@hasna/todos 0.15.7 → 0.15.10

package/dist/mcp/index.js

@@ -2038,6 +2038,29 @@ var init_migrations = __esm(() => {
   ${sqliteTodosProjectRegistrationSchemaSql()}
   INSERT OR IGNORE INTO _migrations (id) VALUES (69);
   COMMIT;
+  `,
+    `BEGIN;
+  CREATE TABLE IF NOT EXISTS plan_project_link_receipts (
+    receipt_id TEXT PRIMARY KEY,
+    idempotency_key TEXT NOT NULL UNIQUE,
+    plan_id TEXT NOT NULL,
+    project_id TEXT NOT NULL,
+    payload_hash TEXT NOT NULL,
+    payload TEXT NOT NULL,
+    created_at TEXT NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS idx_plan_project_link_receipts_plan
+    ON plan_project_link_receipts(plan_id, created_at);
+
+  CREATE TABLE IF NOT EXISTS plan_project_link_rollback_receipts (
+    rollback_receipt_id TEXT PRIMARY KEY,
+    accepted_receipt_id TEXT NOT NULL UNIQUE
+      REFERENCES plan_project_link_receipts(receipt_id) ON DELETE RESTRICT,
+    payload TEXT NOT NULL,
+    created_at TEXT NOT NULL
+  );
+  INSERT OR IGNORE INTO _migrations (id) VALUES (70);
+  COMMIT;
   `
   ];
 });
@@ -11646,6 +11669,40 @@ function deleteTaskList(id, db) {
     return d.run("DELETE FROM task_lists WHERE id = ?", [id]).changes > 0;
   })();
 }
+function deleteTaskListIfUnchangedAndUnused(id, expected, db) {
+  const d = db || getDatabase();
+  return d.transaction(() => {
+    const current = getTaskList(id, d);
+    if (!current) {
+      return { status: "not_found", task_dependents: 0, plan_dependents: 0 };
+    }
+    const changed = current.project_id !== expected.project_id || current.slug !== expected.slug || current.name !== expected.name || current.description !== expected.description || current.updated_at !== expected.updated_at || JSON.stringify(current.metadata) !== JSON.stringify(expected.metadata);
+    if (changed) {
+      return { status: "changed", task_dependents: 0, plan_dependents: 0 };
+    }
+    const taskDependents = Number(d.query("SELECT COUNT(*) AS count FROM tasks WHERE task_list_id = ?").get(id).count);
+    const planDependents = Number(d.query("SELECT COUNT(*) AS count FROM plans WHERE task_list_id = ?").get(id).count);
+    if (taskDependents > 0 || planDependents > 0) {
+      return {
+        status: "has_dependents",
+        task_dependents: taskDependents,
+        plan_dependents: planDependents
+      };
+    }
+    recordStorageTombstone({
+      object_type: "task_lists",
+      object_id: id,
+      payload: current
+    }, d);
+    releaseCanonicalSlugClaims("task_list", id, d);
+    const deleted = d.run("DELETE FROM task_lists WHERE id = ?", [id]).changes > 0;
+    return {
+      status: deleted ? "deleted" : "not_found",
+      task_dependents: 0,
+      plan_dependents: 0
+    };
+  })();
+}
 function ensureTaskList(name, slug, projectId, db) {
   const d = db || getDatabase();
   const existing = getTaskListBySlug(slug, projectId, d);
@@ -12365,6 +12422,14 @@ var init_checklists = __esm(() => {
   init_database();
 });
 
+// src/db/plan-row-serialization.ts
+function guardPlanRowsSqlite(planIds, db) {
+  const ids = [...new Set(planIds.filter((id) => Boolean(id)))].sort();
+  for (const id of ids) {
+    db.run("/* todos:sqlite-plan-row-guard */ UPDATE plans SET id = id WHERE id = ?", [id]);
+  }
+}
+
 // src/lib/creator-identity.ts
 import { existsSync as existsSync6, rmSync } from "fs";
 import { join as join5 } from "path";
@@ -13747,9 +13812,23 @@ function sanitizeUpdateTaskInput(input) {
     metadata: input.metadata !== undefined ? sanitizePreWriteValue(input.metadata, "task.metadata") : undefined
   };
 }
-function createTask(input, db) {
-  input = sanitizeCreateTaskInput(input);
-  const d = db || getDatabase();
+function linkedPlanProjectId(planId, db) {
+  if (!planId)
+    return null;
+  const row = db.query("SELECT project_id FROM plans WHERE id = ?").get(planId);
+  return row?.project_id ?? null;
+}
+function resolveCreateProjectForPlan(input, db) {
+  const linkedProjectId = linkedPlanProjectId(input.plan_id, db);
+  if (!linkedProjectId)
+    return input.project_id || null;
+  if (input.project_id !== undefined && input.project_id !== linkedProjectId) {
+    throw new ResourceConflictError("PLAN_PROJECT_LINK_CONFLICT", `Task project conflicts with linked plan ${input.plan_id}: expected ${linkedProjectId}`);
+  }
+  return linkedProjectId;
+}
+function createTaskStored(input, d) {
+  const effectiveProjectId = resolveCreateProjectForPlan(input, d);
   const timestamp2 = now();
   const tags = input.tags || [];
   const machineId = currentStorageMachineId(d);
@@ -13763,7 +13842,7 @@ function createTask(input, db) {
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
         id,
         null,
-        input.project_id || null,
+        effectiveProjectId,
         input.parent_id || null,
         input.plan_id || null,
         input.task_list_id || null,
@@ -13813,7 +13892,15 @@ function createTask(input, db) {
   if (tags.length > 0) {
     insertTaskTags(id, tags, d);
   }
-  const task = getTask(id, d);
+  return getTask(id, d);
+}
+function createTask(input, db) {
+  input = sanitizeCreateTaskInput(input);
+  const d = db || getDatabase();
+  const task = input.plan_id ? d.transaction(() => {
+    guardPlanRowsSqlite([input.plan_id], d);
+    return createTaskStored(input, d);
+  })() : createTaskStored(input, d);
   const payload = taskEventData(task);
   const databasePath = databasePathFromDatabase(d);
   dispatchWebhook2("task.created", payload, d).catch(() => {});
@@ -13913,6 +14000,10 @@ function listTasks(filter = {}, db) {
     conditions.push("(created_by IS NULL OR LOWER(created_by) != LOWER(?))");
     params.push(filter.not_created_by);
   }
+  if (filter.updated_after) {
+    conditions.push("(julianday(updated_at) IS NULL OR julianday(updated_at) > julianday(?))");
+    params.push(filter.updated_after);
+  }
   if (filter.session_id) {
     conditions.push("session_id = ?");
     params.push(filter.session_id);
@@ -14073,6 +14164,10 @@ function countTasks(filter = {}, db) {
     conditions.push("(created_by IS NULL OR LOWER(created_by) != LOWER(?))");
     params.push(filter.not_created_by);
   }
+  if (filter.updated_after) {
+    conditions.push("(julianday(updated_at) IS NULL OR julianday(updated_at) > julianday(?))");
+    params.push(filter.updated_after);
+  }
   if (filter.session_id) {
     conditions.push("session_id = ?");
     params.push(filter.session_id);
@@ -14112,7 +14207,7 @@ function countTasks(filter = {}, db) {
   const row = d.query(`SELECT COUNT(*) as count FROM tasks ${where}`).get(...params);
   return row.count;
 }
-function updateTask(id, input, db) {
+function updateTaskStored(id, input, db) {
   const d = db || getDatabase();
   const task = getTask(id, d);
   if (!task)
@@ -14121,6 +14216,18 @@ function updateTask(id, input, db) {
     throw new VersionConflictError(id, input.version, task.version);
   }
   input = sanitizeUpdateTaskInput(input);
+  const effectivePlanId = input.plan_id !== undefined ? input.plan_id : task.plan_id;
+  const linkedProjectId = linkedPlanProjectId(effectivePlanId, d);
+  if (linkedProjectId) {
+    const effectiveProjectId = input.project_id !== undefined ? input.project_id : task.project_id;
+    if (effectiveProjectId !== linkedProjectId) {
+      if (input.project_id === undefined && (input.plan_id !== undefined || task.project_id === null)) {
+        input = { ...input, project_id: linkedProjectId };
+      } else {
+        throw new ResourceConflictError("PLAN_PROJECT_LINK_CONFLICT", `Task project conflicts with linked plan ${effectivePlanId}: expected ${linkedProjectId}`);
+      }
+    }
+  }
   const timestamp2 = now();
   const completionTimestamp = input.completed_at ?? timestamp2;
   const sets = ["version = version + 1", "updated_at = ?"];
@@ -14328,6 +14435,21 @@ function updateTask(id, input, db) {
   emitSharedTaskEventQuiet({ type: "task.updated", task: updatedTask, databasePath });
   return updatedTask;
 }
+function updateTask(id, input, db) {
+  const d = db || getDatabase();
+  const before = getTask(id, d);
+  if (!before)
+    throw new TaskNotFoundError(id);
+  const guardedPlanIds = [before.plan_id, input.plan_id];
+  if (!guardedPlanIds.some(Boolean))
+    return updateTaskStored(id, input, d);
+  return d.transaction(() => {
+    guardPlanRowsSqlite(guardedPlanIds, d);
+    const current = getTask(id, d);
+    guardPlanRowsSqlite([current?.plan_id, input.plan_id], d);
+    return updateTaskStored(id, input, d);
+  })();
+}
 function deleteTask(id, db) {
   const d = db || getDatabase();
   const row = d.query("SELECT * FROM tasks WHERE id = ?").get(id);
@@ -15134,7 +15256,7 @@ function listPlans(projectId, db) {
   }
   return d.query("SELECT * FROM plans ORDER BY created_at DESC").all();
 }
-function updatePlan(id, input, db) {
+function updatePlanStored(id, input, db) {
   const d = db || getDatabase();
   const plan = getPlan(id, d);
   if (!plan)
@@ -15179,6 +15301,13 @@ function updatePlan(id, input, db) {
   });
   return updated;
 }
+function updatePlan(id, input, db) {
+  const d = db || getDatabase();
+  return d.transaction(() => {
+    guardPlanRowsSqlite([id], d);
+    return updatePlanStored(id, input, d);
+  })();
+}
 function deletePlan(id, db) {
   const d = db || getDatabase();
   const plan = getPlan(id, d);
@@ -20769,12 +20898,16 @@ function protectRemoteClient(client) {
 function remoteAuthorityBase(client) {
   return client.baseUrl.replace(/\/v1\/?$/, "");
 }
-async function requiredRemoteRoute(client, route, request) {
+async function requiredRemoteRoute(client, route, request, recognized404Codes = []) {
   try {
     return await request();
   } catch (error) {
     const status = error && typeof error === "object" ? error.status : undefined;
     if (status === 404) {
+      const body = error && typeof error === "object" ? error.body : undefined;
+      const code = body && typeof body === "object" && !Array.isArray(body) ? body.code : undefined;
+      if (typeof code === "string" && recognized404Codes.includes(code))
+        throw error;
       throw new Error(`REMOTE_API_INCOMPATIBLE: configured Todos authority ${remoteAuthorityBase(client)} does not expose ${route}; ` + "deploy the @hasna/todos /v1 server contract before retrying; local SQLite fallback is disabled", { cause: error });
     }
     throw error;
@@ -35176,7 +35309,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.7",
+    version: "0.15.10",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -35218,6 +35351,10 @@ var init_package = __esm(() => {
       "./project-registration": {
         types: "./dist/project-registration.d.ts",
         import: "./dist/project-registration.js"
+      },
+      "./task-manifest": {
+        types: "./dist/task-manifest.d.ts",
+        import: "./dist/task-manifest.js"
       }
     },
     workspaces: [
@@ -35230,8 +35367,8 @@ var init_package = __esm(() => {
       "README.md"
     ],
     scripts: {
-      build: "rm -rf dist dashboard/dist && cd dashboard && bun install --frozen-lockfile && bun run build && cd .. && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && tsc --emitDeclarationOnly --outDir dist",
-      "build:server": "rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*'",
+      build: "rm -rf dist dashboard/dist && cd dashboard && bun install --frozen-lockfile && bun run build && cd .. && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts src/task-manifest.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && tsc --emitDeclarationOnly --outDir dist",
+      "build:server": "rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts src/task-manifest.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*'",
       migrate: "bun run src/server/index.ts migrate",
       "backfill:comment-redaction": "bun run src/server/index.ts redact-comments",
       "generate:sdk": "bun run scripts/generate-sdk.ts",
@@ -44552,6 +44689,243 @@ var init_cloud_client = __esm(() => {
   init_config();
 });
 
+// src/lib/plan-project-link-contract.ts
+import { createHash as createHash13 } from "crypto";
+function canonicalPlanProjectLinkJson(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map(canonicalPlanProjectLinkJson).join(",")}]`;
+  return `{${Object.entries(value).filter(([, item]) => item !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonicalPlanProjectLinkJson(item)}`).join(",")}}`;
+}
+function planProjectLinkDigest(value) {
+  return createHash13("sha256").update(canonicalPlanProjectLinkJson(value)).digest("hex");
+}
+function normalizePlanProjectLinkIdempotencyKey(value) {
+  const key = value?.trim() ?? "";
+  if (key.length < 8 || key.length > 128 || !/^[A-Za-z0-9._:-]+$/.test(key)) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_KEY_INVALID", "idempotency_key must be 8-128 ASCII letters, digits, dots, underscores, colons, or hyphens");
+  }
+  return key;
+}
+function planProjectLinkReceiptId(idempotencyKey) {
+  return `pplr_${planProjectLinkDigest({ idempotency_key: idempotencyKey }).slice(0, 48)}`;
+}
+function planProjectLinkRollbackReceiptId(receiptId) {
+  return `pplr_inverse_${planProjectLinkDigest({ accepted_receipt_id: receiptId }).slice(0, 38)}`;
+}
+function planProjectLinkRequestHash(planId, projectId) {
+  return planProjectLinkDigest({ plan_id: planId, project_id: projectId });
+}
+function planProjectLinkResultDigest(plan, tasks) {
+  return planProjectLinkDigest({
+    plan_id: plan.id,
+    plan_project_id: plan.project_id,
+    tasks: tasks.map((task2) => ({ id: task2.id, plan_id: task2.plan_id, project_id: task2.project_id })).sort((left, right) => left.id.localeCompare(right.id))
+  });
+}
+function assertPlanProjectLinkReceipt(value) {
+  const receipt = value;
+  if (!receipt || typeof receipt !== "object" || receipt.schema_version !== PLAN_PROJECT_LINK_SCHEMA_VERSION || typeof receipt.receipt_id !== "string" || typeof receipt.idempotency_key !== "string" || typeof receipt.plan_id !== "string" || typeof receipt.project_id !== "string" || !Array.isArray(receipt.task_ids) || receipt.task_ids.some((id) => typeof id !== "string") || !receipt.prior_task_project_ids || typeof receipt.prior_task_project_ids !== "object" || typeof receipt.result_digest !== "string") {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND", "Stored plan-project-link receipt is invalid");
+  }
+  return receipt;
+}
+var PLAN_PROJECT_LINK_SCHEMA_VERSION = "todos.plan-project-link.v1", PlanProjectLinkError;
+var init_plan_project_link_contract = __esm(() => {
+  PlanProjectLinkError = class PlanProjectLinkError extends Error {
+    code;
+    details;
+    constructor(code, message, details = {}) {
+      super(message);
+      this.code = code;
+      this.details = details;
+      this.name = "PlanProjectLinkError";
+    }
+  };
+});
+
+// src/db/plan-project-links.ts
+function getPlanProjectLinkReceipt(receiptId, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT payload FROM plan_project_link_receipts WHERE receipt_id = ?").get(receiptId);
+  return row ? assertPlanProjectLinkReceipt(JSON.parse(row.payload)) : null;
+}
+function getPlanProjectLinkReceiptByIdempotencyKey(idempotencyKey, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT payload FROM plan_project_link_receipts WHERE idempotency_key = ?").get(idempotencyKey);
+  return row ? assertPlanProjectLinkReceipt(JSON.parse(row.payload)) : null;
+}
+function exactTasks(planId, db) {
+  return listTasks({ plan_id: planId, include_subtasks: true, include_archived: true }, db).sort((left, right) => left.id.localeCompare(right.id));
+}
+function currentResult(planId, projectId, receipt, db, action) {
+  const plan = getPlan(planId, db);
+  const project = getProject(projectId, db);
