agentwheel 0.20.8 → 0.20.9

package/dist/index.js

@@ -12,10 +12,12 @@ import {
   commitManifestMetadataJournal,
   computeInstallManifestInventoryRevision,
   computeManifestRevision,
+  computeSourceLockRevision,
   computeTargetFingerprint,
   desiredManagedInstructionBlockHash,
   hasMergeRemovalContent,
   installManifestSchema,
+  installManifestV2Schema,
   legacyUnownedWorkspaceOwner,
   listInstallManifests,
   managedInstructionBlockMode,
@@ -29,11 +31,12 @@ import {
   readGraphLock,
   readInstallManifest,
   readManagedInstructionBlockState,
+  readSourceLock,
   recoverPendingApply,
   uninstall,
   withManifestRevision,
   writeInstallManifest
-} from "./chunk-4AM3LNUQ.js";
+} from "./chunk-E7Z2YB2C.js";
 import {
   CURRENT_WORKSPACE_SCHEMA_VERSION,
   GovernedMutation,
@@ -94,7 +97,7 @@ import {
   workspaceSelectionImportSchema,
   writeApplyJournal,
   writeWorkspaceConfig
-} from "./chunk-JXX6EDIP.js";
+} from "./chunk-SHPNLNBR.js";
 import {
   inferSourceDriverName
 } from "./chunk-EMDIG24I.js";
@@ -113,7 +116,7 @@ import { createHash as createHash14 } from "crypto";
 import { existsSync } from "fs";
 import { mkdir as mkdir16, rm as rm10, writeFile as writeFile13 } from "fs/promises";
 import { homedir as homedir12 } from "os";
-import { dirname as dirname22, join as join45, resolve as resolve24 } from "path";
+import { dirname as dirname22, join as join45, resolve as resolve25 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { Command } from "commander";
 
@@ -917,11 +920,11 @@ function normalizeArtifactSelectors(select, legacySkills) {
   if (selected.length === 0) return void 0;
   return [...new Set(selected.map(parseArtifactSelector))];
 }
-function filterArtifactsBySelection(artifacts, selectors, legacySkills) {
+function filterArtifactsBySelection(artifacts, selectors, legacySkills, options = {}) {
   const selected = normalizeArtifactSelectors(selectors, legacySkills);
   if (!selected?.length) return artifacts;
   const selectedSet = new Set(selected);
-  const available = new Set(artifacts.flatMap(artifactSelectorAliases));
+  const available = new Set((options.validationArtifacts ?? artifacts).flatMap(artifactSelectorAliases));
   const missing = selected.filter((selector) => !available.has(selector));
   if (missing.length > 0) {
     throw new Error(`Selected artifact not found in package: ${missing.join(", ")}`);
@@ -1706,6 +1709,7 @@ async function createPlanFromOperations(desiredOps, adapter, targetRoot, manifes
     hasBlockingChanges: operations.some((op) => op.action === "drift" || op.action === "conflict"),
     baseRevision: options.baseRevision ?? manifest?.revision ?? null,
     runtimeStateRevision,
+    stateMigration: options.stateMigration,
     migrationReport: migration.report,
     graphLockDigest: options.graphLockDigest,
     adapterCode: adapter.programmatic ? { modulePath: adapter.programmatic.modulePath, hash: adapter.programmatic.hash } : void 0,
@@ -2388,6 +2392,7 @@ function operationMetadataFromEntry2(entry, ownersOverride) {
       graphNodeId: entry.graphNodeId,
       dependencyRole: entry.dependencyRole,
       owners: ownersOverride ?? entry.owners,
+      workspaceOwner: entry.workspaceOwner,
       graphLockDigest: entry.graphLockDigest,
       mergeRemoval: entry.mergeRemoval,
       mergeCreatedDestination: entry.mergeCreatedDestination
@@ -3107,14 +3112,14 @@ async function writeMermaidAsset(response) {
     "content-type": "application/javascript; charset=utf-8",
     "cache-control": "public, max-age=3600"
   });
-  await new Promise((resolve25) => {
+  await new Promise((resolve26) => {
     const stream = createReadStream(assetPath);
     stream.on("error", () => {
       if (!response.headersSent) writeText(response, 404, "Mermaid asset unavailable.\n");
       else response.destroy();
-      resolve25();
+      resolve26();
     });
-    stream.on("end", resolve25);
+    stream.on("end", resolve26);
     stream.pipe(response);
   });
 }
@@ -3141,14 +3146,14 @@ function escapeHtml2(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
 function listen(server, port, bind) {
-  return new Promise((resolve25, reject) => {
+  return new Promise((resolve26, reject) => {
     const onError = (error) => {
       server.off("listening", onListening);
       reject(error);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve25();
+      resolve26();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -3156,7 +3161,7 @@ function listen(server, port, bind) {
   });
 }
 function waitForShutdown(server, beforeClose) {
-  return new Promise((resolve25) => {
+  return new Promise((resolve26) => {
     let closing = false;
     const shutdown = () => {
       if (closing) return;
@@ -3164,7 +3169,7 @@ function waitForShutdown(server, beforeClose) {
       process.off("SIGINT", shutdown);
       process.off("SIGTERM", shutdown);
       beforeClose();
-      server.close(() => resolve25());
+      server.close(() => resolve26());
     };
     process.once("SIGINT", shutdown);
     process.once("SIGTERM", shutdown);
@@ -3174,7 +3179,7 @@ function waitForShutdown(server, beforeClose) {
       process.off("SIGINT", shutdown);
       process.off("SIGTERM", shutdown);
       beforeClose();
-      resolve25();
+      resolve26();
     });
   });
 }
@@ -3727,7 +3732,7 @@ async function fetchClawHubPackage(fetchImpl, packageName) {
   throw new Error(`ClawHub lookup failed for ${packageName}`);
 }
 async function delay(ms) {
-  await new Promise((resolve25) => setTimeout(resolve25, ms));
+  await new Promise((resolve26) => setTimeout(resolve26, ms));
 }
 function parseClawHubSource(source) {
   if (!source.startsWith(sourcePrefix)) {
@@ -3904,7 +3909,7 @@ async function withGitCacheMaintenanceLock(cacheRoot, timeoutMs, fn) {
       if (Date.now() - started > timeoutMs) {
         throw new Error(`Timed out waiting for git cache maintenance lock at ${lockPath}`);
       }
-      await new Promise((resolve25) => setTimeout(resolve25, 50));
+      await new Promise((resolve26) => setTimeout(resolve26, 50));
     }
   }
   try {
@@ -6570,7 +6575,7 @@ async function collectIncludeSelector(raw, optional, artifactsByRelativePath, sc
 }
 function artifactTargetsRuntime(runtimes, runtime, nodeId, selector, warn) {
   if (!runtimes?.length || !runtime || runtimes.includes(runtime)) return true;
-  warn?.(`skip artifact ${nodeId}:${selector} (not targeted: runtimes=[${runtimes.join(",")}])`);
+  warn?.(`skip artifact ${nodeId}:${selector} (selected but not targeted: runtimes=[${runtimes.join(",")}])`);
   return false;
 }
 function requirementTargetsRuntime(runtimes, runtime, label, warn) {
@@ -6770,8 +6775,8 @@ function verifyIntegrity(integrity, sourceHash, label) {
 async function withCachePathLock(path, fn) {
   const previous = cacheLocks.get(path) ?? Promise.resolve();
   let release = () => void 0;
-  const current = previous.then(() => new Promise((resolve25) => {
-    release = resolve25;
+  const current = previous.then(() => new Promise((resolve26) => {
+    release = resolve26;
   }));
   cacheLocks.set(path, current);
   await previous;
@@ -6833,6 +6838,11 @@ function detectDirectCollisions(nodes) {
   for (const [selector, owners] of bySelector) {
     const uniqueOwners = [...new Map(owners.map((owner) => [owner.node.id, owner])).values()];
     if (uniqueOwners.length <= 1) continue;
+    const selectedArtifacts = uniqueOwners.map((owner) => ({
+      owner,
+      artifact: owner.artifacts.find((candidate) => artifactSelectorKey(candidate) === selector)
+    }));
+    if (new Set(selectedArtifacts.map(({ artifact }) => artifact.hash)).size === 1) continue;
     const replacements = uniqueOwners.filter((owner) => {
       const artifact = owner.artifacts.find((candidate) => artifactSelectorKey(candidate) === selector);
       return uniqueOwners.every((other) => {
@@ -6842,7 +6852,7 @@ function detectDirectCollisions(nodes) {
     });
     if (replacements.length === 1) continue;
     throw new Error(
-      `Direct dependency artifact collision for ${selector}: ${uniqueOwners.map((owner) => `${owner.node.id} required by ${owner.node.requiredBy.join(", ")}`).join("; ")}. Resolve by aliasing, deselecting one artifact, or overriding the dependency selection.`
+      `Direct dependency artifact collision for ${selector}: ${uniqueOwners.map((owner) => `${owner.node.id} required by ${owner.node.requiredBy.join(", ")}`).join("; ")}. Content hashes differ: ${selectedArtifacts.map(({ owner, artifact }) => `${owner.node.id}=sha256:${artifact.hash}`).join("; ")}. Resolve by aliasing, deselecting one artifact, or overriding the dependency selection.`
     );
   }
 }
@@ -7027,8 +7037,8 @@ import { rm as rm7 } from "fs/promises";
 
 // src/lifecycle/source-plan.ts
 import { createHash as createHash8 } from "crypto";
-import { mkdir as mkdir14 } from "fs/promises";
-import { dirname as dirname17, join as join33, resolve as resolve15 } from "path";
+import { mkdir as mkdir14, readdir as readdir9 } from "fs/promises";
+import { basename as basename18, dirname as dirname17, join as join33, posix as posix2, resolve as resolve16 } from "path";
 
 // src/resolve/graph-diff.ts
 function diffGraphLocks(previous, next) {
@@ -7226,8 +7236,10 @@ async function renderGraphForTarget(graph, targetContext = {}) {
   for (const staged of [...stagedNodes.values()].sort((a, b) => a.rawNode.node.id.localeCompare(b.rawNode.node.id))) {
     const rawNode = staged.rawNode;
     const runtimeSelectedSet = new Set(normalizeArtifactSelectors(rawNode.node.selected) ?? []);
-    const runtimeArtifacts = targetContext.adapter ? filterArtifactsByRuntime2(staged.artifacts, targetContext.adapter.name, runtimeSelectedSet) : staged.artifacts;
-    const compositionArtifacts = targetContext.noDeps ? filterArtifactsBySelection(runtimeArtifacts, rawNode.node.selected) : runtimeArtifacts;
+    const selectionValidatedArtifacts = filterArtifactsBySelection(staged.artifacts, rawNode.node.selected);
+    const preRuntimeArtifacts = targetContext.noDeps ? selectionValidatedArtifacts : staged.artifacts;
+    const runtimeArtifacts = targetContext.adapter ? filterArtifactsByRuntime2(preRuntimeArtifacts, targetContext.adapter.name, runtimeSelectedSet) : preRuntimeArtifacts;
+    const compositionArtifacts = runtimeArtifacts;
     const expandedArtifacts = await expandMarkdownIncludes(compositionArtifacts, staged.root, {
       nodeId: rawNode.node.id,
       originNodeId: rawNode.node.id,
@@ -7275,7 +7287,12 @@ async function renderGraphForTarget(graph, targetContext = {}) {
         };
       }
     });
-    const selectedArtifacts = filterArtifactsBySelection(expandedArtifacts, rawNode.node.selected);
+    const selectedArtifacts = filterArtifactsBySelection(
+      expandedArtifacts,
+      rawNode.node.selected,
+      void 0,
+      { validationArtifacts: staged.artifacts }
+    );
     const claudeRenderedArtifacts = await renderClaudeSubagents(selectedArtifacts, staged.root, targetContext.adapter);
     const codexRenderedArtifacts = await renderCodexSubagents(claudeRenderedArtifacts, staged.root, targetContext.adapter);
     const openClawRenderedArtifacts = await renderOpenClawSubagents(codexRenderedArtifacts, staged.root, targetContext.adapter);
@@ -7389,8 +7406,9 @@ function sha2563(content) {
   return createHash7("sha256").update(content).digest("hex");
 }
 function assignInstallNames(graph, artifacts) {
-  const superseded = supersededLogicalSelectors(artifacts);
-  const effectiveArtifacts = artifacts.filter((artifact) => !superseded.has(artifact.logicalSelector));
+  const equivalentArtifacts = coalesceEquivalentDirectArtifacts(artifacts);
+  const superseded = supersededLogicalSelectors(equivalentArtifacts);
+  const effectiveArtifacts = equivalentArtifacts.filter((artifact) => !superseded.has(artifact.logicalSelector));
   const aliases = workspaceAliases(graph);
   validateAliasScopes(graph, effectiveArtifacts, aliases);
   const decisions = /* @__PURE__ */ new Map();
@@ -7433,6 +7451,37 @@ function assignInstallNames(graph, artifacts) {
   }));
   return { artifacts: out, namespacing: [...decisions.values()], overrides: finalOverrides };
 }
+function coalesceEquivalentDirectArtifacts(artifacts) {
+  const equivalent = /* @__PURE__ */ new Map();
+  const passthrough = [];
+  for (const artifact of artifacts) {
+    if (artifact.dependencyRole !== "direct") {
+      passthrough.push(artifact);
+      continue;
+    }
+    const key = `${artifact.type}\0${artifact.name}\0${artifact.hash}`;
+    const group = equivalent.get(key) ?? [];
+    group.push(artifact);
+    equivalent.set(key, group);
+  }
+  for (const group of equivalent.values()) {
+    const sorted = [...group].sort((left, right) => left.logicalSelector.localeCompare(right.logicalSelector));
+    const canonical = sorted[0];
+    passthrough.push({
+      ...canonical,
+      owners: [...new Set(sorted.flatMap((artifact) => artifact.owners))].sort((left, right) => left.localeCompare(right)),
+      composedFrom: mergeComposedFrom(sorted)
+    });
+  }
+  return passthrough;
+}
+function mergeComposedFrom(artifacts) {
+  const entries = /* @__PURE__ */ new Map();
+  for (const entry of artifacts.flatMap((artifact) => artifact.composedFrom ?? [])) {
+    entries.set(`${entry.selector}\0${entry.hash}`, entry);
+  }
+  return entries.size > 0 ? [...entries.values()].sort((left, right) => `${left.selector}\0${left.hash}`.localeCompare(`${right.selector}\0${right.hash}`)) : void 0;
+}
 function supersededLogicalSelectors(artifacts) {
   const removed = /* @__PURE__ */ new Set();
   for (const replacement of artifacts) {
@@ -7595,7 +7644,8 @@ function reachableNodeIds(graph, rootNodeId) {
   return reachable;
 }
 function installNameCollisionError(group) {
-  return new Error(`Install name collision for ${group[0]?.type}/${group[0]?.installName}: ${group.map((artifact) => artifact.logicalSelector).sort().join(" vs ")}`);
+  const details = group.map((artifact) => `${artifact.logicalSelector}=sha256:${artifact.hash}`).sort().join("; ");
+  return new Error(`Install name collision for ${group[0]?.type}/${group[0]?.installName}. Artifact content hashes: ${details}`);
 }
 function namespaceDecision(artifact, reason) {
   return {
@@ -8029,6 +8079,63 @@ function containsPath(parent, candidate) {
   return path === "" || !path.startsWith("..") && !isAbsolute2(path);
 }
 
