archctx 0.2.0 → 0.2.2

package/bin/archctx.mjs

@@ -702,7 +702,7 @@ function productVersionManifest() {
     }
   };
 }
-var ARCHCONTEXT_PRODUCT_NAME = "archctx", ARCHCONTEXT_PRODUCT_VERSION = "0.2.0", ARCHCONTEXT_PACKAGE_MANAGER = "bun@1.3.10", ARCHCONTEXT_NODE_RANGE = ">=24 <26", LOCAL_RUNTIME_RPC_SCHEMA_VERSION = "archcontext.runtime-rpc/v1", ARCHCONTEXT_SCHEMA_SET_VERSION = "2026-06-25.al0-ledger";
+var ARCHCONTEXT_PRODUCT_NAME = "archctx", ARCHCONTEXT_PRODUCT_VERSION = "0.2.2", ARCHCONTEXT_PACKAGE_MANAGER = "bun@1.3.10", ARCHCONTEXT_NODE_RANGE = ">=24 <26", LOCAL_RUNTIME_RPC_SCHEMA_VERSION = "archcontext.runtime-rpc/v1", ARCHCONTEXT_SCHEMA_SET_VERSION = "2026-06-25.al0-ledger";
 // packages/contracts/src/index.ts
 var init_src = __esm(() => {
   init_control_plane_routes();
@@ -5145,7 +5145,7 @@ var init_src7 = __esm(() => {
 
 // packages/surfaces/cli/src/main.ts
 import { execFileSync as execFileSync8, spawn as spawn2, spawnSync as spawnSync3 } from "child_process";
-import { accessSync, chmodSync as chmodSync5, closeSync as closeSync7, constants, existsSync as existsSync14, mkdirSync as mkdirSync9, openSync as openSync7, readFileSync as readFileSync13, rmSync as rmSync10, statSync as statSync8, writeFileSync as writeFileSync8 } from "fs";
+import { accessSync, chmodSync as chmodSync5, closeSync as closeSync7, constants, existsSync as existsSync15, mkdirSync as mkdirSync9, openSync as openSync7, readFileSync as readFileSync13, rmSync as rmSync10, statSync as statSync8, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname10, join as join10, resolve as resolve17 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
@@ -7493,7 +7493,7 @@ function planYamlToArchitectureLedgerImport(input) {
     payloadVersion: "archcontext.architecture-ledger-yaml-import/v1",
     repository: input.repository,
     worktree: input.worktree,
-    baseDigest: sourceDigest,
+    baseDigest: architectureLedgerStateDigest(emptyArchitectureLedgerState()),
     resultingDigest: graphDigest,
     headSha: input.worktree.headSha,
     actor: { kind: "migration", id: "archctx-ledger-yaml-import" },
@@ -7677,8 +7677,6 @@ function planYamlToArchitectureLedgerRebuild(input) {
   const plan = planYamlToArchitectureLedgerImport(input);
   const previousGraphDigest = architectureLedgerStateDigest(input.previousState);
   const deleteOperations = architectureLedgerDeletionOperations(input.previousState, plan.state);
-  if (deleteOperations.length === 0)
-    return plan;
   const payload = architectureLedgerPayload(plan.event);
   const event = normalizeArchitectureLedgerEvent({
     ...plan.event,
@@ -8244,41 +8242,41 @@ function projectArchitectureLedgerStateToYamlFiles(state) {
   const canonical = canonicalArchitectureLedgerState(state);
   const files = [
     ...canonical.entities.map((entity) => {
+      const declared = declaredProjectionRecord(entity.metadata, ["archcontext.node/v1"], `entity ${entity.entityId}`);
+      const summary = entity.summary;
+      if (!summary)
+        throw new Error(`architecture-ledger-projection-invalid: entity ${entity.entityId} requires summary`);
       const body = canonicalArchitectureYaml({
+        ...declared,
         schemaVersion: "archcontext.node/v1",
         id: entity.entityId,
         kind: entity.kind,
         name: entity.canonicalName,
         status: entity.status,
-        ...entity.path ? { path: entity.path } : {},
-        ...entity.summary ? { summary: entity.summary } : {},
-        ...entity.metadata ? { metadata: entity.metadata } : {}
+        summary
       });
       return projectionFile(`.archcontext/model/nodes/${pathSegment(entity.entityId)}.yaml`, body, "entity", entity.entityId);
     }),
     ...canonical.relations.map((relation) => {
-      const body = canonicalArchitectureYaml({
+      const declared = declaredProjectionRecord(relation.metadata, ["archcontext.relation/v1", "archcontext.cross-repo-relation/v1"], `relation ${relation.relationId}`);
+      const schemaVersion = requireStringField(declared, "schemaVersion", `relation ${relation.relationId}`);
+      const body = schemaVersion === "archcontext.cross-repo-relation/v1" ? canonicalArchitectureYaml({ ...declared, id: relation.relationId, kind: relation.kind }) : canonicalArchitectureYaml({
+        ...declared,
         schemaVersion: "archcontext.relation/v1",
         id: relation.relationId,
         kind: relation.kind,
         source: relation.sourceEntityId,
-        target: relation.targetEntityId,
-        status: relation.status,
-        ...relation.summary ? { summary: relation.summary } : {},
-        ...relation.metadata ? { metadata: relation.metadata } : {}
+        target: relation.targetEntityId
       });
       return projectionFile(`.archcontext/model/relations/${pathSegment(relation.relationId)}.yaml`, body, "relation", relation.relationId);
     }),
     ...canonical.constraints.map((constraint) => {
+      const declared = declaredProjectionRecord(constraint.metadata, ["archcontext.constraint/v1"], `constraint ${constraint.constraintId}`);
       const body = canonicalArchitectureYaml({
+        ...declared,
         schemaVersion: "archcontext.constraint/v1",
         id: constraint.constraintId,
-        kind: constraint.kind,
-        subject: constraint.subjectId,
-        status: constraint.status,
-        ...constraint.severity ? { severity: constraint.severity } : {},
-        ...constraint.summary ? { summary: constraint.summary } : {},
-        ...constraint.metadata ? { metadata: constraint.metadata } : {}
+        ...constraint.severity ? { severity: constraint.severity } : {}
       });
       return projectionFile(`.archcontext/model/constraints/${pathSegment(constraint.constraintId)}.yaml`, body, "constraint", constraint.constraintId);
     })
@@ -8453,12 +8451,11 @@ function yamlRecordToLedgerOperation(value, path, schemaVersion) {
     const entityId = requireStringField(value, "id", path);
     const entity = {
       entityId,
-      kind: stringField(value, "kind") ?? "component",
-      canonicalName: stringField(value, "name") ?? stringField(value, "canonicalName") ?? entityId,
-      status: activeStatus(value.status),
-      ...stringField(value, "path") ? { path: stringField(value, "path") } : {},
-      ...stringField(value, "summary") ? { summary: stringField(value, "summary") } : {},
-      ...metadataField(value, ["schemaVersion", "id", "kind", "name", "canonicalName", "status", "path", "summary"])
+      kind: requireStringField(value, "kind", path),
+      canonicalName: requireStringField(value, "name", path),
+      status: declaredStatus(value.status, path),
+      summary: requireStringField(value, "summary", path),
+      metadata: { declared: value }
     };
     return { operation: { op: "upsert_entity", entity }, targetKind: "entity", targetId: entityId };
   }
@@ -8466,12 +8463,12 @@ function yamlRecordToLedgerOperation(value, path, schemaVersion) {
     const relationId = requireStringField(value, "id", path);
     const relation = {
       relationId,
-      kind: stringField(value, "kind") ?? "depends_on",
+      kind: requireStringField(value, "kind", path),
       sourceEntityId: requireStringField(value, "source", path),
       targetEntityId: requireStringField(value, "target", path),
-      status: activeStatus(value.status),
-      ...stringField(value, "summary") ?? stringField(value, "intent") ? { summary: stringField(value, "summary") ?? stringField(value, "intent") } : {},
-      ...metadataField(value, ["schemaVersion", "id", "kind", "source", "target", "status", "summary", "intent"])
+      status: "active",
+      summary: requireStringField(value, "intent", path),
+      metadata: { declared: value }
     };
     return { operation: { op: "upsert_relation", relation }, targetKind: "relation", targetId: relationId };
   }
@@ -8481,25 +8478,28 @@ function yamlRecordToLedgerOperation(value, path, schemaVersion) {
     const target = repoScopedTarget(value.target, path, "target");
     const relation = {
       relationId,
-      kind: stringField(value, "kind") ?? "depends_on",
+      kind: requireStringField(value, "kind", path),
       sourceEntityId: source,
       targetEntityId: target,
-      status: activeStatus(value.status),
-      ...stringField(value, "intent") ? { summary: stringField(value, "intent") } : {},
-      ...metadataField(value, ["schemaVersion", "id", "kind", "source", "target", "status", "intent"])
+      status: "active",
+      summary: requireStringField(value, "intent", path),
+      metadata: { declared: value }
     };
     return { operation: { op: "upsert_relation", relation }, targetKind: "relation", targetId: relationId };
   }
   if (schemaVersion === "archcontext.constraint/v1") {
     const constraintId = requireStringField(value, "id", path);
+    const scope = requiredRecordField(value, "scope", path);
+    const rule = requiredRecordField(value, "rule", path);
+    const subjectId = firstStringArrayValue(scope.nodes) ?? firstStringArrayValue(scope.relations) ?? "repository";
     const constraint = {
       constraintId,
-      kind: stringField(value, "kind") ?? "constraint",
-      subjectId: stringField(value, "subject") ?? stringField(value, "subjectId") ?? "repository",
-      status: activeStatus(value.status),
-      ...severityField(value.severity) ? { severity: severityField(value.severity) } : {},
-      ...stringField(value, "summary") ? { summary: stringField(value, "summary") } : {},
-      ...metadataField(value, ["schemaVersion", "id", "kind", "subject", "subjectId", "status", "severity", "summary"])
+      kind: requireStringField(rule, "type", path),
+      subjectId,
+      status: "active",
+      severity: requiredSeverity(value.severity, path),
+      summary: requireStringField(value, "rationale", path),
+      metadata: { declared: value }
     };
     return { operation: { op: "upsert_constraint", constraint }, targetKind: "constraint", targetId: constraintId };
   }
@@ -8636,19 +8636,30 @@ function isEvidenceOnlySchema(schemaVersion) {
 function isGeneratedProjectionFile(file) {
   return file.schemaVersion === "archcontext.generated/v1" || file.path === ".archcontext/generated" || file.path.startsWith(".archcontext/generated/") || file.body.includes("Generated by ArchContext");
 }
-function metadataField(value, omitted) {
-  const metadata = {};
-  const explicit = value.metadata;
-  if (isRecord(explicit)) {
-    for (const key of Object.keys(explicit).sort())
-      metadata[key] = explicit[key];
+function declaredProjectionRecord(metadata, allowedSchemaVersions, label) {
+  const declared = metadata?.declared;
+  if (!isRecord(declared))
+    throw new Error(`architecture-ledger-projection-invalid: ${label} has no declared YAML record`);
+  const schemaVersion = requireStringField(declared, "schemaVersion", label);
+  if (!allowedSchemaVersions.includes(schemaVersion)) {
+    throw new Error(`architecture-ledger-projection-invalid: ${label} has unsupported declared schema ${schemaVersion}`);
   }
-  for (const key of Object.keys(value).sort()) {
-    if (omitted.includes(key) || key === "metadata")
-      continue;
-    metadata[key] = value[key];
-  }
-  return Object.keys(metadata).length === 0 ? {} : { metadata };
+  return declared;
+}
+function requiredRecordField(value, key, path) {
+  const field = value[key];
+  if (!isRecord(field))
+    throw new Error(`${path}: ${key} is required`);
+  return field;
+}
+function firstStringArrayValue(value) {
+  return Array.isArray(value) ? value.find((item) => typeof item === "string" && item.length > 0) : undefined;
+}
+function requiredSeverity(value, path) {
+  const severity = severityField(value);
+  if (!severity)
+    throw new Error(`${path}: severity is required`);
+  return severity;
 }
 function declaredYamlSubject(value, path) {
   const id = stringField(value, "id");
@@ -8681,8 +8692,10 @@ function requireStringField(value, key, path) {
 function stringField(value, key) {
   return typeof value[key] === "string" ? value[key] : undefined;
 }
-function activeStatus(value) {
-  return value === "deprecated" || value === "removed" ? value : "active";