+  if (!plan || !project) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "An accepted plan-project-link target no longer resolves", { plan_id: planId, project_id: projectId, receipt_id: receipt.receipt_id });
+  }
+  const tasks = exactTasks(planId, db);
+  if (planProjectLinkResultDigest(plan, tasks) !== receipt.result_digest) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "The accepted plan-project-link result has drifted", { plan_id: planId, project_id: projectId, receipt_id: receipt.receipt_id });
+  }
+  return { mode: "apply", action, plan, project, tasks, receipt };
+}
+function applyPlanProjectLinkSqlite(input, db) {
+  const d = db || getDatabase();
+  const mutate = d.transaction(() => {
+    guardPlanRowsSqlite([input.plan_id], d);
+    const requestHash = planProjectLinkRequestHash(input.plan_id, input.project_id);
+    const existingRow = d.query("SELECT payload_hash, payload FROM plan_project_link_receipts WHERE idempotency_key = ?").get(input.idempotency_key);
+    if (existingRow) {
+      if (existingRow.payload_hash !== requestHash) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The idempotency key was already accepted for a different plan-project link", { idempotency_key: input.idempotency_key });
+      }
+      const rolledBack = d.query("SELECT rollback_receipt_id FROM plan_project_link_rollback_receipts WHERE accepted_receipt_id = ?").get(input.receipt_id);
+      if (rolledBack) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The accepted plan-project link has already been rolled back", { receipt_id: input.receipt_id });
+      }
+      return currentResult(input.plan_id, input.project_id, assertPlanProjectLinkReceipt(JSON.parse(existingRow.payload)), d, "already_linked");
+    }
+    const plan = getPlan(input.plan_id, d);
+    if (!plan) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan not found: ${input.plan_id}`);
+    }
+    const project = getProject(input.project_id, d);
+    if (!project) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_NOT_FOUND", `Project not found: ${input.project_id}`);
+    }
+    if (plan.updated_at !== input.expected_plan_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed after the link plan; fetch a fresh plan before applying", { expected_plan_revision: input.expected_plan_revision, current_plan_revision: plan.updated_at });
+    }
+    if (project.updated_at !== input.expected_project_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_REVISION_CONFLICT", "Destination project changed after the link plan; fetch a fresh plan before applying", { expected_project_revision: input.expected_project_revision, current_project_revision: project.updated_at });
+    }
+    if (plan.slug) {
+      const collision = d.query("SELECT id FROM plans WHERE project_id = ? AND slug = ? AND id <> ? LIMIT 1").get(project.id, plan.slug, plan.id);
+      if (collision) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_SCOPE_COLLISION", "Another plan already owns this slug in the destination project", { conflicting_plan_id: collision.id, slug: plan.slug });
+      }
+    }
+    const beforeTasks = exactTasks(plan.id, d);
+    const alreadyLinked = plan.project_id === project.id && beforeTasks.every((task2) => task2.project_id === project.id);
+    const priorTaskProjectIds = Object.fromEntries(beforeTasks.map((task2) => [task2.id, task2.project_id]));
+    const timestamp4 = input.created_at;
+    if (plan.project_id !== project.id) {
+      d.run("UPDATE plans SET project_id = ?, updated_at = ? WHERE id = ? AND updated_at = ?", [
+        project.id,
+        timestamp4,
+        plan.id,
+        input.expected_plan_revision
+      ]);
+    }
+    for (const task2 of beforeTasks) {
+      if (task2.project_id === project.id)
+        continue;
+      d.run("UPDATE tasks SET project_id = ?, updated_at = ?, version = version + 1 WHERE id = ? AND plan_id = ?", [project.id, timestamp4, task2.id, plan.id]);
+    }
+    const linkedPlan = getPlan(plan.id, d);
+    const linkedTasks = exactTasks(plan.id, d);
+    if (linkedPlan.project_id !== project.id || linkedTasks.length !== beforeTasks.length || linkedTasks.some((task2) => task2.project_id !== project.id)) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "Atomic plan-project link readback did not preserve the exact plan membership", { plan_id: plan.id, project_id: project.id });
+    }
+    const receipt = {
+      schema_version: PLAN_PROJECT_LINK_SCHEMA_VERSION,
+      receipt_id: input.receipt_id,
+      idempotency_key: input.idempotency_key,
+      plan_id: plan.id,
+      project_id: project.id,
+      prior_plan_project_id: plan.project_id,
+      prior_task_project_ids: priorTaskProjectIds,
+      task_ids: beforeTasks.map((task2) => task2.id),
+      task_count: beforeTasks.length,
+      result_plan_revision: linkedPlan.updated_at,
+      result_digest: planProjectLinkResultDigest(linkedPlan, linkedTasks),
+      rollback_supported: true,
+      created_at: input.created_at
+    };
+    d.run(`INSERT INTO plan_project_link_receipts
+       (receipt_id, idempotency_key, plan_id, project_id, payload_hash, payload, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`, [
+      receipt.receipt_id,
+      receipt.idempotency_key,
+      receipt.plan_id,
+      receipt.project_id,
+      requestHash,
+      JSON.stringify(receipt),
+      receipt.created_at
+    ]);
+    return {
+      mode: "apply",
+      action: alreadyLinked ? "already_linked" : "linked",
+      plan: linkedPlan,
+      project,
+      tasks: linkedTasks,
+      receipt
+    };
+  });
+  return mutate();
+}
+function rollbackPlanProjectLinkSqlite(input, db) {
+  const d = db || getDatabase();
+  return d.transaction(() => {
+    guardPlanRowsSqlite([input.plan_id], d);
+    const priorRollback = d.query("SELECT payload FROM plan_project_link_rollback_receipts WHERE accepted_receipt_id = ?").get(input.receipt_id);
+    if (priorRollback)
+      return JSON.parse(priorRollback.payload);
+    const receipt = getPlanProjectLinkReceipt(input.receipt_id, d);
+    if (!receipt || receipt.plan_id !== input.plan_id || receipt.project_id !== input.project_id) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND", "No exact plan-project-link receipt matches this rollback request", { receipt_id: input.receipt_id, plan_id: input.plan_id, project_id: input.project_id });
+    }
+    const plan = getPlan(input.plan_id, d);
+    if (!plan || plan.updated_at !== input.expected_plan_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed after the accepted link; fetch an exact readback before rollback", { expected_plan_revision: input.expected_plan_revision, current_plan_revision: plan?.updated_at ?? null });
+    }
+    const tasks = exactTasks(plan.id, d);
+    if (planProjectLinkResultDigest(plan, tasks) !== receipt.result_digest || tasks.length !== receipt.task_ids.length || tasks.some((task2, index) => task2.id !== receipt.task_ids[index])) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Plan membership or project linkage drifted; refusing conditional rollback", { receipt_id: receipt.receipt_id });
+    }
+    d.run("UPDATE plans SET project_id = ?, updated_at = ? WHERE id = ? AND updated_at = ?", [
+      receipt.prior_plan_project_id,
+      input.restored_at,
+      plan.id,
+      input.expected_plan_revision
+    ]);
+    for (const task2 of tasks) {
+      const priorProjectId = receipt.prior_task_project_ids[task2.id];
+      if (priorProjectId === undefined && !(task2.id in receipt.prior_task_project_ids)) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Receipt does not contain the exact prior project for every member task", { task_id: task2.id, receipt_id: receipt.receipt_id });
+      }
+      d.run("UPDATE tasks SET project_id = ?, updated_at = ?, version = version + 1 WHERE id = ? AND plan_id = ?", [priorProjectId, input.restored_at, task2.id, plan.id]);
+    }
+    const restoredPlan = getPlan(plan.id, d);
+    const restoredTasks = exactTasks(plan.id, d);
+    if (restoredPlan.project_id !== receipt.prior_plan_project_id || restoredTasks.some((task2) => task2.project_id !== receipt.prior_task_project_ids[task2.id])) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Rollback readback did not restore every exact prior project id", { receipt_id: receipt.receipt_id });
+    }
+    const result = {
+      schema_version: PLAN_PROJECT_LINK_SCHEMA_VERSION,
+      action: "restored",
+      plan: restoredPlan,
+      tasks: restoredTasks,
+      accepted_receipt_id: receipt.receipt_id,
+      rollback_receipt_id: input.rollback_receipt_id,
+      restored_at: input.restored_at
+    };
+    d.run(`INSERT INTO plan_project_link_rollback_receipts
+       (rollback_receipt_id, accepted_receipt_id, payload, created_at)
+       VALUES (?, ?, ?, ?)`, [result.rollback_receipt_id, result.accepted_receipt_id, JSON.stringify(result), result.restored_at]);
+    return result;
+  })();
+}
+var init_plan_project_links = __esm(() => {
+  init_plan_project_link_contract();
+  init_database();
+  init_plans();
+  init_projects();
+  init_tasks();
+});
+
 // src/storage/sqlite-snapshot.ts
 function exportSqliteTodosStorageSnapshot(db) {
   const d = db ?? getDatabase();
@@ -45058,6 +45432,12 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       update: (id, input) => updatePlan(id, input, database()),
       delete: (id) => deletePlan(id, database())
     },
+    planProjectLinks: {
+      apply: (input) => applyPlanProjectLinkSqlite(input, database()),
+      rollback: (input) => rollbackPlanProjectLinkSqlite(input, database()),
+      getReceipt: (receiptId) => getPlanProjectLinkReceipt(receiptId, database()),
+      getReceiptByIdempotencyKey: (key) => getPlanProjectLinkReceiptByIdempotencyKey(key, database())
+    },
     agents: {
       register: (input) => registerAgent(input, database()),
       get: (id) => getAgent(id, database()),
@@ -45071,7 +45451,8 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       getBySlug: (slug, projectId) => getTaskListBySlug(slug, projectId, database()),
       list: (projectId) => listTaskLists(projectId, database()),
       update: (id, input) => updateTaskList(id, input, database()),
-      delete: (id) => deleteTaskList(id, database())
+      delete: (id) => deleteTaskList(id, database()),
+      deleteIfUnchangedAndUnused: (id, expected) => deleteTaskListIfUnchangedAndUnused(id, expected, database())
     },
     templates: {
       create: (input) => createTemplate(input, database()),
@@ -45131,6 +45512,7 @@ var init_local_sqlite = __esm(() => {
   init_comments();
   init_database();
   init_integrity2();
+  init_plan_project_links();
   init_sqlite_snapshot();
   TASK_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 });
@@ -45161,6 +45543,21 @@ function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABL
       RETURNS text
       LANGUAGE sql IMMUTABLE PARALLEL SAFE STRICT
       AS $$ SELECT unaccent('unaccent', $1) $$`,
+    `CREATE OR REPLACE FUNCTION todos_try_timestamptz(text)
+      RETURNS timestamptz
+      LANGUAGE plpgsql IMMUTABLE PARALLEL SAFE
+      SET DateStyle TO 'ISO, YMD'
+      AS $$
+      BEGIN
+        RETURN CASE
+          WHEN $1 ~ '(Z|[+-][0-9]{2}:?[0-9]{2})$' THEN $1::timestamptz
+          ELSE ($1::timestamp AT TIME ZONE 'UTC')
+        END;
+      EXCEPTION WHEN others THEN RETURN NULL; END $$`,
+    `DROP INDEX IF EXISTS ${tableName}_task_updated_at_idx`,
+    `CREATE INDEX IF NOT EXISTS ${tableName}_task_updated_at_utc_idx
+      ON ${tableName} (todos_try_timestamptz(payload->>'updated_at'))
+      WHERE object_type = 'tasks' AND deleted_at IS NULL`,
     `ALTER TABLE ${tableName}
       ADD COLUMN IF NOT EXISTS task_search_tsv tsvector
       GENERATED ALWAYS AS (
@@ -45880,7 +46277,7 @@ var init_shadow_runtime = __esm(() => {
 });
 
 // src/db/api-keys.ts
-import { createHash as createHash13, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHash as createHash14, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual3 } from "crypto";
 function rowToRecord(row) {
   return {
     id: row.id,
@@ -45894,7 +46291,7 @@ function rowToRecord(row) {
   };
 }
 function hashApiKey(key) {
-  return createHash13("sha256").update(key).digest("hex");
+  return createHash14("sha256").update(key).digest("hex");
 }
 function safeEqualHex(a, b) {
   if (a.length !== b.length)
@@ -45902,8 +46299,8 @@ function safeEqualHex(a, b) {
   return timingSafeEqual3(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
 }
 function safeEqualStrings(a, b) {
-  const ah = createHash13("sha256").update(a, "utf8").digest();
-  const bh = createHash13("sha256").update(b, "utf8").digest();
+  const ah = createHash14("sha256").update(a, "utf8").digest();
+  const bh = createHash14("sha256").update(b, "utf8").digest();
   return timingSafeEqual3(ah, bh);
 }
 function hasActiveApiKeys(db) {
@@ -45995,6 +46392,12 @@ function createPostgresTodosStorageAdapter(options) {
       update: (id, input) => updatePlan2(id, input, store),
       delete: (id, context) => store.deletePlan(id, context)
     },
+    planProjectLinks: {
+      apply: (input, context) => store.applyPlanProjectLink(input, context),
+      rollback: (input, context) => store.rollbackPlanProjectLink(input, context),
+      getReceipt: (receiptId) => store.getPlanProjectLinkReceipt(receiptId),
+      getReceiptByIdempotencyKey: (key) => store.getPlanProjectLinkReceiptByIdempotencyKey(key)
+    },
     agents: {
       register: (input, context) => registerAgent2(input, store, context),
       get: (id) => store.get("agents", id),
@@ -46177,6 +46580,9 @@ class PostgresJsonRecordStore {
       conds.push(`LOWER(payload->>'created_by') = LOWER(${p(filter.created_by)})`);
     if (filter.not_created_by !== undefined)
       conds.push(`(payload->>'created_by' IS NULL OR LOWER(payload->>'created_by') <> LOWER(${p(filter.not_created_by)}))`);
+    if (filter.updated_after !== undefined) {
+      conds.push(`(todos_try_timestamptz(payload->>'updated_at') IS NULL ` + `OR todos_try_timestamptz(payload->>'updated_at') > ${p(filter.updated_after)}::timestamptz)`);
+    }
     if (filter.session_id !== undefined)
       conds.push(`payload->>'session_id' = ${p(filter.session_id)}`);
     if (filter.tags?.length) {
@@ -46361,6 +46767,115 @@ class PostgresJsonRecordStore {
     }
     return value;
   }
+  async upsertTaskWithPlanMembershipGuard(value, guardedPlanIds, explicitProject, context = {}) {
+    const planIds = [...new Set(guardedPlanIds.filter(Boolean))].sort();
+    if (planIds.length === 0)
+      return this.upsert("tasks", value, context);
+    await this.ensureSchema();
+    const updatedAt = value.updated_at;
+    const targetPlanId = value.plan_id;
+    const result = await this.options.client.query(`/* todos:task-plan-membership-guard */ WITH
+       locked_plans AS MATERIALIZED (
+         SELECT object_id, payload FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'plans' AND deleted_at IS NULL
+           AND object_id IN (SELECT value FROM jsonb_array_elements_text($7::jsonb))
+         ORDER BY object_id
+         FOR UPDATE
+       ), validation AS (
+         SELECT
+           (SELECT count(*) FROM locked_plans) = jsonb_array_length($7::jsonb) AS all_plans_found,
+           ($8::text IS NULL OR EXISTS (SELECT 1 FROM locked_plans WHERE object_id = $8)) AS target_plan_found,
+           (SELECT payload->>'project_id' FROM locked_plans WHERE object_id = $8) AS target_project_id
+       ), guarded AS (
+         SELECT
+           validation.*,
+           ($9::boolean AND validation.target_project_id IS NOT NULL
+             AND ($3::jsonb->>'project_id') IS DISTINCT FROM validation.target_project_id) AS project_conflict,
+           CASE
+             WHEN validation.target_project_id IS NULL THEN $3::jsonb
