agentwheel 0.20.16 → 0.20.18

package/dist/index.js

@@ -113,11 +113,11 @@ import {
 } from "./chunk-GE7F76AC.js";
 
 // src/cli/index.ts
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 import { existsSync } from "fs";
-import { mkdir as mkdir16, mkdtemp as mkdtemp4, realpath as realpath2, rm as rm10, writeFile as writeFile13 } from "fs/promises";
+import { mkdir as mkdir16, mkdtemp as mkdtemp4, realpath as realpath3, rm as rm10, writeFile as writeFile13 } from "fs/promises";
 import { homedir as homedir12, tmpdir as tmpdir5 } from "os";
-import { basename as basename21, dirname as dirname23, isAbsolute as isAbsolute4, join as join46, relative as relative10, resolve as resolve26 } from "path";
+import { basename as basename21, dirname as dirname23, isAbsolute as isAbsolute5, join as join46, relative as relative11, resolve as resolve27 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { Command } from "commander";
 
@@ -3113,14 +3113,14 @@ async function writeMermaidAsset(response) {
     "content-type": "application/javascript; charset=utf-8",
     "cache-control": "public, max-age=3600"
   });
-  await new Promise((resolve27) => {
+  await new Promise((resolve28) => {
     const stream = createReadStream(assetPath);
     stream.on("error", () => {
       if (!response.headersSent) writeText(response, 404, "Mermaid asset unavailable.\n");
       else response.destroy();
-      resolve27();
+      resolve28();
     });
-    stream.on("end", resolve27);
+    stream.on("end", resolve28);
     stream.pipe(response);
   });
 }
@@ -3147,14 +3147,14 @@ function escapeHtml2(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
 function listen(server, port, bind) {
-  return new Promise((resolve27, reject) => {
+  return new Promise((resolve28, reject) => {
     const onError = (error) => {
       server.off("listening", onListening);
       reject(error);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve27();
+      resolve28();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -3162,7 +3162,7 @@ function listen(server, port, bind) {
   });
 }
 function waitForShutdown(server, beforeClose) {
-  return new Promise((resolve27) => {
+  return new Promise((resolve28) => {
     let closing = false;
     const shutdown = () => {
       if (closing) return;
@@ -3170,7 +3170,7 @@ function waitForShutdown(server, beforeClose) {
       process.off("SIGINT", shutdown);
       process.off("SIGTERM", shutdown);
       beforeClose();
-      server.close(() => resolve27());
+      server.close(() => resolve28());
     };
     process.once("SIGINT", shutdown);
     process.once("SIGTERM", shutdown);
@@ -3180,7 +3180,7 @@ function waitForShutdown(server, beforeClose) {
       process.off("SIGINT", shutdown);
       process.off("SIGTERM", shutdown);
       beforeClose();
-      resolve27();
+      resolve28();
     });
   });
 }
@@ -3733,7 +3733,7 @@ async function fetchClawHubPackage(fetchImpl, packageName) {
   throw new Error(`ClawHub lookup failed for ${packageName}`);
 }
 async function delay(ms) {
-  await new Promise((resolve27) => setTimeout(resolve27, ms));
+  await new Promise((resolve28) => setTimeout(resolve28, ms));
 }
 function parseClawHubSource(source) {
   if (!source.startsWith(sourcePrefix)) {
@@ -3910,7 +3910,7 @@ async function withGitCacheMaintenanceLock(cacheRoot, timeoutMs, fn) {
       if (Date.now() - started > timeoutMs) {
         throw new Error(`Timed out waiting for git cache maintenance lock at ${lockPath}`);
       }
-      await new Promise((resolve27) => setTimeout(resolve27, 50));
+      await new Promise((resolve28) => setTimeout(resolve28, 50));
     }
   }
   try {
@@ -6776,8 +6776,8 @@ function verifyIntegrity(integrity, sourceHash, label) {
 async function withCachePathLock(path, fn) {
   const previous = cacheLocks.get(path) ?? Promise.resolve();
   let release = () => void 0;
-  const current = previous.then(() => new Promise((resolve27) => {
-    release = resolve27;
+  const current = previous.then(() => new Promise((resolve28) => {
+    release = resolve28;
   }));
   cacheLocks.set(path, current);
   await previous;
@@ -8785,6 +8785,7 @@ async function assertNoForeignWorkspaceState(check) {
   }
   const foreign = [...foreignByOwner.values()];
   if (foreign.length === 0) return observations.sort((left, right) => left.path.localeCompare(right.path));
+  const currentOwner = parseWorkspaceOwner(check.workspaceOwner);
   throw new Error([
     `Refusing to plan ${check.adapter} at ${check.installRoot}.`,
     "This runtime root already carries Agentwheel state owned by another workspace, at paths this run would install:",
@@ -8795,7 +8796,10 @@ async function assertNoForeignWorkspaceState(check) {
     `Current workspace: ${check.workspaceRoot} (state key ${check.stateKey})`,
     "Agentwheel keys install state by target fingerprint, so this run cannot read that manifest and",
     "would report those paths as unmanaged conflicts or drift.",
-    parseWorkspaceOwner(check.workspaceOwner)?.fleetId ? "Reconcile the owners with an explicit agentwheel fleet normalize operation before planning this fleet." : "Re-run from the owning workspace, or pass --force-foreign-state to plan against it anyway."
+    ...currentOwner?.fleetId ? [
+      "Reconcile the owners with an explicit agentwheel fleet normalize operation before planning this fleet.",
+      ...currentOwner.root !== root ? ["For this nested workspace, adopt legacy fingerprint-keyed claims with agentwheel ownership adopt-legacy."] : []
+    ] : ["Re-run from the owning workspace, or pass --force-foreign-state to plan against it anyway."]
   ].join("\n"));
 }
 async function exactForeignKeepOperation(check, collision, operations) {
@@ -10001,7 +10005,7 @@ async function observe(request, transport) {
   const normalized = normalizeRequest(request);
   const source = await requireManifest(normalized, normalized.sourceStateKey, transport, "source");
   const destination = await requireManifest(normalized, normalized.destinationStateKey, transport, "destination");
-  const sourceOwner = workspaceOwnerForRoot(normalized.fromWorkspaceRoot);
+  const sourceOwner = workspaceOwnerForRoot(normalized.fromWorkspaceRoot, normalized.fromFleetId);
   const destinationOwner = workspaceOwnerForRoot(normalized.toWorkspaceRoot, normalized.toFleetId);
   const destinationByPath = /* @__PURE__ */ new Map();
   for (const entry of destination.entries) {
@@ -10078,6 +10082,11 @@ function normalizeRequest(request) {
   const destinationStateKey = exactStateKey(request.adapter, request.destinationStateKey, request.installationType, "destination");
   if (sourceStateKey === destinationStateKey) throw new Error("Source and destination state keys must differ.");
   if (!request.toFleetId.trim()) throw new Error("Destination Fleet id is required.");
+  const fromFleetId = request.fromFleetId?.trim();
+  if (request.fromFleetId !== void 0 && !fromFleetId) throw new Error("Source Fleet id cannot be empty.");
+  if (fromFleetId && (fromFleetId !== request.toFleetId.trim() || resolve21(request.fromWorkspaceRoot) !== resolve21(request.toWorkspaceRoot))) {
+    throw new Error("Fleet-qualified stale ownership retirement requires the same source and destination Fleet and workspace root.");
+  }
   return {
     ...request,
     targetRoot,
@@ -10085,6 +10094,7 @@ function normalizeRequest(request) {
     sourceStateKey,
     destinationStateKey,
     fromWorkspaceRoot: resolve21(request.fromWorkspaceRoot),
+    ...fromFleetId ? { fromFleetId } : {},
     toWorkspaceRoot: resolve21(request.toWorkspaceRoot),
     toFleetId: request.toFleetId.trim()
   };
@@ -10101,7 +10111,7 @@ async function requireManifest(request, stateKey, transport, label) {
     stateKey
   });
   if (!manifest) throw new Error(`No ${label} install manifest for state key ${stateKey}.`);
-  if (manifest.version !== 2) throw new Error(`${label} ownership retirement requires an Agentwheel v2 install manifest.`);
+  if (manifest.version !== 2) throw new Error(`The ${label} install manifest must be an Agentwheel v2 manifest.`);
   const actualStateKey = stateKeyFor(manifest.adapter, {
     installationType: manifest.installationType,
     stateKey: manifest.stateKey
@@ -10121,6 +10131,7 @@ function assertRetirableSourceEntry(entry, abandonIncompleteMergeOwner) {
   }
 }
 async function assertContributionCoverage(source, destination, targetRoot, transport, abandonIncompleteMergeOwner) {
+  containedArtifactPath(targetRoot, source.path);
   const sourceManagedBlock = source.mode === "managed-block";
   const destinationManagedBlock = destination.mode === "managed-block";
   const sourceMerge = source.mergeStrategy !== void 0;
@@ -10146,8 +10157,19 @@ async function assertContributionCoverage(source, destination, targetRoot, trans
       if (abandonIncompleteMergeOwner) return "abandoned-incomplete-merge";
       throw new Error(`Cannot retire incomplete merge ownership at ${source.path}.`);
     }
-    const exactlyCovered = destination.mergeStrategy === source.mergeStrategy && hasMergeRemovalContent(destination.mergeRemoval) && contributionSelector(source) === contributionSelector(destination) && canonicalJson(source.mergeRemoval) === canonicalJson(destination.mergeRemoval);
+    const selectorsDiffer = contributionSelector(source) !== contributionSelector(destination);
+    if (selectorsDiffer && !sameContributionSelector(source, destination)) {
+      throw new Error(`Destination Fleet does not identify the same source merge artifact at ${source.path}.`);
+    }
+    if (source.mergeStrategy === "json-deep" && destination.mergeStrategy === "json-deep" && hasMergeRemovalContent(destination.mergeRemoval) && sameContributionSelector(source, destination)) {
+      if (canonicalJson(combineMergeRemovals(destination.mergeRemoval, source.mergeRemoval)) === canonicalJson(destination.mergeRemoval)) return "exact";
+      throw new Error(`Destination Fleet does not exactly cover stale source merge contribution at ${source.path}.`);
+    }
+    const exactlyCovered = destination.mergeStrategy === source.mergeStrategy && hasMergeRemovalContent(destination.mergeRemoval) && sameContributionSelector(source, destination) && canonicalJson(source.mergeRemoval) === canonicalJson(destination.mergeRemoval);
     if (exactlyCovered) return "exact";
+    if (selectorsDiffer) {
+      throw new Error(`Destination Fleet does not exactly cover stale source merge contribution at ${source.path}.`);
