opencode-ship 0.2.1 → 0.3.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// opencode-ship CLI v0.2.1
+// opencode-ship CLI v0.3.0
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -10,109 +10,6 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/installer/catalog.js
-import { fileURLToPath } from "node:url";
-import { dirname, resolve } from "node:path";
-function getTemplateSet() {
-  return TEMPLATE_SET;
-}
-var packageRoot, TEMPLATE_SET, CATALOG, POINTER_ENTRIES;
-var init_catalog = __esm({
-  "src/installer/catalog.js"() {
-    packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
-    TEMPLATE_SET = "v0.2.0";
-    CATALOG = [
-      {
-        kind: "plugin",
-        path: ".opencode/plugin/opencode-ship.js",
-        source: resolve(packageRoot, "dist/plugin.js"),
-        mode: 420
-      },
-      {
-        kind: "agent",
-        path: ".opencode/agents/delivery-reviewer.md",
-        source: resolve(packageRoot, "assets/agents/delivery-reviewer.md"),
-        mode: 420
-      },
-      {
-        kind: "agent",
-        path: ".opencode/agents/delivery-verifier.md",
-        source: resolve(packageRoot, "assets/agents/delivery-verifier.md"),
-        mode: 420
-      },
-      {
-        kind: "skill",
-        path: ".opencode/skills/delivery-workflow/SKILL.md",
-        source: resolve(packageRoot, "assets/skills/delivery-workflow/SKILL.md"),
-        mode: 420
-      },
-      {
-        kind: "skill",
-        path: ".opencode/skills/planning-research-checkpoint/SKILL.md",
-        source: resolve(packageRoot, "assets/skills/planning-research-checkpoint/SKILL.md"),
-        mode: 420
-      }
-    ];
-    POINTER_ENTRIES = [
-      {
-        pointer: "/agent/build/permission/delivery_inspect",
-        strategy: "value",
-        value: "allow"
-      },
-      {
-        pointer: "/agent/build/permission/delivery_issue",
-        strategy: "value",
-        value: "allow"
-      },
-      {
-        pointer: "/agent/build/permission/delivery_worktree",
-        strategy: "value",
-        value: "allow"
-      },
-      {
-        pointer: "/agent/build/permission/delivery_verify",
-        strategy: "value",
-        value: "deny"
-      },
-      {
-        pointer: "/agent/build/permission/delivery_review",
-        strategy: "value",
-        value: "deny"
-      },
-      {
-        pointer: "/agent/build/permission/delivery_pr",
-        strategy: "value",
-        value: "allow"
-      },
-      {
-        pointer: "/agent/build/permission/delivery_ready",
-        strategy: "value",
-        value: "allow"
-      },
-      {
-        pointer: "/agent/build/permission/delivery_merge",
-        strategy: "value",
-        value: "ask"
-      },
-      {
-        pointer: "/agent/build/permission/delivery_cleanup",
-        strategy: "value",
-        value: "allow"
-      },
-      {
-        pointer: "/agent/build/permission/task/delivery-reviewer",
-        strategy: "value",
-        value: "allow"
-      },
-      {
-        pointer: "/agent/build/permission/task/delivery-verifier",
-        strategy: "value",
-        value: "allow"
-      }
-    ];
-  }
-});
-
 // src/installer/json-pointer.js
 var json_pointer_exports = {};
 __export(json_pointer_exports, {
@@ -216,6 +113,7 @@ var init_hash = __esm({
 // src/installer/root-config.js
 var root_config_exports = {};
 __export(root_config_exports, {
+  POINTER_ENTRIES: () => POINTER_ENTRIES,
   applyOwnedPointers: () => applyOwnedPointers,
   defaultRootConfigPath: () => defaultRootConfigPath,
   findRootConfig: () => findRootConfig,
@@ -225,24 +123,24 @@ __export(root_config_exports, {
   readRootConfig: () => readRootConfig,
   synthesizeDefaultRootConfig: () => synthesizeDefaultRootConfig
 });
-import { existsSync as existsSync2, readFileSync } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "node:fs";
 import { readFile as readFile2 } from "node:fs/promises";
-import { resolve as resolve3 } from "node:path";
+import { resolve as resolve5 } from "node:path";
 function findRootConfig(repoRoot) {
   for (const rel of ROOT_PATH_CANDIDATES) {
-    const abs = resolve3(repoRoot, rel);
-    if (existsSync2(abs)) return { path: abs, relative: rel, format: rel.endsWith(".jsonc") ? "jsonc" : "json" };
+    const abs = resolve5(repoRoot, rel);
+    if (existsSync5(abs)) return { path: abs, relative: rel, format: rel.endsWith(".jsonc") ? "jsonc" : "json" };
   }
   return { path: null, relative: ROOT_PATH_CANDIDATES[0], format: "json" };
 }
 function defaultRootConfigPath(repoRoot) {
-  return resolve3(repoRoot, ROOT_PATH_CANDIDATES[0]);
+  return resolve5(repoRoot, ROOT_PATH_CANDIDATES[0]);
 }
 function readRootConfig(absPath) {
-  if (!existsSync2(absPath)) {
+  if (!existsSync5(absPath)) {
     return { ok: false, error: { kind: "missing", path: absPath } };
   }
-  const raw = readFileSync(absPath, "utf8");
+  const raw = readFileSync3(absPath, "utf8");
   const stripped = stripJsonc(raw);
   try {
     const value = JSON.parse(stripped);
@@ -382,6 +280,9 @@ function formatRootConfigPreserving(value) {
   return formatRootConfig(value);
 }
 function parseRootConfigPreservingOrder(text) {
+  if (typeof text !== "string" || text.length === 0) {
+    return { value: {}, format: "json" };
+  }
   const parser = new RootConfigParser(text);
   const value = parser.parseValue(
     0,
@@ -391,12 +292,68 @@ function parseRootConfigPreservingOrder(text) {
   const isJsonc = text.includes("//") || text.includes("/*");
   return { value, format: isJsonc ? "jsonc" : "json" };
 }
-var ROOT_PATH_CANDIDATES, RootConfigParser;
+var POINTER_ENTRIES, ROOT_PATH_CANDIDATES, RootConfigParser;
 var init_root_config = __esm({
   "src/installer/root-config.js"() {
     init_json_pointer();
     init_hash();
-    init_catalog();
+    POINTER_ENTRIES = [
+      {
+        pointer: "/agent/build/permission/delivery_inspect",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/agent/build/permission/delivery_issue",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/agent/build/permission/delivery_worktree",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/agent/build/permission/delivery_verify",
+        strategy: "value",
+        value: "deny"
+      },
+      {
+        pointer: "/agent/build/permission/delivery_review",
+        strategy: "value",
+        value: "deny"
+      },
+      {
+        pointer: "/agent/build/permission/delivery_pr",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/agent/build/permission/delivery_ready",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/agent/build/permission/delivery_merge",
+        strategy: "value",
+        value: "ask"
+      },
+      {
+        pointer: "/agent/build/permission/delivery_cleanup",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/agent/build/permission/task/delivery-reviewer",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/agent/build/permission/task/delivery-verifier",
+        strategy: "value",
+        value: "allow"
+      }
+    ];
     ROOT_PATH_CANDIDATES = ["opencode.json", "opencode.jsonc"];
     RootConfigParser = class {
       constructor(text) {
@@ -527,83 +484,6 @@ var init_root_config = __esm({
   }
 });
 
-// src/installer/lock.js
-var lock_exports = {};
-__export(lock_exports, {
-  CURRENT_LOCK_SCHEMA: () => CURRENT_LOCK_SCHEMA,
-  computeIntegrity: () => computeIntegrity,
-  lockPath: () => lockPath,
-  migrateLegacyLock: () => migrateLegacyLock,
-  readLock: () => readLock,
-  validateIntegrity: () => validateIntegrity,
-  writeLock: () => writeLock
-});
-import { readFile as readFile4, writeFile as writeFile2, rename as rename2, mkdir as mkdir2 } from "node:fs/promises";
-import { existsSync as existsSync4 } from "node:fs";
-import { dirname as dirname3, resolve as resolve4 } from "node:path";
-function lockPath(repoRoot) {
-  return resolve4(repoRoot, ".opencode", "ship.lock.json");
-}
-async function readLock(repoRoot) {
-  const path = lockPath(repoRoot);
-  if (!existsSync4(path)) return null;
-  try {
-    const raw = await readFile4(path, "utf8");
-    const parsed = JSON.parse(raw);
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-async function writeLock(repoRoot, lock) {
-  const path = lockPath(repoRoot);
-  await mkdir2(dirname3(path), { recursive: true });
-  const integrity = computeIntegrity(lock);
-  const finalLock = { ...lock, integrity };
-  const raw = JSON.stringify(finalLock, null, 2) + "\n";
-  const tmp = `${path}.tmp`;
-  await writeFile2(tmp, raw, "utf8");
-  await rename2(tmp, path);
-  return path;
-}
-function computeIntegrity(lock) {
-  const { integrity: _ignored, ...without } = lock ?? {};
-  void _ignored;
-  return {
-    lockSha256: bytesHashString(stableStringify(without))
-  };
-}
-async function validateIntegrity(lock) {
-  if (!lock?.integrity?.lockSha256) return false;
-  const expected = computeIntegrity(lock).lockSha256;
-  return expected === lock.integrity.lockSha256;
-}
-async function migrateLegacyLock(repoRoot) {
-  const legacy = resolve4(repoRoot, ".opencode", "delivery.lock.json");
-  if (!existsSync4(legacy)) return null;
-  try {
-    const raw = await readFile4(legacy, "utf8");
-    const parsed = JSON.parse(raw);
-    if (parsed.contractVersion !== 1 || typeof parsed.adapterSha256 !== "string") return null;
-    return {
-      kind: "legacy-lock",
-      sourcePath: legacy,
-      payload: { contractVersion: 1, adapterSha256: parsed.adapterSha256, writtenAt: parsed.writtenAt ?? null },
-      sha256: bytesHashString(raw)
-    };
-  } catch {
-    return null;
-  }
-}
-var CURRENT_LOCK_SCHEMA;
-var init_lock = __esm({
-  "src/installer/lock.js"() {
-    init_hash();
-    init_json_pointer();
-    CURRENT_LOCK_SCHEMA = 1;
-  }
-});
-
 // src/installer/cli-args.js
 var USAGE = `opencode-ship <command> [options]
 