+             ELSE jsonb_set($3::jsonb, '{project_id}', to_jsonb(validation.target_project_id), true)
+           END AS payload
+         FROM validation
+       ), stored AS (
+         INSERT INTO ${this.tableName} (
+           service, object_type, object_id, payload, updated_at,
+           deleted_at, source_machine_id, version
+         )
+         SELECT $1, 'tasks', $2, guarded.payload, $4::timestamptz, NULL, $5, $6
+         FROM guarded
+         WHERE guarded.all_plans_found AND guarded.target_plan_found AND NOT guarded.project_conflict
+         ON CONFLICT (service, object_type, object_id) DO UPDATE SET
+           payload = EXCLUDED.payload,
+           updated_at = EXCLUDED.updated_at,
+           deleted_at = NULL,
+           source_machine_id = EXCLUDED.source_machine_id,
+           version = EXCLUDED.version
+         WHERE ${this.tableName}.updated_at IS NULL
+            OR ${this.tableName}.updated_at < EXCLUDED.updated_at
+            OR (${this.tableName}.updated_at = EXCLUDED.updated_at
+                AND COALESCE(${this.tableName}.version, 0) <= COALESCE(EXCLUDED.version, 0))
+         RETURNING payload
+       )
+       SELECT guarded.all_plans_found, guarded.target_plan_found, guarded.project_conflict,
+              (SELECT payload FROM stored) AS payload
+       FROM guarded`, [
+      this.service,
+      value.id,
+      jsonbParam(value),
+      updatedAt,
+      context.requestId ?? this.sourceMachineId ?? null,
+      numberValue3(value.version),
+      jsonbParam(planIds),
+      targetPlanId,
+      explicitProject
+    ]);
+    const row = result.rows[0];
+    if (!row?.all_plans_found || !row.target_plan_found) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan membership changed through a missing plan: ${targetPlanId ?? planIds.join(", ")}`, { plan_ids: planIds, target_plan_id: targetPlanId });
+    }
+    if (row.project_conflict) {
+      throw new ResourceConflictError("PLAN_PROJECT_LINK_CONFLICT", `Task project conflicts with linked plan ${targetPlanId}`);
+    }
+    if (!row.payload) {
+      return await requireRecord("tasks", value.id, this);
+    }
+    return payloadRecord2(row.payload);
+  }
+  async updatePlanWithProjectLinkGuard(value, context = {}) {
+    await this.ensureSchema();
+    const result = await this.options.client.query(`/* todos:plan-update-project-link-guard */ WITH locked_plan AS MATERIALIZED (
+         SELECT payload FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'plans' AND object_id = $2 AND deleted_at IS NULL
+         FOR UPDATE
+       ), stored AS (
+         UPDATE ${this.tableName} r SET
+           payload = jsonb_set(
+             $3::jsonb,
+             '{project_id}',
+             COALESCE((SELECT payload->'project_id' FROM locked_plan), 'null'::jsonb),
+             true
+           ),
+           updated_at = $4::timestamptz,
+           deleted_at = NULL,
+           source_machine_id = COALESCE($5, r.source_machine_id),
+           version = COALESCE(r.version, 0) + 1
+         FROM locked_plan
+         WHERE r.service = $1 AND r.object_type = 'plans' AND r.object_id = $2 AND r.deleted_at IS NULL
+         RETURNING r.payload
+       )
+       SELECT EXISTS (SELECT 1 FROM locked_plan) AS plan_found,
+              (SELECT payload FROM stored) AS payload`, [
+      this.service,
+      value.id,
+      jsonbParam(value),
+      value.updated_at,
+      context.requestId ?? this.sourceMachineId ?? null
+    ]);
+    const row = result.rows[0];
+    if (!row?.plan_found || !row.payload)
+      throw new PlanNotFoundError(value.id);
+    return payloadRecord2(row.payload);
+  }
   async createTemplateWithTasks(template, tasks, context = {}) {
     await this.ensureSchema();
     const records = [
@@ -46599,6 +47114,333 @@ class PostgresJsonRecordStore {
       version: numberValue3(existing["version"])
     }, context);
   }
+  async getPlanProjectLinkReceipt(receiptId) {
+    const value = await this.get("plan_project_link_receipts", receiptId);
+    return value ? assertPlanProjectLinkReceipt(value) : null;
+  }
+  async getPlanProjectLinkReceiptByIdempotencyKey(idempotencyKey) {
+    await this.ensureSchema();
+    const result = await this.options.client.query(`/* todos:plan-project-link-receipt-by-key */ SELECT payload FROM ${this.tableName}
+       WHERE service = $1 AND object_type = 'plan_project_link_receipts' AND deleted_at IS NULL
+         AND payload->>'idempotency_key' = $2
+       LIMIT 2`, [this.service, idempotencyKey]);
+    if (result.rows.length > 1) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "More than one immutable receipt carries this idempotency key", { idempotency_key: idempotencyKey });
+    }
+    return result.rows[0] ? assertPlanProjectLinkReceipt(result.rows[0].payload) : null;
+  }
+  async currentPlanProjectLinkResult(receipt, action) {
+    const [plan, project, tasks] = await Promise.all([
+      this.get("plans", receipt.plan_id),
+      this.get("projects", receipt.project_id),
+      this.listTasks({ plan_id: receipt.plan_id, include_subtasks: true })
+    ]);
+    const sortedTasks3 = tasks.sort((left, right) => left.id.localeCompare(right.id));
+    if (!plan || !project || planProjectLinkResultDigest(plan, sortedTasks3) !== receipt.result_digest) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "The accepted plan-project-link result has drifted", { receipt_id: receipt.receipt_id });
+    }
+    return { mode: "apply", action, plan, project, tasks: sortedTasks3, receipt };
+  }
+  async applyPlanProjectLink(input, context = {}) {
+    await this.ensureSchema();
+    const existing = await this.getPlanProjectLinkReceipt(input.receipt_id);
+    if (existing) {
+      if (existing.plan_id !== input.plan_id || existing.project_id !== input.project_id) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The idempotency key was already accepted for a different plan-project link", { idempotency_key: input.idempotency_key, receipt_id: existing.receipt_id });
+      }
+      const rolledBack = await this.get("plan_project_link_rollback_receipts", planProjectLinkRollbackReceiptId(input.receipt_id));
+      if (rolledBack) {
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The accepted plan-project link has already been rolled back", { receipt_id: input.receipt_id });
+      }
+      return this.currentPlanProjectLinkResult(existing, "already_linked");
+    }
+    const [plan, project, tasks, scopedPlans] = await Promise.all([
+      this.get("plans", input.plan_id),
+      this.get("projects", input.project_id),
+      this.listTasks({ plan_id: input.plan_id, include_subtasks: true }),
+      this.list("plans")
+    ]);
+    if (!plan)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan not found: ${input.plan_id}`);
+    if (!project)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_NOT_FOUND", `Project not found: ${input.project_id}`);
+    if (plan.updated_at !== input.expected_plan_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed after the link plan; fetch a fresh plan before applying", { expected_plan_revision: input.expected_plan_revision, current_plan_revision: plan.updated_at });
+    }
+    if (project.updated_at !== input.expected_project_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_REVISION_CONFLICT", "Destination project changed after the link plan; fetch a fresh plan before applying", { expected_project_revision: input.expected_project_revision, current_project_revision: project.updated_at });
+    }
+    const collision = scopedPlans.find((candidate) => candidate.id !== plan.id && candidate.project_id === project.id && candidate.slug !== null && candidate.slug === plan.slug);
+    if (collision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_SCOPE_COLLISION", "Another plan already owns this slug in the destination project", { conflicting_plan_id: collision.id, slug: plan.slug });
+    }
+    const sortedTasks3 = tasks.sort((left, right) => left.id.localeCompare(right.id));
+    const priorTaskProjectIds = Object.fromEntries(sortedTasks3.map((task2) => [task2.id, task2.project_id]));
+    const projectedPlan = { ...plan, project_id: project.id, updated_at: input.created_at };
+    const projectedTasks = sortedTasks3.map((task2) => task2.project_id === project.id ? task2 : { ...task2, project_id: project.id, updated_at: input.created_at, version: task2.version + 1 });
+    const alreadyLinked = plan.project_id === project.id && sortedTasks3.every((task2) => task2.project_id === project.id);
+    const receipt = {
+      schema_version: PLAN_PROJECT_LINK_SCHEMA_VERSION,
+      receipt_id: input.receipt_id,
+      idempotency_key: input.idempotency_key,
+      plan_id: plan.id,
+      project_id: project.id,
+      prior_plan_project_id: plan.project_id,
+      prior_task_project_ids: priorTaskProjectIds,
+      task_ids: sortedTasks3.map((task2) => task2.id),
+      task_count: sortedTasks3.length,
+      result_plan_revision: projectedPlan.updated_at,
+      result_digest: planProjectLinkResultDigest(projectedPlan, projectedTasks),
+      rollback_supported: true,
+      created_at: input.created_at
+    };
+    let mutation;
+    try {
+      mutation = await this.options.client.query(`/* todos:plan-project-link-atomic */ WITH
+         target_plan AS MATERIALIZED (
+           SELECT payload FROM ${this.tableName}
+           WHERE service = $1 AND object_type = 'plans' AND object_id = $2 AND deleted_at IS NULL
+           FOR UPDATE
+         ), target_project AS (
+           SELECT payload FROM ${this.tableName}
+           WHERE service = $1 AND object_type = 'projects' AND object_id = $3 AND deleted_at IS NULL
+           FOR UPDATE
+         ), member_tasks AS MATERIALIZED (
+           SELECT object_id, payload FROM ${this.tableName}
+           WHERE service = $1 AND object_type = 'tasks' AND deleted_at IS NULL
+             AND payload->>'plan_id' = $2
+             AND EXISTS (SELECT 1 FROM target_plan)
+           FOR UPDATE
+         ), existing AS (
+           SELECT payload FROM ${this.tableName}
+           WHERE service = $1 AND object_type = 'plan_project_link_receipts'
+             AND object_id = $6 AND deleted_at IS NULL
+           FOR UPDATE
+         ), collision AS (
+           SELECT 1 FROM ${this.tableName} r, target_plan p
+           WHERE r.service = $1 AND r.object_type = 'plans' AND r.deleted_at IS NULL
+             AND r.object_id <> $2 AND r.payload->>'project_id' = $3
+             AND r.payload->>'slug' IS NOT DISTINCT FROM p.payload->>'slug'
+             AND p.payload->>'slug' IS NOT NULL
+           LIMIT 1
+         ), checks AS (
+           SELECT
+             EXISTS (SELECT 1 FROM target_plan) AS plan_found,
+             EXISTS (SELECT 1 FROM target_project) AS project_found,
+             COALESCE((SELECT payload->>'updated_at' = $4 FROM target_plan), false) AS plan_revision_ok,
+             COALESCE((SELECT payload->>'updated_at' = $5 FROM target_project), false) AS project_revision_ok,
+             COALESCE((SELECT jsonb_object_agg(object_id, COALESCE(payload->'project_id', 'null'::jsonb) ORDER BY object_id) FROM member_tasks), '{}'::jsonb) = $8::jsonb
+               AND COALESCE((SELECT jsonb_agg(object_id ORDER BY object_id) FROM member_tasks), '[]'::jsonb) = $9::jsonb AS membership_ok,
+             EXISTS (SELECT 1 FROM collision) AS collision,
+             EXISTS (SELECT 1 FROM existing) AS has_existing
+         ), updated_plan AS (
+           UPDATE ${this.tableName} r SET
+             payload = r.payload || jsonb_build_object('project_id', $3::text, 'updated_at', $10::text),
+             updated_at = $10::timestamptz,
+             version = COALESCE(r.version, 0) + 1,
+             source_machine_id = COALESCE($11, r.source_machine_id)
+           FROM checks
+           WHERE r.service = $1 AND r.object_type = 'plans' AND r.object_id = $2 AND r.deleted_at IS NULL
+             AND checks.plan_found AND checks.project_found AND checks.plan_revision_ok
+             AND checks.project_revision_ok AND checks.membership_ok AND NOT checks.collision AND NOT checks.has_existing
+           RETURNING r.payload
+         ), updated_tasks AS (
+           UPDATE ${this.tableName} r SET
+             payload = r.payload || jsonb_build_object(
+               'project_id', $3::text,
+               'updated_at', $10::text,
+               'version', COALESCE((r.payload->>'version')::int, 0) + 1
+             ),
+             updated_at = $10::timestamptz,
+             version = COALESCE(r.version, 0) + 1,
+             source_machine_id = COALESCE($11, r.source_machine_id)
+           WHERE r.service = $1 AND r.object_type = 'tasks' AND r.deleted_at IS NULL
+             AND r.payload->>'plan_id' = $2
+             AND r.payload->>'project_id' IS DISTINCT FROM $3
+             AND EXISTS (SELECT 1 FROM updated_plan)
+           RETURNING 1
+         ), task_gate AS (
+           SELECT count(*) AS count FROM updated_tasks
+         ), inserted AS (
+           INSERT INTO ${this.tableName}
+             (service, object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version)
+           SELECT $1, 'plan_project_link_receipts', $6, $7::jsonb, $10::timestamptz, NULL, $11, 1
+           FROM checks, task_gate
+           WHERE NOT checks.has_existing AND EXISTS (SELECT 1 FROM updated_plan)
+           RETURNING payload
+         ) SELECT
+           checks.plan_found,
+           checks.project_found,
+           checks.plan_revision_ok,
+           checks.project_revision_ok,
+           checks.membership_ok,
+           checks.collision,
+           (SELECT payload FROM existing) AS existing_receipt,
+           (SELECT payload FROM inserted) AS inserted_receipt
+         FROM checks`, [
+        this.service,
+        plan.id,
+        project.id,
+        input.expected_plan_revision,
+        input.expected_project_revision,
+        receipt.receipt_id,
+        jsonbParam(receipt),
+        jsonbParam(priorTaskProjectIds),
+        jsonbParam(receipt.task_ids),
+        input.created_at,
+        this.machineId(context)
+      ]);
+    } catch (error) {
+      if (isPostgresUniqueViolation(error)) {
+        const raced = await this.getPlanProjectLinkReceipt(input.receipt_id);
+        if (raced && raced.plan_id === input.plan_id && raced.project_id === input.project_id) {
+          return this.currentPlanProjectLinkResult(raced, "already_linked");
+        }
+        throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The idempotency key raced with a different plan-project link", { idempotency_key: input.idempotency_key });
+      }
+      throw error;
+    }
+    const row = mutation.rows[0];
+    if (!row?.plan_found)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan not found: ${plan.id}`);
+    if (!row.project_found)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_NOT_FOUND", `Project not found: ${project.id}`);
+    if (!row.plan_revision_ok)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed during the atomic link");
+    if (!row.project_revision_ok)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_REVISION_CONFLICT", "Project changed during the atomic link");
+    if (!row.membership_ok)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RESULT_DRIFT", "Plan membership changed during the atomic link");
+    if (row.collision)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_SCOPE_COLLISION", "Another plan owns this slug in the destination project");
+    const accepted = assertPlanProjectLinkReceipt(row.existing_receipt ?? row.inserted_receipt);
+    if (accepted.plan_id !== plan.id || accepted.project_id !== project.id) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT", "The idempotency key was accepted for a different target");
