT_TTL_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_TIMEOUT_MS = 300;
@@ -8591,7 +8843,7 @@ async function maybeCheckForUpdate(options) {
   if (isDisabled(options)) return;
   const now = options.now?.() ?? /* @__PURE__ */ new Date();
   const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
-  const cachePath = options.cachePath ?? join35(homedir7(), ".agentwheel", "update-check.json");
+  const cachePath = options.cachePath ?? join35(homedir8(), ".agentwheel", "update-check.json");
   try {
     const cached = await readCache(cachePath);
     if (cached && now.getTime() - Date.parse(cached.checkedAt) < ttlMs) {
@@ -8628,7 +8880,7 @@ async function fetchLatestVersion(fetchImpl, timeoutMs) {
 }
 async function readCache(path) {
   try {
-    const parsed = JSON.parse(await readFile20(path, "utf8"));
+    const parsed = JSON.parse(await readFile21(path, "utf8"));
     if (typeof parsed.checkedAt !== "string" || typeof parsed.latest !== "string") return void 0;
     return { checkedAt: parsed.checkedAt, latest: parsed.latest };
   } catch {
@@ -8660,9 +8912,9 @@ function normalizeVersion(version) {
 
 // src/model/package-validate.ts
 import { stat as stat12 } from "fs/promises";
-import { resolve as resolve16 } from "path";
+import { resolve as resolve17 } from "path";
 async function validatePackage(root) {
-  const packageRoot = resolve16(root);
+  const packageRoot = resolve17(root);
   const findings = [];
   const manifestPath = await findPackageManifestPath(packageRoot);
   if (!manifestPath) {
@@ -8763,7 +9015,7 @@ async function validateManifestComposeInclude(packageRoot, selector, optional, f
   try {
     validateSelector(selector, "compose.include", findings, manifestPath, { fragmentsOnly: true, aliases });
     if (isCrossPackageSelector(selector)) return;
-    const full = resolve16(packageRoot, selector);
+    const full = resolve17(packageRoot, selector);
     if (full !== packageRoot && !full.startsWith(`${packageRoot}/`)) {
       findings.push({ level: "error", message: `Compose include escapes package root: ${selector}`, path: manifestPath });
       return;
@@ -8816,11 +9068,11 @@ function isCrossPackageSelector(value) {
 }
 
 // src/model/package-migrate.ts
-import { readFile as readFile21, rename as rename3, writeFile as writeFile12 } from "fs/promises";
-import { join as join37, resolve as resolve17 } from "path";
+import { readFile as readFile22, rename as rename3, writeFile as writeFile12 } from "fs/promises";
+import { join as join37, resolve as resolve18 } from "path";
 import { applyEdits, modify, parse as parse2 } from "jsonc-parser";
 async function migratePackageManifest(root) {
-  const packageRoot = resolve17(root);
+  const packageRoot = resolve18(root);
   for (const name of openPackManifestNames) {
     const path = join37(packageRoot, name);
     if (await pathExists(path)) {
@@ -8834,7 +9086,7 @@ async function migratePackageManifest(root) {
   const from = join37(packageRoot, legacyName);
   const toName = legacyName.endsWith(".jsonc") ? "openpack.jsonc" : "openpack.json";
   const to = join37(packageRoot, toName);
-  const content = await readFile21(from, "utf8");
+  const content = await readFile22(from, "utf8");
   const updated = updateSchemaVersion(content);
   declareMutationPath(from);
   declareMutationPath(to);
@@ -8882,7 +9134,7 @@ function resolveCliVersion() {
 }
 
 // src/lifecycle/ownership.ts
-import { resolve as resolve18 } from "path";
+import { resolve as resolve19 } from "path";
 async function planArtifactOwnershipHandoff(request) {
   return validateOwnershipHandoff(request, request.transport ?? localTransport);
 }
@@ -8895,7 +9147,9 @@ async function applyArtifactOwnershipHandoff(request) {
   const scope = { installationType: request.installationType, stateKey: request.stateKey };
   const lock = await acquireApplyLock(request.targetRoot, request.adapter, transport, {}, scope);
   try {
-    if (await readApplyJournal(request.targetRoot, request.adapter, transport, scope)) {
+    if ((await listApplyJournals(request.targetRoot, request.adapter, transport, {
+      installationType: request.installationType
+    })).length > 0) {
       throw new Error("Cannot hand off ownership while an apply journal is pending. Recover or abort it first.");
     }
     const plan = await validateOwnershipHandoff(request, transport);
@@ -8997,12 +9251,17 @@ async function verifiedEntryHash(entry, destPath, transport) {
   }
   return currentHash;
 }
+async function verifyManifestEntryRuntime(targetRoot, entry, transport = localTransport) {
+  const path = containedArtifactPath(targetRoot, entry.path);
+  if (!await transport.pathExists(path)) throw new Error(`Managed artifact is missing: ${entry.path}`);
+  return verifiedEntryHash(entry, path, transport);
+}
 function containedArtifactPath(targetRoot, relativePath) {
   if (!relativePath || relativePath.startsWith("/") || relativePath.includes("\0")) {
     throw new Error(`Unsafe managed artifact path: ${relativePath}`);
   }
-  const root = resolve18(targetRoot);
-  const candidate = resolve18(root, relativePath);
+  const root = resolve19(targetRoot);
+  const candidate = resolve19(root, relativePath);
   if (candidate !== root && !candidate.startsWith(`${root}/`)) {
     throw new Error(`Managed artifact path escapes target root: ${relativePath}`);
   }
@@ -9033,10 +9292,246 @@ function assertManifestIdentity(manifest, request) {
   }
 }
 
+// src/lifecycle/ownership-retire-stale.ts
+import { createHash as createHash9 } from "crypto";
+import { resolve as resolve20 } from "path";
+async function planRetireStaleOwnership(request) {
+  return observe(request, request.transport ?? localTransport);
+}
+async function applyRetireStaleOwnership(request) {
+  assertApplyPreconditions(request);
+  const transport = request.transport ?? localTransport;
+  const lock = await acquireApplyLock(request.targetRoot, request.adapter, transport, {}, {
+    installationType: request.installationType,
+    stateKey: request.destinationStateKey
+  });
+  try {
+    const pending = await listAllApplyJournals(request.targetRoot, request.adapter, transport);
+    if (pending.length > 0) {
+      throw new Error(`Cannot retire stale ownership while runtime apply journal(s) are pending: ${pending.map((item) => item.path).join(", ")}`);
+    }
+    const current = await observe(request, transport);
+    assertExpected(request.planDigest, current.planDigest, "plan digest");
+    assertExpected(request.expectedSourceRevision, current.source.revision, "source manifest revision");
+    assertExpected(request.expectedDestinationRevision, current.destination.revision, "destination manifest revision");
+    assertExpected(request.expectedInventoryRevision, current.manifestInventoryRevision, "manifest inventory revision");
+    const source = await requireManifest(request, request.sourceStateKey, transport, "source");
+    const selectedDigests = new Set(current.selected.map((entry) => entry.sourceEntryDigest));
+    const retained = source.entries.filter((entry) => !selectedDigests.has(entryDigest(entry)));
+    if (source.entries.length - retained.length !== current.selected.length) {
+      throw new Error("Source manifest selection changed while locked; replan required.");
+    }
+    declareMutationPath(current.source.manifestPath);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const mutation = mutationMetadataForApplyJournal();
+    const journal = {
+      version: mutation ? 2 : 1,
+      ...mutation ? { mutation } : {},
+      mode: "uninstall",
+      adapter: request.adapter,
+      installationType: request.installationType,
+      stateKey: request.sourceStateKey,
+      targetRoot: request.targetRoot,
+      baseRevision: source.revision,
+      createdAt: now,
+      updatedAt: now,
+      operations: [],
+      completed: [],
+      manifest: { ...source, entries: retained }
+    };
+    await writeApplyJournal(journal, transport);
+    await commitManifestMetadataJournal(journal, transport);
+    return {
+      ...current,
+      applied: true,
+      sourceManifestRemoved: retained.length === 0,
+      retainedSourceEntries: retained.length
+    };
+  } finally {
+    await lock.release();
+  }
+}
+async function observe(request, transport) {
+  const normalized = normalizeRequest(request);
+  const source = await requireManifest(normalized, normalized.sourceStateKey, transport, "source");
