@hasna/todos 0.15.7 → 0.15.10

package/dist/storage.js

@@ -2269,6 +2269,29 @@ var init_migrations = __esm(() => {
   ${sqliteTodosProjectRegistrationSchemaSql()}
   INSERT OR IGNORE INTO _migrations (id) VALUES (69);
   COMMIT;
+  `,
+    `BEGIN;
+  CREATE TABLE IF NOT EXISTS plan_project_link_receipts (
+    receipt_id TEXT PRIMARY KEY,
+    idempotency_key TEXT NOT NULL UNIQUE,
+    plan_id TEXT NOT NULL,
+    project_id TEXT NOT NULL,
+    payload_hash TEXT NOT NULL,
+    payload TEXT NOT NULL,
+    created_at TEXT NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS idx_plan_project_link_receipts_plan
+    ON plan_project_link_receipts(plan_id, created_at);
+
+  CREATE TABLE IF NOT EXISTS plan_project_link_rollback_receipts (
+    rollback_receipt_id TEXT PRIMARY KEY,
+    accepted_receipt_id TEXT NOT NULL UNIQUE
+      REFERENCES plan_project_link_receipts(receipt_id) ON DELETE RESTRICT,
+    payload TEXT NOT NULL,
+    created_at TEXT NOT NULL
+  );
+  INSERT OR IGNORE INTO _migrations (id) VALUES (70);
+  COMMIT;
   `
   ];
 });
@@ -6747,6 +6770,40 @@ function deleteTaskList(id, db) {
     return d.run("DELETE FROM task_lists WHERE id = ?", [id]).changes > 0;
   })();
 }
+function deleteTaskListIfUnchangedAndUnused(id, expected, db) {
+  const d = db || getDatabase();
+  return d.transaction(() => {
+    const current = getTaskList(id, d);
+    if (!current) {
+      return { status: "not_found", task_dependents: 0, plan_dependents: 0 };
+    }
+    const changed = current.project_id !== expected.project_id || current.slug !== expected.slug || current.name !== expected.name || current.description !== expected.description || current.updated_at !== expected.updated_at || JSON.stringify(current.metadata) !== JSON.stringify(expected.metadata);
+    if (changed) {
+      return { status: "changed", task_dependents: 0, plan_dependents: 0 };
+    }
+    const taskDependents = Number(d.query("SELECT COUNT(*) AS count FROM tasks WHERE task_list_id = ?").get(id).count);
+    const planDependents = Number(d.query("SELECT COUNT(*) AS count FROM plans WHERE task_list_id = ?").get(id).count);
+    if (taskDependents > 0 || planDependents > 0) {
+      return {
+        status: "has_dependents",
+        task_dependents: taskDependents,
+        plan_dependents: planDependents
+      };
+    }
+    recordStorageTombstone({
+      object_type: "task_lists",
+      object_id: id,
+      payload: current
+    }, d);
+    releaseCanonicalSlugClaims("task_list", id, d);
+    const deleted = d.run("DELETE FROM task_lists WHERE id = ?", [id]).changes > 0;
+    return {
+      status: deleted ? "deleted" : "not_found",
+      task_dependents: 0,
+      plan_dependents: 0
+    };
+  })();
+}
 function ensureTaskList(name, slug, projectId, db) {
   const d = db || getDatabase();
   const existing = getTaskListBySlug(slug, projectId, d);
@@ -7774,6 +7831,14 @@ var init_checklists = __esm(() => {
   init_database();
 });
 
+// src/db/plan-row-serialization.ts
+function guardPlanRowsSqlite(planIds, db) {
+  const ids = [...new Set(planIds.filter((id) => Boolean(id)))].sort();
+  for (const id of ids) {
+    db.run("/* todos:sqlite-plan-row-guard */ UPDATE plans SET id = id WHERE id = ?", [id]);
+  }
+}
+
 // src/lib/creator-identity.ts
 function canonicalAgentRef(value) {
   return value.trim().toLowerCase();
@@ -9100,9 +9165,23 @@ function sanitizeUpdateTaskInput(input) {
     metadata: input.metadata !== undefined ? sanitizePreWriteValue(input.metadata, "task.metadata") : undefined
   };
 }
-function createTask(input, db) {
-  input = sanitizeCreateTaskInput(input);
-  const d = db || getDatabase();
+function linkedPlanProjectId(planId, db) {
+  if (!planId)
+    return null;
+  const row = db.query("SELECT project_id FROM plans WHERE id = ?").get(planId);
+  return row?.project_id ?? null;
+}
+function resolveCreateProjectForPlan(input, db) {
+  const linkedProjectId = linkedPlanProjectId(input.plan_id, db);
+  if (!linkedProjectId)
+    return input.project_id || null;
+  if (input.project_id !== undefined && input.project_id !== linkedProjectId) {
+    throw new ResourceConflictError("PLAN_PROJECT_LINK_CONFLICT", `Task project conflicts with linked plan ${input.plan_id}: expected ${linkedProjectId}`);
+  }
+  return linkedProjectId;
+}
+function createTaskStored(input, d) {
+  const effectiveProjectId = resolveCreateProjectForPlan(input, d);
   const timestamp2 = now();
   const tags = input.tags || [];
   const machineId = currentStorageMachineId(d);
@@ -9116,7 +9195,7 @@ function createTask(input, db) {
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
         id,
         null,
-        input.project_id || null,
+        effectiveProjectId,
         input.parent_id || null,
         input.plan_id || null,
         input.task_list_id || null,
@@ -9166,7 +9245,15 @@ function createTask(input, db) {
   if (tags.length > 0) {
     insertTaskTags(id, tags, d);
   }
-  const task = getTask(id, d);
+  return getTask(id, d);
+}
+function createTask(input, db) {
+  input = sanitizeCreateTaskInput(input);
+  const d = db || getDatabase();
+  const task = input.plan_id ? d.transaction(() => {
+    guardPlanRowsSqlite([input.plan_id], d);
+    return createTaskStored(input, d);
+  })() : createTaskStored(input, d);
   const payload = taskEventData(task);
   const databasePath = databasePathFromDatabase(d);
   dispatchWebhook2("task.created", payload, d).catch(() => {});
@@ -9266,6 +9353,10 @@ function listTasks(filter = {}, db) {
     conditions.push("(created_by IS NULL OR LOWER(created_by) != LOWER(?))");
     params.push(filter.not_created_by);
   }
+  if (filter.updated_after) {
+    conditions.push("(julianday(updated_at) IS NULL OR julianday(updated_at) > julianday(?))");
+    params.push(filter.updated_after);
+  }
   if (filter.session_id) {
     conditions.push("session_id = ?");
     params.push(filter.session_id);
@@ -9426,6 +9517,10 @@ function countTasks(filter = {}, db) {
     conditions.push("(created_by IS NULL OR LOWER(created_by) != LOWER(?))");
     params.push(filter.not_created_by);
   }
+  if (filter.updated_after) {
+    conditions.push("(julianday(updated_at) IS NULL OR julianday(updated_at) > julianday(?))");
+    params.push(filter.updated_after);
+  }
   if (filter.session_id) {
     conditions.push("session_id = ?");
     params.push(filter.session_id);
@@ -9465,7 +9560,7 @@ function countTasks(filter = {}, db) {
   const row = d.query(`SELECT COUNT(*) as count FROM tasks ${where}`).get(...params);
   return row.count;
 }
-function updateTask(id, input, db) {
+function updateTaskStored(id, input, db) {
   const d = db || getDatabase();
   const task = getTask(id, d);
   if (!task)
@@ -9474,6 +9569,18 @@ function updateTask(id, input, db) {
     throw new VersionConflictError(id, input.version, task.version);
   }
   input = sanitizeUpdateTaskInput(input);
