agentwheel 0.20.1 → 0.20.2

package/dist/{apply-R5VHCIUN.js → apply-OGC6E2Y4.js}

@@ -2,14 +2,16 @@
 import {
   applyCombinedInstallPlan,
   applyInstallPlan,
+  commitManifestMetadataJournal,
   recoverPendingApply,
   uninstall
-} from "./chunk-AFVGRRZW.js";
-import "./chunk-BJEZXIXX.js";
+} from "./chunk-BAJEWUI6.js";
+import "./chunk-Z4N7TB6Q.js";
 import "./chunk-7VPI5J5Y.js";
 export {
   applyCombinedInstallPlan,
   applyInstallPlan,
+  commitManifestMetadataJournal,
   recoverPendingApply,
   uninstall
 };

package/dist/{chunk-AFVGRRZW.js → chunk-BAJEWUI6.js}

@@ -24,7 +24,7 @@ import {
   rollbackCompletedOperations,
   sourceLockPath,
   writeApplyJournal
-} from "./chunk-BJEZXIXX.js";
+} from "./chunk-Z4N7TB6Q.js";
 import {
   pathExists,
   writeJsonAtomic
@@ -1607,6 +1607,12 @@ function shouldPreserveKeptOperationWhenKeepingFiles(operation) {
 function isForceRemovableKeep(operation) {
   return operation.action === "keep" && operation.preserveInManifest !== true;
 }
+async function commitManifestMetadataJournal(journal, transport = localTransport) {
+  if (journal.mode !== "uninstall" || journal.operations.length !== 0) {
+    throw new Error("Manifest metadata journal must contain no runtime operations.");
+  }
+  return commitJournalState(journal, transport, void 0, journal.createdAt);
+}
 async function commitJournalState(journal, transport, entries, now) {
   const manifest = withManifestRevision({
     ...journal.manifest,
@@ -2291,6 +2297,7 @@ export {
   combineMergeRemovals,
   hasMergeRemovalContent,
   mergeRemovalForInstall,
+  mergeContributionAbsent,
   normalizeOwners,
   managedInstructionBlockMode,
   desiredManagedInstructionBlockHash,
@@ -2301,5 +2308,6 @@ export {
   applyInstallPlan,
   applyCombinedInstallPlan,
   recoverPendingApply,
-  uninstall
+  uninstall,
+  commitManifestMetadataJournal
 };

package/dist/{chunk-BJEZXIXX.js → chunk-Z4N7TB6Q.js}

@@ -2624,8 +2624,8 @@ async function recoverMutationRuntime(operationId, options = {}) {
     }
     mutation = GovernedMutation.activateExisting(receipt, baseline, lock);
     const [{ recoverPendingApply }, { readLinkedLocalApplyJournal: readLinkedLocalApplyJournal2, removeApplyJournal: removeApplyJournal2, localPathExists: localPathExists2 }] = await Promise.all([
-      import("./apply-R5VHCIUN.js"),
-      import("./transaction-ITXC7FFV.js")
+      import("./apply-OGC6E2Y4.js"),
+      import("./transaction-7CNV5MAQ.js")
     ]);
     let missingReservation = false;
     for (const entry of pending) {
@@ -2870,6 +2870,17 @@ async function listApplyJournals(targetRoot, adapter, transport = localTransport
   }
   return found.sort((a, b) => a.path.localeCompare(b.path));
 }
+async function listAllApplyJournals(targetRoot, adapter, transport = localTransport) {
+  const suffix = ".apply-journal.json";
+  const found = [];
+  for (const fileName of await transport.listDir(metadataDir(targetRoot))) {
+    if (!fileName.endsWith(suffix)) continue;
+    const path = join6(metadataDir(targetRoot), fileName);
+    const journal = parseApplyJournal(JSON.parse(await transport.readFile(path)));
+    if (journal.adapter === adapter) found.push({ path, journal });
+  }
+  return found.sort((a, b) => a.path.localeCompare(b.path));
+}
 async function readLinkedLocalApplyJournal(path, operationId, expectedDigest, expectedTransportDescription) {
   const absolutePath = resolve9(path);
   const journal = parseApplyJournal(JSON.parse(await readFile7(absolutePath, "utf8")));
@@ -3150,6 +3161,7 @@ export {
   writeApplyJournal,
   readApplyJournal,
   listApplyJournals,
+  listAllApplyJournals,
   readLinkedLocalApplyJournal,
   removeApplyJournal,
   abortApplyJournal,

package/dist/index.js

@@ -9,6 +9,7 @@ import {
   canonicalizeGraphLock,
   claudeInstructionBridgesAgents,
   combineMergeRemovals,
+  commitManifestMetadataJournal,
   computeInstallManifestInventoryRevision,
   computeManifestRevision,
   computeTargetFingerprint,
@@ -20,6 +21,7 @@ import {
   managedInstructionBlockMode,
   managedInstructionPhysicalKey,
   managedInstructionSelector,
+  mergeContributionAbsent,
   mergeRemovalForInstall,
   normalizeImmutableCacheIdentity,
   normalizeOwners,
@@ -31,7 +33,7 @@ import {
   uninstall,
   withManifestRevision,
   writeInstallManifest
-} from "./chunk-AFVGRRZW.js";
+} from "./chunk-BAJEWUI6.js";
 import {
   CURRENT_WORKSPACE_SCHEMA_VERSION,
   GovernedMutation,
@@ -55,10 +57,12 @@ import {
   installRootForAdapterInstallationType,
   installRootForArtifacts,
   isCompositeWorkspaceProfile,
+  listAllApplyJournals,
   listApplyJournals,
   listMutationReceipts,
   loadAdapterConfig,
   localTransport,
+  mutationMetadataForApplyJournal,
   mutationPolicyForWorkspace,
   packageAssetSchema,
   packageComposeEntrySchema,
@@ -88,8 +92,9 @@ import {
   workspaceConfigSchema,
   workspaceExportsSchema,
   workspaceSelectionImportSchema,
+  writeApplyJournal,
   writeWorkspaceConfig
-} from "./chunk-BJEZXIXX.js";
+} from "./chunk-Z4N7TB6Q.js";
 import {
   inferSourceDriverName
 } from "./chunk-EMDIG24I.js";
@@ -104,11 +109,11 @@ import {
 } from "./chunk-7VPI5J5Y.js";
 
 // src/cli/index.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import { existsSync } from "fs";
 import { mkdir as mkdir16, rm as rm10, writeFile as writeFile13 } from "fs/promises";
 import { homedir as homedir12 } from "os";
-import { dirname as dirname22, join as join45, resolve as resolve23 } from "path";
+import { dirname as dirname22, join as join45, resolve as resolve24 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { Command } from "commander";
 