@@ -618,7 +498,6 @@ Commands:
 
 Options:
   --root <path>          Project root (defaults to cwd).
-  --config <path>        Override the config file location (init only).
   --force-config         Rewrite the user config from detection (init only).
   --force-root-config    Create opencode.json when absent (init only).
   --strict-doctor        Fail init when doctor reports unhealthy checks.
@@ -629,7 +508,6 @@ Options:
 function parseFlags(argv) {
   const options = {
     rootPath: null,
-    configPath: null,
     json: false,
     replaceManaged: false,
     purgeConfig: false,
@@ -646,7 +524,6 @@ function parseFlags(argv) {
     else if (arg === "--force-root-config") options.forceRootConfig = true;
     else if (arg === "--strict-doctor") options.strictDoctor = true;
     else if (arg === "--root") options.rootPath = argv[++i];
-    else if (arg === "--config") options.configPath = argv[++i];
     else if (arg === "-h" || arg === "--help") return { help: true };
     else if (arg === "-v" || arg === "--version") return { version: true };
     else return { error: `unknown flag ${arg}` };
@@ -680,26 +557,160 @@ function helpText() {
 }
 
 // src/installer/executor.js
-init_catalog();
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync11 } from "node:fs";
 import { mkdir as mkdir4, readFile as readFile7, rename as rename4, unlink as unlink2, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname5, resolve as resolve9 } from "node:path";
+import { dirname as dirname6, resolve as resolve10 } from "node:path";
+
+// src/installer/catalog.js
+import { resolve as resolve3, relative, sep } from "node:path";
+import { existsSync as existsSync3, statSync } from "node:fs";
+
+// src/installer/package-root.js
+import { existsSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+var PACKAGE_NAME = "opencode-ship";
+function resolvePackageRoot(startUrl) {
+  let candidate = dirname(fileURLToPath(startUrl ?? import.meta.url));
+  while (candidate && candidate !== "/") {
+    const pkgPath = resolve(candidate, "package.json");
+    if (existsSync(pkgPath)) {
+      try {
+        const raw = readFileSync(pkgPath, "utf8");
+        const pkg = JSON.parse(raw);
+        if (pkg && pkg.name === PACKAGE_NAME) return candidate;
+      } catch {
+      }
+    }
+    candidate = dirname(candidate);
+  }
+  throw new Error(`opencode-ship package root not found from ${startUrl ?? import.meta.url}`);
+}
+
+// src/version.js
+import { readFileSync as readFileSync2, existsSync as existsSync2 } from "node:fs";
+import { dirname as dirname2, resolve as resolve2 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var PACKAGE_VERSION = "0.3.0";
+var TEMPLATE_SET = `v${PACKAGE_VERSION}`;
+
+// src/installer/catalog.js
+var TEMPLATE_SET_ID = TEMPLATE_SET;
+var packageRoot = resolvePackageRoot(import.meta.url);
+var CATALOG = [
+  {
+    id: "plugin:opencode-ship",
+    kind: "plugin",
+    path: ".opencode/plugins/opencode-ship.js",
+    source: resolve3(packageRoot, "dist/plugin.js"),
+    mode: 420
+  },
+  {
+    id: "agent:delivery-reviewer",
+    kind: "agent",
+    path: ".opencode/agents/delivery-reviewer.md",
+    source: resolve3(packageRoot, "assets/agents/delivery-reviewer.md"),
+    mode: 420
+  },
+  {
+    id: "agent:delivery-verifier",
+    kind: "agent",
+    path: ".opencode/agents/delivery-verifier.md",
+    source: resolve3(packageRoot, "assets/agents/delivery-verifier.md"),
+    mode: 420
+  },
+  {
+    id: "skill:delivery-workflow",
+    kind: "skill",
+    path: ".opencode/skills/delivery-workflow/SKILL.md",
+    source: resolve3(packageRoot, "assets/skills/delivery-workflow/SKILL.md"),
+    mode: 420
+  },
+  {
+    id: "skill:planning-research-checkpoint",
+    kind: "skill",
+    path: ".opencode/skills/planning-research-checkpoint/SKILL.md",
+    source: resolve3(packageRoot, "assets/skills/planning-research-checkpoint/SKILL.md"),
+    mode: 420
+  }
+];
+var ALLOWED_KINDS = /* @__PURE__ */ new Set(["plugin", "agent", "skill", "support"]);
+function validateCatalog({ catalog = CATALOG } = {}) {
+  const seenIds = /* @__PURE__ */ new Set();
+  const seenPaths = /* @__PURE__ */ new Set();
+  const issues = [];
+  for (const entry of catalog) {
+    if (!entry || typeof entry !== "object") {
+      issues.push({ id: null, kind: "shape", message: "catalog entry is not an object" });
+      continue;
+    }
+    const { id, kind, path, source, mode } = entry;
+    if (typeof id !== "string" || id.length === 0) {
+      issues.push({ id: null, kind: "id", message: `entry id missing: ${JSON.stringify(entry)}` });
+    } else if (seenIds.has(id)) {
+      issues.push({ id, kind: "duplicate-id", message: `duplicate catalog id: ${id}` });
+    } else {
+      seenIds.add(id);
+    }
+    if (typeof path !== "string" || !path.startsWith(".opencode" + sep)) {
+      issues.push({ id, kind: "path", message: `path must be rooted under .opencode/: ${path}` });
+    }
+    if (seenPaths.has(path)) {
+      issues.push({ id, kind: "duplicate-path", message: `duplicate target path: ${path}` });
+    } else {
+      seenPaths.add(path);
+    }
+    if (!ALLOWED_KINDS.has(kind)) {
+      issues.push({ id, kind: "kind", message: `unsupported entry kind: ${kind}` });
+    }
+    if (typeof source !== "string" || source.length === 0) {
+      issues.push({ id, kind: "source", message: `source path missing: ${id}` });
+    } else if (!existsSync3(source)) {
+      issues.push({ id, kind: "source-missing", message: `source file not found: ${source}` });
+    } else {
+      try {
+        const stats = statSync(source);
+        if (!stats.isFile()) {
+          issues.push({ id, kind: "source-not-file", message: `source is not a regular file: ${source}` });
+        } else if (stats.size === 0) {
+          issues.push({ id, kind: "source-empty", message: `source file is empty: ${source}` });
+        }
+      } catch (e) {
+        issues.push({ id, kind: "source-stat", message: `unable to stat source: ${e?.message ?? e}` });
+      }
+      const rel = relative(packageRoot, source);
+      if (rel.startsWith("..")) {
+        issues.push({ id, kind: "source-out-of-package", message: `source escapes package root: ${source}` });
+      }
+    }
+    if (mode !== 420) {
+      issues.push({ id, kind: "mode", message: `mode must be 0o644: ${id}` });
+    }
+  }
+  if (issues.length > 0) {
+    const summary = issues.map((i) => i.message).join("; ");
+    const err = new Error(`opencode-ship catalog validation failed: ${summary}`);
+    err.issues = issues;
+    err.catalogValidation = true;
+    throw err;
+  }
+  return catalog;
+}
 
 // src/installer/planner.js
-init_catalog();
-init_hash();
-import { existsSync as existsSync3 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { readFile as readFile3, stat } from "node:fs/promises";
+init_hash();
 
 // src/installer/config.js
 import { readFile, writeFile, rename, mkdir } from "node:fs/promises";
-import { existsSync } from "node:fs";
-import { dirname as dirname2, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync4 } from "node:fs";
+import { dirname as dirname3, resolve as resolve4 } from "node:path";
 
 // schema/ship-config.schema.json
 var ship_config_schema_default = {
   $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "https://github.com/Viktorxyz/opencode-delivery/schema/ship-config.schema.json",
+  $id: "https://github.com/Viktorxyz/opencode-ship/schema/ship-config.schema.json",
   title: "opencode-ship user config",
   type: "object",
   required: ["schemaVersion"],
@@ -927,11 +938,11 @@ function validateSchema(value, schema) {
 init_json_pointer();
 init_hash();
 function configPath(repoRoot) {
-  return resolve2(repoRoot, ".opencode", "ship.config.json");
+  return resolve4(repoRoot, ".opencode", "ship.config.json");
 }
 async function loadConfig(repoRoot) {
   const path = configPath(repoRoot);
-  if (!existsSync(path)) return null;
+  if (!existsSync4(path)) return null;
   const raw = await readFile(path, "utf8");
   let parsed;
   try {
@@ -952,15 +963,6 @@ async function loadConfig(repoRoot) {
     value: parsed
   };
 }
-async function writeConfig(repoRoot, value) {
-  const path = configPath(repoRoot);
-  await mkdir(dirname2(path), { recursive: true });
-  const raw = JSON.stringify(value, null, 2) + "\n";
-  const tmp = `${path}.tmp`;
-  await writeFile(tmp, raw, "utf8");
-  await rename(tmp, path);
-  return { path, raw, sha256: bytesHashString(raw) };
-}
 function renderDefaultConfig(detection, overrides = {}) {
   const pm = detection?.packageManager ?? "npm";
   const safeBootstrap = Array.isArray(detection?.worktreeBootstrap) && detection.worktreeBootstrap.length ? detection.worktreeBootstrap : [["npm", "install"]];
@@ -1002,17 +1004,16 @@ function renderDefaultConfig(detection, overrides = {}) {
 