+  const effectivePlanId = input.plan_id !== undefined ? input.plan_id : task.plan_id;
+  const linkedProjectId = linkedPlanProjectId(effectivePlanId, d);
+  if (linkedProjectId) {
+    const effectiveProjectId = input.project_id !== undefined ? input.project_id : task.project_id;
+    if (effectiveProjectId !== linkedProjectId) {
+      if (input.project_id === undefined && (input.plan_id !== undefined || task.project_id === null)) {
+        input = { ...input, project_id: linkedProjectId };
+      } else {
+        throw new ResourceConflictError("PLAN_PROJECT_LINK_CONFLICT", `Task project conflicts with linked plan ${effectivePlanId}: expected ${linkedProjectId}`);
+      }
+    }
+  }
   const timestamp2 = now();
   const completionTimestamp = input.completed_at ?? timestamp2;
   const sets = ["version = version + 1", "updated_at = ?"];
@@ -9681,6 +9788,21 @@ function updateTask(id, input, db) {
   emitSharedTaskEventQuiet({ type: "task.updated", task: updatedTask, databasePath });
   return updatedTask;
 }
+function updateTask(id, input, db) {
+  const d = db || getDatabase();
+  const before = getTask(id, d);
+  if (!before)
+    throw new TaskNotFoundError(id);
+  const guardedPlanIds = [before.plan_id, input.plan_id];
+  if (!guardedPlanIds.some(Boolean))
+    return updateTaskStored(id, input, d);
+  return d.transaction(() => {
+    guardPlanRowsSqlite(guardedPlanIds, d);
+    const current = getTask(id, d);
+    guardPlanRowsSqlite([current?.plan_id, input.plan_id], d);
+    return updateTaskStored(id, input, d);
+  })();
+}
 function deleteTask(id, db) {
   const d = db || getDatabase();
   const row = d.query("SELECT * FROM tasks WHERE id = ?").get(id);
@@ -10346,7 +10468,7 @@ function listPlans(projectId, db) {
   }
   return d.query("SELECT * FROM plans ORDER BY created_at DESC").all();
 }
-function updatePlan(id, input, db) {
+function updatePlanStored(id, input, db) {
   const d = db || getDatabase();
   const plan = getPlan(id, d);
   if (!plan)
@@ -10391,6 +10513,13 @@ function updatePlan(id, input, db) {
   });
   return updated;
 }
+function updatePlan(id, input, db) {
+  const d = db || getDatabase();
+  return d.transaction(() => {
+    guardPlanRowsSqlite([id], d);
+    return updatePlanStored(id, input, d);
+  })();
+}
 function deletePlan(id, db) {
   const d = db || getDatabase();
   const plan = getPlan(id, d);
@@ -13332,6 +13461,239 @@ function scanSqliteIntegrity(db = getDatabase()) {
   return buildIntegrityReport(conditions, now());
 }
 
+// src/lib/plan-project-link-contract.ts
+import { createHash as createHash4 } from "crypto";
+var PLAN_PROJECT_LINK_SCHEMA_VERSION = "todos.plan-project-link.v1";
+
+class PlanProjectLinkError extends Error {
+  code;
+  details;
+  constructor(code, message, details = {}) {
+    super(message);
+    this.code = code;
+    this.details = details;
+    this.name = "PlanProjectLinkError";
+  }
+}
+function canonicalPlanProjectLinkJson(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map(canonicalPlanProjectLinkJson).join(",")}]`;
+  return `{${Object.entries(value).filter(([, item]) => item !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonicalPlanProjectLinkJson(item)}`).join(",")}}`;
+}
+function planProjectLinkDigest(value) {
+  return createHash4("sha256").update(canonicalPlanProjectLinkJson(value)).digest("hex");
+}
+function normalizePlanProjectLinkIdempotencyKey(value) {
+  const key = value?.trim() ?? "";
+  if (key.length < 8 || key.length > 128 || !/^[A-Za-z0-9._:-]+$/.test(key)) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_KEY_INVALID", "idempotency_key must be 8-128 ASCII letters, digits, dots, underscores, colons, or hyphens");
+  }
+  return key;
+}
+function planProjectLinkReceiptId(idempotencyKey) {
+  return `pplr_${planProjectLinkDigest({ idempotency_key: idempotencyKey }).slice(0, 48)}`;
+}
+function planProjectLinkRollbackReceiptId(receiptId) {
+  return `pplr_inverse_${planProjectLinkDigest({ accepted_receipt_id: receiptId }).slice(0, 38)}`;
+}
+function planProjectLinkRequestHash(planId, projectId) {
+  return planProjectLinkDigest({ plan_id: planId, project_id: projectId });
+}
+function planProjectLinkResultDigest(plan, tasks) {
+  return planProjectLinkDigest({
+    plan_id: plan.id,
+    plan_project_id: plan.project_id,
+    tasks: tasks.map((task) => ({ id: task.id, plan_id: task.plan_id, project_id: task.project_id })).sort((left, right) => left.id.localeCompare(right.id))
+  });
+}
+function assertPlanProjectLinkReceipt(value) {
+  const receipt = value;
+  if (!receipt || typeof receipt !== "object" || receipt.schema_version !== PLAN_PROJECT_LINK_SCHEMA_VERSION || typeof receipt.receipt_id !== "string" || typeof receipt.idempotency_key !== "string" || typeof receipt.plan_id !== "string" || typeof receipt.project_id !== "string" || !Array.isArray(receipt.task_ids) || receipt.task_ids.some((id) => typeof id !== "string") || !receipt.prior_task_project_ids || typeof receipt.prior_task_project_ids !== "object" || typeof receipt.result_digest !== "string") {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND", "Stored plan-project-link receipt is invalid");
+  }
+  return receipt;
+}
+
+// src/db/plan-project-links.ts
+init_database();
+init_plans();
+init_projects();
+init_tasks();
+function getPlanProjectLinkReceipt(receiptId, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT payload FROM plan_project_link_receipts WHERE receipt_id = ?").get(receiptId);
+  return row ? assertPlanProjectLinkReceipt(JSON.parse(row.payload)) : null;
+}
+function getPlanProjectLinkReceiptByIdempotencyKey(idempotencyKey, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT payload FROM plan_project_link_receipts WHERE idempotency_key = ?").get(idempotencyKey);
+  return row ? assertPlanProjectLinkReceipt(JSON.parse(row.payload)) : null;
+}
+function exactTasks(planId, db) {
+  return listTasks({ plan_id: planId, include_subtasks: true, include_archived: true }, db).sort((left, right) => left.id.localeCompare(right.id));
+}
+function currentResult(planId, projectId, receipt, db, action) {
+  const plan = getPlan(planId, db);
+  const project = getProject(projectId, db);
+  if (!plan || !project) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "An accepted plan-project-link target no longer resolves", { plan_id: planId, project_id: projectId, receipt_id: receipt.receipt_id });
+  }
+  const tasks = exactTasks(planId, db);
+  if (planProjectLinkResultDigest(plan, tasks) !== receipt.result_digest) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "The accepted plan-project-link result has drifted", { plan_id: planId, project_id: projectId, receipt_id: receipt.receipt_id });
+  }
+  return { mode: "apply", action, plan, project, tasks, receipt };
+}
+function applyPlanProjectLinkSqlite(input, db) {
+  const d = db || getDatabase();
+  const mutate = d.transaction(() => {