@@ -3102,14 +3107,14 @@ async function writeMermaidAsset(response) {
     "content-type": "application/javascript; charset=utf-8",
     "cache-control": "public, max-age=3600"
   });
-  await new Promise((resolve24) => {
+  await new Promise((resolve25) => {
     const stream = createReadStream(assetPath);
     stream.on("error", () => {
       if (!response.headersSent) writeText(response, 404, "Mermaid asset unavailable.\n");
       else response.destroy();
-      resolve24();
+      resolve25();
     });
-    stream.on("end", resolve24);
+    stream.on("end", resolve25);
     stream.pipe(response);
   });
 }
@@ -3136,14 +3141,14 @@ function escapeHtml2(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
 function listen(server, port, bind) {
-  return new Promise((resolve24, reject) => {
+  return new Promise((resolve25, reject) => {
     const onError = (error) => {
       server.off("listening", onListening);
       reject(error);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve24();
+      resolve25();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -3151,7 +3156,7 @@ function listen(server, port, bind) {
   });
 }
 function waitForShutdown(server, beforeClose) {
-  return new Promise((resolve24) => {
+  return new Promise((resolve25) => {
     let closing = false;
     const shutdown = () => {
       if (closing) return;
@@ -3159,7 +3164,7 @@ function waitForShutdown(server, beforeClose) {
       process.off("SIGINT", shutdown);
       process.off("SIGTERM", shutdown);
       beforeClose();
-      server.close(() => resolve24());
+      server.close(() => resolve25());
     };
     process.once("SIGINT", shutdown);
     process.once("SIGTERM", shutdown);
@@ -3169,7 +3174,7 @@ function waitForShutdown(server, beforeClose) {
       process.off("SIGINT", shutdown);
       process.off("SIGTERM", shutdown);
       beforeClose();
-      resolve24();
+      resolve25();
     });
   });
 }
@@ -3722,7 +3727,7 @@ async function fetchClawHubPackage(fetchImpl, packageName) {
   throw new Error(`ClawHub lookup failed for ${packageName}`);
 }
 async function delay(ms) {
-  await new Promise((resolve24) => setTimeout(resolve24, ms));
+  await new Promise((resolve25) => setTimeout(resolve25, ms));
 }
 function parseClawHubSource(source) {
   if (!source.startsWith(sourcePrefix)) {
@@ -3893,7 +3898,7 @@ async function withGitCacheMaintenanceLock(cacheRoot, timeoutMs, fn) {
       if (Date.now() - started > timeoutMs) {
         throw new Error(`Timed out waiting for git cache maintenance lock at ${lockPath}`);
       }
-      await new Promise((resolve24) => setTimeout(resolve24, 50));
+      await new Promise((resolve25) => setTimeout(resolve25, 50));
     }
   }
   try {
@@ -6684,8 +6689,8 @@ function verifyIntegrity(integrity, sourceHash, label) {
 async function withCachePathLock(path, fn) {
   const previous = cacheLocks.get(path) ?? Promise.resolve();
   let release = () => void 0;
-  const current = previous.then(() => new Promise((resolve24) => {
-    release = resolve24;
+  const current = previous.then(() => new Promise((resolve25) => {
+    release = resolve25;
   }));
   cacheLocks.set(path, current);
   await previous;
@@ -6761,8 +6766,8 @@ function detectDirectCollisions(nodes) {
   }
 }
 function graphNodeId(name, version, normalizedSource, resolvedCommit, sourceHash) {
-  const digest = createHash6("sha256").update(normalizedSource).update("\0").update(resolvedCommit ?? sourceHash).digest("hex").slice(0, 12);
-  return `${name}@${version}+${digest}`;
+  const digest2 = createHash6("sha256").update(normalizedSource).update("\0").update(resolvedCommit ?? sourceHash).digest("hex").slice(0, 12);
+  return `${name}@${version}+${digest2}`;
 }
 function sortedUnique2(values) {
   return [...new Set(values)].sort((a, b) => a.localeCompare(b));
@@ -9246,6 +9251,11 @@ async function verifiedEntryHash(entry, destPath, transport) {
   }
   return currentHash;
 }
+async function verifyManifestEntryRuntime(targetRoot, entry, transport = localTransport) {
+  const path = containedArtifactPath(targetRoot, entry.path);
+  if (!await transport.pathExists(path)) throw new Error(`Managed artifact is missing: ${entry.path}`);
+  return verifiedEntryHash(entry, path, transport);
+}
 function containedArtifactPath(targetRoot, relativePath) {
   if (!relativePath || relativePath.startsWith("/") || relativePath.includes("\0")) {
     throw new Error(`Unsafe managed artifact path: ${relativePath}`);
@@ -9282,10 +9292,246 @@ function assertManifestIdentity(manifest, request) {
   }
 }
 
