agentwheel 0.20.8 → 0.20.10

package/dist/index.js

@@ -3,6 +3,7 @@ import {
   MergeAdoptionMismatchError,
   applyCombinedInstallPlan,
   assertExactMergeContribution,
+  assertMergedSourceContribution,
   assertOperationContained,
   assertSafeInstallName,
   canonicalGraphLockJson,
@@ -12,10 +13,12 @@ import {
   commitManifestMetadataJournal,
   computeInstallManifestInventoryRevision,
   computeManifestRevision,
+  computeSourceLockRevision,
   computeTargetFingerprint,
   desiredManagedInstructionBlockHash,
   hasMergeRemovalContent,
   installManifestSchema,
+  installManifestV2Schema,
   legacyUnownedWorkspaceOwner,
   listInstallManifests,
   managedInstructionBlockMode,
@@ -29,11 +32,12 @@ import {
   readGraphLock,
   readInstallManifest,
   readManagedInstructionBlockState,
+  readSourceLock,
   recoverPendingApply,
   uninstall,
   withManifestRevision,
   writeInstallManifest
-} from "./chunk-4AM3LNUQ.js";
+} from "./chunk-P2JK34W7.js";
 import {
   CURRENT_WORKSPACE_SCHEMA_VERSION,
   GovernedMutation,
@@ -94,7 +98,7 @@ import {
   workspaceSelectionImportSchema,
   writeApplyJournal,
   writeWorkspaceConfig
-} from "./chunk-JXX6EDIP.js";
+} from "./chunk-J7DKPDS7.js";
 import {
   inferSourceDriverName
 } from "./chunk-EMDIG24I.js";
@@ -109,11 +113,11 @@ import {
 } from "./chunk-7VPI5J5Y.js";
 
 // src/cli/index.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 import { existsSync } from "fs";
-import { mkdir as mkdir16, rm as rm10, writeFile as writeFile13 } from "fs/promises";
-import { homedir as homedir12 } from "os";
-import { dirname as dirname22, join as join45, resolve as resolve24 } from "path";
+import { mkdir as mkdir16, mkdtemp as mkdtemp4, realpath as realpath2, rm as rm10, writeFile as writeFile13 } from "fs/promises";
+import { homedir as homedir12, tmpdir as tmpdir5 } from "os";
+import { basename as basename21, dirname as dirname23, isAbsolute as isAbsolute4, join as join46, relative as relative10, resolve as resolve26 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { Command } from "commander";
 
@@ -917,11 +921,11 @@ function normalizeArtifactSelectors(select, legacySkills) {
   if (selected.length === 0) return void 0;
   return [...new Set(selected.map(parseArtifactSelector))];
 }
-function filterArtifactsBySelection(artifacts, selectors, legacySkills) {
+function filterArtifactsBySelection(artifacts, selectors, legacySkills, options = {}) {
   const selected = normalizeArtifactSelectors(selectors, legacySkills);
   if (!selected?.length) return artifacts;
   const selectedSet = new Set(selected);
-  const available = new Set(artifacts.flatMap(artifactSelectorAliases));
+  const available = new Set((options.validationArtifacts ?? artifacts).flatMap(artifactSelectorAliases));
   const missing = selected.filter((selector) => !available.has(selector));
   if (missing.length > 0) {
     throw new Error(`Selected artifact not found in package: ${missing.join(", ")}`);
@@ -1706,6 +1710,7 @@ async function createPlanFromOperations(desiredOps, adapter, targetRoot, manifes
     hasBlockingChanges: operations.some((op) => op.action === "drift" || op.action === "conflict"),
     baseRevision: options.baseRevision ?? manifest?.revision ?? null,
     runtimeStateRevision,
+    stateMigration: options.stateMigration,
     migrationReport: migration.report,
     graphLockDigest: options.graphLockDigest,
     adapterCode: adapter.programmatic ? { modulePath: adapter.programmatic.modulePath, hash: adapter.programmatic.hash } : void 0,
@@ -2388,6 +2393,7 @@ function operationMetadataFromEntry2(entry, ownersOverride) {
       graphNodeId: entry.graphNodeId,
       dependencyRole: entry.dependencyRole,
       owners: ownersOverride ?? entry.owners,
+      workspaceOwner: entry.workspaceOwner,
       graphLockDigest: entry.graphLockDigest,
       mergeRemoval: entry.mergeRemoval,
       mergeCreatedDestination: entry.mergeCreatedDestination
@@ -3107,14 +3113,14 @@ async function writeMermaidAsset(response) {
     "content-type": "application/javascript; charset=utf-8",
     "cache-control": "public, max-age=3600"
   });
-  await new Promise((resolve25) => {
+  await new Promise((resolve27) => {
     const stream = createReadStream(assetPath);
     stream.on("error", () => {
       if (!response.headersSent) writeText(response, 404, "Mermaid asset unavailable.\n");
       else response.destroy();
-      resolve25();
+      resolve27();
     });
-    stream.on("end", resolve25);
+    stream.on("end", resolve27);
     stream.pipe(response);
   });
 }
@@ -3141,14 +3147,14 @@ function escapeHtml2(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
 function listen(server, port, bind) {
-  return new Promise((resolve25, reject) => {
+  return new Promise((resolve27, reject) => {
     const onError = (error) => {
       server.off("listening", onListening);
       reject(error);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve25();
+      resolve27();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -3156,7 +3162,7 @@ function listen(server, port, bind) {
   });
 }
 function waitForShutdown(server, beforeClose) {
-  return new Promise((resolve25) => {
+  return new Promise((resolve27) => {
     let closing = false;
     const shutdown = () => {
       if (closing) return;
@@ -3164,7 +3170,7 @@ function waitForShutdown(server, beforeClose) {
       process.off("SIGINT", shutdown);
       process.off("SIGTERM", shutdown);
       beforeClose();
-      server.close(() => resolve25());
+      server.close(() => resolve27());
     };
     process.once("SIGINT", shutdown);
     process.once("SIGTERM", shutdown);
@@ -3174,7 +3180,7 @@ function waitForShutdown(server, beforeClose) {
       process.off("SIGINT", shutdown);
       process.off("SIGTERM", shutdown);
       beforeClose();
-      resolve25();
+      resolve27();
     });
   });
 }
@@ -3727,7 +3733,7 @@ async function fetchClawHubPackage(fetchImpl, packageName) {
   throw new Error(`ClawHub lookup failed for ${packageName}`);
 }
 async function delay(ms) {
-  await new Promise((resolve25) => setTimeout(resolve25, ms));
+  await new Promise((resolve27) => setTimeout(resolve27, ms));
 }
 function parseClawHubSource(source) {
   if (!source.startsWith(sourcePrefix)) {
@@ -3904,7 +3910,7 @@ async function withGitCacheMaintenanceLock(cacheRoot, timeoutMs, fn) {
       if (Date.now() - started > timeoutMs) {
         throw new Error(`Timed out waiting for git cache maintenance lock at ${lockPath}`);
       }
-      await new Promise((resolve25) => setTimeout(resolve25, 50));
+      await new Promise((resolve27) => setTimeout(resolve27, 50));
     }
   }
   try {
@@ -6570,7 +6576,7 @@ async function collectIncludeSelector(raw, optional, artifactsByRelativePath, sc
 }
 function artifactTargetsRuntime(runtimes, runtime, nodeId, selector, warn) {
   if (!runtimes?.length || !runtime || runtimes.includes(runtime)) return true;
-  warn?.(`skip artifact ${nodeId}:${selector} (not targeted: runtimes=[${runtimes.join(",")}])`);
+  warn?.(`skip artifact ${nodeId}:${selector} (selected but not targeted: runtimes=[${runtimes.join(",")}])`);
   return false;
 }
 function requirementTargetsRuntime(runtimes, runtime, label, warn) {
@@ -6770,8 +6776,8 @@ function verifyIntegrity(integrity, sourceHash, label) {
 async function withCachePathLock(path, fn) {
   const previous = cacheLocks.get(path) ?? Promise.resolve();
   let release = () => void 0;
-  const current = previous.then(() => new Promise((resolve25) => {
-    release = resolve25;
+  const current = previous.then(() => new Promise((resolve27) => {
+    release = resolve27;
   }));
   cacheLocks.set(path, current);
   await previous;
@@ -6833,6 +6839,11 @@ function detectDirectCollisions(nodes) {
   for (const [selector, owners] of bySelector) {
     const uniqueOwners = [...new Map(owners.map((owner) => [owner.node.id, owner])).values()];
     if (uniqueOwners.length <= 1) continue;
+    const selectedArtifacts = uniqueOwners.map((owner) => ({
+      owner,
+      artifact: owner.artifacts.find((candidate) => artifactSelectorKey(candidate) === selector)
+    }));
+    if (new Set(selectedArtifacts.map(({ artifact }) => artifact.hash)).size === 1) continue;
     const replacements = uniqueOwners.filter((owner) => {
       const artifact = owner.artifacts.find((candidate) => artifactSelectorKey(candidate) === selector);
       return uniqueOwners.every((other) => {
@@ -6842,7 +6853,7 @@ function detectDirectCollisions(nodes) {
     });
     if (replacements.length === 1) continue;
     throw new Error(
-      `Direct dependency artifact collision for ${selector}: ${uniqueOwners.map((owner) => `${owner.node.id} required by ${owner.node.requiredBy.join(", ")}`).join("; ")}. Resolve by aliasing, deselecting one artifact, or overriding the dependency selection.`
+      `Direct dependency artifact collision for ${selector}: ${uniqueOwners.map((owner) => `${owner.node.id} required by ${owner.node.requiredBy.join(", ")}`).join("; ")}. Content hashes differ: ${selectedArtifacts.map(({ owner, artifact }) => `${owner.node.id}=sha256:${artifact.hash}`).join("; ")}. Resolve by aliasing, deselecting one artifact, or overriding the dependency selection.`
     );
   }
 }
@@ -7027,8 +7038,8 @@ import { rm as rm7 } from "fs/promises";
 
 // src/lifecycle/source-plan.ts
 import { createHash as createHash8 } from "crypto";
-import { mkdir as mkdir14 } from "fs/promises";
-import { dirname as dirname17, join as join33, resolve as resolve15 } from "path";
+import { mkdir as mkdir14, readdir as readdir9 } from "fs/promises";
+import { basename as basename18, dirname as dirname17, join as join33, posix as posix2, resolve as resolve16 } from "path";
 
 // src/resolve/graph-diff.ts
 function diffGraphLocks(previous, next) {
@@ -7226,8 +7237,10 @@ async function renderGraphForTarget(graph, targetContext = {}) {
   for (const staged of [...stagedNodes.values()].sort((a, b) => a.rawNode.node.id.localeCompare(b.rawNode.node.id))) {
     const rawNode = staged.rawNode;
     const runtimeSelectedSet = new Set(normalizeArtifactSelectors(rawNode.node.selected) ?? []);
-    const runtimeArtifacts = targetContext.adapter ? filterArtifactsByRuntime2(staged.artifacts, targetContext.adapter.name, runtimeSelectedSet) : staged.artifacts;
-    const compositionArtifacts = targetContext.noDeps ? filterArtifactsBySelection(runtimeArtifacts, rawNode.node.selected) : runtimeArtifacts;
+    const selectionValidatedArtifacts = filterArtifactsBySelection(staged.artifacts, rawNode.node.selected);
+    const preRuntimeArtifacts = targetContext.noDeps ? selectionValidatedArtifacts : staged.artifacts;
+    const runtimeArtifacts = targetContext.adapter ? filterArtifactsByRuntime2(preRuntimeArtifacts, targetContext.adapter.name, runtimeSelectedSet) : preRuntimeArtifacts;
+    const compositionArtifacts = runtimeArtifacts;
     const expandedArtifacts = await expandMarkdownIncludes(compositionArtifacts, staged.root, {
       nodeId: rawNode.node.id,
       originNodeId: rawNode.node.id,
@@ -7275,7 +7288,12 @@ async function renderGraphForTarget(graph, targetContext = {}) {
         };
       }
     });
-    const selectedArtifacts = filterArtifactsBySelection(expandedArtifacts, rawNode.node.selected);
+    const selectedArtifacts = filterArtifactsBySelection(
+      expandedArtifacts,
+      rawNode.node.selected,
+      void 0,
+      { validationArtifacts: staged.artifacts }
+    );
     const claudeRenderedArtifacts = await renderClaudeSubagents(selectedArtifacts, staged.root, targetContext.adapter);
     const codexRenderedArtifacts = await renderCodexSubagents(claudeRenderedArtifacts, staged.root, targetContext.adapter);
     const openClawRenderedArtifacts = await renderOpenClawSubagents(codexRenderedArtifacts, staged.root, targetContext.adapter);
@@ -7389,8 +7407,9 @@ function sha2563(content) {
   return createHash7("sha256").update(content).digest("hex");
 }
 function assignInstallNames(graph, artifacts) {
-  const superseded = supersededLogicalSelectors(artifacts);
-  const effectiveArtifacts = artifacts.filter((artifact) => !superseded.has(artifact.logicalSelector));
+  const equivalentArtifacts = coalesceEquivalentDirectArtifacts(artifacts);
+  const superseded = supersededLogicalSelectors(equivalentArtifacts);
+  const effectiveArtifacts = equivalentArtifacts.filter((artifact) => !superseded.has(artifact.logicalSelector));
   const aliases = workspaceAliases(graph);
   validateAliasScopes(graph, effectiveArtifacts, aliases);
   const decisions = /* @__PURE__ */ new Map();
@@ -7433,6 +7452,37 @@ function assignInstallNames(graph, artifacts) {
   }));
   return { artifacts: out, namespacing: [...decisions.values()], overrides: finalOverrides };
 }
+function coalesceEquivalentDirectArtifacts(artifacts) {
+  const equivalent = /* @__PURE__ */ new Map();
+  const passthrough = [];
+  for (const artifact of artifacts) {
+    if (artifact.dependencyRole !== "direct") {
+      passthrough.push(artifact);
+      continue;
+    }
+    const key = `${artifact.type}\0${artifact.name}\0${artifact.hash}`;
+    const group = equivalent.get(key) ?? [];
+    group.push(artifact);
+    equivalent.set(key, group);
+  }
+  for (const group of equivalent.values()) {
+    const sorted = [...group].sort((left, right) => left.logicalSelector.localeCompare(right.logicalSelector));
+    const canonical = sorted[0];
+    passthrough.push({
+      ...canonical,
+      owners: [...new Set(sorted.flatMap((artifact) => artifact.owners))].sort((left, right) => left.localeCompare(right)),
+      composedFrom: mergeComposedFrom(sorted)
+    });
+  }
+  return passthrough;
+}
+function mergeComposedFrom(artifacts) {
+  const entries = /* @__PURE__ */ new Map();
+  for (const entry of artifacts.flatMap((artifact) => artifact.composedFrom ?? [])) {
+    entries.set(`${entry.selector}\0${entry.hash}`, entry);
+  }
+  return entries.size > 0 ? [...entries.values()].sort((left, right) => `${left.selector}\0${left.hash}`.localeCompare(`${right.selector}\0${right.hash}`)) : void 0;
+}
 function supersededLogicalSelectors(artifacts) {
   const removed = /* @__PURE__ */ new Set();
   for (const replacement of artifacts) {
@@ -7595,7 +7645,8 @@ function reachableNodeIds(graph, rootNodeId) {
   return reachable;
 }
 function installNameCollisionError(group) {
-  return new Error(`Install name collision for ${group[0]?.type}/${group[0]?.installName}: ${group.map((artifact) => artifact.logicalSelector).sort().join(" vs ")}`);
+  const details = group.map((artifact) => `${artifact.logicalSelector}=sha256:${artifact.hash}`).sort().join("; ");
+  return new Error(`Install name collision for ${group[0]?.type}/${group[0]?.installName}. Artifact content hashes: ${details}`);
 }
 function namespaceDecision(artifact, reason) {
   return {
@@ -8029,11 +8080,71 @@ function containsPath(parent, candidate) {
   return path === "" || !path.startsWith("..") && !isAbsolute2(path);
 }
 
