diff --git a/docs/.vitepress/cli-reference.ts b/docs/.vitepress/cli-reference.ts
index 6f3d878dcb6..f2afaca2043 100644
--- a/docs/.vitepress/cli-reference.ts
+++ b/docs/.vitepress/cli-reference.ts
@@ -29,6 +29,7 @@ const guides: Record<string, [string, string]> = {
   set: ["Environment variables", "/environments/"],
   unset: ["Environment variables", "/environments/"],
   exec: ["Running tools", "/dev-tools/"],
+  installs: ["Install layout", "/dev-tools/install-layout.html"],
   backends: ["Choosing backends", "/dev-tools/backends/"],
   config: ["Configuration", "/configuration.html"],
   edit: ["Configuration", "/configuration.html"],
@@ -145,7 +146,7 @@ const guides: Record<string, [string, string]> = {
 const categories = [
   [
     "Install and inspect tools",
-    "use install install-into uninstall unuse upgrade outdated lock latest ls ls-remote tool where which bin-paths registry search backends link sync prune reshim tool-stub packslip",
+    "use install install-into installs uninstall unuse upgrade outdated lock latest ls ls-remote tool where which bin-paths registry search backends link sync prune reshim tool-stub packslip",
   ],
   [
     "Shell and environment",
diff --git a/docs/.vitepress/cli_commands.ts b/docs/.vitepress/cli_commands.ts
index d9e6e53f3ca..8fa7de05680 100644
--- a/docs/.vitepress/cli_commands.ts
+++ b/docs/.vitepress/cli_commands.ts
@@ -697,6 +697,17 @@ export const commands: { [key: string]: Command } = {
   "install-into": {
     hide: false,
   },
+  installs: {
+    hide: false,
+    subcommands: {
+      ls: {
+        hide: false,
+      },
+      select: {
+        hide: false,
+      },
+    },
+  },
   latest: {
     hide: false,
   },
diff --git a/docs/cli/index.md b/docs/cli/index.md
index 14581ec4a4a..07607617097 100644
--- a/docs/cli/index.md
+++ b/docs/cli/index.md
@@ -65,6 +65,7 @@ Choose a command family below. Its page lists the available subcommands.
 - [`mise use`](/cli/use.html) — Install a tool and add it to configuration
 - [`mise install`](/cli/install.html) — Install a tool version
 - [`mise install-into`](/cli/install-into.html) — Install a tool version to a specific path
+- [`mise installs`](/cli/installs.html) — [experimental] Inspect and choose installations of the identity install layout
 - [`mise uninstall`](/cli/uninstall.html) — Remove installed tool versions
 - [`mise unuse`](/cli/unuse.html) — Remove tool requests from configuration and prune unused installations
 - [`mise upgrade`](/cli/upgrade.html) — Upgrade outdated tools
diff --git a/docs/cli/installs.md b/docs/cli/installs.md
new file mode 100644
index 00000000000..5a8e93f2747
--- /dev/null
+++ b/docs/cli/installs.md
@@ -0,0 +1,34 @@
+---
+description: "[experimental] Inspect and choose installations of the identity install layout"
+---
+
+<!-- @generated by usage-cli from usage spec -->
+# `mise installs`
+
+- **Usage:** `mise installs [SUBCOMMAND]`
+- **Effect:** read-only
+- **Source code:** [`src/cli/installs/mod.rs`](https://github.com/jdx/mise/blob/main/src/cli/installs/mod.rs)
+
+[experimental] Inspect and choose installations of the identity install layout
+
+With `install_layout = "identity"`, each installation lives in its own
+`<label>-<hash>` directory, and several installations of one version can
+exist side by side (different options, platforms, pinned artifacts, or a
+refreshed copy). These commands list them and choose which one requests
+without a lockfile use.
+
+## Flags
+- **`-h --help`** — Print help
+
+## Subcommands
+
+- [`mise installs ls [-J --json] [--no-header] [TOOL]…`](/cli/installs/ls.html)
+- [`mise installs select <INSTALLATION>`](/cli/installs/select.html)
+
+<!-- generated reference navigation -->
+
+## Related documentation
+
+- [Install layout](/dev-tools/install-layout.html).
+- [All commands](/cli/).
+- [Global flags and argument syntax](/cli/#global-flags).
diff --git a/docs/cli/installs/ls.md b/docs/cli/installs/ls.md
new file mode 100644
index 00000000000..7ad2f7c37c0
--- /dev/null
+++ b/docs/cli/installs/ls.md
@@ -0,0 +1,49 @@
+---
+description: "List the installations of the identity install layout"
+---
+
+<!-- @generated by usage-cli from usage spec -->
+# `mise installs ls`
+
+- **Usage:** `mise installs ls [-J --json] [--no-header] [TOOL]…`
+- **Aliases:** `list`
+- **Effect:** read-only
+- **Source code:** [`src/cli/installs/ls.rs`](https://github.com/jdx/mise/blob/main/src/cli/installs/ls.rs)
+
+List the installations of the identity install layout
+
+Every installation is listed separately, so variants of one version (made
+with different options, or pinned to different artifacts by lockfiles) can
+be told apart. The status column says which installation requests without
+a lockfile use (`selected`), which a lockfile adopted (`pinned`), and which
+live in a read-only shared installs directory (`shared`).
+
+## Arguments
+- **`[TOOL]…`** — Only show the installations of these tools
+
+## Flags
+- **`-J --json`** — Output in JSON format
+- **`--no-header`** — Don't display headers
+- **`-h --help`** — Print help
+
+## Examples
+
+Every installation in the identity layout
+
+```
+mise installs ls
+```
+
+The installations of node, as JSON
+
+```
+mise installs ls node --json
+```
+
+<!-- generated reference navigation -->
+
+## Related documentation
+
+- [Install layout](/dev-tools/install-layout.html).
+- [`mise installs [SUBCOMMAND]`](/cli/installs.html).
+- [Global flags and argument syntax](/cli/#global-flags).
diff --git a/docs/cli/installs/select.md b/docs/cli/installs/select.md
new file mode 100644
index 00000000000..e4a432c4871
--- /dev/null
+++ b/docs/cli/installs/select.md
@@ -0,0 +1,46 @@
+---
+description: "Choose the installation that requests without a lockfile use"
+---
+
+<!-- @generated by usage-cli from usage spec -->
+# `mise installs select`
+
+- **Usage:** `mise installs select <INSTALLATION>`
+- **Effect:** modifies state
+- **Source code:** [`src/cli/installs/select.rs`](https://github.com/jdx/mise/blob/main/src/cli/installs/select.rs)
+
+Choose the installation that requests without a lockfile use
+
+Several installations can answer the same request: a refresh that could not
+replace a lockfile's installation in place, or installations made for
+different lockfiles. Requests without a lockfile entry use the one selected
+for their tool, version, platform and options, and when none is selected and
+several match, mise stops and asks for this command.
+
+The selection is shared by every project on this machine that makes the same
+request without a lockfile. Projects whose lockfile pins an artifact keep the
+installation of that artifact. The version link (`installs/<tool>/<version>`)
+is pointed at the selected installation.
+
+## Arguments
+- **`<INSTALLATION>`** — The installation to select: its directory name, or its path
+
+## Flags
+- **`-h --help`** — Print help
+
+## Examples
+
+Find jq's installations, then choose one
+
+```
+mise installs ls jq
+mise installs select jq-hm3qa4vb
+```
+
+<!-- generated reference navigation -->
+
+## Related documentation
+
+- [Install layout](/dev-tools/install-layout.html).
+- [`mise installs [SUBCOMMAND]`](/cli/installs.html).
+- [Global flags and argument syntax](/cli/#global-flags).
diff --git a/docs/dev-tools/install-layout.md b/docs/dev-tools/install-layout.md
index a9d48fbda47..c78299a7452 100644
--- a/docs/dev-tools/install-layout.md
+++ b/docs/dev-tools/install-layout.md
@@ -273,6 +273,54 @@ one project does not retarget what another project's unlocked request selects.
 Unlocked selections are local to your machine. To carry a particular choice to
 other machines or teammates, commit a lockfile.
 
+## Choosing an installation: `mise installs`
+
+Several installations can answer one unlocked request: a forced refresh that
+could not replace a lockfile's installation in place, or installations that
+lockfiles in other projects made. `mise installs ls` lists every installation
+and says which one each request uses:
+
+```sh
+mise installs ls jq
+# Installation  Tool  Version  Platform   Status
+# jq-hm3qa4vb   jq    1.7.1    linux-x64  selected
+# jq-ezjqmxa4   jq    1.7.1    linux-x64  pinned
+```
+
+`selected` is the installation requests without a lockfile use, `pinned` means a
+lockfile adopted it, and `shared` means it is in a read-only shared installs
+directory. Add `--json` for the full identity, including options and the
+artifact checksum.
+
+`mise installs select` makes another installation the selected one, and points
+the version link (`installs/jq/1.7.1`) at it:
+
+```sh
+mise installs select jq-ezjqmxa4
+```
+
+The selection applies to every project on the machine that asks for the same
+tool, version, platform and options without a lockfile. Projects whose lockfile
+pins an artifact keep that artifact's installation. To select an installation in
+a shared installs directory, pass its path; the selection is kept in your own
+installs directory, and nothing is written to the shared one.
+
+**When nothing is selected.** The first unlocked install of a request selects
+the installation it made. If the selection is lost (the catalog was rebuilt from
+receipts, for example), or the request was only ever installed by lockfiles,
+mise looks at the installations that answer it. With exactly one, mise uses and
+selects it. With several, mise stops instead of guessing, and lists them:
+
+```text
+mise ERROR jq@1.7.1 matches several installations and none is selected:
+  jq-hm3qa4vb
+  jq-ezjqmxa4 (a lockfile pins it)
+Choose one with `mise installs select <dir>`, or install a fresh one with `mise install --force jq@1.7.1`
+```
+
+If the selected installation has since been pruned, installing restores it in
+the same directory rather than choosing another one.
+
 ## Pruning and uninstalling
 
 Both work on one installation directory at a time.