+// src/lifecycle/ownership-retire-stale.ts
+import { createHash as createHash9 } from "crypto";
+import { resolve as resolve20 } from "path";
+async function planRetireStaleOwnership(request) {
+  return observe(request, request.transport ?? localTransport);
+}
+async function applyRetireStaleOwnership(request) {
+  assertApplyPreconditions(request);
+  const transport = request.transport ?? localTransport;
+  const lock = await acquireApplyLock(request.targetRoot, request.adapter, transport, {}, {
+    installationType: request.installationType,
+    stateKey: request.destinationStateKey
+  });
+  try {
+    const pending = await listAllApplyJournals(request.targetRoot, request.adapter, transport);
+    if (pending.length > 0) {
+      throw new Error(`Cannot retire stale ownership while runtime apply journal(s) are pending: ${pending.map((item) => item.path).join(", ")}`);
+    }
+    const current = await observe(request, transport);
+    assertExpected(request.planDigest, current.planDigest, "plan digest");
+    assertExpected(request.expectedSourceRevision, current.source.revision, "source manifest revision");
+    assertExpected(request.expectedDestinationRevision, current.destination.revision, "destination manifest revision");
+    assertExpected(request.expectedInventoryRevision, current.manifestInventoryRevision, "manifest inventory revision");
+    const source = await requireManifest(request, request.sourceStateKey, transport, "source");
+    const selectedDigests = new Set(current.selected.map((entry) => entry.sourceEntryDigest));
+    const retained = source.entries.filter((entry) => !selectedDigests.has(entryDigest(entry)));
+    if (source.entries.length - retained.length !== current.selected.length) {
+      throw new Error("Source manifest selection changed while locked; replan required.");
+    }
+    declareMutationPath(current.source.manifestPath);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const mutation = mutationMetadataForApplyJournal();
+    const journal = {
+      version: mutation ? 2 : 1,
+      ...mutation ? { mutation } : {},
+      mode: "uninstall",
+      adapter: request.adapter,
+      installationType: request.installationType,
+      stateKey: request.sourceStateKey,
+      targetRoot: request.targetRoot,
+      baseRevision: source.revision,
+      createdAt: now,
+      updatedAt: now,
+      operations: [],
+      completed: [],
+      manifest: { ...source, entries: retained }
+    };
+    await writeApplyJournal(journal, transport);
+    await commitManifestMetadataJournal(journal, transport);
+    return {
+      ...current,
+      applied: true,
+      sourceManifestRemoved: retained.length === 0,
+      retainedSourceEntries: retained.length
+    };
+  } finally {
+    await lock.release();
+  }
+}
+async function observe(request, transport) {
+  const normalized = normalizeRequest(request);
+  const source = await requireManifest(normalized, normalized.sourceStateKey, transport, "source");
+  const destination = await requireManifest(normalized, normalized.destinationStateKey, transport, "destination");
+  const sourceOwner = workspaceOwnerForRoot(normalized.fromWorkspaceRoot);
+  const destinationOwner = workspaceOwnerForRoot(normalized.toWorkspaceRoot, normalized.toFleetId);
+  const destinationByPath = /* @__PURE__ */ new Map();
+  for (const entry of destination.entries) {
+    if (entry.workspaceOwner !== destinationOwner) continue;
+    const entries = destinationByPath.get(entry.path) ?? [];
+    entries.push(entry);
+    destinationByPath.set(entry.path, entries);
+  }
+  const selected = [];
+  for (const sourceEntry of source.entries) {
+    if (sourceEntry.workspaceOwner !== sourceOwner) continue;
+    const candidates = destinationByPath.get(sourceEntry.path) ?? [];
+    if (candidates.length === 0) continue;
+    if (candidates.length !== 1) {
+      throw new Error(`Destination Fleet manifest has ambiguous ownership for ${sourceEntry.path}.`);
+    }
+    assertRetirableSourceEntry(sourceEntry);
+    const destinationEntry = candidates[0];
+    await assertContributionCoverage(sourceEntry, destinationEntry, normalized.targetRoot, transport);
+    const runtimeHash = await verifyManifestEntryRuntime(normalized.targetRoot, destinationEntry, transport);
+    selected.push({
+      path: sourceEntry.path,
+      sourceEntryDigest: entryDigest(sourceEntry),
+      destinationEntryDigest: entryDigest(destinationEntry),
+      runtimeHash
+    });
+  }
+  selected.sort((a, b) => a.path.localeCompare(b.path) || a.sourceEntryDigest.localeCompare(b.sourceEntryDigest) || a.destinationEntryDigest.localeCompare(b.destinationEntryDigest));
+  if (selected.length === 0) {
+    throw new Error("No stale source ownership entries match an exact path in the destination Fleet manifest.");
+  }
+  const withoutDigest = {
+    adapter: normalized.adapter,
+    installationType: normalized.installationType,
+    targetRoot: normalized.targetRoot,
+    source: {
+      stateKey: normalized.sourceStateKey,
+      manifestPath: installManifestPath(normalized.targetRoot, normalized.adapter, {
+        installationType: normalized.installationType,
+        stateKey: normalized.sourceStateKey
+      }),
+      revision: source.revision,
+      owner: sourceOwner
+    },
+    destination: {
+      stateKey: normalized.destinationStateKey,
+      manifestPath: installManifestPath(normalized.targetRoot, normalized.adapter, {
+        installationType: normalized.installationType,
+        stateKey: normalized.destinationStateKey
+      }),
+      revision: destination.revision,
+      owner: destinationOwner,
+      fleetId: normalized.toFleetId
+    },
+    manifestInventoryRevision: await computeInstallManifestInventoryRevision(
+      normalized.targetRoot,
+      normalized.adapter,
+      transport
+    ),
+    selected
+  };
+  return { ...withoutDigest, planDigest: digest(withoutDigest) };
+}
+function normalizeRequest(request) {
+  const targetRoot = resolve20(request.targetRoot);
+  const sourceStateKey = exactStateKey(request.adapter, request.sourceStateKey, request.installationType, "source");
+  const destinationStateKey = exactStateKey(request.adapter, request.destinationStateKey, request.installationType, "destination");
+  if (sourceStateKey === destinationStateKey) throw new Error("Source and destination state keys must differ.");
+  if (!request.toFleetId.trim()) throw new Error("Destination Fleet id is required.");
+  return {
+    ...request,
+    targetRoot,
+    installationType: request.installationType.trim(),
+    sourceStateKey,
+    destinationStateKey,
+    fromWorkspaceRoot: resolve20(request.fromWorkspaceRoot),
+    toWorkspaceRoot: resolve20(request.toWorkspaceRoot),
+    toFleetId: request.toFleetId.trim()
+  };
+}
+function exactStateKey(adapter, value, installationType, label) {
+  if (!value || stateKeyFor(adapter, { installationType, stateKey: value }) !== value) {
+    throw new Error(`The ${label} state key must be an exact canonical state key.`);
+  }
+  return value;
+}
+async function requireManifest(request, stateKey, transport, label) {
+  const manifest = await readInstallManifest(request.targetRoot, request.adapter, transport, {
+    installationType: request.installationType,
+    stateKey
+  });
+  if (!manifest) throw new Error(`No ${label} install manifest for state key ${stateKey}.`);
+  if (manifest.version !== 2) throw new Error(`${label} ownership retirement requires an Agentwheel v2 install manifest.`);
+  const actualStateKey = stateKeyFor(manifest.adapter, {
+    installationType: manifest.installationType,
+    stateKey: manifest.stateKey
+  });
+  if (manifest.adapter !== request.adapter || manifest.installationType !== request.installationType || resolve20(manifest.targetRoot) !== request.targetRoot || actualStateKey !== stateKey) {
+    throw new Error(`${label} install manifest identity does not match the requested adapter, target, installation type, and state key.`);
+  }
+  return manifest;
+}
+function assertRetirableSourceEntry(entry) {
+  if (entry.semanticPlugin || entry.semanticCommand || entry.executed) {
+    throw new Error(`Cannot retire semantic source ownership at ${entry.path}.`);
+  }
+  if (entry.mergeStrategy && !entry.mergeRemoval) {
+    throw new Error(`Cannot retire incomplete merge ownership at ${entry.path}.`);
+  }
+}
+async function assertContributionCoverage(source, destination, targetRoot, transport) {
+  const sourceManagedBlock = source.mode === "managed-block";
+  const destinationManagedBlock = destination.mode === "managed-block";
+  const sourceMerge = source.mergeStrategy !== void 0;
+  const destinationMerge = destination.mergeStrategy !== void 0;
+  const sourceCategory = sourceManagedBlock ? "managed-block" : sourceMerge ? "merge" : "plain";
+  const destinationCategory = destinationManagedBlock ? "managed-block" : destinationMerge ? "merge" : "plain";
+  if (sourceCategory !== destinationCategory) {
+    throw new Error(
+      `Destination Fleet ownership category ${destinationCategory} cannot replace stale source category ${sourceCategory} at ${source.path}.`
+    );
+  }
+  if (sourceCategory === "plain") return;
+  if (sourceManagedBlock) {
+    const sourceSelector = managedInstructionSelector(source.logicalSelector, source.artifactType, source.artifactName);
+    const destinationSelector = managedInstructionSelector(destination.logicalSelector, destination.artifactType, destination.artifactName);
+    if (!sourceManagedBlock || !destinationManagedBlock || sourceSelector !== destinationSelector) {
+      throw new Error(`Destination Fleet does not exactly cover stale source managed block contribution at ${source.path}.`);
+    }
+    return;
+  }
+  if (source.mergeStrategy && destination.mergeStrategy) {
+    if (!source.mergeRemoval) throw new Error(`Cannot retire incomplete merge ownership at ${source.path}.`);
+    const exactlyCovered = destination.mergeStrategy === source.mergeStrategy && destination.mergeRemoval && contributionSelector(source) === contributionSelector(destination) && canonicalJson(source.mergeRemoval) === canonicalJson(destination.mergeRemoval);
+    if (exactlyCovered) return;
+    const current = await transport.readFile(containedArtifactPath(targetRoot, source.path));
+    if (!mergeContributionAbsent(source.mergeRemoval, source.mergeStrategy, current)) {
+      throw new Error(`Destination Fleet does not exactly cover or replace stale source merge contribution at ${source.path}.`);
+    }
+  }
+}
+function contributionSelector(entry) {
+  return entry.logicalSelector ?? `${entry.artifactType}/${entry.artifactName}`;
+}
+function assertApplyPreconditions(request) {
+  for (const [label, value] of [
+    ["plan digest", request.planDigest],
+    ["source manifest revision", request.expectedSourceRevision],
+    ["destination manifest revision", request.expectedDestinationRevision],
+    ["manifest inventory revision", request.expectedInventoryRevision]
+  ]) {
+    if (!value || !/^[a-f0-9]{64}$/.test(value)) {
+      throw new Error(`Applying stale ownership retirement requires a reviewed lowercase SHA-256 ${label}.`);
+    }
+  }
+}
+function assertExpected(expected, current, label) {
+  if (expected !== current) throw new Error(`Stale ${label}: expected ${expected}, found ${current}; replan required.`);
+}
+function entryDigest(entry) {
+  return digest(entry);
+}
+function digest(value) {
+  return createHash9("sha256").update(canonicalJson(value)).digest("hex");
+}
+function canonicalJson(value) {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (!value || typeof value !== "object") return JSON.stringify(value);
+  const record = value;
+  return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+}
+
 // src/version/policy.ts
 import { execFile as execFile3 } from "child_process";
 import { readFile as readFile23 } from "fs/promises";
-import { join as join39, resolve as resolve20 } from "path";
+import { join as join39, resolve as resolve21 } from "path";
 import { promisify as promisify3 } from "util";
 import { parse as parseJsonc } from "jsonc-parser";
 import { z as z5 } from "zod";
@@ -9379,7 +9625,7 @@ async function discoverVersionsFromSource(pkg, workspaceRoot) {
     if (tagged.length > 0) return tagged;
   }
   if (driverName === "local") {
-    const root = resolve20(workspaceRoot, pkg.source);
+    const root = resolve21(workspaceRoot, pkg.source);
     const manifest2 = await readPackageManifest(root);
     const current = manifest2 ? [{ version: manifest2.version, ref: pkg.requestedRef ?? root }] : [];
     try {
@@ -9502,7 +9748,7 @@ async function readVersionCache(path) {
 // src/profile/members.ts
 import { execFile as execFile4 } from "child_process";
 import { readFile as readFile24 } from "fs/promises";
-import { join as join40, resolve as resolve21 } from "path";
+import { join as join40, resolve as resolve22 } from "path";
 import { promisify as promisify4 } from "util";
 import { z as z7 } from "zod";
 