+// src/model/target-state.ts
+import { posix, resolve as resolve15 } from "path";
+var targetEvolutionFields = /* @__PURE__ */ new Set([
+  "adapterCodeHash",
+  "adapterConfig",
+  "adapterModule",
+  "targetRoot",
+  "transportDescription",
+  "ssh"
+]);
+function resolveTargetStateIdentity(options) {
+  return {
+    targetFingerprint: computeTargetFingerprint(options.targetFingerprintParts),
+    stateFingerprint: computeTargetFingerprint({
+      identityVersion: 1,
+      contributionScope: {
+        workspaceRoot: resolve15(options.workspaceRoot),
+        targetKey: options.targetKey
+      },
+      target: {
+        ...persistentTargetParts(options.targetFingerprintParts),
+        installRoot: normalizeInstallRoot(options.resolvedInstallRoot, options.transportKind),
+        endpoint: targetEndpoint(options.targetFingerprintParts, options.transportKind)
+      }
+    })
+  };
+}
+function persistentTargetParts(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { value };
+  return Object.fromEntries(
+    Object.entries(value).filter(([key]) => !targetEvolutionFields.has(key))
+  );
+}
+function normalizeInstallRoot(path, transportKind) {
+  return transportKind === "ssh" ? posix.normalize(path) : resolve15(path);
+}
+function targetEndpoint(value, transportKind) {
+  if (transportKind !== "ssh") return { kind: "local" };
+  const record = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  const ssh = record.ssh && typeof record.ssh === "object" && !Array.isArray(record.ssh) ? record.ssh : {};
+  if (typeof ssh.host !== "string" || ssh.host.trim().length === 0) {
+    throw new Error("SSH endpoint host is required for target state identity; transport description is not an identity source.");
+  }
+  if (ssh.user !== void 0 && (typeof ssh.user !== "string" || ssh.user.trim().length === 0)) {
+    throw new Error("SSH target state identity requires a non-empty endpoint user when one is provided.");
+  }
+  if (ssh.port !== void 0 && (!Number.isInteger(ssh.port) || ssh.port <= 0)) {
+    throw new Error("SSH target state identity requires a positive integer endpoint port.");
+  }
+  return {
+    kind: "ssh",
+    host: ssh.host.trim(),
+    user: ssh.user,
+    port: ssh.port ?? 22
+  };
+}
+
 // src/lifecycle/source-plan.ts
 async function createGraphSourcePlan(options) {
   if (options.roots.length === 0) {
     throw new Error("At least one source is required for a graph plan.");
   }
+  if (options.freshGraphOnly && options.readOnly !== true) {
+    throw new Error("Fresh graph recovery is read-only and cannot be used for install planning.");
+  }
   const workspaceRoot = options.workspaceRoot ?? options.targetRoot;
   const transport = options.transport ?? localTransport;
   const warnings = [];
@@ -8042,22 +8153,62 @@ async function createGraphSourcePlan(options) {
     options.warn?.(message);
   };
   const installationType = options.installationType ?? resolveInstallationTypeForAdapterTarget(options.adapter);
-  const targetFingerprint = computeTargetFingerprint(options.targetFingerprintParts ?? {
+  const targetFingerprintParts2 = options.targetFingerprintParts ?? {
     adapter: options.adapter.name,
     fleetId: options.fleetId,
     installationType,
     targetRoot: options.targetRoot,
     transport: transport.kind,
     transportDescription: transport.description
+  };
+  const installRoot = installRootForAdapterInstallationType(options.adapter, options.targetRoot, installationType, transport.kind === "ssh");
+  const targetIdentity = resolveTargetStateIdentity({
+    targetFingerprintParts: targetFingerprintParts2,
+    workspaceRoot,
+    targetKey: options.targetKey ?? "default",
+    resolvedInstallRoot: installRoot,
+    transportKind: transport.kind
   });
+  const targetFingerprint = targetIdentity.targetFingerprint;
   const stateKey = stateKeyFor(options.adapter.name, {
     installationType,
     stateKey: options.stateKey,
-    targetFingerprint,
+    targetFingerprint: targetIdentity.stateFingerprint,
     fleetId: options.fleetId
   });
-  const installRoot = installRootForAdapterInstallationType(options.adapter, options.targetRoot, installationType, transport.kind === "ssh");
-  const recoveredPendingApply = options.readOnly === true ? false : await recoverPendingApplyIfSafe(installRoot, options.adapter.name, transport, { installationType, stateKey });
+  const graphLockPath = pathForGraphLock(
+    workspaceRoot,
+    options.targetKey ?? "default",
+    options.adapter.name,
+    targetIdentity.stateFingerprint
+  );
+  const ownership = await resolveWorkspaceOwnershipScope(workspaceRoot, {
+    fleetId: options.fleetId,
+    globalRoot: options.globalRoot
+  });
+  const workspaceOwner = workspaceOwnerForRoot(ownership.root, ownership.fleetId);
+  let recoveredPendingApply = false;
+  if (options.readOnly !== true) {
+    const pendingJournal = await discoverTargetApplyJournal({
+      adapter: options.adapter.name,
+      installationType,
+      stateKey,
+      explicitStateKey: options.stateKey,
+      fleetId: options.fleetId,
+      installRoot,
+      workspaceOwner,
+      graphLockPath,
+      transport
+    });
+    if (pendingJournal) {
+      recoveredPendingApply = await recoverPendingApplyIfSafe(
+        installRoot,
+        options.adapter.name,
+        transport,
+        { installationType, stateKey: pendingJournal.stateKey }
+      );
+    }
+  }
   const workspaceConfig = await readMergedWorkspaceConfig(workspaceRoot, { globalRoot: options.globalRoot });
   const trustPolicy = {
     ...normalizeTrustPolicy(workspaceConfig.trust),
@@ -8065,12 +8216,33 @@ async function createGraphSourcePlan(options) {
   };
   const lockMode = options.frozenLock === true || options.offline === true;
   const lockLabel = options.offline === true ? "Offline" : options.frozenLock === true ? "Frozen lock" : options.lockedResolution === true ? "Locked install" : "Fresh resolve";
-  const graphLockPath = pathForGraphLock(workspaceRoot, options.targetKey ?? "default", options.adapter.name, targetFingerprint);
-  const previousLock = await readExistingGraphLock(graphLockPath);
-  const registryClient = new RegistryClient({ workspaceRoot, offline: lockMode, offlineLabel: lockLabel, warn });
+  const readPriorState = async () => {
+    const [stableManifest, stableLock2, stableSourceLock2] = await Promise.all([
+      readInstallManifest(installRoot, options.adapter.name, transport, { installationType, stateKey }),
+      readExistingGraphLock(graphLockPath),
+      readSourceLock(installRoot, options.adapter.name, transport, { installationType, stateKey })
+    ]);
+    const priorState2 = await resolvePriorTargetState({
+      adapter: options.adapter.name,
+      installationType,
+      stateKey,
+      explicitStateKey: options.stateKey,
+      fleetId: options.fleetId,
+      installRoot,
+      workspaceOwner,
+      graphLockPath,
+      stableManifest,
+      stableLock: stableLock2,
+      transport
+    });
+    return { priorState: priorState2, stableLock: stableLock2, stableSourceLock: stableSourceLock2 };
+  };
+  const { priorState, stableLock, stableSourceLock } = options.freshGraphOnly ? { priorState: {}, stableLock: void 0, stableSourceLock: void 0 } : await readPriorState();
+  const previousLock = priorState.graphLock;
+  const registryClient = new RegistryClient({ workspaceRoot, cachePath: options.registryCachePath, offline: lockMode, offlineLabel: lockLabel, warn });
   const graph = await resolveDependencyGraph(options.roots, {
     workspaceRoot,
-    cacheRoot: join33(workspaceRoot, ".agentwheel", "cache"),
+    cacheRoot: options.cacheRoot ?? join33(workspaceRoot, ".agentwheel", "cache"),
     registryClient,
     noDeps: options.noDeps,
     includeSuggestions: options.includeSuggestions,
@@ -8107,13 +8279,13 @@ async function createGraphSourcePlan(options) {
   const resolvedInstallRoot = installRootForArtifacts(options.adapter, options.targetRoot, resolvedInstallationType, desiredArtifacts.map((artifact) => artifact.type), transport.kind === "ssh");
   const graphLockDigest = digestGraphLock(bundle.graphLock);
   const graphDiff = diffGraphLocks(previousLock, bundle.graphLock);
-  const manifest = await readInstallManifest(resolvedInstallRoot, options.adapter.name, transport, { installationType: resolvedInstallationType, stateKey });
-  const ownership = await resolveWorkspaceOwnershipScope(workspaceRoot, {
-    fleetId: options.fleetId,
-    globalRoot: options.globalRoot
-  });
-  const workspaceOwner = workspaceOwnerForRoot(ownership.root, ownership.fleetId);
-  const plan = options.retireExactMcp ? await createExactMcpRetirementPlan(
+  if (normalizeInstallRoot2(resolvedInstallRoot, transport.kind) !== normalizeInstallRoot2(installRoot, transport.kind)) {
+    throw new Error(
+      `Adapter ${options.adapter.name} resolved a different install root after rendering; target state identity cannot be proven.`
+    );
+  }
+  const manifest = priorState.manifest;
+  const basePlan = options.retireExactMcp ? await createExactMcpRetirementPlan(
     desiredArtifacts,
     options.adapter,
     options.targetRoot,
@@ -8135,10 +8307,18 @@ async function createGraphSourcePlan(options) {
     forceDrift: options.forceDrift,
     forceConflict: options.forceConflict,
     replaceConflict: options.replaceConflict,
+    stateMigration: priorState.migration,
     warn
   });
+  const plan = priorState.migration && !basePlan.stateMigration ? { ...basePlan, stateMigration: priorState.migration } : basePlan;
+  plan.targetStateFilePreconditions = {
+    graphLockPath,
+    graphLockRevision: stableLock ? digestGraphLock(stableLock) : null,
+    sourceLockRevision: computeSourceLockRevision(stableSourceLock)
+  };
+  let foreignStateObservations = [];
   if (options.forceForeignState !== true && options.deferForeignStateCheck !== true) {
-    await assertNoForeignWorkspaceState({
+    foreignStateObservations = await assertNoForeignWorkspaceState({
       installRoot: resolvedInstallRoot,
       adapter: options.adapter.name,
       transport,
@@ -8146,9 +8326,11 @@ async function createGraphSourcePlan(options) {
       workspaceOwner,
       globalRoot: options.globalRoot,
       stateKey,
+      migratingStateKey: priorState.migration?.fromStateKey,
       plannedPaths: plan.operations.map((operation) => operation.relativeDestPath),
       plannedOperations: plan.operations
     });
+    plan.hasBlockingChanges = plan.operations.some((operation) => operation.action === "drift" || operation.action === "conflict");
   }
   return {
     plan,
@@ -8161,7 +8343,10 @@ async function createGraphSourcePlan(options) {
     warnings,
     newTransitiveSources: trustEvaluation.promptSources,
     graphDiff,
-    recoveredPendingApply
+    recoveredPendingApply,
+    previousManifest: priorState.manifest,
+    previousGraphLock: priorState.graphLock,
+    foreignStateObservations
   };
 }
 async function assertNoForeignWorkspaceStateForPlan(plan, options) {
@@ -8174,12 +8359,15 @@ async function assertNoForeignWorkspaceStateForPlan(plan, options) {
     workspaceOwner: options.workspaceOwner,
     globalRoot: options.globalRoot,
     stateKey: plan.stateKey,
+    migratingStateKey: plan.stateMigration?.fromStateKey,
     plannedPaths: options.plannedPaths ?? plan.operations.map((operation) => operation.relativeDestPath),
     plannedOperations: plan.operations
   });
+  plan.hasBlockingChanges = plan.operations.some((operation) => operation.action === "drift" || operation.action === "conflict");
 }
-function graphLockPathForTarget(workspaceRoot, targetKey2, adapter, targetFingerprintParts2) {
-  return pathForGraphLock(workspaceRoot, targetKey2, adapter, computeTargetFingerprint(targetFingerprintParts2));
+function graphLockPathForTarget(workspaceRoot, targetKey2, adapter, targetFingerprintParts2, context) {
+  const identity = resolveTargetStateIdentity({ targetFingerprintParts: targetFingerprintParts2, workspaceRoot, targetKey: targetKey2, ...context });
+  return pathForGraphLock(workspaceRoot, targetKey2, adapter, identity.stateFingerprint);
 }
 function desiredArtifactsFromGraphBundle(bundle) {
   return bundle.artifacts.map((artifact) => desiredArtifactFromResolved(artifact));
@@ -8221,10 +8409,278 @@ async function readExistingGraphLock(path) {
   if (!await pathExists(path)) return void 0;
   return readGraphLock(path);
 }
+async function discoverTargetApplyJournal(options) {
+  const journals = await listApplyJournals(
+    options.installRoot,
+    options.adapter,
+    options.transport,
+    { installationType: options.installationType }
+  );
+  const correlated = [];
+  for (const item of journals) {
+    const journal = item.journal;
+    const journalStateKey = journal.stateKey ?? stateKeyFor(options.adapter, { installationType: options.installationType });
+    if (normalizeInstallRoot2(journal.targetRoot, options.transport.kind) !== normalizeInstallRoot2(options.installRoot, options.transport.kind)) {
+      continue;
+    }
+    if (journalStateKey === options.stateKey) {
+      validateJournalManifestEnvelope(journal.manifest, options, journalStateKey, item.path);
+      correlated.push({ path: item.path, stateKey: journalStateKey });
+      continue;
+    }
+    if (!journal.graphLockPath || !journal.graphLock || !journal.graphLockDigest) continue;
+    if (resolve16(dirname17(journal.graphLockPath)) !== resolve16(dirname17(options.graphLockPath))) continue;
+    if (options.transport.kind === "ssh") {
+      throw new Error(
+        `Legacy SSH apply journal at ${item.path} does not record its original endpoint; Agentwheel cannot prove endpoint identity, so the journal was preserved.`
+      );
+    }
+    const suffix = ".graph-lock.json";
+    const graphName = basename18(journal.graphLockPath);
+    if (!graphName.endsWith(suffix)) {
+      throw new Error(`Legacy apply journal at ${item.path} has an invalid graph-lock path.`);
+    }
+    const fingerprint = graphName.slice(0, -suffix.length);
+    if (!/^[a-f0-9]{64}$/u.test(fingerprint) || journal.graphLock.canonical.targetFingerprint !== fingerprint) {
+      throw new Error(`Legacy apply journal graph-lock fingerprint does not match its path at ${item.path}.`);
+    }
+    const expectedStateKey = stateKeyFor(options.adapter, {
+      installationType: options.installationType,
+      stateKey: options.explicitStateKey,
+      targetFingerprint: fingerprint,
+      fleetId: options.fleetId
+    });
+    if (journalStateKey !== expectedStateKey) {
+      throw new Error(`Legacy apply journal state key does not match its graph lock at ${item.path}.`);
+    }
+    let actualGraphLock;
+    try {
+      actualGraphLock = await readGraphLock(journal.graphLockPath);
+    } catch (error) {
+      throw new Error(
+        `Legacy apply journal graph lock is missing or invalid at ${journal.graphLockPath}: ` + (error instanceof Error ? error.message : String(error))
+      );
+    }
+    const embeddedDigest = digestGraphLock(journal.graphLock);
+    const actualDigest = digestGraphLock(actualGraphLock);
+    if (embeddedDigest !== journal.graphLockDigest || actualDigest !== journal.graphLockDigest) {
+      throw new Error(`Legacy apply journal graph-lock digest mismatch at ${item.path}.`);
+    }
+    const manifest = validateJournalManifestEnvelope(journal.manifest, options, journalStateKey, item.path);
+    validateLegacyManifestCandidate(manifest, {
+      ...options,
+      candidateStateKey: journalStateKey,
+      graphLockDigest: journal.graphLockDigest,
+      graphLockPath: journal.graphLockPath
+    });
+    correlated.push({ path: item.path, stateKey: journalStateKey });
+  }
+  if (correlated.length > 1) {
+    throw new Error(`Ambiguous apply journals for ${options.adapter}: multiple journals match the requested target state.`);
+  }
+  return correlated[0];
+}
+function validateJournalManifestEnvelope(value, options, stateKey, journalPath) {
+  let manifest;
+  try {
+    manifest = installManifestV2Schema.parse(value);
+  } catch (error) {
+    throw new Error(
+      `Apply journal at ${journalPath} has an invalid install manifest: ` + (error instanceof Error ? error.message : String(error))
+    );
+  }
+  if (manifest.adapter !== options.adapter || manifest.installationType !== options.installationType || manifest.stateKey !== stateKey || normalizeInstallRoot2(manifest.targetRoot, options.transport.kind) !== normalizeInstallRoot2(options.installRoot, options.transport.kind)) {
+    throw new Error(`Apply journal target identity does not match its manifest at ${journalPath}.`);
+  }
+  return manifest;
+}
+async function resolvePriorTargetState(options) {
+  const candidates = await discoverLegacyStateCandidates(options);
+  const correlated = candidates.filter((candidate) => candidate.manifest);
+  if (options.stableManifest) {
+    for (const candidate of correlated) {
+      if (!sameManifestContributions(options.stableManifest, candidate.manifest)) {
+        throw new Error(
+          `Stable and legacy target states coexist with disagreeing contributions for ${options.adapter}; reconcile them explicitly.`
+        );
+      }
+    }
+    const sameKeyCandidates = correlated.filter((candidate) => candidate.stateKey === options.stateKey);
+    if (!options.stableLock && sameKeyCandidates.length > 1) {
+      throw new Error(`Ambiguous legacy target state for ${options.adapter}: multiple correlated graph locks use the explicit state key.`);
+    }
+    if (!options.stableLock && sameKeyCandidates.length === 1) {
+      const candidate = sameKeyCandidates[0];
+      return {
+        graphLock: candidate.graphLock,
+        manifest: options.stableManifest,
+        migration: migrationFromCandidate(candidate)
+      };
+    }
+    return { graphLock: options.stableLock, manifest: options.stableManifest };
+  }
+  if (options.stableLock && correlated.length > 0) {
+    throw new Error(
+      `Stable graph state and legacy manifest state coexist for ${options.adapter} without a stable manifest; reconcile them explicitly.`
+    );
+  }
+  if (correlated.length > 1) {
+    throw new Error(`Ambiguous legacy target state for ${options.adapter}: multiple correlated manifests were found.`);
+  }
+  if (correlated.length === 1) {
+    const candidate = correlated[0];
+    return {
+      graphLock: candidate.graphLock,
+      manifest: candidate.manifest,
+      migration: migrationFromCandidate(candidate)
+    };
+  }
+  if (options.stableLock) return { graphLock: options.stableLock };
+  if (candidates.length > 1) {
+    throw new Error(`Ambiguous legacy target state for ${options.adapter}: multiple graph-only candidates were found.`);
+  }
+  if (candidates.length === 1) {
+    throw new Error(
+      `Legacy graph-only target state for ${options.adapter} has no correlated install manifest; runtime identity and ownership cannot be proven, so the graph lock was preserved.`
+    );
+  }
+  return {};
+}
+async function discoverLegacyStateCandidates(options) {
+  const directory = dirname17(options.graphLockPath);
+  let names;
+  try {
+    names = await readdir9(directory);
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  const stableName = basename18(options.graphLockPath);
+  const suffix = ".graph-lock.json";
+  const candidates = [];
+  for (const name of names.sort((left, right) => left.localeCompare(right))) {
+    if (name === stableName || !name.endsWith(suffix)) continue;
+    const fingerprint = name.slice(0, -suffix.length);
+    if (!/^[a-f0-9]{64}$/u.test(fingerprint)) continue;
+    const graphLockPath = join33(directory, name);
+    let graphLock;
+    try {
+      graphLock = await readGraphLock(graphLockPath);
+    } catch (error) {
+      throw new Error(
+        `Legacy graph lock at ${graphLockPath} is invalid or unsupported: ` + (error instanceof Error ? error.message : String(error))
+      );
+    }
+    if (graphLock.canonical.targetFingerprint !== fingerprint) {
+      throw new Error(
+        `Legacy graph lock fingerprint does not match its filename at ${graphLockPath}.`
+      );
+    }
+    if (options.transport.kind === "ssh") {
+      throw new Error(
+        `Legacy SSH target state at ${graphLockPath} does not record its original endpoint; Agentwheel cannot prove endpoint identity, so the graph lock was preserved.`
+      );
+    }
+    const graphLockDigest = digestGraphLock(graphLock);
+    const candidateStateKey = stateKeyFor(options.adapter, {
+      installationType: options.installationType,
+      stateKey: options.explicitStateKey,
+      targetFingerprint: fingerprint,
+      fleetId: options.fleetId
+    });
+    let manifest;
+    let sourceLock;
+    try {
+      manifest = await readInstallManifest(options.installRoot, options.adapter, options.transport, {
+        installationType: options.installationType,
+        stateKey: candidateStateKey
+      });
+      sourceLock = await readSourceLock(options.installRoot, options.adapter, options.transport, {
+        installationType: options.installationType,
+        stateKey: candidateStateKey
+      });
+    } catch (error) {
+      throw new Error(
+        `Legacy target state for ${graphLockPath} is invalid: ` + (error instanceof Error ? error.message : String(error))
+      );
+    }
+    if (!manifest) {
+      if (sourceLock) {
+        throw new Error(`Legacy source lock for ${graphLockPath} has no correlated install manifest.`);
+      }
+      candidates.push({ stateKey: candidateStateKey, graphLockPath, graphLockDigest, graphLock });
+      continue;
+    }
+    const validated = validateLegacyManifestCandidate(manifest, {
+      ...options,
+      candidateStateKey,
+      graphLockDigest,
+      graphLockPath
+    });
+    candidates.push({
+      stateKey: candidateStateKey,
+      graphLockPath,
+      graphLockDigest,
+      graphLock,
+      manifest: validated,
+      sourceLock
+    });
+  }
+  return candidates;
+}
+function validateLegacyManifestCandidate(manifest, options) {
+  if (manifest.version !== 2) {
+    throw new Error(`Legacy target state for ${options.graphLockPath} requires an install manifest v2.`);
+  }
+  if (manifest.adapter !== options.adapter) {
+    throw new Error(`Legacy target state adapter mismatch at ${options.graphLockPath}.`);
+  }
+  if (manifest.installationType !== options.installationType) {
+    throw new Error(`Legacy target state installation type mismatch at ${options.graphLockPath}.`);
+  }
+  if (manifest.stateKey !== options.candidateStateKey) {
+    throw new Error(`Legacy target state key mismatch at ${options.graphLockPath}.`);
+  }
+  if (normalizeInstallRoot2(manifest.targetRoot, options.transport.kind) !== normalizeInstallRoot2(options.installRoot, options.transport.kind)) {
+    throw new Error(`Legacy target state target root mismatch at ${options.graphLockPath}.`);
+  }
+  const correlated = manifest.entries.filter((entry) => entry.graphLockDigest === options.graphLockDigest);
+  if (correlated.length === 0) {
+    throw new Error(`Legacy install manifest graph-lock digest does not match ${options.graphLockPath}.`);
+  }
+  if (correlated.some((entry) => entry.workspaceOwner !== options.workspaceOwner)) {
+    throw new Error(`Legacy target state contribution scope does not match ${options.graphLockPath}.`);
+  }
+  return manifest;
+}
+function migrationFromCandidate(candidate) {
+  return {
+    fromStateKey: candidate.manifest ? candidate.stateKey : void 0,
+    fromGraphLockPath: candidate.graphLockPath,
+    fromGraphLockDigest: candidate.graphLockDigest,
+    sourceLock: candidate.manifest ? candidate.sourceLock ?? null : void 0
+  };
+}
+function sameManifestContributions(left, right) {
+  if (left.version !== 2) return false;
+  return stableJson2(manifestContributionState(left)) === stableJson2(manifestContributionState(right));
+}
+function manifestContributionState(manifest) {
+  return manifest.entries.map(({ updatedAt: _updatedAt, graphLockDigest: _graphLockDigest, ...entry }) => entry).sort((left, right) => left.path.localeCompare(right.path));
+}
+function stableJson2(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson2).join(",")}]`;
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  const record = value;
+  return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort((left, right) => left.localeCompare(right)).map((key) => `${JSON.stringify(key)}:${stableJson2(record[key])}`).join(",")}}`;
+}
+function normalizeInstallRoot2(path, transportKind) {
+  return transportKind === "ssh" ? posix2.normalize(path) : resolve16(path);
+}
 var workspaceOwnerPrefix2 = "workspace-root:";
 async function assertNoForeignWorkspaceState(check) {
   const planned = new Set(check.plannedPaths);
-  if (planned.size === 0) return;
+  if (planned.size === 0) return [];
   const plannedOperations = /* @__PURE__ */ new Map();
   for (const operation of check.plannedOperations) {
     if (!planned.has(operation.relativeDestPath)) continue;
@@ -8233,18 +8689,22 @@ async function assertNoForeignWorkspaceState(check) {
     plannedOperations.set(operation.relativeDestPath, operations);
   }
   const manifests = await listInstallManifests(check.installRoot, check.adapter, check.transport);
-  const root = resolve15(check.workspaceRoot);
+  const root = resolve16(check.workspaceRoot);
   const ownsSubWorkspaces = root !== globalConfigRoot(check.globalRoot);
-  const foreign = [];
+  const collisions = /* @__PURE__ */ new Map();
   for (const entry of manifests) {
-    if (entry.stateKey === check.stateKey) continue;
-    const byOwner = /* @__PURE__ */ new Map();
+    if (entry.stateKey === check.stateKey || entry.stateKey === check.migratingStateKey) continue;
+    const entryCounts = /* @__PURE__ */ new Map();
+    for (const manifestEntry of entry.manifest.entries) {
+      const owner = "workspaceOwner" in manifestEntry ? manifestEntry.workspaceOwner : void 0;
+      if (typeof owner === "string" && owner.startsWith(workspaceOwnerPrefix2)) {
+        entryCounts.set(owner, (entryCounts.get(owner) ?? 0) + 1);
+      }
+    }
     for (const manifestEntry of entry.manifest.entries) {
       const owner = "workspaceOwner" in manifestEntry ? manifestEntry.workspaceOwner : void 0;
       if (typeof owner !== "string" || !owner.startsWith(workspaceOwnerPrefix2)) continue;
       if (ownedByWorkspace(owner, check.workspaceOwner, root, ownsSubWorkspaces)) continue;
-      const bucket = byOwner.get(owner) ?? { entryCount: 0, collidingPaths: [] };
-      bucket.entryCount += 1;
       if (planned.has(manifestEntry.path) && !await isDisjointVerifiedMergeContribution(
         check,
         manifestEntry.path,
@@ -8252,16 +8712,46 @@ async function assertNoForeignWorkspaceState(check) {
         manifestEntry.mergeRemoval,
         plannedOperations.get(manifestEntry.path) ?? []
       )) {
-        bucket.collidingPaths.push(manifestEntry.path);
+        const ownedEntry = manifestEntry;
+        const pathCollisions = collisions.get(manifestEntry.path) ?? [];
+        pathCollisions.push({
+          owner,
+          stateKey: entry.stateKey,
+          fileName: entry.fileName,
+          manifestRevision: entry.manifest.revision,
+          entryCount: entryCounts.get(owner) ?? 1,
+          entry: ownedEntry
+        });
+        collisions.set(manifestEntry.path, pathCollisions);
       }
-      byOwner.set(owner, bucket);
     }
-    for (const [owner, bucket] of byOwner) {
-      if (bucket.collidingPaths.length === 0) continue;
-      foreign.push({ owner, fileName: entry.fileName, ...bucket });
+  }
+  const foreignByOwner = /* @__PURE__ */ new Map();
+  const observations = [];
+  for (const [path, pathCollisions] of collisions) {
+    const operations = plannedOperations.get(path) ?? [];
+    const exact = pathCollisions.length === 1 ? await exactForeignKeepOperation(check, pathCollisions[0], operations) : void 0;
+    if (exact) {
+      const index = check.plannedOperations.indexOf(operations[0]);
+      if (index < 0) throw new Error(`Foreign-state reconciliation lost planned operation for ${path}.`);
+      check.plannedOperations[index] = exact.operation;
+      observations.push(exact.observation);
+      continue;
+    }
+    for (const collision of pathCollisions) {
+      const key = `${collision.owner}\0${collision.fileName}`;
+      const bucket = foreignByOwner.get(key) ?? {
+        owner: collision.owner,
+        fileName: collision.fileName,
+        entryCount: collision.entryCount,
+        collidingPaths: []
+      };
+      if (!bucket.collidingPaths.includes(path)) bucket.collidingPaths.push(path);
+      foreignByOwner.set(key, bucket);
     }
   }
-  if (foreign.length === 0) return;
+  const foreign = [...foreignByOwner.values()];
+  if (foreign.length === 0) return observations.sort((left, right) => left.path.localeCompare(right.path));
   throw new Error([
     `Refusing to plan ${check.adapter} at ${check.installRoot}.`,
     "This runtime root already carries Agentwheel state owned by another workspace, at paths this run would install:",
@@ -8275,6 +8765,36 @@ async function assertNoForeignWorkspaceState(check) {
     parseWorkspaceOwner(check.workspaceOwner)?.fleetId ? "Reconcile the owners with an explicit agentwheel fleet normalize operation before planning this fleet." : "Re-run from the owning workspace, or pass --force-foreign-state to plan against it anyway."
   ].join("\n"));
 }
+async function exactForeignKeepOperation(check, collision, operations) {
+  if (operations.length !== 1) return void 0;
+  const operation = operations[0];
+  const entry = collision.entry;
+  if (operation.semanticPlugin || operation.programmaticOperation || operation.mergeStrategy || operation.mode || entry.semanticPlugin || entry.mergeStrategy || entry.mode) return void 0;
+  if (!operation.desiredHash || operation.artifactType !== entry.artifactType || operation.artifactName !== entry.artifactName || operation.kind !== entry.kind || operation.desiredHash !== entry.sourceHash) return void 0;
+  const path = join33(check.installRoot, entry.path);
+  if (!await check.transport.pathExists(path)) return void 0;
+  const currentHash = await check.transport.hashPath(path);
+  if (currentHash !== entry.hash || currentHash !== operation.desiredHash || operation.currentHash !== void 0 && operation.currentHash !== currentHash) return void 0;
+  return {
+    operation: {
+      ...operation,
+      action: "keep",
+      currentHash,
+      manifestHash: entry.hash,
+      reason: `exact foreign artifact owned by ${collision.owner}; kept outside workspace ${check.workspaceOwner}`,
+      preserveInManifest: false
+    },
+    observation: {
+      stateKey: collision.stateKey,
+      fileName: collision.fileName,
+      manifestRevision: collision.manifestRevision,
+      workspaceOwner: collision.owner,
+      path: entry.path,
+      graphNodeId: entry.graphNodeId,
+      logicalSelector: entry.logicalSelector
+    }
+  };
+}
 async function isDisjointVerifiedMergeContribution(check, relativePath, foreignStrategy, foreignRemoval, operations) {
   if (!foreignStrategy || !hasMergeRemovalContent(foreignRemoval) || operations.length !== 1) return false;
   const operation = operations[0];
@@ -8446,7 +8966,7 @@ function targetLabel(target) {
 }
 