+    }
     const current = await transport.readFile(containedArtifactPath(targetRoot, source.path));
     if (!mergeContributionAbsent(source.mergeRemoval, source.mergeStrategy, current)) {
       throw new Error(`Destination Fleet does not exactly cover or replace stale source merge contribution at ${source.path}.`);
@@ -10159,6 +10181,15 @@ async function assertContributionCoverage(source, destination, targetRoot, trans
 function contributionSelector(entry) {
   return entry.logicalSelector ?? `${entry.artifactType}/${entry.artifactName}`;
 }
+function sameContributionSelector(source, destination) {
+  if (contributionSelector(source) === contributionSelector(destination)) return true;
+  if (!source.packageName || source.packageName !== destination.packageName || source.artifactType !== destination.artifactType || source.artifactName !== destination.artifactName || source.installName !== destination.installName || source.sourceHash !== destination.sourceHash || !source.graphNodeId || !destination.graphNodeId) return false;
+  const selector = artifactSelectorKey({ type: source.artifactType, name: source.artifactName });
+  if (source.logicalSelector !== `${source.graphNodeId}:${selector}` || destination.logicalSelector !== `${destination.graphNodeId}:${selector}`) return false;
+  const sourceAt = source.graphNodeId.lastIndexOf("@");
+  const destinationAt = destination.graphNodeId.lastIndexOf("@");
+  return sourceAt > 0 && destinationAt > 0 && source.graphNodeId.slice(0, sourceAt) === source.packageName && destination.graphNodeId.slice(0, destinationAt) === destination.packageName && source.graphNodeId.indexOf("+", sourceAt) > sourceAt && destination.graphNodeId.indexOf("+", destinationAt) > destinationAt;
+}
 function assertApplyPreconditions(request) {
   for (const [label, value] of [
     ["plan digest", request.planDigest],
@@ -10187,9 +10218,14 @@ function canonicalJson(value) {
   return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
 }
 
+// src/lifecycle/ownership-adopt-legacy.ts
+import { createHash as createHash11 } from "crypto";
+import { realpath as realpath2 } from "fs/promises";
+import { isAbsolute as isAbsolute3, relative as relative9, resolve as resolve23 } from "path";
+
 // src/lifecycle/legacy-recovery-plan.ts
 import { createHash as createHash10 } from "crypto";
-import { readdir as readdir10 } from "fs/promises";
+import { lstat as lstat3, readdir as readdir10 } from "fs/promises";
 import { basename as basename20, dirname as dirname21, join as join39, posix as posix3, relative as relative8, resolve as resolve22 } from "path";
 async function inventoryHistoricalLocks(fleetRoot) {
   const root = join39(fleetRoot, ".agentwheel", "locks");
@@ -10201,15 +10237,38 @@ async function inventoryHistoricalLocks(fleetRoot) {
     })) {
       const path = join39(dir, entry.name);
       if (entry.isDirectory()) await visit(path);
-      else if (entry.isFile() && entry.name.endsWith(".graph-lock.json")) {
-        const lock = await readGraphLock(path);
-        found.push({ path, digest: sha2564(canonicalGraphLockJson(lock)), lock });
-      }
+      else if (entry.isFile() && entry.name.endsWith(".graph-lock.json")) found.push(await historicalLock(path));
     }
   }
   await visit(root);
   return found.sort((a, b) => a.path.localeCompare(b.path));
 }
+async function findLegacyNamedLocks(workspaceRoot, adapter, fingerprint) {
+  const root = join39(workspaceRoot, ".agentwheel", "locks");
+  const found = [];
+  for (const target of await readdir10(root, { withFileTypes: true }).catch((error) => {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  })) {
+    if (!target.isDirectory()) continue;
+    const path = join39(root, target.name, adapter, `${fingerprint}.graph-lock.json`);
+    const stats = await lstat3(path).catch((error) => {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    });
+    if (!stats?.isFile()) continue;
+    const item = await historicalLock(path);
+    if (item.lock.canonical.targetFingerprint === fingerprint) found.push(item);
+  }
+  return found.sort((a, b) => a.path.localeCompare(b.path));
+}
+function lockCoversEntry(lock, entry) {
+  return lock.canonical.artifacts.some((artifact) => artifact.graphNodeId === entry.graphNodeId && artifact.logicalSelector === entry.logicalSelector && artifact.hash === entry.sourceHash);
+}
+async function historicalLock(path) {
+  const lock = await readGraphLock(path);
+  return { path, digest: sha2564(canonicalGraphLockJson(lock)), lock };
+}
 async function planLegacyRecovery(input) {
   const { graphPlan, installRoot, targetKey: targetKey2, adapter, installationType, historicalLocks, transport } = input;
   assertCompleteGraphPlan(graphPlan);
@@ -10340,7 +10399,7 @@ function claimFor(item, entry, locks, binding) {
   if (inTargetDir.length && !boundLocks.length) evidence.push("graph-lock fingerprint, filename, or state key does not bind claim");
   if (boundLocks.length && !boundLocks.some((candidate) => candidate.lock.canonical.artifacts.some((artifact) => artifact.graphNodeId === nodeId && artifact.logicalSelector === selector))) {
     evidence.push("historical graph-lock selector/node does not cover claim");
-  } else if (boundLocks.length && !boundLocks.some((candidate) => candidate.lock.canonical.artifacts.some((artifact) => artifact.graphNodeId === nodeId && artifact.logicalSelector === selector && artifact.hash === entry.sourceHash))) {
+  } else if (boundLocks.length && !boundLocks.some((candidate) => lockCoversEntry(candidate.lock, { graphNodeId: nodeId, logicalSelector: selector, sourceHash: entry.sourceHash }))) {
     evidence.push("historical graph-lock artifact hash differs from manifest source hash");
   }
   const foreign = owner !== binding.expectedOwner || !sameRoot || item.manifest.version !== 2 || item.manifest.installationType !== binding.installationType || item.manifest.version === 2 && (item.manifest.stateKey !== item.stateKey || item.manifest.adapter !== binding.adapter) || matches.length > 0 && inTargetDir.length === 0;
@@ -10439,10 +10498,394 @@ function sha2564(value) {
   return createHash10("sha256").update(value).digest("hex");
 }
 
+// src/lifecycle/ownership-adopt-legacy.ts
+var absentRevision = "absent";
+function desiredCoverageFromPlan(plan) {
+  return plan.operations.filter((operation) => operation.desiredHash && operation.action !== "remove" && operation.action !== "keep").map((operation) => ({
+    path: operation.relativeDestPath,
+    artifactType: operation.artifactType,
+    artifactName: operation.artifactName,
+    kind: operation.kind,
+    ...operation.packageName ? { packageName: operation.packageName } : {}
+  })).sort((left, right) => left.path.localeCompare(right.path));
+}
+async function planAdoptLegacyOwnership(request) {
+  return observe2(request, request.transport ?? localTransport);
+}
+async function applyAdoptLegacyOwnership(request) {
+  assertApplyPreconditions2(request);
+  const transport = request.transport ?? localTransport;
+  const targetRoot = resolve23(request.targetRoot);
+  const installationType = request.installationType.trim();
+  const lock = await acquireApplyLock(targetRoot, request.adapter, transport, {}, {
+    installationType,
+    stateKey: request.destinationStateKey
+  });
+  try {
+    await assertNoPendingJournals(targetRoot, request.adapter, transport);
+    const current = await observe2(request, transport);
+    assertExpected(request.planDigest, current.planDigest, "plan digest");
+    assertExpected(request.expectedSourceRevision, current.source.revision, "source manifest revision");
+    assertExpected(request.expectedDestinationRevision, current.destination.revision ?? absentRevision, "destination manifest revision");
+    assertExpected(request.expectedInventoryRevision, current.manifestInventoryRevision, "manifest inventory revision");
+    const identity = { targetRoot, adapter: request.adapter, installationType };
+    const source = await requireManifest(identity, current.source.stateKey, transport, "source");
+    const destination = await readDestination(identity, current.destination.stateKey, transport);
+    const selectedByDigest = new Map(current.selected.map((entry) => [entry.sourceEntryDigest, entry]));
+    const adopted = [];
+    const retained = [];
+    for (const entry of source.entries) {
+      const selected = selectedByDigest.get(entryDigest(entry));
+      if (!selected) retained.push(entry);
+      else if (selected.action === "adopt") adopted.push({ ...entry, workspaceOwner: current.destination.owner });
+    }
+    if (source.entries.length - retained.length !== current.selected.length) {
+      throw new Error("Source manifest selection changed while locked; replan required.");
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    if (adopted.length > 0) {
+      declareMutationPath(current.destination.manifestPath);
+      const base = destination ?? {
+        version: 2,
+        adapter: request.adapter,
+        installationType,
+        stateKey: current.destination.stateKey,
+        targetRoot,
+        generatedAt: now,
+        revision: "pending-apply-0000",
+        legacy: false,
+        entries: []
+      };
+      await commitMetadata({
+        ...base,
+        entries: [...base.entries, ...adopted].sort((left, right) => left.path.localeCompare(right.path))
+      }, destination?.revision ?? null, now, transport);
+    }
+    declareMutationPath(current.source.manifestPath);
+    await commitMetadata({ ...source, entries: retained }, source.revision, now, transport);
+    return {
+      ...current,
+      applied: true,
+      adoptedEntries: adopted.length,
+      retiredCoveredEntries: current.selected.length - adopted.length,
+      sourceManifestRemoved: retained.length === 0,
+      retainedSourceEntries: retained.length
+    };
+  } finally {
+    await lock.release();
+  }
+}
+async function commitMetadata(manifest, baseRevision, now, transport) {
+  const mutation = mutationMetadataForApplyJournal();
+  const journal = {
+    version: mutation ? 2 : 1,
+    ...mutation ? { mutation } : {},
+    mode: "uninstall",
+    adapter: manifest.adapter,
+    installationType: manifest.installationType,
+    stateKey: manifest.stateKey,
+    targetRoot: manifest.targetRoot,
+    baseRevision,
+    createdAt: now,
+    updatedAt: now,
+    operations: [],