@@ -9677,7 +9923,7 @@ async function invokeMemberStatus(member, parentWorkspace, chain, options, cliEn
   let stderr = "";
   try {
     if (member.transport === "local") {
-      const workspace = resolve21(parentWorkspace, member.workspace);
+      const workspace = resolve22(parentWorkspace, member.workspace);
       const result = await execFileAsync4(process.execPath, [cliEntry, ...args], {
         cwd: workspace,
         env: env2,
@@ -9723,7 +9969,7 @@ async function runMemberAgentwheel(member, parentWorkspace, args, chain) {
         process.execPath,
         [process.argv[1], "--no-update-check", ...args],
         {
-          cwd: resolve21(parentWorkspace, member.workspace),
+          cwd: resolve22(parentWorkspace, member.workspace),
           env: env2,
           maxBuffer: 20 * 1024 * 1024
         }
@@ -9824,7 +10070,7 @@ function assertNoCompositeCycle(workspaceRoot, profileName, chain) {
   }
 }
 function compositeKey(workspaceRoot, profileName) {
-  return `${resolve21(workspaceRoot)}#${profileName}`;
+  return `${resolve22(workspaceRoot)}#${profileName}`;
 }
 
 // src/status/repository.ts
@@ -9871,7 +10117,7 @@ function valueAfter(lines, prefix) {
 }
 
 // src/catalogue/client.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 import { readFile as readFile25, rm as rm8 } from "fs/promises";
 import { homedir as homedir9 } from "os";
 import { join as join41 } from "path";
@@ -10146,7 +10392,7 @@ var CatalogueClient = class {
     }
     return {
       value: schema.parse(value),
-      digest: createHash9("sha256").update(bytes).digest("hex")
+      digest: createHash10("sha256").update(bytes).digest("hex")
     };
   }
 };
@@ -10157,7 +10403,7 @@ function sameSources2(a, b) {
   return a.length === b.length && a.every((source, index) => source === b[index]);
 }
 function catalogueContentHash(enriched, vercel) {
-  return createHash9("sha256").update(JSON.stringify({ enriched, vercel })).digest("hex");
+  return createHash10("sha256").update(JSON.stringify({ enriched, vercel })).digest("hex");
 }
 
 // src/search/index.ts
@@ -10519,7 +10765,7 @@ function includesToken(normalizedText, token) {
 }
 
 // src/semantic/index.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { homedir as homedir10 } from "os";
 import { join as join42 } from "path";
 import { env, pipeline } from "@huggingface/transformers";
@@ -10609,8 +10855,8 @@ var SemanticSearchClient = class {
     if (!response.ok) throw new Error(`Semantic index file failed (${response.status}): ${descriptor.path}`);
     const bytes = new Uint8Array(await response.arrayBuffer());
     if (bytes.byteLength !== descriptor.bytes) throw new Error(`Semantic index file size does not match: ${descriptor.path}`);
-    const digest = createHash10("sha256").update(bytes).digest("hex");
-    if (digest !== descriptor.sha256) throw new Error(`Semantic index checksum does not match: ${descriptor.path}`);
+    const digest2 = createHash11("sha256").update(bytes).digest("hex");
+    if (digest2 !== descriptor.sha256) throw new Error(`Semantic index checksum does not match: ${descriptor.path}`);
     return bytes;
   }
 };
@@ -10699,7 +10945,7 @@ function ensureTrailingSlash(value) {
 }
 
 // src/trial/skill.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import { readFile as readFile26, stat as stat13 } from "fs/promises";
 import { join as join43 } from "path";
 import { parse as parseYaml2 } from "yaml";
@@ -10729,7 +10975,7 @@ async function createSkillTrial(driver, resolved, selectors) {
     skill: {
       name: artifact.name,
       relativePath: artifact.relativePath,
-      sha256: createHash11("sha256").update(content).digest("hex"),
+      sha256: createHash12("sha256").update(content).digest("hex"),
       frontmatter,
       content
     }
@@ -10748,12 +10994,12 @@ function readSkillFrontmatter(content, artifact) {
 }
 