 // src/runtime/target.ts
-import { basename as basename18, dirname as dirname18, join as join34, resolve as resolve16 } from "path";
+import { basename as basename19, dirname as dirname18, join as join34, resolve as resolve17 } from "path";
 var runtimeMarkers = [
   { adapter: "openclaw", dirs: [".openclaw", ".clawdbot", ".moltbot"] },
   { adapter: "claude", dirs: [".claude"] },
@@ -8455,9 +8975,9 @@ var runtimeMarkers = [
   { adapter: "copilot", dirs: [".github"] }
 ];
 async function resolveRuntimeTarget(request = {}) {
-  const cwd = resolve16(request.cwd ?? process.cwd());
+  const cwd = resolve17(request.cwd ?? process.cwd());
   if (request.targetRoot) {
-    const targetRoot = resolve16(request.targetRoot);
+    const targetRoot = resolve17(request.targetRoot);
     return {
       adapter: request.adapter ?? "openclaw",
       installationType: request.installationType,
@@ -8489,7 +9009,7 @@ async function resolveRuntimeTarget(request = {}) {
 async function resolveAllRuntimeTargets(request = {}) {
   if (request.targetRoot) return [await resolveRuntimeTarget(request)];
   if (request.agent) return [await resolveRuntimeTarget(request)];
-  const cwd = resolve16(request.cwd ?? process.cwd());
+  const cwd = resolve17(request.cwd ?? process.cwd());
   const workspaceRoot = await findWorkspaceRoot(cwd);
   const config = await readMergedWorkspaceConfig(workspaceRoot, { globalRoot: request.globalRoot });
   const targets = Object.entries(config.agents).map(([name]) => targetFromAgent(name, config, workspaceRoot, request.installationType, request.fleetId));
@@ -8499,8 +9019,8 @@ async function resolveAllRuntimeTargets(request = {}) {
   return targets;
 }
 async function resolveProfileRuntimeTargets(request) {
-  const cwd = resolve16(request.cwd ?? process.cwd());
-  const workspaceRoot = request.targetRoot ? resolve16(request.targetRoot) : await findWorkspaceRoot(cwd);
+  const cwd = resolve17(request.cwd ?? process.cwd());
+  const workspaceRoot = request.targetRoot ? resolve17(request.targetRoot) : await findWorkspaceRoot(cwd);
   const config = await readMergedWorkspaceConfig(workspaceRoot, { globalRoot: request.globalRoot });
   const profile = config.profiles[request.profile];
   if (!profile) {
@@ -8566,12 +9086,12 @@ async function detectRuntimeTarget(cwd = process.cwd(), adapterFilter) {
   return unique[0];
 }
 async function detectRuntimeTargets(cwd = process.cwd(), adapterFilter) {
-  const root = resolve16(cwd);
+  const root = resolve17(cwd);
   const matches = [];
   for (const marker of runtimeMarkers) {
     if (adapterFilter && marker.adapter !== adapterFilter) continue;
     for (const dir of marker.dirs) {
-      if (basename18(root) === dir) {
+      if (basename19(root) === dir) {
         matches.push({ adapter: marker.adapter, targetRoot: dirname18(root) });
       } else if (await pathExists(join34(root, dir))) {
         matches.push({ adapter: marker.adapter, targetRoot: root });
@@ -8615,9 +9135,9 @@ function dedupeTargets(matches) {
   return [...byKey.values()];
 }
 function runtimeScanRoot(request) {
-  const root = resolve16(request.targetRoot ?? request.cwd ?? process.cwd());
+  const root = resolve17(request.targetRoot ?? request.cwd ?? process.cwd());
   if (request.targetRoot) return root;
-  return runtimeMarkers.some((marker) => marker.dirs.includes(basename18(root))) ? dirname18(root) : root;
+  return runtimeMarkers.some((marker) => marker.dirs.includes(basename19(root))) ? dirname18(root) : root;
 }
 
 // src/lifecycle/profile.ts
@@ -9004,9 +9524,9 @@ function normalizeVersion(version) {
 
 // src/model/package-validate.ts
 import { stat as stat12 } from "fs/promises";
-import { resolve as resolve17 } from "path";
+import { resolve as resolve18 } from "path";
 async function validatePackage(root) {
-  const packageRoot = resolve17(root);
+  const packageRoot = resolve18(root);
   const findings = [];
   const manifestPath = await findPackageManifestPath(packageRoot);
   if (!manifestPath) {
@@ -9107,7 +9627,7 @@ async function validateManifestComposeInclude(packageRoot, selector, optional, f
   try {
     validateSelector(selector, "compose.include", findings, manifestPath, { fragmentsOnly: true, aliases });
     if (isCrossPackageSelector(selector)) return;
-    const full = resolve17(packageRoot, selector);
+    const full = resolve18(packageRoot, selector);
     if (full !== packageRoot && !full.startsWith(`${packageRoot}/`)) {
       findings.push({ level: "error", message: `Compose include escapes package root: ${selector}`, path: manifestPath });
       return;
@@ -9161,10 +9681,10 @@ function isCrossPackageSelector(value) {
 
 // src/model/package-migrate.ts
 import { readFile as readFile22, rename as rename3, writeFile as writeFile12 } from "fs/promises";
-import { join as join37, resolve as resolve18 } from "path";
+import { join as join37, resolve as resolve19 } from "path";
 import { applyEdits, modify, parse as parse2 } from "jsonc-parser";
 async function migratePackageManifest(root) {
-  const packageRoot = resolve18(root);
+  const packageRoot = resolve19(root);
   for (const name of openPackManifestNames) {
     const path = join37(packageRoot, name);
     if (await pathExists(path)) {
@@ -9226,7 +9746,7 @@ function resolveCliVersion() {
 }
 
 // src/lifecycle/ownership.ts
-import { resolve as resolve19 } from "path";
+import { resolve as resolve20 } from "path";
 async function planArtifactOwnershipHandoff(request) {
   return validateOwnershipHandoff(request, request.transport ?? localTransport);
 }
@@ -9352,8 +9872,8 @@ function containedArtifactPath(targetRoot, relativePath) {
   if (!relativePath || relativePath.startsWith("/") || relativePath.includes("\0")) {
     throw new Error(`Unsafe managed artifact path: ${relativePath}`);
   }
-  const root = resolve19(targetRoot);
-  const candidate = resolve19(root, relativePath);
+  const root = resolve20(targetRoot);
+  const candidate = resolve20(root, relativePath);
   if (candidate !== root && !candidate.startsWith(`${root}/`)) {
     throw new Error(`Managed artifact path escapes target root: ${relativePath}`);
   }
@@ -9386,7 +9906,7 @@ function assertManifestIdentity(manifest, request) {
 
 // src/lifecycle/ownership-retire-stale.ts
 import { createHash as createHash9 } from "crypto";
-import { resolve as resolve20 } from "path";
+import { resolve as resolve21 } from "path";
 async function planRetireStaleOwnership(request) {
   return observe(request, request.transport ?? localTransport);
 }
@@ -9519,7 +10039,7 @@ async function observe(request, transport) {
   return { ...withoutDigest, planDigest: digest(withoutDigest) };
 }
 function normalizeRequest(request) {
-  const targetRoot = resolve20(request.targetRoot);
+  const targetRoot = resolve21(request.targetRoot);
   const sourceStateKey = exactStateKey(request.adapter, request.sourceStateKey, request.installationType, "source");
   const destinationStateKey = exactStateKey(request.adapter, request.destinationStateKey, request.installationType, "destination");
   if (sourceStateKey === destinationStateKey) throw new Error("Source and destination state keys must differ.");
@@ -9530,8 +10050,8 @@ function normalizeRequest(request) {
     installationType: request.installationType.trim(),
     sourceStateKey,
     destinationStateKey,
-    fromWorkspaceRoot: resolve20(request.fromWorkspaceRoot),
-    toWorkspaceRoot: resolve20(request.toWorkspaceRoot),
+    fromWorkspaceRoot: resolve21(request.fromWorkspaceRoot),
+    toWorkspaceRoot: resolve21(request.toWorkspaceRoot),
     toFleetId: request.toFleetId.trim()
   };
 }
@@ -9552,7 +10072,7 @@ async function requireManifest(request, stateKey, transport, label) {
     installationType: manifest.installationType,
     stateKey: manifest.stateKey
   });
-  if (manifest.adapter !== request.adapter || manifest.installationType !== request.installationType || resolve20(manifest.targetRoot) !== request.targetRoot || actualStateKey !== stateKey) {
+  if (manifest.adapter !== request.adapter || manifest.installationType !== request.installationType || resolve21(manifest.targetRoot) !== request.targetRoot || actualStateKey !== stateKey) {
     throw new Error(`${label} install manifest identity does not match the requested adapter, target, installation type, and state key.`);
   }
   return manifest;
@@ -9633,10 +10153,262 @@ function canonicalJson(value) {
   return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
 }
 