+// src/model/target-state.ts
+import { posix, resolve as resolve15 } from "path";
+var targetEvolutionFields = /* @__PURE__ */ new Set([
+  "adapterCodeHash",
+  "adapterConfig",
+  "adapterModule",
+  "targetRoot",
+  "transportDescription",
+  "ssh"
+]);
+function resolveTargetStateIdentity(options) {
+  return {
+    targetFingerprint: computeTargetFingerprint(options.targetFingerprintParts),
+    stateFingerprint: computeTargetFingerprint({
+      identityVersion: 1,
+      contributionScope: {
+        workspaceRoot: resolve15(options.workspaceRoot),
+        targetKey: options.targetKey
+      },
+      target: {
+        ...persistentTargetParts(options.targetFingerprintParts),
+        installRoot: normalizeInstallRoot(options.resolvedInstallRoot, options.transportKind),
+        endpoint: targetEndpoint(options.targetFingerprintParts, options.transportKind)
+      }
+    })
+  };
+}
+function persistentTargetParts(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { value };
+  return Object.fromEntries(
+    Object.entries(value).filter(([key]) => !targetEvolutionFields.has(key))
+  );
+}
+function normalizeInstallRoot(path, transportKind) {
+  return transportKind === "ssh" ? posix.normalize(path) : resolve15(path);
+}
+function targetEndpoint(value, transportKind) {
+  if (transportKind !== "ssh") return { kind: "local" };
+  const record = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  const ssh = record.ssh && typeof record.ssh === "object" && !Array.isArray(record.ssh) ? record.ssh : {};
+  if (typeof ssh.host !== "string" || ssh.host.trim().length === 0) {
+    throw new Error("SSH endpoint host is required for target state identity; transport description is not an identity source.");
+  }
+  if (ssh.user !== void 0 && (typeof ssh.user !== "string" || ssh.user.trim().length === 0)) {
+    throw new Error("SSH target state identity requires a non-empty endpoint user when one is provided.");
+  }
+  if (ssh.port !== void 0 && (!Number.isInteger(ssh.port) || ssh.port <= 0)) {
+    throw new Error("SSH target state identity requires a positive integer endpoint port.");
+  }
+  return {
+    kind: "ssh",
+    host: ssh.host.trim(),
+    user: ssh.user,
+    port: ssh.port ?? 22
+  };
+}
+
 // src/lifecycle/source-plan.ts
 async function createGraphSourcePlan(options) {
   if (options.roots.length === 0) {
@@ -8042,22 +8149,62 @@ async function createGraphSourcePlan(options) {
     options.warn?.(message);
   };
   const installationType = options.installationType ?? resolveInstallationTypeForAdapterTarget(options.adapter);
-  const targetFingerprint = computeTargetFingerprint(options.targetFingerprintParts ?? {
+  const targetFingerprintParts2 = options.targetFingerprintParts ?? {
     adapter: options.adapter.name,
     fleetId: options.fleetId,
     installationType,
     targetRoot: options.targetRoot,
     transport: transport.kind,
     transportDescription: transport.description
+  };
+  const installRoot = installRootForAdapterInstallationType(options.adapter, options.targetRoot, installationType, transport.kind === "ssh");
+  const targetIdentity = resolveTargetStateIdentity({
+    targetFingerprintParts: targetFingerprintParts2,
+    workspaceRoot,
+    targetKey: options.targetKey ?? "default",
+    resolvedInstallRoot: installRoot,
+    transportKind: transport.kind
   });
+  const targetFingerprint = targetIdentity.targetFingerprint;
   const stateKey = stateKeyFor(options.adapter.name, {
     installationType,
     stateKey: options.stateKey,
-    targetFingerprint,
+    targetFingerprint: targetIdentity.stateFingerprint,
     fleetId: options.fleetId
   });
-  const installRoot = installRootForAdapterInstallationType(options.adapter, options.targetRoot, installationType, transport.kind === "ssh");
-  const recoveredPendingApply = options.readOnly === true ? false : await recoverPendingApplyIfSafe(installRoot, options.adapter.name, transport, { installationType, stateKey });
+  const graphLockPath = pathForGraphLock(
+    workspaceRoot,
+    options.targetKey ?? "default",
+    options.adapter.name,
+    targetIdentity.stateFingerprint
+  );
+  const ownership = await resolveWorkspaceOwnershipScope(workspaceRoot, {
+    fleetId: options.fleetId,
+    globalRoot: options.globalRoot
+  });
+  const workspaceOwner = workspaceOwnerForRoot(ownership.root, ownership.fleetId);
+  let recoveredPendingApply = false;
+  if (options.readOnly !== true) {
+    const pendingJournal = await discoverTargetApplyJournal({
+      adapter: options.adapter.name,
+      installationType,
+      stateKey,
+      explicitStateKey: options.stateKey,
+      fleetId: options.fleetId,
+      installRoot,
+      workspaceOwner,
+      graphLockPath,
+      transport
+    });
+    if (pendingJournal) {
+      recoveredPendingApply = await recoverPendingApplyIfSafe(
+        installRoot,
+        options.adapter.name,
+        transport,
+        { installationType, stateKey: pendingJournal.stateKey }
+      );
+    }
+  }
   const workspaceConfig = await readMergedWorkspaceConfig(workspaceRoot, { globalRoot: options.globalRoot });
   const trustPolicy = {
     ...normalizeTrustPolicy(workspaceConfig.trust),
@@ -8065,8 +8212,29 @@ async function createGraphSourcePlan(options) {
   };
   const lockMode = options.frozenLock === true || options.offline === true;
   const lockLabel = options.offline === true ? "Offline" : options.frozenLock === true ? "Frozen lock" : options.lockedResolution === true ? "Locked install" : "Fresh resolve";
-  const graphLockPath = pathForGraphLock(workspaceRoot, options.targetKey ?? "default", options.adapter.name, targetFingerprint);
-  const previousLock = await readExistingGraphLock(graphLockPath);
+  const readPriorState = async () => {
+    const [stableManifest, stableLock2, stableSourceLock2] = await Promise.all([
+      readInstallManifest(installRoot, options.adapter.name, transport, { installationType, stateKey }),
+      readExistingGraphLock(graphLockPath),
+      readSourceLock(installRoot, options.adapter.name, transport, { installationType, stateKey })
+    ]);
+    const priorState2 = await resolvePriorTargetState({
+      adapter: options.adapter.name,
+      installationType,
+      stateKey,
+      explicitStateKey: options.stateKey,
+      fleetId: options.fleetId,
+      installRoot,
+      workspaceOwner,
+      graphLockPath,
+      stableManifest,
+      stableLock: stableLock2,
+      transport
+    });
+    return { priorState: priorState2, stableLock: stableLock2, stableSourceLock: stableSourceLock2 };
+  };
+  const { priorState, stableLock, stableSourceLock } = await readPriorState();
+  const previousLock = priorState.graphLock;
   const registryClient = new RegistryClient({ workspaceRoot, offline: lockMode, offlineLabel: lockLabel, warn });
   const graph = await resolveDependencyGraph(options.roots, {
     workspaceRoot,
@@ -8107,13 +8275,13 @@ async function createGraphSourcePlan(options) {
   const resolvedInstallRoot = installRootForArtifacts(options.adapter, options.targetRoot, resolvedInstallationType, desiredArtifacts.map((artifact) => artifact.type), transport.kind === "ssh");
   const graphLockDigest = digestGraphLock(bundle.graphLock);
   const graphDiff = diffGraphLocks(previousLock, bundle.graphLock);
-  const manifest = await readInstallManifest(resolvedInstallRoot, options.adapter.name, transport, { installationType: resolvedInstallationType, stateKey });
-  const ownership = await resolveWorkspaceOwnershipScope(workspaceRoot, {
-    fleetId: options.fleetId,
-    globalRoot: options.globalRoot
-  });
-  const workspaceOwner = workspaceOwnerForRoot(ownership.root, ownership.fleetId);
-  const plan = options.retireExactMcp ? await createExactMcpRetirementPlan(
+  if (normalizeInstallRoot2(resolvedInstallRoot, transport.kind) !== normalizeInstallRoot2(installRoot, transport.kind)) {
+    throw new Error(
+      `Adapter ${options.adapter.name} resolved a different install root after rendering; target state identity cannot be proven.`
+    );
+  }
+  const manifest = priorState.manifest;
+  const basePlan = options.retireExactMcp ? await createExactMcpRetirementPlan(
     desiredArtifacts,
     options.adapter,
     options.targetRoot,
@@ -8135,10 +8303,18 @@ async function createGraphSourcePlan(options) {
     forceDrift: options.forceDrift,
     forceConflict: options.forceConflict,
     replaceConflict: options.replaceConflict,
+    stateMigration: priorState.migration,
     warn
   });
+  const plan = priorState.migration && !basePlan.stateMigration ? { ...basePlan, stateMigration: priorState.migration } : basePlan;
+  plan.targetStateFilePreconditions = {
+    graphLockPath,
+    graphLockRevision: stableLock ? digestGraphLock(stableLock) : null,
+    sourceLockRevision: computeSourceLockRevision(stableSourceLock)
+  };
+  let foreignStateObservations = [];
   if (options.forceForeignState !== true && options.deferForeignStateCheck !== true) {
-    await assertNoForeignWorkspaceState({
+    foreignStateObservations = await assertNoForeignWorkspaceState({
       installRoot: resolvedInstallRoot,
       adapter: options.adapter.name,
       transport,
@@ -8146,9 +8322,11 @@ async function createGraphSourcePlan(options) {
       workspaceOwner,
       globalRoot: options.globalRoot,
       stateKey,
+      migratingStateKey: priorState.migration?.fromStateKey,
       plannedPaths: plan.operations.map((operation) => operation.relativeDestPath),
       plannedOperations: plan.operations
     });
+    plan.hasBlockingChanges = plan.operations.some((operation) => operation.action === "drift" || operation.action === "conflict");
   }
   return {
     plan,
@@ -8161,7 +8339,10 @@ async function createGraphSourcePlan(options) {
     warnings,
     newTransitiveSources: trustEvaluation.promptSources,
     graphDiff,
-    recoveredPendingApply
+    recoveredPendingApply,
+    previousManifest: priorState.manifest,
+    previousGraphLock: priorState.graphLock,
+    foreignStateObservations
   };
 }
 async function assertNoForeignWorkspaceStateForPlan(plan, options) {
@@ -8174,12 +8355,15 @@ async function assertNoForeignWorkspaceStateForPlan(plan, options) {
     workspaceOwner: options.workspaceOwner,
     globalRoot: options.globalRoot,
     stateKey: plan.stateKey,
+    migratingStateKey: plan.stateMigration?.fromStateKey,
     plannedPaths: options.plannedPaths ?? plan.operations.map((operation) => operation.relativeDestPath),
     plannedOperations: plan.operations
   });
+  plan.hasBlockingChanges = plan.operations.some((operation) => operation.action === "drift" || operation.action === "conflict");
 }
-function graphLockPathForTarget(workspaceRoot, targetKey2, adapter, targetFingerprintParts2) {
-  return pathForGraphLock(workspaceRoot, targetKey2, adapter, computeTargetFingerprint(targetFingerprintParts2));
+function graphLockPathForTarget(workspaceRoot, targetKey2, adapter, targetFingerprintParts2, context) {
+  const identity = resolveTargetStateIdentity({ targetFingerprintParts: targetFingerprintParts2, workspaceRoot, targetKey: targetKey2, ...context });
+  return pathForGraphLock(workspaceRoot, targetKey2, adapter, identity.stateFingerprint);
 }
 function desiredArtifactsFromGraphBundle(bundle) {
   return bundle.artifacts.map((artifact) => desiredArtifactFromResolved(artifact));
@@ -8221,10 +8405,278 @@ async function readExistingGraphLock(path) {
   if (!await pathExists(path)) return void 0;
   return readGraphLock(path);
 }
+async function discoverTargetApplyJournal(options) {
+  const journals = await listApplyJournals(
+    options.installRoot,
+    options.adapter,
+    options.transport,
+    { installationType: options.installationType }
+  );
+  const correlated = [];
+  for (const item of journals) {
+    const journal = item.journal;
+    const journalStateKey = journal.stateKey ?? stateKeyFor(options.adapter, { installationType: options.installationType });
+    if (normalizeInstallRoot2(journal.targetRoot, options.transport.kind) !== normalizeInstallRoot2(options.installRoot, options.transport.kind)) {
+      continue;
+    }
+    if (journalStateKey === options.stateKey) {
+      validateJournalManifestEnvelope(journal.manifest, options, journalStateKey, item.path);
+      correlated.push({ path: item.path, stateKey: journalStateKey });
+      continue;
+    }
+    if (!journal.graphLockPath || !journal.graphLock || !journal.graphLockDigest) continue;
+    if (resolve16(dirname17(journal.graphLockPath)) !== resolve16(dirname17(options.graphLockPath))) continue;
+    if (options.transport.kind === "ssh") {
+      throw new Error(
+        `Legacy SSH apply journal at ${item.path} does not record its original endpoint; Agentwheel cannot prove endpoint identity, so the journal was preserved.`
+      );
+    }
+    const suffix = ".graph-lock.json";
+    const graphName = basename18(journal.graphLockPath);
+    if (!graphName.endsWith(suffix)) {
+      throw new Error(`Legacy apply journal at ${item.path} has an invalid graph-lock path.`);
+    }
+    const fingerprint = graphName.slice(0, -suffix.length);
+    if (!/^[a-f0-9]{64}$/u.test(fingerprint) || journal.graphLock.canonical.targetFingerprint !== fingerprint) {
+      throw new Error(`Legacy apply journal graph-lock fingerprint does not match its path at ${item.path}.`);
+    }
+    const expectedStateKey = stateKeyFor(options.adapter, {
+      installationType: options.installationType,
+      stateKey: options.explicitStateKey,
+      targetFingerprint: fingerprint,
+      fleetId: options.fleetId
+    });
+    if (journalStateKey !== expectedStateKey) {
+      throw new Error(`Legacy apply journal state key does not match its graph lock at ${item.path}.`);
+    }
+    let actualGraphLock;
+    try {
+      actualGraphLock = await readGraphLock(journal.graphLockPath);
+    } catch (error) {
+      throw new Error(
+        `Legacy apply journal graph lock is missing or invalid at ${journal.graphLockPath}: ` + (error instanceof Error ? error.message : String(error))
+      );
+    }
+    const embeddedDigest = digestGraphLock(journal.graphLock);
+    const actualDigest = digestGraphLock(actualGraphLock);
+    if (embeddedDigest !== journal.graphLockDigest || actualDigest !== journal.graphLockDigest) {
+      throw new Error(`Legacy apply journal graph-lock digest mismatch at ${item.path}.`);
+    }
+    const manifest = validateJournalManifestEnvelope(journal.manifest, options, journalStateKey, item.path);
+    validateLegacyManifestCandidate(manifest, {
+      ...options,
+      candidateStateKey: journalStateKey,
+      graphLockDigest: journal.graphLockDigest,
+      graphLockPath: journal.graphLockPath
+    });
+    correlated.push({ path: item.path, stateKey: journalStateKey });
+  }
+  if (correlated.length > 1) {
+    throw new Error(`Ambiguous apply journals for ${options.adapter}: multiple journals match the requested target state.`);
+  }
+  return correlated[0];
+}
+function validateJournalManifestEnvelope(value, options, stateKey, journalPath) {
+  let manifest;
+  try {
+    manifest = installManifestV2Schema.parse(value);
+  } catch (error) {
+    throw new Error(
+      `Apply journal at ${journalPath} has an invalid install manifest: ` + (error instanceof Error ? error.message : String(error))
+    );
+  }
+  if (manifest.adapter !== options.adapter || manifest.installationType !== options.installationType || manifest.stateKey !== stateKey || normalizeInstallRoot2(manifest.targetRoot, options.transport.kind) !== normalizeInstallRoot2(options.installRoot, options.transport.kind)) {
+    throw new Error(`Apply journal target identity does not match its manifest at ${journalPath}.`);
+  }
+  return manifest;
+}
+async function resolvePriorTargetState(options) {
+  const candidates = await discoverLegacyStateCandidates(options);
+  const correlated = candidates.filter((candidate) => candidate.manifest);
+  if (options.stableManifest) {
+    for (const candidate of correlated) {
+      if (!sameManifestContributions(options.stableManifest, candidate.manifest)) {
+        throw new Error(
+          `Stable and legacy target states coexist with disagreeing contributions for ${options.adapter}; reconcile them explicitly.`
+        );
+      }
+    }
+    const sameKeyCandidates = correlated.filter((candidate) => candidate.stateKey === options.stateKey);
+    if (!options.stableLock && sameKeyCandidates.length > 1) {
+      throw new Error(`Ambiguous legacy target state for ${options.adapter}: multiple correlated graph locks use the explicit state key.`);
+    }
+    if (!options.stableLock && sameKeyCandidates.length === 1) {
+      const candidate = sameKeyCandidates[0];
+      return {
+        graphLock: candidate.graphLock,
+        manifest: options.stableManifest,
+        migration: migrationFromCandidate(candidate)
+      };
+    }
+    return { graphLock: options.stableLock, manifest: options.stableManifest };
+  }
+  if (options.stableLock && correlated.length > 0) {
+    throw new Error(
+      `Stable graph state and legacy manifest state coexist for ${options.adapter} without a stable manifest; reconcile them explicitly.`
+    );
+  }
+  if (correlated.length > 1) {
+    throw new Error(`Ambiguous legacy target state for ${options.adapter}: multiple correlated manifests were found.`);
+  }
+  if (correlated.length === 1) {
+    const candidate = correlated[0];
+    return {
+      graphLock: candidate.graphLock,
+      manifest: candidate.manifest,
+      migration: migrationFromCandidate(candidate)
+    };
+  }
+  if (options.stableLock) return { graphLock: options.stableLock };
+  if (candidates.length > 1) {
+    throw new Error(`Ambiguous legacy target state for ${options.adapter}: multiple graph-only candidates were found.`);
+  }
+  if (candidates.length === 1) {
+    throw new Error(
+      `Legacy graph-only target state for ${options.adapter} has no correlated install manifest; runtime identity and ownership cannot be proven, so the graph lock was preserved.`
+    );
+  }
+  return {};
+}
+async function discoverLegacyStateCandidates(options) {
+  const directory = dirname17(options.graphLockPath);
+  let names;
+  try {
+    names = await readdir9(directory);
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  const stableName = basename18(options.graphLockPath);
+  const suffix = ".graph-lock.json";
+  const candidates = [];
+  for (const name of names.sort((left, right) => left.localeCompare(right))) {
+    if (name === stableName || !name.endsWith(suffix)) continue;
+    const fingerprint = name.slice(0, -suffix.length);
+    if (!/^[a-f0-9]{64}$/u.test(fingerprint)) continue;
+    const graphLockPath = join33(directory, name);
+    let graphLock;
+    try {
+      graphLock = await readGraphLock(graphLockPath);
+    } catch (error) {
+      throw new Error(
+        `Legacy graph lock at ${graphLockPath} is invalid or unsupported: ` + (error instanceof Error ? error.message : String(error))
+      );
+    }
+    if (graphLock.canonical.targetFingerprint !== fingerprint) {
+      throw new Error(
+        `Legacy graph lock fingerprint does not match its filename at ${graphLockPath}.`
+      );
+    }
+    if (options.transport.kind === "ssh") {
+      throw new Error(
+        `Legacy SSH target state at ${graphLockPath} does not record its original endpoint; Agentwheel cannot prove endpoint identity, so the graph lock was preserved.`
+      );
+    }
+    const graphLockDigest = digestGraphLock(graphLock);
+    const candidateStateKey = stateKeyFor(options.adapter, {
+      installationType: options.installationType,
+      stateKey: options.explicitStateKey,
+      targetFingerprint: fingerprint,
+      fleetId: options.fleetId
+    });
+    let manifest;
+    let sourceLock;
+    try {
+      manifest = await readInstallManifest(options.installRoot, options.adapter, options.transport, {
+        installationType: options.installationType,
+        stateKey: candidateStateKey
+      });
+      sourceLock = await readSourceLock(options.installRoot, options.adapter, options.transport, {
+        installationType: options.installationType,
+        stateKey: candidateStateKey
+      });
+    } catch (error) {
+      throw new Error(
+        `Legacy target state for ${graphLockPath} is invalid: ` + (error instanceof Error ? error.message : String(error))
+      );
+    }
+    if (!manifest) {
+      if (sourceLock) {
+        throw new Error(`Legacy source lock for ${graphLockPath} has no correlated install manifest.`);
+      }
+      candidates.push({ stateKey: candidateStateKey, graphLockPath, graphLockDigest, graphLock });
+      continue;
+    }
+    const validated = validateLegacyManifestCandidate(manifest, {
+      ...options,
+      candidateStateKey,
+      graphLockDigest,
+      graphLockPath
+    });
+    candidates.push({
+      stateKey: candidateStateKey,
+      graphLockPath,
+      graphLockDigest,
+      graphLock,
+      manifest: validated,
+      sourceLock
+    });
+  }
+  return candidates;
+}
+function validateLegacyManifestCandidate(manifest, options) {
+  if (manifest.version !== 2) {
+    throw new Error(`Legacy target state for ${options.graphLockPath} requires an install manifest v2.`);
+  }
+  if (manifest.adapter !== options.adapter) {
+    throw new Error(`Legacy target state adapter mismatch at ${options.graphLockPath}.`);
+  }
+  if (manifest.installationType !== options.installationType) {
+    throw new Error(`Legacy target state installation type mismatch at ${options.graphLockPath}.`);
+  }
+  if (manifest.stateKey !== options.candidateStateKey) {
+    throw new Error(`Legacy target state key mismatch at ${options.graphLockPath}.`);
+  }
+  if (normalizeInstallRoot2(manifest.targetRoot, options.transport.kind) !== normalizeInstallRoot2(options.installRoot, options.transport.kind)) {
+    throw new Error(`Legacy target state target root mismatch at ${options.graphLockPath}.`);
+  }
+  const correlated = manifest.entries.filter((entry) => entry.graphLockDigest === options.graphLockDigest);
+  if (correlated.length === 0) {
+    throw new Error(`Legacy install manifest graph-lock digest does not match ${options.graphLockPath}.`);
+  }
+  if (correlated.some((entry) => entry.workspaceOwner !== options.workspaceOwner)) {
+    throw new Error(`Legacy target state contribution scope does not match ${options.graphLockPath}.`);
+  }
+  return manifest;
+}
+function migrationFromCandidate(candidate) {
+  return {
+    fromStateKey: candidate.manifest ? candidate.stateKey : void 0,
+    fromGraphLockPath: candidate.graphLockPath,
+    fromGraphLockDigest: candidate.graphLockDigest,
+    sourceLock: candidate.manifest ? candidate.sourceLock ?? null : void 0
+  };
+}
+function sameManifestContributions(left, right) {
+  if (left.version !== 2) return false;
+  return stableJson2(manifestContributionState(left)) === stableJson2(manifestContributionState(right));
+}
+function manifestContributionState(manifest) {
+  return manifest.entries.map(({ updatedAt: _updatedAt, graphLockDigest: _graphLockDigest, ...entry }) => entry).sort((left, right) => left.path.localeCompare(right.path));
+}
+function stableJson2(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson2).join(",")}]`;
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  const record = value;
+  return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort((left, right) => left.localeCompare(right)).map((key) => `${JSON.stringify(key)}:${stableJson2(record[key])}`).join(",")}}`;
+}
+function normalizeInstallRoot2(path, transportKind) {
+  return transportKind === "ssh" ? posix2.normalize(path) : resolve16(path);
+}
 var workspaceOwnerPrefix2 = "workspace-root:";
 async function assertNoForeignWorkspaceState(check) {
   const planned = new Set(check.plannedPaths);
-  if (planned.size === 0) return;
+  if (planned.size === 0) return [];
   const plannedOperations = /* @__PURE__ */ new Map();
   for (const operation of check.plannedOperations) {
     if (!planned.has(operation.relativeDestPath)) continue;
@@ -8233,18 +8685,22 @@ async function assertNoForeignWorkspaceState(check) {
     plannedOperations.set(operation.relativeDestPath, operations);
   }
   const manifests = await listInstallManifests(check.installRoot, check.adapter, check.transport);
-  const root = resolve15(check.workspaceRoot);
+  const root = resolve16(check.workspaceRoot);
   const ownsSubWorkspaces = root !== globalConfigRoot(check.globalRoot);
-  const foreign = [];
+  const collisions = /* @__PURE__ */ new Map();
   for (const entry of manifests) {
-    if (entry.stateKey === check.stateKey) continue;
-    const byOwner = /* @__PURE__ */ new Map();
+    if (entry.stateKey === check.stateKey || entry.stateKey === check.migratingStateKey) continue;
+    const entryCounts = /* @__PURE__ */ new Map();
+    for (const manifestEntry of entry.manifest.entries) {
+      const owner = "workspaceOwner" in manifestEntry ? manifestEntry.workspaceOwner : void 0;
+      if (typeof owner === "string" && owner.startsWith(workspaceOwnerPrefix2)) {
+        entryCounts.set(owner, (entryCounts.get(owner) ?? 0) + 1);
+      }
+    }
     for (const manifestEntry of entry.manifest.entries) {
       const owner = "workspaceOwner" in manifestEntry ? manifestEntry.workspaceOwner : void 0;
       if (typeof owner !== "string" || !owner.startsWith(workspaceOwnerPrefix2)) continue;
       if (ownedByWorkspace(owner, check.workspaceOwner, root, ownsSubWorkspaces)) continue;
-      const bucket = byOwner.get(owner) ?? { entryCount: 0, collidingPaths: [] };
-      bucket.entryCount += 1;
       if (planned.has(manifestEntry.path) && !await isDisjointVerifiedMergeContribution(
         check,
         manifestEntry.path,
@@ -8252,16 +8708,46 @@ async function assertNoForeignWorkspaceState(check) {
         manifestEntry.mergeRemoval,
         plannedOperations.get(manifestEntry.path) ?? []
       )) {
-        bucket.collidingPaths.push(manifestEntry.path);
+        const ownedEntry = manifestEntry;
+        const pathCollisions = collisions.get(manifestEntry.path) ?? [];
+        pathCollisions.push({
+          owner,
+          stateKey: entry.stateKey,
+          fileName: entry.fileName,
+          manifestRevision: entry.manifest.revision,
+          entryCount: entryCounts.get(owner) ?? 1,
+          entry: ownedEntry
+        });
+        collisions.set(manifestEntry.path, pathCollisions);
       }
-      byOwner.set(owner, bucket);
     }
-    for (const [owner, bucket] of byOwner) {
-      if (bucket.collidingPaths.length === 0) continue;
-      foreign.push({ owner, fileName: entry.fileName, ...bucket });
+  }
+  const foreignByOwner = /* @__PURE__ */ new Map();
+  const observations = [];
+  for (const [path, pathCollisions] of collisions) {
+    const operations = plannedOperations.get(path) ?? [];
+    const exact = pathCollisions.length === 1 ? await exactForeignKeepOperation(check, pathCollisions[0], operations) : void 0;
+    if (exact) {
+      const index = check.plannedOperations.indexOf(operations[0]);
+      if (index < 0) throw new Error(`Foreign-state reconciliation lost planned operation for ${path}.`);
+      check.plannedOperations[index] = exact.operation;
+      observations.push(exact.observation);
+      continue;
+    }
+    for (const collision of pathCollisions) {
+      const key = `${collision.owner}\0${collision.fileName}`;
+      const bucket = foreignByOwner.get(key) ?? {
+        owner: collision.owner,
+        fileName: collision.fileName,
+        entryCount: collision.entryCount,
+        collidingPaths: []
+      };
+      if (!bucket.collidingPaths.includes(path)) bucket.collidingPaths.push(path);
+      foreignByOwner.set(key, bucket);
     }
   }
-  if (foreign.length === 0) return;
+  const foreign = [...foreignByOwner.values()];
+  if (foreign.length === 0) return observations.sort((left, right) => left.path.localeCompare(right.path));
   throw new Error([
     `Refusing to plan ${check.adapter} at ${check.installRoot}.`,
     "This runtime root already carries Agentwheel state owned by another workspace, at paths this run would install:",
@@ -8275,6 +8761,36 @@ async function assertNoForeignWorkspaceState(check) {
     parseWorkspaceOwner(check.workspaceOwner)?.fleetId ? "Reconcile the owners with an explicit agentwheel fleet normalize operation before planning this fleet." : "Re-run from the owning workspace, or pass --force-foreign-state to plan against it anyway."
   ].join("\n"));
 }
+async function exactForeignKeepOperation(check, collision, operations) {
+  if (operations.length !== 1) return void 0;
+  const operation = operations[0];
+  const entry = collision.entry;
+  if (operation.semanticPlugin || operation.programmaticOperation || operation.mergeStrategy || operation.mode || entry.semanticPlugin || entry.mergeStrategy || entry.mode) return void 0;
+  if (!operation.desiredHash || operation.artifactType !== entry.artifactType || operation.artifactName !== entry.artifactName || operation.kind !== entry.kind || operation.desiredHash !== entry.sourceHash) return void 0;
+  const path = join33(check.installRoot, entry.path);
+  if (!await check.transport.pathExists(path)) return void 0;
+  const currentHash = await check.transport.hashPath(path);
+  if (currentHash !== entry.hash || currentHash !== operation.desiredHash || operation.currentHash !== void 0 && operation.currentHash !== currentHash) return void 0;
+  return {
+    operation: {
+      ...operation,
+      action: "keep",
+      currentHash,
+      manifestHash: entry.hash,
+      reason: `exact foreign artifact owned by ${collision.owner}; kept outside workspace ${check.workspaceOwner}`,
+      preserveInManifest: false
+    },
+    observation: {
+      stateKey: collision.stateKey,
+      fileName: collision.fileName,
+      manifestRevision: collision.manifestRevision,
+      workspaceOwner: collision.owner,
+      path: entry.path,
+      graphNodeId: entry.graphNodeId,
+      logicalSelector: entry.logicalSelector
+    }
+  };
+}
 async function isDisjointVerifiedMergeContribution(check, relativePath, foreignStrategy, foreignRemoval, operations) {
   if (!foreignStrategy || !hasMergeRemovalContent(foreignRemoval) || operations.length !== 1) return false;
   const operation = operations[0];
@@ -8446,7 +8962,7 @@ function targetLabel(target) {
 }
 
