evolcore 0.0.28 → 0.0.29

package/dist/core/data-migration.js

@@ -1,12 +1,12 @@
 import crypto from 'crypto';
 import { execFileSync } from 'child_process';
 import fs from 'fs';
+import os from 'os';
 import path from 'path';
-import { formatChannelSessionKey, scanLegacyChatDirs, scanMetaFiles, scanNestedAgentChatDirs, scanNonCanonicalAgentChatDirs, } from './session/session-fs-store.js';
-import { rewriteLegacyTriggerSessionPaths } from '../trigger/legacy-session-history.js';
+import { formatChannelSessionKey, scanMetaFiles, scanNestedAgentChatDirs, scanNonCanonicalAgentChatDirs, } from './session/session-fs-store.js';
 const SESSION_SEEN_FILE = 'seen-messages.jsonl';
 const CHANNEL_TYPES = new Set(['aun', 'feishu', 'wechat', 'dingtalk', 'qqbot', 'wecom']);
-const DATA_MIGRATION_PLAN_VERSION = 3;
+const DATA_MIGRATION_PLAN_VERSION = 5;
 function encodeSegment(value) {
     return value.replace(/[<>:"/\\|?*\x00-\x1F%]/g, ch => '%' + ch.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'));
 }
@@ -62,32 +62,6 @@ function operationProofTopologyKey(operation) {
         source: operation.source,
     });
 }
-/**
- * Manifests written before allowExistingDestinationMerge was introduced still
- * need safe recovery. Re-derive that narrow permission from their immutable
- * source topology and the current owner-evidenced control identity; no other
- * destination conflict is relaxed.
- */
-function restoreLegacyControlMergeEligibility(manifest) {
-    const control = controlIdentity(manifest.root);
-    if (control.aids.size !== 1 || control.legacyAids.size === 0)
-        return;
-    const currentAid = control.aids.values().next().value;
-    const legacySessionsRoot = path.join(manifest.root, 'data', 'sessions', 'aun');
-    const expectedChannelKey = `aun#${currentAid}#main`;
-    const destinationRoot = path.join(manifest.root, 'agents', currentAid, 'sessions');
-    for (const operation of manifest.operations) {
-        if (operation.allowExistingDestinationMerge || operation.transform !== 'normalize-session-channel-key')
-            continue;
-        const relative = path.relative(legacySessionsRoot, operation.source);
-        const [legacyAid] = relative.split(path.sep);
-        if (!legacyAid || relative.startsWith(`..${path.sep}`) || !control.legacyAids.has(legacyAid))
-            continue;
-        if (operation.sessionChannelKey !== expectedChannelKey || !operation.destination || !isWithin(destinationRoot, operation.destination))
-            continue;
-        operation.allowExistingDestinationMerge = true;
-    }
-}
 function sessionDestination(root, aid, channelKey, channelId) {
     const channelType = channelKey === 'daemon' ? 'daemon' : channelKey.split('#', 1)[0]?.trim();
     if (!channelType)
@@ -97,8 +71,20 @@ function sessionDestination(root, aid, channelKey, channelId) {
 function channelStateDestination(root, channelKey, ...parts) {
     return path.join(root, 'data', 'channel-state', encodeURIComponent(channelKey), ...parts);
 }
-function triggerDestination(root, aid, ...parts) {
-    return path.join(root, 'agents', aid, 'triggers', ...parts);
+function agentDataDestination(root, aid, ...parts) {
+    return path.join(root, 'agents', aid, 'data', ...parts);
+}
+function contactOperationsDestination(root, aid) {
+    return agentDataDestination(root, aid, 'contact', 'operations.jsonl');
+}
+function contactAuditDestination(root, aid) {
+    return agentDataDestination(root, aid, 'contact', 'audit.jsonl');
+}
+function codexTokensDestination(root, aid) {
+    return agentDataDestination(root, aid, 'codex-tokens');
+}
+function outboxDestination(root, aid, queue) {
+    return agentDataDestination(root, aid, 'outbox', `${queue}.jsonl`);
 }
 function readJson(filePath) {
     try {
@@ -126,15 +112,16 @@ function acknowledgeCompletedCopies(root, operations) {
             .sort((left, right) => right.mtime - left.mtime);
         for (const candidate of manifests) {
             const manifest = readJson(candidate.path);
-            if (manifest?.state !== 'completed')
+            if (manifest?.state !== 'completed' && manifest?.state !== 'completed_with_errors')
                 continue;
-            // An unchanged plan is a normal re-run and must retain its conflict
-            // checks. Acknowledgement is only for extending a prior plan.
-            if (manifest.planSignature === currentPlanSignature)
+            // A fully completed unchanged plan is a normal re-run and must retain
+            // its conflict checks. A partial manifest may contain committed items
+            // that need acknowledgement even when its topology is unchanged.
+            if (manifest.state === 'completed' && manifest.planSignature === currentPlanSignature)
                 return;
             for (const operation of manifest.operations ?? []) {
-                if ((operation.kind !== 'copy' && operation.kind !== 'contact-audit-partition')
-                    || (operation.status !== 'committed' && operation.status !== 'skipped')
+                if ((operation.kind !== 'copy' && operation.kind !== 'merge-copy' && operation.kind !== 'contact-audit-partition')
+                    || !['committed', 'skipped', 'acknowledged'].includes(operation.status)
                     || !operation.sourceHash)
                     continue;
                 const key = operationProofTopologyKey(operation);
@@ -142,6 +129,7 @@ function acknowledgeCompletedCopies(root, operations) {
                     proofs.set(key, {
                         migrationId: manifest.id,
                         sourceHash: operation.sourceHash,
+                        sourceHashes: operation.sourceHashes,
                         destinations: operation.kind === 'contact-audit-partition'
                             ? [...(operation.destinations ?? [])]
                             : operation.destination ? [operation.destination] : [],
@@ -152,21 +140,32 @@ function acknowledgeCompletedCopies(root, operations) {
     }
     catch { }
     for (const operation of operations) {
-        if (operation.kind !== 'copy' && operation.kind !== 'contact-audit-partition')
+        if (operation.kind !== 'copy' && operation.kind !== 'merge-copy' && operation.kind !== 'contact-audit-partition')
             continue;
         const proof = proofs.get(operationProofTopologyKey(operation));
         if (!proof)
             continue;
-        if (operation.kind === 'copy' && (!operation.destination || !fs.existsSync(operation.destination)))
+        if ((operation.kind === 'copy' || operation.kind === 'merge-copy')
+            && (!operation.destination || !fs.existsSync(operation.destination)))
             continue;
         if (operation.kind === 'contact-audit-partition' && proof.destinations.some(destination => !fs.existsSync(destination)))
             continue;
         try {
-            if (treeHash(operation.source, operation.exclude) !== proof.sourceHash)
+            if (operation.kind === 'merge-copy') {
+                const sourceHashes = proof.sourceHashes ?? {};
+                if (operationSources(operation).some(source => {
+                    const expected = sourceHashes[source] ?? (source === operation.source ? proof.sourceHash : undefined);
+                    return !expected || treeHash(source, operation.exclude) !== expected;
+                }))
+                    continue;
+            }
+            else if (treeHash(operation.source, operation.exclude) !== proof.sourceHash)
                 continue;
             operation.status = 'acknowledged';
             operation.acknowledgedBy = proof.migrationId;
             operation.sourceHash = proof.sourceHash;
+            if (proof.sourceHashes)
+                operation.sourceHashes = proof.sourceHashes;
         }
         catch { }
     }
@@ -246,154 +245,6 @@ function configuredAids(root) {
         }
     })()));
 }
-function controlIdentity(root) {
-    const config = readJson(path.join(root, 'daemon.json'));
-    const aid = typeof config?.aid === 'string' && config.aid.trim() && config.aid !== '_unknown'
-        ? config.aid.trim()
-        : undefined;
-    const owners = new Set();
-    if (Array.isArray(config?.owners)) {
-        for (const owner of config.owners) {
-            if (typeof owner === 'string' && owner.trim())
-                owners.add(owner);
-        }
-    }
-    // A previous `ecNNNNN.<domain>` control identity has no Agent config, so
-    // its legacy AUN session root cannot be attributed through configuredAids.