+// src/lifecycle/legacy-recovery-plan.ts
+import { createHash as createHash10 } from "crypto";
+import { readdir as readdir10 } from "fs/promises";
+import { basename as basename20, dirname as dirname21, join as join39, posix as posix3, relative as relative8, resolve as resolve22 } from "path";
+async function inventoryHistoricalLocks(fleetRoot) {
+  const root = join39(fleetRoot, ".agentwheel", "locks");
+  const found = [];
+  async function visit(dir) {
+    for (const entry of await readdir10(dir, { withFileTypes: true }).catch((error) => {
+      if (error.code === "ENOENT") return [];
+      throw error;
+    })) {
+      const path = join39(dir, entry.name);
+      if (entry.isDirectory()) await visit(path);
+      else if (entry.isFile() && entry.name.endsWith(".graph-lock.json")) {
+        const lock = await readGraphLock(path);
+        found.push({ path, digest: sha2564(canonicalGraphLockJson(lock)), lock });
+      }
+    }
+  }
+  await visit(root);
+  return found.sort((a, b) => a.path.localeCompare(b.path));
+}
+async function planLegacyRecovery(input) {
+  const { graphPlan, installRoot, targetKey: targetKey2, adapter, installationType, historicalLocks, transport } = input;
+  assertCompleteGraphPlan(graphPlan);
+  const binding = {
+    targetLockDir: dirname21(graphPlan.graphLockPath),
+    stableLockPath: graphPlan.graphLockPath,
+    stableStateKey: graphPlan.plan.stateKey,
+    currentFingerprint: graphPlan.targetFingerprint,
+    expectedOwner: workspaceOwnerForRoot(input.workspaceRoot, input.fleetId),
+    installRoot,
+    adapter,
+    installationType,
+    fleetId: input.fleetId,
+    explicitStateKey: input.explicitStateKey,
+    transportKind: transport.kind
+  };
+  const manifests = await listInstallManifests(installRoot, adapter, transport);
+  const paths = /* @__PURE__ */ new Set();
+  const desired = /* @__PURE__ */ new Map();
+  const nodeHashes = new Map(graphPlan.bundle.graphLock.canonical.nodes.map((node) => [node.id, node.sourceHash]));
+  for (const op of graphPlan.plan.operations) {
+    if (!op.desiredHash || op.action === "remove" || op.action === "keep") continue;
+    const path = relative8(installRoot, op.destPath);
+    if (path.startsWith("..") || path === "") throw new Error(`Planner destination escapes target: ${op.destPath}`);
+    paths.add(path);
+    const items = desired.get(path) ?? [];
+    items.push(op);
+    desired.set(path, items);
+  }
+  for (const item of manifests) for (const entry of item.manifest.entries) paths.add(entry.path);
+  const resolutionWarnings = graphPlan.warnings.filter((warning) => !/^skip (?:artifact|dependency) .+ \((?:selected but )?not targeted: runtimes=\[[^\]]+\]\)$/.test(warning));
+  const complete = resolutionWarnings.length === 0;
+  const output = [];
+  for (const path of [...paths].sort()) {
+    const allClaims = manifests.flatMap((item) => item.manifest.entries.filter((entry) => entry.path === path).map((entry) => claimFor(item, entry, historicalLocks, binding)));
+    const claims = allClaims.filter((claim) => claim.scope !== "foreign");
+    const foreignClaims = allClaims.filter((claim) => claim.scope === "foreign");
+    const current = desired.get(path) ?? [];
+    const currentHashes = [...new Set(current.map((item) => item.desiredHash))];
+    const currentSourceHashes = [...new Set(current.map((item) => item.graphNodeId ? nodeHashes.get(item.graphNodeId) : void 0).filter((value) => Boolean(value)))].sort();
+    const currentNodeIds = [...new Set(current.map((item) => item.graphNodeId).filter((value) => Boolean(value)))].sort();
+    const currentSelectors = [...new Set(current.map((item) => item.logicalSelector).filter((value) => Boolean(value)))].sort();
+    const currentOwners = [...new Set(current.flatMap((item) => item.owners ?? []))].sort();
+    const livePath = resolve22(installRoot, path);
+    if (relative8(installRoot, livePath).startsWith("..")) throw new Error(`Manifest path escapes target: ${path}`);
+    const liveHash = await transport.pathExists(livePath) ? await transport.hashPath(livePath) : null;
+    const reasons = [];
+    const currentResults = await Promise.all(current.map((op) => verifyCurrentOperation(op, liveHash, transport)));
+    const currentGraphStatus = current.length === 0 ? "absent" : currentResults.every((result) => result === "exact-match") ? "exact-match" : currentResults.some((result) => result === "unverifiable") ? "unverifiable" : "mismatch";
+    if (currentHashes.length > 1 && current.some((op) => !op.mergeStrategy && op.mode !== "managed-block")) {
+      reasons.push("current graph has divergent hashes for the destination");
+    }
+    if (currentGraphStatus === "mismatch") reasons.push("live contribution differs from current source");
+    if (currentGraphStatus === "unverifiable") reasons.push("current contribution could not be verified");
+    if (current.some((op) => op.action === "conflict" || op.action === "drift")) reasons.push("install planner has a blocking operation");
+    if (!complete) reasons.push("current source graph has resolution warnings; completeness unproven");
+    if (claims.some((claim) => claim.scope === "unbound" || claim.evidence.length)) reasons.push("historical provenance unresolved");
+    if (foreignClaims.length) reasons.push("foreign manifest claim conflicts with destination");
+    if (new Set(claims.map((claim) => `${claim.owner}:${claim.hash}:${claim.sourceHash}:${claim.graphLockDigest ?? ""}`)).size > 1) {
+      reasons.push("competing same-target claims diverge");
+    }
+    if (current.length === 0 && claims.length === 0) reasons.push("no same-target historical claim");
+    if (current.length === 0) {
+      for (const claim of claims) {
+        if (claim.scope !== "same-target") continue;
+        const item = manifests.find((manifest) => manifest.path === claim.manifestPath);
+        const entry = item.manifest.entries.find((candidate) => candidate.path === path && candidate.sourceHash === claim.sourceHash);
+        if (!await verifyHistoricalEntry(entry, livePath, liveHash, transport)) {
+          reasons.push("live contribution differs from same-target historical claim");
+          break;
+        }
+      }
+    }
+    const category = reasons.length ? "unresolved" : currentGraphStatus === "exact-match" ? "current-graph-exact-match" : "retirement-candidate";
+    output.push({
+      path,
+      category,
+      reasons,
+      currentHash: currentHashes.length === 1 ? currentHashes[0] : null,
+      currentHashes: currentHashes.sort(),
+      currentSourceHashes,
+      currentNodeIds,
+      currentSelectors,
+      currentOwners,
+      currentGraphStatus,
+      liveHash,
+      claims,
+      foreignClaims
+    });
+  }
+  const counts = { "current-graph-exact-match": 0, "retirement-candidate": 0, unresolved: 0 };
+  const currentGraphCounts = { "exact-match": 0, mismatch: 0, absent: 0, unverifiable: 0 };
+  for (const path of output) counts[path.category]++;
+  for (const path of output) currentGraphCounts[path.currentGraphStatus]++;
+  return {
+    targetRoot: installRoot,
+    targetKey: targetKey2,
+    adapter,
+    installationType,
+    currentGraphLockDigest: graphPlan.graphLockDigest,
+    roots: graphPlan.graph.roots.map((root) => ({ rootId: root.rootId, source: root.source, graphNodeId: root.graphNodeId, selected: root.selected })),
+    resolutionWarnings,
+    complete,
+    paths: output,
+    counts,
+    currentGraphCounts
+  };
+}
+function claimFor(item, entry, locks, binding) {
+  const digest2 = "graphLockDigest" in entry ? entry.graphLockDigest : void 0;
+  const nodeId = "graphNodeId" in entry ? entry.graphNodeId : void 0;
+  const selector = "logicalSelector" in entry ? entry.logicalSelector : void 0;
+  const matches = locks.filter((candidate) => candidate.digest === digest2);
+  const evidence = [];
+  const owner = "workspaceOwner" in entry ? entry.workspaceOwner : legacyUnownedWorkspaceOwner;
+  const sameRoot = binding.transportKind === "ssh" ? posix3.normalize(item.manifest.targetRoot) === posix3.normalize(binding.installRoot) : resolve22(item.manifest.targetRoot) === resolve22(binding.installRoot);
+  const inTargetDir = matches.filter((candidate) => resolve22(dirname21(candidate.path)) === resolve22(binding.targetLockDir));
+  const boundLocks = inTargetDir.filter((candidate) => lockBindsState(candidate, item, binding));
+  if (owner !== binding.expectedOwner) evidence.push("workspace owner differs from selected Fleet target");
+  if (item.manifest.version !== 2 || item.manifest.installationType !== binding.installationType) evidence.push("installation type differs or manifest is legacy v1");
+  if (!sameRoot) evidence.push("manifest target root differs from selected Fleet target");
+  if (item.manifest.version === 2 && (item.manifest.stateKey !== item.stateKey || item.manifest.adapter !== binding.adapter)) {
+    evidence.push("manifest state key or adapter differs from filename");
+  }
+  if (!digest2) evidence.push("historical graph-lock digest missing");
+  else if (matches.length === 0) evidence.push("historical graph-lock digest has no matching lock");
+  if (matches.length && !inTargetDir.length) evidence.push("claim belongs to another Fleet target graph");
+  if (inTargetDir.length && !boundLocks.length) evidence.push("graph-lock fingerprint, filename, or state key does not bind claim");
+  if (boundLocks.length && !boundLocks.some((candidate) => candidate.lock.canonical.artifacts.some((artifact) => artifact.graphNodeId === nodeId && artifact.logicalSelector === selector))) {
+    evidence.push("historical graph-lock selector/node does not cover claim");
+  } else if (boundLocks.length && !boundLocks.some((candidate) => candidate.lock.canonical.artifacts.some((artifact) => artifact.graphNodeId === nodeId && artifact.logicalSelector === selector && artifact.hash === entry.sourceHash))) {
+    evidence.push("historical graph-lock artifact hash differs from manifest source hash");
+  }
+  const foreign = owner !== binding.expectedOwner || !sameRoot || item.manifest.version !== 2 || item.manifest.installationType !== binding.installationType || item.manifest.version === 2 && (item.manifest.stateKey !== item.stateKey || item.manifest.adapter !== binding.adapter) || matches.length > 0 && inTargetDir.length === 0;
+  const scope = foreign ? "foreign" : boundLocks.length && evidence.length === 0 ? "same-target" : "unbound";
+  return {
+    scope,
+    manifestPath: item.path,
+    stateKey: item.stateKey,
+    manifestStateKey: item.manifest.version === 2 ? item.manifest.stateKey : void 0,
+    installationType: item.manifest.version === 2 ? item.manifest.installationType : void 0,
+    targetRoot: item.manifest.targetRoot,
+    owner,
+    hash: entry.hash,
+    sourceHash: entry.sourceHash,
+    graphLockDigest: digest2,
+    graphNodeId: nodeId,
+    logicalSelector: selector,
+    owners: "owners" in entry ? entry.owners : [entry.packageName ?? "legacy"],
+    lockPaths: matches.map((candidate) => candidate.path),
+    evidence
+  };
+}
+function lockBindsState(candidate, manifest, binding) {
+  const name = basename20(candidate.path);
+  if (!name.endsWith(".graph-lock.json")) return false;
+  const fingerprint = name.slice(0, -".graph-lock.json".length);
+  if (!/^[a-f0-9]{64}$/u.test(fingerprint)) return false;
+  const stable = resolve22(candidate.path) === resolve22(binding.stableLockPath);
+  if (stable) {
+    return manifest.stateKey === binding.stableStateKey && candidate.lock.canonical.targetFingerprint === binding.currentFingerprint;
+  }
+  return candidate.lock.canonical.targetFingerprint === fingerprint && manifest.stateKey === stateKeyFor(binding.adapter, {
+    installationType: binding.installationType,
+    stateKey: binding.explicitStateKey,
+    targetFingerprint: fingerprint,
+    fleetId: binding.fleetId
+  });
+}
+async function verifyCurrentOperation(op, liveHash, transport) {
+  if (liveHash === null || !op.desiredHash) return "mismatch";
+  if (op.semanticPlugin || op.programmaticOperation) return "unverifiable";
+  if (op.mode === "managed-block") {
+    const selector = managedInstructionSelector(op.logicalSelector, op.artifactType, op.artifactName);
+    const state = await readManagedInstructionBlockState(op.destPath, selector, transport);
+    return state.hasBlock && !state.drifted && state.hash === op.desiredHash ? "exact-match" : "mismatch";
+  }
+  if (op.mergeStrategy) {
+    if (!op.sourcePath) return "unverifiable";
+    try {
+      await assertMergedSourceContribution(op.sourcePath, op.mergeStrategy, await transport.readFile(op.destPath));
+      return "exact-match";
+    } catch {
+      return "mismatch";
+    }
+  }
+  return liveHash === op.desiredHash ? "exact-match" : "mismatch";
+}
+async function verifyHistoricalEntry(entry, livePath, liveHash, transport) {
+  if (liveHash === null || entry.semanticPlugin) return false;
+  if (entry.mode === "managed-block") {
+    const selector = managedInstructionSelector(
+      "logicalSelector" in entry ? entry.logicalSelector : void 0,
+      entry.artifactType,
+      entry.artifactName
+    );
+    const state = await readManagedInstructionBlockState(livePath, selector, transport);
+    return state.hasBlock && !state.drifted && state.hash === entry.hash;
+  }
+  if (entry.mergeStrategy) {
+    if (!hasMergeRemovalContent(entry.mergeRemoval)) return false;
+    try {
+      assertExactMergeContribution(entry.mergeRemoval, entry.mergeStrategy, await transport.readFile(livePath));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  return entry.hash === liveHash;
+}
+function assertCompleteGraphPlan(plan) {
+  const sourceNodes = plan.graph.nodes.filter((node) => node.selected.length > 0);
+  const lockedNodes = new Map(plan.bundle.graphLock.canonical.nodes.map((node) => [node.id, node]));
+  for (const node of sourceNodes) {
+    const locked = lockedNodes.get(node.id);
+    if (!locked || locked.sourceHash !== node.sourceHash || node.selected.some((selector) => !locked.selected.includes(selector))) {
+      throw new Error(`Current source graph omitted selected node or dependency: ${node.id}`);
+    }
+  }
+  for (const edge of plan.graph.edges) {
+    if (!plan.bundle.graphLock.canonical.edges.some((locked) => locked.from === edge.from && locked.to === edge.to && locked.alias === edge.alias)) {
+      throw new Error(`Current source graph omitted dependency edge: ${edge.from} -> ${edge.to}`);
+    }
+  }
+}
+function sha2564(value) {
+  return createHash10("sha256").update(value).digest("hex");
+}
+
 // src/version/policy.ts
 import { execFile as execFile3 } from "child_process";
 import { readFile as readFile23 } from "fs/promises";
-import { join as join39, resolve as resolve21 } from "path";
+import { join as join40, resolve as resolve23 } from "path";
 import { promisify as promisify3 } from "util";
 import { parse as parseJsonc } from "jsonc-parser";
 import { z as z5 } from "zod";
@@ -9730,7 +10502,7 @@ async function discoverVersionsFromSource(pkg, workspaceRoot) {
     if (tagged.length > 0) return tagged;
   }
   if (driverName === "local") {
-    const root = resolve21(workspaceRoot, pkg.source);
+    const root = resolve23(workspaceRoot, pkg.source);
     const manifest2 = await readPackageManifest(root);
     const current = manifest2 ? [{ version: manifest2.version, ref: pkg.requestedRef ?? root }] : [];
     try {
@@ -9745,7 +10517,7 @@ async function discoverVersionsFromSource(pkg, workspaceRoot) {
   }
   const driver = getSourceDriver(driverName);
   const resolved = await driver.resolve(pkg.source, {
-    cacheRoot: join39(workspaceRoot, ".agentwheel", "cache"),
+    cacheRoot: join40(workspaceRoot, ".agentwheel", "cache"),
     mode: "tracking",
     ref: pkg.requestedRef
   });
@@ -9839,7 +10611,7 @@ function gitUrlFromSource(source) {
   throw new Error(`Version discovery does not support Git source: ${source}`);
 }
 function versionCachePath(workspaceRoot) {
-  return join39(workspaceRoot, ".agentwheel", "cache", "version-index.json");
+  return join40(workspaceRoot, ".agentwheel", "cache", "version-index.json");
 }
 async function readVersionCache(path) {
   if (!await pathExists(path)) return { schemaVersion: 1, sources: {} };
@@ -9853,7 +10625,7 @@ async function readVersionCache(path) {
 // src/profile/members.ts
 import { execFile as execFile4 } from "child_process";
 import { readFile as readFile24 } from "fs/promises";
-import { join as join40, resolve as resolve22 } from "path";
+import { join as join41, resolve as resolve24 } from "path";
 import { promisify as promisify4 } from "util";
 import { z as z7 } from "zod";
 
@@ -10028,7 +10800,7 @@ async function invokeMemberStatus(member, parentWorkspace, chain, options, cliEn
   let stderr = "";
   try {
     if (member.transport === "local") {
-      const workspace = resolve22(parentWorkspace, member.workspace);
+      const workspace = resolve24(parentWorkspace, member.workspace);
       const result = await execFileAsync4(process.execPath, [cliEntry, ...args], {
         cwd: workspace,
         env: env2,
@@ -10074,7 +10846,7 @@ async function runMemberAgentwheel(member, parentWorkspace, args, chain) {
         process.execPath,
         [process.argv[1], ...memberCommandArgs(member, args)],
         {
-          cwd: resolve22(parentWorkspace, member.workspace),
+          cwd: resolve24(parentWorkspace, member.workspace),
           env: env2,
           maxBuffer: 20 * 1024 * 1024
         }
@@ -10154,7 +10926,7 @@ function memberFailure(member, health, error) {
   };
 }
 function memberCachePath(workspaceRoot, profileName, memberId) {
-  return join40(workspaceRoot, ".agentwheel", "cache", "member-status", profileName, `${memberId}.json`);
+  return join41(workspaceRoot, ".agentwheel", "cache", "member-status", profileName, `${memberId}.json`);
 }
 async function readMemberCache(path) {
   if (!await pathExists(path)) return void 0;
@@ -10180,7 +10952,7 @@ function assertNoCompositeCycle(workspaceRoot, profileName, chain) {
   }
 }
 function compositeKey(workspaceRoot, profileName) {
-  return `${resolve22(workspaceRoot)}#${profileName}`;
+  return `${resolve24(workspaceRoot)}#${profileName}`;
 }
 
 // src/status/repository.ts
@@ -10227,10 +10999,10 @@ function valueAfter(lines, prefix) {
 }
 
 // src/catalogue/client.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { readFile as readFile25, rm as rm8 } from "fs/promises";
 import { homedir as homedir9 } from "os";
-import { join as join41 } from "path";
+import { join as join42 } from "path";
 
 // src/model/catalogue.ts
 import { z as z8 } from "zod";
@@ -10502,18 +11274,18 @@ var CatalogueClient = class {
     }
     return {
       value: schema.parse(value),
-      digest: createHash10("sha256").update(bytes).digest("hex")
+      digest: createHash11("sha256").update(bytes).digest("hex")
     };
   }
 };
 function defaultCatalogueCachePath() {
-  return join41(homedir9(), ".agentwheel", "catalogue-cache.json");
+  return join42(homedir9(), ".agentwheel", "catalogue-cache.json");
 }
 function sameSources2(a, b) {
   return a.length === b.length && a.every((source, index) => source === b[index]);
 }
 function catalogueContentHash(enriched, vercel) {
-  return createHash10("sha256").update(JSON.stringify({ enriched, vercel })).digest("hex");
+  return createHash11("sha256").update(JSON.stringify({ enriched, vercel })).digest("hex");
 }
 
 // src/search/index.ts
@@ -10875,9 +11647,9 @@ function includesToken(normalizedText, token) {
 }
 
 // src/semantic/index.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import { homedir as homedir10 } from "os";
-import { join as join42 } from "path";
+import { join as join43 } from "path";
 import { env, pipeline } from "@huggingface/transformers";
 var DEFAULT_SEMANTIC_INDEX_URL = "https://raw.githubusercontent.com/NestDevLab/agentwheel-registry/main/catalogue-semantic-index/gte-v1/";
 var CONTRACT = {
@@ -10965,13 +11737,13 @@ var SemanticSearchClient = class {
     if (!response.ok) throw new Error(`Semantic index file failed (${response.status}): ${descriptor.path}`);
     const bytes = new Uint8Array(await response.arrayBuffer());
     if (bytes.byteLength !== descriptor.bytes) throw new Error(`Semantic index file size does not match: ${descriptor.path}`);
-    const digest2 = createHash11("sha256").update(bytes).digest("hex");
+    const digest2 = createHash12("sha256").update(bytes).digest("hex");
     if (digest2 !== descriptor.sha256) throw new Error(`Semantic index checksum does not match: ${descriptor.path}`);
     return bytes;
   }
 };
 async function embedQuery(query) {
-  env.cacheDir = join42(homedir10(), ".agentwheel", "semantic-models");
+  env.cacheDir = join43(homedir10(), ".agentwheel", "semantic-models");
   const extractor = await pipeline("feature-extraction", CONTRACT.model.id, {
     revision: CONTRACT.model.revision,
     dtype: CONTRACT.model.dtype,
@@ -11055,9 +11827,9 @@ function ensureTrailingSlash(value) {
 }
 
 // src/trial/skill.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { readFile as readFile26, stat as stat13 } from "fs/promises";
-import { join as join43 } from "path";
+import { join as join44 } from "path";
 import { parse as parseYaml2 } from "yaml";
 var MAX_TRIAL_SKILL_BYTES = 512 * 1024;
 async function createSkillTrial(driver, resolved, selectors) {
@@ -11069,7 +11841,7 @@ async function createSkillTrial(driver, resolved, selectors) {
     throw new Error("Skill trial requires exactly one selected skill. Use --skill <name> or --select skills/<name>.");
   }
   const artifact = skills[0];
-  const path = artifact.kind === "dir" ? join43(artifact.sourcePath, "SKILL.md") : artifact.sourcePath;
+  const path = artifact.kind === "dir" ? join44(artifact.sourcePath, "SKILL.md") : artifact.sourcePath;
   const info = await stat13(path);
   if (info.size > MAX_TRIAL_SKILL_BYTES) {
     throw new Error(`Skill trial exceeds the ${MAX_TRIAL_SKILL_BYTES / 1024} KiB content limit.`);
@@ -11085,7 +11857,7 @@ async function createSkillTrial(driver, resolved, selectors) {
     skill: {
       name: artifact.name,
       relativePath: artifact.relativePath,
-      sha256: createHash12("sha256").update(content).digest("hex"),
+      sha256: createHash13("sha256").update(content).digest("hex"),
       frontmatter,
       content
     }
@@ -11104,10 +11876,10 @@ function readSkillFrontmatter(content, artifact) {
 }
 