+    completed: [],
+    manifest
+  };
+  await writeApplyJournal(journal, transport);
+  await commitManifestMetadataJournal(journal, transport);
+}
+async function observe2(request, transport) {
+  if (transport.kind === "ssh") {
+    throw new Error("Legacy ownership adoption does not support SSH targets; legacy SSH state does not prove its endpoint.");
+  }
+  const input = await normalizeRequest2(request);
+  const { targetRoot, adapter, installationType } = input;
+  await assertNoPendingJournals(targetRoot, adapter, transport);
+  const identity = { targetRoot, adapter, installationType };
+  if (!await readInstallManifest(targetRoot, adapter, transport, { installationType, stateKey: input.sourceStateKey })) {
+    throw new Error(`Nothing to adopt: no source install manifest for state key ${input.sourceStateKey}.`);
+  }
+  const source = await requireManifest(identity, input.sourceStateKey, transport, "source");
+  const destination = await readDestination(identity, input.destinationStateKey, transport);
+  if (!destination && await pathExists(request.destinationGraphLockPath)) {
+    throw new Error(
+      `Destination has a stable graph lock without a stable manifest at ${request.destinationGraphLockPath}; reconcile it before adopting legacy ownership.`
+    );
+  }
+  const desiredByPath = /* @__PURE__ */ new Map();
+  for (const item of request.desiredCoverage) desiredByPath.set(item.path, [...desiredByPath.get(item.path) ?? [], item]);
+  const { entries: selectedEntries, retained, provenance } = await selectLegacySource(
+    input,
+    input.sourceStateKey,
+    input.fingerprint,
+    source,
+    desiredByPath
+  );
+  const selectedPaths = new Set(selectedEntries.map((entry) => entry.path));
+  const selected = [];
+  for (const entry of selectedEntries) {
+    const runtimePath = containedArtifactPath(targetRoot, entry.path);
+    const runtimeHash = await transport.pathExists(runtimePath) ? await transport.hashPath(runtimePath) : null;
+    const drift = runtimeHash !== entry.hash;
+    if (drift && request.carryDrift !== true) {
+      throw new Error(
+        runtimeHash === null ? `Managed artifact is missing at ${entry.path}; pass --carry-drift to keep the recorded hash.` : `Managed artifact is drifted at ${entry.path}: manifest ${entry.hash}, current ${runtimeHash}; pass --carry-drift to keep the recorded hash.`
+      );
+    }
+    const atPath = destination?.entries.filter((candidate) => candidate.path === entry.path) ?? [];
+    let destinationEntryDigest;
+    if (atPath.length > 0) {
+      const covering = atPath.length === 1 ? atPath[0] : void 0;
+      if (!covering || !coversSourceEntry(covering, entry, input.destinationOwner)) {
+        throw new Error(`Destination state at ${entry.path} is not an exact copy of the source claim owned by this workspace.`);
+      }
+      if (!drift) await verifyManifestEntryRuntime(targetRoot, covering, transport);
+      destinationEntryDigest = entryDigest(covering);
+    }
+    selected.push({
+      path: entry.path,
+      action: destinationEntryDigest ? "retire-covered" : "adopt",
+      sourceEntryDigest: entryDigest(entry),
+      ...destinationEntryDigest ? { destinationEntryDigest } : {},
+      recordedHash: entry.hash,
+      runtimeHash,
+      drift
+    });
+  }
+  const remainingDuplicates = [];
+  const selectedByPath = new Map(selectedEntries.map((entry) => [entry.path, entry]));
+  for (const item of await listInstallManifests(targetRoot, adapter, transport)) {
+    if (item.stateKey === input.destinationStateKey) continue;
+    const duplicatePaths = [];
+    for (const entry of item.manifest.entries) {
+      if (!selectedPaths.has(entry.path)) continue;
+      const owner = "workspaceOwner" in entry ? entry.workspaceOwner : legacyUnownedWorkspaceOwner;
+      if (owner !== input.sourceOwner) {
+        throw new Error(`${entry.path} is also claimed by ${owner} in ${item.fileName}; legacy ownership cannot be adopted.`);
+      }
+      if (item.stateKey !== input.sourceStateKey) duplicatePaths.push(entry.path);
+    }
+    if (duplicatePaths.length === 0) continue;
+    await assertRetirableDuplicate(input, item, duplicatePaths, selectedByPath, desiredByPath, transport);
+    for (const path of duplicatePaths) remainingDuplicates.push({ stateKey: item.stateKey, path });
+  }
+  const withoutDigest = {
+    adapter,
+    installationType,
+    targetRoot,
+    source: {
+      stateKey: input.sourceStateKey,
+      manifestPath: installManifestPath(targetRoot, adapter, { installationType, stateKey: input.sourceStateKey }),
+      revision: source.revision,
+      owner: input.sourceOwner,
+      class: input.sourceClass,
+      provenanceLock: { path: provenance.path, digest: provenance.digest }
+    },
+    destination: {
+      stateKey: input.destinationStateKey,
+      manifestPath: installManifestPath(targetRoot, adapter, { installationType, stateKey: input.destinationStateKey }),
+      revision: destination?.revision ?? null,
+      owner: input.destinationOwner,
+      workspaceRoot: input.workspaceRoot
+    },
+    manifestInventoryRevision: await computeInstallManifestInventoryRevision(targetRoot, adapter, transport),
+    selected: selected.sort((left, right) => left.path.localeCompare(right.path)),
+    retained: retained.sort((left, right) => left.path.localeCompare(right.path) || left.owner.localeCompare(right.owner)),
+    remainingDuplicates: remainingDuplicates.sort((left, right) => left.stateKey.localeCompare(right.stateKey) || left.path.localeCompare(right.path)),
+    // identity only, so a newer package revision doesn't invalidate a reviewed plan
+    desiredCoverage: request.desiredCoverage.filter((item) => selectedPaths.has(item.path)).map(({ path, artifactType, artifactName, kind }) => ({ path, artifactType, artifactName, kind })).sort((left, right) => left.path.localeCompare(right.path) || left.artifactType.localeCompare(right.artifactType) || left.artifactName.localeCompare(right.artifactName))
+  };
+  return { ...withoutDigest, planDigest: createHash11("sha256").update(canonicalJson(withoutDigest)).digest("hex") };
+}
+async function normalizeRequest2(request) {
+  if (request.destinationFleetId !== void 0) {
+    throw new Error("Legacy ownership adoption targets a nested workspace; a Fleet target uses fleet normalize or ownership retire-stale.");
+  }
+  const targetRoot = resolve23(request.targetRoot);
+  const installationType = request.installationType.trim();
+  const sourceStateKey = exactStateKey(request.adapter, request.sourceStateKey, installationType, "source");
+  const destinationStateKey = exactStateKey(request.adapter, request.destinationStateKey, installationType, "destination");
+  const fingerprint = legacyFingerprint(request.adapter, installationType, sourceStateKey);
+  if (!fingerprint) {
+    throw new Error(`The source must be a legacy state key of the form ${request.adapter}.${installationType}.<64-hex target fingerprint>.`);
+  }
+  if (sourceStateKey === destinationStateKey) throw new Error("Source and destination state keys must differ.");
+  const scope = await resolveWorkspaceOwnershipScope(request.workspaceRoot, { globalRoot: request.globalRoot });
+  const destinationOwner = workspaceOwnerForRoot(scope.root, scope.fleetId);
+  const workspaceRoot = await realpath2(request.workspaceRoot);
+  const sourceRoot = resolve23(request.fromWorkspaceRoot);
+  const sourceOwner = workspaceOwnerForRoot(sourceRoot);
+  let sourceClass;
+  if (sourceRoot === workspaceRoot || sourceRoot === resolve23(request.workspaceRoot)) {
+    if (sourceOwner === destinationOwner) {
+      throw new Error(`${sourceOwner} is already the destination owner; ordinary install migration handles its legacy state.`);
+    }
+    sourceClass = "own-legacy-owner";
+  } else {
+    const sourceForms = [sourceRoot, ...await realpath2(sourceRoot).then((path) => [path], () => [])];
+    const workspaceForms = [workspaceRoot, resolve23(request.workspaceRoot), scope.root];
+    if (sourceForms.some((source) => workspaceForms.some((workspace) => containsPath2(source, workspace) || containsPath2(workspace, source)))) {
+      throw new Error(`Source root ${sourceRoot} contains or is contained by the destination workspace; it cannot be adopted as a foreign root.`);
+    }
+    for (const fleet of await listRegisteredFleets({ globalRoot: request.globalRoot })) {
+      const fleetForms = [resolve23(fleet.root), ...await realpath2(fleet.root).then((path) => [path], () => [])];
+      if (sourceForms.some((source) => fleetForms.some((root) => containsPath2(root, source)))) {
+        throw new Error(`Source root ${sourceRoot} is inside registered Fleet '${fleet.id}'; use fleet normalize or ownership retire-stale.`);
+      }
+    }
+    sourceClass = "foreign-root";
+  }
+  return {
+    targetRoot,
+    adapter: request.adapter,
+    installationType,
+    sourceStateKey,
+    destinationStateKey,
+    fingerprint,
+    sourceRoot,
+    sourceOwner,
+    workspaceRoot,
+    destinationOwner,
+    sourceClass
+  };
+}
+function legacyFingerprint(adapter, installationType, stateKey) {
+  const prefix = `${adapter}.${installationType}.`;
+  const fingerprint = stateKey.startsWith(prefix) ? stateKey.slice(prefix.length) : "";
+  return /^[a-f0-9]{64}$/u.test(fingerprint) ? fingerprint : void 0;
+}
+async function selectLegacySource(input, stateKey, fingerprint, source, desiredByPath) {
+  if (source.adapterCode) {
+    throw new Error(`The install manifest for ${stateKey} records programmatic adapter code; legacy ownership adoption refuses it.`);
+  }
+  if (source.entries.some((entry) => entry.workspaceOwner === input.destinationOwner)) {
+    throw new Error(
+      `Source state ${stateKey} has entries already owned by the destination owner; run a normal install to migrate them first.`
+    );
+  }
+  for (const entry of source.entries) {
+    if (entry.workspaceOwner === input.sourceOwner) assertPlainEntry(entry, input.targetRoot);
+  }
+  const entries = [];
+  const retained = [];
+  for (const entry of source.entries) {
+    if (entry.workspaceOwner !== input.sourceOwner) {
+      retained.push({ path: entry.path, owner: entry.workspaceOwner, reason: "other-owner" });
+      continue;
+    }
+    const desired = desiredByPath.get(entry.path) ?? [];
+    if (desired.length === 0) {
+      retained.push({ path: entry.path, owner: entry.workspaceOwner, reason: "not-desired" });