+    }
+    return this.currentPlanProjectLinkResult(accepted, alreadyLinked ? "already_linked" : "linked");
+  }
+  async rollbackPlanProjectLink(input, context = {}) {
+    await this.ensureSchema();
+    const existingRollback = await this.get("plan_project_link_rollback_receipts", input.rollback_receipt_id);
+    if (existingRollback)
+      return existingRollback;
+    const receipt = await this.getPlanProjectLinkReceipt(input.receipt_id);
+    if (!receipt || receipt.plan_id !== input.plan_id || receipt.project_id !== input.project_id) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND", "No exact plan-project-link receipt matches this rollback request", { receipt_id: input.receipt_id });
+    }
+    const [plan, tasks] = await Promise.all([
+      this.get("plans", input.plan_id),
+      this.listTasks({ plan_id: input.plan_id, include_subtasks: true })
+    ]);
+    const sortedTasks3 = tasks.sort((left, right) => left.id.localeCompare(right.id));
+    if (!plan || plan.updated_at !== input.expected_plan_revision) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed after the accepted link; fetch an exact readback before rollback");
+    }
+    if (planProjectLinkResultDigest(plan, sortedTasks3) !== receipt.result_digest) {
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Plan membership or project linkage drifted; refusing conditional rollback");
+    }
+    const projectedPlan = { ...plan, project_id: receipt.prior_plan_project_id, updated_at: input.restored_at };
+    const projectedTasks = sortedTasks3.map((task2) => ({
+      ...task2,
+      project_id: receipt.prior_task_project_ids[task2.id] ?? null,
+      updated_at: input.restored_at,
+      version: task2.version + 1
+    }));
+    const rollback = {
+      schema_version: PLAN_PROJECT_LINK_SCHEMA_VERSION,
+      action: "restored",
+      plan: projectedPlan,
+      tasks: projectedTasks,
+      accepted_receipt_id: receipt.receipt_id,
+      rollback_receipt_id: input.rollback_receipt_id,
+      restored_at: input.restored_at
+    };
+    const currentTaskProjects = Object.fromEntries(sortedTasks3.map((task2) => [task2.id, task2.project_id]));
+    const result = await this.options.client.query(`/* todos:plan-project-link-rollback-atomic */ WITH
+       target_plan AS MATERIALIZED (
+         SELECT payload FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'plans' AND object_id = $2 AND deleted_at IS NULL
+         FOR UPDATE
+       ), member_tasks AS MATERIALIZED (
+         SELECT object_id, payload FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'tasks' AND deleted_at IS NULL
+           AND payload->>'plan_id' = $2
+           AND EXISTS (SELECT 1 FROM target_plan)
+         FOR UPDATE
+       ), existing AS (
+         SELECT payload FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'plan_project_link_rollback_receipts'
+           AND object_id = $5 AND deleted_at IS NULL
+         FOR UPDATE
+       ), checks AS (
+         SELECT
+           EXISTS (SELECT 1 FROM target_plan) AS plan_found,
+           COALESCE((SELECT payload->>'updated_at' = $3 FROM target_plan), false) AS plan_revision_ok,
+           COALESCE((SELECT jsonb_object_agg(object_id, COALESCE(payload->'project_id', 'null'::jsonb) ORDER BY object_id) FROM member_tasks), '{}'::jsonb) = $7::jsonb
+             AND COALESCE((SELECT jsonb_agg(object_id ORDER BY object_id) FROM member_tasks), '[]'::jsonb) = $8::jsonb AS membership_ok,
+           EXISTS (SELECT 1 FROM existing) AS has_existing
+       ), updated_plan AS (
+         UPDATE ${this.tableName} r SET
+           payload = r.payload || jsonb_build_object('project_id', $9::jsonb, 'updated_at', $10::text),
+           updated_at = $10::timestamptz,
+           version = COALESCE(r.version, 0) + 1,
+           source_machine_id = COALESCE($11, r.source_machine_id)
+         FROM checks
+         WHERE r.service = $1 AND r.object_type = 'plans' AND r.object_id = $2 AND r.deleted_at IS NULL
+           AND checks.plan_found AND checks.plan_revision_ok AND checks.membership_ok AND NOT checks.has_existing
+         RETURNING 1
+       ), updated_tasks AS (
+         UPDATE ${this.tableName} r SET
+           payload = r.payload || jsonb_build_object(
+             'project_id', COALESCE($12::jsonb -> r.object_id, 'null'::jsonb),
+             'updated_at', $10::text,
+             'version', COALESCE((r.payload->>'version')::int, 0) + 1
+           ),
+           updated_at = $10::timestamptz,
+           version = COALESCE(r.version, 0) + 1,
+           source_machine_id = COALESCE($11, r.source_machine_id)
+         WHERE r.service = $1 AND r.object_type = 'tasks' AND r.deleted_at IS NULL
+           AND r.payload->>'plan_id' = $2 AND EXISTS (SELECT 1 FROM updated_plan)
+         RETURNING 1
+       ), task_gate AS (SELECT count(*) AS count FROM updated_tasks), inserted AS (
+         INSERT INTO ${this.tableName}
+           (service, object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version)
+         SELECT $1, 'plan_project_link_rollback_receipts', $5, $6::jsonb, $10::timestamptz, NULL, $11, 1
+         FROM checks, task_gate
+         WHERE NOT checks.has_existing AND EXISTS (SELECT 1 FROM updated_plan)
+         RETURNING payload
+       ) SELECT
+         checks.plan_found,
+         checks.plan_revision_ok,
+         checks.membership_ok,
+         (SELECT payload FROM existing) AS existing_rollback,
+         (SELECT payload FROM inserted) AS inserted_rollback
+       FROM checks`, [
+      this.service,
+      input.plan_id,
+      input.expected_plan_revision,
+      input.receipt_id,
+      input.rollback_receipt_id,
+      jsonbParam(rollback),
+      jsonbParam(currentTaskProjects),
+      jsonbParam(receipt.task_ids),
+      jsonbParam(receipt.prior_plan_project_id),
+      input.restored_at,
+      this.machineId(context),
+      jsonbParam(receipt.prior_task_project_ids)
+    ]);
+    const row = result.rows[0];
+    if (!row?.plan_found)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan not found: ${input.plan_id}`);
+    if (!row.plan_revision_ok)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT", "Plan changed during rollback");
+    if (!row.membership_ok)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Plan membership changed during rollback");
+    const accepted = row.existing_rollback ?? row.inserted_rollback;
+    if (!accepted)
+      throw new PlanProjectLinkError("PLAN_PROJECT_LINK_ROLLBACK_CONFLICT", "Rollback did not produce an immutable receipt");
+    return accepted;
+  }
   async deletePlan(id, context = {}) {
     await this.ensureSchema();
     const timestamp4 = new Date().toISOString();
@@ -46693,11 +47535,17 @@ class PostgresJsonRecordStore {
 }
 async function createTask3(input, store, context) {
   const timestamp4 = new Date().toISOString();
-  const shortId = input.project_id ? await nextTaskShortId2(input.project_id, store, context) : null;
+  const linkedPlan = input.plan_id ? await store.get("plans", input.plan_id) : null;
+  const requestedProjectId = input.project_id ?? context?.projectId ?? null;
+  if (linkedPlan?.project_id && requestedProjectId && requestedProjectId !== linkedPlan.project_id) {
+    throw new ResourceConflictError("PLAN_PROJECT_LINK_CONFLICT", `Task project conflicts with linked plan ${input.plan_id}: expected ${linkedPlan.project_id}`);
+  }
+  const effectiveProjectId = linkedPlan?.project_id ?? requestedProjectId;
+  const shortId = effectiveProjectId ? await nextTaskShortId2(effectiveProjectId, store, context) : null;
   const task2 = {
     id: randomUUID3(),
     short_id: shortId,
-    project_id: input.project_id ?? context?.projectId ?? null,
+    project_id: effectiveProjectId,
     parent_id: input.parent_id ?? null,
     plan_id: input.plan_id ?? null,
     task_list_id: input.task_list_id ?? context?.taskListId ?? null,
@@ -46751,15 +47599,27 @@ async function createTask3(input, store, context) {
     synced_at: null,
     archived_at: null
   };
-  await store.upsert("tasks", task2, context);
-  await logTaskChange2(task2.id, "created", "status", null, task2.status, task2.assigned_by ?? task2.agent_id, store, context);
-  return task2;
+  const storedTask = await store.upsertTaskWithPlanMembershipGuard(task2, task2.plan_id ? [task2.plan_id] : [], input.project_id !== undefined || context?.projectId !== undefined, context);
+  await logTaskChange2(storedTask.id, "created", "status", null, storedTask.status, storedTask.assigned_by ?? storedTask.agent_id, store, context);
+  return storedTask;
 }
 async function updateTask2(id, input, store) {
   const existing = await requireRecord("tasks", id, store);
   if (existing.version !== input.version) {
     throw new Error(`Task ${id} version conflict: expected ${existing.version}, got ${input.version}`);
   }
+  const effectivePlanId = input.plan_id !== undefined ? input.plan_id : existing.plan_id;
+  const linkedPlan = effectivePlanId ? await store.get("plans", effectivePlanId) : null;
+  if (linkedPlan?.project_id) {
+    const effectiveProjectId = input.project_id !== undefined ? input.project_id : existing.project_id;
+    if (effectiveProjectId !== linkedPlan.project_id) {
+      if (input.project_id === undefined && (input.plan_id !== undefined || existing.project_id === null)) {
+        input = { ...input, project_id: linkedPlan.project_id };
+      } else {
+        throw new ResourceConflictError("PLAN_PROJECT_LINK_CONFLICT", `Task project conflicts with linked plan ${effectivePlanId}: expected ${linkedPlan.project_id}`);
+      }
+    }
+  }
   const reopened = existing.status === "completed" && input.status !== undefined && input.status !== "completed" && input.completed_at === undefined;
   const terminalNow = input.status !== undefined && isTerminalStatus(input.status);
   const task2 = {
@@ -46775,8 +47635,7 @@ async function updateTask2(id, input, store) {
     created_by: existing.created_by,
     completed_at: reopened ? null : input.completed_at !== undefined ? input.completed_at : existing.completed_at
   };
-  await store.upsert("tasks", task2);
-  return task2;
+  return store.upsertTaskWithPlanMembershipGuard(task2, [existing.plan_id, effectivePlanId].filter((planId) => Boolean(planId)), input.project_id !== undefined);
 }
 async function startTask2(id, agentId, store) {
   const task2 = await requireRecord("tasks", id, store);
@@ -46840,8 +47699,7 @@ async function patchTask(task2, patch, store) {
     version: task2.version + 1,
     updated_at: new Date().toISOString()
   };
-  await store.upsert("tasks", updated);
-  return updated;
+  return store.upsertTaskWithPlanMembershipGuard(updated, [task2.plan_id, updated.plan_id].filter((planId) => Boolean(planId)), Object.prototype.hasOwnProperty.call(patch, "project_id"));
 }
 function sameCloudLockHolder(stored, incoming) {
   if (!stored || !incoming)
@@ -47103,7 +47961,12 @@ async function updatePlan2(id, input, store) {
       excludeId: id
     });
   }
-  return store.upsert("plans", { ...plan, ...patch, updated_at: new Date().toISOString() });
+  return store.updatePlanWithProjectLinkGuard({
+    ...plan,
+    ...patch,
+    project_id: plan.project_id,
+    updated_at: new Date().toISOString()
+  });
 }
 function matchAgentByName(agents, name, options) {
   const target = normalizeAgentNameInput(name);
@@ -47491,6 +48354,7 @@ var CLOUD_LOCK_EXPIRY_MINUTES = 30, TASK_ORDER_TIEBREAK = "CASE payload->>'prior
 var init_postgres_adapter = __esm(() => {
   init_types();
   init_creator_identity();
+  init_plan_project_link_contract();
   init_postgres_sync();
   init_integrity();
   init_redaction();
@@ -48377,8 +49241,592 @@ var init_postgres2 = __esm(() => {
 });
 
 // src/project-registration/sqlite.ts
-var sqliteTransactionTails, PROJECT_REFERENCE_COLUMNS, TASK_LIST_REFERENCE_COLUMNS;
+function sameSqliteValue(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+function taskListFromRow(row) {
+  return {
+    ...row,
+    metadata: JSON.parse(row.metadata || "{}")
+  };
+}
+function selectProject(db, id) {
+  return db.query("SELECT * FROM projects WHERE id = ? LIMIT 1").get(id);
+}
+function selectTaskList(db, id) {
+  const row = db.query("SELECT * FROM task_lists WHERE id = ? LIMIT 1").get(id);
+  return row ? taskListFromRow(row) : null;
+}
+function selectProjectConflict(db, path, taskListSlug) {
+  return db.query(`
+    SELECT * FROM projects
+    WHERE path = ? OR task_list_id = ?
+    ORDER BY created_at ASC, id ASC
+    LIMIT 1
+  `).get(path, taskListSlug);
+}
+function selectTaskListConflict(db, projectId, slug) {
+  const row = db.query(`
+    SELECT * FROM task_lists
+    WHERE project_id = ? AND slug = ?
+    LIMIT 1
+  `).get(projectId, slug);
+  return row ? taskListFromRow(row) : null;
+}
+function quoteSqliteIdentifier(value) {
+  return `"${value.replaceAll('"', '""')}"`;
+}
+function hasSqliteDependents(db, resourceKind, targetId) {
+  const targetTable = resourceKind === "project" ? "projects" : "task_lists";
+  const semanticColumns = resourceKind === "project" ? PROJECT_REFERENCE_COLUMNS : TASK_LIST_REFERENCE_COLUMNS;
+  const tables = db.query(`
+    SELECT name FROM sqlite_schema
+    WHERE type = 'table' AND name NOT LIKE 'sqlite_%'
+    ORDER BY name
+  `).all();
+  for (const { name: tableName } of tables) {
+    const quotedTable = quoteSqliteIdentifier(tableName);
+    const columns = db.query(`PRAGMA table_info(${quotedTable})`).all();
+    const foreignKeys = db.query(`PRAGMA foreign_key_list(${quotedTable})`).all();
+    const referenceColumns = columns.map((column) => column.name).filter((columnName) => semanticColumns.has(columnName) || foreignKeys.some((foreignKey) => foreignKey.from === columnName && foreignKey.table === targetTable));
+    for (const columnName of referenceColumns) {
+      const row = db.query(`
+        SELECT 1 AS found
+        FROM ${quotedTable}
+        WHERE ${quoteSqliteIdentifier(columnName)} = ?
+        LIMIT 1
+      `).get(targetId);
+      if (row)
+        return true;
+    }
+  }
+  return false;
+}
+function receiptFromRow2(row) {
+  return {
+    ...row,
+    authority: "todos",
+    created_by_operation: Number(row["created_by_operation"]) === 1
+  };
+}
+function bindingFromRow2(row) {
+  return row;
+}
+
+class SqliteTodosProjectRegistrationTransaction {
+  db;
+  storage;
+  constructor(db) {
+    this.db = db;
+    this.storage = createLocalSqliteTodosStorageAdapter({ db });
+  }
+  async lockStep(_identity) {}
+  async getReceiptForLookup(identity) {
+    const row = this.db.query(`
+      SELECT * FROM todos_project_registration_receipts
+      WHERE authority_id = ? AND tenant_id = ? AND corpus_id = ?
+        AND operation_id = ? AND step_id = ? AND resource_kind = ?
+        AND direction = ? AND idempotency_key = ? AND target_selector = ?
+      ORDER BY CASE outcome
+        WHEN 'terminal_nonacceptance' THEN 0
+        WHEN 'duplicate_of_accepted' THEN 1
+        ELSE 2
+      END, created_at DESC, receipt_id DESC
+      LIMIT 1
+    `).get(identity.authority_id, identity.tenant_id, identity.corpus_id, identity.operation_id, identity.step_id, identity.resource_kind, identity.direction, identity.idempotency_key, identity.target_selector);
+    return row ? receiptFromRow2(row) : null;
+  }
+  async getReceiptById(receiptId) {
+    const row = this.db.query("SELECT * FROM todos_project_registration_receipts WHERE receipt_id = ? LIMIT 1").get(receiptId);
+    return row ? receiptFromRow2(row) : null;
+  }
+  async getAcceptedReceiptForStep(identity) {
+    const row = this.db.query(`
+      SELECT * FROM todos_project_registration_receipts
+      WHERE authority_id = ? AND tenant_id = ? AND corpus_id = ?