 // src/runtime/target.ts
-import { basename as basename18, dirname as dirname18, join as join34, resolve as resolve16 } from "path";
+import { basename as basename19, dirname as dirname18, join as join34, resolve as resolve17 } from "path";
 var runtimeMarkers = [
   { adapter: "openclaw", dirs: [".openclaw", ".clawdbot", ".moltbot"] },
   { adapter: "claude", dirs: [".claude"] },
@@ -8455,9 +8971,9 @@ var runtimeMarkers = [
   { adapter: "copilot", dirs: [".github"] }
 ];
 async function resolveRuntimeTarget(request = {}) {
-  const cwd = resolve16(request.cwd ?? process.cwd());
+  const cwd = resolve17(request.cwd ?? process.cwd());
   if (request.targetRoot) {
-    const targetRoot = resolve16(request.targetRoot);
+    const targetRoot = resolve17(request.targetRoot);
     return {
       adapter: request.adapter ?? "openclaw",
       installationType: request.installationType,
@@ -8489,7 +9005,7 @@ async function resolveRuntimeTarget(request = {}) {
 async function resolveAllRuntimeTargets(request = {}) {
   if (request.targetRoot) return [await resolveRuntimeTarget(request)];
   if (request.agent) return [await resolveRuntimeTarget(request)];
-  const cwd = resolve16(request.cwd ?? process.cwd());
+  const cwd = resolve17(request.cwd ?? process.cwd());
   const workspaceRoot = await findWorkspaceRoot(cwd);
   const config = await readMergedWorkspaceConfig(workspaceRoot, { globalRoot: request.globalRoot });
   const targets = Object.entries(config.agents).map(([name]) => targetFromAgent(name, config, workspaceRoot, request.installationType, request.fleetId));
@@ -8499,8 +9015,8 @@ async function resolveAllRuntimeTargets(request = {}) {
   return targets;
 }
 async function resolveProfileRuntimeTargets(request) {
-  const cwd = resolve16(request.cwd ?? process.cwd());
-  const workspaceRoot = request.targetRoot ? resolve16(request.targetRoot) : await findWorkspaceRoot(cwd);
+  const cwd = resolve17(request.cwd ?? process.cwd());
+  const workspaceRoot = request.targetRoot ? resolve17(request.targetRoot) : await findWorkspaceRoot(cwd);
   const config = await readMergedWorkspaceConfig(workspaceRoot, { globalRoot: request.globalRoot });
   const profile = config.profiles[request.profile];
   if (!profile) {
@@ -8566,12 +9082,12 @@ async function detectRuntimeTarget(cwd = process.cwd(), adapterFilter) {
   return unique[0];
 }
 async function detectRuntimeTargets(cwd = process.cwd(), adapterFilter) {
-  const root = resolve16(cwd);
+  const root = resolve17(cwd);
   const matches = [];
   for (const marker of runtimeMarkers) {
     if (adapterFilter && marker.adapter !== adapterFilter) continue;
     for (const dir of marker.dirs) {
-      if (basename18(root) === dir) {
+      if (basename19(root) === dir) {
         matches.push({ adapter: marker.adapter, targetRoot: dirname18(root) });
       } else if (await pathExists(join34(root, dir))) {
         matches.push({ adapter: marker.adapter, targetRoot: root });
@@ -8615,9 +9131,9 @@ function dedupeTargets(matches) {
   return [...byKey.values()];
 }
 function runtimeScanRoot(request) {
-  const root = resolve16(request.targetRoot ?? request.cwd ?? process.cwd());
+  const root = resolve17(request.targetRoot ?? request.cwd ?? process.cwd());
   if (request.targetRoot) return root;
-  return runtimeMarkers.some((marker) => marker.dirs.includes(basename18(root))) ? dirname18(root) : root;
+  return runtimeMarkers.some((marker) => marker.dirs.includes(basename19(root))) ? dirname18(root) : root;
 }
 