-    // It is safe to recognize only when that root contains at least one current
-    // daemon owner: the whole root then belongs to the same process control
-    // plane, including sessions with its non-owner Agents.
-    const legacyAids = new Set();
-    if (aid && owners.size > 0) {
-        try {
-            for (const entry of fs.readdirSync(path.join(root, 'data', 'sessions', 'aun'), { withFileTypes: true })) {
-                if (!entry.isDirectory() || entry.name === aid || !/^ec\d{5}\.[^.]+(?:\..+)+$/i.test(entry.name))
-                    continue;
-                const sessionRoot = path.join(root, 'data', 'sessions', 'aun', entry.name);
-                const hasCurrentOwner = fs.readdirSync(sessionRoot, { withFileTypes: true })
-                    .some(child => child.isDirectory() && owners.has(child.name));
-                if (hasCurrentOwner)
-                    legacyAids.add(entry.name);
-            }
-        }
-        catch { }
-    }
-    return { aids: new Set(aid ? [aid] : []), owners, legacyAids };
-}
-function inferUnknownAunOwner(chat, control) {
-    if (chat.channelType !== 'aun' || chat.selfAID !== '_unknown' || control.aids.size !== 1)
-        return undefined;
-    // Old message-only AUN directories use `_unknown` for the local identity.
-    // The control identity is recoverable only when the peer is one of its
-    // configured owners; arbitrary unknown directories remain untouched.
-    if (!control.owners.has(chat.channelId))
-        return undefined;
-    return control.aids.values().next().value;
-}
-function remapLegacyControlAunOwner(aid, control) {
-    if (control.aids.size !== 1 || !control.legacyAids.has(aid))
-        return undefined;
-    return control.aids.values().next().value;
-}
-function isOwnedTriggerDefinition(definition, aid, triggerId) {
-    return !!definition
-        && typeof definition === 'object'
-        && definition.id === triggerId
-        && definition.agentAid === aid;
-}
-function listTriggerStorageRoots(root, layout) {
-    const roots = [];
-    if (layout === 'legacy') {
-        const legacyRoot = path.join(root, 'data', 'triggers');
-        try {
-            for (const entry of fs.readdirSync(legacyRoot, { withFileTypes: true })) {
-                if (entry.isDirectory())
-                    roots.push({ aid: entry.name, directory: path.join(legacyRoot, entry.name) });
-            }
-        }
-        catch { }
-        return roots;
-    }
-    const agentsRoot = path.join(root, 'agents');
-    try {
-        for (const entry of fs.readdirSync(agentsRoot, { withFileTypes: true })) {
-            if (!entry.isDirectory())
-                continue;
-            const directory = path.join(agentsRoot, entry.name, 'triggers');
-            if (fs.existsSync(directory))
-                roots.push({ aid: entry.name, directory });
-        }
-    }
-    catch { }
-    return roots;
-}
-/**
- * Trigger definitions are the authority for daemon-session ownership. Search
- * both layouts while a completed migration retains the immutable legacy copy.