@@ -283,7 +331,9 @@ Both work on one installation directory at a time.
   the install store that has neither a receipt nor a reservation in the
   catalog. Removing one variant leaves the others in place.
 - Removing an installation keeps its catalog record, so installing the same
-  identity again lands in the same directory.
+  identity again lands in the same directory. `mise uninstall` also forgets the
+  selection that named it, so the requests it answered choose again; a pruned
+  installation keeps its selection and is restored in place.
 - `mise prune` keeps an installation while a tracked config needs it. An unlocked
   request needs the installation it selects. A tracked lockfile entry needs the
   installations of its backend and version, narrowed to the pinned artifact when
diff --git a/docs/public/llms.txt b/docs/public/llms.txt
index 8cae0aa9ed8..7198d54366f 100644
--- a/docs/public/llms.txt
+++ b/docs/public/llms.txt
@@ -349,6 +349,9 @@
 - [mise implode](https://mise.jdx.dev/cli/implode.html): Remove the mise CLI and all related data
 - [mise install](https://mise.jdx.dev/cli/install.html): Install a tool version
 - [mise install-into](https://mise.jdx.dev/cli/install-into.html): Install a tool version to a specific path
+- [mise installs](https://mise.jdx.dev/cli/installs.html): [experimental] Inspect and choose installations of the identity install layout
+- [mise installs ls](https://mise.jdx.dev/cli/installs/ls.html): List the installations of the identity install layout
+- [mise installs select](https://mise.jdx.dev/cli/installs/select.html): Choose the installation that requests without a lockfile use
 - [mise latest](https://mise.jdx.dev/cli/latest.html): Resolve the latest matching version request for a tool
 - [mise link](https://mise.jdx.dev/cli/link.html): Symlink a tool version into mise
 - [mise lock](https://mise.jdx.dev/cli/lock.html): Create or refresh lockfile versions, checksums, and download URLs
diff --git a/e2e/cli/test_install_layout_select b/e2e/cli/test_install_layout_select
new file mode 100644
index 00000000000..704667165dc
--- /dev/null
+++ b/e2e/cli/test_install_layout_select
@@ -0,0 +1,224 @@
+#!/usr/bin/env bash
+# Choosing installations under the identity install layout: `mise installs ls`
+# lists every installation, `mise installs select` chooses the one requests
+# without a lockfile use, and with nothing selected mise reuses an installation
+# only when exactly one answers the request.
+export MISE_EXPERIMENTAL=1
+export MISE_INSTALL_LAYOUT=identity
+export MISE_LOCKFILE=1
+
+installs="$MISE_DATA_DIR/installs"
+detect_platform
+
+lock_dummy() { # <dir> <version> <checksum>
+  mkdir -p "$1"
+  echo "tools.dummy = \"$2\"" >"$1/mise.toml"
+  cat >"$1/mise.lock" <<EOF
+[[tools.dummy]]
+version = "$2"
+backend = "asdf:dummy"
+"platforms.$MISE_PLATFORM" = { checksum = "$3" }
+EOF
+}
+
+echo "=== an unlocked install and a locked one of the same version ==="
+assert "mise install dummy@1.1.0"
+unlocked="$(mise where dummy@1.1.0)"
+lock_dummy locked 1.1.0 sha256:aaaa
+assert "mise -C locked install"
+locked="$(mise -C locked where dummy)"
+[[ $locked != "$unlocked" ]] || fail "the pinned install reused $unlocked"
+
+echo "=== mise installs ls lists both, with what each is ==="
+assert_contains "mise installs ls dummy" "$(basename "$unlocked")"
+assert_contains "mise installs ls dummy" "$(basename "$locked")"
+assert "mise installs ls dummy --json | jq -r '.[] | select(.selected) | .name'" "$(basename "$unlocked")"
+assert "mise installs ls dummy --json | jq -r '.[] | select(.pinned) | .name'" "$(basename "$locked")"
+assert "mise installs ls dummy --json | jq -r '.[] | select(.pinned) | .mode'" "resolved"
+assert "mise installs ls --json | jq length" "2"
+
+echo "=== select moves requests without a lockfile, and the version link ==="
+assert_contains "mise installs select $(basename "$locked")" "every project that asks for it without a lockfile"
+assert "mise where dummy@1.1.0" "$locked"
+assert "readlink '$installs/dummy/1.1.0'" "../$(basename "$locked")"
+assert "mise -C locked where dummy" "$locked"
+assert "mise installs ls dummy --json | jq -r '.[] | select(.selected) | .name'" "$(basename "$locked")"
+# a path works as well as a name
+assert "mise installs select $unlocked"
+assert "mise where dummy@1.1.0" "$unlocked"
+assert "readlink '$installs/dummy/1.1.0'" "../$(basename "$unlocked")"
+assert_fail "mise installs select dummy-nothere1" "is not an installation"
+
+echo "=== with the selection lost and two candidates, mise does not guess ==="
+rm -rf "$installs/.mise/selections"
+assert_fail "mise install dummy@1.1.0" "matches several installations and none is selected"
+assert_fail "mise install dummy@1.1.0" "mise installs select"
+# nothing runs one of them in the meantime
+assert_fail "mise where dummy@1.1.0"
+assert_fail "mise x dummy@1.1.0 -- dummy" "matches several installations"
+# the locked project still has its pinned installation
+assert "mise -C locked where dummy" "$locked"
+assert "mise installs select $(basename "$unlocked")"
+assert_contains "mise install dummy@1.1.0 2>&1" "already installed"
+assert "mise where dummy@1.1.0" "$unlocked"
+
+echo "=== a forced install is the other way out ==="
+rm -rf "$installs/.mise/selections"
+assert "mise install --force dummy@1.1.0"
+assert "mise where dummy@1.1.0" "$unlocked"
+assert "mise installs ls dummy --json | jq -r '.[] | select(.selected) | .name'" "$(basename "$unlocked")"
+
+echo "=== with one candidate, it is reused and selected ==="
+assert "mise install dummy@2.0.0"
+only="$(mise where dummy@2.0.0)"
+rm -rf "$installs/.mise/selections"
+assert_contains "mise install dummy@2.0.0 2>&1" "already installed"
+assert "mise where dummy@2.0.0" "$only"
+assert "mise installs ls dummy --json | jq -r '.[] | select(.selected and .version == \"2.0.0\") | .name'" "$(basename "$only")"
+
+echo "=== an unlocked request adopts the one installation a lockfile made ==="
+lock_dummy pinned 1.0.0 sha256:bbbb
+assert "mise -C pinned install"
+pinned="$(mise -C pinned where dummy)"
+assert_contains "mise install dummy@1.0.0 2>&1" "already installed"
+assert "mise where dummy@1.0.0" "$pinned"
+assert "test \"\$(mise installs ls dummy --json | jq '[.[] | select(.version == \"1.0.0\")] | length')\" -eq 1"
+
+echo "=== a selection can name an installation in a read-only shared root ==="
+shared="$HOME/shared-installs"
+assert "MISE_INSTALLS_DIR='$shared' mise install tiny@3.1.0"
+shared_dir="$(MISE_INSTALLS_DIR="$shared" mise where tiny@3.1.0)"
+[[ $shared_dir == "$shared"/tiny-* ]] || fail "$shared_dir is not in the shared root"
+shared_state="$(find "$shared" -printf '%p %s %T@\n' | sort)"
+export MISE_SHARED_INSTALL_DIRS="$shared"
+assert "mise where tiny@3.1.0" "$shared_dir"
+assert_contains "mise install tiny@3.1.0 2>&1" "already installed"
+assert "mise installs ls tiny --json | jq -r '.[] | select(.selected) | .shared'" "true"
+# adopting it makes the user's own version link to it
+assert "readlink '$installs/tiny/3.1.0'" "$shared_dir"
+# a forced install writes a copy into the user's own root and selects it
+assert "mise install --force tiny@3.1.0"
+own_dir="$(mise where tiny@3.1.0)"
+[[ $own_dir == "$installs"/tiny-* ]] || fail "$own_dir is not in the user's root"
+assert "test -f '$shared_dir/.mise-install.toml'"
+# the same identity has the same name in both roots: the name alone is ambiguous
+assert_fail "mise installs select $(basename "$shared_dir")" "pass its path"
+assert "mise installs select $shared_dir"
+assert "mise where tiny@3.1.0" "$shared_dir"
+# nothing was written into the shared root
+[[ "$(find "$shared" -printf '%p %s %T@\n' | sort)" == "$shared_state" ]] ||
+  fail "the shared root was written to"
+# a shared catalog that lost its record still has the installation's receipt,
+# which is enough to use and to select it
+mv "$shared/.mise/identities" "$shared/.mise/identities.lost"
+assert "mise where tiny@3.1.0" "$shared_dir"
+assert "mise installs select $shared_dir"
+mv "$shared/.mise/identities.lost" "$shared/.mise/identities"
+echo "=== a selected shared installation that is gone is not replaced silently ==="
+rm -rf "$shared_dir"
+assert_fail "mise install tiny@3.1.0" "no longer has it"
+# even with the whole root gone, the copy of the same identity in the user's own
+# root is not quietly used in its place
+rm -rf "$shared"
+assert_fail "mise install tiny@3.1.0" "no longer has it"
+assert_fail "mise x tiny@3.1.0 -- rtx-tiny" "no longer has it"
+assert "mise installs select $own_dir"
+assert "mise where tiny@3.1.0" "$own_dir"
+
+echo "=== one installation in each root and nothing selected is still a guess ==="
+shared2="$HOME/shared-installs-2"
+assert "MISE_INSTALLS_DIR='$shared2' mise install tiny@3.0.0"
+export MISE_SHARED_INSTALL_DIRS="$shared2"
+assert "mise install --force tiny@3.0.0"
+mine="$(mise where tiny@3.0.0)"
+[[ $mine == "$installs"/tiny-* ]] || fail "$mine is not in the user's root"