 // src/lifecycle/profile.ts
@@ -9004,9 +9520,9 @@ function normalizeVersion(version) {
 
 // src/model/package-validate.ts
 import { stat as stat12 } from "fs/promises";
-import { resolve as resolve17 } from "path";
+import { resolve as resolve18 } from "path";
 async function validatePackage(root) {
-  const packageRoot = resolve17(root);
+  const packageRoot = resolve18(root);
   const findings = [];
   const manifestPath = await findPackageManifestPath(packageRoot);
   if (!manifestPath) {
@@ -9107,7 +9623,7 @@ async function validateManifestComposeInclude(packageRoot, selector, optional, f
   try {
     validateSelector(selector, "compose.include", findings, manifestPath, { fragmentsOnly: true, aliases });
     if (isCrossPackageSelector(selector)) return;
-    const full = resolve17(packageRoot, selector);
+    const full = resolve18(packageRoot, selector);
     if (full !== packageRoot && !full.startsWith(`${packageRoot}/`)) {
       findings.push({ level: "error", message: `Compose include escapes package root: ${selector}`, path: manifestPath });
       return;
@@ -9161,10 +9677,10 @@ function isCrossPackageSelector(value) {
 
 // src/model/package-migrate.ts
 import { readFile as readFile22, rename as rename3, writeFile as writeFile12 } from "fs/promises";
-import { join as join37, resolve as resolve18 } from "path";
+import { join as join37, resolve as resolve19 } from "path";
 import { applyEdits, modify, parse as parse2 } from "jsonc-parser";
 async function migratePackageManifest(root) {
-  const packageRoot = resolve18(root);
+  const packageRoot = resolve19(root);
   for (const name of openPackManifestNames) {
     const path = join37(packageRoot, name);
     if (await pathExists(path)) {
@@ -9226,7 +9742,7 @@ function resolveCliVersion() {
 }
 
 // src/lifecycle/ownership.ts
-import { resolve as resolve19 } from "path";
+import { resolve as resolve20 } from "path";
 async function planArtifactOwnershipHandoff(request) {
   return validateOwnershipHandoff(request, request.transport ?? localTransport);
 }
@@ -9352,8 +9868,8 @@ function containedArtifactPath(targetRoot, relativePath) {
   if (!relativePath || relativePath.startsWith("/") || relativePath.includes("\0")) {
     throw new Error(`Unsafe managed artifact path: ${relativePath}`);
   }
-  const root = resolve19(targetRoot);
-  const candidate = resolve19(root, relativePath);
+  const root = resolve20(targetRoot);
+  const candidate = resolve20(root, relativePath);
   if (candidate !== root && !candidate.startsWith(`${root}/`)) {
     throw new Error(`Managed artifact path escapes target root: ${relativePath}`);
   }
@@ -9386,7 +9902,7 @@ function assertManifestIdentity(manifest, request) {
 