+  const destination = await requireManifest(normalized, normalized.destinationStateKey, transport, "destination");
+  const sourceOwner = workspaceOwnerForRoot(normalized.fromWorkspaceRoot);
+  const destinationOwner = workspaceOwnerForRoot(normalized.toWorkspaceRoot, normalized.toFleetId);
+  const destinationByPath = /* @__PURE__ */ new Map();
+  for (const entry of destination.entries) {
+    if (entry.workspaceOwner !== destinationOwner) continue;
+    const entries = destinationByPath.get(entry.path) ?? [];
+    entries.push(entry);
+    destinationByPath.set(entry.path, entries);
+  }
+  const selected = [];
+  for (const sourceEntry of source.entries) {
+    if (sourceEntry.workspaceOwner !== sourceOwner) continue;
+    const candidates = destinationByPath.get(sourceEntry.path) ?? [];
+    if (candidates.length === 0) continue;
+    if (candidates.length !== 1) {
+      throw new Error(`Destination Fleet manifest has ambiguous ownership for ${sourceEntry.path}.`);
+    }
+    assertRetirableSourceEntry(sourceEntry);
+    const destinationEntry = candidates[0];
+    await assertContributionCoverage(sourceEntry, destinationEntry, normalized.targetRoot, transport);
+    const runtimeHash = await verifyManifestEntryRuntime(normalized.targetRoot, destinationEntry, transport);
+    selected.push({
+      path: sourceEntry.path,
+      sourceEntryDigest: entryDigest(sourceEntry),
+      destinationEntryDigest: entryDigest(destinationEntry),
+      runtimeHash
+    });
+  }
+  selected.sort((a, b) => a.path.localeCompare(b.path) || a.sourceEntryDigest.localeCompare(b.sourceEntryDigest) || a.destinationEntryDigest.localeCompare(b.destinationEntryDigest));
+  if (selected.length === 0) {
+    throw new Error("No stale source ownership entries match an exact path in the destination Fleet manifest.");
+  }
+  const withoutDigest = {
+    adapter: normalized.adapter,
+    installationType: normalized.installationType,
+    targetRoot: normalized.targetRoot,
+    source: {
+      stateKey: normalized.sourceStateKey,
+      manifestPath: installManifestPath(normalized.targetRoot, normalized.adapter, {
+        installationType: normalized.installationType,
+        stateKey: normalized.sourceStateKey
+      }),
+      revision: source.revision,
+      owner: sourceOwner
+    },
+    destination: {
+      stateKey: normalized.destinationStateKey,
+      manifestPath: installManifestPath(normalized.targetRoot, normalized.adapter, {
+        installationType: normalized.installationType,
+        stateKey: normalized.destinationStateKey
+      }),
+      revision: destination.revision,
+      owner: destinationOwner,
+      fleetId: normalized.toFleetId
+    },
+    manifestInventoryRevision: await computeInstallManifestInventoryRevision(
+      normalized.targetRoot,
+      normalized.adapter,
+      transport
+    ),
+    selected
+  };
+  return { ...withoutDigest, planDigest: digest(withoutDigest) };
+}
+function normalizeRequest(request) {
+  const targetRoot = resolve20(request.targetRoot);
+  const sourceStateKey = exactStateKey(request.adapter, request.sourceStateKey, request.installationType, "source");
+  const destinationStateKey = exactStateKey(request.adapter, request.destinationStateKey, request.installationType, "destination");
+  if (sourceStateKey === destinationStateKey) throw new Error("Source and destination state keys must differ.");
+  if (!request.toFleetId.trim()) throw new Error("Destination Fleet id is required.");
+  return {
+    ...request,
+    targetRoot,
+    installationType: request.installationType.trim(),
+    sourceStateKey,
+    destinationStateKey,
+    fromWorkspaceRoot: resolve20(request.fromWorkspaceRoot),
+    toWorkspaceRoot: resolve20(request.toWorkspaceRoot),
+    toFleetId: request.toFleetId.trim()
+  };
+}
+function exactStateKey(adapter, value, installationType, label) {
+  if (!value || stateKeyFor(adapter, { installationType, stateKey: value }) !== value) {
+    throw new Error(`The ${label} state key must be an exact canonical state key.`);
+  }
+  return value;
+}
+async function requireManifest(request, stateKey, transport, label) {
+  const manifest = await readInstallManifest(request.targetRoot, request.adapter, transport, {
+    installationType: request.installationType,
+    stateKey
+  });
+  if (!manifest) throw new Error(`No ${label} install manifest for state key ${stateKey}.`);
+  if (manifest.version !== 2) throw new Error(`${label} ownership retirement requires an Agentwheel v2 install manifest.`);
+  const actualStateKey = stateKeyFor(manifest.adapter, {
+    installationType: manifest.installationType,
+    stateKey: manifest.stateKey
+  });
+  if (manifest.adapter !== request.adapter || manifest.installationType !== request.installationType || resolve20(manifest.targetRoot) !== request.targetRoot || actualStateKey !== stateKey) {
+    throw new Error(`${label} install manifest identity does not match the requested adapter, target, installation type, and state key.`);
+  }
+  return manifest;
+}
+function assertRetirableSourceEntry(entry) {
+  if (entry.semanticPlugin || entry.semanticCommand || entry.executed) {
+    throw new Error(`Cannot retire semantic source ownership at ${entry.path}.`);
+  }
+  if (entry.mergeStrategy && !entry.mergeRemoval) {
+    throw new Error(`Cannot retire incomplete merge ownership at ${entry.path}.`);
+  }
+}
+async function assertContributionCoverage(source, destination, targetRoot, transport) {
+  const sourceManagedBlock = source.mode === "managed-block";
+  const destinationManagedBlock = destination.mode === "managed-block";
+  const sourceMerge = source.mergeStrategy !== void 0;
+  const destinationMerge = destination.mergeStrategy !== void 0;
+  const sourceCategory = sourceManagedBlock ? "managed-block" : sourceMerge ? "merge" : "plain";
+  const destinationCategory = destinationManagedBlock ? "managed-block" : destinationMerge ? "merge" : "plain";
+  if (sourceCategory !== destinationCategory) {
+    throw new Error(
+      `Destination Fleet ownership category ${destinationCategory} cannot replace stale source category ${sourceCategory} at ${source.path}.`
+    );
+  }
+  if (sourceCategory === "plain") return;
+  if (sourceManagedBlock) {
+    const sourceSelector = managedInstructionSelector(source.logicalSelector, source.artifactType, source.artifactName);
+    const destinationSelector = managedInstructionSelector(destination.logicalSelector, destination.artifactType, destination.artifactName);
+    if (!sourceManagedBlock || !destinationManagedBlock || sourceSelector !== destinationSelector) {
+      throw new Error(`Destination Fleet does not exactly cover stale source managed block contribution at ${source.path}.`);
+    }
+    return;
+  }
+  if (source.mergeStrategy && destination.mergeStrategy) {
+    if (!source.mergeRemoval) throw new Error(`Cannot retire incomplete merge ownership at ${source.path}.`);
+    const exactlyCovered = destination.mergeStrategy === source.mergeStrategy && destination.mergeRemoval && contributionSelector(source) === contributionSelector(destination) && canonicalJson(source.mergeRemoval) === canonicalJson(destination.mergeRemoval);
+    if (exactlyCovered) return;
+    const current = await transport.readFile(containedArtifactPath(targetRoot, source.path));
+    if (!mergeContributionAbsent(source.mergeRemoval, source.mergeStrategy, current)) {
+      throw new Error(`Destination Fleet does not exactly cover or replace stale source merge contribution at ${source.path}.`);
+    }
+  }
+}
+function contributionSelector(entry) {
+  return entry.logicalSelector ?? `${entry.artifactType}/${entry.artifactName}`;
+}
+function assertApplyPreconditions(request) {
+  for (const [label, value] of [
+    ["plan digest", request.planDigest],
+    ["source manifest revision", request.expectedSourceRevision],
+    ["destination manifest revision", request.expectedDestinationRevision],
+    ["manifest inventory revision", request.expectedInventoryRevision]
+  ]) {
+    if (!value || !/^[a-f0-9]{64}$/.test(value)) {
+      throw new Error(`Applying stale ownership retirement requires a reviewed lowercase SHA-256 ${label}.`);
+    }
+  }
+}
+function assertExpected(expected, current, label) {
+  if (expected !== current) throw new Error(`Stale ${label}: expected ${expected}, found ${current}; replan required.`);