+    guardPlanRowsSqlite([input.plan_id], d);
+    const requestHash = planProjectLinkRequestHash(input.plan_id, input.project_id);
+    const existingRow = d.query("SELECT payload_hash, payload FROM plan_project_link_receipts WHERE idempotency_key = ?").get(input.idempotency_key);
+    if (existingRow) {
+      if (existingRow.payload_hash !== requestHash) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The idempotency key was already accepted for a different plan-project link", { idempotency_key: input.idempotency_key });
+      }
+      const rolledBack = d.query("SELECT rollback_receipt_id FROM plan_project_link_rollback_receipts WHERE accepted_receipt_id = ?").get(input.receipt_id);
+      if (rolledBack) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The accepted plan-project link has already been rolled back", { receipt_id: input.receipt_id });
+      }
+      return currentResult(input.plan_id, input.project_id, assertPlanProjectLinkReceipt(JSON.parse(existingRow.payload)), d, "already_linked");
+    }
+    const plan = getPlan(input.plan_id, d);
+    if (!plan) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan not found: ${input.plan_id}`);
+    }
+    const project = getProject(input.project_id, d);
+    if (!project) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_NOT_FOUND", `Project not found: ${input.project_id}`);
+    }
+    if (plan.updated_at !== input.expected_plan_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed after the link plan; fetch a fresh plan before applying", { expected_plan_revision: input.expected_plan_revision, current_plan_revision: plan.updated_at });
+    }
+    if (project.updated_at !== input.expected_project_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_REVISION_CONFLICT", "Destination project changed after the link plan; fetch a fresh plan before applying", { expected_project_revision: input.expected_project_revision, current_project_revision: project.updated_at });
+    }
+    if (plan.slug) {
+      const collision = d.query("SELECT id FROM plans WHERE project_id = ? AND slug = ? AND id <> ? LIMIT 1").get(project.id, plan.slug, plan.id);
+      if (collision) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_SCOPE_COLLISION", "Another plan already owns this slug in the destination project", { conflicting_plan_id: collision.id, slug: plan.slug });
+      }
+    }
+    const beforeTasks = exactTasks(plan.id, d);
+    const alreadyLinked = plan.project_id === project.id && beforeTasks.every((task) => task.project_id === project.id);
+    const priorTaskProjectIds = Object.fromEntries(beforeTasks.map((task) => [task.id, task.project_id]));
+    const timestamp2 = input.created_at;
+    if (plan.project_id !== project.id) {
+      d.run("UPDATE plans SET project_id = ?, updated_at = ? WHERE id = ? AND updated_at = ?", [
+        project.id,
+        timestamp2,
+        plan.id,
+        input.expected_plan_revision
+      ]);
+    }
+    for (const task of beforeTasks) {
+      if (task.project_id === project.id)
+        continue;
+      d.run("UPDATE tasks SET project_id = ?, updated_at = ?, version = version + 1 WHERE id = ? AND plan_id = ?", [project.id, timestamp2, task.id, plan.id]);
+    }
+    const linkedPlan = getPlan(plan.id, d);
+    const linkedTasks = exactTasks(plan.id, d);
+    if (linkedPlan.project_id !== project.id || linkedTasks.length !== beforeTasks.length || linkedTasks.some((task) => task.project_id !== project.id)) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "Atomic plan-project link readback did not preserve the exact plan membership", { plan_id: plan.id, project_id: project.id });
+    }
+    const receipt = {
+      schema_version: PLAN_PROJECT_LINK_SCHEMA_VERSION,
+      receipt_id: input.receipt_id,
+      idempotency_key: input.idempotency_key,
+      plan_id: plan.id,
+      project_id: project.id,
+      prior_plan_project_id: plan.project_id,
+      prior_task_project_ids: priorTaskProjectIds,
+      task_ids: beforeTasks.map((task) => task.id),
+      task_count: beforeTasks.length,
+      result_plan_revision: linkedPlan.updated_at,
+      result_digest: planProjectLinkResultDigest(linkedPlan, linkedTasks),
+      rollback_supported: true,
+      created_at: input.created_at
+    };
+    d.run(`INSERT INTO plan_project_link_receipts
+       (receipt_id, idempotency_key, plan_id, project_id, payload_hash, payload, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`, [
+      receipt.receipt_id,
+      receipt.idempotency_key,
+      receipt.plan_id,
+      receipt.project_id,
+      requestHash,
+      JSON.stringify(receipt),
+      receipt.created_at
+    ]);
+    return {
+      mode: "apply",
+      action: alreadyLinked ? "already_linked" : "linked",
+      plan: linkedPlan,
+      project,
+      tasks: linkedTasks,
+      receipt
+    };
+  });
+  return mutate();
+}
+function rollbackPlanProjectLinkSqlite(input, db) {
+  const d = db || getDatabase();
+  return d.transaction(() => {
+    guardPlanRowsSqlite([input.plan_id], d);
+    const priorRollback = d.query("SELECT payload FROM plan_project_link_rollback_receipts WHERE accepted_receipt_id = ?").get(input.receipt_id);
+    if (priorRollback)
+      return JSON.parse(priorRollback.payload);
+    const receipt = getPlanProjectLinkReceipt(input.receipt_id, d);
+    if (!receipt || receipt.plan_id !== input.plan_id || receipt.project_id !== input.project_id) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND", "No exact plan-project-link receipt matches this rollback request", { receipt_id: input.receipt_id, plan_id: input.plan_id, project_id: input.project_id });
+    }
+    const plan = getPlan(input.plan_id, d);
+    if (!plan || plan.updated_at !== input.expected_plan_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed after the accepted link; fetch an exact readback before rollback", { expected_plan_revision: input.expected_plan_revision, current_plan_revision: plan?.updated_at ?? null });
+    }
+    const tasks = exactTasks(plan.id, d);
+    if (planProjectLinkResultDigest(plan, tasks) !== receipt.result_digest || tasks.length !== receipt.task_ids.length || tasks.some((task, index) => task.id !== receipt.task_ids[index])) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Plan membership or project linkage drifted; refusing conditional rollback", { receipt_id: receipt.receipt_id });
+    }
+    d.run("UPDATE plans SET project_id = ?, updated_at = ? WHERE id = ? AND updated_at = ?", [
+      receipt.prior_plan_project_id,
+      input.restored_at,
+      plan.id,
+      input.expected_plan_revision
+    ]);
+    for (const task of tasks) {
+      const priorProjectId = receipt.prior_task_project_ids[task.id];
+      if (priorProjectId === undefined && !(task.id in receipt.prior_task_project_ids)) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Receipt does not contain the exact prior project for every member task", { task_id: task.id, receipt_id: receipt.receipt_id });