- */
-function listTriggerOwners(root) {
-    const ownerAids = new Map();
-    for (const layout of ['legacy', 'agent']) {
-        for (const { aid, directory } of listTriggerStorageRoots(root, layout)) {
-            let triggerEntries;
-            try {
-                triggerEntries = fs.readdirSync(directory, { withFileTypes: true });
-            }
-            catch {
-                continue;
-            }
-            for (const triggerEntry of triggerEntries) {
-                if (!triggerEntry.isDirectory())
-                    continue;
-                const definition = readJson(path.join(directory, triggerEntry.name, 'trigger.json'));
-                if (!isOwnedTriggerDefinition(definition, aid, triggerEntry.name))
-                    continue;
-                const owners = ownerAids.get(triggerEntry.name) ?? new Set();
-                owners.add(aid);
-                ownerAids.set(triggerEntry.name, owners);
-            }
-        }
-    }
-    return new Map([...ownerAids].map(([triggerId, aids]) => [
-        triggerId,
-        [...aids].sort().map(aid => ({ aid })),
-    ]));
-}
-function resolveDaemonTriggerOwner(chat, record, triggerOwners) {
-    if (chat.channelType !== 'daemon') {
-        return { warning: `Non-Trigger daemon session retained: ${chat.channelId}` };
-    }
-    const triggerIds = new Set();
-    if (chat.channelId.startsWith('trigger:'))
-        triggerIds.add(chat.channelId.slice('trigger:'.length));
-    for (const value of [record?.metadata?.peerId, record?.metadata?.triggerId, record?.triggerId]) {
-        if (typeof value === 'string' && value.startsWith('trigger:'))
-            triggerIds.add(value.slice('trigger:'.length));
-    }
-    triggerIds.delete('');
-    if (triggerIds.size === 0)
-        return { warning: `Non-Trigger daemon session retained: ${chat.channelId}` };
-    if (triggerIds.size > 1) {
-        return { warning: `Daemon session references multiple Trigger IDs and was retained: ${chat.channelId}` };
-    }
-    const triggerId = [...triggerIds][0];
-    const candidates = triggerOwners.get(triggerId) ?? [];
-    const declaredOwner = typeof record?.selfAID === 'string' && record.selfAID !== '_unknown'
-        ? record.selfAID
-        : undefined;
-    const ownedCandidates = declaredOwner
-        ? candidates.filter(candidate => candidate.aid === declaredOwner)
-        : candidates;
-    if (ownedCandidates.length === 1)
-        return { aid: ownedCandidates[0].aid };
-    if (declaredOwner && candidates.length > 0) {
-        return { warning: `Daemon Trigger session owner conflicts with its definition and was retained: ${chat.channelId}` };
-    }
-    if (candidates.length === 0) {
-        return { warning: `Daemon Trigger session has no matching definition and was retained: ${chat.channelId}` };
-    }
-    return { warning: `Daemon Trigger session has ambiguous ownership and was retained: ${chat.channelId}` };
-}
 function matchingChannel(instances, type, legacyName) {
     const matches = instances.filter(instance => instance.type === type && (instance.key === legacyName || instance.rawName === legacyName));
     return matches.length === 1 ? matches[0].key : undefined;
@@ -464,6 +315,11 @@ function addCopy(operations, id, source, destination, staging, exclude, transfor
         return;
     operations.push({ id, kind: 'copy', source, destination, staging, exclude, transform, sessionChannelKey, status: 'planned' });
 }
+function addDiscard(operations, id, source, reason) {
+    if (!fs.existsSync(source) || operations.some(operation => operation.kind === 'discard' && operation.source === source))
+        return;
+    operations.push({ id, kind: 'discard', source, status: 'planned', discardReason: reason });
+}
 /**
  * Historic AUN data can contain an early `_unknown` transcript and a later
  * identified transcript for the same peer. They are one logical session, so
@@ -498,14 +354,10 @@ function addMergeCopy(operations, id, source, destination, staging, exclude, tra
 export function planDataMigration(root) {
     const operations = [];
     const warnings = [];
-    const supersededSourceHashes = {};
     const id = `data-${Date.now().toString(36)}-${crypto.randomBytes(3).toString('hex')}`;
     const stagingDir = migrationStagingDir(root, id);
     const instances = listChannelInstances(root);
     const aids = configuredAids(root);
-    const control = controlIdentity(root);
-    const triggerOwners = listTriggerOwners(root);
-    const legacySessions = path.join(root, 'data', 'sessions');
     const legacyFeishuChats = new Map();
     let sequence = 0;
     const nextId = (prefix) => `${prefix}-${String(++sequence).padStart(5, '0')}`;
@@ -517,12 +369,6 @@ export function planDataMigration(root) {
         chats.add(channelId);
         legacyFeishuChats.set(channelKey, chats);
     };
-    const rememberSupersededSource = (source) => {
-        try {
-            supersededSourceHashes[source] = treeHash(source);
-        }
-        catch { }
-    };
     const addFeishuSeen = (source, channelKey, channelId, prefix) => {
         if (!fs.existsSync(source))
             return;
@@ -535,42 +381,7 @@ export function planDataMigration(root) {
             addCopy(operations, operationId, source, destination, stageFor(operationId));
         }
     };
-    // Trigger data is Agent-owned. Migrate each valid Trigger independently so
-    // one malformed legacy definition does not block unrelated Agent data.
-    for (const { aid, directory } of listTriggerStorageRoots(root, 'legacy')) {
-        let entries;
-        try {
-            entries = fs.readdirSync(directory, { withFileTypes: true });
-        }
-        catch {
-            continue;
-        }
-        for (const entry of entries) {
-            const source = path.join(directory, entry.name);
-            if (entry.isDirectory()) {
-                if (entry.name.startsWith('.')) {
-                    const operationId = nextId('trigger-metadata');
-                    addCopy(operations, operationId, source, triggerDestination(root, aid, entry.name), stageFor(operationId));
-                    continue;
-                }
-                const definition = readJson(path.join(source, 'trigger.json'));
-                if (!isOwnedTriggerDefinition(definition, aid, entry.name)) {
-                    warnings.push(`Invalid Trigger definition retained: ${source}`);
-                    continue;
-                }
-                const operationId = nextId('trigger');
-                addCopy(operations, operationId, source, triggerDestination(root, aid, entry.name), stageFor(operationId), undefined, 'rewrite-trigger-session-paths');
-                continue;
-            }
-            if (entry.isFile() && (entry.name === 'history.jsonl' || /^triggers\.legacy\.migrated\.\d+\.json$/.test(entry.name))) {
-                const operationId = nextId(entry.name === 'history.jsonl' ? 'trigger-history' : 'trigger-legacy-stats');
-                addCopy(operations, operationId, source, triggerDestination(root, aid, entry.name), stageFor(operationId));
-                continue;
-            }
-            warnings.push(`Unrecognized Trigger data retained: ${source}`);
-        }
-    }
-    // Canonicalize single-level keys written by an earlier v3 build. These are
+    // Canonicalize single-level keys written by an earlier build. These are
     // live Agent-owned copies and therefore take precedence over retained source
     // layouts when both resolve to the same destination.
     for (const chat of scanNonCanonicalAgentChatDirs(path.join(root, 'agents'))) {
@@ -596,10 +407,9 @@ export function planDataMigration(root) {
             addFeishuSeen(path.join(chat.dirPath, SESSION_SEEN_FILE), channelKey, chat.channelId, 'canonical-feishu-seen');
         }
     }
-    // Version 3 flattens the previous Agent-owned two-level session layout.
-    // These directories are the most recent runtime copies, so when they and a
-    // retained data/sessions source resolve to the same destination, this copy
-    // takes precedence and avoids replaying an older transcript.