+}
+function entryDigest(entry) {
+  return digest(entry);
+}
+function digest(value) {
+  return createHash9("sha256").update(canonicalJson(value)).digest("hex");
+}
+function canonicalJson(value) {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (!value || typeof value !== "object") return JSON.stringify(value);
+  const record = value;
+  return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+}
+
 // src/version/policy.ts
 import { execFile as execFile3 } from "child_process";
-import { readFile as readFile22 } from "fs/promises";
-import { join as join39, resolve as resolve19 } from "path";
+import { readFile as readFile23 } from "fs/promises";
+import { join as join39, resolve as resolve21 } from "path";
 import { promisify as promisify3 } from "util";
 import { parse as parseJsonc } from "jsonc-parser";
 import { z as z5 } from "zod";
@@ -9130,7 +9625,7 @@ async function discoverVersionsFromSource(pkg, workspaceRoot) {
     if (tagged.length > 0) return tagged;
   }
   if (driverName === "local") {
-    const root = resolve19(workspaceRoot, pkg.source);
+    const root = resolve21(workspaceRoot, pkg.source);
     const manifest2 = await readPackageManifest(root);
     const current = manifest2 ? [{ version: manifest2.version, ref: pkg.requestedRef ?? root }] : [];
     try {
@@ -9244,7 +9739,7 @@ function versionCachePath(workspaceRoot) {
 async function readVersionCache(path) {
   if (!await pathExists(path)) return { schemaVersion: 1, sources: {} };
   try {
-    return versionCacheSchema.parse(JSON.parse(await readFile22(path, "utf8")));
+    return versionCacheSchema.parse(JSON.parse(await readFile23(path, "utf8")));
   } catch {
     return { schemaVersion: 1, sources: {} };
   }
@@ -9252,8 +9747,8 @@ async function readVersionCache(path) {
 
 // src/profile/members.ts
 import { execFile as execFile4 } from "child_process";
-import { readFile as readFile23 } from "fs/promises";
-import { join as join40, resolve as resolve20 } from "path";
+import { readFile as readFile24 } from "fs/promises";
+import { join as join40, resolve as resolve22 } from "path";
 import { promisify as promisify4 } from "util";
 import { z as z7 } from "zod";
 
@@ -9428,7 +9923,7 @@ async function invokeMemberStatus(member, parentWorkspace, chain, options, cliEn
   let stderr = "";
   try {
     if (member.transport === "local") {
-      const workspace = resolve20(parentWorkspace, member.workspace);
+      const workspace = resolve22(parentWorkspace, member.workspace);
       const result = await execFileAsync4(process.execPath, [cliEntry, ...args], {
         cwd: workspace,
         env: env2,
@@ -9474,7 +9969,7 @@ async function runMemberAgentwheel(member, parentWorkspace, args, chain) {
         process.execPath,
         [process.argv[1], "--no-update-check", ...args],
         {
-          cwd: resolve20(parentWorkspace, member.workspace),
+          cwd: resolve22(parentWorkspace, member.workspace),
           env: env2,
           maxBuffer: 20 * 1024 * 1024
         }
@@ -9554,7 +10049,7 @@ function memberCachePath(workspaceRoot, profileName, memberId) {
 async function readMemberCache(path) {
   if (!await pathExists(path)) return void 0;
   try {
-    return memberCacheSchema.parse(JSON.parse(await readFile23(path, "utf8")));
+    return memberCacheSchema.parse(JSON.parse(await readFile24(path, "utf8")));
   } catch {
     return void 0;
   }
@@ -9575,7 +10070,7 @@ function assertNoCompositeCycle(workspaceRoot, profileName, chain) {
   }
 }
 function compositeKey(workspaceRoot, profileName) {
-  return `${resolve20(workspaceRoot)}#${profileName}`;
+  return `${resolve22(workspaceRoot)}#${profileName}`;
 }
 
 // src/status/repository.ts
@@ -9622,9 +10117,9 @@ function valueAfter(lines, prefix) {
 }
 
 // src/catalogue/client.ts
-import { createHash as createHash9 } from "crypto";
-import { readFile as readFile24, rm as rm8 } from "fs/promises";
-import { homedir as homedir8 } from "os";
+import { createHash as createHash10 } from "crypto";
+import { readFile as readFile25, rm as rm8 } from "fs/promises";
+import { homedir as homedir9 } from "os";
 import { join as join41 } from "path";
 
 // src/model/catalogue.ts
@@ -9841,7 +10336,7 @@ var CatalogueClient = class {
   async readCache() {
     if (!await pathExists(this.cachePath)) return void 0;
     try {
-      const value = JSON.parse(await readFile24(this.cachePath, "utf8"));
+      const value = JSON.parse(await readFile25(this.cachePath, "utf8"));
       const envelope = catalogueCacheEnvelopeSchema.parse(value);
       if (envelope.contentHash) {
         const contentHash = catalogueContentHash(envelope.enriched, envelope.vercel);
@@ -9897,18 +10392,18 @@ var CatalogueClient = class {
     }
     return {
       value: schema.parse(value),
-      digest: createHash9("sha256").update(bytes).digest("hex")
+      digest: createHash10("sha256").update(bytes).digest("hex")
     };
   }
 };
 function defaultCatalogueCachePath() {
-  return join41(homedir8(), ".agentwheel", "catalogue-cache.json");
+  return join41(homedir9(), ".agentwheel", "catalogue-cache.json");
 }
 function sameSources2(a, b) {
   return a.length === b.length && a.every((source, index) => source === b[index]);
 }
 function catalogueContentHash(enriched, vercel) {
-  return createHash9("sha256").update(JSON.stringify({ enriched, vercel })).digest("hex");
+  return createHash10("sha256").update(JSON.stringify({ enriched, vercel })).digest("hex");
 }
 
 // src/search/index.ts
@@ -10270,8 +10765,8 @@ function includesToken(normalizedText, token) {
 }
 
 // src/semantic/index.ts
-import { createHash as createHash10 } from "crypto";
-import { homedir as homedir9 } from "os";
+import { createHash as createHash11 } from "crypto";
+import { homedir as homedir10 } from "os";
 import { join as join42 } from "path";
 import { env, pipeline } from "@huggingface/transformers";
 var DEFAULT_SEMANTIC_INDEX_URL = "https://raw.githubusercontent.com/NestDevLab/agentwheel-registry/main/catalogue-semantic-index/gte-v1/";
@@ -10360,13 +10855,13 @@ var SemanticSearchClient = class {
     if (!response.ok) throw new Error(`Semantic index file failed (${response.status}): ${descriptor.path}`);
     const bytes = new Uint8Array(await response.arrayBuffer());
     if (bytes.byteLength !== descriptor.bytes) throw new Error(`Semantic index file size does not match: ${descriptor.path}`);
-    const digest = createHash10("sha256").update(bytes).digest("hex");
-    if (digest !== descriptor.sha256) throw new Error(`Semantic index checksum does not match: ${descriptor.path}`);
+    const digest2 = createHash11("sha256").update(bytes).digest("hex");
+    if (digest2 !== descriptor.sha256) throw new Error(`Semantic index checksum does not match: ${descriptor.path}`);
     return bytes;
   }
 };
 async function embedQuery(query) {
-  env.cacheDir = join42(homedir9(), ".agentwheel", "semantic-models");
+  env.cacheDir = join42(homedir10(), ".agentwheel", "semantic-models");
   const extractor = await pipeline("feature-extraction", CONTRACT.model.id, {
     revision: CONTRACT.model.revision,
     dtype: CONTRACT.model.dtype,
@@ -10450,8 +10945,8 @@ function ensureTrailingSlash(value) {
 }
 
 // src/trial/skill.ts
-import { createHash as createHash11 } from "crypto";
-import { readFile as readFile25, stat as stat13 } from "fs/promises";
+import { createHash as createHash12 } from "crypto";
+import { readFile as readFile26, stat as stat13 } from "fs/promises";
 import { join as join43 } from "path";
 import { parse as parseYaml2 } from "yaml";
 var MAX_TRIAL_SKILL_BYTES = 512 * 1024;
@@ -10469,7 +10964,7 @@ async function createSkillTrial(driver, resolved, selectors) {
   if (info.size > MAX_TRIAL_SKILL_BYTES) {
     throw new Error(`Skill trial exceeds the ${MAX_TRIAL_SKILL_BYTES / 1024} KiB content limit.`);
   }
-  const content = await readFile25(path, "utf8");
+  const content = await readFile26(path, "utf8");
   const frontmatter = readSkillFrontmatter(content, artifact);
   return {
     schemaVersion: 1,
@@ -10480,7 +10975,7 @@ async function createSkillTrial(driver, resolved, selectors) {
     skill: {
       name: artifact.name,
       relativePath: artifact.relativePath,
-      sha256: createHash11("sha256").update(content).digest("hex"),
+      sha256: createHash12("sha256").update(content).digest("hex"),
       frontmatter,