+function declaredStatus(value, path) {
+  if (value === "active" || value === "planned" || value === "deprecated" || value === "removed")
+    return value;
+  throw new Error(`${path}: status is required`);
 }
 function severityField(value) {
   return value === "notice" || value === "warning" || value === "error" || value === "critical" ? value : undefined;
@@ -8768,10 +8781,85 @@ function validateArchitectureLedgerEvent(event) {
   if (event.worktree.workspaceId.length === 0 || event.worktree.storageWorkspaceId.length === 0 || event.worktree.headSha.length === 0) {
     throw new Error(`architecture-ledger-invalid-event: worktree identity required for ${event.eventId}`);
   }
+  assertArchitectureLedgerPersistenceSafe(event.payload, `event.payload for ${event.eventId}`);
+  if (event.extensions)
+    assertArchitectureLedgerPersistenceSafe(event.extensions, `event.extensions for ${event.eventId}`);
+  assertArchitectureLedgerPersistenceSafe(event.provenance, `event.provenance for ${event.eventId}`);
   const payload = architectureLedgerPayload(event);
   for (const operation of payload.operations ?? [])
     validateArchitectureLedgerOperation(operation, event.eventId);
 }
+var ARCHITECTURE_LEDGER_MAX_PERSISTED_JSON_BYTES = 262144;
+var ARCHITECTURE_LEDGER_MAX_PERSISTED_STRING_BYTES = 8192;
+var ARCHITECTURE_LEDGER_MAX_PERSISTED_DEPTH = 32;
+var ARCHITECTURE_LEDGER_FORBIDDEN_RAW_KEYS = new Set([
+  "rawsource",
+  "sourcebody",
+  "sourcecode",
+  "rawdiff",
+  "diffbody",
+  "rawpatch",
+  "patchbody",
+  "prompt",
+  "promptbody",
+  "completion",
+  "completionbody",
+  "codegraphoutput",
+  "fullcodegraphoutput",
+  "webhookbody",
+  "rawwebhook",
+  "secret",
+  "secrets",
+  "credential",
+  "credentials",
+  "privatekey",
+  "accesstoken",
+  "refreshtoken"
+]);
+var ARCHITECTURE_LEDGER_SAFE_SENSITIVE_KEY_SUFFIX = /(?:digest|id|ids|count|counts|ref|refs|path|paths|persisted)$/;
+var ARCHITECTURE_LEDGER_FORBIDDEN_STRING_PATTERNS = [
+  /diff --git /,
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+  /\bgh[pousr]_[A-Za-z0-9]{20,}\b/,
+  /\bsk-[A-Za-z0-9_-]{20,}\b/,
+  /\bAKIA[A-Z0-9]{16}\b/,
+  /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/i,
+  /\b(?:api[_-]?key|secret|token|password|private[_-]?key)\s*[:=]\s*["']?[^\s"',;]{8,}/i
+];
+function assertArchitectureLedgerPersistenceSafe(value, label = "architecture-ledger-value") {
+  const encoded = JSON.stringify(value);
+  if (Buffer2.byteLength(encoded, "utf8") > ARCHITECTURE_LEDGER_MAX_PERSISTED_JSON_BYTES) {
+    throw new Error(`architecture-ledger-privacy-denied: persisted JSON exceeds size limit at ${label}`);
+  }
+  visit(value, label, 0);
+  function visit(current, path, depth) {
+    if (depth > ARCHITECTURE_LEDGER_MAX_PERSISTED_DEPTH) {
+      throw new Error(`architecture-ledger-privacy-denied: persisted JSON exceeds depth limit at ${path}`);
+    }
+    if (typeof current === "string") {
+      if (Buffer2.byteLength(current, "utf8") > ARCHITECTURE_LEDGER_MAX_PERSISTED_STRING_BYTES) {
+        throw new Error(`architecture-ledger-privacy-denied: persisted string exceeds size limit at ${path}`);
+      }
+      if (ARCHITECTURE_LEDGER_FORBIDDEN_STRING_PATTERNS.some((pattern) => pattern.test(current))) {
+        throw new Error(`architecture-ledger-privacy-denied: forbidden raw or secret-shaped content at ${path}`);
+      }
+      return;
+    }
+    if (current === null || typeof current !== "object")
+      return;
+    if (Array.isArray(current)) {
+      current.forEach((item, index) => visit(item, `${path}[${index}]`, depth + 1));
+      return;
+    }
+    for (const [key, child] of Object.entries(current)) {
+      const normalizedKey = key.replace(/[-_]/g, "").toLowerCase();
+      if (ARCHITECTURE_LEDGER_FORBIDDEN_RAW_KEYS.has(normalizedKey) && !ARCHITECTURE_LEDGER_SAFE_SENSITIVE_KEY_SUFFIX.test(normalizedKey)) {
+        throw new Error(`architecture-ledger-privacy-denied: forbidden persisted field at ${path}.${key}`);
+      }
+      visit(child, `${path}.${key}`, depth + 1);
+    }
+  }
+}
 function validateArchitectureLedgerOperation(operation, eventId) {
   if (!operation || typeof operation !== "object" || !("op" in operation)) {
     throw new Error(`architecture-ledger-invalid-operation: ${eventId}`);
@@ -8894,7 +8982,7 @@ function requireNonEmpty(value, label, eventId) {
   }
 }
 function requireActiveStatus(value, eventId) {
-  if (!["active", "deprecated", "removed"].includes(value)) {
+  if (!["active", "planned", "deprecated", "removed"].includes(value)) {
     throw new Error(`architecture-ledger-invalid-operation: invalid status for ${eventId}`);
   }
 }
@@ -8943,6 +9031,7 @@ var REQUIRED_LOCAL_STORE_TABLES = [
 ];
 var SQLITE_PRAGMAS = [
   "PRAGMA journal_mode = WAL",
+  "PRAGMA synchronous = FULL",
   "PRAGMA foreign_keys = ON",
   "PRAGMA busy_timeout = 5000"
 ];
@@ -9464,6 +9553,13 @@ var LOCAL_SQLITE_MIGRATIONS = [
       )`,
       "CREATE INDEX IF NOT EXISTS idx_audit_runs_status ON audit_runs(storage_repository_id, storage_workspace_id, status)"
     ]
+  },
+  {
+    id: "0011_changeset_cleanup_cursor",
+    statements: [
+      "ALTER TABLE changeset_journal ADD COLUMN cleanup_completed_at TEXT",
+      "CREATE INDEX IF NOT EXISTS idx_changeset_journal_cleanup_pending ON changeset_journal(status, cleanup_completed_at, updated_at)"
+    ]
   }
 ];
 var ARCHCONTEXT_STATE_DIR_ENV = "ARCHCONTEXT_STATE_DIR";
@@ -10041,17 +10137,18 @@ function readHeadSha(root) {
 // packages/local-runtime/runtime-daemon/src/index.ts
 import { randomBytes } from "node:crypto";
 import { execFileSync as execFileSync6 } from "node:child_process";
-import { chmodSync as chmodSync3, closeSync as closeSync5, existsSync as existsSync12, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, openSync as openSync5, readdirSync as readdirSync8, readFileSync as readFileSync11, rmSync as rmSync8, statSync as statSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync as chmodSync3, closeSync as closeSync5, existsSync as existsSync13, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, openSync as openSync5, readdirSync as readdirSync8, readFileSync as readFileSync11, rmSync as rmSync8, statSync as statSync6, writeFileSync as writeFileSync6 } from "node:fs";
 import { createServer } from "node:http";
 import { tmpdir as tmpdir3 } from "node:os";
 import { dirname as dirname8, join as join8, resolve as resolve15 } from "node:path";
 
 // packages/core/changeset-engine/src/index.ts
 init_src();
-import { closeSync as closeSync3, existsSync as existsSync4, fsyncSync as fsyncSync2, lstatSync as lstatSync2, mkdirSync as mkdirSync3, openSync as openSync3, readFileSync as readFileSync5, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { closeSync as closeSync3, existsSync as existsSync5, fsyncSync as fsyncSync2, lstatSync as lstatSync2, mkdirSync as mkdirSync3, openSync as openSync3, readFileSync as readFileSync5, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname3, resolve as resolve7 } from "node:path";
 
 // packages/core/policy-engine/src/index.ts
+import { existsSync as existsSync4, realpathSync as realpathSync5 } from "node:fs";
 import { isAbsolute as isAbsolute3, relative as relative4, resolve as resolve6, sep as sep3 } from "node:path";
 init_src();
 var INVALID_COMPAT_REASONS = new Set(["just in case", "safer to keep", "many internal callers", "large diff", "old code already exists"]);
@@ -10062,6 +10159,7 @@ var ALLOWLIST = [
   ".archcontext/practices/",
   ".archcontext/waivers/",
   ".archcontext/decisions/",
+  ".archcontext/backups/",
   ".archcontext/generated/",
   "docs/architecture/"
 ];
@@ -10098,6 +10196,21 @@ function assertAllowedArchContextPath(root, relativePath) {
   if (targetFromRoot === "" || targetFromRoot === ".." || targetFromRoot.startsWith(`..${sep3}`) || isAbsolute3(targetFromRoot)) {
     throw new Error(`Path escapes repository: ${relativePath}`);
   }
+  if (!existsSync4(absoluteRoot))
+    return;
+  const canonicalRoot = realpathSync5.native(absoluteRoot);
+  let existingAncestor = absoluteTarget;
+  while (!existsSync4(existingAncestor)) {
+    const parent = resolve6(existingAncestor, "..");
+    if (parent === existingAncestor)
+      throw new Error(`Path has no existing repository ancestor: ${relativePath}`);
+    existingAncestor = parent;
+  }
+  const canonicalAncestor = realpathSync5.native(existingAncestor);
+  const ancestorFromRoot = relative4(canonicalRoot, canonicalAncestor);
+  if (ancestorFromRoot === ".." || ancestorFromRoot.startsWith(`..${sep3}`) || isAbsolute3(ancestorFromRoot)) {
+    throw new Error(`Path escapes repository through symlink: ${relativePath}`);
+  }
 }
 function evaluateChangeSetPaths(root, paths) {
   const findings = [];
@@ -10157,6 +10270,7 @@ class ChangeSetEngine {
     if (!approved)
       throw new Error("ChangeSet must be approved before apply");
     const deps = this.requireDeps();
+    await this.validateModel(root, draft, deps, "before");
     const backups = [];
     const journalId = await deps.journal?.beginChangeSet(root, draft);
     let journalCommitted = false;
@@ -10171,10 +10285,7 @@ class ChangeSetEngine {
               if (options.faultAfterOperations && applied >= options.faultAfterOperations)
                 throw new Error("fault-injection");
             }
-          } else {
-            this.rebuildGeneratedProjection(root, deps);
-            applied += 1;
-          }
+          } else {}
           if (options.faultAfterOperations && applied >= options.faultAfterOperations)
             throw new Error("fault-injection");
           continue;
@@ -10186,15 +10297,24 @@ class ChangeSetEngine {
         if (options.faultAfterOperations && applied >= options.faultAfterOperations)
           throw new Error("fault-injection");
       }
-      this.rebuildGeneratedProjection(root, deps);
-      await this.validateModel(root, draft, deps);
-      await options.afterModelValidatedBeforeCommit?.({ root, draft, journalId });
-      if (journalId) {
+      for (const projection of deps.projection.planGeneratedProjection(root)) {
+        await this.applyFileOperation(root, projection.path, projection.expectedHash, projection.body, projection.operation, backups, journalId, applied + 1);
+        applied += 1;
+        if (options.faultAfterOperations && applied >= options.faultAfterOperations)
+          throw new Error("fault-injection");
+      }
+      await this.validateModel(root, draft, deps, "after");
+      const commit = await options.afterModelValidatedBeforeCommit?.({ root, draft, journalId });
+      if (commit?.journalCommitted)
+        journalCommitted = true;
+      if (journalId && !journalCommitted) {
         await deps.journal?.commitChangeSet(journalId);
         journalCommitted = true;
       }
       try {
         cleanupBackups(backups);
+        if (journalId)
+          await deps.journal?.completeChangeSetCleanup(journalId);
       } catch {}
       const appliedDraft = { ...draft, status: "applied" };
       this.states.set(draft.id, appliedDraft);
@@ -10210,11 +10330,11 @@ class ChangeSetEngine {
       throw error;
     }
   }
-  rebuildGeneratedProjection(root, deps) {
-    deps.projection.rebuildGeneratedProjection(root);
-  }
-  async validateModel(root, draft, deps) {
-    await deps.modelStore.validateModel({ root, repositoryId: draft.reason.taskSessionId, headSha: draft.base.headSha });
+  async validateModel(root, draft, deps, phase) {
+    const result = await deps.modelStore.validateModel({ root, repositoryId: draft.reason.taskSessionId, headSha: draft.base.headSha });
+    if (!result.valid) {
+      throw new Error(`ChangeSet model validation failed ${phase} apply: ${result.errors.join("; ") || "unknown validation error"}`);
+    }
   }
   requireDeps() {
     if (!this.deps)
@@ -10225,19 +10345,16 @@ class ChangeSetEngine {
     assertSafeTarget(root, path);
     const deps = this.requireDeps();
     const absolute = resolve7(root, path);
-    const existed = existsSync4(absolute);
+    const existed = existsSync5(absolute);
     const backupPath = `${absolute}.archctx-backup`;