+        AND operation_id = ? AND step_id = ? AND resource_kind = ?
+        AND direction = ? AND outcome = 'accepted'
+      ORDER BY created_at ASC, receipt_id ASC
+      LIMIT 1
+    `).get(identity.authority_id, identity.tenant_id, identity.corpus_id, identity.operation_id, identity.step_id, identity.resource_kind, identity.direction);
+    return row ? receiptFromRow2(row) : null;
+  }
+  async insertReceipt(receipt) {
+    const result = this.db.query(`
+      INSERT OR IGNORE INTO todos_project_registration_receipts (
+        receipt_id, authority, route, package_version, authority_id, tenant_id,
+        corpus_id, operation_id, step_id, resource_kind, direction,
+        target_selector, idempotency_key, request_digest, precondition_digest,
+        normalized_call_digest, outcome, reason, target_id, result_revision,
+        result_digest, duplicate_of_receipt_id, accepted_receipt_id,
+        created_by_operation, created_at
+      ) VALUES (
+        ?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?
+      )
+    `).run(receipt.receipt_id, receipt.authority, receipt.route, receipt.package_version, receipt.authority_id, receipt.tenant_id, receipt.corpus_id, receipt.operation_id, receipt.step_id, receipt.resource_kind, receipt.direction, receipt.target_selector, receipt.idempotency_key, receipt.request_digest, receipt.precondition_digest, receipt.normalized_call_digest, receipt.outcome, receipt.reason, receipt.target_id, receipt.result_revision, receipt.result_digest, receipt.duplicate_of_receipt_id, receipt.accepted_receipt_id, receipt.created_by_operation ? 1 : 0, receipt.created_at);
+    return result.changes === 1;
+  }
+  async getBinding(scope, resourceKind, targetSelector) {
+    const row = this.db.query(`
+      SELECT * FROM todos_project_registration_bindings
+      WHERE authority_id = ? AND tenant_id = ? AND corpus_id = ?
+        AND resource_kind = ? AND target_selector = ?
+      LIMIT 1
+    `).get(scope.authority_id, scope.tenant_id, scope.corpus_id, resourceKind, targetSelector);
+    return row ? bindingFromRow2(row) : null;
+  }
+  async claimBinding(binding) {
+    const result = this.db.query(`
+      INSERT OR IGNORE INTO todos_project_registration_bindings (
+        authority_id, tenant_id, corpus_id, resource_kind, target_selector,
+        operation_id, step_id, direction, idempotency_key, request_digest,
+        precondition_digest, normalized_call_digest, state, target_id,
+        accepted_receipt_id, result_revision, result_digest, removed_receipt_id,
+        created_at, updated_at
+      ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+    `).run(binding.authority_id, binding.tenant_id, binding.corpus_id, binding.resource_kind, binding.target_selector, binding.operation_id, binding.step_id, binding.direction, binding.idempotency_key, binding.request_digest, binding.precondition_digest, binding.normalized_call_digest, binding.state, binding.target_id, binding.accepted_receipt_id, binding.result_revision, binding.result_digest, binding.removed_receipt_id, binding.created_at, binding.updated_at);
+    return result.changes === 1;
+  }
+  async setBindingAccepted(scope, resourceKind, targetSelector, update) {
+    const result = this.db.query(`
+      UPDATE todos_project_registration_bindings
+      SET state = 'accepted', target_id = ?, accepted_receipt_id = ?,
+        result_revision = ?, result_digest = ?, updated_at = ?
+      WHERE authority_id = ? AND tenant_id = ? AND corpus_id = ?
+        AND resource_kind = ? AND target_selector = ? AND state = 'pending'
+    `).run(update.target_id, update.accepted_receipt_id, update.result_revision, update.result_digest, update.updated_at, scope.authority_id, scope.tenant_id, scope.corpus_id, resourceKind, targetSelector);
+    if (result.changes !== 1) {
+      throw new Error("Todos project registration binding was not pending at acceptance");
+    }
+  }
+  async setBindingTerminal(scope, resourceKind, targetSelector, updatedAt) {
+    this.db.query(`
+      UPDATE todos_project_registration_bindings
+      SET state = 'terminal_nonacceptance', updated_at = ?
+      WHERE authority_id = ? AND tenant_id = ? AND corpus_id = ?
+        AND resource_kind = ? AND target_selector = ? AND state = 'pending'
+    `).run(updatedAt, scope.authority_id, scope.tenant_id, scope.corpus_id, resourceKind, targetSelector);
+  }
+  async setBindingRemoved(scope, resourceKind, targetSelector, removedReceiptId, updatedAt) {
+    const result = this.db.query(`
+      UPDATE todos_project_registration_bindings
+      SET state = 'removed', removed_receipt_id = ?, updated_at = ?
+      WHERE authority_id = ? AND tenant_id = ? AND corpus_id = ?
+        AND resource_kind = ? AND target_selector = ? AND state = 'accepted'
+    `).run(removedReceiptId, updatedAt, scope.authority_id, scope.tenant_id, scope.corpus_id, resourceKind, targetSelector);
+    if (result.changes !== 1) {
+      throw new Error("Todos project registration binding was not accepted at removal");
+    }
+  }
+  async findProjectConflict(path, taskListSlug) {
+    const row = this.db.query(`
+      SELECT * FROM projects
+      WHERE path = ? OR task_list_id = ?
+      ORDER BY created_at ASC, id ASC
+      LIMIT 1
+    `).get(path, taskListSlug);
+    return row ?? null;
+  }
+  async findTaskListConflict(projectId, slug) {
+    return await this.storage.taskLists.getBySlug(slug, projectId);
+  }
+  async createProject(input) {
+    return await this.storage.projects.create(input);
+  }
+  async createTaskList(input) {
+    return await this.storage.taskLists.create(input);
+  }
+  async getProject(id) {
+    return await this.storage.projects.get(id);
+  }
+  async getTaskList(id) {
+    return await this.storage.taskLists.get(id);
+  }
+  async lockCompensationWrites() {}
+  async hasDependents(resourceKind, targetId) {
+    return hasSqliteDependents(this.db, resourceKind, targetId);
+  }
+  async deleteProject(id) {
+    return await this.storage.projects.delete(id);
+  }
+  async deleteTaskList(id) {
+    return await this.storage.taskLists.delete(id);
+  }
+}
+
+class StagedSqliteTodosProjectRegistrationTransaction {
+  db;
+  direct;
+  validators = [];
+  mutations = [];
+  receipts = new Map;
+  bindings = new Map;
+  projects = new Map;
+  taskLists = new Map;
+  constructor(db) {
+    this.db = db;
+    this.direct = new SqliteTodosProjectRegistrationTransaction(db);
+  }
+  commit() {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      for (const validate of this.validators) {
+        if (!validate()) {
+          throw new SqliteRegistrationOptimisticConflict("Todos project registration input changed before SQLite commit");
+        }
+      }
+      for (const mutate of this.mutations)
+        mutate();
+      this.db.exec("COMMIT");
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {}
+      throw error;
+    }
+  }
+  async lockStep(_identity) {}
+  async getReceiptForLookup(identity) {
+    const staged = [...this.receipts.values()].filter((receipt) => receipt.authority_id === identity.authority_id && receipt.tenant_id === identity.tenant_id && receipt.corpus_id === identity.corpus_id && receipt.operation_id === identity.operation_id && receipt.step_id === identity.step_id && receipt.resource_kind === identity.resource_kind && receipt.direction === identity.direction && receipt.idempotency_key === identity.idempotency_key && receipt.target_selector === identity.target_selector);
+    const stored = await this.direct.getReceiptForLookup(identity);
+    if (stored)
+      staged.push(stored);
+    const outcomeRank = (receipt) => receipt.outcome === "terminal_nonacceptance" ? 0 : receipt.outcome === "duplicate_of_accepted" ? 1 : 2;
+    return staged.sort((left, right) => outcomeRank(left) - outcomeRank(right) || right.created_at.localeCompare(left.created_at) || right.receipt_id.localeCompare(left.receipt_id))[0] ?? null;
+  }
+  async getReceiptById(receiptId) {
+    return this.receipts.get(receiptId) ?? this.direct.getReceiptById(receiptId);
+  }
+  async getAcceptedReceiptForStep(identity) {
+    const staged = [...this.receipts.values()].filter((receipt) => receipt.authority_id === identity.authority_id && receipt.tenant_id === identity.tenant_id && receipt.corpus_id === identity.corpus_id && receipt.operation_id === identity.operation_id && receipt.step_id === identity.step_id && receipt.resource_kind === identity.resource_kind && receipt.direction === identity.direction && receipt.outcome === "accepted");
+    const stored = await this.direct.getAcceptedReceiptForStep(identity);
+    if (stored)
+      staged.push(stored);
+    return staged.sort((left, right) => left.created_at.localeCompare(right.created_at) || left.receipt_id.localeCompare(right.receipt_id))[0] ?? null;
+  }
+  async insertReceipt(receipt) {
+    if (this.receipts.has(receipt.receipt_id))
+      return false;
+    if (await this.direct.getReceiptById(receipt.receipt_id))
+      return false;
+    const planned = { ...receipt };
+    this.receipts.set(planned.receipt_id, planned);
+    this.mutations.push(() => {
+      try {
+        const result = this.db.query(`
+          INSERT OR IGNORE INTO todos_project_registration_receipts (
+            receipt_id, authority, route, package_version, authority_id, tenant_id,
+            corpus_id, operation_id, step_id, resource_kind, direction,
+            target_selector, idempotency_key, request_digest, precondition_digest,
+            normalized_call_digest, outcome, reason, target_id, result_revision,
+            result_digest, duplicate_of_receipt_id, accepted_receipt_id,
+            created_by_operation, created_at
+          ) VALUES (
+            ?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?
+          )
+        `).run(planned.receipt_id, planned.authority, planned.route, planned.package_version, planned.authority_id, planned.tenant_id, planned.corpus_id, planned.operation_id, planned.step_id, planned.resource_kind, planned.direction, planned.target_selector, planned.idempotency_key, planned.request_digest, planned.precondition_digest, planned.normalized_call_digest, planned.outcome, planned.reason, planned.target_id, planned.result_revision, planned.result_digest, planned.duplicate_of_receipt_id, planned.accepted_receipt_id, planned.created_by_operation ? 1 : 0, planned.created_at);
+        if (result.changes !== 1) {
+          throw new SqliteRegistrationOptimisticConflict("Todos project registration receipt changed before SQLite commit");
+        }
+      } catch (error) {
+        if (error instanceof SqliteRegistrationOptimisticConflict)
+          throw error;
+        throw new SqliteRegistrationOptimisticConflict("Todos project registration receipt conflicted at SQLite commit", { cause: error });
+      }
+    });
+    return true;
+  }
+  async getBinding(scope, resourceKind, targetSelector) {
+    const key = this.bindingKey(scope, resourceKind, targetSelector);
+    return this.bindings.get(key) ?? this.direct.getBinding(scope, resourceKind, targetSelector);
+  }
+  async claimBinding(binding) {
+    const key = this.bindingKey(binding, binding.resource_kind, binding.target_selector);
+    if (this.bindings.has(key))
+      return false;
+    if (await this.direct.getBinding(binding, binding.resource_kind, binding.target_selector)) {
+      return false;
+    }
+    const planned = { ...binding };
+    this.bindings.set(key, planned);
+    this.mutations.push(() => {
+      try {
+        const result = this.db.query(`
+          INSERT OR IGNORE INTO todos_project_registration_bindings (
+            authority_id, tenant_id, corpus_id, resource_kind, target_selector,
+            operation_id, step_id, direction, idempotency_key, request_digest,
+            precondition_digest, normalized_call_digest, state, target_id,
+            accepted_receipt_id, result_revision, result_digest, removed_receipt_id,
+            created_at, updated_at
+          ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+        `).run(planned.authority_id, planned.tenant_id, planned.corpus_id, planned.resource_kind, planned.target_selector, planned.operation_id, planned.step_id, planned.direction, planned.idempotency_key, planned.request_digest, planned.precondition_digest, planned.normalized_call_digest, planned.state, planned.target_id, planned.accepted_receipt_id, planned.result_revision, planned.result_digest, planned.removed_receipt_id, planned.created_at, planned.updated_at);
+        if (result.changes !== 1) {
+          throw new SqliteRegistrationOptimisticConflict("Todos project registration binding changed before SQLite commit");
+        }
+      } catch (error) {
+        if (error instanceof SqliteRegistrationOptimisticConflict)
+          throw error;
+        throw new SqliteRegistrationOptimisticConflict("Todos project registration binding conflicted at SQLite commit", { cause: error });
+      }
+    });
+    return true;
+  }
+  async setBindingAccepted(scope, resourceKind, targetSelector, update) {
+    const binding = await this.requireBinding(scope, resourceKind, targetSelector, "pending");
+    this.bindings.set(this.bindingKey(scope, resourceKind, targetSelector), {
+      ...binding,
+      state: "accepted",
+      target_id: update.target_id,
+      accepted_receipt_id: update.accepted_receipt_id,
+      result_revision: update.result_revision,
+      result_digest: update.result_digest,
+      updated_at: update.updated_at
+    });
+    this.mutations.push(() => {
+      const result = this.db.query(`
+        UPDATE todos_project_registration_bindings
+        SET state = 'accepted', target_id = ?, accepted_receipt_id = ?,
+          result_revision = ?, result_digest = ?, updated_at = ?
+        WHERE authority_id = ? AND tenant_id = ? AND corpus_id = ?
+          AND resource_kind = ? AND target_selector = ? AND state = 'pending'
+      `).run(update.target_id, update.accepted_receipt_id, update.result_revision, update.result_digest, update.updated_at, scope.authority_id, scope.tenant_id, scope.corpus_id, resourceKind, targetSelector);
+      if (result.changes !== 1) {
+        throw new SqliteRegistrationOptimisticConflict("Todos project registration binding was no longer pending at SQLite commit");
+      }
+    });
+  }
+  async setBindingTerminal(scope, resourceKind, targetSelector, updatedAt) {
+    const binding = await this.requireBinding(scope, resourceKind, targetSelector, "pending");
+    this.bindings.set(this.bindingKey(scope, resourceKind, targetSelector), {
+      ...binding,
+      state: "terminal_nonacceptance",
+      updated_at: updatedAt
+    });
+    this.mutations.push(() => {
+      const result = this.db.query(`
+        UPDATE todos_project_registration_bindings
+        SET state = 'terminal_nonacceptance', updated_at = ?
+        WHERE authority_id = ? AND tenant_id = ? AND corpus_id = ?
+          AND resource_kind = ? AND target_selector = ? AND state = 'pending'
+      `).run(updatedAt, scope.authority_id, scope.tenant_id, scope.corpus_id, resourceKind, targetSelector);
+      if (result.changes !== 1) {
+        throw new SqliteRegistrationOptimisticConflict("Todos project registration binding was no longer pending at SQLite commit");
+      }
+    });
+  }
+  async setBindingRemoved(scope, resourceKind, targetSelector, removedReceiptId, updatedAt) {
+    const binding = await this.requireBinding(scope, resourceKind, targetSelector, "accepted");
+    this.bindings.set(this.bindingKey(scope, resourceKind, targetSelector), {
+      ...binding,
+      state: "removed",
+      removed_receipt_id: removedReceiptId,
+      updated_at: updatedAt
+    });
+    this.mutations.push(() => {
+      const result = this.db.query(`
+        UPDATE todos_project_registration_bindings
+        SET state = 'removed', removed_receipt_id = ?, updated_at = ?