       content
     }
@@ -10498,168 +10993,13 @@ function readSkillFrontmatter(content, artifact) {
   return { name: value.name, description: value.description };
 }
 
-// src/model/fleet.ts
-import { lstat as lstat2, readFile as readFile26, realpath } from "fs/promises";
-import { homedir as homedir10 } from "os";
-import { isAbsolute as isAbsolute2, resolve as resolve21 } from "path";
-async function resolveWorkspaceScope(request = {}) {
-  const selected = [request.user === true, request.local === true, request.fleet !== void 0].filter(Boolean).length;
-  if (selected > 1) {
-    throw new Error("Choose exactly one workspace selector: --user, --local, or --fleet <id>.");
-  }
-  const globalRoot = resolve21(request.globalRoot ?? homedir10());
-  if (request.user) {
-    const config2 = await readWorkspaceConfig(globalRoot);
-    assertNonFleetScope("user", config2);
-    return { kind: "user", root: globalRoot, config: config2 };
-  }
-  if (request.fleet !== void 0) {
-    const id = fleetIdSchema.parse(request.fleet);
-    const registration = await showRegisteredFleet(id, { globalRoot });
-    const root = await assertCanonicalDirectory(registration.root, `Registered fleet '${id}' root`);
-    const config2 = await readRequiredConfig(root, `fleet '${id}'`);
-    assertFleetContract(id, registration, config2);
-    return { kind: "fleet", root, fleetId: id, config: config2 };
-  }
-  const cwd = resolve21(request.cwd ?? process.cwd());
-  const discoveredRoot = await findExistingWorkspaceRoot(cwd);
-  if (!discoveredRoot || discoveredRoot === globalRoot) {
-    if (request.local === true && cwd !== globalRoot) {
-      return { kind: "local", root: cwd, config: await readWorkspaceConfig(cwd) };
-    }
-    throw missingScopeError(request.local === true ? "local" : "implicit local");
-  }
-  const config = await readRequiredConfig(discoveredRoot, "local");
-  assertNonFleetScope("local", config);
-  return { kind: "local", root: discoveredRoot, config };
-}
-async function registerFleet(request) {
-  const id = fleetIdSchema.parse(request.id);
-  const requiredPackages = sortedUnique5(request.requiredPackages);
-  if (requiredPackages.length === 0) throw new Error("Fleet registration requires at least one --required-package <name>.");
-  const globalRoot = resolve21(request.globalRoot ?? homedir10());
-  const home = await readWorkspaceConfig(globalRoot);
-  if (supportsFleetConfig(home) && home.fleetId) {
-    throw new Error(`The home config is fleet '${home.fleetId}', so it cannot own the global fleet registry.`);
-  }
-  const existing = supportsFleetConfig(home) ? await canonicalizeExistingFleetRoots(home.fleets, globalRoot) : {};
-  if (existing[id]) throw new Error(`Fleet '${id}' is already registered.`);
-  const root = await assertCanonicalDirectory(request.root, `Fleet '${id}' root`);
-  const duplicateRoot = Object.entries(existing).find(([, value]) => value.root === root);
-  if (duplicateRoot) throw new Error(`Fleet root ${root} is already registered as '${duplicateRoot[0]}'.`);
-  if (root === globalRoot) throw new Error("A fleet root must be outside the user config root contract.");
-  const target = await readRequiredConfig(root, `fleet '${id}'`);
-  const registration = registeredFleetSchema.parse({ root, requiredPackages });
-  assertFleetContract(id, registration, target);
-  const upgraded = workspaceConfigSchema.parse({
-    ...home,
-    schemaVersion: CURRENT_WORKSPACE_SCHEMA_VERSION,
-    exports: home.schemaVersion >= 2 ? home.exports : { selections: {} },
-    fleets: { ...existing, [id]: registration }
-  });
-  const configPath = globalWorkspaceConfigPath(globalRoot);
-  declareMutationPath(configPath);
-  await writeJsonAtomic(configPath, upgraded);
-  return { id, ...registration };
-}
-async function canonicalizeExistingFleetRoots(fleets, globalRoot) {
-  const canonical = /* @__PURE__ */ new Map();
-  const normalized = {};
-  for (const [id, registration] of Object.entries(fleets).sort(([a], [b]) => a.localeCompare(b))) {
-    const root = await canonicalizeDirectory(registration.root, `Registered fleet '${id}' root`);
-    if (root === globalRoot) throw new Error(`Registered fleet '${id}' root must be outside the user config root contract.`);
-    const incumbent = canonical.get(root);
-    if (incumbent) {
-      throw new Error(`Fleet root ${root} is registered more than once as '${incumbent}' and '${id}'.`);
-    }
-    canonical.set(root, id);
-    normalized[id] = registeredFleetSchema.parse({ ...registration, root });
-  }
-  return normalized;
-}
-async function listRegisteredFleets(options = {}) {
-  const globalRoot = resolve21(options.globalRoot ?? homedir10());
-  const home = await readWorkspaceConfig(globalRoot);
-  if (!supportsFleetConfig(home)) return [];
-  return Object.entries(home.fleets).sort(([a], [b]) => a.localeCompare(b)).map(([id, registration]) => ({ id, ...registration }));
-}
-async function showRegisteredFleet(idInput, options = {}) {
-  const id = fleetIdSchema.parse(idInput);
-  const fleets = await listRegisteredFleets(options);
-  const registration = fleets.find((candidate) => candidate.id === id);
-  if (!registration) {
-    throw new Error(`Unknown fleet '${id}'. Use 'agentwheel fleet list' or register it with 'agentwheel fleet register'.`);
-  }
-  return registration;
-}
-async function readRequiredConfig(root, label) {
-  const path = workspaceConfigPath(root);
-  if (!await pathExists(path)) throw missingScopeError(label);
-  try {
-    return workspaceConfigSchema.parse(JSON.parse(await readFile26(path, "utf8")));
-  } catch (error) {
-    throw new Error(`Invalid ${label} Agentwheel config at ${path}: ${error instanceof Error ? error.message : String(error)}`);
-  }
-}
-function assertFleetContract(id, registration, config) {
-  if (!supportsFleetConfig(config)) {
-    throw new Error(`Fleet '${id}' config must use schemaVersion 3 or newer before registration or selection.`);
-  }
-  if (config.fleetId !== id) {
-    throw new Error(`Fleet fleetId mismatch: expected '${id}', found '${config.fleetId ?? "missing"}'.`);
-  }
-  if (Object.keys(config.fleets).length > 0) {
-    throw new Error(`Fleet '${id}' config may not contain the home fleets registry.`);
-  }
-  const names = new Set(config.packages.map((pkg) => pkg.name));
-  for (const packageName of registration.requiredPackages) {
-    if (!names.has(packageName)) throw new Error(`Fleet '${id}' is missing required package '${packageName}'.`);
-  }
-}
-async function assertCanonicalDirectory(input, label) {
-  const canonical = await canonicalizeDirectory(input, label);
-  const normalized = resolve21(input);
-  const stats = await lstat2(input);
-  if (stats.isSymbolicLink() || canonical !== normalized || input !== normalized) {
-    throw new Error(`${label} must be canonical and symlink-unambiguous: ${input} resolves to ${canonical}.`);
-  }
-  return canonical;
-}
-async function canonicalizeDirectory(input, label) {
-  if (!isAbsolute2(input)) throw new Error(`${label} must be an absolute canonical path.`);
-  let canonical;
-  try {
-    canonical = await realpath(input);
-  } catch {
-    throw new Error(`${label} does not exist: ${input}`);
-  }
-  const stats = await lstat2(canonical);
-  if (!stats.isDirectory()) throw new Error(`${label} is not a directory: ${input}`);
-  return canonical;
-}
-function missingScopeError(label) {
-  return new Error(
-    `Missing ${label} Agentwheel workspace config. Select --user, --local, or --fleet <id>, or run 'agentwheel init workspace' in the intended local root. Agentwheel never falls back to home desired state.`
-  );
-}
-function assertNonFleetScope(kind, config) {
-  if (supportsFleetConfig(config) && config.fleetId) {
-    throw new Error(
-      `The ${kind} config declares fleetId '${config.fleetId}'. Select it through the registered --fleet <id> scope.`
-    );
-  }
-}
-function sortedUnique5(values) {
-  return [...new Set(values.map((value) => value.trim()).filter(Boolean))].sort((a, b) => a.localeCompare(b));
-}
-
 // src/lifecycle/fleet-normalize.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { readFile as readFile27, readdir as readdir9, rm as rm9 } from "fs/promises";
 import { homedir as homedir11 } from "os";
-import { basename as basename19, isAbsolute as isAbsolute3, join as join44, relative as relative7, resolve as resolve22 } from "path";