+    // Flatten the previous Agent-owned two-level session layout. These
+    // directories are the most recent runtime copies and take precedence over
+    // any already-created canonical destination.
     const nestedChats = scanNestedAgentChatDirs(path.join(root, 'agents'))
         .map(chat => {
         const record = readLatestSession(chat.dirPath);
@@ -636,83 +446,6 @@ export function planDataMigration(root) {
             addFeishuSeen(path.join(chat.dirPath, SESSION_SEEN_FILE), channelKey, chat.channelId, 'flatten-feishu-seen');
         }
     }
-    for (const chat of scanLegacyChatDirs(legacySessions)) {
-        const record = readLatestSession(chat.dirPath);
-        if (chat.channelType === 'daemon') {
-            const triggerOwner = resolveDaemonTriggerOwner(chat, record, triggerOwners);
-            if (!triggerOwner.aid) {
-                warnings.push(`${triggerOwner.warning ?? 'Unresolved daemon session retained'}: ${chat.dirPath}`);
-                continue;
-            }
-            let destination;
-            try {
-                destination = sessionDestination(root, triggerOwner.aid, 'daemon', chat.channelId);
-            }
-            catch (error) {
-                warnings.push(`Unmigratable daemon session retained: ${chat.dirPath}: ${error instanceof Error ? error.message : String(error)}`);
-                continue;
-            }
-            if (!liveSessionDestinations.has(destination) && !nestedSessionDestinations.has(destination)) {
-                const sessionId = nextId('trigger-session');
-                addSessionCopy(operations, sessionId, chat.dirPath, destination, stageFor(sessionId));
-            }
-            else {
-                rememberSupersededSource(chat.dirPath);
-            }
-            continue;
-        }
-        const fromChannel = parseChannelKey(record?.channel ?? record?.metadata?.channelKey);
-        const detectedAid = chat.selfAID && chat.selfAID !== '_unknown'
-            ? chat.selfAID
-            : (typeof record?.selfAID === 'string' && record.selfAID !== '_unknown'
-                ? record.selfAID
-                : fromChannel?.aid ?? inferUnknownAunOwner(chat, control));
-        const remappedControlAid = detectedAid && !aids.has(detectedAid) && !control.aids.has(detectedAid)
-            ? remapLegacyControlAunOwner(detectedAid, control)
-            : undefined;
-        const aid = remappedControlAid ?? detectedAid;
-        if (!aid || aid === '_unknown') {
-            warnings.push(`Unresolved session owner retained: ${chat.dirPath}`);
-            continue;
-        }
-        if (!aids.has(aid) && !control.aids.has(aid)) {
-            warnings.push(`Session owner has no Agent config and was retained: ${chat.dirPath}`);
-            continue;
-        }
-        const channelKey = configuredChannelKey(instances, chat.channelType, aid, record?.channel, record?.metadata?.channelKey, chat.channelKey);
-        if (!channelKey) {
-            warnings.push(`Unresolved session channel retained: ${chat.dirPath}`);
-            continue;
-        }
-        let destination;
-        try {
-            destination = sessionDestination(root, aid, channelKey, chat.channelId);
-        }
-        catch (error) {
-            warnings.push(`Unmigratable session retained: ${chat.dirPath}: ${error instanceof Error ? error.message : String(error)}`);
-            continue;
-        }
-        if (!liveSessionDestinations.has(destination) && !nestedSessionDestinations.has(destination)) {
-            const sessionId = nextId('session');
-            addSessionCopy(operations, sessionId, chat.dirPath, destination, stageFor(sessionId), [SESSION_SEEN_FILE], 'normalize-session-channel-key', channelKey);
-            if (remappedControlAid) {
-                const operation = operations.find(item => item.destination === destination);
-                if (operation)
-                    operation.allowExistingDestinationMerge = true;
-            }
-        }
-        else {
-            // This retained data/sessions copy is older than an Agent-owned source
-            // selected for the same canonical destination. It must not be replayed,
-            // but --apply can archive and remove it as a verified
-            // superseded source instead of exposing it as a fresh migration again.
-            rememberSupersededSource(chat.dirPath);
-        }
-        if (chat.channelType === 'feishu') {
-            rememberFeishuChat(channelKey, chat.channelId);
-            addFeishuSeen(path.join(chat.dirPath, SESSION_SEEN_FILE), channelKey, chat.channelId, 'feishu-seen');
-        }
-    }
     // Rebind connector state written under a removed unique channel instance.
     // The source stays intact; a merge-copy handles an already-created target.
     try {
@@ -738,25 +471,106 @@ export function planDataMigration(root) {
         }
     }
     catch { }
+    // Agent-owned contact logs, Codex hook credentials, and outbox queues are
+    // migrated explicitly. Runtime code no longer imports any of these legacy
+    // paths, so a source is either copied here or reported for operator review.
+    for (const aid of [...aids].sort()) {
+        const contactOperationsId = nextId('contact-operations');
+        addCopy(operations, contactOperationsId, path.join(root, 'agents', aid, 'contact-operations.jsonl'), contactOperationsDestination(root, aid), stageFor(contactOperationsId));
+        const contactAuditId = nextId('contact-audit');
+        addCopy(operations, contactAuditId, path.join(root, 'agents', aid, 'data', 'contact-audit.jsonl'), contactAuditDestination(root, aid), stageFor(contactAuditId));
+        const codexTokensId = nextId('codex-tokens');
+        addCopy(operations, codexTokensId, path.join(root, 'agents', aid, 'sessions', 'codex-tokens'), codexTokensDestination(root, aid), stageFor(codexTokensId));
+        const legacySources = [
+            [path.join(root, 'data', 'outbox', encodeURIComponent(aid), 'outbox.jsonl'), 'delivery', 'outbox-shared'],
+            [path.join(root, 'data', 'outbox', encodeURIComponent(aid), 'activity-outbox.jsonl'), 'activity', 'activity-outbox-shared'],
+            [path.join(root, 'data', 'outbox', `${aid}.jsonl`), 'delivery', 'outbox-flat'],
+            [path.join(root, 'agents', aid, 'data', 'outbox.jsonl'), 'delivery', 'outbox-agent'],
+            [path.join(root, 'agents', aid, 'data', 'activity-outbox.jsonl'), 'activity', 'activity-outbox-agent'],
+        ];
+        for (const [source, queue, prefix] of legacySources) {
+            const operationId = nextId(prefix);
+            addMergeCopy(operations, operationId, source, outboxDestination(root, aid, queue), stageFor(operationId));
+        }
+    }
+    // Legacy outbox entries without a configured Agent have no safe destination.
+    // They are intentionally discarded during the stopped maintenance window.
+    try {
+        for (const entry of fs.readdirSync(path.join(root, 'agents'), { withFileTypes: true })) {
+            if (!entry.isDirectory() || aids.has(entry.name))
+                continue;
+            const agentRoot = path.join(root, 'agents', entry.name);
+            for (const candidate of [
+                path.join(agentRoot, 'data', 'outbox.jsonl'),
+                path.join(agentRoot, 'data', 'activity-outbox.jsonl'),
+            ]) {
+                addDiscard(operations, nextId('discard-outbox'), candidate, 'legacy outbox owner is not configured');
+            }
+            for (const candidate of [
+                path.join(agentRoot, 'contact-operations.jsonl'),
+                path.join(agentRoot, 'data', 'contact-audit.jsonl'),
+                path.join(agentRoot, 'sessions', 'codex-tokens'),
+            ]) {
+                if (fs.existsSync(candidate))
+                    warnings.push(`Unresolved Agent-owned legacy source retained: ${candidate}`);
+            }
+        }
+    }
+    catch { }
+    // Shared outbox entries whose owner cannot be matched to a configured Agent
+    // are also intentionally discarded rather than retained indefinitely.