 // src/lifecycle/fleet-normalize.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { readFile as readFile27, readdir as readdir9, rm as rm9 } from "fs/promises";
 import { homedir as homedir11 } from "os";
-import { basename as basename19, isAbsolute as isAbsolute3, join as join44, relative as relative8, resolve as resolve22 } from "path";
+import { basename as basename19, isAbsolute as isAbsolute3, join as join44, relative as relative8, resolve as resolve23 } from "path";
 async function planFleetNormalization(request) {
-  const normalizedRequest = normalizeRequest(request);
+  const normalizedRequest = normalizeRequest2(request);
   const destinationScope = await resolveWorkspaceScope({
     fleet: normalizedRequest.destinationFleet,
     globalRoot: normalizedRequest.globalRoot
@@ -10774,8 +11020,8 @@ async function planFleetNormalization(request) {
     if (!sourcePackage || !destinationPackage) {
       throw new Error(`Package '${name}' must be an existing duplicate in both source and destination fleets.`);
     }
-    const sourceDeclaration = canonicalJson(sourcePackage);
-    const destinationDeclaration = canonicalJson(destinationPackage);
+    const sourceDeclaration = canonicalJson2(sourcePackage);
+    const destinationDeclaration = canonicalJson2(destinationPackage);
     if (sourceDeclaration !== destinationDeclaration) {
       throw new Error(
         `Package '${name}' has divergent declarations. Source, driver, adapter, adapter configuration, installation type, version policy, selections, aliases, overrides, and suggestions must match before normalization.`
@@ -10812,13 +11058,13 @@ async function planFleetNormalization(request) {
     packages,
     installedState
   };
-  return { ...planWithoutDigest, planDigest: sha2564(canonicalJson(planWithoutDigest)) };
+  return { ...planWithoutDigest, planDigest: sha2564(canonicalJson2(planWithoutDigest)) };
 }
 async function applyFleetNormalization(request, hooks = {}) {
   if (!request.apply) throw new Error("Fleet normalization is dry-run by default; pass --apply with --plan-digest <digest>.");
   if (!request.planDigest) throw new Error("Applying fleet normalization requires --plan-digest <digest> from a reviewed dry-run.");
   assertDigest(request.planDigest);
-  const normalizedRequest = normalizeRequest(request);
+  const normalizedRequest = normalizeRequest2(request);
   const roots = await normalizationRoots(normalizedRequest);
   const ordered = [.../* @__PURE__ */ new Set([roots.source, roots.destination])].sort((a, b) => a.localeCompare(b));
   return withOrderedLocks(ordered, async () => {
@@ -10950,14 +11196,14 @@ async function assertNormalizationPostconditions(journal) {
   }
   for (const graphLock of journal.graphLocks) {
     const raw = await readOptionalRecord(graphLock.path);
-    const digest = raw ? sha2564(canonicalJson(await readGraphLock(graphLock.path))) : null;
-    if (digest !== graphLock.afterDigest) {
+    const digest2 = raw ? sha2564(canonicalJson2(await readGraphLock(graphLock.path))) : null;
+    if (digest2 !== graphLock.afterDigest) {
       throw new Error(`Fleet normalization graph-lock postcheck failed: ${graphLock.path}`);
     }
   }
 }
 async function recoverFleetNormalization(request) {
-  const normalizedRequest = normalizeRequest(request);
+  const normalizedRequest = normalizeRequest2(request);
   const roots = await normalizationRoots(normalizedRequest);
   const ordered = [.../* @__PURE__ */ new Set([roots.source, roots.destination])].sort((a, b) => a.localeCompare(b));
   return withOrderedLocks(ordered, async () => {
@@ -11000,7 +11246,7 @@ async function assertSourceFleetPostcondition(request, source, selectedPackages)
     );
   }
 }
-function normalizeRequest(request) {
+function normalizeRequest2(request) {
   const packages = request.packages === void 0 ? void 0 : sortedUnique6(request.packages);
   if (request.packages !== void 0 && packages?.length === 0) throw new Error("--package requires at least one package name.");
   const artifacts = request.artifacts === void 0 ? void 0 : sortedUnique6(request.artifacts.map((artifact) => normalizeArtifactSelector(artifact)));
@@ -11022,17 +11268,17 @@ function normalizeRequest(request) {
     ...profile ? { profile } : {},
     ...agent ? { agent } : {},
     ...orphanedOwnerRoots ? { orphanedOwnerRoots } : {},
-    ...request.globalRoot ? { globalRoot: resolve22(request.globalRoot) } : {}
+    ...request.globalRoot ? { globalRoot: resolve23(request.globalRoot) } : {}
   };
 }
 function normalizeOrphanedOwnerRoot(value) {
   const root = value.trim();
   if (!root || !isAbsolute3(root)) throw new Error(`Invalid orphaned owner root '${value}'; expected an absolute workspace path.`);
-  return resolve22(root);
+  return resolve23(root);
 }
 async function normalizationRoots(request) {
   const destination = await showRegisteredFleet(request.destinationFleet, { globalRoot: request.globalRoot });
-  const source = request.from === "user" ? resolve22(request.globalRoot ?? homedir11()) : (await showRegisteredFleet(request.from.slice("fleet:".length), { globalRoot: request.globalRoot })).root;
+  const source = request.from === "user" ? resolve23(request.globalRoot ?? homedir11()) : (await showRegisteredFleet(request.from.slice("fleet:".length), { globalRoot: request.globalRoot })).root;
   return { source, destination: destination.root };
 }
 async function withOrderedLocks(roots, fn) {
@@ -11123,10 +11369,10 @@ async function inspectInstalledState(source, destination, packageNames) {
     const destinationGraphAfter = destinationGraph?.lock ?? destinationGraphFromSource(sourceGraph.lock, destinationState.targetFingerprint);
     graphTransfers.push({
       sourceGraphLockPath: sourceGraph.path,
-      sourceGraphLockDigest: sha2564(canonicalJson(sourceGraph.lock)),
+      sourceGraphLockDigest: sha2564(canonicalJson2(sourceGraph.lock)),
       destinationGraphLockPath: destinationState.graphLockPath,
-      destinationGraphLockDigest: destinationGraph ? sha2564(canonicalJson(destinationGraph.lock)) : null,
-      destinationGraphLockAfterDigest: sha2564(canonicalJson(destinationGraphAfter)),
+      destinationGraphLockDigest: destinationGraph ? sha2564(canonicalJson2(destinationGraph.lock)) : null,
+      destinationGraphLockAfterDigest: sha2564(canonicalJson2(destinationGraphAfter)),
       targetKey: sourceGraph.targetKey,
       adapter: destinationState.adapter,
       targetFingerprint: destinationState.targetFingerprint
@@ -11339,7 +11585,7 @@ async function inspectLegacySelfInstalledState(fleet, packageNames, profileName,
       )
     });
     if (!selectedArtifacts) {
-      const fullDigest = sha2564(canonicalJson(graph.lock));
+      const fullDigest = sha2564(canonicalJson2(graph.lock));
       const existingDestinationGraph = graphCandidates.find((candidate) => candidate.path === destinationState.graphLockPath);
       if (existingDestinationGraph) assertGraphIsSubset(graph, existingDestinationGraph);
       const destinationGraph = destinationGraphFromSource(graph.lock, destinationState.targetFingerprint);
@@ -11347,8 +11593,8 @@ async function inspectLegacySelfInstalledState(fleet, packageNames, profileName,
         sourceGraphLockPath: graph.path,
         sourceGraphLockDigest: fullDigest,
         destinationGraphLockPath: destinationState.graphLockPath,
-        destinationGraphLockDigest: existingDestinationGraph ? sha2564(canonicalJson(existingDestinationGraph.lock)) : null,
-        destinationGraphLockAfterDigest: sha2564(canonicalJson(destinationGraph)),
+        destinationGraphLockDigest: existingDestinationGraph ? sha2564(canonicalJson2(existingDestinationGraph.lock)) : null,
+        destinationGraphLockAfterDigest: sha2564(canonicalJson2(destinationGraph)),
         targetKey: graph.targetKey,
         adapter: graph.adapter,
         targetFingerprint: destinationState.targetFingerprint
@@ -11406,7 +11652,7 @@ function targetKeysForAgent(scope, name) {
 async function runtimeRoots(scope) {
   const roots = /* @__PURE__ */ new Set([scope.root]);
   if (scope.config.packages.some((pkg) => pkg.installationType === "user") || Object.values(scope.config.agents).some((agent) => agent.installationType === "user")) {
-    roots.add(resolve22(process.env.AGENTWHEEL_TEST_HOME || process.env.HOME || homedir11()));
+    roots.add(resolve23(process.env.AGENTWHEEL_TEST_HOME || process.env.HOME || homedir11()));
   }
   for (const [name, agent] of Object.entries(scope.config.agents)) {
     if (agent.transport === "ssh") throw new Error(`Installed-state normalization cannot inspect SSH agent '${name}' locally.`);
@@ -11443,14 +11689,14 @@ async function collectManifests(roots) {
         }
         continue;
       }
-      if (resolve22(parsed.targetRoot) !== resolve22(root)) {
+      if (resolve23(parsed.targetRoot) !== resolve23(root)) {
         throw new Error(`Install manifest target root does not match its enumerated runtime root: ${path}`);
       }
       const expectedPath = installManifestPath(parsed.targetRoot, parsed.adapter, {
         installationType: parsed.installationType,
         stateKey: parsed.stateKey
       });
-      if (resolve22(expectedPath) !== resolve22(path)) {
+      if (resolve23(expectedPath) !== resolve23(path)) {
         throw new Error(`Install manifest state identity does not match its canonical path: ${path}`);
       }
       found.set(path, { path, raw, manifest: { ...parsed, revision: computeManifestRevision(raw), legacy: false } });
@@ -11471,7 +11717,7 @@ async function collectManifestPaths(paths) {
       installationType: parsed.installationType,
       stateKey: parsed.stateKey
     });
-    if (resolve22(expectedPath) !== resolve22(path)) {
+    if (resolve23(expectedPath) !== resolve23(path)) {
       throw new Error(`Install manifest state identity does not match its canonical path: ${path}`);
     }
     found.push({ path, raw, manifest: { ...parsed, revision: computeManifestRevision(raw), legacy: false } });
@@ -11518,7 +11764,7 @@ async function relevantGraphLocks(workspaceRoot, selected, targetKeys, include)