     const tempPath = operation === "delete_entity" ? undefined : `${absolute}.archctx-tmp-${process.pid}-${sequence}`;
-    if (existsSync4(backupPath))
+    if (existsSync5(backupPath))
       throw new Error(`Backup path already exists: ${path}`);
-    if (existed) {
+    if (existed)
       assertExpectedHash(absolute, expectedHash);
-      renameSync2(absolute, backupPath);
-      fsyncDirectory2(dirname3(absolute));
-    } else if (expectedHash !== "missing") {
+    else if (expectedHash !== "missing")
       throw new Error(`Expected missing file hash for new path: ${path}`);
-    }
-    backups.push({ path: absolute, backupPath, tempPath, existed });
+    const backup = { path: absolute, backupPath, tempPath, existed };
     if (journalId) {
       await deps.journal?.recordChangeSetFile(journalId, {
         path,
@@ -10247,6 +10364,11 @@ class ChangeSetEngine {
         operation
       });
     }
+    backups.push(backup);
+    if (existed) {
+      renameSync2(absolute, backupPath);
+      fsyncDirectory2(dirname3(absolute));
+    }
     if (operation === "delete_entity") {
       rmSync3(absolute, { force: true });
     } else {
@@ -10257,7 +10379,7 @@ class ChangeSetEngine {
 function assertSafeTarget(root, path) {
   assertAllowedArchContextPath(root, path);
   const absolute = resolve7(root, path);
-  if (existsSync4(absolute) && lstatSync2(absolute).isSymbolicLink()) {
+  if (existsSync5(absolute) && lstatSync2(absolute).isSymbolicLink()) {
     throw new Error(`Refusing to write symlink target: ${path}`);
   }
 }
@@ -10332,9 +10454,14 @@ function rollback(backups) {
   for (const backup of backups.reverse()) {
     if (backup.tempPath)
       rmSync3(backup.tempPath, { recursive: true, force: true });
-    rmSync3(backup.path, { recursive: true, force: true });
-    if (backup.existed && existsSync4(backup.backupPath))
-      renameSync2(backup.backupPath, backup.path);
+    if (backup.existed) {
+      if (existsSync5(backup.backupPath)) {
+        rmSync3(backup.path, { recursive: true, force: true });
+        renameSync2(backup.backupPath, backup.path);
+      }
+    } else {
+      rmSync3(backup.path, { recursive: true, force: true });
+    }
     fsyncDirectory2(dirname3(backup.path));
   }
 }
@@ -10540,7 +10667,7 @@ function digestSuffix2(digest) {
 }
 
 // packages/core/application/src/index.ts
-import { existsSync as existsSync7, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync8, statSync as statSync5 } from "node:fs";
 import { extname, resolve as resolve10 } from "node:path";
 
 // packages/core/context-compiler/src/index.ts
@@ -10548,7 +10675,7 @@ init_src();
 
 // packages/core/practice-catalog/src/index.ts
 init_src();
-import { existsSync as existsSync5, lstatSync as lstatSync3, readdirSync as readdirSync4, readFileSync as readFileSync6, realpathSync as realpathSync5 } from "node:fs";
+import { existsSync as existsSync6, lstatSync as lstatSync3, readdirSync as readdirSync4, readFileSync as readFileSync6, realpathSync as realpathSync6 } from "node:fs";
 import { dirname as dirname4, relative as relative5, resolve as resolve8, sep as sep4 } from "node:path";
 import { fileURLToPath } from "node:url";
 var PRACTICE_CATALOG_VERSION = "2026.06.0";
@@ -10797,7 +10924,7 @@ function loadProfileFiles(dir, errors) {
 }
 function loadRepoOverlayAssets(root, errors) {
   const overlayRoot = resolve8(root, ".archcontext/practices");
-  if (!existsSync5(overlayRoot))
+  if (!existsSync6(overlayRoot))
     return [];
   const out = [];
   for (const path of listDataFiles(overlayRoot, overlayRoot, errors)) {
@@ -11140,7 +11267,7 @@ function validateProfile(value, path, errors) {
   return invalid ? undefined : profile;
 }
 function listDataFiles(dir, allowedRoot, errors) {
-  if (!existsSync5(dir))
+  if (!existsSync6(dir))
     return [];
   const out = [];
   const rootReal = safeRealpath(allowedRoot);
@@ -11202,7 +11329,7 @@ function assertRealChild(root, path) {
 }
 function safeRealpath(path) {
   try {
-    return realpathSync5.native(path);
+    return realpathSync6.native(path);
   } catch {
     return resolve8(path);
   }
@@ -11773,7 +11900,7 @@ function checkResult(input, result) {
 }
 // packages/core/practice-engine/src/enforcement.ts
 init_src();
-import { existsSync as existsSync6, lstatSync as lstatSync4, readdirSync as readdirSync5, readFileSync as readFileSync7 } from "node:fs";
+import { existsSync as existsSync7, lstatSync as lstatSync4, readdirSync as readdirSync5, readFileSync as readFileSync7 } from "node:fs";
 import { basename as basename3, join as join4, relative as relative6, resolve as resolve9, sep as sep5 } from "node:path";
 var ENFORCEMENT_RANK = { advisory: 0, checkpoint: 1, complete: 2 };
 var POLICY_MODES = new Set(["advisory", "active", "fail-open", "fail-closed"]);
@@ -11798,7 +11925,7 @@ function shouldEvaluatePracticeEnforcement(policy) {
 }
 function loadPracticeEnforcementPolicy(root) {
   const path = resolve9(root, ".archcontext/policies/practices.yaml");
-  if (!existsSync6(path))
+  if (!existsSync7(path))
     return defaultPracticeEnforcementPolicy();
   assertRepoPolicyFile(root, path, ".archcontext/policies/practices.yaml");
   const parsed = parseJsonYamlFile(path);
@@ -11806,7 +11933,7 @@ function loadPracticeEnforcementPolicy(root) {
 }
 function loadPracticeWaivers(root) {
   const dir = resolve9(root, ".archcontext/waivers");
-  if (!existsSync6(dir))
+  if (!existsSync7(dir))
     return [];
   const stat = lstatSync4(dir);
   if (stat.isSymbolicLink())
@@ -11829,7 +11956,7 @@ function loadPracticeWaiverOwnerRegistry(root) {
   const modelDir = resolve9(root, ".archcontext/model/nodes");
   const sources = [];
   const subjects = [];
-  if (existsSync6(modelDir)) {
+  if (existsSync7(modelDir)) {
     if (lstatSync4(modelDir).isSymbolicLink())
       throw new Error("practice-owner-registry-symlink-denied");
     for (const path of collectFiles(root, ".archcontext/model/nodes")) {
@@ -13642,7 +13769,7 @@ function classifyCheckpointPath(root, path) {
   if (isGeneratedCheckpointPath(path))
     return "generated";
   const absolute = resolve10(root, path);
-  if (!existsSync7(absolute))
+  if (!existsSync8(absolute))
     return "deleted";
   try {
     if (!statSync5(absolute).isFile())
@@ -14848,8 +14975,14 @@ function uniqueSorted4(values) {
 
 // packages/core/projection-engine/src/index.ts
 init_src();
-import { existsSync as existsSync8, readdirSync as readdirSync6, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync9, readdirSync as readdirSync6, readFileSync as readFileSync8 } from "node:fs";
 import { basename as basename4, resolve as resolve11 } from "node:path";
+function nativeNodeSource(node) {
+  const value = node.source;
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return;
+  return value;
+}
 var ARCHITECTURE_DOCS_RENDERER_VERSION = "archcontext.docs-renderer/v1";
 var ARCHITECTURE_DOCS_GENERATED_BEGIN_PREFIX = "<!-- BEGIN ARCHCONTEXT:generated";
 var ARCHITECTURE_DOCS_GENERATED_END_PREFIX = "<!-- END ARCHCONTEXT:generated";
@@ -14885,12 +15018,6 @@ function renderArchitectureDocumentationProjection(input) {
   });
   const targets = rendered.map((file) => file.target);
   const expectedByPath = new Map(rendered.map((file) => [file.path, file]));
-  const drift = architectureDocumentationProjectionDrift({
-    targets,
-    expectedFiles: rendered,
-    existingFiles: input.existingFiles ?? []
-  });
-  const rejected = drift.diffs.filter((diff) => diff.reasonCode === "projection-ambiguous-ownership");
   const projectionDigest = digestJson({
     rendererVersion,
     sourceDigest: input.sourceDigest,
@@ -14901,6 +15028,38 @@ function renderArchitectureDocumentationProjection(input) {
       generatedBodyDigest: file.generatedBodyDigest
     })).sort((left, right) => left.path.localeCompare(right.path))
   });
+  const manifestValue = {
+    schemaVersion: "archcontext.architecture-docs-projection-manifest/v1",
+    rendererVersion,
+    sourceDigest: input.sourceDigest,
+    projectionDigest,
+    targetCount: targets.length,
+    fileCount: rendered.length,
+    targets: targets.map((target) => ({
+      targetId: target.targetId,
+      type: target.type,
+      scope: target.scope,
+      path: target.path,
+      ownership: target.ownership,
+      rendererVersion: target.rendererVersion,
+      format: target.format,
+      sourceDigest: target.sourceDigest,
+      outputDigest: target.outputDigest
+    }))
+  };
+  const manifest = {
+    path: "docs/architecture/.projection-manifest.json",
+    body: `${JSON.stringify(manifestValue, null, 2)}
+`,
+    digest: digestJson(manifestValue)
+  };
+  const drift = architectureDocumentationProjectionDrift({
+    targets,
+    expectedFiles: rendered,
+    expectedManifest: manifest,
+    existingFiles: input.existingFiles ?? []
+  });
+  const rejected = drift.diffs.filter((diff) => diff.reasonCode === "projection-ambiguous-ownership");
   return {
     schemaVersion: "archcontext.architecture-docs-projection-plan/v1",
     rendererVersion,
@@ -14908,6 +15067,7 @@ function renderArchitectureDocumentationProjection(input) {
     projectionDigest,
     targets,
     files: rendered.filter((file) => !rejected.some((diff) => diff.path === file.path && diff.targetId === file.target.targetId)),
+    manifest,
     drift: {
       ...drift,
       diffs: drift.diffs.map((diff) => ({
@@ -14938,7 +15098,7 @@ function architectureDocumentationSourceDigest(input) {
 }
 function loadArchitectureDecisionRecords(root) {
   const dir = resolve11(root, "docs/adr");
-  if (!existsSync8(dir))
+  if (!existsSync9(dir))
     return [];
   return readdirSync6(dir).filter((file) => /^ADR-\d{4}-.+\.md$/.test(file)).sort().map((file) => {
     const path = `docs/adr/${file}`;
@@ -14965,12 +15125,12 @@ function loadArchitectureDocumentationFiles(root) {
     "docs/architecture/.projection-manifest.json"
   ]) {
     const absolute = resolve11(root, entry);
-    if (existsSync8(absolute))
+    if (existsSync9(absolute))
       files.push({ path: entry, body: readFileSync8(absolute, "utf8") });
   }
   for (const dir of ["docs/architecture/modules", "docs/architecture/relations"]) {
     const absoluteDir = resolve11(root, dir);
-    if (!existsSync8(absoluteDir))
+    if (!existsSync9(absoluteDir))
       continue;
     for (const file of readdirSync6(absoluteDir).filter((name) => name.endsWith(".md")).sort()) {
       const path = `${dir}/${file}`;
@@ -15076,25 +15236,12 @@ function mermaidId(id) {
   return stableId(id).replace(/-/g, "_").replace(/\./g, "_");
 }
 function readYamlObjects(dir) {
-  if (!existsSync8(dir))
+  if (!existsSync9(dir))
     return [];
-  return readdirSync6(dir).filter((file) => /\.ya?ml$/.test(file)).sort().map((file) => parseFlatYaml(readFileSync8(resolve11(dir, file), "utf8")));
-}
-function parseFlatYaml(body) {
-  const out = {};
-  for (const line of body.split(/\r?\n/)) {
-    const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
-    if (!match)
-      continue;
-    const [, key, raw] = match;
-    if (raw.startsWith('"') && raw.endsWith('"'))
-      out[key] = JSON.parse(raw);
-    else if (raw === "true" || raw === "false")
-      out[key] = raw === "true";
-    else
-      out[key] = raw;
-  }
-  return out;
+  return readdirSync6(dir).filter((file) => /\.ya?ml$/.test(file)).sort().map((file) => {
+    const path = resolve11(dir, file);
+    return parseJsonOrStableYaml(readFileSync8(path, "utf8"), path);
+  });
 }
 function escapeMermaid(value) {
   return value.replace(/"/g, "'");
@@ -15324,6 +15471,34 @@ function architectureDocumentationProjectionDrift(input) {
   const expectedByPath = new Map(input.expectedFiles.map((file) => [file.path, file]));
   const targetIds = new Set(input.targets.map((target) => target.targetId));
   const diffs = [];
+  const existingManifest = existingByPath.get(input.expectedManifest.path);
+  if (!existingManifest) {
+    diffs.push({
+      path: input.expectedManifest.path,
+      reasonCode: "projection-manifest-missing",
+      expectedDigest: input.expectedManifest.digest
+    });
+  } else {
+    try {