+rm -rf "$installs/.mise/selections"
+assert_fail "mise install tiny@3.0.0" "matches several installations and none is selected"
+# both copies have the same name, so each is listed by its path
+assert_fail "mise install tiny@3.0.0" "shared-installs-2/tiny-"
+# the shared copy still counts when its catalog is gone
+mv "$shared2/.mise" "$shared2/.mise.lost"
+assert_fail "mise install tiny@3.0.0" "matches several installations and none is selected"
+mv "$shared2/.mise.lost" "$shared2/.mise"
+assert "mise installs select $mine"
+assert "mise where tiny@3.0.0" "$mine"
+
+echo "=== a pruned selection is restored in place, not replaced by the shared copy ==="
+# what prune leaves behind: the payload is gone, its catalog record and the
+# selection stay
+rm -rf "$mine"
+assert "test -d '$shared2/$(basename "$mine")'"
+assert "mise install tiny@3.0.0"
+assert "mise where tiny@3.0.0" "$mine"
+assert "test -f '$mine/.mise-install.toml'"
+
+echo "=== selecting a shared installation moves the user's version link to it ==="
+assert "mise installs select $shared2/$(basename "$mine")"
+assert "readlink '$installs/tiny/3.0.0'" "$shared2/$(basename "$mine")"
+# ...and makes the link when the tool directory is gone
+assert "mise installs select $mine"
+rm -rf "$installs/tiny"
+assert "mise installs select $shared2/$(basename "$mine")"
+assert "readlink '$installs/tiny/3.0.0'" "$shared2/$(basename "$mine")"
+# ...and rebuilding the tool's links keeps it there, not on the user's own copy
+rm "$installs/tiny/3.0.0"
+assert "mise install tiny@1.0.0"
+assert "readlink '$installs/tiny/3.0.0'" "$shared2/$(basename "$mine")"
+
+echo "=== removing the user's own copy keeps the version link to the shared one ==="
+assert "mise prune --yes tiny"
+assert "test ! -e '$mine'"
+assert "readlink '$installs/tiny/3.0.0'" "$shared2/$(basename "$mine")"
+
+echo "=== a shared root that is also the user's own is one root ==="
+export MISE_SHARED_INSTALL_DIRS="$installs:$shared2"
+assert "mise install --force tiny@3.0.0"
+assert "mise installs ls tiny --json | jq '[.[] | select(.version == \"3.0.0\")] | length'" "2"
+
+echo "=== the tool's version link follows a selection across option variants ==="
+cat >flavored.toml <<'EOF2'
+[tools]
+dummy = { version = "2.0.0", flavor = "full" }
+EOF2
+assert "MISE_CONFIG_FILE=$PWD/flavored.toml mise install"
+full="$(MISE_CONFIG_FILE=$PWD/flavored.toml mise where dummy)"
+assert "readlink '$installs/dummy/2.0.0'" "../$(basename "$full")"
+assert "mise installs select $only"
+assert "readlink '$installs/dummy/2.0.0'" "../$(basename "$only")"
+
+echo "=== where does not fall back to a variant while the request's own choice is open ==="
+# two installations of the plain request, nothing selected, and a variant with options
+mkdir -p locked2
+echo 'tools.dummy = "2.0.0"' >locked2/mise.toml
+cat >locked2/mise.lock <<EOF2
+[[tools.dummy]]
+version = "2.0.0"
+backend = "asdf:dummy"
+"platforms.$MISE_PLATFORM" = { checksum = "sha256:dddd" }
+EOF2
+assert "mise -C locked2 install"
+rm -rf "$installs/.mise/selections"
+assert_fail "mise where dummy@2.0.0"
+
+echo "=== after mise uninstall, the request chooses again ==="
+unset MISE_SHARED_INSTALL_DIRS
+assert "mise install tiny@2.1.0"
+gone="$(mise where tiny@2.1.0)"
+mkdir -p "$HOME/shared3/tiny"
+cp -a "$gone" "$HOME/shared3/tiny/2.1.0"
+assert "mise uninstall tiny@2.1.0"
+export MISE_SHARED_INSTALL_DIRS="$HOME/shared3"
+assert "mise where tiny@2.1.0" "$HOME/shared3/tiny/2.1.0"
+
+echo "=== a pruned selection does not hide an install made before this layout ==="
+unset MISE_SHARED_INSTALL_DIRS
+assert "mise install tiny@2.0.0"
+pruned="$(mise where tiny@2.0.0)"
+assert "mise installs ls tiny --json | jq -r '.[] | select(.selected and .version == \"2.0.0\") | .name'" "$(basename "$pruned")"
+assert "mise prune --yes tiny"
+assert "test ! -e '$pruned'"
+# a real directory at the version's path is what PATH runs, so it is what mise uses
+mkdir -p "$installs/tiny/2.0.0/bin"
+assert "mise where tiny@2.0.0" "$installs/tiny/2.0.0"
+assert_contains "mise install tiny@2.0.0 2>&1" "already installed"
+assert "test ! -e '$pruned'"
diff --git a/man/man1/mise.1 b/man/man1/mise.1
index 867ff495868..5ccaae8cf52 100644
--- a/man/man1/mise.1
+++ b/man/man1/mise.1
@@ -742,6 +742,18 @@ Install a tool version
 \fBinstall\-into\fR
 Install a tool version to a specific path
 .TP
+\fBinstalls\fR
+[experimental] Inspect and choose installations of the identity install layout
+.TP
+\fBinstalls ls\fR
+List the installations of the identity install layout
+.RS
+\fIAliases: \fRlist
+.RE
+.TP
+\fBinstalls select\fR
+Choose the installation that requests without a lockfile use
+.TP
 \fBlatest\fR
 Resolve the latest matching version request for a tool
 .TP
@@ -6102,6 +6114,96 @@ install node@20.0.0 into ./mynode
 mise install\-into node@20.0.0 ./mynode && ./mynode/bin/node \-v
 v20.0.0
 .RE
+.SH "MISE INSTALLS"
+[experimental] Inspect and choose installations of the identity install layout
+
+With `install_layout = "identity"`, each installation lives in its own
+`<label>\-<hash>` directory, and several installations of one version can
+exist side by side (different options, platforms, pinned artifacts, or a
+refreshed copy). These commands list them and choose which one requests
+without a lockfile use.
+.PP
+\fBUsage:\fR mise installs [OPTIONS] [COMMAND]
+.PP
+\fBOptions:\fR
+.PP
+.TP
+\fB\-h, \-\-help\fR
+Print help
+.SH "MISE INSTALLS LS"
+List the installations of the identity install layout
+
+Every installation is listed separately, so variants of one version (made
+with different options, or pinned to different artifacts by lockfiles) can
+be told apart. The status column says which installation requests without
+a lockfile use (`selected`), which a lockfile adopted (`pinned`), and which
+live in a read\-only shared installs directory (`shared`).
+.PP
+\fBUsage:\fR mise installs ls [OPTIONS] [<TOOL>] ...
+.PP
+\fBOptions:\fR
+.PP
+.TP
+\fB\-J, \-\-json\fR
+Output in JSON format
+.TP
+\fB\-\-no\-header\fR
+Don't display headers
+.TP
+\fB\-h, \-\-help\fR
+Print help
+\fBArguments:\fR
+.PP
+.TP
+\fB<TOOL>\fR
+Only show the installations of these tools
+\fBExamples:\fR
+.PP
+Every installation in the identity layout
+.PP
+.RS 4
+mise installs ls
+.RE
+.PP
+The installations of node, as JSON
+.PP
+.RS 4
+mise installs ls node \-\-json
+.RE
+.SH "MISE INSTALLS SELECT"
+Choose the installation that requests without a lockfile use
+
+Several installations can answer the same request: a refresh that could not
+replace a lockfile's installation in place, or installations made for
+different lockfiles. Requests without a lockfile entry use the one selected
+for their tool, version, platform and options, and when none is selected and
+several match, mise stops and asks for this command.
+
+The selection is shared by every project on this machine that makes the same
+request without a lockfile. Projects whose lockfile pins an artifact keep the
+installation of that artifact. The version link (`installs/<tool>/<version>`)
+is pointed at the selected installation.
+.PP
+\fBUsage:\fR mise installs select [OPTIONS] <INSTALLATION>
+.PP
+\fBOptions:\fR
+.PP
+.TP
+\fB\-h, \-\-help\fR
+Print help
+\fBArguments:\fR
+.PP
+.TP
+\fB<INSTALLATION>\fR
+The installation to select: its directory name, or its path
+\fBExamples:\fR
+.PP
+Find jq's installations, then choose one
+.PP
+.RS 4
+mise installs ls jq
+mise installs select jq\-hm3qa4vb
+.RE
 .SH "MISE LATEST"
 Resolve the latest matching version request for a tool
 
diff --git a/mise.usage.kdl b/mise.usage.kdl
index e853b3e1030..4298953be84 100644
--- a/mise.usage.kdl
+++ b/mise.usage.kdl
@@ -3931,6 +3931,58 @@ v20.0.0
 """# help="install node@20.0.0 into ./mynode"
     complete path type=dir
 }
+cmd installs help="[experimental] Inspect and choose installations of the identity install layout" effect=read {
+    long_help #"""
+[experimental] Inspect and choose installations of the identity install layout
+
+With `install_layout = "identity"`, each installation lives in its own
+`<label>-<hash>` directory, and several installations of one version can
+exist side by side (different options, platforms, pinned artifacts, or a
+refreshed copy). These commands list them and choose which one requests
+without a lockfile use.
+"""#
+    flag "-h --help" help="Print help" action=help builtin=#true
+    cmd ls help="List the installations of the identity install layout" effect=read {
+        alias list
+        long_help #"""
+List the installations of the identity install layout
+
+Every installation is listed separately, so variants of one version (made
+with different options, or pinned to different artifacts by lockfiles) can
+be told apart. The status column says which installation requests without
+a lockfile use (`selected`), which a lockfile adopted (`pinned`), and which
+live in a read-only shared installs directory (`shared`).