 // src/installer/planner.js
 init_json_pointer();
-init_catalog();
 init_root_config();
 init_root_config();
 async function readBytes(path) {
-  if (!existsSync3(path)) return null;
+  if (!existsSync6(path)) return null;
   const buf = await readFile3(path);
   const fileStat = await stat(path);
   return { bytes: buf, hash: bytesHashString(buf.toString("utf8")), mode: fileStat.mode & 511 };
 }
 async function readDesiredBytes(source) {
-  if (!source || !existsSync3(source)) return null;
+  if (!source || !existsSync6(source)) return null;
   const buf = await readFile3(source);
   return { bytes: buf, hash: bytesHashString(buf.toString("utf8")) };
 }
@@ -1092,6 +1093,33 @@ async function planFileInstall({ repoRoot, lock, allowUnowned = false }) {
   }
   return plan;
 }
+async function planMigrationCleanup({ repoRoot, lock, migrationReport, allowUnowned = false }) {
+  const action = migrationReport?.actions?.find((entry) => entry.kind === "candidate-remove-legacy-plugin-path");
+  if (!action) return [];
+  const relPath = ".opencode/plugin/opencode-ship.js";
+  const target = `${repoRoot}/${relPath}`;
+  const current = await readBytes(target);
+  if (!current) return [];
+  const locked = lookupLockedFile(lock, relPath);
+  if (locked?.sha256 === current.hash || allowUnowned) {
+    return [{
+      kind: "delete",
+      op: "file",
+      target,
+      relPath,
+      reason: "remove the lock-owned v0.2 singular plugin path"
+    }];
+  }
+  return [{
+    kind: "conflict",
+    op: "file",
+    target,
+    relPath,
+    currentSha: current.hash,
+    previousSha: locked?.sha256 ?? null,
+    reason: "legacy singular plugin is unowned or locally modified"
+  }];
+}
 async function planUninstall({ repoRoot, lock }) {
   if (!lock) return [];
   const plan = [];
@@ -1113,7 +1141,7 @@ async function planUninstall({ repoRoot, lock }) {
   }
   return plan;
 }
-async function planConfigSynthesis({ repoRoot, detection, lock, forceOverwrite }) {
+async function planConfigSynthesis({ repoRoot, detection, lock, forceOverwrite, migrationSeed = null }) {
   const existing = await loadConfig(repoRoot);
   if (existing?.ok && !forceOverwrite) {
     return {
@@ -1127,10 +1155,11 @@ async function planConfigSynthesis({ repoRoot, detection, lock, forceOverwrite }
       reason: "user config already present"
     };
   }
-  const desiredValue = renderDefaultConfig(detection);
+  const desiredValue = migrationSeed ?? renderDefaultConfig(detection);
   const desiredJson = JSON.stringify(desiredValue, null, 2) + "\n";
   const desiredSha = bytesHashString(desiredJson);
   const kind = existing?.ok && forceOverwrite ? "update" : "create";
+  const reason = existing?.ok ? "user config overwritten via --force-config" : migrationSeed ? "synthesising a default config from legacy adapter migration" : "synthesising a default config from detection";
   return {
     kind,
     op: "config",
@@ -1140,22 +1169,29 @@ async function planConfigSynthesis({ repoRoot, detection, lock, forceOverwrite }
     desiredSha,
     bytes: Buffer.from(desiredJson, "utf8"),
     configValue: desiredValue,
-    reason: existing?.ok ? "user config overwritten via --force-config" : "synthesising a default config from detection"
+    reason
   };
 }
 async function planRootConfigApply({ repoRoot, lock, forceRepair }) {
   const detected = findRootConfig(repoRoot);
   const target = detected.path ?? defaultRootConfigPath(repoRoot);
   const previous = lock?.manager?.rootDocuments?.find((d) => d.path === detected.relative);
-  const fileMissing = !existsSync3(target);
+  const fileMissing = !existsSync6(target);
   if (fileMissing && !forceRepair) {
+    const seededRecords = previous?.pointers && previous.pointers.length > 0 ? previous.pointers : POINTER_ENTRIES.map((entry) => ({
+      pointer: entry.pointer,
+      strategy: entry.strategy,
+      installedSha256: bytesHashString(stableStringify(entry.value)),
+      previous: { existed: false }
+    }));
     return {
       kind: "noop",
       op: "root-config",
       target,
       relPath: detected.relative,
       reason: "no root opencode.json present",
-      edits: []
+      edits: [],
+      pointerRecords: seededRecords
     };
   }
   if (fileMissing && forceRepair) {
@@ -1163,7 +1199,12 @@ async function planRootConfigApply({ repoRoot, lock, forceRepair }) {
     const doc = synthesizeDefaultRootConfig2();
     const bytes2 = Buffer.from(formatRootConfig3(doc), "utf8");
     const newSha2 = bytesHashString(stableStringify(doc));
-    const installedPointers2 = [];
+    const installedPointers2 = POINTER_ENTRIES.map((entry) => ({
+      pointer: entry.pointer,
+      strategy: entry.strategy,
+      installedSha256: bytesHashString(stableStringify(entry.value)),
+      previous: { existed: false }
+    }));
     return {
       kind: "create",
       op: "root-config",
@@ -1172,7 +1213,7 @@ async function planRootConfigApply({ repoRoot, lock, forceRepair }) {
       bytes: bytes2,
       desiredSha: newSha2,
       currentSha: null,
-      edits: [{ kind: "create", pointer: "(file)", value: "(created)" }],
+      edits: installedPointers2.map((p) => ({ kind: "create", pointer: p.pointer, value: "(synthesized)" })),
       pointerRecords: installedPointers2,
       format: "json",
       document: doc,
@@ -1187,11 +1228,36 @@ async function planRootConfigApply({ repoRoot, lock, forceRepair }) {
       target,
       relPath: detected.relative,
       reason: `root config ${docResult.error.kind}`,
-      edits: []
+      edits: [],
+      pointerRecords: previous?.pointers ?? []
     };
   }
   const previousPointers = previous?.pointers ?? [];
   const result = applyOwnedPointers(docResult.value, { allowEqualValues: true });
+  if (result.applied.length === 0 && result.skipped.every((s) => s.reason === "already equal")) {
+    const ownedPointers = previousPointers.length > 0 ? previousPointers : POINTER_ENTRIES.map((entry) => {
+      const existing = getPointer(docResult.value, entry.pointer);
+      return {
+        pointer: entry.pointer,
+        strategy: entry.strategy,
+        installedSha256: bytesHashString(stableStringify(existing ?? entry.value)),
+        previous: existing === void 0 ? { existed: false } : { existed: true, value: existing }
+      };
+    });
+    return {
+      kind: "noop",
+      op: "root-config",
+      target,
+      relPath: detected.relative,
+      reason: "no installer-owned entries missing",
+      edits: [],
+      pointerRecords: ownedPointers,
+      format: docResult.format,
+      document: docResult.value,
+      currentSha: docResult.sha256 ?? null,
+      desiredSha: docResult.sha256 ?? null
+    };
+  }
   const edits = result.applied.map((a) => ({
     kind: "create",
     pointer: a.pointer,
@@ -1207,8 +1273,8 @@ async function planRootConfigApply({ repoRoot, lock, forceRepair }) {
   let bytes;
   let docForWrite = result.doc;
   try {
-    const { value: sourceValue, format: sourceFormat } = parseRootConfigPreservingOrder2(docResult.raw);
-    docForWrite = sourceValue;
+    const { value: sourceValue, format: sourceFormat } = parseRootConfigPreservingOrder2(docResult.raw ?? "");
+    docForWrite = sourceValue && typeof sourceValue === "object" ? sourceValue : result.doc;
     for (const entry of result.applied) {
       docForWrite = setPointer2(docForWrite, entry.pointer, entry.value);
     }
@@ -1231,6 +1297,17 @@ async function planRootConfigApply({ repoRoot, lock, forceRepair }) {
     if (idx >= 0) installedPointers[idx] = next;
     else installedPointers.push(next);
   }
+  for (const e of result.skipped) {
+    if (e.reason !== "already equal") continue;
+    const idx = installedPointers.findIndex((p) => p.pointer === e.pointer);
+    if (idx >= 0) continue;
+    installedPointers.push({
+      pointer: e.pointer,
+      strategy: "value",
+      installedSha256: bytesHashString(stableStringify(e.existing ?? null)),
+      previous: { existed: true, value: e.existing }
+    });
+  }
   return {
     kind: edits.some((e) => e.kind === "conflict") ? "conflict" : edits.length ? "update" : "noop",
     op: "root-config",
@@ -1247,15 +1324,94 @@ async function planRootConfigApply({ repoRoot, lock, forceRepair }) {
   };
 }
 