+      }
+      d.run("UPDATE tasks SET project_id = ?, updated_at = ?, version = version + 1 WHERE id = ? AND plan_id = ?", [priorProjectId, input.restored_at, task.id, plan.id]);
+    }
+    const restoredPlan = getPlan(plan.id, d);
+    const restoredTasks = exactTasks(plan.id, d);
+    if (restoredPlan.project_id !== receipt.prior_plan_project_id || restoredTasks.some((task) => task.project_id !== receipt.prior_task_project_ids[task.id])) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Rollback readback did not restore every exact prior project id", { receipt_id: receipt.receipt_id });
+    }
+    const result = {
+      schema_version: PLAN_PROJECT_LINK_SCHEMA_VERSION,
+      action: "restored",
+      plan: restoredPlan,
+      tasks: restoredTasks,
+      accepted_receipt_id: receipt.receipt_id,
+      rollback_receipt_id: input.rollback_receipt_id,
+      restored_at: input.restored_at
+    };
+    d.run(`INSERT INTO plan_project_link_rollback_receipts
+       (rollback_receipt_id, accepted_receipt_id, payload, created_at)
+       VALUES (?, ?, ?, ?)`, [result.rollback_receipt_id, result.accepted_receipt_id, JSON.stringify(result), result.restored_at]);
+    return result;
+  })();
+}
+
 // src/storage/sqlite-snapshot.ts
 init_database();
 init_audit();
@@ -13835,6 +14197,12 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       update: (id, input) => updatePlan(id, input, database()),
       delete: (id) => deletePlan(id, database())
     },
+    planProjectLinks: {
+      apply: (input) => applyPlanProjectLinkSqlite(input, database()),
+      rollback: (input) => rollbackPlanProjectLinkSqlite(input, database()),
+      getReceipt: (receiptId) => getPlanProjectLinkReceipt(receiptId, database()),
+      getReceiptByIdempotencyKey: (key) => getPlanProjectLinkReceiptByIdempotencyKey(key, database())
+    },
     agents: {
       register: (input) => registerAgent(input, database()),
       get: (id) => getAgent(id, database()),
@@ -13848,7 +14216,8 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       getBySlug: (slug, projectId) => getTaskListBySlug(slug, projectId, database()),
       list: (projectId) => listTaskLists(projectId, database()),
       update: (id, input) => updateTaskList(id, input, database()),
-      delete: (id) => deleteTaskList(id, database())
+      delete: (id) => deleteTaskList(id, database()),
+      deleteIfUnchangedAndUnused: (id, expected) => deleteTaskListIfUnchangedAndUnused(id, expected, database())
     },
     templates: {
       create: (input) => createTemplate(input, database()),
@@ -13928,6 +14297,21 @@ function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABL
       RETURNS text
       LANGUAGE sql IMMUTABLE PARALLEL SAFE STRICT
       AS $$ SELECT unaccent('unaccent', $1) $$`,
+    `CREATE OR REPLACE FUNCTION todos_try_timestamptz(text)
+      RETURNS timestamptz
+      LANGUAGE plpgsql IMMUTABLE PARALLEL SAFE
+      SET DateStyle TO 'ISO, YMD'
+      AS $$
+      BEGIN
+        RETURN CASE
+          WHEN $1 ~ '(Z|[+-][0-9]{2}:?[0-9]{2})$' THEN $1::timestamptz
+          ELSE ($1::timestamp AT TIME ZONE 'UTC')
+        END;
+      EXCEPTION WHEN others THEN RETURN NULL; END $$`,
+    `DROP INDEX IF EXISTS ${tableName}_task_updated_at_idx`,
+    `CREATE INDEX IF NOT EXISTS ${tableName}_task_updated_at_utc_idx
+      ON ${tableName} (todos_try_timestamptz(payload->>'updated_at'))
+      WHERE object_type = 'tasks' AND deleted_at IS NULL`,
     `ALTER TABLE ${tableName}
       ADD COLUMN IF NOT EXISTS task_search_tsv tsvector
       GENERATED ALWAYS AS (
@@ -14357,6 +14741,12 @@ function createPostgresTodosStorageAdapter(options) {
       update: (id, input) => updatePlan2(id, input, store),
       delete: (id, context) => store.deletePlan(id, context)
     },
+    planProjectLinks: {
+      apply: (input, context) => store.applyPlanProjectLink(input, context),
+      rollback: (input, context) => store.rollbackPlanProjectLink(input, context),
+      getReceipt: (receiptId) => store.getPlanProjectLinkReceipt(receiptId),
+      getReceiptByIdempotencyKey: (key) => store.getPlanProjectLinkReceiptByIdempotencyKey(key)
+    },
     agents: {
       register: (input, context) => registerAgent2(input, store, context),
       get: (id) => store.get("agents", id),
@@ -14539,6 +14929,9 @@ class PostgresJsonRecordStore {
       conds.push(`LOWER(payload->>'created_by') = LOWER(${p(filter.created_by)})`);
     if (filter.not_created_by !== undefined)
       conds.push(`(payload->>'created_by' IS NULL OR LOWER(payload->>'created_by') <> LOWER(${p(filter.not_created_by)}))`);
+    if (filter.updated_after !== undefined) {
+      conds.push(`(todos_try_timestamptz(payload->>'updated_at') IS NULL ` + `OR todos_try_timestamptz(payload->>'updated_at') > ${p(filter.updated_after)}::timestamptz)`);
+    }
     if (filter.session_id !== undefined)
       conds.push(`payload->>'session_id' = ${p(filter.session_id)}`);
     if (filter.tags?.length) {
@@ -14723,6 +15116,115 @@ class PostgresJsonRecordStore {
     }
     return value;
   }
+  async upsertTaskWithPlanMembershipGuard(value, guardedPlanIds, explicitProject, context = {}) {
+    const planIds = [...new Set(guardedPlanIds.filter(Boolean))].sort();
+    if (planIds.length === 0)
+      return this.upsert("tasks", value, context);
+    await this.ensureSchema();
+    const updatedAt = value.updated_at;
+    const targetPlanId = value.plan_id;
+    const result = await this.options.client.query(`/* todos:task-plan-membership-guard */ WITH
+       locked_plans AS MATERIALIZED (
+         SELECT object_id, payload FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'plans' AND deleted_at IS NULL
+           AND object_id IN (SELECT value FROM jsonb_array_elements_text($7::jsonb))
+         ORDER BY object_id
+         FOR UPDATE
+       ), validation AS (
+         SELECT
+           (SELECT count(*) FROM locked_plans) = jsonb_array_length($7::jsonb) AS all_plans_found,
+           ($8::text IS NULL OR EXISTS (SELECT 1 FROM locked_plans WHERE object_id = $8)) AS target_plan_found,
+           (SELECT payload->>'project_id' FROM locked_plans WHERE object_id = $8) AS target_project_id
+       ), guarded AS (
+         SELECT
+           validation.*,
+           ($9::boolean AND validation.target_project_id IS NOT NULL
+             AND ($3::jsonb->>'project_id') IS DISTINCT FROM validation.target_project_id) AS project_conflict,
+           CASE
+             WHEN validation.target_project_id IS NULL THEN $3::jsonb
+             ELSE jsonb_set($3::jsonb, '{project_id}', to_jsonb(validation.target_project_id), true)
+           END AS payload
+         FROM validation
+       ), stored AS (
+         INSERT INTO ${this.tableName} (
+           service, object_type, object_id, payload, updated_at,