+"""#
+        flag "-J --json" help="Output in JSON format"
+        flag --no-header help="Don't display headers"
+        flag "-h --help" help="Print help" action=help builtin=#true
+        arg "[TOOL]…" help="Only show the installations of these tools" required=#false var=#true
+        example "mise installs ls" help="Every installation in the identity layout"
+        example "mise installs ls node --json" help="The installations of node, as JSON"
+    }
+    cmd select help="Choose the installation that requests without a lockfile use" effect=write {
+        long_help #"""
+Choose the installation that requests without a lockfile use
+
+Several installations can answer the same request: a refresh that could not
+replace a lockfile's installation in place, or installations made for
+different lockfiles. Requests without a lockfile entry use the one selected
+for their tool, version, platform and options, and when none is selected and
+several match, mise stops and asks for this command.
+
+The selection is shared by every project on this machine that makes the same
+request without a lockfile. Projects whose lockfile pins an artifact keep the
+installation of that artifact. The version link (`installs/<tool>/<version>`)
+is pointed at the selected installation.
+"""#
+        flag "-h --help" help="Print help" action=help builtin=#true
+        arg <INSTALLATION> help="The installation to select: its directory name, or its path"
+        example #"""
+mise installs ls jq
+mise installs select jq-hm3qa4vb
+"""# help="Find jq's installations, then choose one"
+    }
+}
 cmd latest help="Resolve the latest matching version request for a tool" effect=read {
     long_help #"""
 Resolve the latest matching version request for a tool
diff --git a/src/cli/command_effects.rs b/src/cli/command_effects.rs
index 278eaf3d844..2961a6febfa 100644
--- a/src/cli/command_effects.rs
+++ b/src/cli/command_effects.rs
@@ -246,6 +246,9 @@ pub(super) const EFFECTS: &[(&str, SpecCommandEffect)] = &[
     ("implode", Destructive),
     ("install", Write),
     ("install-into", Write),
+    ("installs", Read),
+    ("installs ls", Read),
+    ("installs select", Write),
     ("latest", Read),
     ("link", Write),
     ("lock", Write),
diff --git a/src/cli/installs/ls.rs b/src/cli/installs/ls.rs
new file mode 100644
index 00000000000..078cea6e3c4
--- /dev/null
+++ b/src/cli/installs/ls.rs
@@ -0,0 +1,106 @@
+use comfy_table::Cell;
+use eyre::Result;
+
+use crate::args::BackendArg;
+use crate::file::display_path;
+use crate::install_layout::resolver::{self, Installation};
+use crate::ui::table::MiseTable;
+
+/// List the installations of the identity install layout
+///
+/// Every installation is listed separately, so variants of one version (made
+/// with different options, or pinned to different artifacts by lockfiles) can
+/// be told apart. The status column says which installation requests without
+/// a lockfile use (`selected`), which a lockfile adopted (`pinned`), and which
+/// live in a read-only shared installs directory (`shared`).
+#[derive(Debug, Default, usage_rs::Args)]
+#[usage(
+    visible_alias = "list",
+    example(
+        r###"mise installs ls"###,
+        help = r###"Every installation in the identity layout"###
+    ),
+    example(
+        r###"mise installs ls node --json"###,
+        help = r###"The installations of node, as JSON"###
+    ),
+    verbatim_doc_comment
+)]
+pub(super) struct InstallsLs {
+    /// Only show the installations of these tools
+    #[usage(value_name = "TOOL")]
+    tool: Vec<BackendArg>,
+
+    /// Output in JSON format
+    #[usage(long, short = 'J')]
+    json: bool,
+
+    /// Don't display headers
+    #[usage(long)]
+    no_header: bool,
+}
+
+impl InstallsLs {
+    pub(super) async fn run(self) -> Result<()> {
+        let mut installations = resolver::installations();
+        if !self.tool.is_empty() {
+            installations.retain(|i| {
+                self.tool
+                    .iter()
+                    .any(|ba| resolver::installation_belongs_to(ba, i))
+            });
+        }
+        if self.json {
+            miseprintln!("{}", serde_json::to_string_pretty(&installations)?);
+            return Ok(());
+        }
+        let mut table = MiseTable::new(
+            self.no_header,
+            &["Installation", "Tool", "Version", "Platform", "Status"],
+        );
+        for i in &installations {
+            table.add_row(vec![
+                Cell::new(&i.name),
+                Cell::new(tool_label(i)),
+                Cell::new(&i.version),
+                Cell::new(&i.platform),
+                Cell::new(status(i)),
+            ]);
+        }
+        table.print()?;
+        if installations.iter().any(|i| i.shared) {
+            for i in installations.iter().filter(|i| i.shared) {
+                info!("{} is in {}", i.name, display_path(&i.dir));
+            }
+        }
+        Ok(())
+    }
+}
+
+/// The tool an installation was requested as, with the options that set it
+/// apart from other installations of the same version.
+fn tool_label(i: &Installation) -> String {
+    let tool = i.requested_as.clone().unwrap_or_else(|| i.backend.clone());
+    if i.options.is_empty() {
+        return tool;
+    }
+    let options = i
+        .options
+        .iter()
+        .map(|(k, v)| format!("{k}={v}"))
+        .collect::<Vec<_>>()
+        .join(",");
+    format!("{tool}[{options}]")
+}
+
+fn status(i: &Installation) -> String {
+    [
+        (i.selected, "selected"),
+        (i.pinned, "pinned"),
+        (i.shared, "shared"),
+    ]
+    .into_iter()
+    .filter_map(|(on, word)| on.then_some(word))
+    .collect::<Vec<_>>()
+    .join(", ")
+}
diff --git a/src/cli/installs/mod.rs b/src/cli/installs/mod.rs
new file mode 100644
index 00000000000..874b296e9ad
--- /dev/null
+++ b/src/cli/installs/mod.rs
@@ -0,0 +1,44 @@
+use eyre::{Result, bail};
+
+use crate::config::Settings;
+
+mod ls;
+mod select;
+
+/// [experimental] Inspect and choose installations of the identity install layout
+///
+/// With `install_layout = "identity"`, each installation lives in its own
+/// `<label>-<hash>` directory, and several installations of one version can
+/// exist side by side (different options, platforms, pinned artifacts, or a
+/// refreshed copy). These commands list them and choose which one requests
+/// without a lockfile use.
+#[derive(Debug, usage_rs::Args)]
+#[usage(verbatim_doc_comment)]
+pub(crate) struct Installs {
+    #[usage(subcommand)]
+    command: Option<Commands>,
+}
+
+#[derive(Debug, usage_rs::Subcommands)]
+enum Commands {
+    Ls(ls::InstallsLs),
+    Select(select::InstallsSelect),
+}
+
+impl Installs {
+    pub(crate) async fn run(self) -> Result<()> {
+        Settings::get().ensure_experimental("mise installs")?;
+        if !crate::install_layout::resolver::enabled() {
+            bail!(
+                "the identity install layout is off; turn it on with `install_layout = \"identity\"`"
+            );
+        }
+        match self
+            .command
+            .unwrap_or(Commands::Ls(ls::InstallsLs::default()))
+        {
+            Commands::Ls(cmd) => cmd.run().await,
+            Commands::Select(cmd) => cmd.run(),
+        }
+    }
+}
diff --git a/src/cli/installs/select.rs b/src/cli/installs/select.rs
new file mode 100644
index 00000000000..7775ade994b
--- /dev/null
+++ b/src/cli/installs/select.rs
@@ -0,0 +1,48 @@
+use eyre::Result;
+
+use crate::file::display_path;
+use crate::install_layout::resolver;
+
+/// Choose the installation that requests without a lockfile use
+///
+/// Several installations can answer the same request: a refresh that could not
+/// replace a lockfile's installation in place, or installations made for
+/// different lockfiles. Requests without a lockfile entry use the one selected
+/// for their tool, version, platform and options, and when none is selected and
+/// several match, mise stops and asks for this command.
+///
+/// The selection is shared by every project on this machine that makes the same
+/// request without a lockfile. Projects whose lockfile pins an artifact keep the
+/// installation of that artifact. The version link (`installs/<tool>/<version>`)
+/// is pointed at the selected installation.
+#[derive(Debug, usage_rs::Args)]
+#[usage(
+    example(
+        r###"mise installs ls jq
+mise installs select jq-hm3qa4vb"###,
+        help = r###"Find jq's installations, then choose one"###
+    ),
+    verbatim_doc_comment
+)]
+pub(super) struct InstallsSelect {
+    /// The installation to select: its directory name, or its path
+    #[usage(value_name = "INSTALLATION")]
+    installation: String,
+}
+
+impl InstallsSelect {
+    pub(super) fn run(self) -> Result<()> {
+        let selected = resolver::select(&self.installation)?;
+        let tool = selected
+            .requested_as
+            .as_deref()
+            .unwrap_or(&selected.backend);
+        miseprintln!(
+            "selected {} for {tool}@{} ({}); every project that asks for it without a lockfile now uses it",
+            display_path(&selected.dir),
+            selected.version,
+            selected.platform
+        );
+        Ok(())
+    }
+}
diff --git a/src/cli/mod.rs b/src/cli/mod.rs
index 96eafd5d533..f80dfc62116 100644
--- a/src/cli/mod.rs
+++ b/src/cli/mod.rs
@@ -71,6 +71,7 @@ mod editor;
 mod implode;
 mod install;
 mod install_into;
+mod installs;
 mod latest;
 mod link;
 mod local;
@@ -348,6 +349,7 @@ pub(crate) enum Commands {
     Edit(edit::Edit),
     Install(install::Install),
     InstallInto(install_into::InstallInto),
+    Installs(installs::Installs),
     Latest(latest::Latest),
     Link(link::Link),
     Local(local::Local),
@@ -513,6 +515,7 @@ impl Commands {
             Self::Edit(cmd) => Box::pin(cmd.run()),
             Self::Install(cmd) => Box::pin(cmd.run()),
             Self::InstallInto(cmd) => Box::pin(cmd.run()),
+            Self::Installs(cmd) => Box::pin(cmd.run()),
             Self::Latest(cmd) => Box::pin(cmd.run()),
             Self::Link(cmd) => Box::pin(cmd.run()),
             Self::Local(cmd) => Box::pin(cmd.run()),
diff --git a/src/cli/uninstall.rs b/src/cli/uninstall.rs
index f6f6d44d8b0..266e4640130 100644
--- a/src/cli/uninstall.rs
+++ b/src/cli/uninstall.rs
@@ -171,6 +171,8 @@ impl Uninstall {
             if self.is_dry_run() {
                 pr.finish_with_message("uninstalled (dry-run)".into());
             } else {
+                // Removed on purpose: the requests it was selected for choose again.