+// src/installer/lock.js
+init_hash();
+init_json_pointer();
+import { readFile as readFile4, writeFile as writeFile2, rename as rename2, mkdir as mkdir2 } from "node:fs/promises";
+import { existsSync as existsSync7 } from "node:fs";
+import { dirname as dirname4, resolve as resolve6 } from "node:path";
+var CURRENT_LOCK_SCHEMA = 1;
+function lockPath(repoRoot) {
+  return resolve6(repoRoot, ".opencode", "ship.lock.json");
+}
+function computeIntegrity(lock) {
+  const { integrity: _ignored, ...without } = lock ?? {};
+  void _ignored;
+  return {
+    lockSha256: bytesHashString(stableStringify(without))
+  };
+}
+function validateLock(rawLock) {
+  if (rawLock === null || rawLock === void 0) {
+    return { ok: true, kind: "missing", issues: [] };
+  }
+  if (typeof rawLock !== "object" || Array.isArray(rawLock)) {
+    return { ok: false, kind: "shape", issues: ["lock root must be an object"] };
+  }
+  const issues = [];
+  let kind = "ok";
+  if (rawLock.contractVersion !== CURRENT_LOCK_SCHEMA) {
+    issues.push(`unsupported contractVersion: ${JSON.stringify(rawLock.contractVersion)} (expected ${CURRENT_LOCK_SCHEMA})`);
+    kind = "schema";
+  }
+  const manager = rawLock.manager;
+  if (manager === void 0) {
+    issues.push("manager section missing");
+    kind = kind === "ok" ? "shape" : kind;
+  } else if (typeof manager !== "object" || manager === null) {
+    issues.push("manager section must be an object");
+    kind = kind === "ok" ? "shape" : kind;
+  } else if (manager.schemaVersion !== CURRENT_LOCK_SCHEMA) {
+    issues.push(`unsupported manager.schemaVersion: ${JSON.stringify(manager.schemaVersion)} (expected ${CURRENT_LOCK_SCHEMA})`);
+    kind = "schema";
+  } else if (manager.name !== "opencode-ship") {
+    issues.push(`unknown manager.name: ${JSON.stringify(manager.name)}`);
+    kind = "shape";
+  }
+  if (!rawLock.files || !Array.isArray(rawLock.files)) {
+    issues.push("files must be an array");
+    kind = kind === "ok" ? "shape" : kind;
+  }
+  if (!rawLock.integrity || typeof rawLock.integrity !== "object") {
+    issues.push("integrity section missing");
+    kind = kind === "ok" ? "shape" : kind;
+  } else {
+    const expected = computeIntegrity(rawLock).lockSha256;
+    if (expected !== rawLock.integrity.lockSha256) {
+      issues.push(`integrity mismatch: stored ${rawLock.integrity.lockSha256} != computed ${expected}`);
+      kind = "integrity";
+    }
+  }
+  return { ok: issues.length === 0, kind, issues };
+}
+async function readValidatedLock(repoRoot) {
+  const path = lockPath(repoRoot);
+  if (!existsSync7(path)) {
+    return { kind: "missing", lock: null, issues: [] };
+  }
+  let raw;
+  try {
+    const text = await readFile4(path, "utf8");
+    raw = JSON.parse(text);
+  } catch (e) {
+    return {
+      kind: "integrity",
+      lock: null,
+      issues: [`unable to parse lock JSON: ${e?.message ?? String(e)}`]
+    };
+  }
+  const validation = validateLock(raw);
+  return { kind: validation.kind, lock: validation.ok ? raw : null, issues: validation.issues };
+}
+
 // src/installer/executor.js
-init_lock();
 init_hash();
 init_json_pointer();
 
 // src/installer/detection/project.js
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync2 } from "node:fs";
-import { resolve as resolve5, join } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync4 } from "node:fs";
+import { resolve as resolve7, join } from "node:path";
 function runGit(cwd, args) {
   const r = spawnSync("git", ["-C", cwd, ...args], {
     stdio: ["ignore", "pipe", "pipe"],
@@ -1264,17 +1420,17 @@ function runGit(cwd, args) {
   return { status: r.status ?? -1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
 }
 function detectPackageManager(repoRoot) {
-  if (existsSync5(join(repoRoot, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync5(join(repoRoot, "yarn.lock"))) return "yarn";
-  if (existsSync5(join(repoRoot, "bun.lockb"))) return "bun";
-  if (existsSync5(join(repoRoot, "package-lock.json"))) return "npm";
+  if (existsSync8(join(repoRoot, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync8(join(repoRoot, "yarn.lock"))) return "yarn";
+  if (existsSync8(join(repoRoot, "bun.lockb"))) return "bun";
+  if (existsSync8(join(repoRoot, "package-lock.json"))) return "npm";
   return null;
 }
 function readPackageJson(repoRoot) {
   const path = join(repoRoot, "package.json");
-  if (!existsSync5(path)) return null;
+  if (!existsSync8(path)) return null;
   try {
-    return JSON.parse(readFileSync2(path, "utf8"));
+    return JSON.parse(readFileSync4(path, "utf8"));
   } catch {
     return null;
   }
@@ -1349,7 +1505,7 @@ function detectOwner(repoRoot) {
 }
 function detectProject(repoRoot = process.cwd()) {
   const errors = [];
-  const cwd = resolve5(repoRoot);
+  const cwd = resolve7(repoRoot);
   const inside = runGit(cwd, ["rev-parse", "--show-toplevel"]);
   if (inside.status !== 0) {
     errors.push({ kind: "not-a-git-repo", path: cwd, detail: inside.stderr.trim() });
@@ -1397,7 +1553,6 @@ function detectProject(repoRoot = process.cwd()) {
 
 // src/installer/executor.js
 init_root_config();
-init_lock();
 