+import { basename as basename19, isAbsolute as isAbsolute3, join as join44, relative as relative8, resolve as resolve23 } from "path";
 async function planFleetNormalization(request) {
-  const normalizedRequest = normalizeRequest(request);
+  const normalizedRequest = normalizeRequest2(request);
   const destinationScope = await resolveWorkspaceScope({
     fleet: normalizedRequest.destinationFleet,
     globalRoot: normalizedRequest.globalRoot
@@ -10680,8 +11020,8 @@ async function planFleetNormalization(request) {
     if (!sourcePackage || !destinationPackage) {
       throw new Error(`Package '${name}' must be an existing duplicate in both source and destination fleets.`);
     }
-    const sourceDeclaration = canonicalJson(sourcePackage);
-    const destinationDeclaration = canonicalJson(destinationPackage);
+    const sourceDeclaration = canonicalJson2(sourcePackage);
+    const destinationDeclaration = canonicalJson2(destinationPackage);
     if (sourceDeclaration !== destinationDeclaration) {
       throw new Error(
         `Package '${name}' has divergent declarations. Source, driver, adapter, adapter configuration, installation type, version policy, selections, aliases, overrides, and suggestions must match before normalization.`
@@ -10718,13 +11058,13 @@ async function planFleetNormalization(request) {
     packages,
     installedState
   };
-  return { ...planWithoutDigest, planDigest: sha2564(canonicalJson(planWithoutDigest)) };
+  return { ...planWithoutDigest, planDigest: sha2564(canonicalJson2(planWithoutDigest)) };
 }
 async function applyFleetNormalization(request, hooks = {}) {
   if (!request.apply) throw new Error("Fleet normalization is dry-run by default; pass --apply with --plan-digest <digest>.");
   if (!request.planDigest) throw new Error("Applying fleet normalization requires --plan-digest <digest> from a reviewed dry-run.");
   assertDigest(request.planDigest);
-  const normalizedRequest = normalizeRequest(request);
+  const normalizedRequest = normalizeRequest2(request);
   const roots = await normalizationRoots(normalizedRequest);
   const ordered = [.../* @__PURE__ */ new Set([roots.source, roots.destination])].sort((a, b) => a.localeCompare(b));
   return withOrderedLocks(ordered, async () => {
@@ -10856,14 +11196,14 @@ async function assertNormalizationPostconditions(journal) {
   }
   for (const graphLock of journal.graphLocks) {
     const raw = await readOptionalRecord(graphLock.path);
-    const digest = raw ? sha2564(canonicalJson(await readGraphLock(graphLock.path))) : null;
-    if (digest !== graphLock.afterDigest) {
+    const digest2 = raw ? sha2564(canonicalJson2(await readGraphLock(graphLock.path))) : null;
+    if (digest2 !== graphLock.afterDigest) {
       throw new Error(`Fleet normalization graph-lock postcheck failed: ${graphLock.path}`);
     }
   }
 }
 async function recoverFleetNormalization(request) {
-  const normalizedRequest = normalizeRequest(request);
+  const normalizedRequest = normalizeRequest2(request);
   const roots = await normalizationRoots(normalizedRequest);
   const ordered = [.../* @__PURE__ */ new Set([roots.source, roots.destination])].sort((a, b) => a.localeCompare(b));
   return withOrderedLocks(ordered, async () => {
@@ -10906,7 +11246,7 @@ async function assertSourceFleetPostcondition(request, source, selectedPackages)
     );
   }
 }
-function normalizeRequest(request) {
+function normalizeRequest2(request) {
   const packages = request.packages === void 0 ? void 0 : sortedUnique6(request.packages);
   if (request.packages !== void 0 && packages?.length === 0) throw new Error("--package requires at least one package name.");
   const artifacts = request.artifacts === void 0 ? void 0 : sortedUnique6(request.artifacts.map((artifact) => normalizeArtifactSelector(artifact)));
@@ -10928,17 +11268,17 @@ function normalizeRequest(request) {
     ...profile ? { profile } : {},
     ...agent ? { agent } : {},
     ...orphanedOwnerRoots ? { orphanedOwnerRoots } : {},
-    ...request.globalRoot ? { globalRoot: resolve22(request.globalRoot) } : {}
+    ...request.globalRoot ? { globalRoot: resolve23(request.globalRoot) } : {}
   };
 }
 function normalizeOrphanedOwnerRoot(value) {
   const root = value.trim();
   if (!root || !isAbsolute3(root)) throw new Error(`Invalid orphaned owner root '${value}'; expected an absolute workspace path.`);
-  return resolve22(root);
+  return resolve23(root);
 }
 async function normalizationRoots(request) {
   const destination = await showRegisteredFleet(request.destinationFleet, { globalRoot: request.globalRoot });
-  const source = request.from === "user" ? resolve22(request.globalRoot ?? homedir11()) : (await showRegisteredFleet(request.from.slice("fleet:".length), { globalRoot: request.globalRoot })).root;
+  const source = request.from === "user" ? resolve23(request.globalRoot ?? homedir11()) : (await showRegisteredFleet(request.from.slice("fleet:".length), { globalRoot: request.globalRoot })).root;
   return { source, destination: destination.root };
 }
 async function withOrderedLocks(roots, fn) {
@@ -11029,10 +11369,10 @@ async function inspectInstalledState(source, destination, packageNames) {
     const destinationGraphAfter = destinationGraph?.lock ?? destinationGraphFromSource(sourceGraph.lock, destinationState.targetFingerprint);
     graphTransfers.push({
       sourceGraphLockPath: sourceGraph.path,
-      sourceGraphLockDigest: sha2564(canonicalJson(sourceGraph.lock)),
+      sourceGraphLockDigest: sha2564(canonicalJson2(sourceGraph.lock)),
       destinationGraphLockPath: destinationState.graphLockPath,
-      destinationGraphLockDigest: destinationGraph ? sha2564(canonicalJson(destinationGraph.lock)) : null,
-      destinationGraphLockAfterDigest: sha2564(canonicalJson(destinationGraphAfter)),
+      destinationGraphLockDigest: destinationGraph ? sha2564(canonicalJson2(destinationGraph.lock)) : null,
+      destinationGraphLockAfterDigest: sha2564(canonicalJson2(destinationGraphAfter)),
       targetKey: sourceGraph.targetKey,
       adapter: destinationState.adapter,
       targetFingerprint: destinationState.targetFingerprint
@@ -11245,7 +11585,7 @@ async function inspectLegacySelfInstalledState(fleet, packageNames, profileName,
       )
     });
     if (!selectedArtifacts) {
-      const fullDigest = sha2564(canonicalJson(graph.lock));
+      const fullDigest = sha2564(canonicalJson2(graph.lock));
       const existingDestinationGraph = graphCandidates.find((candidate) => candidate.path === destinationState.graphLockPath);
       if (existingDestinationGraph) assertGraphIsSubset(graph, existingDestinationGraph);
       const destinationGraph = destinationGraphFromSource(graph.lock, destinationState.targetFingerprint);
@@ -11253,8 +11593,8 @@ async function inspectLegacySelfInstalledState(fleet, packageNames, profileName,
         sourceGraphLockPath: graph.path,
         sourceGraphLockDigest: fullDigest,
         destinationGraphLockPath: destinationState.graphLockPath,
-        destinationGraphLockDigest: existingDestinationGraph ? sha2564(canonicalJson(existingDestinationGraph.lock)) : null,
-        destinationGraphLockAfterDigest: sha2564(canonicalJson(destinationGraph)),
+        destinationGraphLockDigest: existingDestinationGraph ? sha2564(canonicalJson2(existingDestinationGraph.lock)) : null,
+        destinationGraphLockAfterDigest: sha2564(canonicalJson2(destinationGraph)),
         targetKey: graph.targetKey,
         adapter: graph.adapter,
         targetFingerprint: destinationState.targetFingerprint
@@ -11312,7 +11652,7 @@ function targetKeysForAgent(scope, name) {
 async function runtimeRoots(scope) {
   const roots = /* @__PURE__ */ new Set([scope.root]);
   if (scope.config.packages.some((pkg) => pkg.installationType === "user") || Object.values(scope.config.agents).some((agent) => agent.installationType === "user")) {
-    roots.add(resolve22(process.env.AGENTWHEEL_TEST_HOME || process.env.HOME || homedir11()));
+    roots.add(resolve23(process.env.AGENTWHEEL_TEST_HOME || process.env.HOME || homedir11()));
   }
   for (const [name, agent] of Object.entries(scope.config.agents)) {
     if (agent.transport === "ssh") throw new Error(`Installed-state normalization cannot inspect SSH agent '${name}' locally.`);
@@ -11349,14 +11689,14 @@ async function collectManifests(roots) {
         }
         continue;
       }