+      const parsed = JSON.parse(existingManifest.body);
+      const actualDigest = digestJson(parsed);
+      if (actualDigest !== input.expectedManifest.digest) {
+        diffs.push({
+          path: input.expectedManifest.path,
+          reasonCode: "projection-manifest-stale",
+          expectedDigest: input.expectedManifest.digest,
+          actualDigest
+        });
+      }
+    } catch {
+      diffs.push({
+        path: input.expectedManifest.path,
+        reasonCode: "projection-manifest-invalid",
+        expectedDigest: input.expectedManifest.digest,
+        actualDigest: digestJson({ path: existingManifest.path, body: existingManifest.body })
+      });
+    }
+  }
   for (const expected of input.expectedFiles) {
     const existing = existingByPath.get(expected.path);
     if (!existing) {
@@ -15362,6 +15537,8 @@ function architectureDocumentationProjectionDrift(input) {
     }
   }
   for (const existing of input.existingFiles) {
+    if (existing.path === input.expectedManifest.path)
+      continue;
     if (!isManagedArchitectureDocumentationPath(existing.path) || expectedByPath.has(existing.path))
       continue;
     const region = findAnyGeneratedRegion(existing.body);
@@ -15410,7 +15587,7 @@ function generatedEndMarker(targetId) {
   return `${ARCHITECTURE_DOCS_GENERATED_END_PREFIX} target="${targetId}" -->`;
 }
 function isManagedArchitectureDocumentationPath(path) {
-  return /^docs\/architecture\/(modules|relations)\/.+\.md$/.test(path) || /^docs\/architecture\/diagrams\/architecture\.(mmd|likec4|structurizr\.json)$/.test(path) || path === "docs/architecture/index.md" || path === "docs/architecture/changelog.md" || path === "docs/architecture/decisions/index.md";
+  return /^docs\/architecture\/(modules|relations)\/.+\.md$/.test(path) || /^docs\/architecture\/diagrams\/architecture\.(mmd|likec4|structurizr\.json)$/.test(path) || path === "docs/architecture/index.md" || path === "docs/architecture/changelog.md" || path === "docs/architecture/decisions/index.md" || path === "docs/architecture/.projection-manifest.json";
 }
 function pathSegment2(id) {
   return stableId(id).replace(/\./g, "-");
@@ -15441,6 +15618,61 @@ function escapeDsl(value) {
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function resolveArchitectureOwnerForPath(nodes, path) {
+  const candidates = [];
+  for (const node of nodes) {
+    const source = nativeNodeSource(node);
+    const include = source?.include ?? [];
+    if (include.length === 0)
+      continue;
+    const excluded = (source?.exclude ?? []).some((pattern) => matchesGlob(path, pattern));
+    if (excluded)
+      continue;
+    const specificity = include.filter((pattern) => matchesGlob(path, pattern)).reduce((max, pattern) => Math.max(max, globLiteralPrefixLength(pattern)), -1);
+    if (specificity >= 0)
+      candidates.push({ node, specificity });
+  }
+  if (candidates.length === 0)
+    return { status: "no-match" };
+  const maxSpecificity = candidates.reduce((max, candidate) => Math.max(max, candidate.specificity), -1);
+  const winners = candidates.filter((candidate) => candidate.specificity === maxSpecificity).map((candidate) => candidate.node);
+  if (winners.length > 1)
+    return { status: "ambiguous", candidates: winners };
+  return { status: "matched", node: winners[0] };
+}
+function matchesGlob(path, pattern) {
+  return globToRegExp(pattern).test(path);
+}
+function globLiteralPrefixLength(pattern) {
+  const index = pattern.search(/[*?]/);
+  return index === -1 ? pattern.length : index;
+}
+function globToRegExp(pattern) {
+  let out = "";
+  let index = 0;
+  while (index < pattern.length) {
+    if (pattern.startsWith("**/", index)) {
+      out += "(?:.*/)?";
+      index += 3;
+      continue;
+    }
+    if (pattern.startsWith("**", index)) {
+      out += ".*";
+      index += 2;
+      continue;
+    }
+    const char = pattern[index];
+    if (char === "*") {
+      out += "[^/]*";
+    } else if (char === "?") {
+      out += "[^/]";
+    } else {
+      out += escapeRegExp(char);
+    }
+    index += 1;
+  }
+  return new RegExp(`^${out}$`);
+}
 
 // packages/local-runtime/explorer-html/src/index.ts
 var STATUS_STYLE = {
@@ -16565,7 +16797,7 @@ init_src();
 
 // packages/local-runtime/git-adapter/src/index.ts
 import { execFileSync as execFileSync4, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync9, mkdirSync as mkdirSync4, mkdtempSync as mkdtempSync2, rmSync as rmSync4 } from "node:fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync4, mkdtempSync as mkdtempSync2, rmSync as rmSync4 } from "node:fs";
 import { dirname as dirname5, join as join5, resolve as resolve12 } from "node:path";
 import { tmpdir } from "node:os";
 init_src();
@@ -16579,7 +16811,7 @@ function findRepositoryRoot2(start) {
   } catch {
     let cursor = resolve12(start);
     while (true) {
-      if (existsSync9(resolve12(cursor, ".git")))
+      if (existsSync10(resolve12(cursor, ".git")))
         return cursor;
       const parent = dirname5(cursor);
       if (parent === cursor)
@@ -16850,7 +17082,7 @@ function isGitWorktreeError(error) {
 // packages/local-runtime/local-store-sqlite/src/index.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash6, randomUUID as randomUUID2 } from "node:crypto";
-import { chmodSync as chmodSync2, closeSync as closeSync4, existsSync as existsSync10, fsyncSync as fsyncSync3, lstatSync as lstatSync5, mkdirSync as mkdirSync5, openSync as openSync4, readFileSync as readFileSync9, realpathSync as realpathSync6, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync3 } from "node:fs";
+import { chmodSync as chmodSync2, closeSync as closeSync4, existsSync as existsSync11, fsyncSync as fsyncSync3, lstatSync as lstatSync5, mkdirSync as mkdirSync5, openSync as openSync4, readFileSync as readFileSync9, realpathSync as realpathSync7, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync3 } from "node:fs";
 import { readdir, readFile } from "node:fs/promises";
 import { createRequire as createRequire3 } from "node:module";
 import { homedir as homedir2 } from "node:os";
@@ -16893,6 +17125,7 @@ var REQUIRED_LOCAL_STORE_TABLES2 = [
 ];
 var SQLITE_PRAGMAS2 = [
   "PRAGMA journal_mode = WAL",
+  "PRAGMA synchronous = FULL",
   "PRAGMA foreign_keys = ON",
   "PRAGMA busy_timeout = 5000"
 ];
@@ -17414,8 +17647,16 @@ var LOCAL_SQLITE_MIGRATIONS2 = [
       )`,
       "CREATE INDEX IF NOT EXISTS idx_audit_runs_status ON audit_runs(storage_repository_id, storage_workspace_id, status)"
     ]
+  },
+  {
+    id: "0011_changeset_cleanup_cursor",
+    statements: [
+      "ALTER TABLE changeset_journal ADD COLUMN cleanup_completed_at TEXT",
+      "CREATE INDEX IF NOT EXISTS idx_changeset_journal_cleanup_pending ON changeset_journal(status, cleanup_completed_at, updated_at)"
+    ]
   }
 ];
+var CHANGESET_STARTUP_CLEANUP_LIMIT = 100;
 var ARCHCONTEXT_STATE_DIR_ENV2 = "ARCHCONTEXT_STATE_DIR";
 var ARCHCONTEXT_LOCAL_STORE_PATH_ENV2 = "ARCHCONTEXT_LOCAL_STORE_PATH";
 function defaultArchContextStateRoot2(env = process.env, platform = process.platform, home = homedir2()) {
@@ -17474,10 +17715,10 @@ function migrateLegacyLocalStoreIfNeeded2(root = process.cwd(), env = process.en
     });
   }
   ensurePrivateDir2(dirname6(paths.localStorePath));
-  const legacyExists = existsSync10(paths.legacyLocalStorePath);
+  const legacyExists = existsSync11(paths.legacyLocalStorePath);
   const integrityCheck = {};
   const quarantinedFiles = [];
-  const targetExists = existsSync10(paths.localStorePath);
+  const targetExists = existsSync11(paths.localStorePath);
   if (targetExists) {
     try {
       integrityCheck.target = assertCurrentLocalStore2(paths.localStorePath);
@@ -17941,6 +18182,11 @@ class SqliteLocalStore {
       throw new Error(`ChangeSet journal not found: ${journalId}`);
     db.prepare("UPDATE changeset_journal SET status = ?, updated_at = ?, completed_at = ? WHERE journal_id = ?").run("committed", nowIso2(), nowIso2(), journalId);
   }
+  async completeChangeSetCleanup(journalId) {
+    const db = await this.database();
+    const completedAt = nowIso2();
+    db.prepare("UPDATE changeset_journal SET cleanup_completed_at = ?, updated_at = ? WHERE journal_id = ? AND status = ?").run(completedAt, completedAt, journalId, "committed");
+  }
   async abortChangeSet(journalId, reason) {
     const db = await this.database();
     const row = db.prepare("SELECT metadata_json FROM changeset_journal WHERE journal_id = ?").get(journalId);
@@ -17951,37 +18197,61 @@ class SqliteLocalStore {
   }
   recoverPendingChangeSets() {
     const db = this.requireOpenDatabase();
-    const committed = db.prepare("SELECT files_json FROM changeset_journal WHERE status = ?").all("committed");
+    const committed = db.prepare(`SELECT journal_id, files_json FROM changeset_journal
+        WHERE status = ? AND cleanup_completed_at IS NULL
+        ORDER BY updated_at, journal_id
+        LIMIT ?`).all("committed", CHANGESET_STARTUP_CLEANUP_LIMIT);
     for (const row of committed) {
-      cleanupCommittedJournalFiles(JSON.parse(String(row.files_json)));
+      try {
+        cleanupCommittedJournalFiles(JSON.parse(String(row.files_json)));
+        const completedAt = nowIso2();
+        db.prepare("UPDATE changeset_journal SET cleanup_completed_at = ?, updated_at = ? WHERE journal_id = ?").run(completedAt, completedAt, String(row.journal_id));
+      } catch {}
     }
     const rows = db.prepare("SELECT journal_id, root, files_json, metadata_json FROM changeset_journal WHERE status = ?").all("pending");
+    let recovered = 0;
     for (const row of rows) {
-      const files = JSON.parse(String(row.files_json));
-      const metadata = JSON.parse(String(row.metadata_json));
-      const plannedLedgerEvent = changeSetJournalPlannedLedgerEvent(metadata);
-      const existingLedgerEvent = plannedLedgerEvent ? architectureEventByIdempotency(db, plannedLedgerEvent) : undefined;
-      if (plannedLedgerEvent && existingLedgerEvent) {
-        const expectedEventHash = normalizeArchitectureLedgerEvent(plannedLedgerEvent, existingLedgerEvent.previousEventHash).eventHash;
-        if (expectedEventHash !== existingLedgerEvent.event.eventHash) {
-          throw new Error(`changeset-ledger-recovery-idempotency-conflict: ${plannedLedgerEvent.idempotencyKey}`);
+      let metadata = {};
+      try {
+        const files = JSON.parse(String(row.files_json));
+        metadata = JSON.parse(String(row.metadata_json));
+        const plannedLedgerEvent = changeSetJournalPlannedLedgerEvent(metadata);
+        const existingLedgerEvent = plannedLedgerEvent ? architectureEventByIdempotency(db, plannedLedgerEvent) : undefined;
+        if (plannedLedgerEvent && existingLedgerEvent) {
+          const expectedEventHash = normalizeArchitectureLedgerEvent(plannedLedgerEvent, existingLedgerEvent.previousEventHash).eventHash;
+          if (expectedEventHash !== existingLedgerEvent.event.eventHash) {
+            throw new Error(`changeset-ledger-recovery-idempotency-conflict: ${plannedLedgerEvent.idempotencyKey}`);
+          }
+          cleanupCommittedJournalFiles(files);
+          const completedAt2 = nowIso2();
+          db.prepare("UPDATE changeset_journal SET status = ?, metadata_json = ?, updated_at = ?, completed_at = ?, cleanup_completed_at = ? WHERE journal_id = ?").run("committed", stableJson(withChangeSetJournalArchitectureLedger(metadata, {
+            recovery: {
+              schemaVersion: "archcontext.changeset-ledger-recovery/v1",
+              status: "ledger-append-detected",
+              eventId: existingLedgerEvent.event.eventId,
+              eventHash: existingLedgerEvent.event.eventHash ?? "",
+              recoveredAt: completedAt2
+            }
+          })), completedAt2, completedAt2, completedAt2, String(row.journal_id));
+          recovered += 1;
+          continue;
         }
-        cleanupCommittedJournalFiles(files);
-        db.prepare("UPDATE changeset_journal SET status = ?, metadata_json = ?, updated_at = ?, completed_at = ? WHERE journal_id = ?").run("committed", stableJson(withChangeSetJournalArchitectureLedger(metadata, {