 // src/installer/transaction.js
 import {
@@ -1409,34 +1564,62 @@ import {
   stat as stat2,
   open
 } from "node:fs/promises";
-import { existsSync as existsSync6 } from "node:fs";
-import { dirname as dirname4, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync9 } from "node:fs";
+import { dirname as dirname5, resolve as resolve8 } from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
+init_hash();
 function gitDir(repoRoot) {
   const r = spawnSync2("git", ["-C", repoRoot, "rev-parse", "--path-format=absolute", "--git-dir"], {
     encoding: "utf8"
   });
   if (r.status !== 0) return null;
   const trimmed = r.stdout.trim();
-  return trimmed ? resolve6(repoRoot, trimmed) : null;
+  return trimmed ? resolve8(repoRoot, trimmed) : null;
 }
 function lockDir(repoRoot) {
-  return resolve6(gitDir(repoRoot) ?? repoRoot, "opencode-ship");
+  return resolve8(gitDir(repoRoot) ?? repoRoot, "opencode-ship");
 }
 function transactionLockPath(repoRoot) {
-  return resolve6(lockDir(repoRoot), ".txn.lock");
+  return resolve8(lockDir(repoRoot), ".txn.lock");
 }
 function journalPath(repoRoot, txnId) {
-  return resolve6(lockDir(repoRoot), `.txn-${txnId}.journal`);
+  return resolve8(lockDir(repoRoot), `.txn-${txnId}.journal`);
+}
+function backupPath(target, token) {
+  return `${target}.txn-${token}-backup`;
+}
+function stagedPath(target, token) {
+  return `${target}.txn-${token}-staged`;
+}
+async function mkdirp(path) {
+  await mkdir3(path, { recursive: true });
 }
 async function acquireLock(repoRoot, txnId) {
   const dir = lockDir(repoRoot);
-  await mkdir3(dir, { recursive: true });
-  await writeFile3(
-    transactionLockPath(repoRoot),
-    JSON.stringify({ pid: process.pid, txnId, startedAt: (/* @__PURE__ */ new Date()).toISOString() }),
-    { flag: "wx" }
-  );
+  const path = transactionLockPath(repoRoot);
+  await mkdirp(dir);
+  let created = false;
+  try {
+    const handle = await open(path, "wx", 384);
+    created = true;
+    try {
+      await handle.writeFile(JSON.stringify({
+        pid: process.pid,
+        txnId,
+        startedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }));
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await fsyncDir(dir);
+  } catch (error) {
+    if (created) {
+      await unlink(path).catch(() => null);
+      await fsyncDir(dir);
+    }
+    throw error;
+  }
 }
 async function releaseLock(repoRoot) {
   try {
@@ -1444,6 +1627,18 @@ async function releaseLock(repoRoot) {
   } catch {
   }
 }
+async function liveLockOwner(repoRoot) {
+  const path = transactionLockPath(repoRoot);
+  if (!existsSync9(path)) return false;
+  try {
+    const lock = JSON.parse(await readFile5(path, "utf8"));
+    if (!Number.isInteger(lock?.pid) || lock.pid <= 0) return false;
+    process.kill(lock.pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === "EPERM";
+  }
+}
 async function fsyncDir(path) {
   try {
     const handle = await open(path, "r");
@@ -1455,21 +1650,32 @@ async function fsyncDir(path) {
 function randomToken() {
   return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
 }
-async function captureOriginal(target) {
-  if (!existsSync6(target)) return null;
-  try {
-    const bytes = await readFile5(target);
-    const fileStat = await stat2(target);
-    return { bytes, mode: fileStat.mode & 511 };
-  } catch {
-    return null;
-  }
-}
 function asMode(mode) {
   return typeof mode === "number" ? mode : 420;
 }
 async function writeJournal(repoRoot, txnId, journal) {
-  await writeFile3(journalPath(repoRoot, txnId), JSON.stringify(journal, null, 2), "utf8");
+  const { entries, ...header } = journal;
+  const json = { ...header, ledger: entries.map((entry) => ({
+    op: entry.op,
+    target: entry.target,
+    backup: entry.backup ?? null,
+    staged: entry.staged ?? null,
+    hadOriginal: entry.hadOriginal ?? null,
+    commitMarker: entry.commitMarker ?? false,
+    installedSha256: entry.installedSha256 ?? null,
+    mode: entry.mode ?? null
+  })) };
+  const target = journalPath(repoRoot, txnId);
+  const staged = `${target}.tmp`;
+  const handle = await open(staged, "w", 384);
+  try {
+    await handle.writeFile(JSON.stringify(json, null, 2), "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  await rename3(staged, target);
+  await fsyncDir(dirname5(target));
 }
 async function clearJournal(repoRoot, txnId) {
   if (!txnId) return;
@@ -1478,50 +1684,104 @@ async function clearJournal(repoRoot, txnId) {
   } catch {
   }
 }
+async function readJournal(repoRoot, name) {
+  const path = resolve8(lockDir(repoRoot), name);
+  try {
+    const raw = await readFile5(path, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function isCommitted(journal) {
+  if (journal.committed) return true;
+  const marker = journal.ledger?.find((entry) => entry.commitMarker);
+  if (!marker?.target || !marker.installedSha256 || !existsSync9(marker.target)) return false;
+  try {
+    return bytesHashString(await readFile5(marker.target, "utf8")) === marker.installedSha256;
+  } catch {
+    return false;
+  }
+}
+async function restoreEntry(entry) {
+  if (entry.op === "write") {
+    if (entry.backup && existsSync9(entry.backup)) {
+      await rename3(entry.backup, entry.target);
+    } else if (entry.hadOriginal === false && existsSync9(entry.target)) {
+      await unlink(entry.target);
+    }
+    if (entry.staged && existsSync9(entry.staged)) await unlink(entry.staged);
+  } else if (entry.op === "delete" && entry.backup && existsSync9(entry.backup)) {
+    await rename3(entry.backup, entry.target);
+  }
+  await fsyncDir(dirname5(entry.target));
+}
+async function recoverJournal(repoRoot, dir, name) {
+  const journal = await readJournal(repoRoot, name);
+  if (!journal) {
+    await unlink(resolve8(dir, name)).catch(() => null);
+    return true;
+  }
+  const committed = await isCommitted(journal);
+  const entries = committed ? journal.ledger ?? [] : [...journal.ledger ?? []].reverse();
+  let complete = true;
+  for (const entry of entries) {
+    try {
+      if (committed) await commitEntry(entry);
+      else await restoreEntry(entry);
+    } catch {
+      complete = false;
+    }
+  }
+  if (complete) await unlink(resolve8(dir, name)).catch(() => null);
+  return complete;
+}
 async function recover(repoRoot) {
   const dir = lockDir(repoRoot);
-  if (!existsSync6(dir)) return { recovered: false };
+  if (!existsSync9(dir)) return { recovered: false, recoveredCount: 0 };
+  if (await liveLockOwner(repoRoot)) {
+    return { recovered: false, recoveredCount: 0, blocked: true };
+  }
   const { readdir } = await import("node:fs/promises");
   const names = await readdir(dir).catch(() => []);
   const journals = names.filter((n) => n.startsWith(".txn-") && n.endsWith(".journal"));
-  if (!journals.length) return { recovered: false };
+  if (!journals.length) {
+    await releaseLock(repoRoot);
+    return { recovered: false, recoveredCount: 0 };
+  }
   let totalRecovered = 0;
+  let recoveryFailed = false;
   for (const name of journals) {
-    let payload;
-    try {
-      const raw = await readFile5(resolve6(dir, name), "utf8");
-      payload = JSON.parse(raw);
-    } catch {
-      await unlink(resolve6(dir, name)).catch(() => null);
-      continue;
-    }
-    const journal = payload;
-    for (const entry of [...journal.entries ?? []].reverse()) {
-      if (entry.op !== "promote") continue;
-      if (entry.original) {
-        try {
-          await writeFile3(entry.target, entry.original.bytes, { mode: entry.original.mode ?? 420 });
-        } catch {
-        }
-      } else if (entry.staged) {
-        try {
-          await rename3(entry.staged, entry.target);
-        } catch {
-          try {
-            await unlink(entry.staged);
-          } catch {
-          }
-        }
-      }
-    }
-    await unlink(resolve6(dir, name)).catch(() => null);
-    totalRecovered += 1;
+    if (await recoverJournal(repoRoot, dir, name)) totalRecovered += 1;
+    else recoveryFailed = true;
   }
   await releaseLock(repoRoot);
-  return { recovered: totalRecovered > 0, recoveredCount: totalRecovered };
+  return {
+    recovered: totalRecovered > 0,
+    recoveredCount: totalRecovered,
+    blocked: recoveryFailed,
+    reason: recoveryFailed ? "recovery-failed" : null
+  };
+}
+async function commitEntry(entry) {
+  let changed = false;
+  if (entry.backup && existsSync9(entry.backup)) {
+    await unlink(entry.backup);
+    changed = true;
+  }
+  if (entry.staged && existsSync9(entry.staged)) {
+    await unlink(entry.staged);
+    changed = true;
+  }
+  if (changed) await fsyncDir(dirname5(entry.target));
 }
 async function executePlan({ repoRoot, plan, newLockBuilder }) {
   const recovered = await recover(repoRoot);
+  if (recovered.blocked) {
+    const kind = recovered.reason ?? "lock-held";
+    const message = kind === "lock-held" ? "another opencode-ship transaction is active" : "a previous opencode-ship transaction could not be recovered";
+    return { ok: false, error: { kind, message } };
+  }
   const txnId = `txn-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
   try {
     await acquireLock(repoRoot, txnId);
@@ -1529,58 +1789,94 @@ async function executePlan({ repoRoot, plan, newLockBuilder }) {
     return { ok: false, error: { kind: "lock-held", message: e?.message ?? String(e) } };
   }
   const journal = { repoRoot, txnId, startedAt: (/* @__PURE__ */ new Date()).toISOString(), entries: [] };
-  await writeJournal(repoRoot, txnId, journal);
   try {
+    await writeJournal(repoRoot, txnId, journal);
     for (const op of plan) {
       if (op.op !== "file") continue;
       if (op.kind === "conflict" || op.kind === "noop" || op.kind === "converge") continue;
-      const original = await captureOriginal(op.target);
+      const token = randomToken();
+      const backup = backupPath(op.target, token);
+      const staged = stagedPath(op.target, token);
       if (op.kind === "delete") {
-        if (!existsSync6(op.target)) continue;
-        const backup = `${op.target}.txn-${randomToken()}-backup`;
-        await rename3(op.target, backup);
+        if (!existsSync9(op.target)) continue;
         journal.entries.push({
-          op: "promote",
+          op: "delete",
           target: op.target,
-          staged: backup,
-          original,
-          kind: "delete"
+          backup,
+          staged: null,
+          hadOriginal: true,
+          mode: asMode(op.mode)
         });
+        await writeJournal(repoRoot, txnId, journal);
+        await rename3(op.target, backup);
       } else {
-        const tempPath = `${op.target}.txn-${randomToken()}`;
-        await mkdir3(dirname4(op.target), { recursive: true });
-        await writeFile3(tempPath, op.bytes ?? Buffer.alloc(0), { mode: asMode(op.mode) });
-        const h = await open(tempPath, "r+");
-        await h.sync();
-        await h.close();
-        await rename3(tempPath, op.target);
+        await mkdirp(dirname5(op.target));
+        const hadOriginal = existsSync9(op.target);
         journal.entries.push({
-          op: "promote",
+          op: "write",
           target: op.target,
-          staged: tempPath,
-          original,
-          kind: op.kind
+          backup: hadOriginal ? backup : null,
+          staged,
+          hadOriginal,
+          mode: asMode(op.mode)
         });
+        await writeJournal(repoRoot, txnId, journal);
+        await writeFile3(staged, op.bytes ?? Buffer.alloc(0), { mode: asMode(op.mode) });
+        const h = await open(staged, "r+");
+        await h.sync();
+        await h.close();
+        if (hadOriginal) await rename3(op.target, backup);
+        await rename3(staged, op.target);
       }
-      await fsyncDir(dirname4(op.target));
-      await writeJournal(repoRoot, txnId, journal);
+      await fsyncDir(dirname5(op.target));
     }
     if (newLockBuilder) {
       const lockValue = await newLockBuilder();
-      const { writeLock: writer } = await Promise.resolve().then(() => (init_lock(), lock_exports));
       const lockPathTarget = `${repoRoot}/.opencode/ship.lock.json`;
+      await mkdirp(dirname5(lockPathTarget));
+      const token = randomToken();
+      const backup = backupPath(lockPathTarget, token);
+      const staged = stagedPath(lockPathTarget, token);
+      const hadOriginal = existsSync9(lockPathTarget);
+      const finalLock = { ...lockValue, integrity: computeIntegrity(lockValue) };
+      const lockBytes = JSON.stringify(finalLock, null, 2) + "\n";
       journal.entries.push({
-        op: "promote",
+        op: "write",
         target: lockPathTarget,
-        staged: lockPathTarget,
-        original: await captureOriginal(lockPathTarget),
-        kind: "lock"
+        backup: hadOriginal ? backup : null,
+        staged,
+        hadOriginal,
+        commitMarker: true,
+        installedSha256: bytesHashString(lockBytes),
+        mode: 420
       });
-      await writer(repoRoot, lockValue);
       await writeJournal(repoRoot, txnId, journal);
+      await writeFile3(staged, lockBytes, { mode: 420 });
+      const handle = await open(staged, "r+");
+      await handle.sync();
+      await handle.close();
+      if (hadOriginal) await rename3(lockPathTarget, backup);
+      await rename3(staged, lockPathTarget);
+      await fsyncDir(dirname5(lockPathTarget));
+    }
+    journal.committed = true;
+    await writeJournal(repoRoot, txnId, journal);
+    let cleanupComplete = true;
+    for (const entry of journal.entries) {
+      try {
+        await commitEntry(entry);
+      } catch {
+        cleanupComplete = false;
+      }
     }
-    await clearJournal(repoRoot, txnId);
-    return { ok: true, txnId, recovered: recovered.recovered ?? false, recoveredCount: recovered.recoveredCount ?? 0 };
+    if (cleanupComplete) await clearJournal(repoRoot, txnId);
+    return {
+      ok: true,
+      txnId,
+      recovered: recovered.recovered ?? false,
+      recoveredCount: recovered.recoveredCount ?? 0,
+      cleanupPending: !cleanupComplete
+    };
   } catch (e) {
     await rollback(repoRoot, journal);
     return { ok: false, error: { kind: "transaction-failed", message: e?.message ?? String(e) } };
@@ -1589,75 +1885,51 @@ async function executePlan({ repoRoot, plan, newLockBuilder }) {
   }
 }
 async function rollback(repoRoot, journal) {
-  for (const entry of [...journal.entries ?? []].reverse()) {
-    if (entry.op !== "promote") continue;
-    if (entry.original) {
-      try {
-        await writeFile3(entry.target, entry.original.bytes, { mode: entry.original.mode ?? 420 });
-      } catch {
-      }
-    } else if (entry.staged) {
-      try {
-        await rename3(entry.staged, entry.target);
-      } catch {
-        try {
-          await unlink(entry.staged);
-        } catch {
-        }
-      }
-    } else {
-      try {
-        await unlink(entry.target);
-      } catch {
-      }
-    }
-    if (entry.staged && entry.staged !== entry.target && existsSync6(entry.staged)) {
-      try {
-        await unlink(entry.staged);
-      } catch {
-      }
+  const entries = journal.entries ?? journal.ledger ?? [];
+  let complete = true;
+  for (const entry of [...entries].reverse()) {
+    try {
+      await restoreEntry(entry);
+    } catch {
+      complete = false;
     }
   }
-  if (journal.txnId) await clearJournal(repoRoot, journal.txnId);
+  if (complete && journal.txnId) await clearJournal(repoRoot, journal.txnId);
 }
 