-      if (resolve22(parsed.targetRoot) !== resolve22(root)) {
+      if (resolve23(parsed.targetRoot) !== resolve23(root)) {
         throw new Error(`Install manifest target root does not match its enumerated runtime root: ${path}`);
       }
       const expectedPath = installManifestPath(parsed.targetRoot, parsed.adapter, {
         installationType: parsed.installationType,
         stateKey: parsed.stateKey
       });
-      if (resolve22(expectedPath) !== resolve22(path)) {
+      if (resolve23(expectedPath) !== resolve23(path)) {
         throw new Error(`Install manifest state identity does not match its canonical path: ${path}`);
       }
       found.set(path, { path, raw, manifest: { ...parsed, revision: computeManifestRevision(raw), legacy: false } });
@@ -11377,7 +11717,7 @@ async function collectManifestPaths(paths) {
       installationType: parsed.installationType,
       stateKey: parsed.stateKey
     });
-    if (resolve22(expectedPath) !== resolve22(path)) {
+    if (resolve23(expectedPath) !== resolve23(path)) {
       throw new Error(`Install manifest state identity does not match its canonical path: ${path}`);
     }
     found.push({ path, raw, manifest: { ...parsed, revision: computeManifestRevision(raw), legacy: false } });
@@ -11403,7 +11743,7 @@ async function relevantGraphLocks(workspaceRoot, selected, targetKeys, include)
     if (!path.endsWith(".graph-lock.json")) continue;
     const lock = await readGraphLock(path);
     if (!lock.canonical.roots.some((candidate2) => selected.has(candidate2.rootId))) continue;
-    const parts = relative7(root, path).split(/[\\/]/);
+    const parts = relative8(root, path).split(/[\\/]/);
     if (parts.length !== 3) throw new Error(`Graph lock path is not canonical: ${path}`);
     const [targetKey2, adapter, fileName] = parts;
     if (targetKeys && !targetKeys.has(targetKey2)) continue;
@@ -11424,7 +11764,7 @@ async function relevantGraphLocks(workspaceRoot, selected, targetKeys, include)
     const projection = relevantGraphProjection(lock, selected);
     results.push({
       ...candidate,
-      digest: sha2564(canonicalJson(projection)),
+      digest: sha2564(canonicalJson2(projection)),
       artifactIdentities: lock.canonical.artifacts.filter((artifact) => artifact.owners.some((owner) => ownerMatchesGraphPackage(lock, owner, selected))).map(graphArtifactIdentity).sort()
     });
   }
@@ -11460,7 +11800,7 @@ async function legacyManifestPathForConfiguredTarget(scope, graph) {
     baseDir: scope.root
   });
   const targetRoot = resolveConfigPath(agent.root, scope.root);
-  const installRoot = resolve22(installRootForAdapterInstallationType(adapter, targetRoot, agent.installationType, false));
+  const installRoot = resolve23(installRootForAdapterInstallationType(adapter, targetRoot, agent.installationType, false));
   const stateKey = stateKeyFor(adapter.name, {
     installationType: agent.installationType,
     targetFingerprint: graph.lock.canonical.targetFingerprint
@@ -11534,7 +11874,7 @@ async function targetStateForGraph(scope, graph, identityFleetId = scope.fleetId
     targetFingerprint,
     ...identityFleetId ? { fleetId: identityFleetId } : {}
   });
-  const installRoot = resolve22(installRootForAdapterInstallationType(adapter, targetRoot, installationType, false));
+  const installRoot = resolve23(installRootForAdapterInstallationType(adapter, targetRoot, installationType, false));
   return {
     adapter: adapter.name,
     installationType,
@@ -11565,9 +11905,9 @@ async function legacyTargetStateForGraph(scope, graph) {
   };
 }
 function assertGraphIsSubset(source, destination) {
-  const sourceRoots = new Map(source.lock.canonical.roots.map((root) => [root.rootId, canonicalJson(root)]));
+  const sourceRoots = new Map(source.lock.canonical.roots.map((root) => [root.rootId, canonicalJson2(root)]));
   for (const root of destination.lock.canonical.roots) {
-    if (sourceRoots.get(root.rootId) !== canonicalJson(root)) {
+    if (sourceRoots.get(root.rootId) !== canonicalJson2(root)) {
       throw new Error(
         `Partially normalized destination graph diverges at root '${root.rootId}': ${destination.path}`
       );
@@ -11597,7 +11937,7 @@ function destinationGraphFromSource(source, targetFingerprint) {
 function mergeDestinationManifest(existing, state, generatedAt, desiredEntries, replaceOwners = /* @__PURE__ */ new Set()) {
   if (existing) {
     const manifest2 = existing.manifest;
-    if (manifest2.adapter !== state.adapter || manifest2.installationType !== state.installationType || manifest2.stateKey !== state.stateKey || resolve22(manifest2.targetRoot) !== state.installRoot) {
+    if (manifest2.adapter !== state.adapter || manifest2.installationType !== state.installationType || manifest2.stateKey !== state.stateKey || resolve23(manifest2.targetRoot) !== state.installRoot) {
       throw new Error(`Destination manifest identity diverges from the derived target: ${existing.path}`);
     }
   }
@@ -11657,7 +11997,7 @@ async function assertEquivalentRuntimeState(entry, sourcePath, destinationPath)
       const content = await readFile27(path, "utf8");
       if (hasMergeRemovalContent(entry.mergeRemoval)) {
         assertExactMergeContribution(entry.mergeRemoval, entry.mergeStrategy, content);
-      } else if (resolve22(sourcePath) === resolve22(destinationPath) && entry.mergeStrategy !== "codex-toml-mcp") {
+      } else if (resolve23(sourcePath) === resolve23(destinationPath) && entry.mergeStrategy !== "codex-toml-mcp") {
         assertExactMergeContribution({}, entry.mergeStrategy, content);
       } else {
         throw new Error(`Installed-state normalization cannot prove incomplete merge ownership at ${path}.`);
@@ -11668,8 +12008,8 @@ async function assertEquivalentRuntimeState(entry, sourcePath, destinationPath)
   await assertEquivalentRuntimeBytes(sourcePath, destinationPath, entry.hash);
 }
 function renderedEntryPathForRoot(root, entryPath) {
-  const normalizedRoot = resolve22(root);
-  const candidate = resolve22(normalizedRoot, entryPath);
+  const normalizedRoot = resolve23(root);
+  const candidate = resolve23(normalizedRoot, entryPath);
   if (candidate !== normalizedRoot && !candidate.startsWith(`${normalizedRoot}/`)) {
     throw new Error(`Install manifest entry escapes its target root: ${entryPath}`);
   }
@@ -11760,8 +12100,8 @@ function ownerMatchesGraphPackage(lock, owner, selected) {
   return ownerMatchesPackage(owner, selected) || lock.canonical.roots.some((root) => selected.has(root.rootId) && root.graphNodeId === owner);
 }
 function renderedEntryPath(manifest, entry) {
-  const root = resolve22(manifest.targetRoot);
-  const candidate = resolve22(root, entry.path);
+  const root = resolve23(manifest.targetRoot);
+  const candidate = resolve23(root, entry.path);
   if (candidate !== root && !candidate.startsWith(`${root}/`)) {
     throw new Error(`Install manifest entry escapes its target root: ${entry.path}`);
   }
@@ -11780,7 +12120,7 @@ function assertSimpleVerifiableEntry(entry, path) {
   if (entry.kind !== "file" && entry.kind !== "dir") throw new Error(`Unsupported installed entry kind at ${path}.`);
 }
 function entryIdentity(entry) {
-  return canonicalJson({
+  return canonicalJson2({
     path: entry.path,
     artifactType: entry.artifactType,
     artifactName: entry.artifactName,
@@ -11798,7 +12138,7 @@ function entryIdentity(entry) {
   });
 }
 function graphArtifactIdentity(artifact) {
-  return canonicalJson({
+  return canonicalJson2({
     graphNodeId: artifact.graphNodeId,
     type: artifact.type,
     name: artifact.name,
@@ -11812,7 +12152,7 @@ function graphArtifactIdentity(artifact) {
   });
 }
 function graphEntryIdentity(entry) {
-  return canonicalJson({
+  return canonicalJson2({
     graphNodeId: entry.graphNodeId,
     type: entry.artifactType,
     name: entry.artifactName,
@@ -11916,7 +12256,7 @@ async function buildJournalGraphLockStates(plan) {
   for (const transfer of plan.installedState.graphTransfers) {
     const sourceBefore = JSON.parse(await readFile27(transfer.sourceGraphLockPath, "utf8"));
     const sourceLock = await readGraphLock(transfer.sourceGraphLockPath);
-    const sourceDigest = sha2564(canonicalJson(sourceLock));
+    const sourceDigest = sha2564(canonicalJson2(sourceLock));
     if (sourceDigest !== transfer.sourceGraphLockDigest) {
