fix(install): guard state before selective merge

scripts/lib/install/apply.js

@@ -337,8 +337,12 @@ function previewInstallPlan(plan) {
 
 function applyInstallPlan(plan, dependencies = {}) {
   const persistInstallState = dependencies.writeInstallState || writeInstallState;
+  const beforeInstallStateRead = dependencies.beforeInstallStateRead;
   const beforeOperationWrite = dependencies.beforeOperationWrite;
   const beforeInstallStateWrite = dependencies.beforeInstallStateWrite;
+  if (typeof beforeInstallStateRead === 'function') {
+    beforeInstallStateRead({ plan });
+  }
   const migration = prepareClaudeSkillMigration(plan);
   const appliedPlan = {
     ...plan,

scripts/lib/multi-harness-setup.js

@@ -327,6 +327,7 @@ async function applyPreflightedManagedPlan(entry) {
   );
 
   const result = require('./install-executor').applyInstallPlan(preview.plan, {
+    beforeInstallStateRead: assertStateUnchanged,
     beforeOperationWrite({ operation }) {
       assertStateUnchanged();
       const expected = preview.operations[operationIndex];

tests/lib/install-claude-skill-migration.test.js

@@ -490,12 +490,33 @@ function runTests() {
           operation.destinationPath === extraDestinationPath
         )));
 
+        const updatedExtraOperation = {
+          ...extraOperation,
+          moduleId: 'skill-extra-updated',
+        };
+        applyInstallPlan({
+          ...extraPlan,
+          operations: [updatedExtraOperation],
+          statePreview: {
+            ...extraPlan.statePreview,
+            operations: [updatedExtraOperation],
+          },
+        });
+        const stateAfterMetadataUpdate = readInstallState(fixture.installStatePath);
+        const updatedExtraRecords = stateAfterMetadataUpdate.operations.filter(operation => (
+          operation.destinationPath === extraDestinationPath
+        ));
+        assert.strictEqual(updatedExtraRecords.length, 1);
+        assert.strictEqual(updatedExtraRecords[0].moduleId, 'skill-extra-updated');
+
         const retry = applyInstallPlan(fixture.plan);
         assert.deepStrictEqual(retry.skippedOperations, []);
         const stateAfterRetry = readInstallState(fixture.installStatePath);
-        assert.ok(stateAfterRetry.operations.some(operation => (
+        const retainedExtraRecords = stateAfterRetry.operations.filter(operation => (
           operation.destinationPath === extraDestinationPath
-        )));
+        ));
+        assert.strictEqual(retainedExtraRecords.length, 1);
+        assert.strictEqual(retainedExtraRecords[0].moduleId, 'skill-extra-updated');
 
         const uninstall = runUninstall(fixture);
         assert.strictEqual(uninstall.summary.errorCount, 0);