 // src/lifecycle/fleet-normalize.ts
-import { createHash as createHash13 } from "crypto";
-import { readFile as readFile27, readdir as readdir9, rm as rm9 } from "fs/promises";
+import { createHash as createHash14 } from "crypto";
+import { readFile as readFile27, readdir as readdir11, rm as rm9 } from "fs/promises";
 import { homedir as homedir11 } from "os";
-import { basename as basename19, isAbsolute as isAbsolute3, join as join44, relative as relative8, resolve as resolve23 } from "path";
+import { dirname as dirname22, isAbsolute as isAbsolute3, join as join45, relative as relative9, resolve as resolve25 } from "path";
 async function planFleetNormalization(request) {
   const normalizedRequest = normalizeRequest2(request);
   const destinationScope = await resolveWorkspaceScope({
@@ -11137,7 +11909,7 @@ async function planFleetNormalization(request) {
         `Package '${name}' has divergent declarations. Source, driver, adapter, adapter configuration, installation type, version policy, selections, aliases, overrides, and suggestions must match before normalization.`
       );
     }
-    packages.push({ name, declarationDigest: sha2564(sourceDeclaration) });
+    packages.push({ name, declarationDigest: sha2565(sourceDeclaration) });
   }
   if (!legacySelfNormalization) await assertSourceFleetPostcondition(normalizedRequest, sourceScope, candidates);
   if ((normalizedRequest.profile || normalizedRequest.agent || normalizedRequest.artifacts || normalizedRequest.orphanedOwnerRoots) && !legacySelfNormalization) {
@@ -11168,7 +11940,7 @@ async function planFleetNormalization(request) {
     packages,
     installedState
   };
-  return { ...planWithoutDigest, planDigest: sha2564(canonicalJson2(planWithoutDigest)) };
+  return { ...planWithoutDigest, planDigest: sha2565(canonicalJson2(planWithoutDigest)) };
 }
 async function applyFleetNormalization(request, hooks = {}) {
   if (!request.apply) throw new Error("Fleet normalization is dry-run by default; pass --apply with --plan-digest <digest>.");
@@ -11306,7 +12078,7 @@ async function assertNormalizationPostconditions(journal) {
   }
   for (const graphLock of journal.graphLocks) {
     const raw = await readOptionalRecord(graphLock.path);
-    const digest2 = raw ? sha2564(canonicalJson2(await readGraphLock(graphLock.path))) : null;
+    const digest2 = raw ? sha2565(canonicalJson2(await readGraphLock(graphLock.path))) : null;
     if (digest2 !== graphLock.afterDigest) {
       throw new Error(`Fleet normalization graph-lock postcheck failed: ${graphLock.path}`);
     }
@@ -11378,17 +12150,17 @@ function normalizeRequest2(request) {
     ...profile ? { profile } : {},
     ...agent ? { agent } : {},
     ...orphanedOwnerRoots ? { orphanedOwnerRoots } : {},
-    ...request.globalRoot ? { globalRoot: resolve23(request.globalRoot) } : {}
+    ...request.globalRoot ? { globalRoot: resolve25(request.globalRoot) } : {}
   };
 }
 function normalizeOrphanedOwnerRoot(value) {
   const root = value.trim();
   if (!root || !isAbsolute3(root)) throw new Error(`Invalid orphaned owner root '${value}'; expected an absolute workspace path.`);
-  return resolve23(root);
+  return resolve25(root);
 }
 async function normalizationRoots(request) {
   const destination = await showRegisteredFleet(request.destinationFleet, { globalRoot: request.globalRoot });
-  const source = request.from === "user" ? resolve23(request.globalRoot ?? homedir11()) : (await showRegisteredFleet(request.from.slice("fleet:".length), { globalRoot: request.globalRoot })).root;
+  const source = request.from === "user" ? resolve25(request.globalRoot ?? homedir11()) : (await showRegisteredFleet(request.from.slice("fleet:".length), { globalRoot: request.globalRoot })).root;
   return { source, destination: destination.root };
 }
 async function withOrderedLocks(roots, fn) {
@@ -11396,7 +12168,7 @@ async function withOrderedLocks(roots, fn) {
     if (index === roots.length) return fn();
     const root = roots[index];
     return withFilesystemLock(
-      join44(root, ".agentwheel", "fleet-normalize.lock"),
+      join45(root, ".agentwheel", "fleet-normalize.lock"),
       5e3,
       () => run(index + 1),
       "fleet normalization"
@@ -11454,11 +12226,28 @@ async function inspectInstalledState(source, destination, packageNames) {
   const coveredDestinationGraphs = /* @__PURE__ */ new Set();
   const plannedDestinationGraphs = /* @__PURE__ */ new Set();
   for (const sourceGraph of sourceGraphs) {
-    const sourceState = await targetStateForGraph(source, sourceGraph);
-    const destinationState = await targetStateForGraph(destination, sourceGraph);
-    if (sourceState.graphLockPath !== sourceGraph.path) {
-      throw new Error(`Source graph lock target identity is stale or noncanonical: ${sourceGraph.path}`);
+    const sourceState = await installedTargetStateForGraph(
+      source,
+      sourceGraph,
+      manifests,
+      sourceOwners,
+      selected
+    );
+    const destinationStableState = await targetStateForGraph(destination, sourceGraph);
+    const matchingDestinationGraphs = destinationGraphs.filter((candidate) => candidate.targetKey === sourceGraph.targetKey && candidate.adapter === sourceGraph.adapter);
+    if (matchingDestinationGraphs.length > 1) {
+      throw new Error(
+        `Ambiguous destination graph state for target '${sourceGraph.targetKey}': ` + matchingDestinationGraphs.map((candidate) => candidate.path).join(", ")
+      );
     }
+    const destinationGraph = matchingDestinationGraphs[0];
+    const destinationState = destinationGraph ? await installedTargetStateForGraph(
+      destination,
+      destinationGraph,
+      manifests,
+      destinationOwners,
+      selected
+    ) : destinationStableState;
     if (sourceState.adapter !== destinationState.adapter) {
       throw new Error(`Source and destination adapters diverge for target '${sourceGraph.targetKey}'.`);
     }
@@ -11467,7 +12256,6 @@ async function inspectInstalledState(source, destination, packageNames) {
       throw new Error(`Source graph lock is not covered by its canonical install manifest: ${sourceState.manifestPath}`);
     }
     const sourceGraphArtifacts = new Set(sourceGraph.artifactIdentities);
-    const destinationGraph = destinationGraphs.find((candidate) => candidate.path === destinationState.graphLockPath);
     if (destinationGraph && destinationGraph.digest !== sourceGraph.digest) {
       throw new Error("Source and destination graph declarations, selections, versions, identities, or rendered paths diverge.");
     }
@@ -11479,10 +12267,10 @@ async function inspectInstalledState(source, destination, packageNames) {
     const destinationGraphAfter = destinationGraph?.lock ?? destinationGraphFromSource(sourceGraph.lock, destinationState.targetFingerprint);
     graphTransfers.push({
       sourceGraphLockPath: sourceGraph.path,
-      sourceGraphLockDigest: sha2564(canonicalJson2(sourceGraph.lock)),
+      sourceGraphLockDigest: sha2565(canonicalJson2(sourceGraph.lock)),
       destinationGraphLockPath: destinationState.graphLockPath,
-      destinationGraphLockDigest: destinationGraph ? sha2564(canonicalJson2(destinationGraph.lock)) : null,
-      destinationGraphLockAfterDigest: sha2564(canonicalJson2(destinationGraphAfter)),
+      destinationGraphLockDigest: destinationGraph ? sha2565(canonicalJson2(destinationGraph.lock)) : null,
+      destinationGraphLockAfterDigest: sha2565(canonicalJson2(destinationGraphAfter)),
       targetKey: sourceGraph.targetKey,
       adapter: destinationState.adapter,
       targetFingerprint: destinationState.targetFingerprint
@@ -11585,16 +12373,30 @@ async function inspectLegacySelfInstalledState(fleet, packageNames, profileName,
   const transferableOwners = orphanedOwners.size > 0 ? orphanedOwners : /* @__PURE__ */ new Set([legacyOwner]);
   let normalizedGraphCount = 0;
   for (const graph of graphCandidates) {
+    const destinationState = await targetStateForGraph(fleet, graph, fleet.fleetId);
+    if (resolve25(destinationState.graphLockPath) === resolve25(graph.path)) {
+      const destinationManifest = (await collectManifestPaths([destinationState.manifestPath]))[0];
+      if (destinationManifest?.manifest.entries.some((entry) => entry.workspaceOwner === fleetOwner && entryMatchesPackages(entry, selected))) {
+        assertCorrelatedGraphManifest(
+          graph,
+          destinationState,
+          destinationManifest,
+          /* @__PURE__ */ new Set([fleetOwner]),
+          selected
+        );
+        normalizedGraphCount += 1;
+        continue;
+      }
+    }
     const legacyState = await legacyTargetStateForGraph(fleet, graph);
+    if (resolve25(legacyState.graphLockPath) !== resolve25(graph.path)) {
+      throw new Error(`Legacy graph lock target identity is stale or noncanonical: ${graph.path}`);
+    }
     const legacyManifest = (await collectManifestPaths([legacyState.manifestPath]))[0];
     const relevantManifestEntries2 = legacyManifest?.manifest.entries.filter((entry) => entryMatchesGraphPackages(entry, graph.lock, selected) && entryMatchesArtifacts(entry, selectedArtifacts)) ?? [];
     if (relevantManifestEntries2.length > 0) {
       graphs.push(graph);
     }
-    const destinationState = await targetStateForGraph(fleet, graph, fleet.fleetId);
-    if (destinationState.graphLockPath === graph.path && legacyManifest?.manifest.entries.some((entry) => entry.workspaceOwner === fleetOwner && entryMatchesPackages(entry, selected))) {
-      normalizedGraphCount += 1;
-    }
   }
   if (graphs.length === 0 && normalizedGraphCount > 0) {
     throw new Error(`Fleet '${fleet.fleetId}' installed state is already normalized to fleet-qualified ownership.`);
@@ -11695,7 +12497,7 @@ async function inspectLegacySelfInstalledState(fleet, packageNames, profileName,
       )
     });
     if (!selectedArtifacts) {
-      const fullDigest = sha2564(canonicalJson2(graph.lock));
+      const fullDigest = sha2565(canonicalJson2(graph.lock));
       const existingDestinationGraph = graphCandidates.find((candidate) => candidate.path === destinationState.graphLockPath);
       if (existingDestinationGraph) assertGraphIsSubset(graph, existingDestinationGraph);
       const destinationGraph = destinationGraphFromSource(graph.lock, destinationState.targetFingerprint);
@@ -11703,8 +12505,8 @@ async function inspectLegacySelfInstalledState(fleet, packageNames, profileName,
         sourceGraphLockPath: graph.path,
         sourceGraphLockDigest: fullDigest,
         destinationGraphLockPath: destinationState.graphLockPath,
-        destinationGraphLockDigest: existingDestinationGraph ? sha2564(canonicalJson2(existingDestinationGraph.lock)) : null,
-        destinationGraphLockAfterDigest: sha2564(canonicalJson2(destinationGraph)),
+        destinationGraphLockDigest: existingDestinationGraph ? sha2565(canonicalJson2(existingDestinationGraph.lock)) : null,
+        destinationGraphLockAfterDigest: sha2565(canonicalJson2(destinationGraph)),
         targetKey: graph.targetKey,
         adapter: graph.adapter,
         targetFingerprint: destinationState.targetFingerprint
@@ -11762,7 +12564,7 @@ function targetKeysForAgent(scope, name) {
 async function runtimeRoots(scope) {
   const roots = /* @__PURE__ */ new Set([scope.root]);
   if (scope.config.packages.some((pkg) => pkg.installationType === "user") || Object.values(scope.config.agents).some((agent) => agent.installationType === "user")) {
-    roots.add(resolve23(process.env.AGENTWHEEL_TEST_HOME || process.env.HOME || homedir11()));
+    roots.add(resolve25(process.env.AGENTWHEEL_TEST_HOME || process.env.HOME || homedir11()));
   }
   for (const [name, agent] of Object.entries(scope.config.agents)) {
     if (agent.transport === "ssh") throw new Error(`Installed-state normalization cannot inspect SSH agent '${name}' locally.`);
@@ -11780,17 +12582,17 @@ async function runtimeRoots(scope) {
 async function collectManifests(roots) {
   const found = /* @__PURE__ */ new Map();
   for (const root of roots) {
-    const dir = join44(root, ".agentwheel");
+    const dir = join45(root, ".agentwheel");
     let names;
     try {
-      names = await readdir9(dir);
+      names = await readdir11(dir);
     } catch (error) {
       if (isMissing(error)) continue;
       throw error;
     }
     for (const name of names.sort((a, b) => a.localeCompare(b))) {
       if (!name.endsWith(".install-manifest.json")) continue;
-      const path = join44(dir, name);
+      const path = join45(dir, name);
       const raw = JSON.parse(await readFile27(path, "utf8"));
       const parsed = installManifestSchema.parse(raw);
       if (parsed.version !== 2) {
@@ -11799,14 +12601,14 @@ async function collectManifests(roots) {
         }
         continue;
       }
-      if (resolve23(parsed.targetRoot) !== resolve23(root)) {
+      if (resolve25(parsed.targetRoot) !== resolve25(root)) {
         throw new Error(`Install manifest target root does not match its enumerated runtime root: ${path}`);
       }
       const expectedPath = installManifestPath(parsed.targetRoot, parsed.adapter, {
         installationType: parsed.installationType,
         stateKey: parsed.stateKey
       });
-      if (resolve23(expectedPath) !== resolve23(path)) {
+      if (resolve25(expectedPath) !== resolve25(path)) {
         throw new Error(`Install manifest state identity does not match its canonical path: ${path}`);
       }
       found.set(path, { path, raw, manifest: { ...parsed, revision: computeManifestRevision(raw), legacy: false } });
@@ -11827,7 +12629,7 @@ async function collectManifestPaths(paths) {
       installationType: parsed.installationType,
       stateKey: parsed.stateKey
     });
-    if (resolve23(expectedPath) !== resolve23(path)) {
+    if (resolve25(expectedPath) !== resolve25(path)) {
       throw new Error(`Install manifest state identity does not match its canonical path: ${path}`);
     }
     found.push({ path, raw, manifest: { ...parsed, revision: computeManifestRevision(raw), legacy: false } });
@@ -11846,21 +12648,17 @@ function assertNoForeignSamePathOwnership(manifests, renderedPaths, allowedOwner
   }
 }
 async function relevantGraphLocks(workspaceRoot, selected, targetKeys, include) {
-  const root = join44(workspaceRoot, ".agentwheel", "locks");
+  const root = join45(workspaceRoot, ".agentwheel", "locks");
   if (!await pathExists(root)) return [];
   const results = [];
   for (const path of await listFiles(root)) {
     if (!path.endsWith(".graph-lock.json")) continue;
     const lock = await readGraphLock(path);
     if (!lock.canonical.roots.some((candidate2) => selected.has(candidate2.rootId))) continue;
-    const parts = relative8(root, path).split(/[\\/]/);
+    const parts = relative9(root, path).split(/[\\/]/);
     if (parts.length !== 3) throw new Error(`Graph lock path is not canonical: ${path}`);
-    const [targetKey2, adapter, fileName] = parts;
+    const [targetKey2, adapter] = parts;
     if (targetKeys && !targetKeys.has(targetKey2)) continue;
-    const pathFingerprint = basename19(fileName, ".graph-lock.json");
-    if (!lock.canonical.targetFingerprint || lock.canonical.targetFingerprint !== pathFingerprint) {
-      throw new Error(`Graph lock fingerprint does not match its canonical path: ${path}`);
-    }
     const candidate = {
       path,
       lock,
@@ -11874,7 +12672,7 @@ async function relevantGraphLocks(workspaceRoot, selected, targetKeys, include)
     const projection = relevantGraphProjection(lock, selected);
     results.push({
       ...candidate,
-      digest: sha2564(canonicalJson2(projection)),
+      digest: sha2565(canonicalJson2(projection)),
       artifactIdentities: lock.canonical.artifacts.filter((artifact) => artifact.owners.some((owner) => ownerMatchesGraphPackage(lock, owner, selected))).map(graphArtifactIdentity).sort()
     });
   }
@@ -11889,9 +12687,19 @@ function isCurrentLocalTarget(scope, graph) {
 }
 async function hasRelevantLegacyManifestCandidate(scope, graph, selected) {
   if (!isCurrentLocalTarget(scope, graph)) return false;
-  const manifestPath = await legacyManifestPathForConfiguredTarget(scope, graph) ?? (await legacyTargetStateForGraph(scope, graph)).manifestPath;
-  const manifest = (await collectManifestPaths([manifestPath]))[0];
-  return manifest?.manifest.entries.some((entry) => entryMatchesGraphPackages(entry, graph.lock, selected)) ?? false;
+  const configuredLegacyPath = await legacyManifestPathForConfiguredTarget(scope, graph);
+  if (configuredLegacyPath) {
+    const manifest = (await collectManifestPaths([configuredLegacyPath]))[0];
+    if (manifest?.manifest.entries.some((entry) => entryMatchesGraphPackages(entry, graph.lock, selected))) return true;
+  }
+  if (graph.lock.canonical.roots.some((root) => !scope.config.packages.some((pkg) => pkg.name === root.rootId))) return false;
+  const legacyState = await legacyTargetStateForGraph(scope, graph);
+  const legacyManifest = (await collectManifestPaths([legacyState.manifestPath]))[0];
+  if (legacyManifest?.manifest.entries.some((entry) => entryMatchesGraphPackages(entry, graph.lock, selected))) return true;
+  const stableState = await targetStateForGraph(scope, graph, scope.fleetId ?? null);
+  if (resolve25(stableState.graphLockPath) !== resolve25(graph.path)) return false;
+  const stableManifest = (await collectManifestPaths([stableState.manifestPath]))[0];
+  return stableManifest?.manifest.entries.some((entry) => entryMatchesGraphPackages(entry, graph.lock, selected)) ?? false;
 }
 async function legacyManifestPathForConfiguredTarget(scope, graph) {
   const agent = scope.config.agents[graph.targetKey];
@@ -11910,9 +12718,10 @@ async function legacyManifestPathForConfiguredTarget(scope, graph) {
     baseDir: scope.root
   });
   const targetRoot = resolveConfigPath(agent.root, scope.root);
-  const installRoot = resolve23(installRootForAdapterInstallationType(adapter, targetRoot, agent.installationType, false));
+  const installRoot = resolve25(installRootForAdapterInstallationType(adapter, targetRoot, agent.installationType, false));
   const stateKey = stateKeyFor(adapter.name, {
     installationType: agent.installationType,
+    stateKey: agent.stateKey,
     targetFingerprint: graph.lock.canonical.targetFingerprint
   });
   return installManifestPath(installRoot, adapter.name, { installationType: agent.installationType, stateKey });
@@ -11977,14 +12786,21 @@ async function targetStateForGraph(scope, graph, identityFleetId = scope.fleetId
     ssh: void 0,
     ...agent?.stateKey ? { stateKey: agent.stateKey } : {}
   };
-  const targetFingerprint = computeTargetFingerprint(fingerprintParts);
+  const installRoot = resolve25(installRootForAdapterInstallationType(adapter, targetRoot, installationType, false));
+  const targetIdentity = resolveTargetStateIdentity({
+    targetFingerprintParts: fingerprintParts,
+    workspaceRoot: scope.root,
+    targetKey: graph.targetKey,
+    resolvedInstallRoot: installRoot,
+    transportKind: "local"
+  });
+  const targetFingerprint = targetIdentity.targetFingerprint;
   const stateKey = stateKeyFor(adapter.name, {
     installationType,
     stateKey: agent?.stateKey,
-    targetFingerprint,
+    targetFingerprint: targetIdentity.stateFingerprint,
     ...identityFleetId ? { fleetId: identityFleetId } : {}
   });
-  const installRoot = resolve23(installRootForAdapterInstallationType(adapter, targetRoot, installationType, false));