       throw new Error(`Source graph lock changed after planning: ${transfer.sourceGraphLockPath}`);
     }
@@ -11934,9 +12274,9 @@ async function buildJournalGraphLockStates(plan) {
       continue;
     }
     const destinationBefore = await readOptionalRecord(transfer.destinationGraphLockPath);
-    const destinationBeforeDigest = destinationBefore ? sha2564(canonicalJson(await readGraphLock(transfer.destinationGraphLockPath))) : null;
+    const destinationBeforeDigest = destinationBefore ? sha2564(canonicalJson2(await readGraphLock(transfer.destinationGraphLockPath))) : null;
     const destinationAfter = destinationBefore ? await readGraphLock(transfer.destinationGraphLockPath) : destinationGraphFromSource(sourceLock, transfer.targetFingerprint);
-    const destinationAfterDigest = sha2564(canonicalJson(destinationAfter));
+    const destinationAfterDigest = sha2564(canonicalJson2(destinationAfter));
     if (destinationBeforeDigest !== transfer.destinationGraphLockDigest || destinationAfterDigest !== transfer.destinationGraphLockAfterDigest) {
       throw new Error(`Destination graph lock changed after planning: ${transfer.destinationGraphLockPath}`);
     }
@@ -11976,6 +12316,7 @@ async function acquireJournalManifestLocks(manifests) {
   try {
     const unique = /* @__PURE__ */ new Map();
     for (const item of manifests) unique.set(item.path, item);
+    const acquiredPaths = /* @__PURE__ */ new Set();
     for (const item of [...unique.values()].sort((a, b) => a.path.localeCompare(b.path))) {
       const raw = await readOptionalRecord(item.path) ?? item.before ?? item.after;
       if (!raw && !(item.targetRoot && item.adapter && item.installationType && item.stateKey)) {
@@ -11988,9 +12329,13 @@ async function acquireJournalManifestLocks(manifests) {
       const installationType = manifest?.installationType ?? item.installationType;
       const stateKey = manifest?.stateKey ?? item.stateKey;
       const scope = { installationType, stateKey };
-      const lock = await acquireApplyLock(targetRoot, adapter, void 0, {}, scope);
-      locks.push(lock);
-      if (await readApplyJournal(targetRoot, adapter, void 0, scope)) {
+      const lockPath = applyLockPath(targetRoot, adapter, scope);
+      if (!acquiredPaths.has(lockPath)) {
+        const lock = await acquireApplyLock(targetRoot, adapter, void 0, {}, scope);
+        locks.push(lock);
+        acquiredPaths.add(lockPath);
+      }
+      if ((await listApplyJournals(targetRoot, adapter, void 0, { installationType })).length > 0) {
         throw new Error(`Cannot normalize while an Agentwheel apply journal is pending for ${item.path}.`);
       }
     }
@@ -12041,8 +12386,8 @@ async function assertJournalRecoverable(journal) {
   }
   for (const graphLock of journal.graphLocks) {
     const raw = await readOptionalRecord(graphLock.path);
-    const digest = raw ? sha2564(canonicalJson(await readGraphLock(graphLock.path))) : null;
-    if (digest !== graphLock.beforeDigest && digest !== graphLock.afterDigest) {
+    const digest2 = raw ? sha2564(canonicalJson2(await readGraphLock(graphLock.path))) : null;
+    if (digest2 !== graphLock.beforeDigest && digest2 !== graphLock.afterDigest) {
       throw new Error(`Cannot recover fleet normalization because graph lock changed outside the transaction: ${graphLock.path}`);
     }
   }
@@ -12094,12 +12439,12 @@ function packageMap(config) {
   return result;
 }
 function configRevision(config) {
-  return sha2564(canonicalJson(config));
+  return sha2564(canonicalJson2(config));
 }
 function normalizationJournalPath(sourceRoot, destinationFleet) {
   return join44(sourceRoot, ".agentwheel", `fleet-normalize-${destinationFleet}.journal.json`);
 }
-function canonicalJson(value) {
+function canonicalJson2(value) {
   return JSON.stringify(sortValue(value));
 }
 function sortValue(value) {
@@ -12110,7 +12455,7 @@ function sortValue(value) {
   return value;
 }
 function sha2564(value) {
-  return createHash12("sha256").update(value).digest("hex");
+  return createHash13("sha256").update(value).digest("hex");
 }
 function assertDigest(value) {
   if (!/^[a-f0-9]{64}$/.test(value)) throw new Error(`Invalid plan digest: ${value}`);
@@ -12148,6 +12493,7 @@ var commandGovernance = {
   "package migrate": "governed-always",
   remember: "governed-always",
   "ownership handoff": "governed-unless-dry-run",
+  "ownership retire-stale": "governed-apply",
   "mcp retire": "governed-apply",
   eject: "governed-always",
   uninstall: "governed-unless-dry-run",
@@ -12564,7 +12910,7 @@ ownershipCommand.command("handoff").description("transfer one managed artifact b
   const toWorkspaceRoot = normalizeCliPath(options.toWorkspaceRoot);
   if (options.toFleet) {
     const fleet = await showRegisteredFleet(options.toFleet);
-    if (resolve23(fleet.root) !== resolve23(toWorkspaceRoot)) {
+    if (resolve24(fleet.root) !== resolve24(toWorkspaceRoot)) {
       throw new Error(`Destination fleet '${options.toFleet}' is registered at ${fleet.root}, not ${toWorkspaceRoot}.`);
     }
   }
@@ -12589,6 +12935,84 @@ ownershipCommand.command("handoff").description("transfer one managed artifact b
   console.log(`Manifest revision: ${result.manifestRevision}`);
   console.log(`Owner: ${result.fromOwner} -> ${result.toOwner}`);
 });
+ownershipCommand.command("retire-stale").description("retire stale source-manifest ownership already covered by one Fleet manifest").requiredOption("--from-workspace-root <path>", "exact stale workspace owner root").requiredOption("--to-workspace-root <path>", "registered destination Fleet root").requiredOption("--source-state-key <key>", "exact source install-manifest state key").requiredOption("--fleet <id>", "registered destination Fleet").option("--adapter <adapter>", "built-in adapter").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named destination Fleet agent").option("--profile <name>", "destination Fleet profile resolving to one target").option("--plan-digest <sha256>", "reviewed plan digest; required with --apply").option("--expected-source-revision <sha256>", "reviewed source manifest revision; required with --apply").option("--expected-destination-revision <sha256>", "reviewed destination manifest revision; required with --apply").option("--expected-inventory-revision <sha256>", "reviewed runtime manifest inventory revision; required with --apply").option("--apply", "apply the exact reviewed metadata-only retirement", false).option("--json", "print the complete deterministic plan as JSON", false).action(async (options) => {
+  const normalizedOptions = normalizeRuntimeScopeOptions(options);
+  const fleet = await showRegisteredFleet(options.fleet);
+  const toWorkspaceRoot = normalizeCliPath(options.toWorkspaceRoot);
+  if (resolve24(fleet.root) !== resolve24(toWorkspaceRoot)) {
+    throw new Error(`Destination Fleet '${options.fleet}' is registered at ${fleet.root}, not ${toWorkspaceRoot}.`);
+  }
+  const targets = await resolveCliTargets(normalizedOptions);
+  if (targets.length !== 1) {
+    throw new Error(`Stale ownership retirement requires exactly one destination Fleet target, found ${targets.length}.`);
+  }
+  const target = targets[0];
+  if (target.fleetId !== options.fleet || resolve24(target.workspaceRoot) !== resolve24(fleet.root)) {
+    throw new Error(`Resolved target does not belong to destination Fleet '${options.fleet}'.`);
+  }
+  const adapterOptions = adapterOptionsForTarget(target, normalizedOptions);
+  const adapter = await resolveAdapterForTarget(target, adapterOptions);
+  const installationType = normalizedOptions.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
+  const state = installStateForTarget(target, adapter, adapterOptions, installationType);
+  const request = {
+    targetRoot: state.installRoot,
+    adapter: adapter.name,
+    installationType,
+    sourceStateKey: options.sourceStateKey,
+    destinationStateKey: state.stateKey,
+    fromWorkspaceRoot: normalizeCliPath(options.fromWorkspaceRoot),
+    toWorkspaceRoot,
+    toFleetId: fleet.id,
+    planDigest: options.planDigest,
+    expectedSourceRevision: options.expectedSourceRevision,
+    expectedDestinationRevision: options.expectedDestinationRevision,
+    expectedInventoryRevision: options.expectedInventoryRevision,
+    transport: transportForTarget(target)
+  };
+  const result = options.apply ? await applyRetireStaleOwnership(request) : await planRetireStaleOwnership(request);
