@@ -833,7 +833,12 @@ worse, lets a warm cache silently serve unpatched bytes):
   (purl or patch uuid; v5 keeps no hosted ledger) restores each matched pin to its default
   upstream registry entry — the same restore as `rollback` (see "Hosted unwind coverage"), for every
   ecosystem. A hosted-only match works with no manifest at all (mirroring the manifest-less
-  vendored escape). A pin the restore refuses (`--offline`, a registry that does not answer,
+  vendored escape). **One owned pin per release**: an identifier that matches a manifest entry
+  also selects the vendored ledger entry that entry claims and every hosted pin wiring the same
+  package release, whatever patch uuid (generation) each recorded — so `remove <uuid A>` of a
+  record a later scan superseded with patch B (vendored or hosted) unwinds B's wiring too. That
+  hosted restore needs the registry lookups below, so such a remove can refuse offline where the
+  manifest entry alone would not. A pin the restore refuses (`--offline`, a registry that does not answer,
   `bun.lockb`, …) or a failed write is the top-level `hosted_revert_failed` error BEFORE the
   manifest mutation (exit 1, manifest not modified; message `could not restore <purl> to its
   upstream registry entry: … (`git checkout -- <files>`)`). v4's `hosted_revert_unsupported` is no
@@ -888,7 +893,7 @@ worse, lets a warm cache silently serve unpatched bytes):
 
 ### Targets
 
-`rollback [TARGET]...` — zero or more targets, unioned. `pkg:` tokens are PURLs (base purl matches every release variant; qualified purl exact), other identifier-shaped tokens are UUIDs, and only **path-shaped** tokens (separator, glob metachar `*?[`, `./` prefix, or absolute) are path globs — see the per-subcommand args table for the safety rationale. Identifier matching runs across ALL THREE sources (a hosted pin matches by purl or by the patch uuid in its hosted URL); an identifier matching nothing anywhere is the familiar exit-1 error. Path globs use the same matcher as `scan [PATHS]` (ancestor rule, `require_literal_separator`, absolute-only outside `--cwd`, Windows case-insensitive): installed copies of every candidate purl are discovered and purls with ≥ 1 matching copy are selected. Scoping sentences (shared with scan):
+`rollback [TARGET]...` — zero or more targets, unioned. `pkg:` tokens are PURLs (base purl matches every release variant; qualified purl exact), other identifier-shaped tokens are UUIDs, and only **path-shaped** tokens (separator, glob metachar `*?[`, `./` prefix, or absolute) are path globs — see the per-subcommand args table for the safety rationale. Identifier matching runs across ALL THREE sources (a hosted pin matches by purl or by the patch uuid in its hosted URL); an identifier that matches a manifest entry also selects the vendored ledger entry that entry claims and every hosted pin of the same package release under any patch uuid (one owned pin per release — `remove` parity); an identifier matching nothing anywhere is the familiar exit-1 error. Path globs use the same matcher as `scan [PATHS]` (ancestor rule, `require_literal_separator`, absolute-only outside `--cwd`, Windows case-insensitive): installed copies of every candidate purl are discovered and purls with ≥ 1 matching copy are selected. Scoping sentences (shared with scan):
 
 * **A target that selects nothing is an error on `rollback` (exit 1) and an empty scan on `scan` (exit 0).** Each rollback path pattern must select at least one patched package; the error names the pattern and the reachability rule.
 * **Path targets select installed copies; entries with no installed copy are reachable only by identifier or unscoped runs.**
 
@@ -1144,8 +1144,9 @@ async fn a_git_pattern_hosted_pin_is_refused_not_restored_to_the_registry() {
     assert!(
         envelope["hosted"]["failed"][0]["error"]
             .as_str()
-            .is_some_and(|e| e.contains("installs from git")
-                && e.contains("`git checkout -- yarn.lock`")),
+            .is_some_and(
+                |e| e.contains("installs from git") && e.contains("`git checkout -- yarn.lock`")
+            ),
         "{envelope}"
     );
     assert_eq!(
@@ -1568,3 +1569,33 @@ async fn remove_unhosts_a_package_whose_agent_record_is_superseded() {
         "the superseded record is reported:\n{envelope:#}"
     );
 }
+
+/// B07: a remove/rollback identifier that names the superseded record's
+/// uuid (A) selects the whole owned pin, so the hosted pin of the same
+/// release under the superseding uuid (B) is unwound too, instead of being
+/// left live with no record.
+#[tokio::test]
+#[serial]
+async fn remove_and_rollback_by_superseded_record_uuid_unhost_the_release() {
+    for command in ["remove", "rollback"] {
+        let server = MockServer::start().await;
+        let tmp = tempfile::tempdir().unwrap();
+        let pristine = write_superseded_agent_fixture(tmp.path(), &server, B_PATCHED_INDEX).await;
+
+        let (code, envelope) = if command == "remove" {
+            run_remove_subprocess_online(tmp.path(), &server, SUPERSEDED_UUID)
+        } else {
+            run_rollback_subprocess_online(tmp.path(), &server, &[SUPERSEDED_UUID])
+        };
+        assert_eq!(code, 0, "{command}:\n{envelope:#}");
+        let restored = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
+        assert_eq!(
+            restored, pristine,
+            "{command} {SUPERSEDED_UUID} must unwind the hosted pin of the same release:\n{envelope:#}"
+        );
+        assert!(
+            manifest_patch_keys(tmp.path()).is_empty(),
+            "{command}:\n{envelope:#}"
+        );
+    }
+}