+    try {
+        const sharedOutbox = path.join(root, 'data', 'outbox');
+        for (const entry of fs.readdirSync(sharedOutbox, { withFileTypes: true })) {
+            if (entry.isDirectory()) {
+                let aid;
+                try {
+                    aid = decodeURIComponent(entry.name);
+                }
+                catch {
+                    aid = entry.name;
+                }
+                if (aids.has(aid))
+                    continue;
+                addDiscard(operations, nextId('discard-outbox'), path.join(sharedOutbox, entry.name), 'shared outbox owner is not configured');
+            }
+            else if (entry.isFile() && /\.jsonl$/.test(entry.name)) {
+                const aid = entry.name.replace(/\.jsonl$/, '');
+                if (!aids.has(aid))
+                    addDiscard(operations, nextId('discard-outbox'), path.join(sharedOutbox, entry.name), 'flat outbox owner is not configured');
+            }
+        }
+    }
+    catch { }
+    // Pre-v4 nested handoff snapshots are obsolete and intentionally discarded.
+    // The flat handoff files already used by the runtime remain untouched.
+    let agentEntries = [];
+    try {
+        agentEntries = fs.readdirSync(path.join(root, 'agents'), { withFileTypes: true });
+    }
+    catch { }
+    for (const entry of agentEntries.filter(item => item.isDirectory()).sort((left, right) => left.name.localeCompare(right.name))) {
+        const nestedRoot = path.join(root, 'agents', entry.name, 'data', 'handoff', 'handoffs');
+        let entries;
+        try {
+            entries = fs.readdirSync(nestedRoot, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            addDiscard(operations, nextId('discard-handoff'), path.join(nestedRoot, entry.name), 'legacy nested handoff is obsolete');
+        }
+    }
     const legacyHandoff = path.join(root, 'data', 'handoff');
     try {
         for (const entry of fs.readdirSync(legacyHandoff, { withFileTypes: true })) {
             if (!entry.isDirectory())
                 continue;
-            if (!aids.has(entry.name)) {
-                warnings.push(`Unresolved handoff owner retained: ${entry.name}`);
-                continue;
-            }
-            const operationId = nextId('handoff');
-            addCopy(operations, operationId, path.join(legacyHandoff, entry.name), path.join(root, 'agents', entry.name, 'data', 'handoff'), stageFor(operationId));
+            addDiscard(operations, nextId('discard-handoff'), path.join(legacyHandoff, entry.name), aids.has(entry.name) ? 'legacy shared handoff is obsolete' : 'legacy handoff owner is not configured');
         }
     }
     catch { }
-    // Outbox layouts are imported lazily by src/aun/outbox.ts when a queue is
-    // first read or written. They are append-only delivery state, so including
-    // them in the maintenance migration would unnecessarily block startup and
-    // could race a live connector. Keep the explicit migration reserved for
-    // data that needs operator review or an exclusive maintenance window.
     const contactAudit = path.join(root, 'data', 'contact-book-audit.jsonl');
     // The legacy audit file may be provisioned as an empty placeholder (for
     // example by a protected-path sandbox). An empty source has nothing to
@@ -880,7 +694,6 @@ export function planDataMigration(root) {
         state: 'planned',
         operations,
         warnings,
-        ...(Object.keys(supersededSourceHashes).length ? { supersededSourceHashes } : {}),
         planSignature: migrationPlanSignature(operations),
     };
 }
@@ -911,70 +724,6 @@ function validateTree(filePath) {
             strictJsonValidation(child);
     }
 }
-function verifyRequiredTriggerPayload(source, destination, relative = '') {
-    const sourceStat = fs.statSync(source);
-    let destinationStat;
-    try {
-        destinationStat = fs.statSync(destination);
-    }
-    catch {
-        throw new Error(`destination conflict: missing Trigger payload ${relative || '.'}`);
-    }
-    if (sourceStat.isFile()) {
-        if (!destinationStat.isFile())
-            throw new Error(`destination conflict: incompatible Trigger payload ${relative}`);
-        if (relative === 'active.json') {
-            strictJsonValidation(destination);
-            return;
-        }
-        if (relative === 'trigger.json') {
-            strictJsonValidation(destination);
-            return;
-        }
-        if (!fs.readFileSync(source).equals(fs.readFileSync(destination))) {
-            throw new Error(`destination conflict: changed Trigger payload ${relative}`);
-        }
-        return;
-    }
-    if (!destinationStat.isDirectory())
-        throw new Error(`destination conflict: incompatible Trigger directory ${relative || '.'}`);
-    for (const entry of fs.readdirSync(source, { withFileTypes: true })) {
-        if (!entry.isDirectory() && !entry.isFile())
-            continue;
-        const childRelative = relative ? path.join(relative, entry.name) : entry.name;
-        verifyRequiredTriggerPayload(path.join(source, entry.name), path.join(destination, entry.name), childRelative);
-    }
-}
-function verifyLiveTriggerDestination(operation) {
-    if (operation.transform !== 'rewrite-trigger-session-paths' || !operation.destination) {
-        throw new Error('operation is not a Trigger live-state reconciliation');
-    }
-    verifyRequiredTriggerPayload(operation.source, operation.destination);
-    const sourceDefinition = readJson(path.join(operation.source, 'trigger.json'));
-    const targetPath = path.join(operation.destination, 'trigger.json');
-    const targetDefinition = readJson(targetPath);
-    const aid = typeof sourceDefinition?.agentAid === 'string' ? sourceDefinition.agentAid : undefined;
-    const id = typeof sourceDefinition?.id === 'string' ? sourceDefinition.id : undefined;
-    if (!aid || !id || !isOwnedTriggerDefinition(targetDefinition, aid, id)) {
-        throw new Error('destination conflict: Trigger definition owner or id changed');
-    }
-    const content = fs.readFileSync(targetPath, 'utf8');
-    const transformed = transformedFileContent(targetPath, 'trigger.json', content, operation.transform, operation.sessionChannelKey);
-    if (transformed !== content)
-        throw new Error('destination conflict: Trigger definition still has legacy session paths');
-    validateTree(operation.destination);
-}
-function reconcileLiveTriggerDestination(operation) {
-    if (!operation.destination)
-        throw new Error('Trigger live-state reconciliation has no destination');
-    verifyRequiredTriggerPayload(operation.source, operation.destination);
-    const targetPath = path.join(operation.destination, 'trigger.json');