   return {
     adapter: adapter.name,
     installationType,
@@ -11992,28 +12808,81 @@ async function targetStateForGraph(scope, graph, identityFleetId = scope.fleetId
     installRoot,
     stateKey,
     targetFingerprint,
-    graphLockPath: graphLockPathForTarget(scope.root, graph.targetKey, adapter.name, fingerprintParts),
+    graphLockPath: graphLockPathForTarget(scope.root, graph.targetKey, adapter.name, fingerprintParts, {
+      resolvedInstallRoot: installRoot,
+      transportKind: "local"
+    }),
     manifestPath: installManifestPath(installRoot, adapter.name, { installationType, stateKey })
   };
 }
-async function legacyTargetStateForGraph(scope, graph) {
-  const current = await targetStateForGraph(scope, graph, null);
+async function installedTargetStateForGraph(scope, graph, manifests, owners, selected, identityFleetId = scope.fleetId ?? null) {
+  const stable = await targetStateForGraph(scope, graph, identityFleetId);
+  let state;
+  if (resolve25(graph.path) === resolve25(stable.graphLockPath)) {
+    state = stable;
+  } else {
+    const released = await releasedTargetStateForGraph(scope, graph, identityFleetId);
+    if (resolve25(graph.path) !== resolve25(released.graphLockPath)) {
+      throw new Error(`Graph lock target identity is stale or noncanonical: ${graph.path}`);
+    }
+    state = released;
+  }
+  const manifest = manifests.find((candidate) => resolve25(candidate.path) === resolve25(state.manifestPath));
+  if (!manifest) {
+    throw new Error(`Graph lock is not covered by its canonical install manifest: ${state.manifestPath}`);
+  }
+  assertCorrelatedGraphManifest(graph, state, manifest, owners, selected);
+  return state;
+}
+async function releasedTargetStateForGraph(scope, graph, identityFleetId = scope.fleetId ?? null) {
+  const current = await targetStateForGraph(scope, graph, identityFleetId);
   const targetFingerprint = graph.lock.canonical.targetFingerprint;
+  if (!targetFingerprint || !/^[a-f0-9]{64}$/u.test(targetFingerprint)) {
+    throw new Error(`Released graph lock has an invalid target fingerprint: ${graph.path}`);
+  }
+  const agent = scope.config.agents[graph.targetKey];
   const stateKey = stateKeyFor(current.adapter, {
     installationType: current.installationType,
-    targetFingerprint
+    stateKey: agent?.stateKey,
+    targetFingerprint,
+    ...identityFleetId ? { fleetId: identityFleetId } : {}
   });
   return {
     ...current,
     stateKey,
     targetFingerprint,
-    graphLockPath: graph.path,
+    graphLockPath: join45(dirname22(graph.path), `${targetFingerprint}.graph-lock.json`),
     manifestPath: installManifestPath(current.installRoot, current.adapter, {
       installationType: current.installationType,
       stateKey
     })
   };
 }
+function assertCorrelatedGraphManifest(graph, state, manifest, owners, selected) {
+  if (manifest.manifest.adapter !== state.adapter || manifest.manifest.installationType !== state.installationType || manifest.manifest.stateKey !== state.stateKey || resolve25(manifest.manifest.targetRoot) !== resolve25(state.installRoot)) {
+    throw new Error(`Install manifest identity does not match graph target state: ${manifest.path}`);
+  }
+  const entries = manifest.manifest.entries.filter((entry) => entryMatchesGraphPackages(entry, graph.lock, selected));
+  if (entries.length === 0) {
+    throw new Error(`Graph lock is not covered by selected install-manifest contributions: ${graph.path}`);
+  }
+  const graphArtifacts = new Set(graph.artifactIdentities);
+  const graphLockDigest = sha2565(canonicalJson2(graph.lock));
+  for (const entry of entries) {
+    if (!owners.has(entry.workspaceOwner)) {
+      throw new Error(`Graph lock manifest owner mismatch at ${manifest.path}: ${entry.workspaceOwner}.`);
+    }
+    if (!graphArtifacts.has(graphEntryIdentity(entry))) {
+      throw new Error(`Install manifest entry is not covered by its graph lock: ${renderedEntryPath(manifest.manifest, entry)}`);
+    }
+    if (entry.graphLockDigest !== void 0 && entry.graphLockDigest !== graphLockDigest) {
+      throw new Error(`Install manifest graph-lock digest does not match ${graph.path}.`);
+    }
+  }
+}
+async function legacyTargetStateForGraph(scope, graph) {
+  return releasedTargetStateForGraph(scope, graph, null);
+}
 function assertGraphIsSubset(source, destination) {
   const sourceRoots = new Map(source.lock.canonical.roots.map((root) => [root.rootId, canonicalJson2(root)]));
   for (const root of destination.lock.canonical.roots) {
@@ -12047,7 +12916,7 @@ function destinationGraphFromSource(source, targetFingerprint) {
 function mergeDestinationManifest(existing, state, generatedAt, desiredEntries, replaceOwners = /* @__PURE__ */ new Set()) {
   if (existing) {
     const manifest2 = existing.manifest;
-    if (manifest2.adapter !== state.adapter || manifest2.installationType !== state.installationType || manifest2.stateKey !== state.stateKey || resolve23(manifest2.targetRoot) !== state.installRoot) {
+    if (manifest2.adapter !== state.adapter || manifest2.installationType !== state.installationType || manifest2.stateKey !== state.stateKey || resolve25(manifest2.targetRoot) !== state.installRoot) {
       throw new Error(`Destination manifest identity diverges from the derived target: ${existing.path}`);
     }
   }
@@ -12107,7 +12976,7 @@ async function assertEquivalentRuntimeState(entry, sourcePath, destinationPath)
       const content = await readFile27(path, "utf8");
       if (hasMergeRemovalContent(entry.mergeRemoval)) {
         assertExactMergeContribution(entry.mergeRemoval, entry.mergeStrategy, content);
-      } else if (resolve23(sourcePath) === resolve23(destinationPath) && entry.mergeStrategy !== "codex-toml-mcp") {
+      } else if (resolve25(sourcePath) === resolve25(destinationPath) && entry.mergeStrategy !== "codex-toml-mcp") {
         assertExactMergeContribution({}, entry.mergeStrategy, content);
       } else {
         throw new Error(`Installed-state normalization cannot prove incomplete merge ownership at ${path}.`);
@@ -12118,8 +12987,8 @@ async function assertEquivalentRuntimeState(entry, sourcePath, destinationPath)
   await assertEquivalentRuntimeBytes(sourcePath, destinationPath, entry.hash);
 }
 function renderedEntryPathForRoot(root, entryPath) {
-  const normalizedRoot = resolve23(root);
-  const candidate = resolve23(normalizedRoot, entryPath);
+  const normalizedRoot = resolve25(root);
+  const candidate = resolve25(normalizedRoot, entryPath);
   if (candidate !== normalizedRoot && !candidate.startsWith(`${normalizedRoot}/`)) {
     throw new Error(`Install manifest entry escapes its target root: ${entryPath}`);
   }
@@ -12210,8 +13079,8 @@ function ownerMatchesGraphPackage(lock, owner, selected) {
   return ownerMatchesPackage(owner, selected) || lock.canonical.roots.some((root) => selected.has(root.rootId) && root.graphNodeId === owner);
 }
 function renderedEntryPath(manifest, entry) {
-  const root = resolve23(manifest.targetRoot);
-  const candidate = resolve23(root, entry.path);
+  const root = resolve25(manifest.targetRoot);
+  const candidate = resolve25(root, entry.path);
   if (candidate !== root && !candidate.startsWith(`${root}/`)) {
     throw new Error(`Install manifest entry escapes its target root: ${entry.path}`);
   }
@@ -12366,7 +13235,7 @@ async function buildJournalGraphLockStates(plan) {
   for (const transfer of plan.installedState.graphTransfers) {
     const sourceBefore = JSON.parse(await readFile27(transfer.sourceGraphLockPath, "utf8"));
     const sourceLock = await readGraphLock(transfer.sourceGraphLockPath);
-    const sourceDigest = sha2564(canonicalJson2(sourceLock));
+    const sourceDigest = sha2565(canonicalJson2(sourceLock));
     if (sourceDigest !== transfer.sourceGraphLockDigest) {
       throw new Error(`Source graph lock changed after planning: ${transfer.sourceGraphLockPath}`);
     }
@@ -12384,9 +13253,9 @@ async function buildJournalGraphLockStates(plan) {
       continue;
     }
     const destinationBefore = await readOptionalRecord(transfer.destinationGraphLockPath);
-    const destinationBeforeDigest = destinationBefore ? sha2564(canonicalJson2(await readGraphLock(transfer.destinationGraphLockPath))) : null;
+    const destinationBeforeDigest = destinationBefore ? sha2565(canonicalJson2(await readGraphLock(transfer.destinationGraphLockPath))) : null;
     const destinationAfter = destinationBefore ? await readGraphLock(transfer.destinationGraphLockPath) : destinationGraphFromSource(sourceLock, transfer.targetFingerprint);
-    const destinationAfterDigest = sha2564(canonicalJson2(destinationAfter));
+    const destinationAfterDigest = sha2565(canonicalJson2(destinationAfter));
     if (destinationBeforeDigest !== transfer.destinationGraphLockDigest || destinationAfterDigest !== transfer.destinationGraphLockAfterDigest) {
       throw new Error(`Destination graph lock changed after planning: ${transfer.destinationGraphLockPath}`);
     }
@@ -12496,7 +13365,7 @@ async function assertJournalRecoverable(journal) {
   }
   for (const graphLock of journal.graphLocks) {
     const raw = await readOptionalRecord(graphLock.path);
-    const digest2 = raw ? sha2564(canonicalJson2(await readGraphLock(graphLock.path))) : null;
+    const digest2 = raw ? sha2565(canonicalJson2(await readGraphLock(graphLock.path))) : null;
     if (digest2 !== graphLock.beforeDigest && digest2 !== graphLock.afterDigest) {
       throw new Error(`Cannot recover fleet normalization because graph lock changed outside the transaction: ${graphLock.path}`);
     }
@@ -12549,10 +13418,10 @@ function packageMap(config) {
   return result;
 }
 function configRevision(config) {
-  return sha2564(canonicalJson2(config));
+  return sha2565(canonicalJson2(config));
 }
 function normalizationJournalPath(sourceRoot, destinationFleet) {
-  return join44(sourceRoot, ".agentwheel", `fleet-normalize-${destinationFleet}.journal.json`);
+  return join45(sourceRoot, ".agentwheel", `fleet-normalize-${destinationFleet}.journal.json`);
 }
 function canonicalJson2(value) {
   return JSON.stringify(sortValue(value));
@@ -12564,8 +13433,8 @@ function sortValue(value) {
   }
   return value;
 }
-function sha2564(value) {
-  return createHash13("sha256").update(value).digest("hex");
+function sha2565(value) {
+  return createHash14("sha256").update(value).digest("hex");
 }
 function assertDigest(value) {
   if (!/^[a-f0-9]{64}$/.test(value)) throw new Error(`Invalid plan digest: ${value}`);
@@ -12603,6 +13472,7 @@ var commandGovernance = {
   "package migrate": "governed-always",
   remember: "governed-always",
   "ownership handoff": "governed-unless-dry-run",
+  "ownership recovery-plan": "incidental-cache",
   "ownership retire-stale": "governed-apply",
   "mcp retire": "governed-apply",
   eject: "governed-always",
@@ -12709,7 +13579,7 @@ fleetCommand.command("normalize").description("plan or apply duplicate desired-s
 });
 cacheCommand.command("prune").description("remove old Git source snapshots while preserving locked commits").option("--user", "use the user workspace", false).option("--local", "use the nearest local workspace", false).option("--fleet <id>", "use one registered named fleet").option("-t, --target-root <path>", "explicit workspace root").option("--keep <count>", "newest snapshots to retain per source", parsePositiveInteger, 3).option("--apply", "delete the selected snapshots; without this flag only preview", false).action(async (options) => {
   const targetRoot = await workspaceContextRootFromOptions(normalizeRuntimeScopeOptions(options));
-  const cacheRoot = join45(targetRoot, ".agentwheel", "cache");
+  const cacheRoot = join46(targetRoot, ".agentwheel", "cache");
   const result = await pruneGitCache(cacheRoot, { keepSnapshots: options.keep, dryRun: !options.apply });
   const verb = options.apply ? "Removed" : "Would remove";
   for (const path of result.removedPaths) console.log(`${verb} ${path}`);
@@ -12727,7 +13597,7 @@ program.command("list").description("list artifacts exposed by a package source"
   const resolvedInput = await resolvePackageSource(source, targetRoot);
   const selectedArtifacts = selectedArtifactsFromOptionsOrRegistry(options, resolvedInput.registryEntry);
   const driver = getSourceDriver(options.driver ?? inferSourceDriverName(resolvedInput.source));
-  const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(resolvedInput.source, { cacheRoot: join45(targetRoot, ".agentwheel", "cache") }))));
+  const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(resolvedInput.source, { cacheRoot: join46(targetRoot, ".agentwheel", "cache") }))));
   try {
     const artifacts = filterArtifactsBySelection(await driver.list(resolved), selectedArtifacts);
     for (const artifact of artifacts) {
@@ -12796,7 +13666,7 @@ program.command("try").description("read and validate one skill for the current
   const resolvedInput = await resolvePackageSource(source, targetRoot);
   const driver = getSourceDriver(options.driver ?? inferSourceDriverName(resolvedInput.source));
   const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(resolvedInput.source, {
-    cacheRoot: join45(targetRoot, ".agentwheel", "cache")
+    cacheRoot: join46(targetRoot, ".agentwheel", "cache")
   }))));
   try {
     const trial = await createSkillTrial(driver, resolved, selectedArtifactsFromOptionsOrRegistry(options, resolvedInput.registryEntry));
@@ -12818,7 +13688,7 @@ program.command("scan").description("scan a package source for validation findin
   const targetRoot = await workspaceContextRootFromOptions(normalizeRuntimeScopeOptions(options));
   const resolvedInput = await resolvePackageSource(source, targetRoot);
   const driver = getSourceDriver(options.driver ?? inferSourceDriverName(resolvedInput.source));
-  const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(resolvedInput.source, { cacheRoot: join45(targetRoot, ".agentwheel", "cache") }))));
+  const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(resolvedInput.source, { cacheRoot: join46(targetRoot, ".agentwheel", "cache") }))));
   try {
     const result = await driver.scan(resolved);
     if (result.findings.length === 0) {
@@ -12918,11 +13788,11 @@ program.command("deps").description("inspect the OpenPack dependency graph").add
     const normalizedOptions = normalizeRuntimeScopeOptions(options);
     const targets = await resolveCliTargets(normalizedOptions);
     for (const target of targets) {
-      const { lock, adapter } = await readTargetGraphLock(target, normalizedOptions);
-      const installationType = normalizedOptions.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
-      const state = installStateForTarget(target, adapter, normalizedOptions, installationType);
-      const manifest = await readInstallManifest(state.installRoot, adapter.name, transportForTarget(target), state);
-      console.log(formatDepsWhy(lock, manifest, selector));
+      const state = await resolveCliTargetState(target, normalizedOptions);
+      if (!state.graphLock) {
+        throw new Error(`No graph lock for ${state.adapter.name} at ${target.targetRoot}: ${state.stableGraphLockPath}`);
+      }
+      console.log(formatDepsWhy(state.graphLock, state.manifest, selector));
     }
   })
 );
@@ -13013,19 +13883,23 @@ ownershipCommand.command("handoff").description("transfer one managed artifact b
     throw new Error(`Ownership handoff selector must be exactly type/name: ${selector}`);
   }
   const target = targets[0];
-  const adapterOptions = adapterOptionsForTarget(target, normalizedOptions);
-  const adapter = await resolveAdapterForTarget(target, adapterOptions);
-  const installationType = normalizedOptions.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
-  const state = installStateForTarget(target, adapter, adapterOptions, installationType);
+  const state = await resolveCliTargetState(target, normalizedOptions);
+  const { adapter, installationType } = state;
+  if (state.migration) {
+    throw new Error(
+      "Migrate the target state before ownership handoff by running a full agentwheel install for this target."
+    );
+  }
   const toWorkspaceRoot = normalizeCliPath(options.toWorkspaceRoot);
   if (options.toFleet) {
     const fleet = await showRegisteredFleet(options.toFleet);
-    if (resolve24(fleet.root) !== resolve24(toWorkspaceRoot)) {
+    if (resolve26(fleet.root) !== resolve26(toWorkspaceRoot)) {
       throw new Error(`Destination fleet '${options.toFleet}' is registered at ${fleet.root}, not ${toWorkspaceRoot}.`);
     }
   }
   const request = {
-    ...state,
+    installationType,
+    stateKey: state.stableStateKey,
     targetRoot: state.installRoot,
     adapter: adapter.name,
     artifactType,
@@ -13045,11 +13919,85 @@ ownershipCommand.command("handoff").description("transfer one managed artifact b
   console.log(`Manifest revision: ${result.manifestRevision}`);
   console.log(`Owner: ${result.fromOwner} -> ${result.toOwner}`);
 });
+ownershipCommand.command("recovery-plan").description("write a read-only per-path legacy ownership evidence report").requiredOption("--fleet <id>", "registered Fleet containing the current source graph").requiredOption("--report <path>", "new private JSON report path").option("--agent <name>", "one named Fleet target").option("--profile <name>", "Fleet profile resolving to one target").action(async (options) => {
+  const targets = await resolveCliTargets({ fleet: options.fleet, agent: options.agent, profile: options.profile });
+  if (targets.length !== 1) throw new Error(`Recovery planning requires one Fleet target, found ${targets.length}.`);
+  const target = targets[0];
+  if (target.fleetId !== options.fleet) throw new Error("Resolved target does not belong to the selected Fleet.");
+  const adapter = await resolveAdapterForTarget(target, {});
+  const transport = transportForTarget(target);
+  const requestedReport = normalizeCliPath(options.report);
+  const reportPath = join46(await realpath2(dirname23(requestedReport)), basename21(requestedReport));
+  const reportInsideTarget = relative10(resolve26(target.targetRoot), reportPath);
+  if (reportInsideTarget === "" || !reportInsideTarget.startsWith("..") && !isAbsolute4(reportInsideTarget)) {
+    throw new Error("Recovery report must be outside the runtime target root.");
+  }
+  const installationType = target.installationType ?? resolveInstallationTypeForAdapter(adapter, void 0);
+  const config = await readMergedWorkspaceConfig(target.workspaceRoot);
+  if (config.packages.length === 0) throw new Error("Fleet has no configured source packages.");
+  const stage = await mkdtemp4(join46(tmpdir5(), "agentwheel-recovery-"));
+  const priorTmpdir = process.env.TMPDIR;
+  try {
+    process.env.TMPDIR = stage;
+    const graphPlan = await createGraphSourcePlan({
+      roots: config.packages.map((pkg) => ({
+        rootId: pkg.name,
+        source: pkg.source,
+        mode: pkg.mode,
+        version: pkg.version,
+        ref: pkg.requestedRef,
+        select: pkg.selection ? void 0 : normalizeArtifactSelectors(pkg.select, pkg.skills),
+        selection: pkg.selection,
+        aliases: pkg.aliases,
+        overrides: pkg.overrides,
+        includeSuggestions: pkg.withSuggestions,
+        suggestionAliases: pkg.suggestions,
+        useLock: false
+      })),
+      targetRoot: target.targetRoot,