+           deleted_at, source_machine_id, version
+         )
+         SELECT $1, 'tasks', $2, guarded.payload, $4::timestamptz, NULL, $5, $6
+         FROM guarded
+         WHERE guarded.all_plans_found AND guarded.target_plan_found AND NOT guarded.project_conflict
+         ON CONFLICT (service, object_type, object_id) DO UPDATE SET
+           payload = EXCLUDED.payload,
+           updated_at = EXCLUDED.updated_at,
+           deleted_at = NULL,
+           source_machine_id = EXCLUDED.source_machine_id,
+           version = EXCLUDED.version
+         WHERE ${this.tableName}.updated_at IS NULL
+            OR ${this.tableName}.updated_at < EXCLUDED.updated_at
+            OR (${this.tableName}.updated_at = EXCLUDED.updated_at
+                AND COALESCE(${this.tableName}.version, 0) <= COALESCE(EXCLUDED.version, 0))
+         RETURNING payload
+       )
+       SELECT guarded.all_plans_found, guarded.target_plan_found, guarded.project_conflict,
+              (SELECT payload FROM stored) AS payload
+       FROM guarded`, [
+      this.service,
+      value.id,
+      jsonbParam(value),
+      updatedAt,
+      context.requestId ?? this.sourceMachineId ?? null,
+      numberValue2(value.version),
+      jsonbParam(planIds),
+      targetPlanId,
+      explicitProject
+    ]);
+    const row = result.rows[0];
+    if (!row?.all_plans_found || !row.target_plan_found) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan membership changed through a missing plan: ${targetPlanId ?? planIds.join(", ")}`, { plan_ids: planIds, target_plan_id: targetPlanId });
+    }
+    if (row.project_conflict) {
+      throw new ResourceConflictError("PLAN_PROJECT_LINK_CONFLICT", `Task project conflicts with linked plan ${targetPlanId}`);
+    }
+    if (!row.payload) {
+      return await requireRecord("tasks", value.id, this);
+    }
+    return payloadRecord2(row.payload);
+  }
+  async updatePlanWithProjectLinkGuard(value, context = {}) {
+    await this.ensureSchema();
+    const result = await this.options.client.query(`/* todos:plan-update-project-link-guard */ WITH locked_plan AS MATERIALIZED (
+         SELECT payload FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'plans' AND object_id = $2 AND deleted_at IS NULL
+         FOR UPDATE
+       ), stored AS (
+         UPDATE ${this.tableName} r SET
+           payload = jsonb_set(
+             $3::jsonb,
+             '{project_id}',
+             COALESCE((SELECT payload->'project_id' FROM locked_plan), 'null'::jsonb),
+             true
+           ),
+           updated_at = $4::timestamptz,
+           deleted_at = NULL,
+           source_machine_id = COALESCE($5, r.source_machine_id),
+           version = COALESCE(r.version, 0) + 1
+         FROM locked_plan
+         WHERE r.service = $1 AND r.object_type = 'plans' AND r.object_id = $2 AND r.deleted_at IS NULL
+         RETURNING r.payload
+       )
+       SELECT EXISTS (SELECT 1 FROM locked_plan) AS plan_found,
+              (SELECT payload FROM stored) AS payload`, [
+      this.service,
+      value.id,
+      jsonbParam(value),
+      value.updated_at,
+      context.requestId ?? this.sourceMachineId ?? null
+    ]);
+    const row = result.rows[0];
+    if (!row?.plan_found || !row.payload)
+      throw new PlanNotFoundError(value.id);
+    return payloadRecord2(row.payload);
+  }
   async createTemplateWithTasks(template, tasks, context = {}) {
     await this.ensureSchema();
     const records = [
@@ -14961,6 +15463,333 @@ class PostgresJsonRecordStore {
       version: numberValue2(existing["version"])
     }, context);
   }
+  async getPlanProjectLinkReceipt(receiptId) {
+    const value = await this.get("plan_project_link_receipts", receiptId);
+    return value ? assertPlanProjectLinkReceipt(value) : null;
+  }
+  async getPlanProjectLinkReceiptByIdempotencyKey(idempotencyKey) {
+    await this.ensureSchema();
+    const result = await this.options.client.query(`/* todos:plan-project-link-receipt-by-key */ SELECT payload FROM ${this.tableName}
+       WHERE service = $1 AND object_type = 'plan_project_link_receipts' AND deleted_at IS NULL
+         AND payload->>'idempotency_key' = $2
+       LIMIT 2`, [this.service, idempotencyKey]);
+    if (result.rows.length > 1) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "More than one immutable receipt carries this idempotency key", { idempotency_key: idempotencyKey });
+    }
+    return result.rows[0] ? assertPlanProjectLinkReceipt(result.rows[0].payload) : null;
+  }
+  async currentPlanProjectLinkResult(receipt, action) {
+    const [plan, project, tasks] = await Promise.all([
+      this.get("plans", receipt.plan_id),
+      this.get("projects", receipt.project_id),
+      this.listTasks({ plan_id: receipt.plan_id, include_subtasks: true })
+    ]);
+    const sortedTasks2 = tasks.sort((left, right) => left.id.localeCompare(right.id));
+    if (!plan || !project || planProjectLinkResultDigest(plan, sortedTasks2) !== receipt.result_digest) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "The accepted plan-project-link result has drifted", { receipt_id: receipt.receipt_id });
+    }
+    return { mode: "apply", action, plan, project, tasks: sortedTasks2, receipt };
+  }
+  async applyPlanProjectLink(input, context = {}) {
+    await this.ensureSchema();
+    const existing = await this.getPlanProjectLinkReceipt(input.receipt_id);
+    if (existing) {
+      if (existing.plan_id !== input.plan_id || existing.project_id !== input.project_id) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The idempotency key was already accepted for a different plan-project link", { idempotency_key: input.idempotency_key, receipt_id: existing.receipt_id });
+      }
+      const rolledBack = await this.get("plan_project_link_rollback_receipts", planProjectLinkRollbackReceiptId(input.receipt_id));
+      if (rolledBack) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The accepted plan-project link has already been rolled back", { receipt_id: input.receipt_id });
+      }
+      return this.currentPlanProjectLinkResult(existing, "already_linked");
+    }
+    const [plan, project, tasks, scopedPlans] = await Promise.all([
+      this.get("plans", input.plan_id),
+      this.get("projects", input.project_id),
+      this.listTasks({ plan_id: input.plan_id, include_subtasks: true }),
+      this.list("plans")
+    ]);
+    if (!plan)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan not found: ${input.plan_id}`);
+    if (!project)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_NOT_FOUND", `Project not found: ${input.project_id}`);
+    if (plan.updated_at !== input.expected_plan_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed after the link plan; fetch a fresh plan before applying", { expected_plan_revision: input.expected_plan_revision, current_plan_revision: plan.updated_at });
+    }