     const projection = relevantGraphProjection(lock, selected);
     results.push({
       ...candidate,
-      digest: sha2564(canonicalJson(projection)),
+      digest: sha2564(canonicalJson2(projection)),
       artifactIdentities: lock.canonical.artifacts.filter((artifact) => artifact.owners.some((owner) => ownerMatchesGraphPackage(lock, owner, selected))).map(graphArtifactIdentity).sort()
     });
   }
@@ -11554,7 +11800,7 @@ async function legacyManifestPathForConfiguredTarget(scope, graph) {
     baseDir: scope.root
   });
   const targetRoot = resolveConfigPath(agent.root, scope.root);
-  const installRoot = resolve22(installRootForAdapterInstallationType(adapter, targetRoot, agent.installationType, false));
+  const installRoot = resolve23(installRootForAdapterInstallationType(adapter, targetRoot, agent.installationType, false));
   const stateKey = stateKeyFor(adapter.name, {
     installationType: agent.installationType,
     targetFingerprint: graph.lock.canonical.targetFingerprint
@@ -11628,7 +11874,7 @@ async function targetStateForGraph(scope, graph, identityFleetId = scope.fleetId
     targetFingerprint,
     ...identityFleetId ? { fleetId: identityFleetId } : {}
   });
-  const installRoot = resolve22(installRootForAdapterInstallationType(adapter, targetRoot, installationType, false));
+  const installRoot = resolve23(installRootForAdapterInstallationType(adapter, targetRoot, installationType, false));
   return {
     adapter: adapter.name,
     installationType,
@@ -11659,9 +11905,9 @@ async function legacyTargetStateForGraph(scope, graph) {
   };
 }
 function assertGraphIsSubset(source, destination) {
-  const sourceRoots = new Map(source.lock.canonical.roots.map((root) => [root.rootId, canonicalJson(root)]));
+  const sourceRoots = new Map(source.lock.canonical.roots.map((root) => [root.rootId, canonicalJson2(root)]));
   for (const root of destination.lock.canonical.roots) {
-    if (sourceRoots.get(root.rootId) !== canonicalJson(root)) {
+    if (sourceRoots.get(root.rootId) !== canonicalJson2(root)) {
       throw new Error(
         `Partially normalized destination graph diverges at root '${root.rootId}': ${destination.path}`
       );
@@ -11691,7 +11937,7 @@ function destinationGraphFromSource(source, targetFingerprint) {
 function mergeDestinationManifest(existing, state, generatedAt, desiredEntries, replaceOwners = /* @__PURE__ */ new Set()) {
   if (existing) {
     const manifest2 = existing.manifest;
-    if (manifest2.adapter !== state.adapter || manifest2.installationType !== state.installationType || manifest2.stateKey !== state.stateKey || resolve22(manifest2.targetRoot) !== state.installRoot) {
+    if (manifest2.adapter !== state.adapter || manifest2.installationType !== state.installationType || manifest2.stateKey !== state.stateKey || resolve23(manifest2.targetRoot) !== state.installRoot) {
       throw new Error(`Destination manifest identity diverges from the derived target: ${existing.path}`);
     }
   }
@@ -11751,7 +11997,7 @@ async function assertEquivalentRuntimeState(entry, sourcePath, destinationPath)
       const content = await readFile27(path, "utf8");
       if (hasMergeRemovalContent(entry.mergeRemoval)) {
         assertExactMergeContribution(entry.mergeRemoval, entry.mergeStrategy, content);
-      } else if (resolve22(sourcePath) === resolve22(destinationPath) && entry.mergeStrategy !== "codex-toml-mcp") {
+      } else if (resolve23(sourcePath) === resolve23(destinationPath) && entry.mergeStrategy !== "codex-toml-mcp") {
         assertExactMergeContribution({}, entry.mergeStrategy, content);
       } else {
         throw new Error(`Installed-state normalization cannot prove incomplete merge ownership at ${path}.`);
@@ -11762,8 +12008,8 @@ async function assertEquivalentRuntimeState(entry, sourcePath, destinationPath)
   await assertEquivalentRuntimeBytes(sourcePath, destinationPath, entry.hash);
 }
 function renderedEntryPathForRoot(root, entryPath) {
-  const normalizedRoot = resolve22(root);
-  const candidate = resolve22(normalizedRoot, entryPath);
+  const normalizedRoot = resolve23(root);
+  const candidate = resolve23(normalizedRoot, entryPath);
   if (candidate !== normalizedRoot && !candidate.startsWith(`${normalizedRoot}/`)) {
     throw new Error(`Install manifest entry escapes its target root: ${entryPath}`);
   }
@@ -11854,8 +12100,8 @@ function ownerMatchesGraphPackage(lock, owner, selected) {
   return ownerMatchesPackage(owner, selected) || lock.canonical.roots.some((root) => selected.has(root.rootId) && root.graphNodeId === owner);
 }
 function renderedEntryPath(manifest, entry) {
-  const root = resolve22(manifest.targetRoot);
-  const candidate = resolve22(root, entry.path);
+  const root = resolve23(manifest.targetRoot);
+  const candidate = resolve23(root, entry.path);
   if (candidate !== root && !candidate.startsWith(`${root}/`)) {
     throw new Error(`Install manifest entry escapes its target root: ${entry.path}`);
   }
@@ -11874,7 +12120,7 @@ function assertSimpleVerifiableEntry(entry, path) {
   if (entry.kind !== "file" && entry.kind !== "dir") throw new Error(`Unsupported installed entry kind at ${path}.`);
 }
 function entryIdentity(entry) {
-  return canonicalJson({
+  return canonicalJson2({
     path: entry.path,
     artifactType: entry.artifactType,
     artifactName: entry.artifactName,
@@ -11892,7 +12138,7 @@ function entryIdentity(entry) {
   });
 }
 function graphArtifactIdentity(artifact) {
-  return canonicalJson({
+  return canonicalJson2({
     graphNodeId: artifact.graphNodeId,
     type: artifact.type,
     name: artifact.name,
@@ -11906,7 +12152,7 @@ function graphArtifactIdentity(artifact) {
   });
 }
 function graphEntryIdentity(entry) {
-  return canonicalJson({
+  return canonicalJson2({
     graphNodeId: entry.graphNodeId,
     type: entry.artifactType,
     name: entry.artifactName,
@@ -12010,7 +12256,7 @@ async function buildJournalGraphLockStates(plan) {
   for (const transfer of plan.installedState.graphTransfers) {
     const sourceBefore = JSON.parse(await readFile27(transfer.sourceGraphLockPath, "utf8"));
     const sourceLock = await readGraphLock(transfer.sourceGraphLockPath);
-    const sourceDigest = sha2564(canonicalJson(sourceLock));
+    const sourceDigest = sha2564(canonicalJson2(sourceLock));
     if (sourceDigest !== transfer.sourceGraphLockDigest) {
       throw new Error(`Source graph lock changed after planning: ${transfer.sourceGraphLockPath}`);
     }
@@ -12028,9 +12274,9 @@ async function buildJournalGraphLockStates(plan) {
       continue;
     }
     const destinationBefore = await readOptionalRecord(transfer.destinationGraphLockPath);
-    const destinationBeforeDigest = destinationBefore ? sha2564(canonicalJson(await readGraphLock(transfer.destinationGraphLockPath))) : null;
+    const destinationBeforeDigest = destinationBefore ? sha2564(canonicalJson2(await readGraphLock(transfer.destinationGraphLockPath))) : null;
     const destinationAfter = destinationBefore ? await readGraphLock(transfer.destinationGraphLockPath) : destinationGraphFromSource(sourceLock, transfer.targetFingerprint);
-    const destinationAfterDigest = sha2564(canonicalJson(destinationAfter));
+    const destinationAfterDigest = sha2564(canonicalJson2(destinationAfter));
     if (destinationBeforeDigest !== transfer.destinationGraphLockDigest || destinationAfterDigest !== transfer.destinationGraphLockAfterDigest) {
       throw new Error(`Destination graph lock changed after planning: ${transfer.destinationGraphLockPath}`);
     }
@@ -12140,8 +12386,8 @@ async function assertJournalRecoverable(journal) {
   }
   for (const graphLock of journal.graphLocks) {
     const raw = await readOptionalRecord(graphLock.path);
-    const digest = raw ? sha2564(canonicalJson(await readGraphLock(graphLock.path))) : null;
-    if (digest !== graphLock.beforeDigest && digest !== graphLock.afterDigest) {
+    const digest2 = raw ? sha2564(canonicalJson2(await readGraphLock(graphLock.path))) : null;
+    if (digest2 !== graphLock.beforeDigest && digest2 !== graphLock.afterDigest) {
       throw new Error(`Cannot recover fleet normalization because graph lock changed outside the transaction: ${graphLock.path}`);
     }
   }
@@ -12193,12 +12439,12 @@ function packageMap(config) {
   return result;
 }
 function configRevision(config) {
-  return sha2564(canonicalJson(config));
+  return sha2564(canonicalJson2(config));
 }
 function normalizationJournalPath(sourceRoot, destinationFleet) {
   return join44(sourceRoot, ".agentwheel", `fleet-normalize-${destinationFleet}.journal.json`);
 }
-function canonicalJson(value) {
+function canonicalJson2(value) {
   return JSON.stringify(sortValue(value));
 }
 function sortValue(value) {
@@ -12209,7 +12455,7 @@ function sortValue(value) {
   return value;
 }
 function sha2564(value) {
-  return createHash12("sha256").update(value).digest("hex");
+  return createHash13("sha256").update(value).digest("hex");
 }
 function assertDigest(value) {
   if (!/^[a-f0-9]{64}$/.test(value)) throw new Error(`Invalid plan digest: ${value}`);
@@ -12247,6 +12493,7 @@ var commandGovernance = {
   "package migrate": "governed-always",
   remember: "governed-always",
   "ownership handoff": "governed-unless-dry-run",
+  "ownership retire-stale": "governed-apply",
   "mcp retire": "governed-apply",
   eject: "governed-always",
   uninstall: "governed-unless-dry-run",
@@ -12663,7 +12910,7 @@ ownershipCommand.command("handoff").description("transfer one managed artifact b
   const toWorkspaceRoot = normalizeCliPath(options.toWorkspaceRoot);
   if (options.toFleet) {
     const fleet = await showRegisteredFleet(options.toFleet);
-    if (resolve23(fleet.root) !== resolve23(toWorkspaceRoot)) {
+    if (resolve24(fleet.root) !== resolve24(toWorkspaceRoot)) {
       throw new Error(`Destination fleet '${options.toFleet}' is registered at ${fleet.root}, not ${toWorkspaceRoot}.`);
     }
   }
@@ -12688,6 +12935,84 @@ ownershipCommand.command("handoff").description("transfer one managed artifact b