+      continue;
+    }
+    if (!desired.some((item) => desiredCovers(item, entry))) {
+      throw new Error(`The current graph plans a different artifact at ${entry.path}; legacy ownership cannot be adopted there.`);
+    }
+    entries.push(entry);
+  }
+  if (entries.length === 0) {
+    throw new Error(`Nothing to adopt: no entry owned by ${input.sourceOwner} in ${stateKey} is desired by this workspace.`);
+  }
+  const paths = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    if (paths.has(entry.path)) throw new Error(`Source state ${stateKey} has more than one entry at ${entry.path}.`);
+    paths.add(entry.path);
+  }
+  return { entries, retained, provenance: await resolveProvenance(input, fingerprint, entries) };
+}
+async function assertRetirableDuplicate(input, item, paths, selectedByPath, desiredByPath, transport) {
+  const refuse = (path, reason) => new Error(
+    `${path} is also claimed by ${input.sourceOwner} in ${item.fileName}, which a follow-up adopt-legacy run could not retire: ${reason}`
+  );
+  const fingerprint = legacyFingerprint(input.adapter, input.installationType, item.stateKey);
+  if (!fingerprint) throw refuse(paths[0], `${item.stateKey} is not a legacy fingerprint state key for ${input.adapter}/${input.installationType}.`);
+  let duplicates;
+  try {
+    const identity = { targetRoot: input.targetRoot, adapter: input.adapter, installationType: input.installationType };
+    const manifest = await requireManifest(identity, item.stateKey, transport, "duplicate source");
+    duplicates = (await selectLegacySource(input, item.stateKey, fingerprint, manifest, desiredByPath)).entries;
+  } catch (error) {
+    throw refuse(paths[0], error instanceof Error ? error.message : String(error));
+  }
+  for (const path of paths) {
+    const duplicate = duplicates.find((entry) => entry.path === path);
+    if (!duplicate || !sameRecordedArtifact(duplicate, selectedByPath.get(path))) {
+      throw refuse(path, "its artifact identity or recorded hashes differ from the adopted entry.");
+    }
+  }
+}
+async function resolveProvenance(input, fingerprint, entries) {
+  const locks = await findLegacyNamedLocks(input.sourceRoot, input.adapter, fingerprint);
+  if (locks.length === 0) {
+    throw new Error(
+      `Source root ${input.sourceRoot} has no legacy-named graph lock for ${input.adapter}/${fingerprint}; provenance cannot be proven.`
+    );
+  }
+  if (input.sourceClass === "own-legacy-owner") return locks[0];
+  if (locks.length !== 1) {
+    throw new Error(`Source root ${input.sourceRoot} must have exactly one legacy-named graph lock for ${fingerprint}, found ${locks.length}.`);
+  }
+  const lock = locks[0];
+  for (const entry of entries) {
+    if (entry.graphLockDigest !== lock.digest) {
+      throw new Error(`Recorded graph-lock digest for ${entry.path} does not match ${lock.path}.`);
+    }
+    if (!lockCoversEntry(lock.lock, entry)) {
+      throw new Error(`Legacy graph lock ${lock.path} does not cover ${entry.path} with its recorded node, selector, and source hash.`);
+    }
+  }
+  return lock;
+}
+async function readDestination(identity, stateKey, transport) {
+  if (!await readInstallManifest(identity.targetRoot, identity.adapter, transport, { installationType: identity.installationType, stateKey })) {
+    return void 0;
+  }
+  return requireManifest(identity, stateKey, transport, "destination");
+}
+function assertPlainEntry(entry, targetRoot) {
+  if (entry.mode || entry.mergeStrategy || entry.semanticPlugin || entry.semanticCommand || entry.executed) {
+    throw new Error(`Legacy ownership adoption supports only plain file or directory entries; ${entry.path} is not one.`);
+  }
+  containedArtifactPath(targetRoot, entry.path);
+}
+function desiredCovers(item, entry) {
+  return item.artifactType === entry.artifactType && item.artifactName === entry.artifactName && item.kind === entry.kind && (!item.packageName || !entry.packageName || item.packageName === entry.packageName);
+}
+function coversSourceEntry(destination, source, owner) {
+  return destination.workspaceOwner === owner && !destination.mode && !destination.mergeStrategy && !destination.semanticPlugin && sameRecordedArtifact(destination, source);
+}
+function sameRecordedArtifact(left, right) {
+  return left.artifactType === right.artifactType && left.artifactName === right.artifactName && left.kind === right.kind && left.hash === right.hash && left.sourceHash === right.sourceHash;
+}
+async function assertNoPendingJournals(targetRoot, adapter, transport) {
+  const pending = await listAllApplyJournals(targetRoot, adapter, transport);
+  if (pending.length > 0) {
+    throw new Error(`Cannot adopt legacy ownership while runtime apply journal(s) are pending: ${pending.map((item) => item.path).join(", ")}`);
+  }
+}
+function assertApplyPreconditions2(request) {
+  for (const [label, value, allowAbsent] of [
+    ["plan digest", request.planDigest, false],
+    ["source manifest revision", request.expectedSourceRevision, false],
+    ["destination manifest revision", request.expectedDestinationRevision, true],
+    ["manifest inventory revision", request.expectedInventoryRevision, false]
+  ]) {
+    if (allowAbsent && value === absentRevision) continue;
+    if (!value || !/^[a-f0-9]{64}$/.test(value)) {
+      throw new Error(`Applying legacy ownership adoption requires a reviewed lowercase SHA-256 ${label}${allowAbsent ? " or 'absent'" : ""}.`);
+    }
+  }
+}
+function containsPath2(parent, candidate) {
+  const path = relative9(parent, candidate);
+  return path === "" || !path.startsWith("..") && !isAbsolute3(path);
+}
+
 // src/version/policy.ts
 import { execFile as execFile3 } from "child_process";
 import { readFile as readFile23 } from "fs/promises";
-import { join as join40, resolve as resolve23 } from "path";
+import { join as join40, resolve as resolve24 } from "path";
 import { promisify as promisify3 } from "util";
 import { parse as parseJsonc } from "jsonc-parser";
 import { z as z5 } from "zod";
@@ -10536,7 +10979,7 @@ async function discoverVersionsFromSource(pkg, workspaceRoot) {
     if (tagged.length > 0) return tagged;
   }
   if (driverName === "local") {
-    const root = resolve23(workspaceRoot, pkg.source);
+    const root = resolve24(workspaceRoot, pkg.source);
     const manifest2 = await readPackageManifest(root);
     const current = manifest2 ? [{ version: manifest2.version, ref: pkg.requestedRef ?? root }] : [];
     try {
@@ -10659,7 +11102,7 @@ async function readVersionCache(path) {
 // src/profile/members.ts
 import { execFile as execFile4 } from "child_process";
 import { readFile as readFile24 } from "fs/promises";
-import { join as join41, resolve as resolve24 } from "path";
+import { join as join41, resolve as resolve25 } from "path";
 import { promisify as promisify4 } from "util";
 import { z as z7 } from "zod";
 
@@ -10834,7 +11277,7 @@ async function invokeMemberStatus(member, parentWorkspace, chain, options, cliEn
   let stderr = "";
   try {
     if (member.transport === "local") {
-      const workspace = resolve24(parentWorkspace, member.workspace);
+      const workspace = resolve25(parentWorkspace, member.workspace);
       const result = await execFileAsync4(process.execPath, [cliEntry, ...args], {
         cwd: workspace,
         env: env2,
@@ -10880,7 +11323,7 @@ async function runMemberAgentwheel(member, parentWorkspace, args, chain) {
         process.execPath,
         [process.argv[1], ...memberCommandArgs(member, args)],
         {
-          cwd: resolve24(parentWorkspace, member.workspace),
+          cwd: resolve25(parentWorkspace, member.workspace),
           env: env2,
           maxBuffer: 20 * 1024 * 1024
         }
@@ -10986,7 +11429,7 @@ function assertNoCompositeCycle(workspaceRoot, profileName, chain) {
   }
 }
 function compositeKey(workspaceRoot, profileName) {
-  return `${resolve24(workspaceRoot)}#${profileName}`;
+  return `${resolve25(workspaceRoot)}#${profileName}`;
 }
 
 // src/status/repository.ts
@@ -11033,7 +11476,7 @@ function valueAfter(lines, prefix) {
 }
 
 // src/catalogue/client.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import { readFile as readFile25, rm as rm8 } from "fs/promises";
 import { homedir as homedir9 } from "os";
 import { join as join42 } from "path";
@@ -11308,7 +11751,7 @@ var CatalogueClient = class {
     }
     return {
       value: schema.parse(value),
-      digest: createHash11("sha256").update(bytes).digest("hex")
+      digest: createHash12("sha256").update(bytes).digest("hex")
     };
   }
 };
@@ -11319,7 +11762,7 @@ function sameSources2(a, b) {
   return a.length === b.length && a.every((source, index) => source === b[index]);
 }
 function catalogueContentHash(enriched, vercel) {
-  return createHash11("sha256").update(JSON.stringify({ enriched, vercel })).digest("hex");
+  return createHash12("sha256").update(JSON.stringify({ enriched, vercel })).digest("hex");
 }
 
 // src/search/index.ts
@@ -11681,7 +12124,7 @@ function includesToken(normalizedText, token) {
 }
 
 // src/semantic/index.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { homedir as homedir10 } from "os";
 import { join as join43 } from "path";
 import { env, pipeline } from "@huggingface/transformers";
@@ -11771,7 +12214,7 @@ var SemanticSearchClient = class {
     if (!response.ok) throw new Error(`Semantic index file failed (${response.status}): ${descriptor.path}`);
     const bytes = new Uint8Array(await response.arrayBuffer());
     if (bytes.byteLength !== descriptor.bytes) throw new Error(`Semantic index file size does not match: ${descriptor.path}`);
-    const digest2 = createHash12("sha256").update(bytes).digest("hex");
+    const digest2 = createHash13("sha256").update(bytes).digest("hex");
     if (digest2 !== descriptor.sha256) throw new Error(`Semantic index checksum does not match: ${descriptor.path}`);
     return bytes;
   }
@@ -11861,7 +12304,7 @@ function ensureTrailingSlash(value) {
 }
 
 // src/trial/skill.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import { readFile as readFile26, stat as stat13 } from "fs/promises";
 import { join as join44 } from "path";
 import { parse as parseYaml2 } from "yaml";
@@ -11891,7 +12334,7 @@ async function createSkillTrial(driver, resolved, selectors) {
     skill: {
       name: artifact.name,
       relativePath: artifact.relativePath,