+      workspaceRoot: target.workspaceRoot,
+      fleetId: target.fleetId,
+      adapter,
+      transport,
+      targetKey: targetKeyForTarget(target, adapter.name),
+      targetFingerprintParts: targetFingerprintParts(target, adapter, adapterOptionsForTarget(target, {}), installationType),
+      installationType,
+      stateKey: target.stateKey,
+      readOnly: true,
+      yes: true,
+      freshGraphOnly: true,
+      deferForeignStateCheck: true,
+      cacheRoot: join46(stage, "source-cache"),
+      registryCachePath: join46(stage, "registry.json")
+    });
+    const installRoot = installRootForAdapterInstallationType(adapter, target.targetRoot, installationType, transport.kind === "ssh");
+    const report = await planLegacyRecovery({
+      graphPlan,
+      installRoot,
+      workspaceRoot: target.workspaceRoot,
+      fleetId: target.fleetId,
+      explicitStateKey: target.stateKey,
+      targetKey: targetKeyForTarget(target, adapter.name),
+      adapter: adapter.name,
+      installationType,
+      historicalLocks: await inventoryHistoricalLocks(target.workspaceRoot),
+      transport
+    });
+    await writeFile13(reportPath, `${JSON.stringify(report, null, 2)}
+`, { mode: 384, flag: "wx" });
+    console.log(`Recovery report: ${reportPath}`);
+    console.log(JSON.stringify(report.counts));
+  } finally {
+    if (priorTmpdir === void 0) delete process.env.TMPDIR;
+    else process.env.TMPDIR = priorTmpdir;
+    await rm10(stage, { recursive: true, force: true });
+  }
+});
 ownershipCommand.command("retire-stale").description("retire stale source-manifest ownership already covered by one Fleet manifest").requiredOption("--from-workspace-root <path>", "exact stale workspace owner root").requiredOption("--to-workspace-root <path>", "registered destination Fleet root").requiredOption("--source-state-key <key>", "exact source install-manifest state key").requiredOption("--fleet <id>", "registered destination Fleet").option("--adapter <adapter>", "built-in adapter").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named destination Fleet agent").option("--profile <name>", "destination Fleet profile resolving to one target").option("--plan-digest <sha256>", "reviewed plan digest; required with --apply").option("--expected-source-revision <sha256>", "reviewed source manifest revision; required with --apply").option("--expected-destination-revision <sha256>", "reviewed destination manifest revision; required with --apply").option("--expected-inventory-revision <sha256>", "reviewed runtime manifest inventory revision; required with --apply").option("--abandon-incomplete-merge-owner", "explicitly retire incomplete legacy merge metadata without changing runtime bytes", false).option("--apply", "apply the exact reviewed metadata-only retirement", false).option("--json", "print the complete deterministic plan as JSON", false).action(async (options) => {
   const normalizedOptions = normalizeRuntimeScopeOptions(options);
   const fleet = await showRegisteredFleet(options.fleet);
   const toWorkspaceRoot = normalizeCliPath(options.toWorkspaceRoot);
-  if (resolve24(fleet.root) !== resolve24(toWorkspaceRoot)) {
+  if (resolve26(fleet.root) !== resolve26(toWorkspaceRoot)) {
     throw new Error(`Destination Fleet '${options.fleet}' is registered at ${fleet.root}, not ${toWorkspaceRoot}.`);
   }
   const targets = await resolveCliTargets(normalizedOptions);
@@ -13057,19 +14005,22 @@ ownershipCommand.command("retire-stale").description("retire stale source-manife
     throw new Error(`Stale ownership retirement requires exactly one destination Fleet target, found ${targets.length}.`);
   }
   const target = targets[0];
-  if (target.fleetId !== options.fleet || resolve24(target.workspaceRoot) !== resolve24(fleet.root)) {
+  if (target.fleetId !== options.fleet || resolve26(target.workspaceRoot) !== resolve26(fleet.root)) {
     throw new Error(`Resolved target does not belong to destination Fleet '${options.fleet}'.`);
   }
-  const adapterOptions = adapterOptionsForTarget(target, normalizedOptions);
-  const adapter = await resolveAdapterForTarget(target, adapterOptions);
-  const installationType = normalizedOptions.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
-  const state = installStateForTarget(target, adapter, adapterOptions, installationType);
+  const state = await resolveCliTargetState(target, normalizedOptions);
+  const { adapter, installationType } = state;
+  if (state.migration) {
+    throw new Error(
+      "Migrate the target state before ownership retirement by running a full agentwheel install for this target."
+    );
+  }
   const request = {
     targetRoot: state.installRoot,
     adapter: adapter.name,
     installationType,
     sourceStateKey: options.sourceStateKey,
-    destinationStateKey: state.stateKey,
+    destinationStateKey: state.stableStateKey,
     fromWorkspaceRoot: normalizeCliPath(options.fromWorkspaceRoot),
     toWorkspaceRoot,
     toFleetId: fleet.id,
@@ -13154,13 +14105,18 @@ program.command("uninstall").description("remove configured packages or managed
     const adapter = await resolveAdapterForTarget(target, adapterOptions);
     const transport = transportForTarget(target);
     const installationType = normalizedOptions.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
-    const state = installStateForTarget(target, adapter, adapterOptions, installationType);
-    const manifest = await readInstallManifest(state.installRoot, adapter.name, transport, state);
+    const state = await resolveCliTargetState(target, normalizedOptions);
+    const manifest = state.manifest;
     if (!manifest) {
       console.log(`No install manifest for ${adapter.name}/${installationType} at ${state.installRoot}`);
       continue;
     }
-    const plan = filterUninstallPlanBySelection(await createUninstallPlan(manifest), selectedArtifactsFromOptions(options));
+    const plan = {
+      ...filterUninstallPlanBySelection(await createUninstallPlan(manifest), selectedArtifactsFromOptions(options)),
+      stateKey: state.stableStateKey,
+      stateMigration: state.migration,
+      targetStateFilePreconditions: state.targetStateFilePreconditions
+    };
     console.log(formatPlan(plan));
     const result = await uninstall(plan, { dryRun: normalizedOptions.dryRun, force: normalizedOptions.force, transport });
     if (!normalizedOptions.dryRun) {
@@ -13207,7 +14163,7 @@ journalCommand.command("list").description("show pending apply journals for reso
     if (!journal) continue;
     pending += 1;
     console.log(`PENDING ${state.adapter.name}/${state.installationType} at ${state.installRoot}`);
-    console.log(`  journal: ${join45(state.installRoot, ".agentwheel", `${state.state.stateKey}.apply-journal.json`)}`);
+    console.log(`  journal: ${join46(state.installRoot, ".agentwheel", `${state.state.stateKey}.apply-journal.json`)}`);
     console.log(`  stateKey: ${state.state.stateKey}`);
     console.log(`  createdAt: ${journal.createdAt}`);
     console.log(`  updatedAt: ${journal.updatedAt}`);
@@ -13543,14 +14499,14 @@ async function packageEntryFromSource(source, targetRoot, options) {
     );
   }
   const bundle = options.deferGraphRendering ? await stageSourceRaw(driver, resolvedSource, {
-    cacheRoot: join45(targetRoot, ".agentwheel", "cache"),
+    cacheRoot: join46(targetRoot, ".agentwheel", "cache"),
     mode: options.mode,
     ref: initialVersion?.ref,
     frozenLock: lockMode
   }) : await stageSource(driver, resolvedSource, {
     workspaceRoot: targetRoot,
     adapter,
-    cacheRoot: join45(targetRoot, ".agentwheel", "cache"),
+    cacheRoot: join46(targetRoot, ".agentwheel", "cache"),
     mode: options.mode,
     ref: initialVersion?.ref,
     frozenLock: lockMode,
@@ -13622,15 +14578,12 @@ async function packageSelectsSkillForTarget(target, pkg, selector, options) {
   if (explicitSelection && !explicitSelection.some((candidate) => candidate === selector)) return false;
   const groups = /* @__PURE__ */ new Map();
   const group = graphGroupForPackage(groups, target, pkg, options);
-  const adapter = await resolveAdapterForTarget(group.target, group.adapterOptions);
-  const graphLockPath = graphLockPathForTarget(
-    group.target.workspaceRoot,
-    targetKeyForTarget(group.target, adapter.name),
-    adapter.name,
-    targetFingerprintParts(group.target, adapter, group.adapterOptions, group.installationType)
-  );
-  if (await pathExists(graphLockPath)) {
-    const lock = await readGraphLock(graphLockPath);
+  const state = await resolveCliTargetState(group.target, {
+    ...options,
+    installationType: group.installationType
+  });
+  if (state.graphLock) {
+    const lock = state.graphLock;
     const root = lock.canonical.roots.find((candidate) => candidate.rootId === pkg.name);
     if (root?.selected.includes(selector)) return true;
   }
@@ -13933,13 +14886,30 @@ async function buildGraphPlansForTarget(target, source, options, behavior) {
     const allPackages = [...group.packages, ...group.extraPackages];
     const groupHasScope = !scopedRootId || allPackages.some((pkg) => pkg.name === scopedRootId || pkg.source === targetOptions.scope);
     if (behavior.mode === "install" && scopedRootId && !groupHasScope) continue;
-    const groupGraphLockPath = graphLockPathForTarget(
-      group.target.workspaceRoot,
-      targetKeyForTarget(group.target, adapter.name),
-      adapter.name,
-      targetFingerprintParts(group.target, adapter, group.adapterOptions, group.installationType)
-    );
-    const previousGroupLock = await (await pathExists(groupGraphLockPath) ? readGraphLock(groupGraphLockPath) : void 0);
+    if (behavior.readOnly !== true && targetOptions.dryRun !== true) {
+      const pendingState = await journalStateForTarget(group.target, {
+        ...targetOptions,
+        installationType: group.installationType
+      });
+      if (await readApplyJournal(
+        pendingState.installRoot,
+        pendingState.adapter.name,
+        pendingState.transport,
+        pendingState.state
+      )) {
+        await recoverPendingApply(
+          pendingState.installRoot,
+          pendingState.adapter.name,
+          pendingState.transport,
+          pendingState.state
+        );
+      }
+    }
+    const priorGroupState = await resolveCliTargetState(group.target, {
+      ...targetOptions,
+      installationType: group.installationType
+    });
+    const previousGroupLock = priorGroupState.graphLock;
     const dependencyUpdateRootNames = /* @__PURE__ */ new Set();
     if (scopedDependencyUpdate) {
       for (const pkg of group.packages) {
@@ -14049,14 +15019,14 @@ async function buildGraphPlansForTarget(target, source, options, behavior) {
       expectedFromWorkspaceOwner: targetOptions.expectedFromWorkspaceOwner
     });
     if ((behavior.mode === "install" || behavior.mode === "update") && scopedRootId) {
-      const state = installStateForTarget(group.target, adapter, group.adapterOptions, group.installationType);
-      const manifest = await readInstallManifest(state.installRoot, adapter.name, transport, state);
-      const scopedResult = targetOptions.focusedArtifact ? previousGroupLock ? scopeUpdatePlanToArtifact(result, scopedRootId, targetOptions.focusedArtifact, previousGroupLock, manifest) : scopeInstallPlanToArtifact(result, scopedRootId, targetOptions.focusedArtifact, manifest) : previousGroupLock ? scopeUpdatePlanToRoot(result, scopedRootId, previousGroupLock, manifest) : scopeInstallPlanToRoot(result, scopedRootId, manifest);
+      const manifest = result.previousManifest;
+      const previousLock = result.previousGraphLock;
+      const scopedResult = targetOptions.focusedArtifact ? previousLock ? scopeUpdatePlanToArtifact(result, scopedRootId, targetOptions.focusedArtifact, previousLock, manifest) : scopeInstallPlanToArtifact(result, scopedRootId, targetOptions.focusedArtifact, manifest) : previousLock ? scopeUpdatePlanToRoot(result, scopedRootId, previousLock, manifest) : scopeInstallPlanToRoot(result, scopedRootId, manifest);
       if (targetOptions.focusedArtifact && targetOptions.forceForeignState !== true) {
         const focusedPaths = scopedResult.plan.operations.filter((operation) => operationMatchesFocusedArtifact(
           operation,
           targetOptions.focusedArtifact,
-          focusedArtifactOwnerKeys(result.bundle.graphLock, previousGroupLock, scopedRootId, targetOptions.focusedArtifact)
+          focusedArtifactOwnerKeys(result.bundle.graphLock, previousLock, scopedRootId, targetOptions.focusedArtifact)
         )).map((operation) => operation.relativeDestPath);
         const ownership = await resolveWorkspaceOwnershipScope(group.target.workspaceRoot, {
           fleetId: group.target.fleetId
@@ -14070,9 +15040,11 @@ async function buildGraphPlansForTarget(target, source, options, behavior) {
       }
       results.push(scopedResult);
     } else if (scopedDependencyUpdate) {
-      const state = installStateForTarget(group.target, adapter, group.adapterOptions, group.installationType);
-      const manifest = await readInstallManifest(state.installRoot, adapter.name, transport, state);
-      const previousLock = await readGraphLock(result.graphLockPath);
+      const manifest = result.previousManifest;
+      const previousLock = result.previousGraphLock;
+      if (!previousLock) {
+        throw new Error(`Dependency update requires an existing graph lock for ${adapter.name} at ${group.target.targetRoot}.`);
+      }
       results.push(scopeUpdatePlanToDependencies(result, dependencyUpdateSelectors, previousLock, manifest));
     } else {
       results.push(result);
@@ -14115,7 +15087,7 @@ function scopeUpdatePlanToDependencies(result, selectors, previousLock, manifest
     selectedPreviousNodeIds,
     selectedRootIds
   );
-  const graphLockDigest = createHash14("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash15("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...result,
     bundle: { ...result.bundle, graphLock },
@@ -14241,7 +15213,7 @@ function operationBelongsToDependencyUpdate(operation, allowedNodeIds, allowedNa
 function scopeInstallPlanToArtifact(result, rootId, focused, manifest) {
   const scoped = scopePlanOperationsToArtifact(result, rootId, focused, manifest);
   const graphLock = focusedGraphLockForInstall(scoped.bundle.graphLock, rootId, focused);
-  const graphLockDigest = createHash14("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash15("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...scoped,
     bundle: { ...scoped.bundle, graphLock },
@@ -14252,7 +15224,7 @@ function scopeInstallPlanToArtifact(result, rootId, focused, manifest) {
 function scopeUpdatePlanToArtifact(result, rootId, focused, previousLock, manifest) {
   const scoped = scopePlanOperationsToArtifact(result, rootId, focused, manifest, previousLock);
   const graphLock = mergeFocusedArtifactGraphLock(scoped.bundle.graphLock, previousLock, rootId, focused);
-  const graphLockDigest = createHash14("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash15("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...scoped,
     bundle: { ...scoped.bundle, graphLock },
@@ -14547,7 +15519,7 @@ function scopeUpdatePlanToRoot(result, rootId, previousLock, manifest) {
     selectedPreviousNodeIds,
     /* @__PURE__ */ new Set([rootId])
   );
-  const graphLockDigest = createHash14("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash15("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...scoped,
     bundle: { ...scoped.bundle, graphLock },
@@ -14619,7 +15591,7 @@ function keepManifestEntryOperation(entry, targetRoot, scopeDescription, operati
     artifactType: entry.artifactType,
     artifactName: entry.artifactName,
     kind: entry.kind,
-    destPath: operation?.destPath ?? join45(targetRoot, entry.path),
+    destPath: operation?.destPath ?? join46(targetRoot, entry.path),
     relativeDestPath: entry.path,
     desiredHash: entry.sourceHash,
     currentHash: operation?.currentHash ?? entry.hash,
@@ -14665,8 +15637,12 @@ async function uninstallConfiguredPackage(target, packageName, options) {
     const removedInstallationType = options.installationType ?? pkg.installationType ?? removedTarget.installationType ?? "local";
     const adapter = await resolveAdapterForTarget(removedTarget, removedAdapterOptions);
     const transport = transportForTarget(removedTarget);
-    const removedState = installStateForTarget(removedTarget, adapter, removedAdapterOptions, removedInstallationType);
-    const manifest = await readInstallManifest(removedState.installRoot, adapter.name, transport, removedState);
+    const removedState = await resolveCliTargetState(removedTarget, {
+      ...options,
+      ...removedAdapterOptions,
+      installationType: removedInstallationType
+    });
+    const manifest = removedState.manifest;
     if (!manifest) {
       console.log(`No install manifest for ${adapter.name} at ${removedTarget.targetRoot}`);
       continue;
@@ -14714,25 +15690,24 @@ async function uninstallConfiguredPackage(target, packageName, options) {
       remainingDesired = desiredArtifactsFromGraphBundle(result2.bundle);
       renderedRoot = result2.bundle.root;
     }
-    const plan = await createOwnershipUninstallPlan(manifest, remainingDesired, adapter, transport, { graphLockDigest: remainingGraphPlan?.graphLockDigest });
+    const uninstallPlan = await createOwnershipUninstallPlan(manifest, remainingDesired, adapter, transport, {
+      graphLockDigest: remainingGraphPlan?.graphLockDigest
+    });
+    const transitionPlan = remainingGraphPlan?.plan;
+    const plan = {
+      ...uninstallPlan,
+      stateKey: transitionPlan?.stateKey ?? removedState.stableStateKey,
+      stateMigration: transitionPlan?.stateMigration ?? removedState.migration,
+      targetStateFilePreconditions: transitionPlan?.targetStateFilePreconditions ?? removedState.targetStateFilePreconditions
+    };
     console.log(`Uninstall ${pkg.name} (${adapter.name} at ${removedTarget.targetRoot}):`);
     console.log(formatPlan(plan));
     const graphLockFinalState = remainingGraphPlan ? { graphLock: { path: remainingGraphPlan.graphLockPath, lock: remainingGraphPlan.bundle.graphLock } } : {
-      removeGraphLockPath: graphLockPathForTarget(
-        removedTarget.workspaceRoot,
-        targetKeyForTarget(removedTarget, adapter.name),
-        adapter.name,
-        targetFingerprintParts(removedTarget, adapter, removedAdapterOptions, removedInstallationType)
-      )
+      removeGraphLockPath: removedState.graphLockPath ?? removedState.stableGraphLockPath
     };
     if (!options.dryRun) {
       declareMutationPath(workspaceConfigPath(target.workspaceRoot));
-      const declarativeGraphPath = remainingGraphPlan ? remainingGraphPlan.graphLockPath : graphLockPathForTarget(
-        removedTarget.workspaceRoot,
-        targetKeyForTarget(removedTarget, adapter.name),
-        adapter.name,
-        targetFingerprintParts(removedTarget, adapter, removedAdapterOptions, removedInstallationType)
-      );
+      const declarativeGraphPath = remainingGraphPlan ? remainingGraphPlan.graphLockPath : removedState.graphLockPath ?? removedState.stableGraphLockPath;
       declareMutationPath(declarativeGraphPath);
     }
     const result = await uninstall(plan, {
@@ -14807,36 +15782,92 @@ function targetFingerprintParts(target, adapter, options, installationType) {