-    const content = fs.readFileSync(targetPath, 'utf8');
-    const transformed = transformedFileContent(targetPath, 'trigger.json', content, operation.transform, operation.sessionChannelKey);
-    if (transformed !== content)
-        atomicWriteText(targetPath, transformed);
-    verifyLiveTriggerDestination(operation);
-}
 function sessionIdentity(directory) {
     const active = readJson(path.join(directory, 'active.json'));
     if (!active || typeof active !== 'object')
@@ -1086,16 +835,6 @@ function normalizeSessionRecordChannelKeys(record, channelKey, forceCurrentRoute
     return changed;
 }
 function transformedFileContent(filePath, relative, content, transform, sessionChannelKey) {
-    if (transform === 'rewrite-trigger-session-paths') {
-        if (path.basename(filePath) !== 'trigger.json')
-            return content;
-        const definition = JSON.parse(content);
-        const prompt = definition?.execution?.prompt;
-        if (typeof prompt !== 'string')
-            return content;
-        const rewritten = rewriteLegacyTriggerSessionPaths(prompt, definition.agentAid);
-        return rewritten === prompt ? content : JSON.stringify({ ...definition, execution: { ...definition.execution, prompt: rewritten } }, null, 2) + '\n';
-    }
     if (transform !== 'normalize-session-channel-key')
         return content;
     const baseName = path.basename(filePath);
@@ -1199,10 +938,10 @@ function completedCopyProof(root, operation) {
         }))
             .sort((left, right) => right.mtime - left.mtime);
         for (const { manifest } of manifests) {
-            if (manifest?.state !== 'completed')
+            if (manifest?.state !== 'completed' && manifest?.state !== 'completed_with_errors')
                 continue;
             const proof = manifest.operations?.find(candidate => operationTopologyKey(candidate) === operationTopologyKey(operation)
-                && (candidate.status === 'committed' || candidate.status === 'skipped')
+                && ['committed', 'skipped', 'acknowledged'].includes(candidate.status)
                 && typeof candidate.sourceHash === 'string');
             if (proof)
                 return proof;
@@ -1211,24 +950,41 @@ function completedCopyProof(root, operation) {
     catch { }
     return undefined;
 }
-function assertFinalizableOperation(root, operation) {
+function assertFinalizableOperation(root, operation, archivedSources = new Set()) {
     const checkSource = (source, expectedHash) => {
         if (!expectedHash)
             throw new Error(`migration source has no verified hash: ${source}`);
-        if (!fs.existsSync(source))
+        if (!fs.existsSync(source)) {
+            if (archivedSources.has(path.resolve(source)))
+                return;
             throw new Error(`migration source is missing: ${source}`);
+        }
         if (treeHash(source, operation.exclude) !== expectedHash) {
             throw new Error(`migration source changed after verification: ${source}`);
         }
     };
+    if (operation.kind === 'discard') {
+        if (fs.existsSync(operation.source))
+            throw new Error(`discard source remains: ${operation.source}`);
+        return;
+    }
     if (operation.status === 'acknowledged') {
         // Acknowledged operations deliberately do not copy a live destination a
         // second time. Resolve the earlier completed manifest that proved the
         // identical source and topology before making that source removable.
-        if (operation.kind !== 'copy')
+        if (operation.kind !== 'copy' && operation.kind !== 'merge-copy' && operation.kind !== 'contact-audit-partition') {
             throw new Error(`unsupported acknowledged migration operation: ${operation.id}`);
+        }
         const proof = completedCopyProof(root, operation);
-        checkSource(operation.source, proof?.sourceHash);
+        if (operation.kind === 'merge-copy') {
+            for (const source of operationSources(operation)) {
+                checkSource(source, proof?.sourceHashes?.[source] ?? operation.sourceHashes?.[source]
+                    ?? (source === operation.source ? proof?.sourceHash ?? operation.sourceHash : undefined));
+            }
+        }
+        else {
+            checkSource(operation.source, proof?.sourceHash ?? operation.sourceHash);
+        }
         return;
     }
     if (operation.kind === 'merge-copy') {
@@ -1239,31 +995,29 @@ function assertFinalizableOperation(root, operation) {
     }
     checkSource(operation.source, operation.sourceHash);
 }
-function finalizationSourcePaths(root, manifest) {
-    if (manifest.state !== 'completed') {
+function finalizationSourcePaths(root, manifest, existing) {
+    if (manifest.state !== 'completed' && manifest.state !== 'completed_with_errors') {
         throw new Error(`only a completed migration can be finalized: ${manifest.id}`);
     }
-    const allSources = new Set();
+    const archivedSources = new Set((existing?.sourcePaths ?? []).map(source => path.resolve(root, source)));
+    const allSources = new Set(archivedSources);
     for (const operation of manifest.operations) {
-        if (!['committed', 'skipped', 'acknowledged'].includes(operation.status)) {
-            throw new Error(`migration has an unfinished operation: ${operation.id}`);
+        const terminal = ['committed', 'skipped', 'acknowledged'].includes(operation.status);
+        if (!terminal) {
+            if (manifest.state === 'completed')
+                throw new Error(`migration has an unfinished operation: ${operation.id}`);
+            continue;
+        }
+        if (operation.kind === 'discard') {
+            assertFinalizableOperation(root, operation, archivedSources);
+            continue;
         }
-        assertFinalizableOperation(root, operation);
+        assertFinalizableOperation(root, operation, archivedSources);
         for (const source of operationSources(operation)) {
             rootRelative(root, source);
             allSources.add(path.resolve(source));
         }
     }
-    for (const [source, expectedHash] of Object.entries(manifest.supersededSourceHashes ?? {})) {
-        const absolute = path.resolve(source);
-        rootRelative(root, absolute);
-        if (!fs.existsSync(absolute))
-            throw new Error(`superseded migration source is missing: ${absolute}`);
-        if (treeHash(absolute) !== expectedHash) {
-            throw new Error(`superseded migration source changed after planning: ${absolute}`);
-        }
-        allSources.add(absolute);
-    }
     // A parent copy may intentionally omit a payload (currently Feishu dedup).
     // Do not let purging that parent remove an omitted file unless an independent
     // completed operation has verified that payload too.