-      sha256: createHash13("sha256").update(content).digest("hex"),
+      sha256: createHash14("sha256").update(content).digest("hex"),
       frontmatter,
       content
     }
@@ -11910,12 +12353,12 @@ function readSkillFrontmatter(content, artifact) {
 }
 
 // src/lifecycle/fleet-normalize.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 import { readFile as readFile27, readdir as readdir11, rm as rm9 } from "fs/promises";
 import { homedir as homedir11 } from "os";
-import { dirname as dirname22, isAbsolute as isAbsolute3, join as join45, relative as relative9, resolve as resolve25 } from "path";
+import { dirname as dirname22, isAbsolute as isAbsolute4, join as join45, relative as relative10, resolve as resolve26 } from "path";
 async function planFleetNormalization(request) {
-  const normalizedRequest = normalizeRequest2(request);
+  const normalizedRequest = normalizeRequest3(request);
   const destinationScope = await resolveWorkspaceScope({
     fleet: normalizedRequest.destinationFleet,
     globalRoot: normalizedRequest.globalRoot
@@ -11987,7 +12430,7 @@ async function applyFleetNormalization(request, hooks = {}) {
   if (!request.apply) throw new Error("Fleet normalization is dry-run by default; pass --apply with --plan-digest <digest>.");
   if (!request.planDigest) throw new Error("Applying fleet normalization requires --plan-digest <digest> from a reviewed dry-run.");
   assertDigest(request.planDigest);
-  const normalizedRequest = normalizeRequest2(request);
+  const normalizedRequest = normalizeRequest3(request);
   const roots = await normalizationRoots(normalizedRequest);
   const ordered = [.../* @__PURE__ */ new Set([roots.source, roots.destination])].sort((a, b) => a.localeCompare(b));
   return withOrderedLocks(ordered, async () => {
@@ -12126,7 +12569,7 @@ async function assertNormalizationPostconditions(journal) {
   }
 }
 async function recoverFleetNormalization(request) {
-  const normalizedRequest = normalizeRequest2(request);
+  const normalizedRequest = normalizeRequest3(request);
   const roots = await normalizationRoots(normalizedRequest);
   const ordered = [.../* @__PURE__ */ new Set([roots.source, roots.destination])].sort((a, b) => a.localeCompare(b));
   return withOrderedLocks(ordered, async () => {
@@ -12169,7 +12612,7 @@ async function assertSourceFleetPostcondition(request, source, selectedPackages)
     );
   }
 }
-function normalizeRequest2(request) {
+function normalizeRequest3(request) {
   const packages = request.packages === void 0 ? void 0 : sortedUnique6(request.packages);
   if (request.packages !== void 0 && packages?.length === 0) throw new Error("--package requires at least one package name.");
   const artifacts = request.artifacts === void 0 ? void 0 : sortedUnique6(request.artifacts.map((artifact) => normalizeArtifactSelector(artifact)));
@@ -12191,17 +12634,17 @@ function normalizeRequest2(request) {
     ...profile ? { profile } : {},
     ...agent ? { agent } : {},
     ...orphanedOwnerRoots ? { orphanedOwnerRoots } : {},
-    ...request.globalRoot ? { globalRoot: resolve25(request.globalRoot) } : {}
+    ...request.globalRoot ? { globalRoot: resolve26(request.globalRoot) } : {}
   };
 }
 function normalizeOrphanedOwnerRoot(value) {
   const root = value.trim();
-  if (!root || !isAbsolute3(root)) throw new Error(`Invalid orphaned owner root '${value}'; expected an absolute workspace path.`);
-  return resolve25(root);
+  if (!root || !isAbsolute4(root)) throw new Error(`Invalid orphaned owner root '${value}'; expected an absolute workspace path.`);
+  return resolve26(root);
 }
 async function normalizationRoots(request) {
   const destination = await showRegisteredFleet(request.destinationFleet, { globalRoot: request.globalRoot });
-  const source = request.from === "user" ? resolve25(request.globalRoot ?? homedir11()) : (await showRegisteredFleet(request.from.slice("fleet:".length), { globalRoot: request.globalRoot })).root;
+  const source = request.from === "user" ? resolve26(request.globalRoot ?? homedir11()) : (await showRegisteredFleet(request.from.slice("fleet:".length), { globalRoot: request.globalRoot })).root;
   return { source, destination: destination.root };
 }
 async function withOrderedLocks(roots, fn) {
@@ -12416,7 +12859,7 @@ async function inspectLegacySelfInstalledState(fleet, packageNames, profileName,
   let normalizedGraphCount = 0;
   for (const graph of graphCandidates) {
     const destinationState = await targetStateForGraph(fleet, graph, fleet.fleetId, allowOrphanedRetiredPackages);
-    if (resolve25(destinationState.graphLockPath) === resolve25(graph.path)) {
+    if (resolve26(destinationState.graphLockPath) === resolve26(graph.path)) {
       const destinationManifest = (await collectManifestPaths([destinationState.manifestPath]))[0];
       if (destinationManifest?.manifest.entries.some((entry) => entry.workspaceOwner === fleetOwner && entryMatchesPackages(entry, selected))) {
         assertCorrelatedGraphManifest(
@@ -12431,7 +12874,7 @@ async function inspectLegacySelfInstalledState(fleet, packageNames, profileName,
       }
     }
     const legacyState = await legacyTargetStateForGraph(fleet, graph, allowOrphanedRetiredPackages);
-    if (resolve25(legacyState.graphLockPath) !== resolve25(graph.path)) {
+    if (resolve26(legacyState.graphLockPath) !== resolve26(graph.path)) {
       throw new Error(`Legacy graph lock target identity is stale or noncanonical: ${graph.path}`);
     }
     const legacyManifest = (await collectManifestPaths([legacyState.manifestPath]))[0];
@@ -12606,7 +13049,7 @@ function targetKeysForAgent(scope, name) {
 async function runtimeRoots(scope) {
   const roots = /* @__PURE__ */ new Set([scope.root]);
   if (scope.config.packages.some((pkg) => pkg.installationType === "user") || Object.values(scope.config.agents).some((agent) => agent.installationType === "user")) {
-    roots.add(resolve25(process.env.AGENTWHEEL_TEST_HOME || process.env.HOME || homedir11()));
+    roots.add(resolve26(process.env.AGENTWHEEL_TEST_HOME || process.env.HOME || homedir11()));
   }
   for (const [name, agent] of Object.entries(scope.config.agents)) {
     if (agent.transport === "ssh") throw new Error(`Installed-state normalization cannot inspect SSH agent '${name}' locally.`);
@@ -12643,14 +13086,14 @@ async function collectManifests(roots) {
         }
         continue;
       }
-      if (resolve25(parsed.targetRoot) !== resolve25(root)) {
+      if (resolve26(parsed.targetRoot) !== resolve26(root)) {
         throw new Error(`Install manifest target root does not match its enumerated runtime root: ${path}`);
       }
       const expectedPath = installManifestPath(parsed.targetRoot, parsed.adapter, {
         installationType: parsed.installationType,
         stateKey: parsed.stateKey
       });
-      if (resolve25(expectedPath) !== resolve25(path)) {
+      if (resolve26(expectedPath) !== resolve26(path)) {
         throw new Error(`Install manifest state identity does not match its canonical path: ${path}`);
       }
       found.set(path, { path, raw, manifest: { ...parsed, revision: computeManifestRevision(raw), legacy: false } });
@@ -12671,7 +13114,7 @@ async function collectManifestPaths(paths) {
       installationType: parsed.installationType,
       stateKey: parsed.stateKey
     });
-    if (resolve25(expectedPath) !== resolve25(path)) {
+    if (resolve26(expectedPath) !== resolve26(path)) {
       throw new Error(`Install manifest state identity does not match its canonical path: ${path}`);
     }
     found.push({ path, raw, manifest: { ...parsed, revision: computeManifestRevision(raw), legacy: false } });
@@ -12697,7 +13140,7 @@ async function relevantGraphLocks(workspaceRoot, selected, targetKeys, include)
     if (!path.endsWith(".graph-lock.json")) continue;
     const lock = await readGraphLock(path);
     if (!lock.canonical.roots.some((candidate2) => selected.has(candidate2.rootId))) continue;
-    const parts = relative9(root, path).split(/[\\/]/);
+    const parts = relative10(root, path).split(/[\\/]/);
     if (parts.length !== 3) throw new Error(`Graph lock path is not canonical: ${path}`);
     const [targetKey2, adapter] = parts;
     if (targetKeys && !targetKeys.has(targetKey2)) continue;
@@ -12739,7 +13182,7 @@ async function hasRelevantLegacyManifestCandidate(scope, graph, selected) {
   const legacyManifest = (await collectManifestPaths([legacyState.manifestPath]))[0];
   if (legacyManifest?.manifest.entries.some((entry) => entryMatchesGraphPackages(entry, graph.lock, selected))) return true;
   const stableState = await targetStateForGraph(scope, graph, scope.fleetId ?? null);
-  if (resolve25(stableState.graphLockPath) !== resolve25(graph.path)) return false;
+  if (resolve26(stableState.graphLockPath) !== resolve26(graph.path)) return false;
   const stableManifest = (await collectManifestPaths([stableState.manifestPath]))[0];
   return stableManifest?.manifest.entries.some((entry) => entryMatchesGraphPackages(entry, graph.lock, selected)) ?? false;
 }
@@ -12760,7 +13203,7 @@ async function legacyManifestPathForConfiguredTarget(scope, graph) {
     baseDir: scope.root
   });
   const targetRoot = resolveConfigPath(agent.root, scope.root);
-  const installRoot = resolve25(installRootForAdapterInstallationType(adapter, targetRoot, agent.installationType, false));
+  const installRoot = resolve26(installRootForAdapterInstallationType(adapter, targetRoot, agent.installationType, false));
   const stateKey = stateKeyFor(adapter.name, {
     installationType: agent.installationType,
     stateKey: agent.stateKey,
@@ -12828,7 +13271,7 @@ async function targetStateForGraph(scope, graph, identityFleetId = scope.fleetId
     ssh: void 0,
     ...agent?.stateKey ? { stateKey: agent.stateKey } : {}
   };
-  const installRoot = resolve25(installRootForAdapterInstallationType(adapter, targetRoot, installationType, false));
+  const installRoot = resolve26(installRootForAdapterInstallationType(adapter, targetRoot, installationType, false));
   const targetIdentity = resolveTargetStateIdentity({
     targetFingerprintParts: fingerprintParts,
     workspaceRoot: scope.root,
@@ -12860,16 +13303,16 @@ async function targetStateForGraph(scope, graph, identityFleetId = scope.fleetId
 async function installedTargetStateForGraph(scope, graph, manifests, owners, selected, identityFleetId = scope.fleetId ?? null) {