 // src/lifecycle/ownership-retire-stale.ts
 import { createHash as createHash9 } from "crypto";
-import { resolve as resolve20 } from "path";
+import { resolve as resolve21 } from "path";
 async function planRetireStaleOwnership(request) {
   return observe(request, request.transport ?? localTransport);
 }
@@ -9519,7 +10035,7 @@ async function observe(request, transport) {
   return { ...withoutDigest, planDigest: digest(withoutDigest) };
 }
 function normalizeRequest(request) {
-  const targetRoot = resolve20(request.targetRoot);
+  const targetRoot = resolve21(request.targetRoot);
   const sourceStateKey = exactStateKey(request.adapter, request.sourceStateKey, request.installationType, "source");
   const destinationStateKey = exactStateKey(request.adapter, request.destinationStateKey, request.installationType, "destination");
   if (sourceStateKey === destinationStateKey) throw new Error("Source and destination state keys must differ.");
@@ -9530,8 +10046,8 @@ function normalizeRequest(request) {
     installationType: request.installationType.trim(),
     sourceStateKey,
     destinationStateKey,
-    fromWorkspaceRoot: resolve20(request.fromWorkspaceRoot),
-    toWorkspaceRoot: resolve20(request.toWorkspaceRoot),
+    fromWorkspaceRoot: resolve21(request.fromWorkspaceRoot),
+    toWorkspaceRoot: resolve21(request.toWorkspaceRoot),
     toFleetId: request.toFleetId.trim()
   };
 }
@@ -9552,7 +10068,7 @@ async function requireManifest(request, stateKey, transport, label) {
     installationType: manifest.installationType,
     stateKey: manifest.stateKey
   });
-  if (manifest.adapter !== request.adapter || manifest.installationType !== request.installationType || resolve20(manifest.targetRoot) !== request.targetRoot || actualStateKey !== stateKey) {
+  if (manifest.adapter !== request.adapter || manifest.installationType !== request.installationType || resolve21(manifest.targetRoot) !== request.targetRoot || actualStateKey !== stateKey) {
     throw new Error(`${label} install manifest identity does not match the requested adapter, target, installation type, and state key.`);
   }
   return manifest;
@@ -9636,7 +10152,7 @@ function canonicalJson(value) {
 // src/version/policy.ts
 import { execFile as execFile3 } from "child_process";
 import { readFile as readFile23 } from "fs/promises";
-import { join as join39, resolve as resolve21 } from "path";
+import { join as join39, resolve as resolve22 } from "path";
 import { promisify as promisify3 } from "util";
 import { parse as parseJsonc } from "jsonc-parser";
 import { z as z5 } from "zod";
@@ -9730,7 +10246,7 @@ async function discoverVersionsFromSource(pkg, workspaceRoot) {
     if (tagged.length > 0) return tagged;
   }
   if (driverName === "local") {
-    const root = resolve21(workspaceRoot, pkg.source);
+    const root = resolve22(workspaceRoot, pkg.source);
     const manifest2 = await readPackageManifest(root);
     const current = manifest2 ? [{ version: manifest2.version, ref: pkg.requestedRef ?? root }] : [];
     try {
@@ -9853,7 +10369,7 @@ async function readVersionCache(path) {
 // src/profile/members.ts
 import { execFile as execFile4 } from "child_process";
 import { readFile as readFile24 } from "fs/promises";
-import { join as join40, resolve as resolve22 } from "path";
+import { join as join40, resolve as resolve23 } from "path";
 import { promisify as promisify4 } from "util";
 import { z as z7 } from "zod";
 
@@ -10028,7 +10544,7 @@ async function invokeMemberStatus(member, parentWorkspace, chain, options, cliEn
   let stderr = "";
   try {
     if (member.transport === "local") {
-      const workspace = resolve22(parentWorkspace, member.workspace);
+      const workspace = resolve23(parentWorkspace, member.workspace);
       const result = await execFileAsync4(process.execPath, [cliEntry, ...args], {
         cwd: workspace,
         env: env2,
@@ -10074,7 +10590,7 @@ async function runMemberAgentwheel(member, parentWorkspace, args, chain) {
         process.execPath,
         [process.argv[1], ...memberCommandArgs(member, args)],
         {
-          cwd: resolve22(parentWorkspace, member.workspace),
+          cwd: resolve23(parentWorkspace, member.workspace),
           env: env2,
           maxBuffer: 20 * 1024 * 1024
         }
@@ -10180,7 +10696,7 @@ function assertNoCompositeCycle(workspaceRoot, profileName, chain) {
   }
 }
 function compositeKey(workspaceRoot, profileName) {
-  return `${resolve22(workspaceRoot)}#${profileName}`;
+  return `${resolve23(workspaceRoot)}#${profileName}`;
 }
 
 // src/status/repository.ts
@@ -11105,9 +11621,9 @@ function readSkillFrontmatter(content, artifact) {
 