@@ -1348,44 +1102,71 @@ function pruneEmptyLegacyParents(root, sourcePaths) {
         }
     }
 }
-function pruneEmptyLegacyDirectories(root) {
-    // Some legacy roots contain empty per-Agent directories that never produced
-    // a migration operation. Remove only empty children of known legacy roots;
-    // unresolved directories containing data are left untouched.
-    const roots = [path.join(root, 'data', 'triggers')];
-    const pruneChildren = (directory) => {
-        let entries;
-        try {
-            entries = fs.readdirSync(directory, { withFileTypes: true });
-        }
-        catch {
-            return;
-        }
-        for (const entry of entries) {
-            if (!entry.isDirectory())
-                continue;
-            const child = path.join(directory, entry.name);
-            pruneChildren(child);
-            try {
-                if (fs.readdirSync(child).length === 0)
-                    fs.rmdirSync(child);
-            }
-            catch { }
-        }
-    };
-    for (const directory of roots)
-        pruneChildren(directory);
-}
 function removeMigrationStaging(manifest) {
     try {
         fs.rmSync(migrationStagingDir(manifest.root, manifest.id), { recursive: true, force: true });
     }
     catch { }
 }
+function createMigrationArchive(root, archivePath, sourcePaths, existingArchivePath) {
+    const archiveRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'evolcore-migration-'));
+    const temporary = `${archivePath}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`;
+    const tar = systemTar();
+    try {
+        if (existingArchivePath) {
+            execFileSync(tar, ['-xzf', existingArchivePath, '-C', archiveRoot], {
+                stdio: 'pipe',
+                windowsHide: process.platform === 'win32',
+            });
+        }
+        for (const source of sourcePaths) {
+            if (!fs.existsSync(source))
+                continue;
+            copyTree(source, path.join(archiveRoot, rootRelative(root, source)));
+        }
+        const relativeSources = sourcePaths.map(source => rootRelative(root, source));
+        for (const relative of relativeSources) {
+            if (!fs.existsSync(path.join(archiveRoot, relative))) {
+                throw new Error(`migration archive source is missing: ${relative}`);
+            }
+        }
+        fs.mkdirSync(path.dirname(archivePath), { recursive: true });
+        if (relativeSources.length > 0) {
+            execFileSync(tar, ['-czf', temporary, ...relativeSources], {
+                cwd: archiveRoot,
+                stdio: 'pipe',
+                windowsHide: process.platform === 'win32',
+            });
+        }
+        else {
+            execFileSync(tar, ['-czf', temporary, '--files-from', '-'], {
+                cwd: archiveRoot,
+                input: '',
+                stdio: ['pipe', 'pipe', 'pipe'],
+                windowsHide: process.platform === 'win32',
+            });
+        }
+        verifyArchiveContains(temporary, relativeSources, tar);
+        fs.renameSync(temporary, archivePath);
+    }
+    catch (error) {
+        try {
+            fs.rmSync(temporary, { force: true });
+        }
+        catch { }
+        throw new Error(`cannot create migration archive: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    finally {
+        try {
+            fs.rmSync(archiveRoot, { recursive: true, force: true });
+        }
+        catch { }
+    }
+}
 /**
- * Archive and remove only source paths already proven by a completed migration.
- * The CLI invokes this as the final phase of --apply. An archive is
- * verified before any source is removed.
+ * Archive and remove source paths already proven by a migration. A manifest
+ * with independent failures is finalized incrementally: successful sources
+ * are archived and removed while failed sources remain for a later retry.
  */
 export function finalizeDataMigration(root, manifest) {
     if (path.resolve(manifest.root) !== path.resolve(root)) {
@@ -1396,43 +1177,27 @@ export function finalizeDataMigration(root, manifest) {
         if (!fs.existsSync(existing.archivePath) || archiveHash(existing.archivePath) !== existing.archiveSha256) {
             throw new Error(`existing migration archive is missing or corrupt: ${existing.archivePath}`);
         }
-        pruneEmptyLegacyDirectories(root);
-        removeMigrationStaging(manifest);
-        return existing;
     }
-    const absoluteSources = finalizationSourcePaths(root, manifest);
+    const absoluteSources = finalizationSourcePaths(root, manifest, existing);
     const sourcePaths = absoluteSources.map(source => rootRelative(root, source));
-    const archivePath = path.join(root, 'backups', 'data-migration', `${manifest.id}-legacy-sources.tar.gz`);
-    if (fs.existsSync(archivePath)) {
-        throw new Error(`migration archive already exists without a finalization receipt: ${archivePath}`);
-    }
-    fs.mkdirSync(path.dirname(archivePath), { recursive: true });
-    const temporary = `${archivePath}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`;
-    const tar = systemTar();
-    try {
-        execFileSync(tar, ['-czf', temporary, ...sourcePaths], {
-            cwd: root,
-            stdio: 'pipe',
-            windowsHide: process.platform === 'win32',
-        });
-        verifyArchiveContains(temporary, sourcePaths, tar);
-        fs.renameSync(temporary, archivePath);
-    }
-    catch (error) {
-        try {
-            fs.rmSync(temporary, { force: true });
-        }
-        catch { }
-        throw new Error(`cannot create migration archive: ${error instanceof Error ? error.message : String(error)}`);
+    const archivePath = existing?.archivePath
+        ?? path.join(root, 'backups', 'data-migration', `${manifest.id}-legacy-sources.tar.gz`);
+    const liveSources = absoluteSources.filter(source => fs.existsSync(source));
+    const archiveNeedsUpdate = !existing || liveSources.length > 0;
+    if (archiveNeedsUpdate) {
+        createMigrationArchive(root, archivePath, absoluteSources, existing?.archivePath);
     }
     // Recheck immediately before deletion in case another writer appeared in
     // the maintenance window after the archive was created.