+  const targetArgs = options.profile ? ["--profile", options.profile] : target.agentName ? ["--agent", target.agentName] : ["--adapter", adapter.name, "--target-root", target.targetRoot];
+  const applyArgs = [
+    "agentwheel",
+    "ownership",
+    "retire-stale",
+    "--from-workspace-root",
+    request.fromWorkspaceRoot,
+    "--to-workspace-root",
+    request.toWorkspaceRoot,
+    "--source-state-key",
+    request.sourceStateKey,
+    "--fleet",
+    request.toFleetId,
+    ...targetArgs,
+    "--installation-type",
+    installationType,
+    ...options.adapterConfig ? ["--adapter-config", options.adapterConfig] : [],
+    ...options.adapterModule ? ["--adapter-module", options.adapterModule] : [],
+    ...options.allowAdapterCode ? ["--allow-adapter-code"] : [],
+    "--plan-digest",
+    result.planDigest,
+    "--expected-source-revision",
+    result.source.revision,
+    "--expected-destination-revision",
+    result.destination.revision,
+    "--expected-inventory-revision",
+    result.manifestInventoryRevision,
+    "--apply"
+  ];
+  const applyCommand = applyArgs.map(shellQuoteArgument).join(" ");
+  if (options.json) {
+    console.log(JSON.stringify({ ...result, applyCommand }, null, 2));
+    return;
+  }
+  console.log(`${options.apply ? "Retired stale ownership" : "Stale ownership retirement plan"}: ${result.selected.length} entr${result.selected.length === 1 ? "y" : "ies"}`);
+  console.log(`Target: ${result.adapter}/${result.installationType} at ${result.targetRoot}`);
+  console.log(`Source: ${result.source.stateKey} revision ${result.source.revision}`);
+  console.log(`Destination: ${result.destination.stateKey} revision ${result.destination.revision}`);
+  console.log(`Manifest inventory revision: ${result.manifestInventoryRevision}`);
+  for (const entry of result.selected) console.log(`- ${entry.path}: ${entry.sourceEntryDigest} -> ${entry.destinationEntryDigest}`);
+  console.log(`Plan digest: ${result.planDigest}`);
+  if (!options.apply) console.log(`Apply: ${applyCommand}`);
+});
 var mcpCommand = program.command("mcp").description("operate on MCP runtime configuration");
 mcpCommand.command("retire").description("remove one exact legacy MCP contribution with explicit state ownership").argument("<package>", "configured package containing exactly one legacy MCP artifact").option("--user", "use the user workspace", false).option("--local", "use the nearest local workspace", false).option("--fleet <id>", "use one registered named fleet").option("-t, --target-root <path>", "explicit runtime/project root").option("--agent <name>", "one named agent from merged config").option("--profile <name>", "workspace runtime profile resolving to one target").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--from-workspace-root <path>", "required previous owner when managed legacy state exists").option("--dry-run", "show the retirement plan without writing (default)", false).option("--apply", "apply the exact reviewed retirement plan", false).option("--json", "print the install plan as JSON", false).action(async (packageName, options) => {
   if (options.apply && options.dryRun) throw new Error("--apply cannot be combined with --dry-run.");
@@ -13522,10 +13946,13 @@ async function buildGraphPlansForTarget(target, source, options, behavior) {
           targetOptions.focusedArtifact,
           focusedArtifactOwnerKeys(result.bundle.graphLock, previousGroupLock, scopedRootId, targetOptions.focusedArtifact)
         )).map((operation) => operation.relativeDestPath);
+        const ownership = await resolveWorkspaceOwnershipScope(group.target.workspaceRoot, {
+          fleetId: group.target.fleetId
+        });
         await assertNoForeignWorkspaceStateForPlan(scopedResult.plan, {
           transport,
           workspaceRoot: group.target.workspaceRoot,
-          workspaceOwner: workspaceOwnerForRoot(group.target.workspaceRoot, group.target.fleetId),
+          workspaceOwner: workspaceOwnerForRoot(ownership.root, ownership.fleetId),
           plannedPaths: focusedPaths
         });
       }
@@ -13576,7 +14003,7 @@ function scopeUpdatePlanToDependencies(result, selectors, previousLock, manifest
     selectedPreviousNodeIds,
     selectedRootIds
   );
-  const graphLockDigest = createHash13("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash14("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...result,
     bundle: { ...result.bundle, graphLock },
@@ -13702,7 +14129,7 @@ function operationBelongsToDependencyUpdate(operation, allowedNodeIds, allowedNa
 function scopeInstallPlanToArtifact(result, rootId, focused, manifest) {
   const scoped = scopePlanOperationsToArtifact(result, rootId, focused, manifest);
   const graphLock = focusedGraphLockForInstall(scoped.bundle.graphLock, rootId, focused);
-  const graphLockDigest = createHash13("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash14("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...scoped,
     bundle: { ...scoped.bundle, graphLock },
@@ -13713,7 +14140,7 @@ function scopeInstallPlanToArtifact(result, rootId, focused, manifest) {
 function scopeUpdatePlanToArtifact(result, rootId, focused, previousLock, manifest) {
   const scoped = scopePlanOperationsToArtifact(result, rootId, focused, manifest, previousLock);
   const graphLock = mergeFocusedArtifactGraphLock(scoped.bundle.graphLock, previousLock, rootId, focused);
-  const graphLockDigest = createHash13("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash14("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...scoped,
     bundle: { ...scoped.bundle, graphLock },
@@ -14008,7 +14435,7 @@ function scopeUpdatePlanToRoot(result, rootId, previousLock, manifest) {
     selectedPreviousNodeIds,
     /* @__PURE__ */ new Set([rootId])
   );
-  const graphLockDigest = createHash13("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash14("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...scoped,
     bundle: { ...scoped.bundle, graphLock },
@@ -14092,6 +14519,8 @@ function keepManifestEntryOperation(entry, targetRoot, scopeDescription, operati
     semanticPlugin: entry.semanticPlugin,
     execute: entry.executed,
     mergeStrategy: entry.mergeStrategy,
+    mergeRemoval: "mergeRemoval" in entry ? entry.mergeRemoval : void 0,
+    mergeCreatedDestination: "mergeCreatedDestination" in entry ? entry.mergeCreatedDestination : void 0,
     composedFrom: entry.composedFrom,
     installName: fresh?.installName ?? ("installName" in entry ? entry.installName : entry.artifactName),
     logicalSelector: fresh?.logicalSelector ?? ("logicalSelector" in entry ? entry.logicalSelector : `${entry.artifactType}/${entry.artifactName}`),
@@ -14562,7 +14991,7 @@ async function assertCompositeMutationSupported(workspaceRoot, profile, readOnly
         `Composite-profile mutation is refused before member execution because ${member.id} uses ${member.transport}; durable remote policy and recovery preflight is not implemented.`
       );
     }
-    const memberRoot = resolve23(workspaceRoot, member.workspace);
+    const memberRoot = resolve24(workspaceRoot, member.workspace);
     const memberPolicy = await mutationPolicyForWorkspace(memberRoot);
     if (memberPolicy?.revisioning.mode === "commit-after-verify") {
       throw new Error(
@@ -15013,11 +15442,14 @@ function looksLikeSourceSpecifier(value) {
 }
 function normalizeCliPath(value) {
   if (value === "~") return homedir12();
-  if (value.startsWith("~/")) return resolve23(homedir12(), value.slice(2));
-  return resolve23(value);
+  if (value.startsWith("~/")) return resolve24(homedir12(), value.slice(2));
+  return resolve24(value);
+}
+function shellQuoteArgument(value) {
+  return /^[a-z0-9_./:@%+=,-]+$/i.test(value) ? value : `'${value.replace(/'/g, `'"'"'`)}'`;
 }
 function isHomePath(path) {
-  return resolve23(path) === resolve23(homedir12());
+  return resolve24(path) === resolve24(homedir12());
 }
 function adapterListFromOption(adapter) {
   if (!adapter) return [];
@@ -15138,7 +15570,7 @@ function withFleetExample(config) {
   };
 }
 async function findAgentwheelPackageRoot(start) {
-  let current = resolve23(start);
+  let current = resolve24(start);
   while (true) {
     if (await findPackageManifestPath(current, { warnLegacy: false })) return current;
     const parent = dirname22(current);