-          recovery: {
-            schemaVersion: "archcontext.changeset-ledger-recovery/v1",
-            status: "ledger-append-detected",
-            eventId: existingLedgerEvent.event.eventId,
-            eventHash: existingLedgerEvent.event.eventHash ?? "",
-            recoveredAt: nowIso2()
+        recoverJournalFiles(String(row.root), files);
+        const completedAt = nowIso2();
+        db.prepare("UPDATE changeset_journal SET status = ?, updated_at = ?, completed_at = ?, cleanup_completed_at = ? WHERE journal_id = ?").run("recovered", completedAt, completedAt, completedAt, String(row.journal_id));
+        recovered += 1;
+      } catch (error) {
+        db.prepare("UPDATE changeset_journal SET metadata_json = ?, updated_at = ? WHERE journal_id = ?").run(stableJson({
+          ...metadata,
+          recoveryError: {
+            schemaVersion: "archcontext.changeset-recovery-error/v1",
+            message: error instanceof Error ? error.message : String(error),
+            failedAt: nowIso2()
           }
-        })), nowIso2(), nowIso2(), String(row.journal_id));
-        continue;
+        }), nowIso2(), String(row.journal_id));
       }
-      recoverJournalFiles(String(row.root), files);
-      db.prepare("UPDATE changeset_journal SET status = ?, updated_at = ?, completed_at = ? WHERE journal_id = ?").run("recovered", nowIso2(), nowIso2(), String(row.journal_id));
     }
-    return rows.length;
+    return recovered;
   }
   async saveTaskState(taskSessionId, state) {
     const db = await this.database();
@@ -18079,52 +18349,38 @@ class SqliteLocalStore {
     for (const event of input.events)
       validateArchitectureLedgerEvent(event);
     const db = await this.database();
-    const startedAt = Date.now();
-    const appendedEvents = [];
-    const duplicateEvents = [];
     db.exec("BEGIN IMMEDIATE");
     try {
-      let processed = 0;
-      for (const event of input.events) {
-        const duplicate = architectureEventByIdempotency(db, event);
-        if (duplicate) {
-          const expectedDuplicateHash = normalizeArchitectureLedgerEvent(event, duplicate.previousEventHash).eventHash;
-          if (expectedDuplicateHash !== duplicate.event.eventHash) {
-            throw new Error(`architecture-ledger-idempotency-conflict: ${event.idempotencyKey}`);
-          }
-          duplicateEvents.push(duplicate.event);
-          continue;
-        }
-        const previousEventHash = latestArchitectureEventHash(db, event.repository.storageRepositoryId, event.worktree.storageWorkspaceId);
-        const normalized = normalizeArchitectureLedgerEvent(event, previousEventHash);
-        insertArchitectureEvent(db, normalized);
-        persistArchitectureLedgerArtifacts(db, normalized);
-        materializeArchitectureLedgerEvent(db, normalized);
-        appendedEvents.push(normalized);
-        processed += 1;
-        if (input.faultAfterEvents !== undefined && processed >= input.faultAfterEvents)
-          throw new Error("architecture-ledger-fault-injection");
-      }
-      const scope = architectureScopeFromEvent(input.events[0] ?? duplicateEvents[0]);
-      const state = scope ? readArchitectureLedgerStateFromDb(db, scope) : emptyArchitectureLedgerState();
-      if (scope) {
-        recordArchitectureLedgerOperation(db, {
-          scope,
-          operationKind: "append_events",
-          durationMs: Date.now() - startedAt,
-          rowCount: appendedEvents.length,
-          rebuildReason: null
-        });
-      }
+      const result = appendArchitectureEventsInOpenTransaction(db, input);
       db.exec("COMMIT");
-      return {
-        appendedEvents,
-        duplicateEvents,
-        graphDigest: architectureLedgerStateDigest(state),
-        entityCount: state.entities.length,
-        relationCount: state.relations.length,
-        constraintCount: state.constraints.length
-      };
+      return result;
+    } catch (error) {
+      db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  async appendArchitectureEventsAndCommitChangeSet(journalId, input) {
+    if (input.writer !== "runtime-daemon")
+      throw new Error("architecture-ledger-writer-must-be-runtime-daemon");
+    for (const event of input.events)
+      validateArchitectureLedgerEvent(event);
+    const db = await this.database();
+    db.exec("BEGIN IMMEDIATE");
+    try {
+      const row = db.prepare("SELECT status, metadata_json FROM changeset_journal WHERE journal_id = ?").get(journalId);
+      if (!row)
+        throw new Error(`ChangeSet journal not found: ${journalId}`);
+      if (String(row.status) !== "pending")
+        throw new Error(`ChangeSet journal is not pending: ${journalId}`);
+      const metadata = JSON.parse(String(row.metadata_json));
+      const result = appendArchitectureEventsInOpenTransaction(db, input);
+      const completedAt = nowIso2();
+      db.prepare("UPDATE changeset_journal SET status = ?, metadata_json = ?, updated_at = ?, completed_at = ? WHERE journal_id = ?").run("committed", stableJson(withChangeSetJournalArchitectureLedger(metadata, {
+        append: changeSetLedgerAppendSummary(result),
+        appendedAt: completedAt
+      })), completedAt, completedAt, journalId);
+      db.exec("COMMIT");
+      return result;
     } catch (error) {
       db.exec("ROLLBACK");
       throw error;
@@ -18138,24 +18394,50 @@ class SqliteLocalStore {
         WHERE storage_repository_id = ?
           AND storage_workspace_id = ?
           ${statusClause}
-        ORDER BY created_at DESC, run_id ASC`).all(input.repository.storageRepositoryId, input.worktree.storageWorkspaceId, ...statuses).map((row) => JSON.parse(String(row.run_json)));
+        ORDER BY created_at DESC, run_id ASC`).all(input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree), ...statuses).map((row) => JSON.parse(String(row.run_json)));
+  }
+  async resolveArchitectureLedgerScope(input) {
+    const db = await this.database();
+    const rows = db.prepare(`SELECT event_json FROM architecture_events
+        WHERE storage_repository_id = ? AND workspace_id = ? AND branch = ?
+        ORDER BY event_sequence DESC`).all(input.repository.storageRepositoryId, input.worktree.workspaceId, input.worktree.branch);
+    for (const row of rows) {
+      const event = JSON.parse(String(row.event_json));
+      if (event.worktree.storageWorkspaceId === input.worktree.storageWorkspaceId) {
+        return architectureScopeFromEvent(event);
+      }
+    }
+    return input;
+  }
+  async resolveLatestArchitectureLedgerScope(input) {
+    const db = await this.database();
+    const rows = db.prepare(`SELECT event_json FROM architecture_events
+        WHERE storage_repository_id = ? AND workspace_id = ?
+        ORDER BY event_sequence DESC`).all(input.repository.storageRepositoryId, input.worktree.workspaceId);
+    for (const row of rows) {
+      const event = JSON.parse(String(row.event_json));
+      if (event.worktree.storageWorkspaceId === input.worktree.storageWorkspaceId) {
+        return architectureScopeFromEvent(event);
+      }
+    }
+    return input;
   }
   async getAuditRun(input) {
     const db = await this.database();
     const row = db.prepare(`SELECT run_json FROM audit_runs
-        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND run_id = ?`).get(input.repository.storageRepositoryId, input.worktree.storageWorkspaceId, input.runId);
+        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND run_id = ?`).get(input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree), architectureLedgerStorageId(input.worktree, input.runId));
     return row ? JSON.parse(String(row.run_json)) : undefined;
   }
   async readArchitectureLedgerSourceCursor(input) {
     const db = await this.database();
     const row = db.prepare(`SELECT cursor_json FROM source_cursors
-        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND cursor_id = ?`).get(input.repository.storageRepositoryId, input.worktree.storageWorkspaceId, input.cursorId);
+        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND cursor_id = ?`).get(input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree), architectureLedgerStorageId(input.worktree, input.cursorId));
     return row ? JSON.parse(String(row.cursor_json)) : undefined;
   }
   async createArchitectureLedgerSnapshot(input) {
     const db = await this.database();
     const startedAt = Date.now();
-    const latest = latestArchitectureEvent(db, input.repository.storageRepositoryId, input.worktree.storageWorkspaceId);
+    const latest = latestArchitectureEvent(db, input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree));
     if (!latest)
       throw new Error("architecture-ledger-snapshot-requires-event");
     const state = readArchitectureLedgerStateFromDb(db, input);
@@ -18169,7 +18451,7 @@ class SqliteLocalStore {
         (snapshot_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, branch, head_sha, worktree_digest,
           source_mode, last_event_id, last_event_hash, graph_digest, projection_digest, entity_count, relation_count,
           constraint_count, input_digests_json, snapshot_json, created_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(snapshot.snapshotId, snapshot.repository.repositoryId, snapshot.repository.storageRepositoryId, snapshot.worktree.workspaceId, snapshot.worktree.storageWorkspaceId, snapshot.worktree.branch, snapshot.worktree.headSha, snapshot.worktree.worktreeDigest, snapshot.sourceMode, snapshot.eventCursor.lastEventId, snapshot.eventCursor.lastEventHash, snapshot.graphDigest, snapshot.projectionDigest, snapshot.entityCount, snapshot.relationCount, snapshot.constraintCount, stableJson(snapshot.inputDigests), stableJson(snapshot), snapshot.createdAt);
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(snapshot.snapshotId, snapshot.repository.repositoryId, snapshot.repository.storageRepositoryId, snapshot.worktree.workspaceId, architectureLedgerWorkspaceKey(snapshot.worktree), snapshot.worktree.branch, snapshot.worktree.headSha, snapshot.worktree.worktreeDigest, snapshot.sourceMode, architectureLedgerStorageId(snapshot.worktree, snapshot.eventCursor.lastEventId), snapshot.eventCursor.lastEventHash, snapshot.graphDigest, snapshot.projectionDigest, snapshot.entityCount, snapshot.relationCount, snapshot.constraintCount, stableJson(snapshot.inputDigests), stableJson(snapshot), snapshot.createdAt);
     recordArchitectureLedgerOperation(db, {
       scope: input,
       operationKind: "create_snapshot",
@@ -18238,16 +18520,16 @@ class SqliteLocalStore {
     const db = await this.database();
     const startedAt = Date.now();
     const snapshot = db.prepare(`SELECT last_event_id FROM architecture_snapshots
-        WHERE snapshot_id = ? AND storage_repository_id = ? AND storage_workspace_id = ?`).get(input.beforeSnapshotId, input.repository.storageRepositoryId, input.worktree.storageWorkspaceId);
+        WHERE snapshot_id = ? AND storage_repository_id = ? AND storage_workspace_id = ?`).get(input.beforeSnapshotId, input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree));
     if (!snapshot)
       throw new Error(`architecture-ledger-snapshot-not-found: ${input.beforeSnapshotId}`);
     const cursor = db.prepare("SELECT event_sequence FROM architecture_events WHERE event_id = ?").get(String(snapshot.last_event_id));
     if (!cursor)
       throw new Error(`architecture-ledger-snapshot-cursor-not-found: ${String(snapshot.last_event_id)}`);
     const before = Number(db.prepare(`SELECT COUNT(*) AS count FROM architecture_events
-        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND event_sequence <= ? AND compacted_by_snapshot_id IS NULL`).get(input.repository.storageRepositoryId, input.worktree.storageWorkspaceId, Number(cursor.event_sequence))?.count ?? 0);
+        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND event_sequence <= ? AND compacted_by_snapshot_id IS NULL`).get(input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree), Number(cursor.event_sequence))?.count ?? 0);
     db.prepare(`UPDATE architecture_events SET compacted_by_snapshot_id = ?