-    for (const operation of manifest.operations)
-        assertFinalizableOperation(root, operation);
-    for (const source of absoluteSources)
+    const archivedSources = new Set(sourcePaths.map(source => path.resolve(root, source)));
+    for (const operation of manifest.operations) {
+        if (['committed', 'skipped', 'acknowledged'].includes(operation.status)) {
+            assertFinalizableOperation(root, operation, archivedSources);
+        }
+    }
+    for (const source of liveSources)
         fs.rmSync(source, { recursive: true, force: false });
-    pruneEmptyLegacyParents(root, absoluteSources);
-    pruneEmptyLegacyDirectories(root);
+    pruneEmptyLegacyParents(root, liveSources);
     const finalization = {
         schemaVersion: 1,
         migrationId: manifest.id,
@@ -1441,6 +1206,7 @@ export function finalizeDataMigration(root, manifest) {
         archivePath,
         archiveSha256: archiveHash(archivePath),
         sourcePaths,
+        partial: manifest.state !== 'completed',
     };
     writeFinalization(finalization);
     removeMigrationStaging(manifest);
@@ -1502,7 +1268,7 @@ function executeContactAudit(manifest, operation, checkpoint) {
         groups.set(record.selfAid, records);
     }
     for (const [aid, lines] of groups) {
-        const destination = path.join(manifest.root, 'agents', aid, 'data', 'contact-audit.jsonl');
+        const destination = contactAuditDestination(manifest.root, aid);
         const content = lines.join('\n') + '\n';
         const existing = fs.existsSync(destination) ? fs.readFileSync(destination, 'utf8') : undefined;
         if (existing !== undefined)
@@ -1571,16 +1337,6 @@ function executeCopy(operation, checkpoint) {
             operation.verificationError = undefined;
             return;
         }
-        if (operation.transform === 'rewrite-trigger-session-paths') {
-            reconcileLiveTriggerDestination(operation);
-            operation.preservedLiveTrigger = true;
-            operation.destinationHash = treeHash(operation.destination);
-            operation.status = 'committed';
-            operation.error = undefined;
-            operation.verificationError = undefined;
-            checkpoint();
-            return;
-        }
         if (operation.transform === 'normalize-session-channel-key'
             && (operation.allowExistingDestinationMerge || canMergeSessionDestination(operation))) {
             // A control-AID rotation can legitimately converge an old transcript
@@ -1627,6 +1383,18 @@ function executeCopy(operation, checkpoint) {
     operation.error = undefined;
     operation.verificationError = undefined;
 }
+function executeDiscard(operation, checkpoint) {
+    if (fs.existsSync(operation.source)) {
+        operation.sourceHash = treeHash(operation.source);
+        checkpoint();
+        fs.rmSync(operation.source, { recursive: true, force: false });
+    }
+    if (fs.existsSync(operation.source))
+        throw new Error(`discard failed: ${operation.source}`);
+    operation.status = 'skipped';
+    operation.error = undefined;
+    operation.verificationError = undefined;
+}
 function operationSources(operation) {
     return [...new Set([operation.source, ...(operation.sources ?? [])])];
 }
@@ -1744,7 +1512,6 @@ function executeMergeCopy(operation, checkpoint) {
  * later items still run and a subsequent `--resume` only retries failures.
  */
 export function applyDataMigration(manifest) {
-    restoreLegacyControlMergeEligibility(manifest);
     manifest.state = 'running';
     writeManifest(manifest);
     for (const operation of manifest.operations) {
@@ -1756,8 +1523,10 @@ export function applyDataMigration(manifest) {
                 executeCopy(operation, checkpoint);
             else if (operation.kind === 'merge-copy')
                 executeMergeCopy(operation, checkpoint);
-            else
+            else if (operation.kind === 'contact-audit-partition')
                 executeContactAudit(manifest, operation, checkpoint);
+            else
+                executeDiscard(operation, checkpoint);
         }
         catch (error) {
             operation.status = 'error';
@@ -1861,11 +1630,11 @@ export function verifyDataMigration(manifest, { strictTargetContent = true } = {
     for (const operation of manifest.operations) {
         if (operation.status === 'acknowledged')
             continue;
-        if (operation.preservedLiveTrigger) {
+        if (operation.kind === 'discard') {
             try {
-                verifyLiveTriggerDestination(operation);
-                operation.destinationHash = treeHash(operation.destination);
-                operation.status = 'committed';
+                if (fs.existsSync(operation.source))
+                    throw new Error(`discard source remains: ${operation.source}`);
+                operation.status = 'skipped';
                 operation.error = undefined;
                 operation.verificationError = undefined;
             }
@@ -1892,7 +1661,8 @@ export function verifyDataMigration(manifest, { strictTargetContent = true } = {
                         throw new Error(`destination missing: ${destination}`);
                     strictJsonValidation(destination);
                     const expectedHash = operation.destinationHashes?.[destination];
-                    if (strictTargetContent && expectedHash && hashContent(fs.readFileSync(destination, 'utf8')) !== expectedHash) {
+                    const sourceWasArchived = !fs.existsSync(operation.source) && sourceArchived(operation.source);
+                    if (strictTargetContent && !sourceWasArchived && expectedHash && hashContent(fs.readFileSync(destination, 'utf8')) !== expectedHash) {
                         throw new Error(`content hash mismatch: ${destination}`);
                     }
                 }
@@ -1925,8 +1695,10 @@ export function verifyDataMigration(manifest, { strictTargetContent = true } = {
                 operation.destinationHash = destinationHash;
                 if (!operation.expectedHash)
                     throw new Error('expected output hash missing');
-                if (strictTargetContent && operation.expectedHash !== destinationHash)
+                const allSourcesArchived = liveSources.length === 0 && removedSources.every(source => sourceArchived(source));
+                if (strictTargetContent && !allSourcesArchived && operation.expectedHash !== destinationHash) {
                     throw new Error('content hash mismatch');
+                }
                 operation.status = 'committed';
                 operation.error = undefined;
                 operation.verificationError = undefined;
@@ -1948,6 +1720,7 @@ export function verifyDataMigration(manifest, { strictTargetContent = true } = {
             validateTree(operation.destination);
             let sourceHash = operation.sourceHash;
             let expectedHash = operation.expectedHash;
+            let sourceWasArchived = false;
             if (fs.existsSync(operation.source)) {
                 sourceHash = treeHash(operation.source, operation.exclude);
                 if (operation.sourceHash && operation.sourceHash !== sourceHash) {
@@ -1961,6 +1734,9 @@ export function verifyDataMigration(manifest, { strictTargetContent = true } = {
             else if (!sourceArchived(operation.source)) {
                 throw new Error(`source missing: ${operation.source}`);
             }
+            else {
+                sourceWasArchived = true;
+            }
             if (!expectedHash)
                 throw new Error('expected output hash missing');
             const destinationHash = treeHash(operation.destination);
@@ -1971,8 +1747,9 @@ export function verifyDataMigration(manifest, { strictTargetContent = true } = {
             if (!strictTargetContent && operation.status === 'error' && operation.error?.startsWith('destination conflict') && expectedHash !== destinationHash) {
                 throw new Error(operation.error ?? 'content hash mismatch');
             }
-            if (strictTargetContent && expectedHash !== destinationHash)
+            if (strictTargetContent && !sourceWasArchived && expectedHash !== destinationHash) {
                 throw new Error('content hash mismatch');
+            }
             if (operation.status !== 'skipped')
                 operation.status = 'committed';
             operation.error = undefined;