+    if (project.updated_at !== input.expected_project_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_REVISION_CONFLICT", "Destination project changed after the link plan; fetch a fresh plan before applying", { expected_project_revision: input.expected_project_revision, current_project_revision: project.updated_at });
+    }
+    const collision = scopedPlans.find((candidate) => candidate.id !== plan.id && candidate.project_id === project.id && candidate.slug !== null && candidate.slug === plan.slug);
+    if (collision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_SCOPE_COLLISION", "Another plan already owns this slug in the destination project", { conflicting_plan_id: collision.id, slug: plan.slug });
+    }
+    const sortedTasks2 = tasks.sort((left, right) => left.id.localeCompare(right.id));
+    const priorTaskProjectIds = Object.fromEntries(sortedTasks2.map((task) => [task.id, task.project_id]));
+    const projectedPlan = { ...plan, project_id: project.id, updated_at: input.created_at };
+    const projectedTasks = sortedTasks2.map((task) => task.project_id === project.id ? task : { ...task, project_id: project.id, updated_at: input.created_at, version: task.version + 1 });
+    const alreadyLinked = plan.project_id === project.id && sortedTasks2.every((task) => task.project_id === project.id);
+    const receipt = {
+      schema_version: PLAN_PROJECT_LINK_SCHEMA_VERSION,
+      receipt_id: input.receipt_id,
+      idempotency_key: input.idempotency_key,
+      plan_id: plan.id,
+      project_id: project.id,
+      prior_plan_project_id: plan.project_id,
+      prior_task_project_ids: priorTaskProjectIds,
+      task_ids: sortedTasks2.map((task) => task.id),
+      task_count: sortedTasks2.length,
+      result_plan_revision: projectedPlan.updated_at,
+      result_digest: planProjectLinkResultDigest(projectedPlan, projectedTasks),
+      rollback_supported: true,
+      created_at: input.created_at
+    };
+    let mutation;
+    try {
+      mutation = await this.options.client.query(`/* todos:plan-project-link-atomic */ WITH
+         target_plan AS MATERIALIZED (
+           SELECT payload FROM ${this.tableName}
+           WHERE service = $1 AND object_type = 'plans' AND object_id = $2 AND deleted_at IS NULL
+           FOR UPDATE
+         ), target_project AS (
+           SELECT payload FROM ${this.tableName}
+           WHERE service = $1 AND object_type = 'projects' AND object_id = $3 AND deleted_at IS NULL
+           FOR UPDATE
+         ), member_tasks AS MATERIALIZED (
+           SELECT object_id, payload FROM ${this.tableName}
+           WHERE service = $1 AND object_type = 'tasks' AND deleted_at IS NULL
+             AND payload->>'plan_id' = $2
+             AND EXISTS (SELECT 1 FROM target_plan)
+           FOR UPDATE
+         ), existing AS (
+           SELECT payload FROM ${this.tableName}
+           WHERE service = $1 AND object_type = 'plan_project_link_receipts'
+             AND object_id = $6 AND deleted_at IS NULL
+           FOR UPDATE
+         ), collision AS (
+           SELECT 1 FROM ${this.tableName} r, target_plan p
+           WHERE r.service = $1 AND r.object_type = 'plans' AND r.deleted_at IS NULL
+             AND r.object_id <> $2 AND r.payload->>'project_id' = $3
+             AND r.payload->>'slug' IS NOT DISTINCT FROM p.payload->>'slug'
+             AND p.payload->>'slug' IS NOT NULL
+           LIMIT 1
+         ), checks AS (
+           SELECT
+             EXISTS (SELECT 1 FROM target_plan) AS plan_found,
+             EXISTS (SELECT 1 FROM target_project) AS project_found,
+             COALESCE((SELECT payload->>'updated_at' = $4 FROM target_plan), false) AS plan_revision_ok,
+             COALESCE((SELECT payload->>'updated_at' = $5 FROM target_project), false) AS project_revision_ok,
+             COALESCE((SELECT jsonb_object_agg(object_id, COALESCE(payload->'project_id', 'null'::jsonb) ORDER BY object_id) FROM member_tasks), '{}'::jsonb) = $8::jsonb
+               AND COALESCE((SELECT jsonb_agg(object_id ORDER BY object_id) FROM member_tasks), '[]'::jsonb) = $9::jsonb AS membership_ok,
+             EXISTS (SELECT 1 FROM collision) AS collision,
+             EXISTS (SELECT 1 FROM existing) AS has_existing
+         ), updated_plan AS (
+           UPDATE ${this.tableName} r SET
+             payload = r.payload || jsonb_build_object('project_id', $3::text, 'updated_at', $10::text),
+             updated_at = $10::timestamptz,
+             version = COALESCE(r.version, 0) + 1,
+             source_machine_id = COALESCE($11, r.source_machine_id)
+           FROM checks
+           WHERE r.service = $1 AND r.object_type = 'plans' AND r.object_id = $2 AND r.deleted_at IS NULL
+             AND checks.plan_found AND checks.project_found AND checks.plan_revision_ok
+             AND checks.project_revision_ok AND checks.membership_ok AND NOT checks.collision AND NOT checks.has_existing
+           RETURNING r.payload
+         ), updated_tasks AS (
+           UPDATE ${this.tableName} r SET
+             payload = r.payload || jsonb_build_object(
+               'project_id', $3::text,
+               'updated_at', $10::text,
+               'version', COALESCE((r.payload->>'version')::int, 0) + 1
+             ),
+             updated_at = $10::timestamptz,
+             version = COALESCE(r.version, 0) + 1,
+             source_machine_id = COALESCE($11, r.source_machine_id)
+           WHERE r.service = $1 AND r.object_type = 'tasks' AND r.deleted_at IS NULL
+             AND r.payload->>'plan_id' = $2
+             AND r.payload->>'project_id' IS DISTINCT FROM $3
+             AND EXISTS (SELECT 1 FROM updated_plan)
+           RETURNING 1
+         ), task_gate AS (
+           SELECT count(*) AS count FROM updated_tasks
+         ), inserted AS (
+           INSERT INTO ${this.tableName}
+             (service, object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version)
+           SELECT $1, 'plan_project_link_receipts', $6, $7::jsonb, $10::timestamptz, NULL, $11, 1
+           FROM checks, task_gate
+           WHERE NOT checks.has_existing AND EXISTS (SELECT 1 FROM updated_plan)
+           RETURNING payload
+         ) SELECT
+           checks.plan_found,
+           checks.project_found,
+           checks.plan_revision_ok,
+           checks.project_revision_ok,
+           checks.membership_ok,
+           checks.collision,
+           (SELECT payload FROM existing) AS existing_receipt,
+           (SELECT payload FROM inserted) AS inserted_receipt
+         FROM checks`, [
+        this.service,
+        plan.id,
+        project.id,
+        input.expected_plan_revision,
+        input.expected_project_revision,
+        receipt.receipt_id,
+        jsonbParam(receipt),
+        jsonbParam(priorTaskProjectIds),
+        jsonbParam(receipt.task_ids),
+        input.created_at,
+        this.machineId(context)