 // src/lifecycle/fleet-normalize.ts
 import { createHash as createHash13 } from "crypto";
-import { readFile as readFile27, readdir as readdir9, rm as rm9 } from "fs/promises";
+import { readFile as readFile27, readdir as readdir10, rm as rm9 } from "fs/promises";
 import { homedir as homedir11 } from "os";
-import { basename as basename19, isAbsolute as isAbsolute3, join as join44, relative as relative8, resolve as resolve23 } from "path";
+import { dirname as dirname21, isAbsolute as isAbsolute3, join as join44, relative as relative8, resolve as resolve24 } from "path";
 async function planFleetNormalization(request) {
   const normalizedRequest = normalizeRequest2(request);
   const destinationScope = await resolveWorkspaceScope({
@@ -11378,17 +11894,17 @@ function normalizeRequest2(request) {
     ...profile ? { profile } : {},
     ...agent ? { agent } : {},
     ...orphanedOwnerRoots ? { orphanedOwnerRoots } : {},
-    ...request.globalRoot ? { globalRoot: resolve23(request.globalRoot) } : {}
+    ...request.globalRoot ? { globalRoot: resolve24(request.globalRoot) } : {}
   };
 }
 function normalizeOrphanedOwnerRoot(value) {
   const root = value.trim();
   if (!root || !isAbsolute3(root)) throw new Error(`Invalid orphaned owner root '${value}'; expected an absolute workspace path.`);
-  return resolve23(root);
+  return resolve24(root);
 }
 async function normalizationRoots(request) {
   const destination = await showRegisteredFleet(request.destinationFleet, { globalRoot: request.globalRoot });
-  const source = request.from === "user" ? resolve23(request.globalRoot ?? homedir11()) : (await showRegisteredFleet(request.from.slice("fleet:".length), { globalRoot: request.globalRoot })).root;
+  const source = request.from === "user" ? resolve24(request.globalRoot ?? homedir11()) : (await showRegisteredFleet(request.from.slice("fleet:".length), { globalRoot: request.globalRoot })).root;
   return { source, destination: destination.root };
 }
 async function withOrderedLocks(roots, fn) {
@@ -11454,11 +11970,28 @@ async function inspectInstalledState(source, destination, packageNames) {
   const coveredDestinationGraphs = /* @__PURE__ */ new Set();
   const plannedDestinationGraphs = /* @__PURE__ */ new Set();
   for (const sourceGraph of sourceGraphs) {
-    const sourceState = await targetStateForGraph(source, sourceGraph);
-    const destinationState = await targetStateForGraph(destination, sourceGraph);
-    if (sourceState.graphLockPath !== sourceGraph.path) {
-      throw new Error(`Source graph lock target identity is stale or noncanonical: ${sourceGraph.path}`);
+    const sourceState = await installedTargetStateForGraph(
+      source,
+      sourceGraph,
+      manifests,
+      sourceOwners,
+      selected
+    );
+    const destinationStableState = await targetStateForGraph(destination, sourceGraph);
+    const matchingDestinationGraphs = destinationGraphs.filter((candidate) => candidate.targetKey === sourceGraph.targetKey && candidate.adapter === sourceGraph.adapter);
+    if (matchingDestinationGraphs.length > 1) {
+      throw new Error(
+        `Ambiguous destination graph state for target '${sourceGraph.targetKey}': ` + matchingDestinationGraphs.map((candidate) => candidate.path).join(", ")
+      );
     }
+    const destinationGraph = matchingDestinationGraphs[0];
+    const destinationState = destinationGraph ? await installedTargetStateForGraph(
+      destination,
+      destinationGraph,
+      manifests,
+      destinationOwners,
+      selected
+    ) : destinationStableState;
     if (sourceState.adapter !== destinationState.adapter) {
       throw new Error(`Source and destination adapters diverge for target '${sourceGraph.targetKey}'.`);
     }
@@ -11467,7 +12000,6 @@ async function inspectInstalledState(source, destination, packageNames) {
       throw new Error(`Source graph lock is not covered by its canonical install manifest: ${sourceState.manifestPath}`);
     }
     const sourceGraphArtifacts = new Set(sourceGraph.artifactIdentities);
-    const destinationGraph = destinationGraphs.find((candidate) => candidate.path === destinationState.graphLockPath);
     if (destinationGraph && destinationGraph.digest !== sourceGraph.digest) {
       throw new Error("Source and destination graph declarations, selections, versions, identities, or rendered paths diverge.");
     }
@@ -11585,16 +12117,30 @@ async function inspectLegacySelfInstalledState(fleet, packageNames, profileName,
   const transferableOwners = orphanedOwners.size > 0 ? orphanedOwners : /* @__PURE__ */ new Set([legacyOwner]);
   let normalizedGraphCount = 0;
   for (const graph of graphCandidates) {
+    const destinationState = await targetStateForGraph(fleet, graph, fleet.fleetId);
+    if (resolve24(destinationState.graphLockPath) === resolve24(graph.path)) {
+      const destinationManifest = (await collectManifestPaths([destinationState.manifestPath]))[0];
+      if (destinationManifest?.manifest.entries.some((entry) => entry.workspaceOwner === fleetOwner && entryMatchesPackages(entry, selected))) {
+        assertCorrelatedGraphManifest(
+          graph,
+          destinationState,
+          destinationManifest,
+          /* @__PURE__ */ new Set([fleetOwner]),
+          selected
+        );
+        normalizedGraphCount += 1;
+        continue;
+      }
+    }
     const legacyState = await legacyTargetStateForGraph(fleet, graph);
+    if (resolve24(legacyState.graphLockPath) !== resolve24(graph.path)) {
+      throw new Error(`Legacy graph lock target identity is stale or noncanonical: ${graph.path}`);
+    }
     const legacyManifest = (await collectManifestPaths([legacyState.manifestPath]))[0];
     const relevantManifestEntries2 = legacyManifest?.manifest.entries.filter((entry) => entryMatchesGraphPackages(entry, graph.lock, selected) && entryMatchesArtifacts(entry, selectedArtifacts)) ?? [];
     if (relevantManifestEntries2.length > 0) {
       graphs.push(graph);
     }
-    const destinationState = await targetStateForGraph(fleet, graph, fleet.fleetId);
-    if (destinationState.graphLockPath === graph.path && legacyManifest?.manifest.entries.some((entry) => entry.workspaceOwner === fleetOwner && entryMatchesPackages(entry, selected))) {
-      normalizedGraphCount += 1;
-    }
   }
   if (graphs.length === 0 && normalizedGraphCount > 0) {
     throw new Error(`Fleet '${fleet.fleetId}' installed state is already normalized to fleet-qualified ownership.`);
@@ -11762,7 +12308,7 @@ function targetKeysForAgent(scope, name) {
 async function runtimeRoots(scope) {
   const roots = /* @__PURE__ */ new Set([scope.root]);
   if (scope.config.packages.some((pkg) => pkg.installationType === "user") || Object.values(scope.config.agents).some((agent) => agent.installationType === "user")) {
-    roots.add(resolve23(process.env.AGENTWHEEL_TEST_HOME || process.env.HOME || homedir11()));
+    roots.add(resolve24(process.env.AGENTWHEEL_TEST_HOME || process.env.HOME || homedir11()));
   }
   for (const [name, agent] of Object.entries(scope.config.agents)) {
     if (agent.transport === "ssh") throw new Error(`Installed-state normalization cannot inspect SSH agent '${name}' locally.`);
@@ -11783,7 +12329,7 @@ async function collectManifests(roots) {
     const dir = join44(root, ".agentwheel");
     let names;
     try {
-      names = await readdir9(dir);
+      names = await readdir10(dir);
     } catch (error) {
       if (isMissing(error)) continue;
       throw error;
@@ -11799,14 +12345,14 @@ async function collectManifests(roots) {
         }
         continue;
       }
-      if (resolve23(parsed.targetRoot) !== resolve23(root)) {
+      if (resolve24(parsed.targetRoot) !== resolve24(root)) {
         throw new Error(`Install manifest target root does not match its enumerated runtime root: ${path}`);
       }
       const expectedPath = installManifestPath(parsed.targetRoot, parsed.adapter, {
         installationType: parsed.installationType,
         stateKey: parsed.stateKey
       });
-      if (resolve23(expectedPath) !== resolve23(path)) {
+      if (resolve24(expectedPath) !== resolve24(path)) {
         throw new Error(`Install manifest state identity does not match its canonical path: ${path}`);
       }
       found.set(path, { path, raw, manifest: { ...parsed, revision: computeManifestRevision(raw), legacy: false } });
@@ -11827,7 +12373,7 @@ async function collectManifestPaths(paths) {
       installationType: parsed.installationType,
       stateKey: parsed.stateKey
     });
-    if (resolve23(expectedPath) !== resolve23(path)) {
+    if (resolve24(expectedPath) !== resolve24(path)) {
       throw new Error(`Install manifest state identity does not match its canonical path: ${path}`);
     }
     found.push({ path, raw, manifest: { ...parsed, revision: computeManifestRevision(raw), legacy: false } });
@@ -11855,12 +12401,8 @@ async function relevantGraphLocks(workspaceRoot, selected, targetKeys, include)
     if (!lock.canonical.roots.some((candidate2) => selected.has(candidate2.rootId))) continue;
     const parts = relative8(root, path).split(/[\\/]/);
     if (parts.length !== 3) throw new Error(`Graph lock path is not canonical: ${path}`);
-    const [targetKey2, adapter, fileName] = parts;
+    const [targetKey2, adapter] = parts;
     if (targetKeys && !targetKeys.has(targetKey2)) continue;
-    const pathFingerprint = basename19(fileName, ".graph-lock.json");
-    if (!lock.canonical.targetFingerprint || lock.canonical.targetFingerprint !== pathFingerprint) {
-      throw new Error(`Graph lock fingerprint does not match its canonical path: ${path}`);
-    }
     const candidate = {
       path,
       lock,
@@ -11889,9 +12431,19 @@ function isCurrentLocalTarget(scope, graph) {
 }
 async function hasRelevantLegacyManifestCandidate(scope, graph, selected) {
   if (!isCurrentLocalTarget(scope, graph)) return false;
-  const manifestPath = await legacyManifestPathForConfiguredTarget(scope, graph) ?? (await legacyTargetStateForGraph(scope, graph)).manifestPath;
-  const manifest = (await collectManifestPaths([manifestPath]))[0];
-  return manifest?.manifest.entries.some((entry) => entryMatchesGraphPackages(entry, graph.lock, selected)) ?? false;
+  const configuredLegacyPath = await legacyManifestPathForConfiguredTarget(scope, graph);
+  if (configuredLegacyPath) {
+    const manifest = (await collectManifestPaths([configuredLegacyPath]))[0];
+    if (manifest?.manifest.entries.some((entry) => entryMatchesGraphPackages(entry, graph.lock, selected))) return true;
+  }
+  if (graph.lock.canonical.roots.some((root) => !scope.config.packages.some((pkg) => pkg.name === root.rootId))) return false;
+  const legacyState = await legacyTargetStateForGraph(scope, graph);
+  const legacyManifest = (await collectManifestPaths([legacyState.manifestPath]))[0];
+  if (legacyManifest?.manifest.entries.some((entry) => entryMatchesGraphPackages(entry, graph.lock, selected))) return true;
+  const stableState = await targetStateForGraph(scope, graph, scope.fleetId ?? null);
+  if (resolve24(stableState.graphLockPath) !== resolve24(graph.path)) return false;
+  const stableManifest = (await collectManifestPaths([stableState.manifestPath]))[0];
+  return stableManifest?.manifest.entries.some((entry) => entryMatchesGraphPackages(entry, graph.lock, selected)) ?? false;
 }
 async function legacyManifestPathForConfiguredTarget(scope, graph) {
   const agent = scope.config.agents[graph.targetKey];
@@ -11910,9 +12462,10 @@ async function legacyManifestPathForConfiguredTarget(scope, graph) {
     baseDir: scope.root
   });
   const targetRoot = resolveConfigPath(agent.root, scope.root);
-  const installRoot = resolve23(installRootForAdapterInstallationType(adapter, targetRoot, agent.installationType, false));
+  const installRoot = resolve24(installRootForAdapterInstallationType(adapter, targetRoot, agent.installationType, false));
   const stateKey = stateKeyFor(adapter.name, {
     installationType: agent.installationType,
+    stateKey: agent.stateKey,
     targetFingerprint: graph.lock.canonical.targetFingerprint
   });
   return installManifestPath(installRoot, adapter.name, { installationType: agent.installationType, stateKey });
@@ -11977,14 +12530,21 @@ async function targetStateForGraph(scope, graph, identityFleetId = scope.fleetId
     ssh: void 0,
     ...agent?.stateKey ? { stateKey: agent.stateKey } : {}
   };
-  const targetFingerprint = computeTargetFingerprint(fingerprintParts);
+  const installRoot = resolve24(installRootForAdapterInstallationType(adapter, targetRoot, installationType, false));
+  const targetIdentity = resolveTargetStateIdentity({
+    targetFingerprintParts: fingerprintParts,
+    workspaceRoot: scope.root,
+    targetKey: graph.targetKey,
+    resolvedInstallRoot: installRoot,
+    transportKind: "local"
+  });
+  const targetFingerprint = targetIdentity.targetFingerprint;
   const stateKey = stateKeyFor(adapter.name, {
     installationType,
     stateKey: agent?.stateKey,
-    targetFingerprint,
+    targetFingerprint: targetIdentity.stateFingerprint,
     ...identityFleetId ? { fleetId: identityFleetId } : {}
   });
-  const installRoot = resolve23(installRootForAdapterInstallationType(adapter, targetRoot, installationType, false));
   return {
     adapter: adapter.name,
     installationType,
@@ -11992,28 +12552,81 @@ async function targetStateForGraph(scope, graph, identityFleetId = scope.fleetId
     installRoot,
     stateKey,
     targetFingerprint,
-    graphLockPath: graphLockPathForTarget(scope.root, graph.targetKey, adapter.name, fingerprintParts),
+    graphLockPath: graphLockPathForTarget(scope.root, graph.targetKey, adapter.name, fingerprintParts, {
+      resolvedInstallRoot: installRoot,
+      transportKind: "local"
+    }),
     manifestPath: installManifestPath(installRoot, adapter.name, { installationType, stateKey })
   };
 }
-async function legacyTargetStateForGraph(scope, graph) {
-  const current = await targetStateForGraph(scope, graph, null);
+async function installedTargetStateForGraph(scope, graph, manifests, owners, selected, identityFleetId = scope.fleetId ?? null) {
+  const stable = await targetStateForGraph(scope, graph, identityFleetId);
+  let state;
+  if (resolve24(graph.path) === resolve24(stable.graphLockPath)) {
+    state = stable;
+  } else {
+    const released = await releasedTargetStateForGraph(scope, graph, identityFleetId);
+    if (resolve24(graph.path) !== resolve24(released.graphLockPath)) {
+      throw new Error(`Graph lock target identity is stale or noncanonical: ${graph.path}`);
+    }
+    state = released;
+  }
+  const manifest = manifests.find((candidate) => resolve24(candidate.path) === resolve24(state.manifestPath));
+  if (!manifest) {
+    throw new Error(`Graph lock is not covered by its canonical install manifest: ${state.manifestPath}`);
+  }
+  assertCorrelatedGraphManifest(graph, state, manifest, owners, selected);
+  return state;
+}
+async function releasedTargetStateForGraph(scope, graph, identityFleetId = scope.fleetId ?? null) {
+  const current = await targetStateForGraph(scope, graph, identityFleetId);
   const targetFingerprint = graph.lock.canonical.targetFingerprint;
+  if (!targetFingerprint || !/^[a-f0-9]{64}$/u.test(targetFingerprint)) {
+    throw new Error(`Released graph lock has an invalid target fingerprint: ${graph.path}`);
+  }
+  const agent = scope.config.agents[graph.targetKey];
   const stateKey = stateKeyFor(current.adapter, {
     installationType: current.installationType,
-    targetFingerprint
+    stateKey: agent?.stateKey,
+    targetFingerprint,
+    ...identityFleetId ? { fleetId: identityFleetId } : {}
   });
   return {
     ...current,
     stateKey,
     targetFingerprint,
-    graphLockPath: graph.path,
+    graphLockPath: join44(dirname21(graph.path), `${targetFingerprint}.graph-lock.json`),
     manifestPath: installManifestPath(current.installRoot, current.adapter, {
       installationType: current.installationType,
       stateKey
     })
   };
 }
+function assertCorrelatedGraphManifest(graph, state, manifest, owners, selected) {
+  if (manifest.manifest.adapter !== state.adapter || manifest.manifest.installationType !== state.installationType || manifest.manifest.stateKey !== state.stateKey || resolve24(manifest.manifest.targetRoot) !== resolve24(state.installRoot)) {
+    throw new Error(`Install manifest identity does not match graph target state: ${manifest.path}`);
+  }
+  const entries = manifest.manifest.entries.filter((entry) => entryMatchesGraphPackages(entry, graph.lock, selected));
+  if (entries.length === 0) {
+    throw new Error(`Graph lock is not covered by selected install-manifest contributions: ${graph.path}`);
+  }
+  const graphArtifacts = new Set(graph.artifactIdentities);
+  const graphLockDigest = sha2564(canonicalJson2(graph.lock));
+  for (const entry of entries) {
+    if (!owners.has(entry.workspaceOwner)) {