+        WHERE authority_id = ? AND tenant_id = ? AND corpus_id = ?
+          AND resource_kind = ? AND target_selector = ? AND state = 'accepted'
+      `).run(removedReceiptId, updatedAt, scope.authority_id, scope.tenant_id, scope.corpus_id, resourceKind, targetSelector);
+      if (result.changes !== 1) {
+        throw new SqliteRegistrationOptimisticConflict("Todos project registration binding was no longer accepted at SQLite commit");
+      }
+    });
+  }
+  async findProjectConflict(path, taskListSlug) {
+    const planned = [...this.projects.values()].find((project) => project?.path === path || project?.task_list_id === taskListSlug);
+    if (planned)
+      return planned;
+    const observed = selectProjectConflict(this.db, path, taskListSlug);
+    this.validators.push(() => sameSqliteValue(selectProjectConflict(this.db, path, taskListSlug), observed));
+    return observed;
+  }
+  async findTaskListConflict(projectId, slug) {
+    const planned = [...this.taskLists.values()].find((taskList) => taskList?.project_id === projectId && taskList.slug === slug);
+    if (planned)
+      return planned;
+    const observed = selectTaskListConflict(this.db, projectId, slug);
+    this.validators.push(() => sameSqliteValue(selectTaskListConflict(this.db, projectId, slug), observed));
+    return observed;
+  }
+  async createProject(input) {
+    const derivedSlug = normalizeSlug(input.name);
+    const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : normalizeSlug(input.task_list_id);
+    if (!derivedSlug || !taskListId) {
+      throw new Error("Project name and task-list slug must be non-empty");
+    }
+    const project = {
+      id: uuid(),
+      name: input.name,
+      path: input.path,
+      description: input.description || null,
+      task_list_id: taskListId,
+      task_prefix: input.task_prefix ?? this.availableProjectPrefix(input.name),
+      task_counter: 0,
+      created_at: now(),
+      updated_at: now(),
+      machine_id: currentStorageMachineId(this.db)
+    };
+    project.updated_at = project.created_at;
+    this.projects.set(project.id, project);
+    this.mutations.push(() => {
+      try {
+        const result = this.db.run(`INSERT INTO projects (
+             id, name, path, description, task_list_id, task_prefix,
+             task_counter, created_at, updated_at, machine_id
+           ) VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [
+          project.id,
+          project.name,
+          project.path,
+          project.description,
+          project.task_list_id,
+          project.task_prefix,
+          project.created_at,
+          project.updated_at,
+          project.machine_id ?? null
+        ]);
+        if (result.changes < 1) {
+          throw new SqliteRegistrationOptimisticConflict("Todos project changed before SQLite registration commit");
+        }
+      } catch (error) {
+        if (error instanceof SqliteRegistrationOptimisticConflict)
+          throw error;
+        throw new SqliteRegistrationOptimisticConflict("Todos project conflicted at SQLite registration commit", { cause: error });
+      }
+    });
+    return project;
+  }
+  async createTaskList(input) {
+    const slug = normalizeSlug(input.slug === undefined ? input.name : input.slug);
+    if (!slug)
+      throw new Error("Invalid task-list slug \u2014 must be non-empty kebab-case");
+    const taskList = {
+      id: uuid(),
+      project_id: input.project_id || null,
+      slug,
+      name: input.name,
+      description: input.description || null,
+      metadata: input.metadata ?? {},
+      created_at: now(),
+      updated_at: now(),
+      machine_id: currentStorageMachineId(this.db)
+    };
+    taskList.updated_at = taskList.created_at;
+    this.taskLists.set(taskList.id, taskList);
+    this.mutations.push(() => {
+      try {
+        const result = this.db.run(`INSERT INTO task_lists (
+             id, project_id, slug, name, description, metadata,
+             created_at, updated_at, machine_id
+           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+          taskList.id,
+          taskList.project_id,
+          taskList.slug,
+          taskList.name,
+          taskList.description,
+          JSON.stringify(taskList.metadata),
+          taskList.created_at,
+          taskList.updated_at,
+          taskList.machine_id ?? null
+        ]);
+        if (result.changes < 1) {
+          throw new SqliteRegistrationOptimisticConflict("Todos task list changed before SQLite registration commit");
+        }
+      } catch (error) {
+        if (error instanceof SqliteRegistrationOptimisticConflict)
+          throw error;
+        throw new SqliteRegistrationOptimisticConflict("Todos task list conflicted at SQLite registration commit", { cause: error });
+      }
+    });
+    return taskList;
+  }
+  async getProject(id) {
+    if (this.projects.has(id))
+      return this.projects.get(id) ?? null;
+    const observed = selectProject(this.db, id);
+    this.validators.push(() => sameSqliteValue(selectProject(this.db, id), observed));
+    return observed;
+  }
+  async getTaskList(id) {
+    if (this.taskLists.has(id))
+      return this.taskLists.get(id) ?? null;
+    const observed = selectTaskList(this.db, id);
+    this.validators.push(() => sameSqliteValue(selectTaskList(this.db, id), observed));
+    return observed;
+  }
+  async lockCompensationWrites() {}
+  async hasDependents(resourceKind, targetId) {
+    const observed = hasSqliteDependents(this.db, resourceKind, targetId);
+    this.validators.push(() => hasSqliteDependents(this.db, resourceKind, targetId) === observed);
+    return observed;
+  }
+  async deleteProject(id) {
+    const project = await this.getProject(id);
+    if (!project)
+      return false;
+    this.projects.set(id, null);
+    this.mutations.push(() => {
+      recordStorageTombstone({
+        object_type: "projects",
+        object_id: id,
+        payload: project
+      }, this.db);
+      if (this.db.run("DELETE FROM projects WHERE id = ?", [id]).changes < 1) {
+        throw new SqliteRegistrationOptimisticConflict("Todos project changed before SQLite compensation commit");
+      }
+    });
+    return true;
+  }
+  async deleteTaskList(id) {
+    const taskList = await this.getTaskList(id);
+    if (!taskList)
+      return false;
+    this.taskLists.set(id, null);
+    this.mutations.push(() => {
+      recordStorageTombstone({
+        object_type: "task_lists",
+        object_id: id,
+        payload: taskList
+      }, this.db);
+      if (this.db.run("DELETE FROM task_lists WHERE id = ?", [id]).changes < 1) {
+        throw new SqliteRegistrationOptimisticConflict("Todos task list changed before SQLite compensation commit");
+      }
+    });
+    return true;
+  }
+  bindingKey(scope, resourceKind, targetSelector) {
+    return JSON.stringify([
+      scope.authority_id,
+      scope.tenant_id,
+      scope.corpus_id,
+      resourceKind,
+      targetSelector
+    ]);
+  }
+  async requireBinding(scope, resourceKind, targetSelector, state) {
+    const binding = await this.getBinding(scope, resourceKind, targetSelector);
+    if (!binding || binding.state !== state) {
+      throw new Error(`Todos project registration binding was not ${state}`);
+    }
+    return binding;
+  }
+  availableProjectPrefix(name) {
+    const words = name.replace(/[^a-zA-Z0-9\s]/g, "").trim().split(/\s+/);
+    const prefix = words.length >= 3 ? words.slice(0, 3).map((word) => word[0].toUpperCase()).join("") : words.length === 2 ? (words[0].slice(0, 2) + words[1][0]).toUpperCase() : words[0].slice(0, 3).toUpperCase();
+    let candidate = prefix;
+    let suffix = 1;
+    while (this.db.query("SELECT id FROM projects WHERE task_prefix = ? LIMIT 1").get(candidate) || [...this.projects.values()].some((project) => project?.task_prefix === candidate)) {
+      suffix += 1;
+      candidate = `${prefix}${suffix}`;
+    }
+    return candidate;
+  }
+}
+var sqliteTransactionTails, PROJECT_REFERENCE_COLUMNS, TASK_LIST_REFERENCE_COLUMNS, SqliteRegistrationOptimisticConflict;
 var init_sqlite = __esm(() => {
+  init_database();
+  init_storage_tombstones();
   init_local_sqlite();
   sqliteTransactionTails = new WeakMap;
   PROJECT_REFERENCE_COLUMNS = new Set([
@@ -48388,10 +49836,16 @@ var init_sqlite = __esm(() => {
     "external_project_id"
   ]);
   TASK_LIST_REFERENCE_COLUMNS = new Set(["task_list_id"]);
+  SqliteRegistrationOptimisticConflict = class SqliteRegistrationOptimisticConflict extends Error {
+    constructor(message, options = {}) {
+      super(message, options);
+      this.name = "SqliteRegistrationOptimisticConflict";
+    }
+  };
 });
 
 // src/project-registration/authority.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 function canonicalProjectRegistrationJson(value) {
   return JSON.stringify(canonicalize2(value));
 }
@@ -48409,7 +49863,7 @@ function canonicalize2(value) {
   return out;
 }
 function digestProjectRegistrationValue(value) {
-  return createHash14("sha256").update(canonicalProjectRegistrationJson(value)).digest("hex");
+  return createHash15("sha256").update(canonicalProjectRegistrationJson(value)).digest("hex");
 }
 function deriveTodosProjectRegistrationIdempotencyKey(input) {
   return `prk_${digestProjectRegistrationValue({
@@ -50892,8 +52346,14 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
         Task: taskSchema,
         Project: projectSchema,
         TaskList: taskListSchema,
+        ProjectTaskListEnsureReceipt: projectTaskListEnsureReceiptSchema,
+        ProjectTaskListEnsureResult: projectTaskListEnsureResultSchema,
+        ProjectTaskListRollbackResult: projectTaskListRollbackResultSchema,
         TaskComment: taskCommentSchema,
         Plan: planSchema,
+        PlanProjectLinkReceipt: planProjectLinkReceiptSchema,
+        PlanProjectLinkResult: planProjectLinkResultSchema,
+        PlanProjectLinkRollbackResult: planProjectLinkRollbackResultSchema,
         Template: templateSchema,
         TemplateTask: templateTaskSchema,
         TemplateVariable: templateVariableSchema,
@@ -50907,6 +52367,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             status: { type: "string" },
             priority: { type: "string" },
             project_id: { type: "string" },
+            plan_id: { type: "string" },
             assigned_to: { type: "string" },
             agent_id: { type: "string" },
             tags: { type: "array", items: { type: "string" } }
@@ -50921,6 +52382,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             priority: { type: "string" },
             assigned_to: { type: "string" },
             project_id: { type: "string", nullable: true },
+            plan_id: { type: "string", nullable: true },
             task_list_id: { type: "string", nullable: true },
             version: { type: "number" }
           }
@@ -50969,6 +52431,55 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             name: { type: "string", minLength: 1 }
           }
         },
+        ProjectTaskListEnsureApplyInput: {
+          type: "object",
+          additionalProperties: false,
+          required: ["expected_project_revision"],
+          properties: {
+            expected_project_revision: { type: "string", minLength: 1 },
+            idempotency_key: {
+              type: "string",
+              minLength: 8,
+              maxLength: 128,
+              pattern: "^[A-Za-z0-9._:-]+$"
+            }
+          }
+        },
+        ProjectTaskListRollbackInput: {
+          type: "object",
+          additionalProperties: false,
+          required: ["receipt_id", "expected_task_list_revision"],
+          properties: {
+            receipt_id: { type: "string", minLength: 1 },
+            expected_task_list_revision: { type: "string", minLength: 1 }
+          }
+        },
+        PlanProjectLinkApplyInput: {
+          type: "object",
+          additionalProperties: false,
+          required: ["project_id", "expected_plan_revision", "expected_project_revision", "idempotency_key"],
+          properties: {
+            project_id: { type: "string", minLength: 1 },
+            expected_plan_revision: { type: "string", minLength: 1 },
+            expected_project_revision: { type: "string", minLength: 1 },
+            idempotency_key: {
+              type: "string",
+              minLength: 8,
+              maxLength: 128,
+              pattern: "^[A-Za-z0-9._:-]+$"
+            }
+          }
+        },
+        PlanProjectLinkRollbackInput: {
+          type: "object",
+          additionalProperties: false,
+          required: ["project_id", "receipt_id", "expected_plan_revision"],
+          properties: {
+            project_id: { type: "string", minLength: 1 },
+            receipt_id: { type: "string", minLength: 1 },
+            expected_plan_revision: { type: "string", minLength: 1 }
+          }
+        },
         ErrorResponse: {
           type: "object",
           required: ["error"],
@@ -51852,6 +53363,12 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             { name: "assigned_to", in: "query", schema: { type: "string" } },
             { name: "agent_id", in: "query", schema: { type: "string" } },
             { name: "tags", in: "query", schema: { type: "string" }, description: "Comma-separated tags; matches tasks carrying any of them" },
+            {
+              name: "updated_after",
+              in: "query",
+              schema: { type: "string", format: "date-time" },
+              description: "Since-cursor. Returns only tasks whose updated_at is strictly after this instant, and `total` respects it too. " + "Intended for pollers: re-read what changed instead of the whole table. Must be a full RFC 3339 date-time with " + "an explicit offset (e.g. 2026-08-07T12:00:00Z or 2026-08-07T12:00:00+03:00); a reduced-precision value such as " + "`2026` or `2026-08`, or any other malformed value, is rejected with 400 rather than ignored. Timestamps stored " + "without an offset are read as UTC on every backend."