   };
 }
 function installStateForTarget(target, adapter, options, installationType) {
-  const targetFingerprint = targetFingerprintDigest(target, adapter, options, installationType);
+  const installRoot = installRootForAdapterInstallationType(adapter, target.targetRoot, installationType, target.transport === "ssh");
+  const targetIdentity = resolveTargetStateIdentity({
+    targetFingerprintParts: targetFingerprintParts(target, adapter, options, installationType),
+    workspaceRoot: target.workspaceRoot,
+    targetKey: targetKeyForTarget(target, adapter.name),
+    resolvedInstallRoot: installRoot,
+    transportKind: target.transport
+  });
   return {
     installationType,
     stateKey: stateKeyFor(adapter.name, {
       installationType,
       stateKey: target.stateKey,
-      targetFingerprint,
+      targetFingerprint: targetIdentity.stateFingerprint,
       fleetId: target.fleetId
     }),
-    installRoot: installRootForAdapterInstallationType(adapter, target.targetRoot, installationType, target.transport === "ssh")
+    installRoot
   };
 }
-function targetFingerprintDigest(target, adapter, options, installationType) {
-  const fingerprintInput = targetFingerprintParts(target, adapter, options, installationType);
-  return computeTargetFingerprint(fingerprintInput);
+function targetIdentityContext(target, adapter, installationType) {
+  return {
+    resolvedInstallRoot: installRootForAdapterInstallationType(
+      adapter,
+      target.targetRoot,
+      installationType,
+      target.transport === "ssh"
+    ),
+    transportKind: target.transport
+  };
 }
-async function readTargetGraphLock(target, options) {
+async function resolveCliTargetState(target, options) {
   const adapterOptions = adapterOptionsForTarget(target, options);
   const adapter = await resolveAdapterForTarget(target, adapterOptions);
+  const transport = transportForTarget(target);
   const installationType = options.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter, void 0);
-  const path = graphLockPathForTarget(
+  const stable = installStateForTarget(target, adapter, adapterOptions, installationType);
+  const stableGraphLockPath = graphLockPathForTarget(
     target.workspaceRoot,
     targetKeyForTarget(target, adapter.name),
     adapter.name,
-    targetFingerprintParts(target, adapter, adapterOptions, installationType)
+    targetFingerprintParts(target, adapter, adapterOptions, installationType),
+    targetIdentityContext(target, adapter, installationType)
   );
-  if (!await pathExists(path)) {
-    throw new Error(`No graph lock for ${adapter.name} at ${target.targetRoot}: ${path}`);
+  const [stableManifest, stableLock, stableSourceLock, ownership] = await Promise.all([
+    readInstallManifest(stable.installRoot, adapter.name, transport, stable),
+    pathExists(stableGraphLockPath).then((exists) => exists ? readGraphLock(stableGraphLockPath) : void 0),
+    readSourceLock(stable.installRoot, adapter.name, transport, stable),
+    resolveWorkspaceOwnershipScope(target.workspaceRoot, { fleetId: target.fleetId })
+  ]);
+  const prior = await resolvePriorTargetState({
+    adapter: adapter.name,
+    installationType,
+    stateKey: stable.stateKey,
+    explicitStateKey: target.stateKey,
+    fleetId: target.fleetId,
+    installRoot: stable.installRoot,
+    workspaceOwner: workspaceOwnerForRoot(ownership.root, ownership.fleetId),
+    graphLockPath: stableGraphLockPath,
+    stableManifest,
+    stableLock,
+    transport
+  });
+  return {
+    adapter,
+    installationType,
+    installRoot: stable.installRoot,
+    stateKey: prior.migration?.fromStateKey ?? stable.stateKey,
+    stableStateKey: stable.stateKey,
+    stableGraphLockPath,
+    manifest: prior.manifest,
+    graphLock: prior.graphLock,
+    graphLockPath: prior.graphLock ? prior.migration?.fromGraphLockPath ?? stableGraphLockPath : null,
+    migration: prior.migration,
+    targetStateFilePreconditions: {
+      graphLockPath: stableGraphLockPath,
+      graphLockRevision: stableLock ? createHash15("sha256").update(canonicalGraphLockJson(stableLock)).digest("hex") : null,
+      sourceLockRevision: computeSourceLockRevision(stableSourceLock)
+    }
+  };
+}
+async function readTargetGraphLock(target, options) {
+  const state = await resolveCliTargetState(target, options);
+  if (!state.graphLock || !state.graphLockPath) {
+    throw new Error(`No graph lock for ${state.adapter.name} at ${target.targetRoot}: ${state.stableGraphLockPath}`);
   }
-  return { adapter, path, lock: await readGraphLock(path) };
+  return { adapter: state.adapter, path: state.graphLockPath, lock: state.graphLock };
 }
 async function printStatus(target, options) {
   const report = await collectTargetStatus(target, options);
@@ -14844,30 +15875,24 @@ async function printStatus(target, options) {
 }
 async function collectTargetStatus(target, options) {
   const config = await readMergedWorkspaceConfig(target.workspaceRoot);
-  const adapterOptions = adapterOptionsForTarget(target, options);
-  const adapter = await resolveAdapterForTarget(target, { ...adapterOptions, warn: () => void 0 });
-  const transport = transportForTarget(target);
-  const installationType = options.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
-  const state = installStateForTarget(target, adapter, adapterOptions, installationType);
-  const manifest = await readInstallManifest(state.installRoot, adapter.name, transport, state);
-  let graphLockPath = null;
-  let graphLock;
-  try {
-    const result = await readTargetGraphLock(target, adapterOptions);
-    graphLockPath = result.path;
-    graphLock = result.lock;
-  } catch {
-    graphLock = void 0;
-  }
+  const state = await resolveCliTargetState(target, { ...options, warn: () => void 0 });
+  const { adapter, installationType, manifest, graphLock, graphLockPath } = state;
+  const pending = await collectPendingInstallWork(target, options);
+  const foreignObservations = pending.foreignStateObservations;
+  const effectiveGraphLock = graphLock ?? pending.observedGraphLock;
+  const observedManifestRevision = foreignObservations.length > 0 ? createHash15("sha256").update(JSON.stringify(foreignObservations.map((observation) => [
+    observation.fileName,
+    observation.manifestRevision
+  ]).sort())).digest("hex") : null;
   const packages = [];
   for (const pkg of config.packages) {
-    const root = graphLock?.canonical.roots.find((candidate) => candidate.rootId === pkg.name);
-    const node = root ? graphLock?.canonical.nodes.find((candidate) => candidate.id === root.graphNodeId) : void 0;
+    const root = effectiveGraphLock?.canonical.roots.find((candidate) => candidate.rootId === pkg.name);
+    const node = root ? effectiveGraphLock?.canonical.nodes.find((candidate) => candidate.id === root.graphNodeId) : void 0;
     const availability = await discoverPackageVersions(pkg, target.workspaceRoot, {
       forceRefresh: options.refresh,
       offline: options.offline
     });
-    const installed = node && manifest?.entries.some((entry) => "graphNodeId" in entry && entry.graphNodeId === node.id) ? node.version : null;
+    const installed = node && (manifest?.entries.some((entry) => "graphNodeId" in entry && entry.graphNodeId === node.id) || foreignObservations.some((observation) => observation.graphNodeId === node.id)) ? node.version : null;
     const locked = node?.version ?? null;
     const baseline = installed ?? locked;
     packages.push({
@@ -14890,14 +15915,13 @@ async function collectTargetStatus(target, options) {
       )
     });
   }
-  const pending = await collectPendingInstallWork(target, options);
-  const artifacts = (graphLock?.canonical.artifacts ?? []).map((artifact) => {
-    const node = graphLock?.canonical.nodes.find((candidate) => candidate.id === artifact.graphNodeId);
-    const installed = manifest?.entries.some((entry) => {
+  const artifacts = (effectiveGraphLock?.canonical.artifacts ?? []).map((artifact) => {
+    const node = effectiveGraphLock?.canonical.nodes.find((candidate) => candidate.id === artifact.graphNodeId);
+    const installed = (manifest?.entries.some((entry) => {
       if (!("graphNodeId" in entry) || entry.graphNodeId !== artifact.graphNodeId) return false;
       if ("logicalSelector" in entry && entry.logicalSelector) return entry.logicalSelector === artifact.logicalSelector;
       return entry.artifactType === artifact.type && entry.artifactName === artifact.name;
-    }) ?? false;
+    }) ?? false) || foreignObservations.some((observation) => observation.graphNodeId === artifact.graphNodeId && (!observation.logicalSelector || observation.logicalSelector === artifact.logicalSelector));
     return {
       selector: artifact.logicalSelector,
       type: artifact.type,
@@ -14910,7 +15934,7 @@ async function collectTargetStatus(target, options) {
     };
   });
   const health = [];
-  if (!manifest || !graphLock) health.push("FAIL");
+  if (!manifest && foreignObservations.length === 0 || !effectiveGraphLock) health.push("FAIL");
   if (pending.error) health.push("DEGRADED");
   if (pending.driftCount > 0 || pending.conflictCount > 0) health.push("FAIL");
   else if (pending.pendingCount > 0) health.push("WARN");
@@ -14921,11 +15945,11 @@ async function collectTargetStatus(target, options) {
     installationType,
     targetRoot: state.installRoot,
     health: worstStatusHealth(health),
-    manifestRevision: manifest?.revision ?? null,
-    manifestEntryCount: manifest?.entries.length ?? 0,
+    manifestRevision: manifest?.revision ?? observedManifestRevision,
+    manifestEntryCount: (manifest?.entries.length ?? 0) + foreignObservations.length,
     graphLockPath,
     packageCount: packages.length,
-    artifactCount: graphLock?.canonical.artifacts.length ?? 0,
+    artifactCount: effectiveGraphLock?.canonical.artifacts.length ?? 0,
     pendingCount: pending.pendingCount,
     driftCount: pending.driftCount,
     conflictCount: pending.conflictCount,
@@ -15103,7 +16127,7 @@ async function assertCompositeMutationSupported(workspaceRoot, profile, readOnly
         `Composite-profile mutation is refused before member execution because ${member.id} uses ${member.transport}; durable remote policy and recovery preflight is not implemented.`
       );
     }
-    const memberRoot = resolve24(workspaceRoot, member.workspace);
+    const memberRoot = resolve26(workspaceRoot, member.workspace);
     const memberPolicy = await mutationPolicyForWorkspace(memberRoot);
     if (memberPolicy?.revisioning.mode === "commit-after-verify") {
       throw new Error(
@@ -15260,9 +16284,34 @@ async function journalStateForTarget(target, options) {
   const adapterOptions = adapterOptionsForTarget(target, options);
   const adapter = await resolveAdapterForTarget(target, adapterOptions);
   const transport = transportForTarget(target);
-  const installationType = options.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
-  const state = installStateForTarget(target, adapter, adapterOptions, installationType);
-  return { adapter, transport, installationType, installRoot: state.installRoot, state };
+  const installationType = options.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter, void 0);
+  const stable = installStateForTarget(target, adapter, adapterOptions, installationType);
+  const graphLockPath = graphLockPathForTarget(
+    target.workspaceRoot,
+    targetKeyForTarget(target, adapter.name),
+    adapter.name,
+    targetFingerprintParts(target, adapter, adapterOptions, installationType),
+    targetIdentityContext(target, adapter, installationType)
+  );
+  const ownership = await resolveWorkspaceOwnershipScope(target.workspaceRoot, { fleetId: target.fleetId });
+  const pending = await discoverTargetApplyJournal({
+    adapter: adapter.name,
+    installationType,
+    stateKey: stable.stateKey,
+    explicitStateKey: target.stateKey,
+    fleetId: target.fleetId,
+    installRoot: stable.installRoot,
+    workspaceOwner: workspaceOwnerForRoot(ownership.root, ownership.fleetId),
+    graphLockPath,
+    transport
+  });
+  return {
+    adapter,
+    transport,
+    installationType,
+    installRoot: stable.installRoot,
+    state: { installationType, stateKey: pending?.stateKey ?? stable.stateKey }
+  };
 }
 async function collectPendingInstallWork(target, options) {
   let results = [];
@@ -15283,11 +16332,20 @@ async function collectPendingInstallWork(target, options) {
       pendingCount: pending.length,
       driftCount: counts.drift ?? 0,
       conflictCount: counts.conflict ?? 0,
-      counts
+      counts,
+      foreignStateObservations: results.flatMap((result) => result.foreignStateObservations),
+      observedGraphLock: results.length === 1 ? results[0].bundle.graphLock : void 0
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    return { pendingCount: 0, driftCount: 0, conflictCount: 0, counts: {}, error: message };
+    return {
+      pendingCount: 0,
+      driftCount: 0,
+      conflictCount: 0,
+      counts: {},
+      foreignStateObservations: [],
+      error: message
+    };
   } finally {
     await Promise.all(results.map((result) => rm10(result.bundle.root, { recursive: true, force: true })));
   }
@@ -15300,18 +16358,17 @@ async function printDoctor(target, options) {
   if (!targetMapping?.enabled) {
     throw new Error(`Adapter ${adapter.name} does not support skills for installation type '${installationType}'.`);
   }
-  const transport = transportForTarget(target);
-  const state = installStateForTarget(target, adapter, adapterOptions, installationType);
-  const manifest = await readInstallManifest(state.installRoot, adapter.name, transport, state);
+  const state = await resolveCliTargetState(target, { ...options, installationType });
+  const manifest = state.manifest;
   const requestedSkills = doctorSkillRequests(target, options);
   const skills = [];
   for (const request of requestedSkills) {
-    const skillPath = join45(state.installRoot, targetMapping.dest, request.name);
+    const skillPath = join46(state.installRoot, targetMapping.dest, request.name);
     const exists = await pathExists(skillPath);
     const manifestEntry = manifest?.entries.find((entry) => {
       if (entry.artifactType !== "skills") return false;
       const legacyInstallName = "installName" in entry && typeof entry.installName === "string" ? entry.installName : void 0;
-      return entry.artifactName === request.name || legacyInstallName === request.name || entry.path === join45(targetMapping.dest, request.name);
+      return entry.artifactName === request.name || legacyInstallName === request.name || entry.path === join46(targetMapping.dest, request.name);
     });
     const status = manifestEntry ? "managed" : exists ? "present-unmanaged" : "missing";
     skills.push({
@@ -15391,7 +16448,7 @@ function doctorSkillLabel(name) {
   return `${name} skill`;
 }
 function isSyncwheelWorkspace(targetRoot) {
-  return existsSync(join45(targetRoot, ".syncwheel", "manifest.json"));
+  return existsSync(join46(targetRoot, ".syncwheel", "manifest.json"));
 }
 function skillInstallCommand(adapter, installationType, options, skill, behavior = {}) {
   const args = [
@@ -15554,14 +16611,14 @@ function looksLikeSourceSpecifier(value) {
 }
 function normalizeCliPath(value) {
   if (value === "~") return homedir12();
-  if (value.startsWith("~/")) return resolve24(homedir12(), value.slice(2));
-  return resolve24(value);
+  if (value.startsWith("~/")) return resolve26(homedir12(), value.slice(2));
+  return resolve26(value);
 }
 function shellQuoteArgument(value) {
   return /^[a-z0-9_./:@%+=,-]+$/i.test(value) ? value : `'${value.replace(/'/g, `'"'"'`)}'`;
 }
 function isHomePath(path) {
-  return resolve24(path) === resolve24(homedir12());
+  return resolve26(path) === resolve26(homedir12());
 }
 function adapterListFromOption(adapter) {
   if (!adapter) return [];
@@ -15616,11 +16673,11 @@ function filterUninstallPlanBySelection(plan, selected) {
   };
 }
 async function initPackage(root) {
-  await mkdir16(join45(root, "instructions"), { recursive: true });
-  await mkdir16(join45(root, "rules"), { recursive: true });
-  await mkdir16(join45(root, "skills"), { recursive: true });
-  const manifestPath = join45(root, "openpack.json");
-  const instructionsPath = join45(root, "instructions", "AGENTS.md");
+  await mkdir16(join46(root, "instructions"), { recursive: true });
+  await mkdir16(join46(root, "rules"), { recursive: true });
+  await mkdir16(join46(root, "skills"), { recursive: true });
+  const manifestPath = join46(root, "openpack.json");
+  const instructionsPath = join46(root, "instructions", "AGENTS.md");
   const manifest = {
     schemaVersion: CURRENT_OPENPACK_SCHEMA_VERSION,
     name: "example/agentwheel-package",
@@ -15638,7 +16695,7 @@ async function initPackage(root) {
   await writeFile13(instructionsPath, "# Agent Instructions\n", "utf8");
 }
 async function defaultBootstrapPackage(_root) {
-  const packageRoot = await findAgentwheelPackageRoot(dirname22(fileURLToPath3(import.meta.url)));
+  const packageRoot = await findAgentwheelPackageRoot(dirname23(fileURLToPath3(import.meta.url)));
   if (!packageRoot) return void 0;
   return {
     name: "agentwheel",
@@ -15682,10 +16739,10 @@ function withFleetExample(config) {
   };
 }
 async function findAgentwheelPackageRoot(start) {
-  let current = resolve24(start);
+  let current = resolve26(start);
   while (true) {
     if (await findPackageManifestPath(current, { warnLegacy: false })) return current;
-    const parent = dirname22(current);
+    const parent = dirname23(current);
     if (parent === current) return void 0;
     current = parent;
   }
@@ -15810,14 +16867,14 @@ async function governedCommandContext(command, options) {
     const kind = String(command.args[0] ?? "workspace");
     return {
       workspaceRoot: workspaceRoot2,
-      anticipatedPaths: kind === "package" ? [join45(targetRoot, "openpack.json"), join45(targetRoot, "instructions", "AGENTS.md")] : [workspaceConfigPath(targetRoot)]
+      anticipatedPaths: kind === "package" ? [join46(targetRoot, "openpack.json"), join46(targetRoot, "instructions", "AGENTS.md")] : [workspaceConfigPath(targetRoot)]
     };
   }
   if (path === "package migrate") {
     const packageRoot = normalizeTargetRoot(String(command.args[0] ?? "."));
     return {
       workspaceRoot: await findExistingWorkspaceRoot(packageRoot) ?? packageRoot,
-      anticipatedPaths: ["agentwheel.json", "agentwheel.jsonc", "openpack.json", "openpack.jsonc"].map((name) => join45(packageRoot, name))
+      anticipatedPaths: ["agentwheel.json", "agentwheel.jsonc", "openpack.json", "openpack.jsonc"].map((name) => join46(packageRoot, name))
     };
   }
   const source = typeof command.args[0] === "string" ? command.args[0] : void 0;
@@ -15829,7 +16886,7 @@ async function governedCommandContext(command, options) {
   const anticipatedPaths = [];
   if (path === "add") anticipatedPaths.push(workspaceConfigPath(workspaceRoot));
   if (path === "remember" && options.runtime) {
-    anticipatedPaths.push(join45(workspaceRoot, ".agentwheel", "overlays", options.runtime, "instructions.local.md"));
+    anticipatedPaths.push(join46(workspaceRoot, ".agentwheel", "overlays", options.runtime, "instructions.local.md"));
   }
   if (path === "uninstall" && source) anticipatedPaths.push(workspaceConfigPath(workspaceRoot));
   return {