+      throw new Error(`Graph lock manifest owner mismatch at ${manifest.path}: ${entry.workspaceOwner}.`);
+    }
+    if (!graphArtifacts.has(graphEntryIdentity(entry))) {
+      throw new Error(`Install manifest entry is not covered by its graph lock: ${renderedEntryPath(manifest.manifest, entry)}`);
+    }
+    if (entry.graphLockDigest !== void 0 && entry.graphLockDigest !== graphLockDigest) {
+      throw new Error(`Install manifest graph-lock digest does not match ${graph.path}.`);
+    }
+  }
+}
+async function legacyTargetStateForGraph(scope, graph) {
+  return releasedTargetStateForGraph(scope, graph, null);
+}
 function assertGraphIsSubset(source, destination) {
   const sourceRoots = new Map(source.lock.canonical.roots.map((root) => [root.rootId, canonicalJson2(root)]));
   for (const root of destination.lock.canonical.roots) {
@@ -12047,7 +12660,7 @@ function destinationGraphFromSource(source, targetFingerprint) {
 function mergeDestinationManifest(existing, state, generatedAt, desiredEntries, replaceOwners = /* @__PURE__ */ new Set()) {
   if (existing) {
     const manifest2 = existing.manifest;
-    if (manifest2.adapter !== state.adapter || manifest2.installationType !== state.installationType || manifest2.stateKey !== state.stateKey || resolve23(manifest2.targetRoot) !== state.installRoot) {
+    if (manifest2.adapter !== state.adapter || manifest2.installationType !== state.installationType || manifest2.stateKey !== state.stateKey || resolve24(manifest2.targetRoot) !== state.installRoot) {
       throw new Error(`Destination manifest identity diverges from the derived target: ${existing.path}`);
     }
   }
@@ -12107,7 +12720,7 @@ async function assertEquivalentRuntimeState(entry, sourcePath, destinationPath)
       const content = await readFile27(path, "utf8");
       if (hasMergeRemovalContent(entry.mergeRemoval)) {
         assertExactMergeContribution(entry.mergeRemoval, entry.mergeStrategy, content);
-      } else if (resolve23(sourcePath) === resolve23(destinationPath) && entry.mergeStrategy !== "codex-toml-mcp") {
+      } else if (resolve24(sourcePath) === resolve24(destinationPath) && entry.mergeStrategy !== "codex-toml-mcp") {
         assertExactMergeContribution({}, entry.mergeStrategy, content);
       } else {
         throw new Error(`Installed-state normalization cannot prove incomplete merge ownership at ${path}.`);
@@ -12118,8 +12731,8 @@ async function assertEquivalentRuntimeState(entry, sourcePath, destinationPath)
   await assertEquivalentRuntimeBytes(sourcePath, destinationPath, entry.hash);
 }
 function renderedEntryPathForRoot(root, entryPath) {
-  const normalizedRoot = resolve23(root);
-  const candidate = resolve23(normalizedRoot, entryPath);
+  const normalizedRoot = resolve24(root);
+  const candidate = resolve24(normalizedRoot, entryPath);
   if (candidate !== normalizedRoot && !candidate.startsWith(`${normalizedRoot}/`)) {
     throw new Error(`Install manifest entry escapes its target root: ${entryPath}`);
   }
@@ -12210,8 +12823,8 @@ function ownerMatchesGraphPackage(lock, owner, selected) {
   return ownerMatchesPackage(owner, selected) || lock.canonical.roots.some((root) => selected.has(root.rootId) && root.graphNodeId === owner);
 }
 function renderedEntryPath(manifest, entry) {
-  const root = resolve23(manifest.targetRoot);
-  const candidate = resolve23(root, entry.path);
+  const root = resolve24(manifest.targetRoot);
+  const candidate = resolve24(root, entry.path);
   if (candidate !== root && !candidate.startsWith(`${root}/`)) {
     throw new Error(`Install manifest entry escapes its target root: ${entry.path}`);
   }
@@ -12918,11 +13531,11 @@ program.command("deps").description("inspect the OpenPack dependency graph").add
     const normalizedOptions = normalizeRuntimeScopeOptions(options);
     const targets = await resolveCliTargets(normalizedOptions);
     for (const target of targets) {
-      const { lock, adapter } = await readTargetGraphLock(target, normalizedOptions);
-      const installationType = normalizedOptions.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
-      const state = installStateForTarget(target, adapter, normalizedOptions, installationType);
-      const manifest = await readInstallManifest(state.installRoot, adapter.name, transportForTarget(target), state);
-      console.log(formatDepsWhy(lock, manifest, selector));
+      const state = await resolveCliTargetState(target, normalizedOptions);
+      if (!state.graphLock) {
+        throw new Error(`No graph lock for ${state.adapter.name} at ${target.targetRoot}: ${state.stableGraphLockPath}`);
+      }
+      console.log(formatDepsWhy(state.graphLock, state.manifest, selector));
     }
   })
 );
@@ -13013,19 +13626,23 @@ ownershipCommand.command("handoff").description("transfer one managed artifact b
     throw new Error(`Ownership handoff selector must be exactly type/name: ${selector}`);
   }
   const target = targets[0];
-  const adapterOptions = adapterOptionsForTarget(target, normalizedOptions);
-  const adapter = await resolveAdapterForTarget(target, adapterOptions);
-  const installationType = normalizedOptions.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
-  const state = installStateForTarget(target, adapter, adapterOptions, installationType);
+  const state = await resolveCliTargetState(target, normalizedOptions);
+  const { adapter, installationType } = state;
+  if (state.migration) {
+    throw new Error(
+      "Migrate the target state before ownership handoff by running a full agentwheel install for this target."
+    );
+  }
   const toWorkspaceRoot = normalizeCliPath(options.toWorkspaceRoot);
   if (options.toFleet) {
     const fleet = await showRegisteredFleet(options.toFleet);
-    if (resolve24(fleet.root) !== resolve24(toWorkspaceRoot)) {
+    if (resolve25(fleet.root) !== resolve25(toWorkspaceRoot)) {
       throw new Error(`Destination fleet '${options.toFleet}' is registered at ${fleet.root}, not ${toWorkspaceRoot}.`);
     }
   }
   const request = {
-    ...state,
+    installationType,
+    stateKey: state.stableStateKey,
     targetRoot: state.installRoot,
     adapter: adapter.name,
     artifactType,
@@ -13049,7 +13666,7 @@ ownershipCommand.command("retire-stale").description("retire stale source-manife
   const normalizedOptions = normalizeRuntimeScopeOptions(options);
   const fleet = await showRegisteredFleet(options.fleet);
   const toWorkspaceRoot = normalizeCliPath(options.toWorkspaceRoot);
-  if (resolve24(fleet.root) !== resolve24(toWorkspaceRoot)) {
+  if (resolve25(fleet.root) !== resolve25(toWorkspaceRoot)) {
     throw new Error(`Destination Fleet '${options.fleet}' is registered at ${fleet.root}, not ${toWorkspaceRoot}.`);
   }
   const targets = await resolveCliTargets(normalizedOptions);
@@ -13057,19 +13674,22 @@ ownershipCommand.command("retire-stale").description("retire stale source-manife
     throw new Error(`Stale ownership retirement requires exactly one destination Fleet target, found ${targets.length}.`);
   }
   const target = targets[0];
-  if (target.fleetId !== options.fleet || resolve24(target.workspaceRoot) !== resolve24(fleet.root)) {
+  if (target.fleetId !== options.fleet || resolve25(target.workspaceRoot) !== resolve25(fleet.root)) {
     throw new Error(`Resolved target does not belong to destination Fleet '${options.fleet}'.`);
   }
-  const adapterOptions = adapterOptionsForTarget(target, normalizedOptions);
-  const adapter = await resolveAdapterForTarget(target, adapterOptions);
-  const installationType = normalizedOptions.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
-  const state = installStateForTarget(target, adapter, adapterOptions, installationType);
+  const state = await resolveCliTargetState(target, normalizedOptions);
+  const { adapter, installationType } = state;
+  if (state.migration) {
+    throw new Error(
+      "Migrate the target state before ownership retirement by running a full agentwheel install for this target."
+    );
+  }
   const request = {
     targetRoot: state.installRoot,
     adapter: adapter.name,
     installationType,
     sourceStateKey: options.sourceStateKey,
-    destinationStateKey: state.stateKey,
+    destinationStateKey: state.stableStateKey,
     fromWorkspaceRoot: normalizeCliPath(options.fromWorkspaceRoot),
     toWorkspaceRoot,
     toFleetId: fleet.id,
@@ -13154,13 +13774,18 @@ program.command("uninstall").description("remove configured packages or managed
     const adapter = await resolveAdapterForTarget(target, adapterOptions);
     const transport = transportForTarget(target);
     const installationType = normalizedOptions.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
-    const state = installStateForTarget(target, adapter, adapterOptions, installationType);
-    const manifest = await readInstallManifest(state.installRoot, adapter.name, transport, state);
+    const state = await resolveCliTargetState(target, normalizedOptions);
+    const manifest = state.manifest;
     if (!manifest) {
       console.log(`No install manifest for ${adapter.name}/${installationType} at ${state.installRoot}`);
       continue;
     }
-    const plan = filterUninstallPlanBySelection(await createUninstallPlan(manifest), selectedArtifactsFromOptions(options));
+    const plan = {
+      ...filterUninstallPlanBySelection(await createUninstallPlan(manifest), selectedArtifactsFromOptions(options)),
+      stateKey: state.stableStateKey,
+      stateMigration: state.migration,
+      targetStateFilePreconditions: state.targetStateFilePreconditions
+    };
     console.log(formatPlan(plan));
     const result = await uninstall(plan, { dryRun: normalizedOptions.dryRun, force: normalizedOptions.force, transport });
     if (!normalizedOptions.dryRun) {
@@ -13622,15 +14247,12 @@ async function packageSelectsSkillForTarget(target, pkg, selector, options) {
   if (explicitSelection && !explicitSelection.some((candidate) => candidate === selector)) return false;
   const groups = /* @__PURE__ */ new Map();
   const group = graphGroupForPackage(groups, target, pkg, options);
-  const adapter = await resolveAdapterForTarget(group.target, group.adapterOptions);
-  const graphLockPath = graphLockPathForTarget(
-    group.target.workspaceRoot,
-    targetKeyForTarget(group.target, adapter.name),
-    adapter.name,
-    targetFingerprintParts(group.target, adapter, group.adapterOptions, group.installationType)
-  );
-  if (await pathExists(graphLockPath)) {
-    const lock = await readGraphLock(graphLockPath);
+  const state = await resolveCliTargetState(group.target, {
+    ...options,
+    installationType: group.installationType
+  });
+  if (state.graphLock) {
+    const lock = state.graphLock;
     const root = lock.canonical.roots.find((candidate) => candidate.rootId === pkg.name);
     if (root?.selected.includes(selector)) return true;
   }
@@ -13933,13 +14555,30 @@ async function buildGraphPlansForTarget(target, source, options, behavior) {
     const allPackages = [...group.packages, ...group.extraPackages];
     const groupHasScope = !scopedRootId || allPackages.some((pkg) => pkg.name === scopedRootId || pkg.source === targetOptions.scope);
     if (behavior.mode === "install" && scopedRootId && !groupHasScope) continue;
-    const groupGraphLockPath = graphLockPathForTarget(
-      group.target.workspaceRoot,
-      targetKeyForTarget(group.target, adapter.name),
-      adapter.name,
-      targetFingerprintParts(group.target, adapter, group.adapterOptions, group.installationType)
-    );
-    const previousGroupLock = await (await pathExists(groupGraphLockPath) ? readGraphLock(groupGraphLockPath) : void 0);
+    if (behavior.readOnly !== true && targetOptions.dryRun !== true) {
+      const pendingState = await journalStateForTarget(group.target, {
+        ...targetOptions,
+        installationType: group.installationType
+      });
+      if (await readApplyJournal(
+        pendingState.installRoot,
+        pendingState.adapter.name,
+        pendingState.transport,
+        pendingState.state
+      )) {
+        await recoverPendingApply(
+          pendingState.installRoot,
+          pendingState.adapter.name,
+          pendingState.transport,
+          pendingState.state
+        );
+      }
+    }
+    const priorGroupState = await resolveCliTargetState(group.target, {
+      ...targetOptions,
+      installationType: group.installationType
+    });
+    const previousGroupLock = priorGroupState.graphLock;
     const dependencyUpdateRootNames = /* @__PURE__ */ new Set();
     if (scopedDependencyUpdate) {
       for (const pkg of group.packages) {
@@ -14049,14 +14688,14 @@ async function buildGraphPlansForTarget(target, source, options, behavior) {
       expectedFromWorkspaceOwner: targetOptions.expectedFromWorkspaceOwner
     });
     if ((behavior.mode === "install" || behavior.mode === "update") && scopedRootId) {
-      const state = installStateForTarget(group.target, adapter, group.adapterOptions, group.installationType);
-      const manifest = await readInstallManifest(state.installRoot, adapter.name, transport, state);
-      const scopedResult = targetOptions.focusedArtifact ? previousGroupLock ? scopeUpdatePlanToArtifact(result, scopedRootId, targetOptions.focusedArtifact, previousGroupLock, manifest) : scopeInstallPlanToArtifact(result, scopedRootId, targetOptions.focusedArtifact, manifest) : previousGroupLock ? scopeUpdatePlanToRoot(result, scopedRootId, previousGroupLock, manifest) : scopeInstallPlanToRoot(result, scopedRootId, manifest);
+      const manifest = result.previousManifest;
+      const previousLock = result.previousGraphLock;
+      const scopedResult = targetOptions.focusedArtifact ? previousLock ? scopeUpdatePlanToArtifact(result, scopedRootId, targetOptions.focusedArtifact, previousLock, manifest) : scopeInstallPlanToArtifact(result, scopedRootId, targetOptions.focusedArtifact, manifest) : previousLock ? scopeUpdatePlanToRoot(result, scopedRootId, previousLock, manifest) : scopeInstallPlanToRoot(result, scopedRootId, manifest);
       if (targetOptions.focusedArtifact && targetOptions.forceForeignState !== true) {
         const focusedPaths = scopedResult.plan.operations.filter((operation) => operationMatchesFocusedArtifact(
           operation,
           targetOptions.focusedArtifact,
-          focusedArtifactOwnerKeys(result.bundle.graphLock, previousGroupLock, scopedRootId, targetOptions.focusedArtifact)
+          focusedArtifactOwnerKeys(result.bundle.graphLock, previousLock, scopedRootId, targetOptions.focusedArtifact)
         )).map((operation) => operation.relativeDestPath);
         const ownership = await resolveWorkspaceOwnershipScope(group.target.workspaceRoot, {
           fleetId: group.target.fleetId
@@ -14070,9 +14709,11 @@ async function buildGraphPlansForTarget(target, source, options, behavior) {
       }
       results.push(scopedResult);
     } else if (scopedDependencyUpdate) {
-      const state = installStateForTarget(group.target, adapter, group.adapterOptions, group.installationType);
-      const manifest = await readInstallManifest(state.installRoot, adapter.name, transport, state);
-      const previousLock = await readGraphLock(result.graphLockPath);
+      const manifest = result.previousManifest;
+      const previousLock = result.previousGraphLock;
+      if (!previousLock) {
+        throw new Error(`Dependency update requires an existing graph lock for ${adapter.name} at ${group.target.targetRoot}.`);
+      }
       results.push(scopeUpdatePlanToDependencies(result, dependencyUpdateSelectors, previousLock, manifest));
     } else {
       results.push(result);
@@ -14665,8 +15306,12 @@ async function uninstallConfiguredPackage(target, packageName, options) {
     const removedInstallationType = options.installationType ?? pkg.installationType ?? removedTarget.installationType ?? "local";
     const adapter = await resolveAdapterForTarget(removedTarget, removedAdapterOptions);
     const transport = transportForTarget(removedTarget);
-    const removedState = installStateForTarget(removedTarget, adapter, removedAdapterOptions, removedInstallationType);
-    const manifest = await readInstallManifest(removedState.installRoot, adapter.name, transport, removedState);
+    const removedState = await resolveCliTargetState(removedTarget, {
+      ...options,
+      ...removedAdapterOptions,
+      installationType: removedInstallationType
+    });
+    const manifest = removedState.manifest;
     if (!manifest) {
       console.log(`No install manifest for ${adapter.name} at ${removedTarget.targetRoot}`);
       continue;
@@ -14714,25 +15359,24 @@ async function uninstallConfiguredPackage(target, packageName, options) {
       remainingDesired = desiredArtifactsFromGraphBundle(result2.bundle);
       renderedRoot = result2.bundle.root;
     }
-    const plan = await createOwnershipUninstallPlan(manifest, remainingDesired, adapter, transport, { graphLockDigest: remainingGraphPlan?.graphLockDigest });