+            },
             { name: "limit", in: "query", schema: { type: "integer", minimum: 1 } },
             { name: "offset", in: "query", schema: { type: "integer", minimum: 0 } }
           ],
@@ -52071,6 +53588,51 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { deleted: { type: "boolean" }, id: { type: "string" } } } } } } }
         }
       },
+      "/v1/projects/{id}/task-list/ensure": {
+        get: {
+          operationId: "planProjectTaskListEnsure",
+          summary: "Plan a non-mutating repair of a project's declared task list",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/ProjectTaskListEnsureResult" } } } },
+            "404": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        },
+        post: {
+          operationId: "ensureProjectTaskList",
+          summary: "Idempotently create an existing project's declared task list",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/ProjectTaskListEnsureApplyInput" } } }
+          },
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/ProjectTaskListEnsureResult" } } } },
+            "201": { content: { "application/json": { schema: { $ref: "#/components/schemas/ProjectTaskListEnsureResult" } } } },
+            "400": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "404": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        }
+      },
+      "/v1/projects/{id}/task-list/rollback": {
+        post: {
+          operationId: "rollbackProjectTaskListEnsure",
+          summary: "Conditionally remove an unchanged task list created by an accepted ensure receipt",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/ProjectTaskListRollbackInput" } } }
+          },
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/ProjectTaskListRollbackResult" } } } },
+            "400": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "404": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        }
+      },
       "/v1/projects/{id}/rename": {
         post: {
           operationId: "renameProject",
@@ -52135,6 +53697,54 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { deleted: { type: "boolean" }, id: { type: "string" } } } } } } }
         }
       },
+      "/v1/plans/{id}/project-link": {
+        get: {
+          operationId: "planPlanProjectLink",
+          summary: "Plan atomic linkage of an existing plan and every current member task to a project",
+          parameters: [
+            { name: "id", in: "path", required: true, schema: { type: "string" } },
+            { name: "project_id", in: "query", required: true, schema: { type: "string" } }
+          ],
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/PlanProjectLinkResult" } } } },
+            "404": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        },
+        post: {
+          operationId: "applyPlanProjectLink",
+          summary: "Atomically and idempotently link an existing plan and every current member task to a project",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/PlanProjectLinkApplyInput" } } }
+          },
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/PlanProjectLinkResult" } } } },
+            "201": { content: { "application/json": { schema: { $ref: "#/components/schemas/PlanProjectLinkResult" } } } },
+            "400": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "404": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        }
+      },
+      "/v1/plans/{id}/project-link/rollback": {
+        post: {
+          operationId: "rollbackPlanProjectLink",
+          summary: "Conditionally restore every exact prior project link from an accepted receipt",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/PlanProjectLinkRollbackInput" } } }
+          },
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/PlanProjectLinkRollbackResult" } } } },
+            "400": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "404": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        }
+      },
       "/v1/templates": {
         get: {
           operationId: "listTemplates",
@@ -52352,7 +53962,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
     }
   };
 }
-var taskSchema, projectSchema, taskListSchema, taskCommentSchema, planSchema, templateTaskSchema, templateSchema, templateVariableSchema, createTemplateTaskInputSchema;
+var taskSchema, projectSchema, taskListSchema, projectTaskListEnsureReceiptSchema, projectTaskListEnsureResultSchema, projectTaskListRollbackResultSchema, taskCommentSchema, planSchema, planProjectLinkReceiptSchema, planProjectLinkResultSchema, planProjectLinkRollbackResultSchema, templateTaskSchema, templateSchema, templateVariableSchema, createTemplateTaskInputSchema;
 var init_openapi = __esm(() => {
   init_package_version();
   init_types();
@@ -52400,6 +54010,80 @@ var init_openapi = __esm(() => {
       updated_at: { type: "string" }
     }
   };
+  projectTaskListEnsureReceiptSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "schema_version",
+      "receipt_id",
+      "idempotency_key",
+      "project_id",
+      "task_list_id",
+      "slug",
+      "created_by_operation",
+      "result_revision",
+      "result_digest",
+      "rollback_supported",
+      "created_at"
+    ],
+    properties: {
+      schema_version: { type: "string", enum: ["todos.project-task-list-ensure.v1"] },
+      receipt_id: { type: "string" },
+      idempotency_key: { type: "string" },
+      project_id: { type: "string" },
+      task_list_id: { type: "string" },
+      slug: { type: "string" },
+      created_by_operation: { type: "boolean" },
+      result_revision: { type: "string" },
+      result_digest: { type: "string" },
+      rollback_supported: { type: "boolean" },
+      created_at: { type: "string", format: "date-time" }
+    }
+  };
+  projectTaskListEnsureResultSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["mode", "action", "project", "task_list", "receipt"],
+    properties: {
+      mode: { type: "string", enum: ["plan", "apply"] },
+      action: { type: "string", enum: ["would_create", "created", "already_present"] },
+      project: { $ref: "#/components/schemas/Project" },
+      task_list: {
+        oneOf: [
+          { $ref: "#/components/schemas/TaskList" },
+          { type: "null" }
+        ]
+      },
+      receipt: {
+        oneOf: [
+          { $ref: "#/components/schemas/ProjectTaskListEnsureReceipt" },
+          { type: "null" }
+        ]
+      }
+    }
+  };
+  projectTaskListRollbackResultSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "schema_version",
+      "action",
+      "project_id",
+      "task_list_id",
+      "accepted_receipt_id",
+      "rollback_receipt_id",
+      "removed_at"
+    ],
+    properties: {
+      schema_version: { type: "string", enum: ["todos.project-task-list-ensure.v1"] },
+      action: { type: "string", enum: ["removed"] },
+      project_id: { type: "string" },
+      task_list_id: { type: "string" },
+      accepted_receipt_id: { type: "string" },
+      rollback_receipt_id: { type: "string" },
+      removed_at: { type: "string", format: "date-time" }
+    }
+  };
   taskCommentSchema = {
     type: "object",
     required: ["id", "task_id", "agent_id", "session_id", "content", "type", "progress_pct", "created_at"],
@@ -52430,6 +54114,75 @@ var init_openapi = __esm(() => {
       updated_at: { type: "string", format: "date-time" }
     }
   };
+  planProjectLinkReceiptSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "schema_version",
+      "receipt_id",
+      "idempotency_key",
+      "plan_id",
+      "project_id",
+      "prior_plan_project_id",
+      "prior_task_project_ids",
+      "task_ids",
+      "task_count",
+      "result_plan_revision",
+      "result_digest",
+      "rollback_supported",
+      "created_at"
+    ],
+    properties: {
+      schema_version: { type: "string", enum: ["todos.plan-project-link.v1"] },
+      receipt_id: { type: "string" },
+      idempotency_key: { type: "string" },
+      plan_id: { type: "string" },
+      project_id: { type: "string" },
+      prior_plan_project_id: { type: "string", nullable: true },
+      prior_task_project_ids: {
+        type: "object",
+        additionalProperties: { type: "string", nullable: true }
+      },
+      task_ids: { type: "array", items: { type: "string" } },
+      task_count: { type: "integer", minimum: 0 },
+      result_plan_revision: { type: "string" },
+      result_digest: { type: "string" },
+      rollback_supported: { type: "boolean", enum: [true] },
+      created_at: { type: "string", format: "date-time" }
+    }
+  };
+  planProjectLinkResultSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["mode", "action", "plan", "project", "tasks", "receipt"],
+    properties: {
+      mode: { type: "string", enum: ["plan", "apply"] },
+      action: { type: "string", enum: ["would_link", "linked", "already_linked"] },
+      plan: { $ref: "#/components/schemas/Plan" },
+      project: { $ref: "#/components/schemas/Project" },
+      tasks: { type: "array", items: { $ref: "#/components/schemas/Task" } },
+      receipt: {
+        oneOf: [
+          { $ref: "#/components/schemas/PlanProjectLinkReceipt" },
+          { type: "null" }
+        ]
+      }
+    }
+  };
+  planProjectLinkRollbackResultSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["schema_version", "action", "plan", "tasks", "accepted_receipt_id", "rollback_receipt_id", "restored_at"],
+    properties: {
+      schema_version: { type: "string", enum: ["todos.plan-project-link.v1"] },
+      action: { type: "string", enum: ["restored"] },
+      plan: { $ref: "#/components/schemas/Plan" },
+      tasks: { type: "array", items: { $ref: "#/components/schemas/Task" } },
+      accepted_receipt_id: { type: "string" },
+      rollback_receipt_id: { type: "string" },
+      restored_at: { type: "string", format: "date-time" }
+    }
+  };
   templateTaskSchema = {
     type: "object",
     required: ["id", "template_id", "position", "title_pattern", "priority", "tags", "depends_on_positions", "metadata", "created_at"],
@@ -52633,6 +54386,330 @@ function decodeCommentCursor(value) {
 }
 var MAX_COMMENT_CURSOR_LENGTH = 1024;
 
+// src/lib/project-task-list-ensure.ts
+import { createHash as createHash16 } from "crypto";
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  return `{${Object.entries(value).filter(([, item]) => item !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(",")}}`;
+}
+function digest(value) {
+  return createHash16("sha256").update(canonicalJson(value)).digest("hex");
+}
+function deriveIdempotencyKey(projectId, slug) {
+  return `ptlk_${digest({ project_id: projectId, slug }).slice(0, 48)}`;
+}
+function normalizeIdempotencyKey(value, projectId, slug) {
+  const key = value?.trim() || deriveIdempotencyKey(projectId, slug);
+  if (key.length < 8 || key.length > 128 || !/^[A-Za-z0-9._:-]+$/.test(key)) {
+    throw new ProjectTaskListEnsureError("PROJECT_TASK_LIST_IDEMPOTENCY_KEY_INVALID", "idempotency_key must be 8-128 ASCII letters, digits, dots, underscores, colons, or hyphens");
+  }
+  return key;
+}
+function receiptId2(projectId, slug, idempotencyKey) {
+  return `ptlr_${digest({ project_id: projectId, slug, idempotency_key: idempotencyKey }).slice(0, 48)}`;
+}
+function semanticListDigest(list) {
+  const metadata = { ...list.metadata ?? {} };
+  delete metadata[RECEIPT_METADATA_KEY];
+  return digest({
+    project_id: list.project_id,
+    slug: list.slug,
+    name: list.name,
+    description: list.description,
+    metadata
+  });
+}
+function storedMarker(list) {
+  const value = list.metadata?.[RECEIPT_METADATA_KEY];
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const marker = value;
+  if (marker.schema_version !== PROJECT_TASK_LIST_ENSURE_SCHEMA_VERSION || typeof marker.receipt_id !== "string" || typeof marker.idempotency_key !== "string" || typeof marker.project_id !== "string" || typeof marker.slug !== "string" || typeof marker.result_digest !== "string" || typeof marker.created_at !== "string")
+    return null;
+  return marker;
+}
+function receiptFor(store, project, list, idempotencyKey) {
+  const marker = storedMarker(list);
+  const owned = marker?.project_id === project.id && marker.slug === list.slug;
+  if (owned && marker.idempotency_key !== idempotencyKey) {
+    throw new ProjectTaskListEnsureError("PROJECT_TASK_LIST_IDEMPOTENCY_CONFLICT", "The operation-owned task list was created under a different idempotency key", {
+      project_id: project.id,
+      task_list_id: list.id,
+      receipt_id: marker.receipt_id
+    });
+  }
+  return {
+    schema_version: PROJECT_TASK_LIST_ENSURE_SCHEMA_VERSION,
+    receipt_id: owned ? marker.receipt_id : `ptlr_existing_${digest({ project_id: project.id, task_list_id: list.id }).slice(0, 39)}`,
+    idempotency_key: owned ? marker.idempotency_key : idempotencyKey,
+    project_id: project.id,
+    task_list_id: list.id,
+    slug: list.slug,
+    created_by_operation: owned,
+    result_revision: list.updated_at,
+    result_digest: owned ? marker.result_digest : semanticListDigest(list),
+    rollback_supported: Boolean(owned && semanticListDigest(list) === marker.result_digest && store.taskLists.deleteIfUnchangedAndUnused),
+    created_at: owned ? marker.created_at : list.created_at
+  };
+}
+async function exactProjectState(store, projectId) {
+  const project = await store.projects.get(projectId);
+  if (!project) {
+    throw new ProjectTaskListEnsureError("PROJECT_NOT_FOUND", `Project not found: ${projectId}`, { project_id: projectId });
+  }
+  const slug = project.task_list_id?.trim();
+  if (!slug) {
+    throw new ProjectTaskListEnsureError("PROJECT_TASK_LIST_NOT_DECLARED", "Project does not declare a canonical task_list_id slug", { project_id: project.id });
+  }
+  const all = await store.taskLists.list();
+  const scopedMatches = all.filter((list) => list.project_id === project.id && list.slug === slug);
+  if (scopedMatches.length > 1) {
+    throw new ProjectTaskListEnsureError("TASK_LIST_SCOPE_COLLISION", "More than one task list matches the project's exact id and declared slug", { project_id: project.id, slug, task_list_ids: scopedMatches.map((list) => list.id) });
+  }
+  const globalMatches = all.filter((list) => list.project_id === null && list.slug === slug);
+  if (globalMatches.length > 0 && scopedMatches.length === 0) {
+    throw new ProjectTaskListEnsureError("TASK_LIST_SCOPE_COLLISION", "A legacy global task list already owns the declared slug; refusing to create a second locator", { project_id: project.id, slug, task_list_ids: globalMatches.map((list) => list.id) });
+  }
+  return { project, scoped: scopedMatches[0] ?? null, globalCollision: globalMatches[0] ?? null };
+}
+async function planProjectTaskListEnsure(store, projectId) {
+  const { project, scoped } = await exactProjectState(store, projectId);
+  return {
+    mode: "plan",
+    action: scoped ? "already_present" : "would_create",
+    project,
+    task_list: scoped,
+    receipt: null
+  };
+}
+async function applyProjectTaskListEnsure(store, projectId, options) {
+  const state = await exactProjectState(store, projectId);
+  const { project } = state;
+  if (project.updated_at !== options.expected_project_revision) {
+    throw new ProjectTaskListEnsureError("PROJECT_REVISION_CONFLICT", "Project changed after the ensure plan; fetch a fresh plan before applying", {
+      project_id: project.id,
+      expected_project_revision: options.expected_project_revision,
+      current_project_revision: project.updated_at
+    });
+  }
+  const slug = project.task_list_id;
+  const idempotencyKey = normalizeIdempotencyKey(options.idempotency_key, project.id, slug);
+  if (state.scoped) {
+    return {
+      mode: "apply",
+      action: "already_present",
+      project,
+      task_list: state.scoped,
+      receipt: receiptFor(store, project, state.scoped, idempotencyKey)
+    };
+  }
+  const marker = {
+    schema_version: PROJECT_TASK_LIST_ENSURE_SCHEMA_VERSION,
+    receipt_id: receiptId2(project.id, slug, idempotencyKey),
+    idempotency_key: idempotencyKey,
+    project_id: project.id,
+    slug,
+    result_digest: semanticListDigest({
+      project_id: project.id,
+      slug,
+      name: project.name,
+      description: null,
+      metadata: {}
+    }),
+    created_at: new Date().toISOString()
+  };
+  let list;
+  try {
+    list = await store.taskLists.create({
+      name: project.name,
+      slug,
+      project_id: project.id,
+      metadata: { [RECEIPT_METADATA_KEY]: marker }
+    });
+  } catch (error) {
+    if (!(error instanceof ResourceConflictError))
+      throw error;
+    const raced = await exactProjectState(store, projectId);
+    if (!raced.scoped)
+      throw error;
+    if (raced.project.updated_at !== options.expected_project_revision || raced.project.task_list_id !== slug) {
+      throw new ProjectTaskListEnsureError("PROJECT_REVISION_CONFLICT", "Project changed while the task list was being created; fetch a fresh plan before retrying", {
+        project_id: raced.project.id,
+        expected_project_revision: options.expected_project_revision,
+        current_project_revision: raced.project.updated_at
+      });
+    }
+    return {
+      mode: "apply",
+      action: "already_present",
+      project: raced.project,
+      task_list: raced.scoped,
+      receipt: receiptFor(store, raced.project, raced.scoped, idempotencyKey)
+    };
+  }
+  const projectReadback = await store.projects.get(project.id);
+  if (!projectReadback || projectReadback.updated_at !== options.expected_project_revision || projectReadback.task_list_id !== slug) {
+    let compensated = false;
+    const unchanged = await store.taskLists.get(list.id);
+    const unchangedMarker = unchanged ? storedMarker(unchanged) : null;