-        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND event_sequence <= ? AND compacted_by_snapshot_id IS NULL`).run(input.beforeSnapshotId, input.repository.storageRepositoryId, input.worktree.storageWorkspaceId, Number(cursor.event_sequence));
+        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND event_sequence <= ? AND compacted_by_snapshot_id IS NULL`).run(input.beforeSnapshotId, input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree), Number(cursor.event_sequence));
     recordArchitectureLedgerOperation(db, {
       scope: input,
       operationKind: "compact_events",
@@ -18267,7 +18549,7 @@ class SqliteLocalStore {
     const replay = await this.verifyArchitectureLedgerReplay(input);
     if (!replay.ok)
       failures.push(...replay.mismatches);
-    const snapshotCount = Number(db.prepare("SELECT COUNT(*) AS count FROM architecture_snapshots WHERE storage_repository_id = ? AND storage_workspace_id = ?").get(input.repository.storageRepositoryId, input.worktree.storageWorkspaceId)?.count ?? 0);
+    const snapshotCount = Number(db.prepare("SELECT COUNT(*) AS count FROM architecture_snapshots WHERE storage_repository_id = ? AND storage_workspace_id = ?").get(input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree))?.count ?? 0);
     const result = {
       ok: failures.length === 0,
       graphDigest: replay.materializedDigest,
@@ -18287,7 +18569,7 @@ class SqliteLocalStore {
   async backupArchitectureLedger(input) {
     const db = await this.database();
     ensurePrivateDir2(dirname6(input.backupPath));
-    if (existsSync10(input.backupPath))
+    if (existsSync11(input.backupPath))
       rmSync5(input.backupPath, { force: true });
     db.exec(`VACUUM INTO ${sqliteStringLiteral2(input.backupPath)}`);
     return { backupPath: input.backupPath, integrity: assertSqliteIntegrity2(input.backupPath) };
@@ -18318,9 +18600,80 @@ class SqliteLocalStore {
 function architectureScopeFromEvent(event) {
   return event ? { repository: event.repository, worktree: event.worktree } : undefined;
 }
+function architectureLedgerWorkspaceKey(worktree) {
+  return `ledger-scope:${digestJson({
+    storageWorkspaceId: worktree.storageWorkspaceId,
+    branch: worktree.branch,
+    headSha: worktree.headSha,
+    worktreeDigest: worktree.worktreeDigest
+  }).slice("sha256:".length)}`;
+}
+function architectureLedgerStorageId(worktree, logicalId) {
+  return `${architectureLedgerWorkspaceKey(worktree)}:${logicalId}`;
+}
+function appendArchitectureEventsInOpenTransaction(db, input) {
+  const startedAt = Date.now();
+  const appendedEvents = [];
+  const duplicateEvents = [];
+  let processed = 0;
+  for (const event of input.events) {
+    const duplicate = architectureEventByIdempotency(db, event);
+    if (duplicate) {
+      const expectedDuplicateHash = normalizeArchitectureLedgerEvent(event, duplicate.previousEventHash).eventHash;
+      if (expectedDuplicateHash !== duplicate.event.eventHash) {
+        throw new Error(`architecture-ledger-idempotency-conflict: ${event.idempotencyKey}`);
+      }
+      duplicateEvents.push(duplicate.event);
+      continue;
+    }
+    const previousEventHash = latestArchitectureEventHash(db, event.repository.storageRepositoryId, architectureLedgerWorkspaceKey(event.worktree));
+    const normalized = normalizeArchitectureLedgerEvent(event, previousEventHash);
+    const operations = architectureLedgerPayload(normalized).operations ?? [];
+    const scope2 = architectureScopeFromEvent(normalized);
+    if (operations.length > 0) {
+      const currentDigest = architectureLedgerStateDigest(readArchitectureLedgerStateFromDb(db, scope2));
+      if (normalized.baseDigest !== currentDigest) {
+        throw new Error(`architecture-ledger-base-digest-conflict: expected ${currentDigest}, received ${normalized.baseDigest}`);
+      }
+    }
+    insertArchitectureEvent(db, normalized);
+    persistArchitectureLedgerArtifacts(db, normalized);
+    materializeArchitectureLedgerEvent(db, normalized);
+    if (operations.length > 0) {
+      const resultingDigest = architectureLedgerStateDigest(readArchitectureLedgerStateFromDb(db, scope2));
+      if (normalized.resultingDigest !== resultingDigest) {
+        throw new Error(`architecture-ledger-resulting-digest-conflict: expected ${resultingDigest}, received ${normalized.resultingDigest}`);
+      }
+    }
+    appendedEvents.push(normalized);
+    processed += 1;
+    if (input.faultAfterEvents !== undefined && processed >= input.faultAfterEvents) {
+      throw new Error("architecture-ledger-fault-injection");
+    }
+  }
+  const scope = architectureScopeFromEvent(input.events[0] ?? duplicateEvents[0]);
+  const state = scope ? readArchitectureLedgerStateFromDb(db, scope) : emptyArchitectureLedgerState();
+  if (scope) {
+    recordArchitectureLedgerOperation(db, {
+      scope,
+      operationKind: "append_events",
+      durationMs: Date.now() - startedAt,
+      rowCount: appendedEvents.length,
+      rebuildReason: null
+    });
+  }
+  return {
+    appendedEvents,
+    duplicateEvents,
+    graphDigest: architectureLedgerStateDigest(state),
+    entityCount: state.entities.length,
+    relationCount: state.relations.length,
+    constraintCount: state.constraints.length
+  };
+}
 function architectureEventByIdempotency(db, event) {
   const row = db.prepare(`SELECT event_json, previous_event_hash FROM architecture_events
-      WHERE storage_repository_id = ? AND storage_workspace_id = ? AND idempotency_key = ?`).get(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, event.idempotencyKey);
+      WHERE storage_repository_id = ? AND storage_workspace_id = ? AND idempotency_key = ?`).get(event.repository.storageRepositoryId, architectureLedgerWorkspaceKey(event.worktree), event.idempotencyKey);
   return row ? {
     event: JSON.parse(String(row.event_json)),
     previousEventHash: row.previous_event_hash === null || row.previous_event_hash === undefined ? null : String(row.previous_event_hash)
@@ -18336,11 +18689,12 @@ function latestArchitectureEvent(db, storageRepositoryId, storageWorkspaceId) {
   return row ? { event: JSON.parse(String(row.event_json)), eventHash: String(row.event_hash) } : undefined;
 }
 function insertArchitectureEvent(db, event) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT INTO architecture_events
       (event_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, branch, head_sha, worktree_digest,
         event_type, payload_version, source, actor_kind, actor_id, base_digest, resulting_digest, previous_event_hash,
         event_hash, idempotency_key, payload_json, provenance_json, event_json, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.eventId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, event.eventType, event.payloadVersion, event.source, event.actor.kind, event.actor.id, event.baseDigest, event.resultingDigest, event.previousEventHash ?? null, event.eventHash, event.idempotencyKey, stableJson(event.payload), stableJson(event.provenance), stableJson(event), event.timestamp);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, event.eventId), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, event.eventType, event.payloadVersion, event.source, event.actor.kind, event.actor.id, event.baseDigest, event.resultingDigest, event.previousEventHash ?? null, event.eventHash, event.idempotencyKey, stableJson(event.payload), stableJson(event.provenance), stableJson(event), event.timestamp);
   insertArchitectureLedgerFts(db, "event", architectureLedgerPayload(event).summary ?? "", architectureLedgerPayload(event).rationale ?? "", architectureLedgerPayload(event).title ?? "", "");
   const payload = architectureLedgerPayload(event);
   insertArchitectureLedgerSearchDoc(db, event, {
@@ -18354,11 +18708,13 @@ function insertArchitectureEvent(db, event) {
 }
 function persistArchitectureLedgerArtifacts(db, event) {
   const payload = architectureLedgerPayload(event);
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
+  const storageEventId = architectureLedgerStorageId(event.worktree, event.eventId);
   for (const evidence of payload.evidenceItems ?? []) {
     db.prepare(`INSERT OR REPLACE INTO evidence_items
         (evidence_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, kind, strength,
           polarity, origin, subject, selector_json, summary, coverage_json, supports_json, provenance_json, evidence_json, digest, created_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(evidence.evidenceId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, evidence.kind, evidence.strength, evidence.polarity, evidence.origin, evidence.subject, stableJson(evidence.selector), evidence.summary, stableJson(evidence.coverage), stableJson(evidence.supports), stableJson(evidence.provenance), stableJson(evidence), evidence.digest, evidence.createdAt);
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, evidence.evidenceId), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, storageEventId, evidence.kind, evidence.strength, evidence.polarity, evidence.origin, evidence.subject, stableJson(evidence.selector), evidence.summary, stableJson(evidence.coverage), stableJson(evidence.supports), stableJson(evidence.provenance), stableJson(evidence), evidence.digest, evidence.createdAt);
     insertArchitectureLedgerFts(db, "evidence", evidence.summary, "", "", evidence.summary);
     insertArchitectureLedgerSearchDoc(db, event, {
       docId: `evidence:${evidence.evidenceId}`,
@@ -18373,7 +18729,7 @@ function persistArchitectureLedgerArtifacts(db, event) {
     db.prepare(`INSERT OR REPLACE INTO evidence_bindings
         (binding_id, evidence_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id,
           target_kind, target_id, binding_reason, authority_effect, provenance_json, binding_json, created_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(binding.bindingId, binding.evidenceId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, binding.target.kind, binding.target.id, binding.bindingReason, binding.authorityEffect, stableJson(binding.provenance), stableJson(binding), binding.createdAt);
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, binding.bindingId), architectureLedgerStorageId(event.worktree, binding.evidenceId), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, storageEventId, binding.target.kind, binding.target.id, binding.bindingReason, binding.authorityEffect, stableJson(binding.provenance), stableJson(binding), binding.createdAt);
   }
   for (const run of payload.recommendationRuns ?? [])
     persistRecommendationRun(db, event, run);
@@ -18393,17 +18749,19 @@ function persistArchitectureLedgerArtifacts(db, event) {
     persistProjectionState(db, event, payload.projectionState);
 }
 function persistRecommendationRun(db, event, run) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO recommendation_runs
       (run_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, status, catalog_digest,
         input_digest, output_digest, metrics_json, run_json, started_at, completed_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(run.runId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, run.status, run.catalogDigest, run.inputDigest, run.outputDigest, stableJson(run.metrics), stableJson(run), run.startedAt, run.completedAt ?? null);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, run.runId), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, architectureLedgerStorageId(event.worktree, event.eventId), run.status, run.catalogDigest, run.inputDigest, run.outputDigest, stableJson(run.metrics), stableJson(run), run.startedAt, run.completedAt ?? null);
 }
 function persistRecommendation(db, event, recommendation) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO recommendations
       (recommendation_id, run_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, fingerprint,
         subject, practice_id, status, confidence, enforcement, risk, uncertainty, evidence_binding_ids_json, explanation_json,
         recommendation_json, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(recommendation.recommendationId, recommendation.runId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, recommendation.fingerprint, recommendation.subject, recommendation.practiceId ?? null, recommendation.status, recommendation.confidence, recommendation.enforcement, recommendation.risk, recommendation.uncertainty, stableJson(recommendation.evidenceBindingIds), stableJson(recommendation.explanation), stableJson(recommendation), recommendation.createdAt, recommendation.updatedAt);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, recommendation.recommendationId), architectureLedgerStorageId(event.worktree, recommendation.runId), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, architectureLedgerStorageId(event.worktree, event.eventId), recommendation.fingerprint, recommendation.subject, recommendation.practiceId ?? null, recommendation.status, recommendation.confidence, recommendation.enforcement, recommendation.risk, recommendation.uncertainty, stableJson(recommendation.evidenceBindingIds), stableJson(recommendation.explanation), stableJson(recommendation), recommendation.createdAt, recommendation.updatedAt);
   insertArchitectureLedgerFts(db, "recommendation", recommendation.explanation.join(`
 `), "", recommendation.subject, recommendation.explanation.join(`
 `));
@@ -18420,44 +18778,51 @@ function persistRecommendation(db, event, recommendation) {
   });
 }
 function persistAgentJob(db, event, job) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO agent_jobs
       (job_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, status, runner_port,
         fingerprint, input_digest, output_digest, stale_policy, job_json, queued_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(job.jobId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, job.status, job.runnerPort, job.fingerprint, job.inputDigest, job.outputDigest ?? null, job.stalePolicy, stableJson(job), job.queuedAt, job.updatedAt);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, job.jobId), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, architectureLedgerStorageId(event.worktree, event.eventId), job.status, job.runnerPort, job.fingerprint, job.inputDigest, job.outputDigest ?? null, job.stalePolicy, stableJson(job), job.queuedAt, job.updatedAt);
 }
 function persistAuditRun(db, event, run) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO audit_runs
       (run_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, job_id, report_id, status,
         repo_name_with_owner, repo_visibility, base_sha, input_digest, output_digest, run_json, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(run.runId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, run.jobId, run.reportId, run.status, run.repoNameWithOwner, run.repoVisibility, run.baseSha, run.inputDigest, run.outputDigest, stableJson(run), run.createdAt);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, run.runId), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, architectureLedgerStorageId(event.worktree, event.eventId), run.jobId, run.reportId, run.status, run.repoNameWithOwner, run.repoVisibility, run.baseSha, run.inputDigest, run.outputDigest, stableJson(run), run.createdAt);
 }
 function persistProjectionState(db, event, state) {
   const path = String(state.path ?? "projection");
   const projectionDigest = typeof state.projectionDigest === "string" ? state.projectionDigest : digestJson(state);
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO projection_state