+    const uninstallPlan = await createOwnershipUninstallPlan(manifest, remainingDesired, adapter, transport, {
+      graphLockDigest: remainingGraphPlan?.graphLockDigest
+    });
+    const transitionPlan = remainingGraphPlan?.plan;
+    const plan = {
+      ...uninstallPlan,
+      stateKey: transitionPlan?.stateKey ?? removedState.stableStateKey,
+      stateMigration: transitionPlan?.stateMigration ?? removedState.migration,
+      targetStateFilePreconditions: transitionPlan?.targetStateFilePreconditions ?? removedState.targetStateFilePreconditions
+    };
     console.log(`Uninstall ${pkg.name} (${adapter.name} at ${removedTarget.targetRoot}):`);
     console.log(formatPlan(plan));
     const graphLockFinalState = remainingGraphPlan ? { graphLock: { path: remainingGraphPlan.graphLockPath, lock: remainingGraphPlan.bundle.graphLock } } : {
-      removeGraphLockPath: graphLockPathForTarget(
-        removedTarget.workspaceRoot,
-        targetKeyForTarget(removedTarget, adapter.name),
-        adapter.name,
-        targetFingerprintParts(removedTarget, adapter, removedAdapterOptions, removedInstallationType)
-      )
+      removeGraphLockPath: removedState.graphLockPath ?? removedState.stableGraphLockPath
     };
     if (!options.dryRun) {
       declareMutationPath(workspaceConfigPath(target.workspaceRoot));
-      const declarativeGraphPath = remainingGraphPlan ? remainingGraphPlan.graphLockPath : graphLockPathForTarget(
-        removedTarget.workspaceRoot,
-        targetKeyForTarget(removedTarget, adapter.name),
-        adapter.name,
-        targetFingerprintParts(removedTarget, adapter, removedAdapterOptions, removedInstallationType)
-      );
+      const declarativeGraphPath = remainingGraphPlan ? remainingGraphPlan.graphLockPath : removedState.graphLockPath ?? removedState.stableGraphLockPath;
       declareMutationPath(declarativeGraphPath);
     }
     const result = await uninstall(plan, {
@@ -14807,36 +15451,92 @@ function targetFingerprintParts(target, adapter, options, installationType) {
   };
 }
 function installStateForTarget(target, adapter, options, installationType) {
-  const targetFingerprint = targetFingerprintDigest(target, adapter, options, installationType);
+  const installRoot = installRootForAdapterInstallationType(adapter, target.targetRoot, installationType, target.transport === "ssh");
+  const targetIdentity = resolveTargetStateIdentity({
+    targetFingerprintParts: targetFingerprintParts(target, adapter, options, installationType),
+    workspaceRoot: target.workspaceRoot,
+    targetKey: targetKeyForTarget(target, adapter.name),
+    resolvedInstallRoot: installRoot,
+    transportKind: target.transport
+  });
   return {
     installationType,
     stateKey: stateKeyFor(adapter.name, {
       installationType,
       stateKey: target.stateKey,
-      targetFingerprint,
+      targetFingerprint: targetIdentity.stateFingerprint,
       fleetId: target.fleetId
     }),
-    installRoot: installRootForAdapterInstallationType(adapter, target.targetRoot, installationType, target.transport === "ssh")
+    installRoot
   };
 }
-function targetFingerprintDigest(target, adapter, options, installationType) {
-  const fingerprintInput = targetFingerprintParts(target, adapter, options, installationType);
-  return computeTargetFingerprint(fingerprintInput);
+function targetIdentityContext(target, adapter, installationType) {
+  return {
+    resolvedInstallRoot: installRootForAdapterInstallationType(
+      adapter,
+      target.targetRoot,
+      installationType,
+      target.transport === "ssh"
+    ),
+    transportKind: target.transport
+  };
 }
-async function readTargetGraphLock(target, options) {
+async function resolveCliTargetState(target, options) {
   const adapterOptions = adapterOptionsForTarget(target, options);
   const adapter = await resolveAdapterForTarget(target, adapterOptions);
+  const transport = transportForTarget(target);
   const installationType = options.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter, void 0);
-  const path = graphLockPathForTarget(
+  const stable = installStateForTarget(target, adapter, adapterOptions, installationType);
+  const stableGraphLockPath = graphLockPathForTarget(
     target.workspaceRoot,
     targetKeyForTarget(target, adapter.name),
     adapter.name,
-    targetFingerprintParts(target, adapter, adapterOptions, installationType)
+    targetFingerprintParts(target, adapter, adapterOptions, installationType),
+    targetIdentityContext(target, adapter, installationType)
   );
-  if (!await pathExists(path)) {
-    throw new Error(`No graph lock for ${adapter.name} at ${target.targetRoot}: ${path}`);
+  const [stableManifest, stableLock, stableSourceLock, ownership] = await Promise.all([
+    readInstallManifest(stable.installRoot, adapter.name, transport, stable),
+    pathExists(stableGraphLockPath).then((exists) => exists ? readGraphLock(stableGraphLockPath) : void 0),
+    readSourceLock(stable.installRoot, adapter.name, transport, stable),
+    resolveWorkspaceOwnershipScope(target.workspaceRoot, { fleetId: target.fleetId })
+  ]);
+  const prior = await resolvePriorTargetState({
+    adapter: adapter.name,
+    installationType,
+    stateKey: stable.stateKey,
+    explicitStateKey: target.stateKey,
+    fleetId: target.fleetId,
+    installRoot: stable.installRoot,
+    workspaceOwner: workspaceOwnerForRoot(ownership.root, ownership.fleetId),
+    graphLockPath: stableGraphLockPath,
+    stableManifest,
+    stableLock,
+    transport
+  });
+  return {
+    adapter,
+    installationType,
+    installRoot: stable.installRoot,
+    stateKey: prior.migration?.fromStateKey ?? stable.stateKey,
+    stableStateKey: stable.stateKey,
+    stableGraphLockPath,
+    manifest: prior.manifest,
+    graphLock: prior.graphLock,
+    graphLockPath: prior.graphLock ? prior.migration?.fromGraphLockPath ?? stableGraphLockPath : null,
+    migration: prior.migration,
+    targetStateFilePreconditions: {
+      graphLockPath: stableGraphLockPath,
+      graphLockRevision: stableLock ? createHash14("sha256").update(canonicalGraphLockJson(stableLock)).digest("hex") : null,
+      sourceLockRevision: computeSourceLockRevision(stableSourceLock)
+    }
+  };
+}
+async function readTargetGraphLock(target, options) {
+  const state = await resolveCliTargetState(target, options);
+  if (!state.graphLock || !state.graphLockPath) {
+    throw new Error(`No graph lock for ${state.adapter.name} at ${target.targetRoot}: ${state.stableGraphLockPath}`);
   }
-  return { adapter, path, lock: await readGraphLock(path) };
+  return { adapter: state.adapter, path: state.graphLockPath, lock: state.graphLock };
 }
 async function printStatus(target, options) {
   const report = await collectTargetStatus(target, options);
@@ -14844,30 +15544,24 @@ async function printStatus(target, options) {
 }
 async function collectTargetStatus(target, options) {
   const config = await readMergedWorkspaceConfig(target.workspaceRoot);
-  const adapterOptions = adapterOptionsForTarget(target, options);
-  const adapter = await resolveAdapterForTarget(target, { ...adapterOptions, warn: () => void 0 });
-  const transport = transportForTarget(target);
-  const installationType = options.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
-  const state = installStateForTarget(target, adapter, adapterOptions, installationType);
-  const manifest = await readInstallManifest(state.installRoot, adapter.name, transport, state);
-  let graphLockPath = null;
-  let graphLock;
-  try {
-    const result = await readTargetGraphLock(target, adapterOptions);
-    graphLockPath = result.path;
-    graphLock = result.lock;
-  } catch {
-    graphLock = void 0;
-  }
+  const state = await resolveCliTargetState(target, { ...options, warn: () => void 0 });
+  const { adapter, installationType, manifest, graphLock, graphLockPath } = state;
+  const pending = await collectPendingInstallWork(target, options);
+  const foreignObservations = pending.foreignStateObservations;
+  const effectiveGraphLock = graphLock ?? pending.observedGraphLock;
+  const observedManifestRevision = foreignObservations.length > 0 ? createHash14("sha256").update(JSON.stringify(foreignObservations.map((observation) => [
+    observation.fileName,
+    observation.manifestRevision
+  ]).sort())).digest("hex") : null;
   const packages = [];
   for (const pkg of config.packages) {
-    const root = graphLock?.canonical.roots.find((candidate) => candidate.rootId === pkg.name);
-    const node = root ? graphLock?.canonical.nodes.find((candidate) => candidate.id === root.graphNodeId) : void 0;
+    const root = effectiveGraphLock?.canonical.roots.find((candidate) => candidate.rootId === pkg.name);
+    const node = root ? effectiveGraphLock?.canonical.nodes.find((candidate) => candidate.id === root.graphNodeId) : void 0;
     const availability = await discoverPackageVersions(pkg, target.workspaceRoot, {
       forceRefresh: options.refresh,
       offline: options.offline
     });
-    const installed = node && manifest?.entries.some((entry) => "graphNodeId" in entry && entry.graphNodeId === node.id) ? node.version : null;
+    const installed = node && (manifest?.entries.some((entry) => "graphNodeId" in entry && entry.graphNodeId === node.id) || foreignObservations.some((observation) => observation.graphNodeId === node.id)) ? node.version : null;
     const locked = node?.version ?? null;
     const baseline = installed ?? locked;
     packages.push({
@@ -14890,14 +15584,13 @@ async function collectTargetStatus(target, options) {
       )
     });
   }
-  const pending = await collectPendingInstallWork(target, options);
-  const artifacts = (graphLock?.canonical.artifacts ?? []).map((artifact) => {
-    const node = graphLock?.canonical.nodes.find((candidate) => candidate.id === artifact.graphNodeId);
-    const installed = manifest?.entries.some((entry) => {
+  const artifacts = (effectiveGraphLock?.canonical.artifacts ?? []).map((artifact) => {
+    const node = effectiveGraphLock?.canonical.nodes.find((candidate) => candidate.id === artifact.graphNodeId);
+    const installed = (manifest?.entries.some((entry) => {
       if (!("graphNodeId" in entry) || entry.graphNodeId !== artifact.graphNodeId) return false;
       if ("logicalSelector" in entry && entry.logicalSelector) return entry.logicalSelector === artifact.logicalSelector;
       return entry.artifactType === artifact.type && entry.artifactName === artifact.name;
-    }) ?? false;
+    }) ?? false) || foreignObservations.some((observation) => observation.graphNodeId === artifact.graphNodeId && (!observation.logicalSelector || observation.logicalSelector === artifact.logicalSelector));
     return {
       selector: artifact.logicalSelector,
       type: artifact.type,
@@ -14910,7 +15603,7 @@ async function collectTargetStatus(target, options) {
     };
   });
   const health = [];
-  if (!manifest || !graphLock) health.push("FAIL");
+  if (!manifest && foreignObservations.length === 0 || !effectiveGraphLock) health.push("FAIL");
   if (pending.error) health.push("DEGRADED");
   if (pending.driftCount > 0 || pending.conflictCount > 0) health.push("FAIL");
   else if (pending.pendingCount > 0) health.push("WARN");
@@ -14921,11 +15614,11 @@ async function collectTargetStatus(target, options) {
     installationType,
     targetRoot: state.installRoot,
     health: worstStatusHealth(health),
-    manifestRevision: manifest?.revision ?? null,
-    manifestEntryCount: manifest?.entries.length ?? 0,
+    manifestRevision: manifest?.revision ?? observedManifestRevision,
+    manifestEntryCount: (manifest?.entries.length ?? 0) + foreignObservations.length,
     graphLockPath,
     packageCount: packages.length,
-    artifactCount: graphLock?.canonical.artifacts.length ?? 0,
+    artifactCount: effectiveGraphLock?.canonical.artifacts.length ?? 0,
     pendingCount: pending.pendingCount,
     driftCount: pending.driftCount,
     conflictCount: pending.conflictCount,
@@ -15103,7 +15796,7 @@ async function assertCompositeMutationSupported(workspaceRoot, profile, readOnly
         `Composite-profile mutation is refused before member execution because ${member.id} uses ${member.transport}; durable remote policy and recovery preflight is not implemented.`
       );
     }
-    const memberRoot = resolve24(workspaceRoot, member.workspace);
+    const memberRoot = resolve25(workspaceRoot, member.workspace);
     const memberPolicy = await mutationPolicyForWorkspace(memberRoot);
     if (memberPolicy?.revisioning.mode === "commit-after-verify") {
       throw new Error(
@@ -15260,9 +15953,34 @@ async function journalStateForTarget(target, options) {
   const adapterOptions = adapterOptionsForTarget(target, options);
   const adapter = await resolveAdapterForTarget(target, adapterOptions);
   const transport = transportForTarget(target);
-  const installationType = options.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
-  const state = installStateForTarget(target, adapter, adapterOptions, installationType);
-  return { adapter, transport, installationType, installRoot: state.installRoot, state };
+  const installationType = options.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter, void 0);
+  const stable = installStateForTarget(target, adapter, adapterOptions, installationType);
+  const graphLockPath = graphLockPathForTarget(
+    target.workspaceRoot,
+    targetKeyForTarget(target, adapter.name),
+    adapter.name,
+    targetFingerprintParts(target, adapter, adapterOptions, installationType),
+    targetIdentityContext(target, adapter, installationType)
+  );
+  const ownership = await resolveWorkspaceOwnershipScope(target.workspaceRoot, { fleetId: target.fleetId });
+  const pending = await discoverTargetApplyJournal({
+    adapter: adapter.name,
+    installationType,
+    stateKey: stable.stateKey,
+    explicitStateKey: target.stateKey,
+    fleetId: target.fleetId,
+    installRoot: stable.installRoot,
+    workspaceOwner: workspaceOwnerForRoot(ownership.root, ownership.fleetId),
+    graphLockPath,
+    transport
+  });
+  return {
+    adapter,
+    transport,
+    installationType,
+    installRoot: stable.installRoot,
+    state: { installationType, stateKey: pending?.stateKey ?? stable.stateKey }
+  };
 }
 async function collectPendingInstallWork(target, options) {
   let results = [];
@@ -15283,11 +16001,20 @@ async function collectPendingInstallWork(target, options) {
       pendingCount: pending.length,
       driftCount: counts.drift ?? 0,
       conflictCount: counts.conflict ?? 0,
-      counts
+      counts,
+      foreignStateObservations: results.flatMap((result) => result.foreignStateObservations),
+      observedGraphLock: results.length === 1 ? results[0].bundle.graphLock : void 0
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    return { pendingCount: 0, driftCount: 0, conflictCount: 0, counts: {}, error: message };
+    return {
+      pendingCount: 0,
+      driftCount: 0,
+      conflictCount: 0,
+      counts: {},
+      foreignStateObservations: [],
+      error: message
+    };
   } finally {
     await Promise.all(results.map((result) => rm10(result.bundle.root, { recursive: true, force: true })));
   }
@@ -15300,9 +16027,8 @@ async function printDoctor(target, options) {
   if (!targetMapping?.enabled) {
     throw new Error(`Adapter ${adapter.name} does not support skills for installation type '${installationType}'.`);
   }
-  const transport = transportForTarget(target);
-  const state = installStateForTarget(target, adapter, adapterOptions, installationType);
-  const manifest = await readInstallManifest(state.installRoot, adapter.name, transport, state);
+  const state = await resolveCliTargetState(target, { ...options, installationType });
+  const manifest = state.manifest;
   const requestedSkills = doctorSkillRequests(target, options);
   const skills = [];
   for (const request of requestedSkills) {
@@ -15554,14 +16280,14 @@ function looksLikeSourceSpecifier(value) {
 }
 function normalizeCliPath(value) {
   if (value === "~") return homedir12();
-  if (value.startsWith("~/")) return resolve24(homedir12(), value.slice(2));
-  return resolve24(value);
+  if (value.startsWith("~/")) return resolve25(homedir12(), value.slice(2));
+  return resolve25(value);
 }
 function shellQuoteArgument(value) {
   return /^[a-z0-9_./:@%+=,-]+$/i.test(value) ? value : `'${value.replace(/'/g, `'"'"'`)}'`;
 }
 function isHomePath(path) {
-  return resolve24(path) === resolve24(homedir12());
+  return resolve25(path) === resolve25(homedir12());
 }
 function adapterListFromOption(adapter) {
   if (!adapter) return [];
@@ -15682,7 +16408,7 @@ function withFleetExample(config) {
   };
 }
 async function findAgentwheelPackageRoot(start) {
-  let current = resolve24(start);
+  let current = resolve25(start);
   while (true) {
     if (await findPackageManifestPath(current, { warnLegacy: false })) return current;
     const parent = dirname22(current);