+    if (unchanged && unchangedMarker?.receipt_id === marker.receipt_id && semanticListDigest(unchanged) === marker.result_digest && store.taskLists.deleteIfUnchangedAndUnused) {
+      const deletion = await store.taskLists.deleteIfUnchangedAndUnused(list.id, {
+        project_id: unchanged.project_id,
+        slug: unchanged.slug,
+        name: unchanged.name,
+        description: unchanged.description,
+        metadata: unchanged.metadata,
+        updated_at: unchanged.updated_at
+      });
+      compensated = deletion.status === "deleted";
+    }
+    throw new ProjectTaskListEnsureError("PROJECT_REVISION_CONFLICT", compensated ? "Project changed while the task list was being created; the new list was rolled back" : "Project changed while the task list was being created; the new list was retained because safe conditional rollback could not be proven", { project_id: project.id, task_list_id: list.id, compensated });
+  }
+  const readback = await store.taskLists.get(list.id);
+  if (!readback || readback.project_id !== project.id || readback.slug !== slug) {
+    throw new ProjectTaskListEnsureError("TASK_LIST_SCOPE_COLLISION", "Task-list create did not preserve the exact project id and declared slug", { project_id: project.id, task_list_id: list.id, slug });
+  }
+  return {
+    mode: "apply",
+    action: "created",
+    project: projectReadback,
+    task_list: readback,
+    receipt: receiptFor(store, projectReadback, readback, idempotencyKey)
+  };
+}
+async function rollbackProjectTaskListEnsure(store, projectId, options) {
+  const conditionalDelete = store.taskLists.deleteIfUnchangedAndUnused;
+  if (!conditionalDelete) {
+    throw new ProjectTaskListEnsureError("PROJECT_TASK_LIST_ROLLBACK_CONFLICT", "This storage backend cannot guarantee atomic conditional rollback; refusing to delete", { project_id: projectId, receipt_id: options.receipt_id });
+  }
+  const project = await store.projects.get(projectId);
+  if (!project) {
+    throw new ProjectTaskListEnsureError("PROJECT_NOT_FOUND", `Project not found: ${projectId}`);
+  }
+  const candidates = (await store.taskLists.list(project.id)).filter((list2) => storedMarker(list2)?.receipt_id === options.receipt_id);
+  if (candidates.length !== 1) {
+    throw new ProjectTaskListEnsureError("PROJECT_TASK_LIST_RECEIPT_NOT_FOUND", "No exact operation-owned task list matches this rollback receipt", { project_id: project.id, receipt_id: options.receipt_id });
+  }
+  const list = candidates[0];
+  const marker = storedMarker(list);
+  if (marker.project_id !== project.id || marker.slug !== list.slug || list.project_id !== project.id || list.updated_at !== options.expected_task_list_revision || semanticListDigest(list) !== marker.result_digest) {
+    throw new ProjectTaskListEnsureError("PROJECT_TASK_LIST_ROLLBACK_CONFLICT", "The operation-owned task list drifted; refusing conditional rollback", { project_id: project.id, task_list_id: list.id, receipt_id: options.receipt_id });
+  }
+  const deletion = await conditionalDelete.call(store.taskLists, list.id, {
+    project_id: list.project_id,
+    slug: list.slug,
+    name: list.name,
+    description: list.description,
+    metadata: list.metadata,
+    updated_at: list.updated_at
+  });
+  if (deletion.status === "has_dependents") {
+    throw new ProjectTaskListEnsureError("PROJECT_TASK_LIST_ROLLBACK_HAS_DEPENDENTS", "The operation-owned task list has dependents; refusing conditional rollback", {
+      task_list_id: list.id,
+      task_dependents: deletion.task_dependents,
+      plan_dependents: deletion.plan_dependents
+    });
+  }
+  if (deletion.status !== "deleted" || await store.taskLists.get(list.id)) {
+    throw new ProjectTaskListEnsureError("PROJECT_TASK_LIST_ROLLBACK_CONFLICT", "Conditional rollback did not remove the exact task list", { task_list_id: list.id });
+  }
+  return {
+    schema_version: PROJECT_TASK_LIST_ENSURE_SCHEMA_VERSION,
+    action: "removed",
+    project_id: project.id,
+    task_list_id: list.id,
+    accepted_receipt_id: options.receipt_id,
+    rollback_receipt_id: `ptlr_inverse_${digest({ accepted_receipt_id: options.receipt_id }).slice(0, 38)}`,
+    removed_at: new Date().toISOString()
+  };
+}
+var PROJECT_TASK_LIST_ENSURE_SCHEMA_VERSION = "todos.project-task-list-ensure.v1", RECEIPT_METADATA_KEY = "todos_project_task_list_ensure", ProjectTaskListEnsureError;
+var init_project_task_list_ensure = __esm(() => {
+  init_types();
+  ProjectTaskListEnsureError = class ProjectTaskListEnsureError extends Error {
+    code;
+    details;
+    constructor(code, message, details = {}) {
+      super(message);
+      this.code = code;
+      this.details = details;
+      this.name = "ProjectTaskListEnsureError";
+    }
+  };
+});
+
+// src/lib/plan-project-link.ts
+async function exactPlanProjectLinkState(store, planId, projectId) {
+  const [plan, project] = await Promise.all([
+    store.plans.get(planId),
+    store.projects.get(projectId)
+  ]);
+  if (!plan) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan not found: ${planId}`, { plan_id: planId });
+  }
+  if (!project) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PROJECT_NOT_FOUND", `Project not found: ${projectId}`, { project_id: projectId });
+  }
+  const [tasks, projectPlans] = await Promise.all([
+    store.tasks.list({ plan_id: plan.id, include_subtasks: true, include_archived: true }),
+    store.plans.list(project.id)
+  ]);
+  const collision = projectPlans.find((candidate) => candidate.id !== plan.id && candidate.slug !== null && candidate.slug === plan.slug);
+  if (collision) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_SCOPE_COLLISION", "Another plan already owns this slug in the destination project", { plan_id: plan.id, project_id: project.id, conflicting_plan_id: collision.id, slug: plan.slug });
+  }
+  return {
+    plan,
+    project,
+    tasks: tasks.sort((left, right) => left.id.localeCompare(right.id))
+  };
+}
+async function planPlanProjectLink(store, planId, projectId) {
+  const state = await exactPlanProjectLinkState(store, planId, projectId);
+  const alreadyLinked = state.plan.project_id === state.project.id && state.tasks.every((task2) => task2.project_id === state.project.id);
+  return {
+    mode: "plan",
+    action: alreadyLinked ? "already_linked" : "would_link",
+    ...state,
+    receipt: null
+  };
+}
+async function applyPlanProjectLink(store, planId, projectId, options) {
+  if (!store.planProjectLinks) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_UNSUPPORTED", "This storage backend cannot atomically link an existing plan and its tasks", { storage_kind: store.kind });
+  }
+  const key = normalizePlanProjectLinkIdempotencyKey(options.idempotency_key);
+  return store.planProjectLinks.apply({
+    plan_id: planId,
+    project_id: projectId,
+    expected_plan_revision: options.expected_plan_revision,
+    expected_project_revision: options.expected_project_revision,
+    idempotency_key: key,
+    receipt_id: planProjectLinkReceiptId(key),
+    created_at: new Date().toISOString()
+  });
+}
+async function rollbackPlanProjectLink(store, planId, projectId, options) {
+  if (!store.planProjectLinks) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_UNSUPPORTED", "This storage backend cannot atomically roll back an existing plan project link", { storage_kind: store.kind });
+  }
+  return store.planProjectLinks.rollback({
+    plan_id: planId,
+    project_id: projectId,
+    receipt_id: options.receipt_id,
+    expected_plan_revision: options.expected_plan_revision,
+    rollback_receipt_id: planProjectLinkRollbackReceiptId(options.receipt_id),
+    restored_at: new Date().toISOString()
+  });
+}
+var init_plan_project_link = __esm(() => {
+  init_plan_project_link_contract();
+  init_plan_project_link_contract();
+});
+
 // src/server/v1.ts
 var exports_v1 = {};
 __export(exports_v1, {
@@ -52655,6 +54732,21 @@ function enumQueryParam(url, name, vocabulary) {
     return { ok: false, response: error(400, result.message) };
   return { ok: true, value: collapseEnumValues(result.values) };
 }
+function parseSinceCursor(raw) {
+  const shape = `updated_after must be an RFC 3339 date-time with an explicit offset, ` + `e.g. 2026-08-07T12:00:00Z or 2026-08-07T12:00:00+03:00; got ${JSON.stringify(raw)}`;
+  const match = RFC3339_DATE_TIME.exec(raw);
+  if (!match)
+    return { ok: false, message: shape };
+  const parsed = Date.parse(raw);
+  if (Number.isNaN(parsed))
+    return { ok: false, message: shape };
+  const [, year, month, day] = match;
+  const probe = new Date(Date.UTC(Number(year), Number(month) - 1, Number(day)));
+  if (probe.getUTCFullYear() !== Number(year) || probe.getUTCMonth() !== Number(month) - 1 || probe.getUTCDate() !== Number(day)) {
+    return { ok: false, message: `updated_after names a date that does not exist: ${JSON.stringify(raw)}` };
+  }
+  return { ok: true, value: new Date(parsed).toISOString() };
+}
 function validateTaskCompletion(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "completion body must be an object" };
@@ -53064,7 +55156,13 @@ async function handleV1Request(req, url, dependencies = {}) {
           const priorityParam = enumQueryParam(url, "priority", TASK_PRIORITIES);
           if (!priorityParam.ok)
             return priorityParam.response;
+          const updatedAfterRaw = url.searchParams.get("updated_after");
+          const updatedAfter = updatedAfterRaw === null ? null : parseSinceCursor(updatedAfterRaw);
+          if (updatedAfter !== null && !updatedAfter.ok) {
+            return error(400, updatedAfter.message);
+          }
           const filter = {
+            ...updatedAfter !== null && updatedAfter.ok ? { updated_after: updatedAfter.value } : {},
             ...url.searchParams.get("q") ? { query: url.searchParams.get("q") } : {},
             ...statusParam.value !== undefined ? { status: statusParam.value } : {},
             ...priorityParam.value !== undefined ? { priority: priorityParam.value } : {},
@@ -53420,6 +55518,52 @@ async function handleV1Request(req, url, dependencies = {}) {
         }
         return error(405, `method ${method} not allowed on /v1/projects`);
       }
+      if (action === "task-list" && subId === "ensure") {
+        if (method === "GET") {
+          return json4(await planProjectTaskListEnsure(store, id));
+        }
+        if (method !== "POST") {
+          return error(405, `method ${method} not allowed on /v1/projects/:id/task-list/ensure`);
+        }
+        const body = await readJson3(req);
+        if (!body)
+          return error(400, "invalid JSON body");
+        const unknown = Object.keys(body).find((key) => !["expected_project_revision", "idempotency_key"].includes(key));
+        if (unknown)
+          return error(400, `unknown task-list ensure field: ${unknown}`);
+        if (typeof body.expected_project_revision !== "string" || !body.expected_project_revision.trim()) {
+          return error(400, "expected_project_revision must be a non-empty string from a fresh ensure plan");
+        }
+        if (body.idempotency_key !== undefined && typeof body.idempotency_key !== "string") {
+          return error(400, "idempotency_key must be a string");
+        }
+        const result = await applyProjectTaskListEnsure(store, id, {
+          expected_project_revision: body.expected_project_revision,
+          ...typeof body.idempotency_key === "string" ? { idempotency_key: body.idempotency_key } : {}
+        });
+        return json4(result, result.action === "created" ? 201 : 200);
+      }
+      if (action === "task-list" && subId === "rollback") {
+        if (method !== "POST") {
+          return error(405, `method ${method} not allowed on /v1/projects/:id/task-list/rollback`);
+        }
+        const body = await readJson3(req);
+        if (!body)
+          return error(400, "invalid JSON body");
+        const unknown = Object.keys(body).find((key) => !["receipt_id", "expected_task_list_revision"].includes(key));
+        if (unknown)
+          return error(400, `unknown task-list rollback field: ${unknown}`);
+        if (typeof body.receipt_id !== "string" || !body.receipt_id.trim()) {
+          return error(400, "receipt_id must be a non-empty string");
+        }
+        if (typeof body.expected_task_list_revision !== "string" || !body.expected_task_list_revision.trim()) {
+          return error(400, "expected_task_list_revision must be a non-empty string from the accepted receipt");
+        }
+        return json4(await rollbackProjectTaskListEnsure(store, id, {
+          receipt_id: body.receipt_id,
+          expected_task_list_revision: body.expected_task_list_revision
+        }));
+      }
       if (action === "rename") {
         if (method !== "POST")
           return error(405, `method ${method} not allowed on /v1/projects/:id/rename`);
@@ -53480,6 +55624,54 @@ async function handleV1Request(req, url, dependencies = {}) {
         const plan = await store.plans.create(validated.input, contextFromPrincipal(principal, validated.input));
         return json4({ plan }, 201);
       }
+      if (id && action === "project-link" && !subId) {
+        if (method === "GET") {
+          const projectId = url.searchParams.get("project_id");
+          if (!projectId?.trim())
+            return error(400, "project_id query parameter is required");
+          return json4(await planPlanProjectLink(store, id, projectId));
+        }
+        if (method !== "POST")
+          return error(405, `method ${method} not allowed on /v1/plans/:id/project-link`);
+        const body = await readJson3(req);
+        if (!body)
+          return error(400, "invalid JSON body");
+        const allowed = new Set(["project_id", "expected_plan_revision", "expected_project_revision", "idempotency_key"]);
+        const unknown = Object.keys(body).find((key) => !allowed.has(key));
+        if (unknown)
+          return error(400, `unknown plan-project-link field: ${unknown}`);
+        for (const field of ["project_id", "expected_plan_revision", "expected_project_revision", "idempotency_key"]) {
+          if (typeof body[field] !== "string" || !body[field].trim()) {
+            return error(400, `${field} must be a non-empty string`);
+          }
+        }
+        const result = await applyPlanProjectLink(store, id, body.project_id, {
+          expected_plan_revision: body.expected_plan_revision,
+          expected_project_revision: body.expected_project_revision,
+          idempotency_key: body.idempotency_key
+        });
+        return json4(result, result.action === "linked" ? 201 : 200);
+      }
+      if (id && action === "project-link" && subId === "rollback") {
+        if (method !== "POST")
+          return error(405, `method ${method} not allowed on /v1/plans/:id/project-link/rollback`);
+        const body = await readJson3(req);
+        if (!body)
+          return error(400, "invalid JSON body");
+        const allowed = new Set(["project_id", "receipt_id", "expected_plan_revision"]);
+        const unknown = Object.keys(body).find((key) => !allowed.has(key));
+        if (unknown)
+          return error(400, `unknown plan-project-link rollback field: ${unknown}`);
+        for (const field of ["project_id", "receipt_id", "expected_plan_revision"]) {
+          if (typeof body[field] !== "string" || !body[field].trim()) {
+            return error(400, `${field} must be a non-empty string`);
+          }
+        }
+        return json4(await rollbackPlanProjectLink(store, id, body.project_id, {
+          receipt_id: body.receipt_id,
+          expected_plan_revision: body.expected_plan_revision
+        }));
+      }
       if (id && method === "GET") {
         const plan = await store.plans.get(id);
         return plan ? json4({ plan }) : error(404, "plan not found");
@@ -53758,6 +55950,14 @@ async function handleV1Request(req, url, dependencies = {}) {
     }
     return error(404, `unknown /v1 resource: ${resource ?? "(root)"}`);
   } catch (e) {
+    if (e instanceof PlanProjectLinkError) {
+      const status = e.code === "PLAN_PROJECT_LINK_PLAN_NOT_FOUND" || e.code === "PLAN_PROJECT_LINK_PROJECT_NOT_FOUND" || e.code === "PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND" ? 404 : e.code === "PLAN_PROJECT_LINK_IDEMPOTENCY_KEY_INVALID" ? 400 : e.code === "PLAN_PROJECT_LINK_UNSUPPORTED" ? 501 : 409;
+      return error(status, e.message, { code: e.code, conflict: status === 409, ...e.details });
+    }
+    if (e instanceof ProjectTaskListEnsureError) {
+      const status = e.code === "PROJECT_NOT_FOUND" || e.code === "PROJECT_TASK_LIST_RECEIPT_NOT_FOUND" ? 404 : e.code === "PROJECT_TASK_LIST_IDEMPOTENCY_KEY_INVALID" ? 400 : 409;
+      return error(status, e.message, { code: e.code, conflict: status === 409, ...e.details });
+    }
     if (e instanceof TaskReferenceAmbiguousError) {
       return error(409, e.message, {
         code: TaskReferenceAmbiguousError.code,
@@ -53777,14 +55977,17 @@ async function handleV1Request(req, url, dependencies = {}) {
     return error(500, e.message || "internal error");
   }
 }
-var JSON_HEADERS3, DEFAULT_COMMENT_PAGE_SIZE = 100, MAX_COMMENT_PAGE_SIZE = 500, LEGACY_COMMENT_RESPONSE_LIMIT = 500;
+var JSON_HEADERS3, DEFAULT_COMMENT_PAGE_SIZE = 100, MAX_COMMENT_PAGE_SIZE = 500, LEGACY_COMMENT_RESPONSE_LIMIT = 500, RFC3339_DATE_TIME;
 var init_v1 = __esm(() => {
   init_types();
   init_cloud();
   init_pr_groups();
   init_project_registration();
   init_redaction();
+  init_project_task_list_ensure();
+  init_plan_project_link();
   JSON_HEADERS3 = { "Content-Type": "application/json" };
+  RFC3339_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})[Tt]\d{2}:\d{2}:\d{2}(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
 });
 
 // src/pr-groups/sqlite.ts