   const stable = await targetStateForGraph(scope, graph, identityFleetId);
   let state;
-  if (resolve25(graph.path) === resolve25(stable.graphLockPath)) {
+  if (resolve26(graph.path) === resolve26(stable.graphLockPath)) {
     state = stable;
   } else {
     const released = await releasedTargetStateForGraph(scope, graph, identityFleetId);
-    if (resolve25(graph.path) !== resolve25(released.graphLockPath)) {
+    if (resolve26(graph.path) !== resolve26(released.graphLockPath)) {
       throw new Error(`Graph lock target identity is stale or noncanonical: ${graph.path}`);
     }
     state = released;
   }
-  const manifest = manifests.find((candidate) => resolve25(candidate.path) === resolve25(state.manifestPath));
+  const manifest = manifests.find((candidate) => resolve26(candidate.path) === resolve26(state.manifestPath));
   if (!manifest) {
     throw new Error(`Graph lock is not covered by its canonical install manifest: ${state.manifestPath}`);
   }
@@ -12901,7 +13344,7 @@ async function releasedTargetStateForGraph(scope, graph, identityFleetId = scope
   };
 }
 function assertCorrelatedGraphManifest(graph, state, manifest, owners, selected) {
-  if (manifest.manifest.adapter !== state.adapter || manifest.manifest.installationType !== state.installationType || manifest.manifest.stateKey !== state.stateKey || resolve25(manifest.manifest.targetRoot) !== resolve25(state.installRoot)) {
+  if (manifest.manifest.adapter !== state.adapter || manifest.manifest.installationType !== state.installationType || manifest.manifest.stateKey !== state.stateKey || resolve26(manifest.manifest.targetRoot) !== resolve26(state.installRoot)) {
     throw new Error(`Install manifest identity does not match graph target state: ${manifest.path}`);
   }
   const entries = manifest.manifest.entries.filter((entry) => entryMatchesGraphPackages(entry, graph.lock, selected));
@@ -12958,7 +13401,7 @@ function destinationGraphFromSource(source, targetFingerprint) {
 function mergeDestinationManifest(existing, state, generatedAt, desiredEntries, replaceOwners = /* @__PURE__ */ new Set()) {
   if (existing) {
     const manifest2 = existing.manifest;
-    if (manifest2.adapter !== state.adapter || manifest2.installationType !== state.installationType || manifest2.stateKey !== state.stateKey || resolve25(manifest2.targetRoot) !== state.installRoot) {
+    if (manifest2.adapter !== state.adapter || manifest2.installationType !== state.installationType || manifest2.stateKey !== state.stateKey || resolve26(manifest2.targetRoot) !== state.installRoot) {
       throw new Error(`Destination manifest identity diverges from the derived target: ${existing.path}`);
     }
   }
@@ -13018,7 +13461,7 @@ async function assertEquivalentRuntimeState(entry, sourcePath, destinationPath)
       const content = await readFile27(path, "utf8");
       if (hasMergeRemovalContent(entry.mergeRemoval)) {
         assertExactMergeContribution(entry.mergeRemoval, entry.mergeStrategy, content);
-      } else if (resolve25(sourcePath) === resolve25(destinationPath) && entry.mergeStrategy !== "codex-toml-mcp") {
+      } else if (resolve26(sourcePath) === resolve26(destinationPath) && entry.mergeStrategy !== "codex-toml-mcp") {
         assertExactMergeContribution({}, entry.mergeStrategy, content);
       } else {
         throw new Error(`Installed-state normalization cannot prove incomplete merge ownership at ${path}.`);
@@ -13029,8 +13472,8 @@ async function assertEquivalentRuntimeState(entry, sourcePath, destinationPath)
   await assertEquivalentRuntimeBytes(sourcePath, destinationPath, entry.hash);
 }
 function renderedEntryPathForRoot(root, entryPath) {
-  const normalizedRoot = resolve25(root);
-  const candidate = resolve25(normalizedRoot, entryPath);
+  const normalizedRoot = resolve26(root);
+  const candidate = resolve26(normalizedRoot, entryPath);
   if (candidate !== normalizedRoot && !candidate.startsWith(`${normalizedRoot}/`)) {
     throw new Error(`Install manifest entry escapes its target root: ${entryPath}`);
   }
@@ -13121,8 +13564,8 @@ function ownerMatchesGraphPackage(lock, owner, selected) {
   return ownerMatchesPackage(owner, selected) || lock.canonical.roots.some((root) => selected.has(root.rootId) && root.graphNodeId === owner);
 }
 function renderedEntryPath(manifest, entry) {
-  const root = resolve25(manifest.targetRoot);
-  const candidate = resolve25(root, entry.path);
+  const root = resolve26(manifest.targetRoot);
+  const candidate = resolve26(root, entry.path);
   if (candidate !== root && !candidate.startsWith(`${root}/`)) {
     throw new Error(`Install manifest entry escapes its target root: ${entry.path}`);
   }
@@ -13476,7 +13919,7 @@ function sortValue(value) {
   return value;
 }
 function sha2565(value) {
-  return createHash14("sha256").update(value).digest("hex");
+  return createHash15("sha256").update(value).digest("hex");
 }
 function assertDigest(value) {
   if (!/^[a-f0-9]{64}$/.test(value)) throw new Error(`Invalid plan digest: ${value}`);
@@ -13516,6 +13959,7 @@ var commandGovernance = {
   "ownership handoff": "governed-unless-dry-run",
   "ownership recovery-plan": "incidental-cache",
   "ownership retire-stale": "governed-apply",
+  "ownership adopt-legacy": "governed-apply",
   "mcp retire": "governed-apply",
   eject: "governed-always",
   uninstall: "governed-unless-dry-run",
@@ -13935,7 +14379,7 @@ ownershipCommand.command("handoff").description("transfer one managed artifact b
   const toWorkspaceRoot = normalizeCliPath(options.toWorkspaceRoot);
   if (options.toFleet) {
     const fleet = await showRegisteredFleet(options.toFleet);
-    if (resolve26(fleet.root) !== resolve26(toWorkspaceRoot)) {
+    if (resolve27(fleet.root) !== resolve27(toWorkspaceRoot)) {
       throw new Error(`Destination fleet '${options.toFleet}' is registered at ${fleet.root}, not ${toWorkspaceRoot}.`);
     }
   }
@@ -13969,49 +14413,15 @@ ownershipCommand.command("recovery-plan").description("write a read-only per-pat
   const adapter = await resolveAdapterForTarget(target, {});
   const transport = transportForTarget(target);
   const requestedReport = normalizeCliPath(options.report);
-  const reportPath = join46(await realpath2(dirname23(requestedReport)), basename21(requestedReport));
-  const reportInsideTarget = relative10(resolve26(target.targetRoot), reportPath);
-  if (reportInsideTarget === "" || !reportInsideTarget.startsWith("..") && !isAbsolute4(reportInsideTarget)) {
+  const reportPath = join46(await realpath3(dirname23(requestedReport)), basename21(requestedReport));
+  const reportInsideTarget = relative11(resolve27(target.targetRoot), reportPath);
+  if (reportInsideTarget === "" || !reportInsideTarget.startsWith("..") && !isAbsolute5(reportInsideTarget)) {
     throw new Error("Recovery report must be outside the runtime target root.");
   }
   const installationType = target.installationType ?? resolveInstallationTypeForAdapter(adapter, void 0);
   const config = await readMergedWorkspaceConfig(target.workspaceRoot);
   if (config.packages.length === 0) throw new Error("Fleet has no configured source packages.");
-  const stage = await mkdtemp4(join46(tmpdir5(), "agentwheel-recovery-"));
-  const priorTmpdir = process.env.TMPDIR;
-  try {
-    process.env.TMPDIR = stage;
-    const graphPlan = await createGraphSourcePlan({
-      roots: config.packages.map((pkg) => ({
-        rootId: pkg.name,
-        source: pkg.source,
-        mode: pkg.mode,
-        version: pkg.version,
-        ref: pkg.requestedRef,
-        select: pkg.selection ? void 0 : normalizeArtifactSelectors(pkg.select, pkg.skills),
-        selection: pkg.selection,
-        aliases: pkg.aliases,
-        overrides: pkg.overrides,
-        includeSuggestions: pkg.withSuggestions,
-        suggestionAliases: pkg.suggestions,
-        useLock: false
-      })),
-      targetRoot: target.targetRoot,
-      workspaceRoot: target.workspaceRoot,
-      fleetId: target.fleetId,
-      adapter,
-      transport,
-      targetKey: targetKeyForTarget(target, adapter.name),
-      targetFingerprintParts: targetFingerprintParts(target, adapter, adapterOptionsForTarget(target, {}), installationType),
-      installationType,
-      stateKey: target.stateKey,
-      readOnly: true,
-      yes: true,
-      freshGraphOnly: true,
-      deferForeignStateCheck: true,
-      cacheRoot: join46(stage, "source-cache"),
-      registryCachePath: join46(stage, "registry.json")
-    });
+  await withFreshReadOnlyGraphPlan(target, adapter, adapterOptionsForTarget(target, {}), installationType, config.packages, async (graphPlan) => {
     const installRoot = installRootForAdapterInstallationType(adapter, target.targetRoot, installationType, transport.kind === "ssh");
     const report = await planLegacyRecovery({
       graphPlan,
@@ -14029,17 +14439,13 @@ ownershipCommand.command("recovery-plan").description("write a read-only per-pat
 `, { mode: 384, flag: "wx" });
     console.log(`Recovery report: ${reportPath}`);
     console.log(JSON.stringify(report.counts));
-  } finally {
-    if (priorTmpdir === void 0) delete process.env.TMPDIR;
-    else process.env.TMPDIR = priorTmpdir;
-    await rm10(stage, { recursive: true, force: true });
-  }
+  });
 });
-ownershipCommand.command("retire-stale").description("retire stale source-manifest ownership already covered by one Fleet manifest").requiredOption("--from-workspace-root <path>", "exact stale workspace owner root").requiredOption("--to-workspace-root <path>", "registered destination Fleet root").requiredOption("--source-state-key <key>", "exact source install-manifest state key").option("--destination-state-key <key>", "exact Fleet-owned destination install-manifest state key (defaults to the stable target state)").requiredOption("--fleet <id>", "registered destination Fleet").option("--adapter <adapter>", "built-in adapter").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named destination Fleet agent").option("--profile <name>", "destination Fleet profile resolving to one target").option("--plan-digest <sha256>", "reviewed plan digest; required with --apply").option("--expected-source-revision <sha256>", "reviewed source manifest revision; required with --apply").option("--expected-destination-revision <sha256>", "reviewed destination manifest revision; required with --apply").option("--expected-inventory-revision <sha256>", "reviewed runtime manifest inventory revision; required with --apply").option("--abandon-incomplete-merge-owner", "explicitly retire incomplete legacy merge metadata without changing runtime bytes", false).option("--apply", "apply the exact reviewed metadata-only retirement", false).option("--json", "print the complete deterministic plan as JSON", false).action(async (options) => {