 // src/installer/migration.js
-init_lock();
 import { readFile as readFile6 } from "node:fs/promises";
-import { existsSync as existsSync7 } from "node:fs";
-import { resolve as resolve8 } from "node:path";
-
-// src/installer/ship-adapter.js
-import { resolve as resolve7 } from "node:path";
-
-// src/installer/migration.js
+import { existsSync as existsSync10 } from "node:fs";
+import { resolve as resolve9 } from "node:path";
 function legacyAdapterPath(repoRoot) {
-  return resolve8(repoRoot, ".opencode", "delivery.json");
+  return resolve9(repoRoot, ".opencode", "delivery.json");
 }
 function legacyLockPath(repoRoot) {
-  return resolve8(repoRoot, ".opencode", "delivery.lock.json");
+  return resolve9(repoRoot, ".opencode", "delivery.lock.json");
 }
 function legacyPluginPath(repoRoot) {
-  return resolve8(repoRoot, ".opencode", "plugin", "delivery.ts");
+  return resolve9(repoRoot, ".opencode", "plugin", "delivery.ts");
 }
 async function detectLegacyShapes(repoRoot) {
   const out = {
     adapter: false,
     legacyLock: false,
     plugin: false,
+    pluginOld: false,
     reviewer: false,
     verifier: false
   };
-  if (existsSync7(legacyAdapterPath(repoRoot))) out.adapter = true;
-  if (existsSync7(legacyLockPath(repoRoot))) out.legacyLock = true;
-  if (existsSync7(legacyPluginPath(repoRoot))) out.plugin = true;
-  if (existsSync7(resolve8(repoRoot, ".opencode/agents/delivery-reviewer.md"))) out.reviewer = true;
-  if (existsSync7(resolve8(repoRoot, ".opencode/agents/delivery-verifier.md"))) out.verifier = true;
+  if (existsSync10(legacyAdapterPath(repoRoot))) out.adapter = true;
+  if (existsSync10(legacyLockPath(repoRoot))) out.legacyLock = true;
+  if (existsSync10(legacyPluginPath(repoRoot))) out.plugin = true;
+  if (existsSync10(resolve9(repoRoot, ".opencode/plugin/opencode-ship.js"))) out.pluginOld = true;
+  if (existsSync10(resolve9(repoRoot, ".opencode/agents/delivery-reviewer.md"))) out.reviewer = true;
+  if (existsSync10(resolve9(repoRoot, ".opencode/agents/delivery-verifier.md"))) out.verifier = true;
   return out;
 }
 async function readLegacyAdapter(repoRoot) {
   const path = legacyAdapterPath(repoRoot);
-  if (!existsSync7(path)) return null;
+  if (!existsSync10(path)) return null;
   try {
     const raw = await readFile6(path, "utf8");
     return { path, raw, value: JSON.parse(raw) };
@@ -1665,44 +1937,49 @@ async function readLegacyAdapter(repoRoot) {
     return null;
   }
 }
-async function migration({ repoRoot, lock, forceRepair }) {
+async function migration({ repoRoot, lock, forceRepair, detection = null }) {
   const shapes = await detectLegacyShapes(repoRoot);
   const legacy = await readLegacyAdapter(repoRoot);
   const config = await loadConfig(repoRoot);
   const actions = [];
+  let proposedConfigSeed = null;
   if (legacy && !config?.ok) {
-    await writeConfig(repoRoot, legacyToShipConfig(legacy.value));
-    actions.push({ kind: "seeded-config", from: legacy.path });
+    proposedConfigSeed = legacyToShipConfig(legacy.value, detection);
+    actions.push({ kind: "candidate-seed-config", from: legacy.path });
   }
   if (legacy && shapes.legacyLock && !lock?.manager) {
     actions.push({ kind: "kept-legacy-lock", path: legacyLockPath(repoRoot) });
   }
-  if (shapes.plugin && existsSync7(resolve8(repoRoot, ".opencode/plugin/opencode-ship.js"))) {
+  if (shapes.plugin && existsSync10(resolve9(repoRoot, ".opencode/plugins/opencode-ship.js"))) {
     if (!forceRepair) {
       actions.push({ kind: "candidate-remove-legacy-plugin", path: legacyPluginPath(repoRoot) });
     }
   }
-  return { shapes, actions, legacyPresent: Boolean(legacy) };
+  if (shapes.pluginOld) {
+    actions.push({ kind: "candidate-remove-legacy-plugin-path", path: resolve9(repoRoot, ".opencode/plugin/opencode-ship.js") });
+  }
+  return { shapes, actions, legacyPresent: Boolean(legacy), proposedConfigSeed };
 }
-function legacyToShipConfig(legacy) {
-  if (!legacy || typeof legacy !== "object") return renderDefaultConfig({});
+function legacyToShipConfig(legacy, detection = null) {
+  if (!legacy || typeof legacy !== "object") return renderDefaultConfig(detection ?? {});
+  const repoSlug = typeof legacy.repository?.repoSlug === "string" ? legacy.repository.repoSlug : detection?.repository ?? "owner/repo";
   return {
     schemaVersion: 1,
     project: {
-      remote: legacy.repository?.remote ?? "origin",
-      repository: legacy.repository?.defaultBranch?.name ?? legacy.repository?.remote ?? "owner/repo",
-      defaultBranch: legacy.repository?.defaultBranch?.name ?? "main",
-      packageManager: "npm",
+      remote: legacy.repository?.remote ?? detection?.remote ?? "origin",
+      repository: repoSlug,
+      defaultBranch: legacy.repository?.defaultBranch?.name ?? detection?.defaultBranch ?? "main",
+      packageManager: detection?.packageManager ?? "pnpm",
       detectOverrides: false
     },
     delivery: {
       worktree: {
         root: legacy.worktree?.root ?? ".worktrees",
         branchTemplate: legacy.worktree?.branchTemplate ?? "{actor}/{slug}",
-        bootstrap: Array.isArray(legacy.worktree?.bootstrap) ? legacy.worktree.bootstrap : [["npm", "install"]]
+        bootstrap: Array.isArray(legacy.worktree?.bootstrap) && legacy.worktree.bootstrap.length ? legacy.worktree.bootstrap : [["pnpm", "install", "--frozen-lockfile"]]
       },
       verification: {
-        commands: legacy.verification?.commands?.length ? legacy.verification.commands : [{ id: "typecheck", argv: ["npm", "run", "typecheck"] }],
+        commands: Array.isArray(legacy.verification?.commands) && legacy.verification.commands.length ? legacy.verification.commands : [{ id: "canonical", argv: ["pnpm", "verify:workspace"], timeoutMs: 18e5 }],
         requireCleanDiffAfter: legacy.verification?.requireCleanDiffAfter ?? true,
         invalidateOnHeadChange: legacy.verification?.invalidateOnHeadChange ?? true
       },
@@ -1715,14 +1992,14 @@ function legacyToShipConfig(legacy) {
       },
       ready: legacy.ready ?? { requires: ["review", "local-verification", "remote-ci"], stopAfterReady: true },
       merge: legacy.merge ?? { strategy: "squash", policy: "explicit-user-request-only", requireFreshGates: true },
-      cleanup: legacy.cleanup ?? { when: "next-task", requireUnpublishedGuard: true }
+      cleanup: legacy.cleanup && typeof legacy.cleanup === "object" && "when" in legacy.cleanup ? legacy.cleanup : { when: "next-task", requireUnpublishedGuard: true }
     }
   };
 }
 
