Implement single-owner managed takeover

docs/config.md

@@ -418,6 +418,24 @@ pipelines:
 
 Every output path in a shared root belongs to exactly one `pipeline_id` and `destination_id`. A different owner planning the same path fails as a conflict.
 
+## Takeover Policy
+
+```yaml
+takeover:
+  mode: same_pipeline
+```
+
+- `takeover.mode`: optional. Accepted values are `same_pipeline`, `same_source`, `any_managed`, and `never`; default is `same_pipeline`.
+
+Takeover controls when a single-owner destination may normally replace valid distributor-managed state whose pipeline, destination, or source identity differs from the current publication.
+
+- `same_pipeline`: replace managed state owned by the same pipeline. The previous destination id and source id may differ.
+- `same_source`: replace managed state only when the existing source manifest id matches the current source id.
+- `any_managed`: replace any valid distributor-managed single-owner state at the selected destination bundle path.
+- `never`: do not replace identity or source conflicts without the explicit forced replacement workflow.
+
+Takeover does not apply to unmanaged content, invalid destination state, same-created digest conflicts, same-source destination-newer comparisons, or shared-root output paths owned by another owner.
+
 ## Reconciliation Policy
 
 ```yaml
@@ -529,6 +547,7 @@ Defaults are applied after YAML decoding and before validation:
 - `links.primary: auto` when a `links` block is present and `primary` is omitted
 - `state.mode: single_owner`
 - `reconciliation.mode: replace`
+- `takeover.mode: same_pipeline`
 - `retention.prune.enabled: false`
 - `transfer.on_destination_same: skip`
 - `transfer.on_destination_older: replace`