+ownershipCommand.command("retire-stale").description("retire stale source-manifest ownership already covered by one Fleet manifest").requiredOption("--from-workspace-root <path>", "exact stale workspace owner root").option("--from-fleet-id <id>", "exact stale Fleet owner id for same-Fleet duplicate state").requiredOption("--to-workspace-root <path>", "registered destination Fleet root").requiredOption("--source-state-key <key>", "exact source install-manifest state key").option("--destination-state-key <key>", "exact Fleet-owned destination install-manifest state key (defaults to the stable target state)").requiredOption("--fleet <id>", "registered destination Fleet").option("--adapter <adapter>", "built-in adapter").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named destination Fleet agent").option("--profile <name>", "destination Fleet profile resolving to one target").option("--plan-digest <sha256>", "reviewed plan digest; required with --apply").option("--expected-source-revision <sha256>", "reviewed source manifest revision; required with --apply").option("--expected-destination-revision <sha256>", "reviewed destination manifest revision; required with --apply").option("--expected-inventory-revision <sha256>", "reviewed runtime manifest inventory revision; required with --apply").option("--abandon-incomplete-merge-owner", "explicitly retire incomplete legacy merge metadata without changing runtime bytes", false).option("--apply", "apply the exact reviewed metadata-only retirement", false).option("--json", "print the complete deterministic plan as JSON", false).action(async (options) => {
   const normalizedOptions = normalizeRuntimeScopeOptions(options);
   const fleet = await showRegisteredFleet(options.fleet);
   const toWorkspaceRoot = normalizeCliPath(options.toWorkspaceRoot);
-  if (resolve26(fleet.root) !== resolve26(toWorkspaceRoot)) {
+  if (resolve27(fleet.root) !== resolve27(toWorkspaceRoot)) {
     throw new Error(`Destination Fleet '${options.fleet}' is registered at ${fleet.root}, not ${toWorkspaceRoot}.`);
   }
   const targets = await resolveCliTargets(normalizedOptions);
@@ -14047,7 +14453,7 @@ ownershipCommand.command("retire-stale").description("retire stale source-manife
     throw new Error(`Stale ownership retirement requires exactly one destination Fleet target, found ${targets.length}.`);
   }
   const target = targets[0];
-  if (target.fleetId !== options.fleet || resolve26(target.workspaceRoot) !== resolve26(fleet.root)) {
+  if (target.fleetId !== options.fleet || resolve27(target.workspaceRoot) !== resolve27(fleet.root)) {
     throw new Error(`Resolved target does not belong to destination Fleet '${options.fleet}'.`);
   }
   const adapterOptions = adapterOptionsForTarget(target, normalizedOptions);
@@ -14061,6 +14467,7 @@ ownershipCommand.command("retire-stale").description("retire stale source-manife
     sourceStateKey: options.sourceStateKey,
     destinationStateKey: options.destinationStateKey ?? stableState.stateKey,
     fromWorkspaceRoot: normalizeCliPath(options.fromWorkspaceRoot),
+    fromFleetId: options.fromFleetId,
     toWorkspaceRoot,
     toFleetId: fleet.id,
     planDigest: options.planDigest,
@@ -14078,6 +14485,7 @@ ownershipCommand.command("retire-stale").description("retire stale source-manife
     "retire-stale",
     "--from-workspace-root",
     request.fromWorkspaceRoot,
+    ...request.fromFleetId ? ["--from-fleet-id", request.fromFleetId] : [],
     "--to-workspace-root",
     request.toWorkspaceRoot,
     "--source-state-key",
@@ -14117,6 +14525,138 @@ ownershipCommand.command("retire-stale").description("retire stale source-manife
   console.log(`Plan digest: ${result.planDigest}`);
   if (!options.apply) console.log(`Apply: ${applyCommand}`);
 });
+ownershipCommand.command("adopt-legacy").description("move proven legacy-keyed ownership into this workspace's stable target state without rewriting runtime artifacts").requiredOption("--source-state-key <key>", "exact legacy install-manifest state key").requiredOption("--from-workspace-root <path>", "exact plain workspace owner root of the entries to move").option("--agent <name>", "named agent of this workspace").option("--profile <name>", "workspace profile resolving to one target").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("--carry-drift", "also move entries whose runtime differs from the recorded hash; the recorded hash is kept", false).option("--plan-digest <sha256>", "reviewed plan digest; required with --apply").option("--expected-source-revision <sha256>", "reviewed source manifest revision; required with --apply").option("--expected-destination-revision <sha256|absent>", "reviewed destination manifest revision; required with --apply").option("--expected-inventory-revision <sha256>", "reviewed runtime manifest inventory revision; required with --apply").option("--apply", "apply the exact reviewed metadata-only adoption", false).option("--json", "print the complete deterministic plan as JSON", false).action(async (options) => {
+  if (Boolean(options.agent) === Boolean(options.profile)) {
+    throw new Error("Legacy ownership adoption requires exactly one of --agent or --profile.");
+  }
+  const normalizedOptions = normalizeRuntimeScopeOptions(options);
+  const requestedInstallationType = normalizedOptions.installationType;
+  const plainInstallOptions = {
+    ...normalizedOptions,
+    installationType: void 0,
+    adapterConfig: void 0,
+    adapterModule: void 0
+  };
+  const targets = await resolveCliTargets(plainInstallOptions);
+  if (targets.length !== 1) {
+    throw new Error(`Legacy ownership adoption requires exactly one runtime target, found ${targets.length}.`);
+  }
+  const target = targets[0];
+  if (target.fleetId) {
+    throw new Error("Legacy ownership adoption targets a nested workspace; a Fleet target uses fleet normalize or ownership retire-stale.");
+  }
+  if (target.transport === "ssh") throw new Error("Legacy ownership adoption does not support SSH targets.");
+  const config = await readMergedWorkspaceConfig(target.workspaceRoot);
+  const groups = /* @__PURE__ */ new Map();
+  for (const pkg of config.packages) graphGroupForPackage(groups, target, pkg, plainInstallOptions).packages.push(pkg);
+  if (groups.size === 0) throw new Error(`No configured source packages in ${target.workspaceRoot}.`);
+  const installationTypes = [...new Set([...groups.values()].map((candidate) => candidate.installationType))];
+  if (installationTypes.length > 1) {
+    throw new Error(
+      `Configured packages use installation types ${installationTypes.join(", ")}, each with its own install state; legacy ownership adoption needs exactly one.`
+    );
+  }
+  if (requestedInstallationType !== void 0 && requestedInstallationType !== installationTypes[0]) {
+    throw new Error(
+      `--installation-type ${requestedInstallationType} does not match installation type ${installationTypes[0]}, which install uses for the configured packages.`
+    );
+  }
+  if (groups.size > 1) {
+    throw new Error(
+      `Configured packages resolve to ${groups.size} adapter configurations for ${installationTypes[0]}, each with its own install state; legacy ownership adoption needs exactly one.`
+    );
+  }
+  const group = [...groups.values()][0];
+  const { installationType, adapterOptions } = group;
+  const requestedAdapterSettings = [
+    { flag: "--adapter-config", requested: normalizedOptions.adapterConfig, resolved: adapterOptions.adapterConfig, none: "no adapter config" },
+    { flag: "--adapter-module", requested: normalizedOptions.adapterModule, resolved: adapterOptions.adapterModule, none: "no adapter module" }
+  ];
+  for (const { flag, requested, resolved, none } of requestedAdapterSettings) {
+    if (requested === void 0) continue;
+    if (resolved !== void 0 && resolve27(target.workspaceRoot, requested) === resolve27(target.workspaceRoot, resolved)) continue;
+    throw new Error(`${flag} ${requested} does not match what install resolves for the configured packages: ${resolved ?? none}.`);
+  }
+  const adapter = await resolveAdapterForTarget(group.target, adapterOptions);
+  const stable = installStateForTarget(group.target, adapter, adapterOptions, installationType);
+  const stableGraphLockPath = graphLockPathForTarget(
+    group.target.workspaceRoot,
+    targetKeyForTarget(group.target, adapter.name),
+    adapter.name,
+    targetFingerprintParts(group.target, adapter, adapterOptions, installationType),
+    targetIdentityContext(group.target, adapter, installationType)
+  );
+  const desiredCoverage = await withFreshReadOnlyGraphPlan(group.target, adapter, adapterOptions, installationType, group.packages, async (graphPlan) => {
+    if (graphPlan.plan.stateKey !== stable.stateKey || graphPlan.graphLockPath !== stableGraphLockPath) {
+      throw new Error("Current source graph resolved a different target state identity; legacy ownership adoption cannot proceed.");
+    }
+    return desiredCoverageFromPlan(graphPlan.plan);
+  });
+  const request = {
+    targetRoot: stable.installRoot,
+    adapter: adapter.name,
+    installationType,
+    sourceStateKey: options.sourceStateKey,
+    destinationStateKey: stable.stateKey,
+    fromWorkspaceRoot: normalizeCliPath(options.fromWorkspaceRoot),
+    workspaceRoot: target.workspaceRoot,
+    destinationFleetId: target.fleetId,
+    destinationGraphLockPath: stableGraphLockPath,
+    desiredCoverage,
+    carryDrift: options.carryDrift === true,
+    planDigest: options.planDigest,
+    expectedSourceRevision: options.expectedSourceRevision,
+    expectedDestinationRevision: options.expectedDestinationRevision,
+    expectedInventoryRevision: options.expectedInventoryRevision,
+    transport: transportForTarget(target)
+  };
+  const result = options.apply ? await applyAdoptLegacyOwnership(request) : await planAdoptLegacyOwnership(request);
+  const destinationRevision = result.destination.revision ?? "absent";
+  const applyArgs = [
+    "agentwheel",