+      ]);
+    } catch (error) {
+      if (isPostgresUniqueViolation(error)) {
+        const raced = await this.getPlanProjectLinkReceipt(input.receipt_id);
+        if (raced && raced.plan_id === input.plan_id && raced.project_id === input.project_id) {
+          return this.currentPlanProjectLinkResult(raced, "already_linked");
+        }
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The idempotency key raced with a different plan-project link", { idempotency_key: input.idempotency_key });
+      }
+      throw error;
+    }
+    const row = mutation.rows[0];
+    if (!row?.plan_found)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan not found: ${plan.id}`);
+    if (!row.project_found)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_NOT_FOUND", `Project not found: ${project.id}`);
+    if (!row.plan_revision_ok)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed during the atomic link");
+    if (!row.project_revision_ok)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_REVISION_CONFLICT", "Project changed during the atomic link");
+    if (!row.membership_ok)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "Plan membership changed during the atomic link");
+    if (row.collision)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_SCOPE_COLLISION", "Another plan owns this slug in the destination project");
+    const accepted = assertPlanProjectLinkReceipt(row.existing_receipt ?? row.inserted_receipt);
+    if (accepted.plan_id !== plan.id || accepted.project_id !== project.id) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The idempotency key was accepted for a different target");
+    }
+    return this.currentPlanProjectLinkResult(accepted, alreadyLinked ? "already_linked" : "linked");
+  }
+  async rollbackPlanProjectLink(input, context = {}) {
+    await this.ensureSchema();
+    const existingRollback = await this.get("plan_project_link_rollback_receipts", input.rollback_receipt_id);
+    if (existingRollback)
+      return existingRollback;
+    const receipt = await this.getPlanProjectLinkReceipt(input.receipt_id);
+    if (!receipt || receipt.plan_id !== input.plan_id || receipt.project_id !== input.project_id) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND", "No exact plan-project-link receipt matches this rollback request", { receipt_id: input.receipt_id });
+    }
+    const [plan, tasks] = await Promise.all([
+      this.get("plans", input.plan_id),
+      this.listTasks({ plan_id: input.plan_id, include_subtasks: true })
+    ]);
+    const sortedTasks2 = tasks.sort((left, right) => left.id.localeCompare(right.id));
+    if (!plan || plan.updated_at !== input.expected_plan_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed after the accepted link; fetch an exact readback before rollback");
+    }
+    if (planProjectLinkResultDigest(plan, sortedTasks2) !== receipt.result_digest) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Plan membership or project linkage drifted; refusing conditional rollback");
+    }
+    const projectedPlan = { ...plan, project_id: receipt.prior_plan_project_id, updated_at: input.restored_at };
+    const projectedTasks = sortedTasks2.map((task) => ({
+      ...task,
+      project_id: receipt.prior_task_project_ids[task.id] ?? null,
+      updated_at: input.restored_at,
+      version: task.version + 1
+    }));
+    const rollback = {
+      schema_version: PLAN_PROJECT_LINK_SCHEMA_VERSION,
+      action: "restored",
+      plan: projectedPlan,
+      tasks: projectedTasks,
+      accepted_receipt_id: receipt.receipt_id,
+      rollback_receipt_id: input.rollback_receipt_id,
+      restored_at: input.restored_at
+    };
+    const currentTaskProjects = Object.fromEntries(sortedTasks2.map((task) => [task.id, task.project_id]));
+    const result = await this.options.client.query(`/* todos:plan-project-link-rollback-atomic */ WITH
+       target_plan AS MATERIALIZED (
+         SELECT payload FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'plans' AND object_id = $2 AND deleted_at IS NULL
+         FOR UPDATE
+       ), member_tasks AS MATERIALIZED (
+         SELECT object_id, payload FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'tasks' AND deleted_at IS NULL
+           AND payload->>'plan_id' = $2
+           AND EXISTS (SELECT 1 FROM target_plan)
+         FOR UPDATE
+       ), existing AS (
+         SELECT payload FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'plan_project_link_rollback_receipts'
+           AND object_id = $5 AND deleted_at IS NULL
+         FOR UPDATE
+       ), checks AS (
+         SELECT
+           EXISTS (SELECT 1 FROM target_plan) AS plan_found,
+           COALESCE((SELECT payload->>'updated_at' = $3 FROM target_plan), false) AS plan_revision_ok,
+           COALESCE((SELECT jsonb_object_agg(object_id, COALESCE(payload->'project_id', 'null'::jsonb) ORDER BY object_id) FROM member_tasks), '{}'::jsonb) = $7::jsonb
+             AND COALESCE((SELECT jsonb_agg(object_id ORDER BY object_id) FROM member_tasks), '[]'::jsonb) = $8::jsonb AS membership_ok,
+           EXISTS (SELECT 1 FROM existing) AS has_existing
+       ), updated_plan AS (
+         UPDATE ${this.tableName} r SET
+           payload = r.payload || jsonb_build_object('project_id', $9::jsonb, 'updated_at', $10::text),
+           updated_at = $10::timestamptz,
+           version = COALESCE(r.version, 0) + 1,
+           source_machine_id = COALESCE($11, r.source_machine_id)
+         FROM checks
+         WHERE r.service = $1 AND r.object_type = 'plans' AND r.object_id = $2 AND r.deleted_at IS NULL
+           AND checks.plan_found AND checks.plan_revision_ok AND checks.membership_ok AND NOT checks.has_existing
+         RETURNING 1
+       ), updated_tasks AS (
+         UPDATE ${this.tableName} r SET
+           payload = r.payload || jsonb_build_object(
+             'project_id', COALESCE($12::jsonb -> r.object_id, 'null'::jsonb),
+             'updated_at', $10::text,
+             'version', COALESCE((r.payload->>'version')::int, 0) + 1
+           ),
+           updated_at = $10::timestamptz,
+           version = COALESCE(r.version, 0) + 1,
+           source_machine_id = COALESCE($11, r.source_machine_id)
+         WHERE r.service = $1 AND r.object_type = 'tasks' AND r.deleted_at IS NULL
+           AND r.payload->>'plan_id' = $2 AND EXISTS (SELECT 1 FROM updated_plan)
+         RETURNING 1
+       ), task_gate AS (SELECT count(*) AS count FROM updated_tasks), inserted AS (
+         INSERT INTO ${this.tableName}
+           (service, object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version)
+         SELECT $1, 'plan_project_link_rollback_receipts', $5, $6::jsonb, $10::timestamptz, NULL, $11, 1
+         FROM checks, task_gate
+         WHERE NOT checks.has_existing AND EXISTS (SELECT 1 FROM updated_plan)
+         RETURNING payload