+                crate::install_layout::resolver::forget_selections_of(&tv.install_path());
                 if let Err(err) = crate::tool_purgatory::forget_path(&tv.install_path()) {
                     warn!("failed to clear tool purgatory entry: {err:#}");
                 }
diff --git a/src/install_layout/catalog.rs b/src/install_layout/catalog.rs
index d2bd588eac0..3a7fe042664 100644
--- a/src/install_layout/catalog.rs
+++ b/src/install_layout/catalog.rs
@@ -112,9 +112,14 @@ impl Catalog {
         (record.digest == digest && record.identity.backend == backend).then_some(record)
     }
 
-    /// The installation an unlocked request's selection points at.
+    /// The installation an unlocked request's selection points at, when it is
+    /// one of this catalog's. A selection naming another root's installation is
+    /// not answered from here, even if this catalog has the same identity.
     pub(crate) fn selected_record(&self, key: &InstallIdentity) -> Option<IdentityRecord> {
         let selection = self.selection(key)?;
+        if selection.root.is_some() {
+            return None;
+        }
         self.record_by_digest(&key.backend, &selection.selected)
     }
 
@@ -235,7 +240,7 @@ impl Catalog {
         identity: &InstallIdentity,
         provenance: Provenance,
     ) -> Result<()> {
-        let _lock = LockFile::at(&self.meta_dir().join("alloc.lock")).lock()?;
+        let _lock = self.lock()?;
         let Some(mut record) = self.lookup(identity) else {
             return Ok(());
         };
@@ -253,9 +258,44 @@ impl Catalog {
     /// Adopt installations that exist on disk with a receipt but are missing
     /// from the catalog (it was lost or never written), so the catalog can be
     /// rebuilt from receipts alone. Returns the records it restored.
+    /// The installation in this catalog's store whose receipt records `digest`:
+    /// what is left to go on when the catalog lost its record and cannot be
+    /// rebuilt, as in a read-only shared root. It reads every receipt.
+    pub(crate) fn find_by_receipt(&self, digest: &str) -> Option<IdentityRecord> {
+        self.receipt_records()
+            .find(|record| record.digest == digest)
+    }
+
+    /// [`Catalog::records_for_backend`] for a catalog that cannot be rebuilt (a
+    /// read-only shared root): when it has lost its records entirely, the
+    /// installations' receipts stand in for them. Reads every receipt in that
+    /// case only.
+    pub(crate) fn records_or_receipts_for_backend(&self, backend: &str) -> Vec<IdentityRecord> {
+        if self.meta_dir().join("identities").is_dir() {
+            return self.records_for_backend(backend);
+        }
+        let mut records: Vec<_> = self
+            .receipt_records()
+            .filter(|record| record.identity.backend == backend)
+            .collect();
+        records.sort_by(|a, b| a.dir.cmp(&b.dir));
+        records
+    }
+
+    /// The records the receipts in the store carry, for directories they name.
+    fn receipt_records(&self) -> impl Iterator<Item = IdentityRecord> + '_ {
+        file::dir_subdirs(&self.store)
+            .unwrap_or_default()
+            .into_iter()
+            .filter(|dir| !dir.starts_with('.'))
+            .filter_map(|dir| read_receipt(&self.store.join(&dir)).map(|r| (dir, r.record)))
+            .filter(|(dir, record)| record.dir == *dir && record.is_consistent())
+            .map(|(_, record)| record)
+    }
+
     pub(crate) fn rebuild_from_receipts(&self) -> Result<Vec<IdentityRecord>> {
         let mut restored = vec![];
-        let _lock = LockFile::at(&self.meta_dir().join("alloc.lock")).lock()?;
+        let _lock = self.lock()?;
         for dir in file::dir_subdirs(&self.store).unwrap_or_default() {
             if dir.starts_with('.') {
                 continue;
@@ -286,6 +326,40 @@ impl Catalog {
         Ok(restored)
     }
 
+    /// The full digest the directory name `dir` is reserved for.
+    pub(crate) fn owner_of(&self, dir: &str) -> Option<String> {
+        std::fs::read_to_string(self.name_path(dir))
+            .ok()
+            .map(|owner| owner.trim().to_string())
+    }
+
+    /// Forget the selections that name the installation with `digest` in this
+    /// catalog's own root. Returns how many were removed.
+    pub(crate) fn remove_selections_of(&self, digest: &str) -> Result<usize> {
+        // Under the lock selections are written with, so a choice made meanwhile
+        // is never the one removed.
+        let _lock = self.lock()?;
+        let dir = self.meta_dir().join("selections");
+        let Ok(entries) = std::fs::read_dir(&dir) else {
+            return Ok(0);
+        };
+        let mut removed = 0;
+        for entry in entries.filter_map(|e| e.ok()) {
+            let path = entry.path();
+            let Some(selection) = std::fs::read_to_string(&path)
+                .ok()
+                .and_then(|body| toml::from_str::<Selection>(&body).ok())
+            else {
+                continue;
+            };
+            if selection.selected == digest && selection.root.is_none() {
+                file::remove_file(&path)?;
+                removed += 1;
+            }
+        }
+        Ok(removed)
+    }
+
     /// Where an unlocked request's choice is remembered, if it was.
     pub(crate) fn selection(&self, key: &InstallIdentity) -> Option<Selection> {
         let body = std::fs::read_to_string(self.selection_path(key)).ok()?;
@@ -302,6 +376,39 @@ impl Catalog {
         key: &InstallIdentity,
         selected: &IdentityRecord,
         root: Option<&Path>,
+    ) -> Result<()> {
+        let _lock = self.lock()?;
+        self.write_selection(key, selected, root)
+    }
+
+    /// [`Catalog::select`], unless `key` already has a selection. Returns whether
+    /// it wrote one.
+    pub(crate) fn select_if_unset(
+        &self,
+        key: &InstallIdentity,
+        selected: &IdentityRecord,
+        root: Option<&Path>,
+    ) -> Result<bool> {
+        let _lock = self.lock()?;
+        if self.selection(key).is_some() {
+            return Ok(false);
+        }
+        self.write_selection(key, selected, root)?;
+        Ok(true)
+    }
+
+    /// Hold the catalog lock, under which allocations and selections are written,
+    /// for a change that has to stay in step with a selection (its version links).
+    pub(crate) fn lock(&self) -> Result<fslock::LockFile> {
+        LockFile::at(&self.meta_dir().join("alloc.lock")).lock()
+    }
+
+    /// [`Catalog::select`] for a caller already holding [`Catalog::lock`].
+    pub(crate) fn write_selection(
+        &self,
+        key: &InstallIdentity,
+        selected: &IdentityRecord,
+        root: Option<&Path>,
     ) -> Result<()> {
         let selection = Selection {
             request: key.clone(),
diff --git a/src/install_layout/resolver.rs b/src/install_layout/resolver.rs
index a4ca2efaa2b..61da49bbabc 100644
--- a/src/install_layout/resolver.rs
+++ b/src/install_layout/resolver.rs
@@ -28,7 +28,7 @@ use crate::{dirs, env};
 /// Whether the identity layout is on: `install_layout = "identity"`, which is
 /// opt-in even with `experimental` on and requires it. (Later, `experimental` will
 /// include it.)
-pub(crate) fn enabled() -> bool {
+pub fn enabled() -> bool {
     let Ok(settings) = crate::config::Settings::try_get() else {
         return false;
     };
@@ -350,40 +350,89 @@ pub(crate) fn locate(tv: &ToolVersion) -> Option<Located> {
     }
     let identity = identity_of(tv)?;
     let digest = identity.digest().to_base32();
-    for root in roots() {
-        let cache_key = (root.clone(), digest.clone());
+    let key = identity.request_key();
+    let unlocked = pin_of(&identity).is_none();
+    let mut ambiguous = false;
+    if unlocked {
+        let cache_key = (dirs::INSTALLS.to_path_buf(), digest.clone());
         if let Some(hit) = locate_cache().get(&cache_key) {
             return Some(hit.clone());
         }
-        let catalog = Catalog::new(&root);
-        for record in candidates(&catalog, &identity) {
-            let dir = catalog.install_dir(&record);
-            let installed = is_complete(&dir);
-            let located = Located {
-                dir,
-                root: root.clone(),
-                record: Some(record),
-                installed,
-            };
-            if installed {
+        match unlocked_choice(&key) {
+            // A selection is answered by what it names alone: if that was pruned
+            // (installing restores it) or its root is gone, nothing else is chosen
+            // in its place without the user saying so. The exception is an install
+            // made before this layout at the version's path in the user's own
+            // root: that path is what PATH runs, and installing the selection
+            // could not put its link there.
+            Unlocked::Selected(located) => {
+                if located.installed {
+                    locate_cache().insert(cache_key, located.clone());
+                    return Some(located);
+                }
+                if is_primary_root(&located.root)
+                    && let Some(legacy) = legacy_dir(tv, &identity)
+                    && legacy
+                        .parent()
+                        .and_then(Path::parent)
+                        .is_some_and(is_primary_root)
+                {
+                    return Some(legacy_located(legacy));
+                }
+                return Some(located);
+            }
+            Unlocked::Found(located) => {
                 locate_cache().insert(cache_key, located.clone());
                 return Some(located);
             }
+            Unlocked::Ambiguous(_) => ambiguous = true,
+            Unlocked::Nothing => {}
+        }
+    } else {
+        for root in roots() {
+            let cache_key = (root.clone(), digest.clone());
+            if let Some(hit) = locate_cache().get(&cache_key) {
+                return Some(hit.clone());
+            }
+            let catalog = Catalog::new(&root);
+            for record in pinned_candidates(&catalog, &identity) {
+                let dir = catalog.install_dir(&record);
+                if is_complete(&dir) {
+                    let located = Located {
+                        dir,
+                        root: root.clone(),
+                        record: Some(record),
+                        installed: true,
+                    };
+                    locate_cache().insert(cache_key, located.clone());
+                    return Some(located);
+                }
+            }
         }
     }
     // An install made before the identity layout, in place.