       (projection_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, path, projection_digest, state_json, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(String(state.projectionId ?? stableLedgerId("projection", event.eventId, path)), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, path, projectionDigest, stableJson(state), event.timestamp);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, String(state.projectionId ?? stableLedgerId("projection", event.eventId, path))), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, architectureLedgerStorageId(event.worktree, event.eventId), path, projectionDigest, stableJson(state), event.timestamp);
 }
 function persistSourceCursor(db, event, cursor) {
   const source = String(cursor.source ?? event.source);
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO source_cursors
       (cursor_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, source, cursor_json, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(String(cursor.cursorId ?? stableLedgerId("cursor", event.eventId, source)), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, source, stableJson(cursor), event.timestamp);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, String(cursor.cursorId ?? stableLedgerId("cursor", event.eventId, source))), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, source, stableJson(cursor), event.timestamp);
 }
 function persistGenericLedgerJson(db, event, table, idColumn, jsonColumn, value, prefix) {
   const id = String(value[idColumn] ?? value.id ?? stableLedgerId(prefix, event.eventId, stableJson(value)));
+  const storageId = architectureLedgerStorageId(event.worktree, id);
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   if (table === "recommendation_feedback") {
     db.prepare(`INSERT OR REPLACE INTO recommendation_feedback
         (feedback_id, recommendation_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, feedback_json, created_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(id, String(value.recommendationId ?? value.recommendation_id ?? "unknown"), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, stableJson(value), String(value.createdAt ?? event.timestamp));
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(storageId, architectureLedgerStorageId(event.worktree, String(value.recommendationId ?? value.recommendation_id ?? "unknown")), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, architectureLedgerStorageId(event.worktree, event.eventId), stableJson(value), String(value.createdAt ?? event.timestamp));
     return;
   }
   db.prepare(`INSERT OR REPLACE INTO waivers
       (waiver_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, target_kind, target_id, waiver_json, created_at, expires_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(id, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, String(value.targetKind ?? value.target_kind ?? "unknown"), String(value.targetId ?? value.target_id ?? "unknown"), stableJson(value), String(value.createdAt ?? event.timestamp), value.expiresAt ? String(value.expiresAt) : null);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(storageId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, architectureLedgerStorageId(event.worktree, event.eventId), String(value.targetKind ?? value.target_kind ?? "unknown"), String(value.targetId ?? value.target_id ?? "unknown"), stableJson(value), String(value.createdAt ?? event.timestamp), value.expiresAt ? String(value.expiresAt) : null);
 }
 function materializeArchitectureLedgerEvent(db, event) {
   const payload = architectureLedgerPayload(event);
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   for (const operation of payload.operations ?? []) {
     switch (operation.op) {
       case "upsert_entity":
@@ -18465,31 +18830,32 @@ function materializeArchitectureLedgerEvent(db, event) {
         break;
       case "delete_entity":
         deleteArchitectureLedgerSearchDocs(db, { repository: event.repository, worktree: event.worktree }, [operation.entityId]);
-        db.prepare("DELETE FROM architecture_entities_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND entity_id = ?").run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, operation.entityId);
-        db.prepare("DELETE FROM architecture_relations_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND (source_entity_id = ? OR target_entity_id = ?)").run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, operation.entityId, operation.entityId);
+        db.prepare("DELETE FROM architecture_entities_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND entity_id = ?").run(event.repository.storageRepositoryId, workspaceKey, operation.entityId);
+        db.prepare("DELETE FROM architecture_relations_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND (source_entity_id = ? OR target_entity_id = ?)").run(event.repository.storageRepositoryId, workspaceKey, operation.entityId, operation.entityId);
         break;
       case "upsert_relation":
         upsertArchitectureRelation(db, event, operation.relation);
         break;
       case "delete_relation":
         deleteArchitectureLedgerSearchDocs(db, { repository: event.repository, worktree: event.worktree }, [operation.relationId]);
-        db.prepare("DELETE FROM architecture_relations_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND relation_id = ?").run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, operation.relationId);
+        db.prepare("DELETE FROM architecture_relations_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND relation_id = ?").run(event.repository.storageRepositoryId, workspaceKey, operation.relationId);
         break;
       case "upsert_constraint":
         upsertArchitectureConstraint(db, event, operation.constraint);
         break;
       case "delete_constraint":
         deleteArchitectureLedgerSearchDocs(db, { repository: event.repository, worktree: event.worktree }, [operation.constraintId]);
-        db.prepare("DELETE FROM architecture_constraints_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND constraint_id = ?").run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, operation.constraintId);
+        db.prepare("DELETE FROM architecture_constraints_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND constraint_id = ?").run(event.repository.storageRepositoryId, workspaceKey, operation.constraintId);
         break;
     }
   }
 }
 function upsertArchitectureEntity(db, event, entity) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO architecture_entities_current
       (storage_repository_id, storage_workspace_id, entity_id, repository_id, workspace_id, branch, head_sha, worktree_digest,
         kind, canonical_name, status, path, summary, metadata_json, last_event_id, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, entity.entityId, event.repository.repositoryId, event.worktree.workspaceId, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, entity.kind, entity.canonicalName, entity.status, entity.path ?? null, entity.summary ?? null, stableJson(entity.metadata ?? {}), event.eventId, event.timestamp);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.repository.storageRepositoryId, workspaceKey, entity.entityId, event.repository.repositoryId, event.worktree.workspaceId, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, entity.kind, entity.canonicalName, entity.status, entity.path ?? null, entity.summary ?? null, stableJson(entity.metadata ?? {}), architectureLedgerStorageId(event.worktree, event.eventId), event.timestamp);
   insertArchitectureLedgerFts(db, "entity", entity.summary ?? "", "", entity.canonicalName, "");
   insertArchitectureLedgerSearchDoc(db, event, {
     docId: `entity:${entity.entityId}`,
@@ -18502,10 +18868,11 @@ function upsertArchitectureEntity(db, event, entity) {
   });
 }
 function upsertArchitectureRelation(db, event, relation) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO architecture_relations_current
       (storage_repository_id, storage_workspace_id, relation_id, repository_id, workspace_id, branch, head_sha, worktree_digest,
         kind, source_entity_id, target_entity_id, status, summary, metadata_json, last_event_id, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, relation.relationId, event.repository.repositoryId, event.worktree.workspaceId, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, relation.kind, relation.sourceEntityId, relation.targetEntityId, relation.status, relation.summary ?? null, stableJson(relation.metadata ?? {}), event.eventId, event.timestamp);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.repository.storageRepositoryId, workspaceKey, relation.relationId, event.repository.repositoryId, event.worktree.workspaceId, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, relation.kind, relation.sourceEntityId, relation.targetEntityId, relation.status, relation.summary ?? null, stableJson(relation.metadata ?? {}), architectureLedgerStorageId(event.worktree, event.eventId), event.timestamp);
   insertArchitectureLedgerFts(db, "relation", relation.summary ?? "", "", relation.relationId, "");
   insertArchitectureLedgerSearchDoc(db, event, {
     docId: `relation:${relation.relationId}`,
@@ -18518,10 +18885,11 @@ function upsertArchitectureRelation(db, event, relation) {
   });
 }
 function upsertArchitectureConstraint(db, event, constraint) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO architecture_constraints_current
       (storage_repository_id, storage_workspace_id, constraint_id, repository_id, workspace_id, branch, head_sha, worktree_digest,
         kind, subject_id, status, severity, summary, metadata_json, last_event_id, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, constraint.constraintId, event.repository.repositoryId, event.worktree.workspaceId, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, constraint.kind, constraint.subjectId, constraint.status, constraint.severity ?? null, constraint.summary ?? null, stableJson(constraint.metadata ?? {}), event.eventId, event.timestamp);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.repository.storageRepositoryId, workspaceKey, constraint.constraintId, event.repository.repositoryId, event.worktree.workspaceId, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, constraint.kind, constraint.subjectId, constraint.status, constraint.severity ?? null, constraint.summary ?? null, stableJson(constraint.metadata ?? {}), architectureLedgerStorageId(event.worktree, event.eventId), event.timestamp);
   insertArchitectureLedgerFts(db, "constraint", constraint.summary ?? "", "", constraint.constraintId, "");
   insertArchitectureLedgerSearchDoc(db, event, {
     docId: `constraint:${constraint.constraintId}`,
@@ -18534,7 +18902,7 @@ function upsertArchitectureConstraint(db, event, constraint) {
   });
 }
 function readArchitectureLedgerStateFromDb(db, scope) {
-  const scopeParams = [scope.repository.storageRepositoryId, scope.worktree.storageWorkspaceId];
+  const scopeParams = [scope.repository.storageRepositoryId, architectureLedgerWorkspaceKey(scope.worktree)];
   const entities = db.prepare(`SELECT entity_id, kind, canonical_name, status, path, summary, metadata_json
       FROM architecture_entities_current
       WHERE storage_repository_id = ? AND storage_workspace_id = ?
@@ -18575,7 +18943,7 @@ function readArchitectureLedgerStateFromDb(db, scope) {
 }
 function readArchitectureLedgerNeighborhoodFromDb(db, input) {
   const depth = Math.max(0, Math.floor(input.depth));
-  const scopeParams = [input.repository.storageRepositoryId, input.worktree.storageWorkspaceId];
+  const scopeParams = [input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree)];
   const entityIds = [...new Set(db.prepare(`WITH RECURSIVE seed(entity_id) AS (
         SELECT entity_id FROM architecture_entities_current
           WHERE storage_repository_id = ? AND storage_workspace_id = ? AND entity_id = ?
@@ -18656,42 +19024,43 @@ function architectureEventsForReplay(db, input) {
   let untilEventId = input.untilEventId;
   if (input.snapshotId) {
     const snapshot = db.prepare(`SELECT last_event_id FROM architecture_snapshots
-        WHERE snapshot_id = ? AND storage_repository_id = ? AND storage_workspace_id = ?`).get(input.snapshotId, input.repository.storageRepositoryId, input.worktree.storageWorkspaceId);
+        WHERE snapshot_id = ? AND storage_repository_id = ? AND storage_workspace_id = ?`).get(input.snapshotId, input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree));
     if (!snapshot)
       throw new Error(`architecture-ledger-snapshot-not-found: ${input.snapshotId}`);
     untilEventId = String(snapshot.last_event_id);
   }
   const rows = db.prepare(`SELECT event_id, event_json FROM architecture_events
       WHERE storage_repository_id = ? AND storage_workspace_id = ?
-      ORDER BY event_sequence`).all(input.repository.storageRepositoryId, input.worktree.storageWorkspaceId);
+      ORDER BY event_sequence`).all(input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree));
   const events = [];
   for (const row of rows) {
     const event = JSON.parse(String(row.event_json));
     events.push(event);
-    if (untilEventId && String(row.event_id) === untilEventId)
+    if (untilEventId && (String(row.event_id) === untilEventId || event.eventId === untilEventId))
       break;
   }
   return events;
 }
 function deleteArchitectureCurrentState(db, scope) {
   for (const table of ["architecture_entities_current", "architecture_relations_current", "architecture_constraints_current"]) {
-    db.prepare(`DELETE FROM ${table} WHERE storage_repository_id = ? AND storage_workspace_id = ?`).run(scope.repository.storageRepositoryId, scope.worktree.storageWorkspaceId);
+    db.prepare(`DELETE FROM ${table} WHERE storage_repository_id = ? AND storage_workspace_id = ?`).run(scope.repository.storageRepositoryId, architectureLedgerWorkspaceKey(scope.worktree));
   }
 }
 function insertArchitectureLedgerFts(db, kind, summary, rationale, title, evidenceSummary) {
   db.prepare("INSERT INTO architecture_ledger_fts(kind, summary, rationale, title, evidence_summary) VALUES (?, ?, ?, ?, ?)").run(kind, summary, rationale, title, evidenceSummary);
 }
 function insertArchitectureLedgerSearchDoc(db, event, doc) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`DELETE FROM architecture_ledger_search_fts
-      WHERE storage_repository_id = ? AND storage_workspace_id = ? AND doc_id = ?`).run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, doc.docId);
+      WHERE storage_repository_id = ? AND storage_workspace_id = ? AND doc_id = ?`).run(event.repository.storageRepositoryId, workspaceKey, doc.docId);
   db.prepare(`INSERT INTO architecture_ledger_search_fts
       (doc_id, storage_repository_id, storage_workspace_id, target_kind, target_id, subject_id, title, summary, rationale, evidence_summary)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(doc.docId, event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, doc.targetKind, doc.targetId, doc.subjectId ?? null, doc.title ?? "", doc.summary ?? "", doc.rationale ?? "", doc.evidenceSummary ?? "");
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(doc.docId, event.repository.storageRepositoryId, workspaceKey, doc.targetKind, doc.targetId, doc.subjectId ?? null, doc.title ?? "", doc.summary ?? "", doc.rationale ?? "", doc.evidenceSummary ?? "");
 }
 function deleteArchitectureLedgerSearchDocs(db, scope, ids) {
   for (const id of ids) {
     db.prepare(`DELETE FROM architecture_ledger_search_fts
-        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND (target_id = ? OR subject_id = ?)`).run(scope.repository.storageRepositoryId, scope.worktree.storageWorkspaceId, id, id);
+        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND (target_id = ? OR subject_id = ?)`).run(scope.repository.storageRepositoryId, architectureLedgerWorkspaceKey(scope.worktree), id, id);
   }
 }
 function queryArchitectureLedgerSearchFts(db, input) {
@@ -18705,7 +19074,7 @@ function queryArchitectureLedgerSearchFts(db, input) {
       WHERE storage_repository_id = ? AND storage_workspace_id = ?
         AND architecture_ledger_search_fts MATCH ?