   console.log(`Manifest revision: ${result.manifestRevision}`);
   console.log(`Owner: ${result.fromOwner} -> ${result.toOwner}`);
 });
+ownershipCommand.command("retire-stale").description("retire stale source-manifest ownership already covered by one Fleet manifest").requiredOption("--from-workspace-root <path>", "exact stale workspace owner root").requiredOption("--to-workspace-root <path>", "registered destination Fleet root").requiredOption("--source-state-key <key>", "exact source install-manifest state key").requiredOption("--fleet <id>", "registered destination Fleet").option("--adapter <adapter>", "built-in adapter").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named destination Fleet agent").option("--profile <name>", "destination Fleet profile resolving to one target").option("--plan-digest <sha256>", "reviewed plan digest; required with --apply").option("--expected-source-revision <sha256>", "reviewed source manifest revision; required with --apply").option("--expected-destination-revision <sha256>", "reviewed destination manifest revision; required with --apply").option("--expected-inventory-revision <sha256>", "reviewed runtime manifest inventory revision; required with --apply").option("--apply", "apply the exact reviewed metadata-only retirement", false).option("--json", "print the complete deterministic plan as JSON", false).action(async (options) => {
+  const normalizedOptions = normalizeRuntimeScopeOptions(options);
+  const fleet = await showRegisteredFleet(options.fleet);
+  const toWorkspaceRoot = normalizeCliPath(options.toWorkspaceRoot);
+  if (resolve24(fleet.root) !== resolve24(toWorkspaceRoot)) {
+    throw new Error(`Destination Fleet '${options.fleet}' is registered at ${fleet.root}, not ${toWorkspaceRoot}.`);
+  }
+  const targets = await resolveCliTargets(normalizedOptions);
+  if (targets.length !== 1) {
+    throw new Error(`Stale ownership retirement requires exactly one destination Fleet target, found ${targets.length}.`);
+  }
+  const target = targets[0];
+  if (target.fleetId !== options.fleet || resolve24(target.workspaceRoot) !== resolve24(fleet.root)) {
+    throw new Error(`Resolved target does not belong to destination Fleet '${options.fleet}'.`);
+  }
+  const adapterOptions = adapterOptionsForTarget(target, normalizedOptions);
+  const adapter = await resolveAdapterForTarget(target, adapterOptions);
+  const installationType = normalizedOptions.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
+  const state = installStateForTarget(target, adapter, adapterOptions, installationType);
+  const request = {
+    targetRoot: state.installRoot,
+    adapter: adapter.name,
+    installationType,
+    sourceStateKey: options.sourceStateKey,
+    destinationStateKey: state.stateKey,
+    fromWorkspaceRoot: normalizeCliPath(options.fromWorkspaceRoot),
+    toWorkspaceRoot,
+    toFleetId: fleet.id,
+    planDigest: options.planDigest,
+    expectedSourceRevision: options.expectedSourceRevision,
+    expectedDestinationRevision: options.expectedDestinationRevision,
+    expectedInventoryRevision: options.expectedInventoryRevision,
+    transport: transportForTarget(target)
+  };
+  const result = options.apply ? await applyRetireStaleOwnership(request) : await planRetireStaleOwnership(request);
+  const targetArgs = options.profile ? ["--profile", options.profile] : target.agentName ? ["--agent", target.agentName] : ["--adapter", adapter.name, "--target-root", target.targetRoot];
+  const applyArgs = [
+    "agentwheel",
+    "ownership",
+    "retire-stale",
+    "--from-workspace-root",
+    request.fromWorkspaceRoot,
+    "--to-workspace-root",
+    request.toWorkspaceRoot,
+    "--source-state-key",
+    request.sourceStateKey,
+    "--fleet",
+    request.toFleetId,
+    ...targetArgs,
+    "--installation-type",
+    installationType,
+    ...options.adapterConfig ? ["--adapter-config", options.adapterConfig] : [],
+    ...options.adapterModule ? ["--adapter-module", options.adapterModule] : [],
+    ...options.allowAdapterCode ? ["--allow-adapter-code"] : [],
+    "--plan-digest",
+    result.planDigest,
+    "--expected-source-revision",
+    result.source.revision,
+    "--expected-destination-revision",
+    result.destination.revision,
+    "--expected-inventory-revision",
+    result.manifestInventoryRevision,
+    "--apply"
+  ];
+  const applyCommand = applyArgs.map(shellQuoteArgument).join(" ");
+  if (options.json) {
+    console.log(JSON.stringify({ ...result, applyCommand }, null, 2));
+    return;
+  }
+  console.log(`${options.apply ? "Retired stale ownership" : "Stale ownership retirement plan"}: ${result.selected.length} entr${result.selected.length === 1 ? "y" : "ies"}`);
+  console.log(`Target: ${result.adapter}/${result.installationType} at ${result.targetRoot}`);
+  console.log(`Source: ${result.source.stateKey} revision ${result.source.revision}`);
+  console.log(`Destination: ${result.destination.stateKey} revision ${result.destination.revision}`);
+  console.log(`Manifest inventory revision: ${result.manifestInventoryRevision}`);
+  for (const entry of result.selected) console.log(`- ${entry.path}: ${entry.sourceEntryDigest} -> ${entry.destinationEntryDigest}`);
+  console.log(`Plan digest: ${result.planDigest}`);
+  if (!options.apply) console.log(`Apply: ${applyCommand}`);
+});
 var mcpCommand = program.command("mcp").description("operate on MCP runtime configuration");
 mcpCommand.command("retire").description("remove one exact legacy MCP contribution with explicit state ownership").argument("<package>", "configured package containing exactly one legacy MCP artifact").option("--user", "use the user workspace", false).option("--local", "use the nearest local workspace", false).option("--fleet <id>", "use one registered named fleet").option("-t, --target-root <path>", "explicit runtime/project root").option("--agent <name>", "one named agent from merged config").option("--profile <name>", "workspace runtime profile resolving to one target").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--from-workspace-root <path>", "required previous owner when managed legacy state exists").option("--dry-run", "show the retirement plan without writing (default)", false).option("--apply", "apply the exact reviewed retirement plan", false).option("--json", "print the install plan as JSON", false).action(async (packageName, options) => {
   if (options.apply && options.dryRun) throw new Error("--apply cannot be combined with --dry-run.");
@@ -13678,7 +14003,7 @@ function scopeUpdatePlanToDependencies(result, selectors, previousLock, manifest
     selectedPreviousNodeIds,
     selectedRootIds
   );
-  const graphLockDigest = createHash13("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash14("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...result,
     bundle: { ...result.bundle, graphLock },
@@ -13804,7 +14129,7 @@ function operationBelongsToDependencyUpdate(operation, allowedNodeIds, allowedNa
 function scopeInstallPlanToArtifact(result, rootId, focused, manifest) {
   const scoped = scopePlanOperationsToArtifact(result, rootId, focused, manifest);
   const graphLock = focusedGraphLockForInstall(scoped.bundle.graphLock, rootId, focused);
-  const graphLockDigest = createHash13("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash14("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...scoped,
     bundle: { ...scoped.bundle, graphLock },
@@ -13815,7 +14140,7 @@ function scopeInstallPlanToArtifact(result, rootId, focused, manifest) {
 function scopeUpdatePlanToArtifact(result, rootId, focused, previousLock, manifest) {
   const scoped = scopePlanOperationsToArtifact(result, rootId, focused, manifest, previousLock);
   const graphLock = mergeFocusedArtifactGraphLock(scoped.bundle.graphLock, previousLock, rootId, focused);
-  const graphLockDigest = createHash13("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash14("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...scoped,
     bundle: { ...scoped.bundle, graphLock },
@@ -14110,7 +14435,7 @@ function scopeUpdatePlanToRoot(result, rootId, previousLock, manifest) {
     selectedPreviousNodeIds,
     /* @__PURE__ */ new Set([rootId])
   );
-  const graphLockDigest = createHash13("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash14("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...scoped,
     bundle: { ...scoped.bundle, graphLock },
@@ -14666,7 +14991,7 @@ async function assertCompositeMutationSupported(workspaceRoot, profile, readOnly
         `Composite-profile mutation is refused before member execution because ${member.id} uses ${member.transport}; durable remote policy and recovery preflight is not implemented.`
       );
     }
-    const memberRoot = resolve23(workspaceRoot, member.workspace);
+    const memberRoot = resolve24(workspaceRoot, member.workspace);
     const memberPolicy = await mutationPolicyForWorkspace(memberRoot);
     if (memberPolicy?.revisioning.mode === "commit-after-verify") {
       throw new Error(
@@ -15117,11 +15442,14 @@ function looksLikeSourceSpecifier(value) {
 }
 function normalizeCliPath(value) {
   if (value === "~") return homedir12();
-  if (value.startsWith("~/")) return resolve23(homedir12(), value.slice(2));
-  return resolve23(value);
+  if (value.startsWith("~/")) return resolve24(homedir12(), value.slice(2));
+  return resolve24(value);
+}
+function shellQuoteArgument(value) {
+  return /^[a-z0-9_./:@%+=,-]+$/i.test(value) ? value : `'${value.replace(/'/g, `'"'"'`)}'`;
 }
 function isHomePath(path) {
-  return resolve23(path) === resolve23(homedir12());
+  return resolve24(path) === resolve24(homedir12());
 }
 function adapterListFromOption(adapter) {
   if (!adapter) return [];
@@ -15242,7 +15570,7 @@ function withFleetExample(config) {
   };
 }
 async function findAgentwheelPackageRoot(start) {
-  let current = resolve23(start);
+  let current = resolve24(start);
   while (true) {
     if (await findPackageManifestPath(current, { warnLegacy: false })) return current;
     const parent = dirname22(current);