-    if let Some(legacy) = legacy_dir(tv, &identity) {
+    if !ambiguous && let Some(legacy) = legacy_dir(tv, &identity) {
+        return Some(legacy_located(legacy));
+    }
+    let primary = Catalog::new(dirs::INSTALLS.to_path_buf());
+    // Several installations answer and none is chosen: report a path that is
+    // never an installation, so nothing (`where`, `exec`, PATH) quietly runs one
+    // of them. Installing reports the choice to make.
+    if ambiguous {
         return Some(Located {
-            root: legacy.parent().map(Path::to_path_buf).unwrap_or_default(),
-            dir: legacy,
+            dir: primary.meta_dir().join("ambiguous").join(&digest),
+            root: primary.root().to_path_buf(),
             record: None,
-            installed: true,
+            installed: false,
         });
     }
     // Not installed. Report where a record says it was (a pruned payload
     // keeps its path), or where it would be allocated.
-    let primary = Catalog::new(dirs::INSTALLS.to_path_buf());
-    let record = candidates(&primary, &identity).into_iter().next();
+    let record = if unlocked {
+        primary.lookup(&key)
+    } else {
+        pinned_candidates(&primary, &identity).into_iter().next()
+    };
     let dir = match &record {
         Some(record) => primary.install_dir(record),
         None => primary.tentative_dir(&identity),
@@ -396,14 +445,89 @@ pub(crate) fn locate(tv: &ToolVersion) -> Option<Located> {
     })
 }
 
-/// The catalog records that could satisfy `identity`, best first.
-///
-/// An unlocked request is satisfied by the installation its selection points
-/// at, else the one allocated for its own key. A request pinning an artifact is
-/// satisfied by the installation allocated for exactly that pin, or by an
-/// unlocked installation whose acquired artifact is the pinned one: adopting it
-/// does not reinstall, and does not hash the installed files.
-fn candidates(catalog: &Catalog, identity: &InstallIdentity) -> Vec<IdentityRecord> {
+/// What an unlocked request resolves to. Its selection lives in the user's own
+/// catalog and may name an installation in a read-only shared root.
+enum Unlocked {
+    /// The installation the selection names, installed or not. Its record is
+    /// `None` when the root it names no longer lists it.
+    Selected(Located),
+    /// Nothing is selected, and exactly one complete installation, in any root,
+    /// answers the request.
+    Found(Located),
+    /// Nothing is selected, and several complete installations answer it:
+    /// choosing one would be a guess.
+    Ambiguous(Vec<Located>),
+    /// Nothing is selected or installed.
+    Nothing,
+}
+
+fn unlocked_choice(key: &InstallIdentity) -> Unlocked {
+    let primary = Catalog::new(dirs::INSTALLS.to_path_buf());
+    if let Some(selection) = primary.selection(key) {
+        let root = selection
+            .root
+            .map(PathBuf::from)
+            .unwrap_or_else(|| primary.root().to_path_buf());
+        let catalog = Catalog::new(&root);
+        // A shared root's catalog cannot be rebuilt here; the installation's own
+        // receipt still says what it is.
+        let record = catalog
+            .record_by_digest(&key.backend, &selection.selected)
+            .or_else(|| {
+                (!is_primary_root(&root))
+                    .then(|| catalog.find_by_receipt(&selection.selected))
+                    .flatten()
+            });
+        // A selection in the user's own catalog whose record is gone is treated
+        // as no selection; one naming another root is not given up on silently.
+        if record.is_some() || !is_primary_root(&root) {
+            let dir = match &record {
+                Some(record) => catalog.install_dir(record),
+                None => catalog.store().join(&selection.selected),
+            };
+            let installed = record.is_some() && is_complete(&dir);
+            return Unlocked::Selected(Located {
+                dir,
+                root,
+                record,
+                installed,
+            });
+        }
+    }
+    let mut complete: Vec<Located> = vec![];
+    for root in roots() {
+        let catalog = Catalog::new(&root);
+        // A shared root's catalog cannot be rebuilt here; if it is gone, the
+        // installations it listed still count, by their receipts.
+        let records = if is_primary_root(&root) {
+            catalog.records_for_backend(&key.backend)
+        } else {
+            catalog.records_or_receipts_for_backend(&key.backend)
+        };
+        for record in records {
+            let dir = catalog.install_dir(&record);
+            if same_request(&record.identity, key) && is_complete(&dir) {
+                complete.push(Located {
+                    dir,
+                    root: root.clone(),
+                    record: Some(record),
+                    installed: true,
+                });
+            }
+        }
+    }
+    match complete.len() {
+        0 => Unlocked::Nothing,
+        1 => Unlocked::Found(complete.remove(0)),
+        _ => Unlocked::Ambiguous(complete),
+    }
+}
+
+/// The catalog records that could satisfy a request pinning an artifact, best
+/// first: the installation allocated for exactly that pin, one the pin already
+/// adopted, or an unlocked installation whose acquired artifact is the pinned
+/// one. Adopting it does not reinstall, and does not hash the installed files.
+fn pinned_candidates(catalog: &Catalog, identity: &InstallIdentity) -> Vec<IdentityRecord> {
     let key = identity.request_key();
     let mut found: Vec<IdentityRecord> = vec![];
     let mut push = |record: Option<IdentityRecord>| {
@@ -413,43 +537,100 @@ fn candidates(catalog: &Catalog, identity: &InstallIdentity) -> Vec<IdentityReco
             found.push(record);
         }
     };
-    match pin_of(identity) {
-        Some(pin) => {
-            push(catalog.lookup(identity));
-            // An installation this pin already adopted is the one it keeps, even if a
-            // later refresh moved the unlocked selection to another copy of the same
-            // artifact.
-            push(
-                catalog
-                    .records_for_backend(&key.backend)
-                    .into_iter()
-                    .find(|r| {
-                        same_request(&r.identity, &key)
-                            && r.provenance.pinned_by.iter().any(|p| p == pin)
-                    }),
-            );
-            let adoptable = |r: &IdentityRecord| {
-                r.provenance.artifacts.get("checksum").map(String::as_str) == Some(pin)
-            };
-            push(catalog.selected_record(&key).filter(adoptable));
-            push(catalog.lookup(&key).filter(adoptable));
-        }
-        None => {
-            push(catalog.selected_record(&key));
-            push(catalog.lookup(&key));
-        }
-    }
+    let Some(pin) = pin_of(identity) else {
+        return found;
+    };
+    push(catalog.lookup(identity));
+    // An installation this pin already adopted is the one it keeps, even if a
+    // later refresh moved the unlocked selection to another copy of the same
+    // artifact.
+    push(
+        catalog
+            .records_for_backend(&key.backend)
+            .into_iter()
+            .find(|r| {
+                same_request(&r.identity, &key) && r.provenance.pinned_by.iter().any(|p| p == pin)
+            }),
+    );
+    let adoptable = |r: &IdentityRecord| {
+        r.provenance.artifacts.get("checksum").map(String::as_str) == Some(pin)
+    };
+    push(catalog.selected_record(&key).filter(adoptable));
+    push(catalog.lookup(&key).filter(adoptable));
     found
 }
 
+/// The unlocked request an installation answers: its identity without a pin
+/// or a refresh generation. Its selection is recorded under this key.
+fn request_of(identity: &InstallIdentity) -> InstallIdentity {
+    let mut key = identity.request_key();
+    key.inputs.remove("generation");
+    key
+}
+
+/// The next refresh generation of the unlocked request `key`.
+fn next_generation(catalog: &Catalog, key: &InstallIdentity) -> u32 {
+    catalog
+        .records_for_backend(&key.backend)
+        .iter()
+        .filter(|r| same_request(&r.identity, key))
+        .map(|r| {
+            let named = r
+                .identity
+                .inputs
+                .get("generation")
+                .and_then(|g| g.parse().ok())
+                .unwrap_or(0);
+            r.provenance.generation.max(named)
+        })
+        .max()
+        .unwrap_or(0)
+        + 1
+}
+
+/// Why an unlocked request with no selection cannot just use an installation.
+fn ambiguity_error(tv: &ToolVersion, installations: &[Located]) -> eyre::Report {
+    // Full paths: the same identity has the same name in each root that has it.
+    let list = installations
+        .iter()
+        .map(|l| {
+            let pinned = if l
+                .record
+                .as_ref()
+                .is_some_and(|r| !r.provenance.pinned_by.is_empty())
+            {
+                " (a lockfile pins it)"
+            } else {
+                ""
+            };
+            format!("  {}{pinned}", file::display_path(&l.dir))
+        })
+        .collect::<Vec<_>>()
+        .join("\n");
+    eyre::eyre!(
+        "{} matches several installations and none is selected:\n{list}\n\
+         Choose one with `mise installs select <dir>`, or install a fresh one with \
+         `mise install --force {}@{}`",
+        tv.style(),
+        tv.ba().short,
+        tv.version
+    )
+}
+
 /// Whether `identity` answers the unlocked request `key`, whichever refresh
 /// generation of the request it belongs to.
 fn same_request(identity: &InstallIdentity, key: &InstallIdentity) -> bool {
-    let mut a = identity.request_key();
-    let mut b = key.request_key();
-    a.inputs.remove("generation");
-    b.inputs.remove("generation");
-    a == b
+    request_of(identity) == request_of(key)
+}
+
+/// What [`locate`] reports for a legacy installation at `legacy`.
+fn legacy_located(legacy: PathBuf) -> Located {
+    Located {
+        root: legacy.parent().map(Path::to_path_buf).unwrap_or_default(),
+        dir: legacy,
+        record: None,
+        installed: true,
+    }
 }
 
 /// A legacy `installs/<short>/<version>` directory that this request may use.