+    "ownership",
+    "adopt-legacy",
+    "--source-state-key",
+    result.source.stateKey,
+    "--from-workspace-root",
+    request.fromWorkspaceRoot,
+    ...options.profile ? ["--profile", options.profile] : ["--agent", options.agent],
+    "--installation-type",
+    installationType,
+    ...options.adapterConfig ? ["--adapter-config", options.adapterConfig] : [],
+    ...options.adapterModule ? ["--adapter-module", options.adapterModule] : [],
+    ...options.allowAdapterCode ? ["--allow-adapter-code"] : [],
+    ...request.carryDrift ? ["--carry-drift"] : [],
+    "--plan-digest",
+    result.planDigest,
+    "--expected-source-revision",
+    result.source.revision,
+    "--expected-destination-revision",
+    destinationRevision,
+    "--expected-inventory-revision",
+    result.manifestInventoryRevision,
+    "--apply"
+  ];
+  const applyCommand = applyArgs.map(shellQuoteArgument).join(" ");
+  if (options.json) {
+    console.log(JSON.stringify({ ...result, applyCommand }, null, 2));
+    return;
+  }
+  console.log(`${options.apply ? "Adopted legacy ownership" : "Legacy ownership adoption plan"}: ${result.selected.length} entr${result.selected.length === 1 ? "y" : "ies"}`);
+  console.log(`Target: ${result.adapter}/${result.installationType} at ${result.targetRoot}`);
+  console.log(`Source: ${result.source.stateKey} revision ${result.source.revision} (${result.source.class}, ${result.source.owner})`);
+  console.log(`Provenance: ${result.source.provenanceLock.path} (${result.source.provenanceLock.digest})`);
+  console.log(`Destination: ${result.destination.stateKey} revision ${destinationRevision} (${result.destination.owner})`);
+  console.log(`Manifest inventory revision: ${result.manifestInventoryRevision}`);
+  for (const entry of result.selected) {
+    const drift = entry.drift ? ` drift: recorded ${entry.recordedHash}, runtime ${entry.runtimeHash ?? "missing"}` : "";
+    console.log(`- ${entry.path}: ${entry.action}${drift}`);
+  }
+  for (const entry of result.retained) console.log(`  retained ${entry.path} (${entry.reason}, ${entry.owner})`);
+  for (const entry of result.remainingDuplicates) console.log(`  duplicate claim remains in ${entry.stateKey}: ${entry.path}`);
+  console.log(`Plan digest: ${result.planDigest}`);
+  if (!options.apply) console.log(`Apply from ${target.workspaceRoot}: ${applyCommand}`);
+});
 var mcpCommand = program.command("mcp").description("operate on MCP runtime configuration");
 mcpCommand.command("retire").description("remove one exact legacy MCP contribution with explicit state ownership").argument("<package>", "configured package containing exactly one legacy MCP artifact").option("--user", "use the user workspace", false).option("--local", "use the nearest local workspace", false).option("--fleet <id>", "use one registered named fleet").option("-t, --target-root <path>", "explicit runtime/project root").option("--agent <name>", "one named agent from merged config").option("--profile <name>", "workspace runtime profile resolving to one target").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--from-workspace-root <path>", "required previous owner when managed legacy state exists").option("--dry-run", "show the retirement plan without writing (default)", false).option("--apply", "apply the exact reviewed retirement plan", false).option("--json", "print the install plan as JSON", false).action(async (packageName, options) => {
   if (options.apply && options.dryRun) throw new Error("--apply cannot be combined with --dry-run.");
@@ -15132,7 +15672,7 @@ function scopeUpdatePlanToDependencies(result, selectors, previousLock, manifest
     selectedPreviousNodeIds,
     selectedRootIds
   );
-  const graphLockDigest = createHash15("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash16("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...result,
     bundle: { ...result.bundle, graphLock },
@@ -15258,7 +15798,7 @@ function operationBelongsToDependencyUpdate(operation, allowedNodeIds, allowedNa
 function scopeInstallPlanToArtifact(result, rootId, focused, manifest) {
   const scoped = scopePlanOperationsToArtifact(result, rootId, focused, manifest);
   const graphLock = focusedGraphLockForInstall(scoped.bundle.graphLock, rootId, focused);
-  const graphLockDigest = createHash15("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash16("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...scoped,
     bundle: { ...scoped.bundle, graphLock },
@@ -15269,7 +15809,7 @@ function scopeInstallPlanToArtifact(result, rootId, focused, manifest) {
 function scopeUpdatePlanToArtifact(result, rootId, focused, previousLock, manifest) {
   const scoped = scopePlanOperationsToArtifact(result, rootId, focused, manifest, previousLock);
   const graphLock = mergeFocusedArtifactGraphLock(scoped.bundle.graphLock, previousLock, rootId, focused);
-  const graphLockDigest = createHash15("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash16("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...scoped,
     bundle: { ...scoped.bundle, graphLock },
@@ -15564,7 +16104,7 @@ function scopeUpdatePlanToRoot(result, rootId, previousLock, manifest) {
     selectedPreviousNodeIds,
     /* @__PURE__ */ new Set([rootId])
   );
-  const graphLockDigest = createHash15("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash16("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...scoped,
     bundle: { ...scoped.bundle, graphLock },
@@ -15826,6 +16366,49 @@ function targetFingerprintParts(target, adapter, options, installationType) {
     stateKey: target.stateKey
   };
 }
+async function withFreshReadOnlyGraphPlan(target, adapter, adapterOptions, installationType, packages, use) {
+  const stage = await mkdtemp4(join46(tmpdir5(), "agentwheel-recovery-"));
+  const priorTmpdir = process.env.TMPDIR;
+  try {
+    process.env.TMPDIR = stage;
+    const graphPlan = await createGraphSourcePlan({
+      roots: packages.map((pkg) => ({
+        rootId: pkg.name,
+        source: pkg.source,
+        mode: pkg.mode,
+        version: pkg.version,
+        ref: pkg.requestedRef,
+        select: pkg.selection ? void 0 : normalizeArtifactSelectors(pkg.select, pkg.skills),
+        selection: pkg.selection,
+        aliases: pkg.aliases,
+        overrides: pkg.overrides,
+        includeSuggestions: pkg.withSuggestions,
+        suggestionAliases: pkg.suggestions,
+        useLock: false
+      })),
+      targetRoot: target.targetRoot,
+      workspaceRoot: target.workspaceRoot,
+      fleetId: target.fleetId,
+      adapter,
+      transport: transportForTarget(target),
+      targetKey: targetKeyForTarget(target, adapter.name),
+      targetFingerprintParts: targetFingerprintParts(target, adapter, adapterOptions, installationType),
+      installationType,
+      stateKey: target.stateKey,
+      readOnly: true,
+      yes: true,
+      freshGraphOnly: true,
+      deferForeignStateCheck: true,
+      cacheRoot: join46(stage, "source-cache"),
+      registryCachePath: join46(stage, "registry.json")
+    });
+    return await use(graphPlan);
+  } finally {
+    if (priorTmpdir === void 0) delete process.env.TMPDIR;
+    else process.env.TMPDIR = priorTmpdir;
+    await rm10(stage, { recursive: true, force: true });
+  }
+}
 function installStateForTarget(target, adapter, options, installationType) {
   const installRoot = installRootForAdapterInstallationType(adapter, target.targetRoot, installationType, target.transport === "ssh");
   const targetIdentity = resolveTargetStateIdentity({
@@ -15904,7 +16487,7 @@ async function resolveCliTargetState(target, options) {
     migration: prior.migration,
     targetStateFilePreconditions: {
       graphLockPath: stableGraphLockPath,
-      graphLockRevision: stableLock ? createHash15("sha256").update(canonicalGraphLockJson(stableLock)).digest("hex") : null,
+      graphLockRevision: stableLock ? createHash16("sha256").update(canonicalGraphLockJson(stableLock)).digest("hex") : null,
       sourceLockRevision: computeSourceLockRevision(stableSourceLock)
     }
   };
@@ -15927,7 +16510,7 @@ async function collectTargetStatus(target, options) {
   const pending = await collectPendingInstallWork(target, options);
   const foreignObservations = pending.foreignStateObservations;
   const effectiveGraphLock = graphLock ?? pending.observedGraphLock;
-  const observedManifestRevision = foreignObservations.length > 0 ? createHash15("sha256").update(JSON.stringify(foreignObservations.map((observation) => [
+  const observedManifestRevision = foreignObservations.length > 0 ? createHash16("sha256").update(JSON.stringify(foreignObservations.map((observation) => [
     observation.fileName,
     observation.manifestRevision
   ]).sort())).digest("hex") : null;
@@ -16174,7 +16757,7 @@ async function assertCompositeMutationSupported(workspaceRoot, profile, readOnly
         `Composite-profile mutation is refused before member execution because ${member.id} uses ${member.transport}; durable remote policy and recovery preflight is not implemented.`
       );
     }
-    const memberRoot = resolve26(workspaceRoot, member.workspace);
+    const memberRoot = resolve27(workspaceRoot, member.workspace);
     const memberPolicy = await mutationPolicyForWorkspace(memberRoot);
     if (memberPolicy?.revisioning.mode === "commit-after-verify") {
       throw new Error(
@@ -16659,14 +17242,14 @@ function looksLikeSourceSpecifier(value) {
 }
 function normalizeCliPath(value) {
   if (value === "~") return homedir12();
-  if (value.startsWith("~/")) return resolve26(homedir12(), value.slice(2));
-  return resolve26(value);
+  if (value.startsWith("~/")) return resolve27(homedir12(), value.slice(2));
+  return resolve27(value);
 }
 function shellQuoteArgument(value) {
   return /^[a-z0-9_./:@%+=,-]+$/i.test(value) ? value : `'${value.replace(/'/g, `'"'"'`)}'`;
 }
 function isHomePath(path) {
-  return resolve26(path) === resolve26(homedir12());
+  return resolve27(path) === resolve27(homedir12());
 }
 function adapterListFromOption(adapter) {
   if (!adapter) return [];
@@ -16787,7 +17370,7 @@ function withFleetExample(config) {
   };
 }
 async function findAgentwheelPackageRoot(start) {
-  let current = resolve26(start);
+  let current = resolve27(start);
   while (true) {
     if (await findPackageManifestPath(current, { warnLegacy: false })) return current;
     const parent = dirname23(current);