+       ) SELECT
+         checks.plan_found,
+         checks.plan_revision_ok,
+         checks.membership_ok,
+         (SELECT payload FROM existing) AS existing_rollback,
+         (SELECT payload FROM inserted) AS inserted_rollback
+       FROM checks`, [
+      this.service,
+      input.plan_id,
+      input.expected_plan_revision,
+      input.receipt_id,
+      input.rollback_receipt_id,
+      jsonbParam(rollback),
+      jsonbParam(currentTaskProjects),
+      jsonbParam(receipt.task_ids),
+      jsonbParam(receipt.prior_plan_project_id),
+      input.restored_at,
+      this.machineId(context),
+      jsonbParam(receipt.prior_task_project_ids)
+    ]);
+    const row = result.rows[0];
+    if (!row?.plan_found)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan not found: ${input.plan_id}`);
+    if (!row.plan_revision_ok)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed during rollback");
+    if (!row.membership_ok)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Plan membership changed during rollback");
+    const accepted = row.existing_rollback ?? row.inserted_rollback;
+    if (!accepted)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Rollback did not produce an immutable receipt");
+    return accepted;
+  }
   async deletePlan(id, context = {}) {
     await this.ensureSchema();
     const timestamp2 = new Date().toISOString();
@@ -15055,11 +15884,17 @@ class PostgresJsonRecordStore {
 }
 async function createTask2(input, store, context) {
   const timestamp2 = new Date().toISOString();
-  const shortId = input.project_id ? await nextTaskShortId2(input.project_id, store, context) : null;
+  const linkedPlan = input.plan_id ? await store.get("plans", input.plan_id) : null;
+  const requestedProjectId = input.project_id ?? context?.projectId ?? null;
+  if (linkedPlan?.project_id && requestedProjectId && requestedProjectId !== linkedPlan.project_id) {
+    throw new ResourceConflictError("PLAN_PROJECT_LINK_CONFLICT", `Task project conflicts with linked plan ${input.plan_id}: expected ${linkedPlan.project_id}`);
+  }
+  const effectiveProjectId = linkedPlan?.project_id ?? requestedProjectId;
+  const shortId = effectiveProjectId ? await nextTaskShortId2(effectiveProjectId, store, context) : null;
   const task = {
     id: randomUUID3(),
     short_id: shortId,
-    project_id: input.project_id ?? context?.projectId ?? null,
+    project_id: effectiveProjectId,
     parent_id: input.parent_id ?? null,
     plan_id: input.plan_id ?? null,
     task_list_id: input.task_list_id ?? context?.taskListId ?? null,
@@ -15113,15 +15948,27 @@ async function createTask2(input, store, context) {
     synced_at: null,
     archived_at: null
   };
-  await store.upsert("tasks", task, context);
-  await logTaskChange2(task.id, "created", "status", null, task.status, task.assigned_by ?? task.agent_id, store, context);
-  return task;
+  const storedTask = await store.upsertTaskWithPlanMembershipGuard(task, task.plan_id ? [task.plan_id] : [], input.project_id !== undefined || context?.projectId !== undefined, context);
+  await logTaskChange2(storedTask.id, "created", "status", null, storedTask.status, storedTask.assigned_by ?? storedTask.agent_id, store, context);
+  return storedTask;
 }
 async function updateTask2(id, input, store) {
   const existing = await requireRecord("tasks", id, store);
   if (existing.version !== input.version) {
     throw new Error(`Task ${id} version conflict: expected ${existing.version}, got ${input.version}`);
   }
+  const effectivePlanId = input.plan_id !== undefined ? input.plan_id : existing.plan_id;
+  const linkedPlan = effectivePlanId ? await store.get("plans", effectivePlanId) : null;
+  if (linkedPlan?.project_id) {
+    const effectiveProjectId = input.project_id !== undefined ? input.project_id : existing.project_id;
+    if (effectiveProjectId !== linkedPlan.project_id) {
+      if (input.project_id === undefined && (input.plan_id !== undefined || existing.project_id === null)) {
+        input = { ...input, project_id: linkedPlan.project_id };
+      } else {
+        throw new ResourceConflictError("PLAN_PROJECT_LINK_CONFLICT", `Task project conflicts with linked plan ${effectivePlanId}: expected ${linkedPlan.project_id}`);
+      }
+    }
+  }
   const reopened = existing.status === "completed" && input.status !== undefined && input.status !== "completed" && input.completed_at === undefined;
   const terminalNow = input.status !== undefined && isTerminalStatus(input.status);
   const task = {
@@ -15137,8 +15984,7 @@ async function updateTask2(id, input, store) {
     created_by: existing.created_by,
     completed_at: reopened ? null : input.completed_at !== undefined ? input.completed_at : existing.completed_at
   };
-  await store.upsert("tasks", task);
-  return task;
+  return store.upsertTaskWithPlanMembershipGuard(task, [existing.plan_id, effectivePlanId].filter((planId) => Boolean(planId)), input.project_id !== undefined);
 }
 async function startTask2(id, agentId, store) {
   const task = await requireRecord("tasks", id, store);
@@ -15202,8 +16048,7 @@ async function patchTask(task, patch, store) {
     version: task.version + 1,
     updated_at: new Date().toISOString()
   };
-  await store.upsert("tasks", updated);
-  return updated;
+  return store.upsertTaskWithPlanMembershipGuard(updated, [task.plan_id, updated.plan_id].filter((planId) => Boolean(planId)), Object.prototype.hasOwnProperty.call(patch, "project_id"));
 }
 var CLOUD_LOCK_EXPIRY_MINUTES = 30;
 function sameCloudLockHolder(stored, incoming) {
@@ -15468,7 +16313,12 @@ async function updatePlan2(id, input, store) {
       excludeId: id
     });
   }
-  return store.upsert("plans", { ...plan, ...patch, updated_at: new Date().toISOString() });
+  return store.updatePlanWithProjectLinkGuard({
+    ...plan,
+    ...patch,
+    project_id: plan.project_id,
+    updated_at: new Date().toISOString()
+  });
 }
 function matchAgentByName(agents, name, options) {
   const target = normalizeAgentNameInput(name);
@@ -16800,7 +17650,7 @@ function isCommentRedactionBackfillComplete(result) {
   return !result.dry_run && result.conflicts === 0 && result.remaining_candidates === 0;
 }
 // src/storage/s3-artifacts.ts
-import { createHash as createHash4, createHmac as createHmac2 } from "crypto";
+import { createHash as createHash5, createHmac as createHmac2 } from "crypto";
 function createTodosS3ArtifactStore(options) {
   const requestFetch = options.fetch ?? fetch;
   const now3 = options.now ?? (() => new Date);
@@ -16972,7 +17822,7 @@ function toAmzDate(date) {
   return date.toISOString().replace(/[:-]|\.\d{3}/g, "");
 }
 function sha256Hex(value) {
-  return createHash4("sha256").update(value).digest("hex");
+  return createHash5("sha256").update(value).digest("hex");
 }
 function hmac(key, value) {
   return createHmac2("sha256", key).update(value).digest();