@@ -653,10 +834,14 @@ pub(crate) fn unlink_installation(dir: &Path) {
             if !is_dir_link(&entry) || !is_compat_link_shape(&entry) {
                 continue;
             }
+            // The whole target is compared, not its name: a link to the same
+            // identity in another root's store has the same name.
             let names_it = file::resolve_symlink(&entry)
                 .ok()
                 .flatten()
-                .is_some_and(|target| target.file_name() == Some(name));
+                .is_some_and(|target| {
+                    target.file_name() == Some(name) && same_path(&tool_dir.join(&target), dir)
+                });
             if names_it && let Err(err) = file::remove_dir_link(&entry) {
                 debug!("could not remove version link {}: {err:#}", entry.display());
             }
@@ -711,10 +896,11 @@ pub(crate) fn installs_matching(backend: &str, version: &str) -> Vec<(String, Op
     out
 }
 
-/// The installations of `tv`'s tool and version on this platform, whatever install
-/// options they were made with. A version named on the command line carries no
-/// options, so `mise where tool@1.0` has to find a copy made with the options a
-/// configuration file sets.
+/// The installations of `tv`'s tool and version on this platform made with other
+/// install options than `tv` carries. A version named on the command line carries
+/// no options, so `mise where tool@1.0` has to find a copy made with the options a
+/// configuration file sets. Installations of `tv`'s own request are not variants:
+/// which of those it uses is its selection's business, never a guess here.
 pub fn variants_of(tv: &ToolVersion) -> Vec<PathBuf> {
     if !enabled() {
         return vec![];
@@ -722,6 +908,17 @@ pub fn variants_of(tv: &ToolVersion) -> Vec<PathBuf> {
     let Ok(b) = tv.backend() else {
         return vec![];
     };
+    let mut bare = tv.clone();
+    bare.install_path = None;
+    let own_request = identity_of(&bare).map(|identity| request_of(&identity));
+    // The request has installations of its own, or a selection: which one it uses
+    // is for the selection to say (or the user, when that is ambiguous), so a
+    // variant made with other options is no stand-in for it.
+    if let Some(own) = &own_request
+        && !matches!(unlocked_choice(own), Unlocked::Nothing)
+    {
+        return vec![];
+    }
     let backend = canonical_backend(&tv.ba().full());
     let (version, platform) = (tv.logical_pathname(), b.get_platform_key());
     let mut out = vec![];
@@ -731,6 +928,9 @@ pub fn variants_of(tv: &ToolVersion) -> Vec<PathBuf> {
             let dir = catalog.install_dir(&record);
             if record.identity.version == version
                 && record.identity.platform == platform
+                && own_request
+                    .as_ref()
+                    .is_none_or(|own| request_of(&record.identity) != *own)
                 && is_complete(&dir)
             {
                 out.push(dir);
@@ -878,7 +1078,42 @@ pub(crate) fn allocate(tv: &ToolVersion, refresh: bool) -> Result<Option<Allocat
         }
     }
 
-    if let Some(existing) = candidates(&catalog, &identity).into_iter().next() {
+    let existing = if locked {
+        pinned_candidates(&catalog, &identity).into_iter().next()
+    } else {
+        // An installation in another root is never written to: a refresh, or one
+        // that is missing, installs into the user's own root.
+        let own = |located: Located| {
+            if is_primary_root(&located.root) {
+                located.record
+            } else {
+                catalog.lookup(&key)
+            }
+        };
+        match unlocked_choice(&key) {
+            // The installation selected in another root is gone: say so rather than
+            // quietly installing a replacement and moving every project's selection.
+            Unlocked::Selected(located) if !refresh && !is_primary_root(&located.root) => {
+                eyre::bail!(
+                    "the installation selected for {} is in {}, which no longer has it. \
+                     Select another with `mise installs select <dir>`, or install a fresh one \
+                     with `mise install --force {}@{}`",
+                    tv.style(),
+                    located.root.display(),
+                    tv.ba().short,
+                    tv.version
+                );
+            }
+            Unlocked::Selected(located) | Unlocked::Found(located) => own(located),
+            Unlocked::Ambiguous(records) if !refresh => {
+                return Err(ambiguity_error(tv, &records));
+            }
+            // A refresh is the explicit choice: it installs into the request's own
+            // directory and selects that.
+            Unlocked::Ambiguous(_) | Unlocked::Nothing => catalog.lookup(&key),
+        }
+    };
+    if let Some(existing) = existing {
         let pinned_elsewhere = !existing.provenance.pinned_by.is_empty() && !locked;
         if !(refresh && pinned_elsewhere) {
             return Ok(Some(Allocated {
@@ -890,13 +1125,12 @@ pub(crate) fn allocate(tv: &ToolVersion, refresh: bool) -> Result<Option<Allocat
             }));
         }
         // Move the unlocked selection to a new generation.
+        let generation = next_generation(&catalog, &key);
         let mut next = key.clone();
-        next.inputs.insert(
-            "generation".into(),
-            (existing.provenance.generation + 1).to_string(),
-        );
+        next.inputs
+            .insert("generation".into(), generation.to_string());
         let mut record = catalog.allocate(&next)?;
-        record.provenance.generation = existing.provenance.generation + 1;
+        record.provenance.generation = generation;
         catalog.update_provenance(&next, record.provenance.clone())?;
         return Ok(Some(Allocated {
             read_only: false,
@@ -1037,15 +1271,24 @@ pub(crate) fn note_reuse(tv: &ToolVersion) -> Result<()> {
     let (true, Some(record)) = (located.installed, located.record) else {
         return Ok(());
     };
-    if !is_primary_root(&located.root) {
-        // A read-only shared installation: never written to.
-        return Ok(());
-    }
     let Some(identity) = identity_of(tv) else {
         return Ok(());
     };
     let catalog = Catalog::new(dirs::INSTALLS.to_path_buf());
-    if let Some(pin) = pin_of(&identity)
+    // An unlocked request that found its installation with nothing selected (one
+    // a lockfile, another spelling or a shared root made) remembers it, so the
+    // choice stays put when more installations of the request appear.
+    let key = identity.request_key();
+    if pin_of(&identity).is_none() {
+        let shared = (!is_primary_root(&located.root)).then_some(located.root.as_path());
+        if catalog.select_if_unset(&key, &record, shared)? {
+            reset_cache();
+        }
+    }
+    // A pin is recorded in the catalog that lists the installation, and a shared
+    // root's is never written to. The version link is the user's own.
+    if is_primary_root(&located.root)
+        && let Some(pin) = pin_of(&identity)
         && !record.provenance.pinned_by.iter().any(|p| p == pin)
     {
         let mut provenance = record.provenance.clone();
@@ -1151,17 +1394,46 @@ fn same_link_target(slot: &Path, current: &Path, dir: &Path) -> bool {
 /// Recreate the version links of a tool's installations that have none: the tool
 /// directory was removed by hand, or the installation was made through another
 /// spelling of the tool. A slot that exists is left alone, because a link can name
-/// only one variant.
+/// only one variant. A missing one names the selected installation of its version,
+/// in whichever root that is, or else the first of the user's own.
 pub(crate) fn heal_links(ba: &crate::args::BackendArg) {
     let tool_dir = ba.installs_path();
-    for (name, dir) in installs_of(ba) {
-        if !is_primary_install(&dir) {
+    let installs = installs_of(ba);
+    if installs
+        .iter()
+        .all(|(name, _)| std::fs::symlink_metadata(tool_dir.join(name)).is_ok())
+    {
+        return;
+    }
+    let primary = Catalog::new(dirs::INSTALLS.to_path_buf());
+    // Under the catalog lock `mise installs select` moves links with, so a choice
+    // made meanwhile is not overwritten with an older one.
+    let _lock = match primary.lock() {
+        Ok(lock) => lock,
+        Err(err) => {
+            debug!("could not lock the installs catalog to repair links: {err:#}");
+            return;
+        }
+    };
+    let mut missing: indexmap::IndexMap<String, (PathBuf, bool)> = indexmap::IndexMap::new();
+    for (name, dir) in installs {
+        if std::fs::symlink_metadata(tool_dir.join(&name)).is_ok() {
             continue;
         }
-        let slot = tool_dir.join(&name);
-        if std::fs::symlink_metadata(&slot).is_ok() {
+        let selected = is_selected_install(&primary, &dir);
+        if !selected && !is_primary_install(&dir) {
             continue;
         }
+        match missing.get(&name) {
+            Some((_, true)) => {}
+            Some((_, false)) if !selected => {}
+            _ => {
+                missing.insert(name, (dir, selected));
+            }
+        }
+    }
+    for (name, (dir, _)) in missing {
+        let slot = tool_dir.join(&name);
         if let Err(err) = file::create_dir_all(tool_dir)
             .and_then(|()| file::make_dir_link(&link_value(tool_dir, &dir), &slot))
         {
@@ -1170,6 +1442,17 @@ pub(crate) fn heal_links(ba: &crate::args::BackendArg) {
     }
 }
 
+/// Whether the installation at `dir` is the one its request's selection names.
+fn is_selected_install(primary: &Catalog, dir: &Path) -> bool {
+    let (Some(store), Some(name)) = (dir.parent(), dir.file_name().and_then(|n| n.to_str())) else {
+        return false;
+    };
+    let Some(root) = root_of_store(store) else {
+        return false;
+    };
+    describe(primary, &Catalog::new(&root), &root, name).is_some_and(|i| i.selected)
+}
+
 /// The installation directory a compatibility link names, if `slot` is one: a
 /// link whose target is a direct child of an install store holding a receipt.
 pub fn link_target(slot: &Path) -> Option<PathBuf> {
@@ -1189,6 +1472,260 @@ pub fn link_target(slot: &Path) -> Option<PathBuf> {
     (is_store && target.join(RECEIPT_FILE).exists()).then_some(target)
 }
 
+/// One installation of the identity layout, as `mise installs` shows it.
+#[derive(Clone, Debug, serde::Serialize)]
+pub struct Installation {
+    /// The directory name, `<label>-<hash>`.
+    pub name: String,
+    pub dir: PathBuf,
+    /// The canonical backend it was installed from.
+    pub backend: String,
+    pub version: String,
+    pub platform: String,
+    /// `fallback` (identified by its request) or `resolved` (a pinned artifact).
+    pub mode: String,
+    /// The install-affecting options it was made with.
+    pub options: BTreeMap<String, String>,
+    /// The spelling it was first requested as.