package/dist/{transaction-ITXC7FFV.js → transaction-7CNV5MAQ.js}

@@ -8,6 +8,7 @@ import {
   applyLockPath,
   assertApplyJournalRecoveryAllowed,
   assertGovernedRuntimeTransportSupported,
+  listAllApplyJournals,
   listApplyJournals,
   localPathExists,
   mutationMetadataForApplyJournal,
@@ -17,7 +18,7 @@ import {
   removeApplyJournal,
   rollbackCompletedOperations,
   writeApplyJournal
-} from "./chunk-BJEZXIXX.js";
+} from "./chunk-Z4N7TB6Q.js";
 import "./chunk-7VPI5J5Y.js";
 export {
   abortApplyJournal,
@@ -28,6 +29,7 @@ export {
   applyLockPath,
   assertApplyJournalRecoveryAllowed,
   assertGovernedRuntimeTransportSupported,
+  listAllApplyJournals,
   listApplyJournals,
   localPathExists,
   mutationMetadataForApplyJournal,

package/openpack.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "name": "NestDevLab/agentwheel",
-  "version": "0.20.1",
+  "version": "0.20.2",
   "provides": [
     { "type": "skills", "path": "skills" }
   ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentwheel",
-  "version": "0.20.1",
+  "version": "0.20.2",
   "description": "Weave skills, rules, and instructions across every AI agent.",
   "type": "module",
   "license": "MIT",

package/skills/agentwheel/SKILL.md

@@ -5,7 +5,7 @@ allowed-tools: [Bash]
 license: MIT
 metadata:
   author: NestDevLab
-  version: "0.20.1"
+  version: "0.20.2"
 ---
 
 # agentwheel

package/skills/agentwheel-discovery/SKILL.md

@@ -5,7 +5,7 @@ allowed-tools: [Bash]
 license: MIT
 metadata:
   author: NestDevLab
-  version: "0.20.1"
+  version: "0.20.2"
 ---
 
 # Agentwheel Discovery