forked from mosaicstack/stack
Design-only planning artifact for #791. Traces the wipe mechanism (install.sh:199 rsync --delete gated by PRESERVE_PATHS denylist) and specifies the ratified (b)+(a)+(d) fix: framework-owned manifest allow-list with fail-safe unknown=>operator default and manifest-scoped prune, a transactional pre-update snapshot with mosaic restore, and a projection-only mosaic fleet regen recovery path. No implementation changes. Refs #791 Co-Authored-By: Claude Opus 4.8 <[email protected]>