+    pub requested_as: Option<String>,
+    /// The checksum of the artifact it was installed from, when known.
+    pub checksum: Option<String>,
+    /// A lockfile adopted it: a refresh never replaces it in place.
+    pub pinned: bool,
+    /// Unlocked requests for its tool, version, platform and options use it.
+    pub selected: bool,
+    /// It is in a read-only shared installs directory.
+    pub shared: bool,
+}
+
+/// Every complete installation of the identity layout, in every installs root,
+/// ordered by name within each root.
+pub fn installations() -> Vec<Installation> {
+    let primary = Catalog::new(dirs::INSTALLS.to_path_buf());
+    let mut out = vec![];
+    for root in roots() {
+        let catalog = Catalog::new(&root);
+        for name in file::dir_subdirs(catalog.store()).unwrap_or_default() {
+            if !has_hash_suffix(&name) {
+                continue;
+            }
+            if let Some(found) = describe(&primary, &catalog, &root, &name) {
+                out.push(found);
+            }
+        }
+    }
+    out
+}
+
+/// Whether the installation `i` is one of `ba`'s, judged from its receipt (so an
+/// installation the catalog lost, or one in a shared root, still counts).
+pub fn installation_belongs_to(ba: &crate::args::BackendArg, i: &Installation) -> bool {
+    if !backends_of(ba).contains(&i.backend) {
+        return false;
+    }
+    read_receipt(&i.dir).is_some_and(|receipt| belongs_to(ba, &receipt.record, &i.dir))
+}
+
+/// The installation named `name` in the store of `root`, if there is a complete one.
+fn describe(primary: &Catalog, catalog: &Catalog, root: &Path, name: &str) -> Option<Installation> {
+    let dir = catalog.store().join(name);
+    let receipt = read_receipt(&dir)?;
+    // The catalog's record carries provenance added after the receipt was written.
+    let record = catalog
+        .record_by_digest(&receipt.record.identity.backend, &receipt.record.digest)
+        .unwrap_or(receipt.record);
+    let shared = !is_primary_root(root);
+    let selected = primary
+        .selection(&request_of(&record.identity))
+        .is_some_and(|s| {
+            s.selected == record.digest
+                && match &s.root {
+                    Some(r) => shared && same_path(Path::new(r), root),
+                    None => !shared,
+                }
+        });
+    let identity = &record.identity;
+    Some(Installation {
+        name: name.to_string(),
+        dir,
+        backend: identity.backend.clone(),
+        version: identity.version.clone(),
+        platform: identity.platform.clone(),
+        mode: match identity.mode {
+            Mode::Resolved => "resolved",
+            Mode::Fallback => "fallback",
+        }
+        .to_string(),
+        options: identity.options.clone(),
+        requested_as: receipt.requested_as,
+        checksum: identity
+            .inputs
+            .get("artifact.checksum")
+            .or_else(|| record.provenance.artifacts.get("checksum"))
+            .cloned(),
+        pinned: !record.provenance.pinned_by.is_empty(),
+        selected,
+        shared,
+    })
+}
+
+/// Make the installation `name` (a directory name, or its path) the one that
+/// unlocked requests for its tool, version, platform and options use, in every
+/// project on this machine, and point the version links that named another
+/// installation of that request at it. Locked requests are not affected.
+pub fn select(installation: &str) -> Result<Installation> {
+    let path = Path::new(installation);
+    let name = path
+        .file_name()
+        .and_then(|n| n.to_str())
+        .unwrap_or(installation)
+        .to_string();
+    // A path names its installs root; a bare name may be in several.
+    let parent = path.parent().filter(|p| !p.as_os_str().is_empty());
+    let primary = Catalog::new(dirs::INSTALLS.to_path_buf());
+    let mut found: Vec<(PathBuf, Catalog)> = roots()
+        .into_iter()
+        .map(|root| {
+            let catalog = Catalog::new(&root);
+            (root, catalog)
+        })
+        .filter(|(root, catalog)| {
+            parent.is_none_or(|p| same_path(p, catalog.store()))
+                && describe(&primary, catalog, root, &name).is_some()
+        })
+        .collect();
+    if found.len() > 1 {
+        let paths = found
+            .iter()
+            .map(|(_, c)| format!("  {}", c.store().join(&name).display()))
+            .collect::<Vec<_>>()
+            .join("\n");
+        eyre::bail!("{name} is in more than one installs directory; pass its path:\n{paths}");
+    }
+    let Some((root, catalog)) = found.pop() else {
+        eyre::bail!("{installation} is not an installation; `mise installs ls` lists them");
+    };
+    let dir = catalog.store().join(&name);
+    let receipt = read_receipt(&dir).ok_or_else(|| eyre::eyre!("{name} has no receipt"))?;
+    // A selection is resolved through the catalog that lists the installation.
+    // The user's own catalog is rebuilt from receipts if it lost the record; a
+    // shared root's is read-only, so its installation's receipt stands in for
+    // the record, as it does when the selection is used.
+    let lookup =
+        || catalog.record_by_digest(&receipt.record.identity.backend, &receipt.record.digest);
+    let record = match lookup() {
+        Some(record) => record,
+        None if is_primary_root(&root) => {
+            catalog.rebuild_from_receipts()?;
+            lookup().ok_or_else(|| eyre::eyre!("{name} could not be added to the catalog"))?
+        }
+        // The receipt of the very directory being selected.
+        None if receipt.record.dir == name && receipt.record.is_consistent() => {
+            receipt.record.clone()
+        }
+        None => eyre::bail!(
+            "{} is not listed in the catalog of {}, so it cannot be selected",
+            name,
+            root.display()
+        ),
+    };
+    let key = request_of(&record.identity);
+    let shared = (!is_primary_root(&root)).then_some(root.as_path());
+    // The version links follow the selection under the same lock, so two
+    // selections made at once cannot leave the links on the other one.
+    let lock = primary.lock()?;
+    primary.write_selection(&key, &record, shared)?;
+    retarget_links(&record, &dir, receipt.requested_as.as_deref());
+    drop(lock);
+    reset_cache();
+    describe(&primary, &catalog, &root, &name)
+        .ok_or_else(|| eyre::eyre!("{name} is no longer installed"))
+}
+
+/// Forget the unlocked selections that name the installation `dir`, after
+/// `mise uninstall` removed it on purpose: the requests it answered choose
+/// again (another installation, or a legacy or shared copy). Prune keeps them,
+/// so a pruned selection is restored in place.
+pub fn forget_selections_of(dir: &Path) {
+    if !enabled() || !is_primary_install(dir) {
+        return;
+    }
+    let Some(name) = dir.file_name().and_then(|n| n.to_str()) else {
+        return;
+    };
+    let catalog = Catalog::new(dirs::INSTALLS.to_path_buf());
+    let Some(digest) = catalog.owner_of(name) else {
+        return;
+    };
+    if let Err(err) = catalog.remove_selections_of(&digest) {
+        debug!(
+            "could not forget the selections of {}: {err:#}",
+            dir.display()
+        );
+    }
+    reset_cache();
+}
+
+/// Point every version link in the primary root that names another installation
+/// of `record`'s request at `dir` (which may be in a shared root) instead, and
+/// give the tool it was requested as a link if it has none. A link can name only
+/// one variant; after a selection it should name the selected one. Nothing is
+/// written to a shared root.
+fn retarget_links(record: &IdentityRecord, dir: &Path, requested_as: Option<&str>) {
+    let root: &Path = &dirs::INSTALLS;
+    let key = request_of(&record.identity);
+    let name = listing_name(record);
+    let requested_dir =
+        requested_as.map(|short| root.join(crate::backend::tool_directory_name(short)));
+    let mut tool_dirs: Vec<PathBuf> = file::dir_subdirs(root)
+        .unwrap_or_default()
+        .into_iter()
+        .filter(|tool| !is_reserved_dir(root, tool))
+        .map(|tool| root.join(tool))
+        .collect();
+    // The tool it was requested as gets its link even when its directory is gone.
+    if let Some(dir) = &requested_dir
+        && !tool_dirs.contains(dir)
+    {
+        tool_dirs.push(dir.clone());
+    }
+    for tool_dir in tool_dirs {
+        let slot = tool_dir.join(&name);
+        let requested = requested_dir.as_ref() == Some(&tool_dir);
+        let retarget = match link_target(&slot) {
+            // In the tool's own directory the link follows the selection from any
+            // installation of the version (another variant included); in other
+            // tool directories (an alias with other options) only from another
+            // installation of the same request.
+            Some(current) => {
+                !same_path(&current, dir)
+                    && (requested
+                        || read_receipt(&current)
+                            .is_some_and(|r| same_request(&r.record.identity, &key)))
+            }
+            // An empty slot, or a version link whose installation is gone, in the
+            // directory of the tool it was requested as. Anything else there (a
+            // legacy installation, a `mise link`) is left alone.
+            None => {
+                requested
+                    && (std::fs::symlink_metadata(&slot).is_err() || is_compat_link_shape(&slot))
+            }
+        };
+        if !retarget {
+            continue;
+        }
+        if let Err(err) = file::create_dir_all(&tool_dir)
+            .and_then(|()| file::make_dir_link(&link_value(&tool_dir, dir), &slot))
+        {
+            warn!(
+                "could not link {} to {}: {err:#}",
+                slot.display(),
+                dir.display()
+            );
+        }
+    }
+}
+
 /// Adopt installations whose receipt is on disk but that the primary catalog does
 /// not know (it was lost, or a mise that predates it made them), so the catalog can
 /// always be rebuilt from receipts alone. `root_entries` are the names in the
@@ -1259,7 +1796,9 @@ pub(crate) fn is_compat_link_shape(path: &Path) -> bool {
     let (Some(store), Some(root)) = (target.parent(), tool_dir.parent()) else {
         return false;
     };
-    same_path(store, &store_of(root))
+    // Its own root's store, or (for a selection of a shared installation) the
+    // store of another root.
+    (same_path(store, &store_of(root)) || stores().iter().any(|s| same_path(store, s)))
         && target
             .file_name()
             .and_then(|n| n.to_str())