 // src/installer/executor.js
 async function readCurrentBytes(targetPath) {
-  if (!existsSync8(targetPath)) return null;
+  if (!existsSync11(targetPath)) return null;
   const buf = await readFile7(targetPath);
   return { bytes: buf, hash: bytesHashString(buf.toString("utf8")) };
 }
@@ -1732,17 +2009,31 @@ async function previewInstall({ rootPath, replaceManaged, forceConfig, forceRoot
     return { ok: false, error: { kind: "invalid-project", errors: detection.errors } };
   }
   const repoRoot = detection.repoRoot;
-  const lock = await readLock(repoRoot);
-  const migrationReport = await migration({ repoRoot, lock, forceRepair: false });
+  const validatedLock = await readValidatedLock(repoRoot);
+  if (validatedLock.kind === "schema") {
+    return { ok: false, error: { kind: "unsupported-lock-schema", issues: validatedLock.issues } };
+  }
+  if (validatedLock.kind === "integrity" || validatedLock.kind === "shape") {
+    return { ok: false, error: { kind: "lock-invalid", issues: validatedLock.issues } };
+  }
+  const lock = validatedLock.lock;
+  const migrationReport = await migration({ repoRoot, lock, forceRepair: false, detection });
   const configPlan = await planConfigSynthesis({
     repoRoot,
     detection,
     lock,
-    forceOverwrite: Boolean(forceConfig)
+    forceOverwrite: Boolean(forceConfig),
+    migrationSeed: migrationReport?.proposedConfigSeed ?? null
   });
   const filePlan = await planFileInstall({ repoRoot, lock, allowUnowned: Boolean(replaceManaged) });
+  const migrationPlan = await planMigrationCleanup({
+    repoRoot,
+    lock,
+    migrationReport,
+    allowUnowned: Boolean(replaceManaged)
+  });
   const rootPlan = await planRootConfigApply({ repoRoot, lock, forceRepair: Boolean(forceRootConfig) });
-  const plan = [...filePlan ?? [], configPlan, rootPlan];
+  const plan = [...filePlan ?? [], ...migrationPlan, configPlan, rootPlan];
   const conflicts = plan.filter((p) => p && p.kind === "conflict");
   const summary = summarise(plan);
   return { ok: true, repoRoot, detection, lock, plan, conflicts, summary, migrationReport };
@@ -1753,9 +2044,16 @@ async function previewUninstall({ rootPath }) {
     return { ok: false, error: { kind: "invalid-project" } };
   }
   const repoRoot = detection.repoRoot;
-  const lock = await readLock(repoRoot);
+  const validatedLock = await readValidatedLock(repoRoot);
+  if (validatedLock.kind === "schema") {
+    return { ok: false, error: { kind: "unsupported-lock-schema", issues: validatedLock.issues } };
+  }
+  if (validatedLock.kind === "integrity" || validatedLock.kind === "shape") {
+    return { ok: false, error: { kind: "lock-invalid", issues: validatedLock.issues } };
+  }
+  const lock = validatedLock.lock;
   if (!lock) {
-    return { ok: true, repoRoot, lock, plan: [], conflicts: [], summary: summarise([]) };
+    return { ok: true, repoRoot, lock: null, plan: [], conflicts: [], summary: summarise([]) };
   }
   const plan = await planUninstall({ repoRoot, lock });
   const conflicts = plan.filter((p) => p.kind === "conflict");
@@ -1798,24 +2096,26 @@ async function assembleLock({ repoRoot, plan, lock, configPlan, rootPlan }) {
   }
   const configSha = configPlan?.kind === "create" || configPlan?.kind === "update" ? configPlan.desiredSha : configPlan?.kind === "noop" ? configPlan.currentSha : null;
   const rootPointers = rootPlan?.pointerRecords ?? lock?.manager?.rootDocuments?.[0]?.pointers ?? [];
+  const hasRootPlan = Boolean(rootPlan?.target || rootPlan?.pointerRecords && rootPlan.pointerRecords.length > 0);
+  const hasRootDocuments = rootPlan?.pointerRecords && rootPlan.pointerRecords.length > 0 || lock?.manager?.rootDocuments && lock.manager.rootDocuments.length > 0;
   return {
     contractVersion: 1,
     manager: {
       schemaVersion: 1,
       name: "opencode-ship",
-      version: "0.2.1",
-      templateSet: getTemplateSet(),
+      version: "0.3.0",
+      templateSet: TEMPLATE_SET_ID,
       appliedAt: (/* @__PURE__ */ new Date()).toISOString(),
       config: {
         path: ".opencode/ship.config.json",
         sha256: configSha ?? lock?.manager?.config?.sha256 ?? "",
         existed: Boolean(lock?.manager?.config?.existed)
       },
-      rootDocuments: rootPlan?.kind && rootPlan.kind !== "noop" && rootPlan?.target ? [{
-        path: rootPlan.relPath,
-        format: rootPlan.format ?? "json",
-        pointers: rootPointers
-      }] : lock?.manager?.rootDocuments ?? []
+      rootDocuments: hasRootDocuments && (hasRootPlan || (lock?.manager?.rootDocuments?.length ?? 0) > 0) ? [{
+        path: rootPlan?.relPath ?? lock?.manager?.rootDocuments?.[0]?.path ?? "opencode.json",
+        format: rootPlan?.format ?? lock?.manager?.rootDocuments?.[0]?.format ?? "json",
+        pointers: rootPlan?.pointerRecords && rootPlan.pointerRecords.length > 0 ? rootPlan.pointerRecords : lock?.manager?.rootDocuments?.[0]?.pointers ?? []
+      }] : []
     },
     files,
     cleanupPending: lock?.cleanupPending ?? []
@@ -1908,7 +2208,16 @@ async function commitInstall(preview, { json, command }) {
 async function stageFiles(filePlan, repoRoot) {
   const out = [];
   for (const op of filePlan) {
-    if (op.kind === "conflict" || op.kind === "noop" || op.kind === "converge" || op.kind === "delete") continue;
+    if (op.kind === "conflict" || op.kind === "noop" || op.kind === "converge") continue;
+    if (op.kind === "delete") {
+      out.push({
+        op: "file",
+        kind: "delete",
+        target: op.target,
+        relPath: op.relPath
+      });
+      continue;
+    }
     out.push({
       op: "file",
       kind: op.kind,
@@ -1937,12 +2246,11 @@ function relativeTemplate(source) {
 }
 
 // src/installer/commands/doctor.js
-init_lock();
-import { existsSync as existsSync9, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync5 } from "node:fs";
 import { spawnSync as spawnSync3 } from "node:child_process";
 init_hash();
+import { resolve as resolve11 } from "node:path";
 init_root_config();
-import { resolve as resolve10 } from "node:path";
 
 // src/installer/report.js
 var REPORT_VERSION = 1;
@@ -2015,14 +2323,77 @@ function checkGhAuth() {
     detail: r.status === 0 ? "authenticated (token)" : (r.stderr || r.stdout || "").trim() || "no session"
   };
 }
+function checkPackageIntegrity() {
+  try {
+    validateCatalog();
+    return { name: "package integrity", ok: true, detail: `${CATALOG.length} catalog entries` };
+  } catch (e) {
+    return {
+      name: "package integrity",
+      ok: false,
+      detail: `${e?.message ?? e}: ${(e?.issues ?? []).map((i) => i.message).join("; ")}`
+    };
+  }
+}
+function buildSourceHashIndex() {
+  const idx = /* @__PURE__ */ new Map();
+  for (const entry of CATALOG) {
+    if (!existsSync12(entry.source)) continue;
+    try {
+      const buf = readFileSync5(entry.source, "utf8");
+      idx.set(entry.source, bytesHashString(buf));
+    } catch {
+    }
+  }
+  return idx;
+}
+function checkCatalogInstall(repoRoot, sourceHashes) {
+  const rows = [];
+  for (const entry of CATALOG) {
+    const target = resolve11(repoRoot, entry.path);
+    if (!existsSync12(target)) {
+      rows.push(`${entry.id}: missing`);
+      continue;
+    }
+    try {
+      const buf = readFileSync5(target, "utf8");
+      const actual = bytesHashString(buf);
+      const expected = sourceHashes.get(entry.source);
+      if (expected && expected !== actual) {
+        rows.push(`${entry.id}: drift`);
+      } else {
+        rows.push(`${entry.id}: ok`);
+      }
+    } catch (e) {
+      rows.push(`${entry.id}: ${e?.message ?? e}`);
+    }
+  }
+  const allOk = rows.length === 0 || rows.every((r) => r.endsWith("ok"));
+  return {
+    name: "catalog assets present",
+    ok: allOk,
+    detail: rows.join(",")
+  };
+}
 async function checkLock(repoRoot) {
-  const lock = await readLock(repoRoot);
-  if (!lock) return { name: "lock present", ok: false, detail: "missing" };
-  const integrityOk = await validateIntegrity(lock);
+  const result = await readValidatedLock(repoRoot);
+  if (result.kind === "missing") {
+    return { name: "lock present", ok: false, detail: "no lock" };
+  }
+  if (result.kind === "schema") {
+    return { name: "lock present", ok: false, detail: `unsupported schema: ${result.issues.join("; ")}` };
+  }
+  if (result.kind === "integrity") {
+    return { name: "lock present", ok: false, detail: `integrity: ${result.issues.join("; ")}` };
+  }
+  if (result.kind === "shape") {
+    return { name: "lock present", ok: false, detail: `malformed: ${result.issues.join("; ")}` };
+  }
+  const lock = result.lock;
   return {
     name: "lock present",
-    ok: integrityOk,
-    detail: integrityOk ? `v0.2 manager@${lock.manager?.version ?? "?"}` : "integrity mismatch"
+    ok: true,
+    detail: `manager@${lock.manager?.version ?? "?"} schema=${lock.manager?.schemaVersion ?? "?"}`
   };
 }
 async function checkConfig(repoRoot) {
@@ -2033,45 +2404,18 @@ async function checkConfig(repoRoot) {
     detail: r?.ok ? "loaded" : r?.error?.kind ?? "missing"
   };
 }
-function checkPlugin(repoRoot) {
-  const path = resolve10(repoRoot, ".opencode/plugin/opencode-ship.js");
-  if (!existsSync9(path)) return { name: "plugin", ok: false, detail: "missing" };
-  try {
-    const buf = readFileSync3(path, "utf8");
-    return { name: "plugin", ok: buf.includes("opencode-ship"), detail: "loaded" };
-  } catch (e) {
-    return { name: "plugin", ok: false, detail: e.message };
+async function checkManagedHashes(repoRoot, validatedLock) {
+  if (validatedLock.kind !== "ok" || !validatedLock.lock) {
+    return { name: "managed hashes", ok: false, detail: "no usable lock" };
   }
-}
-function checkAgents(repoRoot) {
-  const reviewer = resolve10(repoRoot, ".opencode/agents/delivery-reviewer.md");
-  const verifier = resolve10(repoRoot, ".opencode/agents/delivery-verifier.md");
-  return {
-    name: "canonical agents",
-    ok: existsSync9(reviewer) && existsSync9(verifier),
-    detail: existsSync9(reviewer) && existsSync9(verifier) ? "loaded" : "missing"
-  };
-}
-function checkSkills(repoRoot) {
-  const a = resolve10(repoRoot, ".opencode/skills/delivery-workflow/SKILL.md");
-  const b = resolve10(repoRoot, ".opencode/skills/planning-research-checkpoint/SKILL.md");
-  return {
-    name: "canonical skills",
-    ok: existsSync9(a) && existsSync9(b),
-    detail: existsSync9(a) && existsSync9(b) ? "loaded" : "missing"
-  };
-}
-async function checkManagedHashes(repoRoot) {
-  const lock = await readLock(repoRoot);
-  if (!lock) return { name: "managed hashes", ok: false, detail: "no lock" };
   const drift = [];
-  for (const entry of lock.files ?? []) {
-    const p = resolve10(repoRoot, entry.path);
-    if (!existsSync9(p)) {
+  for (const entry of validatedLock.lock.files ?? []) {
+    const p = resolve11(repoRoot, entry.path);
+    if (!existsSync12(p)) {
       drift.push(`missing:${entry.path}`);
       continue;
     }
-    const buf = readFileSync3(p, "utf8");
+    const buf = readFileSync5(p, "utf8");
     const actual = bytesHashString(buf);
     if (actual !== entry.sha256) drift.push(`drift:${entry.path}`);
   }
@@ -2117,17 +2461,19 @@ async function runDoctor({ rootPath, json, writeOutput = true }) {
     return { issues: issues2, exitCode: 2, plan: plan2, checks: checks2 };
   }
   const repoRoot = detection.repoRoot;
+  const sourceHashes = buildSourceHashIndex();
+  const validatedLock = await readValidatedLock(repoRoot);
+  const packageIntegrity = checkPackageIntegrity();
   const checks = [
     checkNode(),
     checkGit(),
     checkGh(),
     checkGhAuth(),
+    packageIntegrity,
+    checkCatalogInstall(repoRoot, sourceHashes),
     await checkLock(repoRoot),
     await checkConfig(repoRoot),
-    checkPlugin(repoRoot),
-    checkAgents(repoRoot),
-    checkSkills(repoRoot),
-    await checkManagedHashes(repoRoot),
+    await checkManagedHashes(repoRoot, validatedLock),
     await checkRootConfig(repoRoot)
   ];
   const issues = checks.filter((c) => !c.ok).map((c) => `${c.name}: ${c.detail}`);
@@ -2139,7 +2485,10 @@ async function runDoctor({ rootPath, json, writeOutput = true }) {
     reason: c.detail
   }));
   const summary = summarise2(plan);
-  const exitCode = issues.length === 0 ? 0 : 1;
+  let exitCode = 1;
+  if (issues.length === 0) exitCode = 0;
+  if (!packageIntegrity.ok) exitCode = 4;
+  if (validatedLock.kind === "schema") exitCode = 5;
   if (writeOutput) writeEnvelope({ command: "doctor", plan, summary, diagnostics: issues, json, exitCode });
   process.exitCode = exitCode;
   return { issues, exitCode, plan, checks };
@@ -2147,6 +2496,14 @@ async function runDoctor({ rootPath, json, writeOutput = true }) {
 
 // src/installer/commands/init.js
 async function runInit(options) {
+  try {
+    validateCatalog();
+  } catch (e) {
+    if (e?.catalogValidation) {
+      return emitFailure(4, `catalog validation failed: ${e.message}`, options.json, "init");
+    }
+    throw e;
+  }
   const preview = await previewInstall({
     rootPath: options.rootPath ?? null,
     replaceManaged: false,
@@ -2154,6 +2511,12 @@ async function runInit(options) {
     forceRootConfig: Boolean(options.forceRootConfig)
   });
   if (!preview.ok) {
+    if (preview.error?.kind === "unsupported-lock-schema") {
+      return emitFailure(5, `unsupported lock schema: ${(preview.error.issues ?? []).join("; ")}`, options.json, "init");
+    }
+    if (preview.error?.kind === "lock-invalid") {
+      return emitFailure(3, `lock invalid: ${(preview.error.issues ?? []).join("; ")}`, options.json, "init");
+    }
     return emitFailure(2, preview.error?.kind ?? "invalid-project", options.json, "init");
   }
   const committed = await commitInstall(preview, { json: options.json, command: "init" });
@@ -2245,6 +2608,30 @@ function serializePlan2(plan) {
   });
 }
 async function runDiff(options) {
+  try {
+    validateCatalog();
+  } catch (e) {
+    if (e?.catalogValidation) {
+      if (options.json) {
+        process.stdout.write(JSON.stringify({
+          reportVersion: 1,
+          command: "diff",
+          status: "error",
+          plan: [],
+          conflicts: [],
+          summary: { create: 0, update: 0, noop: 0, delete: 0, conflict: 0, converge: 0 },
+          diagnostics: [`catalog validation failed: ${e.message}`],
+          exitCode: 4
+        }, null, 2) + "\n");
+      } else {
+        process.stdout.write(`opencode-ship: catalog validation failed: ${e.message}
+`);
+      }
+      process.exitCode = 4;
+      return { ok: false, exitCode: 4 };
+    }
+    throw e;
+  }
   const preview = await previewInstall({
     rootPath: options.rootPath ?? null,
     replaceManaged: false,
@@ -2252,6 +2639,8 @@ async function runDiff(options) {
     forceRootConfig: false
   });
   if (!preview.ok) {
+    const exitCode = preview.error?.kind === "unsupported-lock-schema" ? 5 : preview.error?.kind === "lock-invalid" ? 3 : 2;
+    const message = preview.error?.kind === "lock-invalid" ? `lock invalid: ${(preview.error.issues ?? []).join("; ")}` : preview.error?.kind === "unsupported-lock-schema" ? `unsupported lock schema: ${(preview.error.issues ?? []).join("; ")}` : preview.error?.kind ?? "invalid-project";
     if (options.json) {
       process.stdout.write(JSON.stringify({
         reportVersion: 1,
@@ -2260,15 +2649,15 @@ async function runDiff(options) {
         plan: [],
         conflicts: [],
         summary: { create: 0, update: 0, noop: 0, delete: 0, conflict: 0, converge: 0 },
-        diagnostics: [preview.error?.kind ?? "invalid-project"],
-        exitCode: 2
+        diagnostics: [message],
+        exitCode
       }, null, 2) + "\n");
     } else {
-      process.stdout.write(`opencode-ship: ${preview.error?.kind ?? "invalid-project"}
+      process.stdout.write(`opencode-ship: ${message}
 `);
     }
-    process.exitCode = 2;
-    return { ok: false, exitCode: 2 };
+    process.exitCode = exitCode;
+    return { ok: false, exitCode };
   }
   const { plan, conflicts, migrationReport } = preview;
   const summary = summarise3(plan);
@@ -2305,6 +2694,14 @@ async function runDiff(options) {
 
 // src/installer/commands/update.js
 async function runUpdate(options) {
+  try {
+    validateCatalog();
+  } catch (e) {
+    if (e?.catalogValidation) {
+      return emitFailure2(4, `catalog validation failed: ${e.message}`, options.json, "update");
+    }
+    throw e;
+  }
   const preview = await previewInstall({
     rootPath: options.rootPath,
     replaceManaged: options.replaceManaged,
@@ -2312,6 +2709,12 @@ async function runUpdate(options) {
     forceRootConfig: options.forceRootConfig
   });
   if (!preview.ok) {
+    if (preview.error?.kind === "unsupported-lock-schema") {
+      return emitFailure2(5, `unsupported lock schema: ${(preview.error.issues ?? []).join("; ")}`, options.json, "update");
+    }
+    if (preview.error?.kind === "lock-invalid") {
+      return emitFailure2(3, `lock invalid: ${(preview.error.issues ?? []).join("; ")}`, options.json, "update");
+    }
     return emitFailure2(2, preview.error?.kind ?? "invalid-project", options.json, "update");
   }
   if (preview.conflicts.length > 0 && !options.replaceManaged) {
@@ -2359,11 +2762,17 @@ function emitFailure2(code, message, json, command) {
 
 // src/installer/commands/uninstall.js
 import { unlink as unlink3 } from "node:fs/promises";
-import { existsSync as existsSync10 } from "node:fs";
-import { resolve as resolve11 } from "node:path";
+import { existsSync as existsSync13 } from "node:fs";
+import { resolve as resolve12 } from "node:path";
 async function runUninstall(options) {
   const preview = await previewUninstall({ rootPath: options.rootPath });
   if (!preview.ok) {
+    if (preview.error?.kind === "unsupported-lock-schema") {
+      return emitFailure3(5, `unsupported lock schema: ${(preview.error.issues ?? []).join("; ")}`, options.json);
+    }
+    if (preview.error?.kind === "lock-invalid") {
+      return emitFailure3(3, `lock invalid: ${(preview.error.issues ?? []).join("; ")}`, options.json);
+    }
     return emitFailure3(2, preview.error?.kind ?? "invalid-project", options.json);
   }
   const { repoRoot, plan, conflicts, summary } = preview;
@@ -2374,8 +2783,8 @@ async function runUninstall(options) {
   if (!tx.ok) {
     return emitFailure3(4, tx.error?.message ?? "transaction failure", options.json);
   }
-  const lockPath2 = resolve11(repoRoot, ".opencode", "ship.lock.json");
-  if (existsSync10(lockPath2)) await unlink3(lockPath2).catch(() => null);
+  const lockPath2 = resolve12(repoRoot, ".opencode", "ship.lock.json");
+  if (existsSync13(lockPath2)) await unlink3(lockPath2).catch(() => null);
   if (options.purgeConfig) {
     await unlink3(configPath(repoRoot)).catch(() => null);
   }
@@ -2432,7 +2841,7 @@ function emitReport(plan, conflicts, summary, json, exitCode, diagnostics) {
 }
 
 // src/cli.js
-var VERSION = "0.2.1";
+var VERSION = PACKAGE_VERSION;
 async function main() {
   const parsed = parseCommand(process.argv.slice(2));
   if (parsed.command === "help") {