       ORDER BY rank, target_kind, target_id
-      LIMIT ?`).all(input.repository.storageRepositoryId, input.worktree.storageWorkspaceId, matchQuery, limit);
+      LIMIT ?`).all(input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree), matchQuery, limit);
   return rows.map((row) => {
     const title = String(row.title ?? "");
     const summary = String(row.summary ?? "");
@@ -18749,7 +19118,7 @@ function ftsMatchKind(query, doc) {
 function recordArchitectureLedgerOperation(db, input) {
   db.prepare(`INSERT INTO architecture_ledger_operations
       (operation_id, storage_repository_id, storage_workspace_id, operation_kind, duration_ms, row_count, rebuild_reason, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(`ledger_operation_${randomUUID2()}`, input.scope.repository.storageRepositoryId, input.scope.worktree.storageWorkspaceId, input.operationKind, Math.max(0, Math.trunc(input.durationMs)), input.rowCount, input.rebuildReason, nowIso2());
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(`ledger_operation_${randomUUID2()}`, input.scope.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.scope.worktree), input.operationKind, Math.max(0, Math.trunc(input.durationMs)), input.rowCount, input.rebuildReason, nowIso2());
 }
 function stableLedgerId(prefix, ...parts) {
   return `${prefix}.${createHash6("sha256").update(parts.join("\x00")).digest("hex").slice(0, 24)}`;
@@ -18932,7 +19301,7 @@ function assertTrustedLegacyLocalStoreSource2(paths) {
   if (!stat.isFile()) {
     throw new Error(`Legacy SQLite source must be a regular file: ${paths.legacyLocalStorePath}`);
   }
-  const sourceRealPath = realpathSync6.native(paths.legacyLocalStorePath);
+  const sourceRealPath = realpathSync7.native(paths.legacyLocalStorePath);
   if (!isPathInsideOrSame2(sourceRealPath, paths.repositoryRoot)) {
     throw new Error(`Legacy SQLite source must stay inside the repository root: ${paths.legacyLocalStorePath}`);
   }
@@ -18986,7 +19355,7 @@ function sqliteStringLiteral2(value) {
 function publishStagedLocalStore2(stagingPath, targetPath) {
   for (const suffix of SQLITE_SIDECAR_SUFFIXES2) {
     const path = `${targetPath}${suffix}`;
-    if (existsSync10(path))
+    if (existsSync11(path))
       throw new Error(`Cannot publish migrated SQLite over existing target file: ${path}`);
   }
   renameSync3(stagingPath, targetPath);
@@ -19058,14 +19427,14 @@ function quarantineExistingLocalStore2(paths) {
   const quarantinedFiles = [];
   for (const suffix of SQLITE_SIDECAR_SUFFIXES2) {
     const source = `${paths.localStorePath}${suffix}`;
-    if (!existsSync10(source))
+    if (!existsSync11(source))
       continue;
     const target = join6(quarantineDir, `runtime.sqlite${suffix}`);
     renameSync3(source, target);
     quarantinedFiles.push(target);
   }
   const markerPath = legacyMigrationMarkerPath2(paths);
-  if (existsSync10(markerPath)) {
+  if (existsSync11(markerPath)) {
     const target = join6(quarantineDir, LEGACY_MIGRATION_MARKER_FILE2);
     renameSync3(markerPath, target);
     quarantinedFiles.push(target);
@@ -19125,7 +19494,7 @@ function resolveMaybeRelative2(base, path) {
 function canonicalPath2(path) {
   const resolved = resolve13(path);
   try {
-    return realpathSync6.native(resolved);
+    return realpathSync7.native(resolved);
   } catch {
     return resolved;
   }
@@ -19315,18 +19684,22 @@ function changeSetLedgerAppendSummary(result) {
 }
 function changeSetJournalPlannedLedgerEvent(metadata) {
   const architectureLedger = metadata.architectureLedger;
-  if (!isJsonRecord(architectureLedger))
+  if (architectureLedger === undefined)
     return;
+  if (!isJsonRecord(architectureLedger))
+    throw new Error("changeset-ledger-recovery-metadata-malformed");
   const plannedEvent = architectureLedger.plannedEvent;
-  if (!isJsonRecord(plannedEvent))
+  if (plannedEvent === undefined)
     return;
+  if (!isJsonRecord(plannedEvent))
+    throw new Error("changeset-ledger-recovery-planned-event-malformed");
+  const event = plannedEvent;
   try {
-    const event = plannedEvent;
     validateArchitectureLedgerEvent(event);
-    return event;
-  } catch {
-    return;
+  } catch (error) {
+    throw new Error(`changeset-ledger-recovery-planned-event-invalid: ${error instanceof Error ? error.message : String(error)}`);
   }
+  return event;
 }
 function isJsonRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -19336,9 +19709,13 @@ function recoverJournalFiles(root, files) {
     const absolute = resolve13(root, file.path);
     if (file.tempPath)
       rmSync5(file.tempPath, { recursive: true, force: true });
-    rmSync5(absolute, { recursive: true, force: true });
-    if (file.existed && file.backupPath && existsSync10(file.backupPath)) {
-      renameSync3(file.backupPath, absolute);
+    if (file.existed) {
+      if (file.backupPath && existsSync11(file.backupPath)) {
+        rmSync5(absolute, { recursive: true, force: true });
+        renameSync3(file.backupPath, absolute);
+      }
+    } else {
+      rmSync5(absolute, { recursive: true, force: true });
     }
     fsyncDirectory3(dirname6(absolute));
   }
@@ -19395,8 +19772,18 @@ async function readRelationFiles(root, relationsDir) {
 
 // packages/local-runtime/model-store-yaml/src/index.ts
 init_src();
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readdirSync as readdirSync7, readFileSync as readFileSync10, rmSync as rmSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, readdirSync as readdirSync7, readFileSync as readFileSync10, rmSync as rmSync6, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname7, resolve as resolve14 } from "node:path";
+var GENERATED_ARCHITECTURE_PATH = ".archcontext/generated/ARCHITECTURE.md";
+var GENERATED_ARCHITECTURE_BODY = [
+  "<!-- Generated by ArchContext. Do not edit by hand. -->",
+  "",
+  "# Architecture",
+  "",
+  "Model projection is generated from `.archcontext/model`.",
+  ""
+].join(`
+`);
 function createDefaultManifest(productId, productName) {
   return {
     schemaVersion: "archcontext.manifest/v1",
@@ -19494,6 +19881,22 @@ function createDefaultProjectionTargetManifest() {
         pathTemplate: "docs/architecture/diagrams/architecture.likec4",
         ownership: "generated",
         format: "likec4"
+      },
+      {
+        id: "projection_rule.agent-context.claude",
+        targetType: "agent-context",
+        scope: { kind: "entity", entityKind: "capability" },
+        pathTemplate: "{primarySourceDir}/CLAUDE.md",
+        ownership: "mixed",
+        format: "markdown"
+      },
+      {
+        id: "projection_rule.agent-context.agents",
+        targetType: "agent-context",
+        scope: { kind: "entity", entityKind: "capability" },
+        pathTemplate: "{primarySourceDir}/AGENTS.md",
+        ownership: "mixed",
+        format: "markdown"
       }
     ]
   };
@@ -19530,16 +19933,50 @@ function initializeArchContextModel(root, productName = "ArchContext Project") {
   rebuildGeneratedProjection(root);
 }
 function rebuildGeneratedProjection(root) {
-  rmSync6(resolve14(root, ".archcontext/generated"), { recursive: true, force: true });
-  writeFile(root, ".archcontext/generated/ARCHITECTURE.md", [
-    "<!-- Generated by ArchContext. Do not edit by hand. -->",
-    "",
-    "# Architecture",
-    "",
-    "Model projection is generated from `.archcontext/model`.",
-    ""
-  ].join(`
-`));
+  for (const operation of planGeneratedProjection(root)) {
+    if (operation.operation === "delete_entity") {
+      rmSync6(resolve14(root, operation.path), { force: true });
+    } else {
+      writeFile(root, operation.path, operation.body);
+    }
+  }
+}
+function planGeneratedProjection(root) {
+  const desiredBody = GENERATED_ARCHITECTURE_BODY;
+  const desiredAbsolute = resolve14(root, GENERATED_ARCHITECTURE_PATH);
+  const operations = [];
+  if (!existsSync12(desiredAbsolute) || readFileSync10(desiredAbsolute, "utf8") !== desiredBody) {
+    operations.push({
+      path: GENERATED_ARCHITECTURE_PATH,
+      expectedHash: existsSync12(desiredAbsolute) ? digestJson({ body: readFileSync10(desiredAbsolute, "utf8") }) : "missing",
+      body: desiredBody,
+      operation: "render_projection"
+    });
+  }
+  for (const path of collectGeneratedProjectionFiles(root)) {
+    if (path === GENERATED_ARCHITECTURE_PATH)
+      continue;
+    const body = readFileSync10(resolve14(root, path), "utf8");
+    operations.push({
+      path,
+      expectedHash: digestJson({ body }),
+      body: "",
+      operation: "delete_entity"
+    });
+  }
+  return operations.sort((left, right) => left.path.localeCompare(right.path));
+}
+function collectGeneratedProjectionFiles(root) {
+  const generatedRoot = ".archcontext/generated";
+  if (!existsSync12(resolve14(root, generatedRoot)))
+    return [];
+  const walk = (relativeDir) => readdirSync7(resolve14(root, relativeDir), { withFileTypes: true }).flatMap((entry) => {
+    const child = `${relativeDir}/${entry.name}`;
+    if (entry.isDirectory())
+      return walk(child);
+    return entry.isFile() ? [child] : [];
+  });
+  return walk(generatedRoot).sort();
 }
 
 class YamlModelStore {
@@ -19596,7 +20033,7 @@ function collectArchContextFiles(root, entries) {
   const files = [];
   for (const entry of entries) {
     const absolute = resolve14(root, entry);
-    if (!existsSync11(absolute))
+    if (!existsSync12(absolute))
       continue;
     const stat = readdirOrFile(absolute);
     if (stat === "file") {
@@ -20011,7 +20448,8 @@ class ArchitectureLedgerReadModelStore {
     return this.fallback.writeChangeSetPreview(changeSet);
   }
   async loadLedgerModel(workspace) {
-    const state = await this.localStore.readArchitectureLedgerState(architectureLedgerScopeForWorkspace(workspace));
+    const scope = await this.localStore.resolveArchitectureLedgerScope(architectureLedgerScopeForWorkspace(workspace));
+    const state = await this.localStore.readArchitectureLedgerState(scope);
     const projectedFiles = projectArchitectureLedgerStateToYamlFiles(state).map((file) => ({
       path: file.path,
       body: file.body,
@@ -20095,7 +20533,7 @@ class ArchctxDaemon {
     this.readModelStore = new ArchitectureLedgerReadModelStore(this.modelStore, this.localStore, this.architectureLedger);
     this.changeSetEngine = deps.changeSetEngine ?? new ChangeSetEngine({
       modelStore: this.modelStore,
-      projection: { rebuildGeneratedProjection },
+      projection: { planGeneratedProjection },
       journal: this.localStore
     });
     this.devicePrivateKeySigner = deps.devicePrivateKeySigner;
@@ -21047,7 +21485,7 @@ class ArchctxDaemon {
     const absolute = resolve15(session.workspace.root, path);
     const body = `${JSON.stringify(waiver, null, 2)}
 `;
-    const expectedHash = existsSync12(absolute) ? digestJson({ body: readFileSync11(absolute, "utf8") }) : "missing";
+    const expectedHash = existsSync13(absolute) ? digestJson({ body: readFileSync11(absolute, "utf8") }) : "missing";
     const draft = this.changeSetEngine.plan({
       id: input.id ?? `changeset.practice-waiver-${waiverId.replace(/[^A-Za-z0-9_-]/g, "-")}`,
       base: {
@@ -21386,6 +21824,16 @@ class ArchctxDaemon {
       const draft = this.changesets.get(input.id);
       if (!draft)
         throw new Error(`Unknown ChangeSet: ${input.id}`);
+      if (draft.base.headSha !== session.workspace.headSha)
+        throw new Error("ChangeSet HEAD changed before apply");
+      if (draft.base.worktreeDigest !== current)
+        throw new Error("ChangeSet worktree digest changed before apply");
+      const currentModel = await this.readModelStore.validateModel(session.workspace);
+      if (!currentModel.valid) {
+        throw new Error(`ChangeSet base model is invalid: ${currentModel.errors.join("; ") || "unknown validation error"}`);
+      }
+      if (draft.base.modelDigest !== currentModel.modelDigest)
+        throw new Error("ChangeSet model digest changed before apply");
       const approved = input.approved ? this.changeSetEngine.approve(draft) : draft;
       let ledgerAppend;
       const writesLedger = architectureLedgerWriteAppendsEvents(this.architectureLedger.writeMode);
@@ -21402,6 +21850,7 @@ class ArchctxDaemon {
             relationCount: appended.relationCount,
             constraintCount: appended.constraintCount
           };
+          return { journalCommitted: Boolean(journalId) };
         } : undefined
       });
       return okEnvelope("apply_update", {
@@ -21435,14 +21884,72 @@ class ArchctxDaemon {
     });
     if (journalId)
       await this.localStore.recordChangeSetLedgerPlan(journalId, { event: plan.event });
-    const result = await this.localStore.appendArchitectureEvents({
-      writer: "runtime-daemon",
-      events: [plan.event]
-    });
-    if (journalId)
-      await this.localStore.recordChangeSetLedgerAppend(journalId, { result });
+    const appendInput = { writer: "runtime-daemon", events: [plan.event] };
+    const result = journalId ? await this.localStore.appendArchitectureEventsAndCommitChangeSet(journalId, appendInput) : await this.localStore.appendArchitectureEvents(appendInput);
     return result;
   }
+  async applyArchitectureProjectionChangeSet(root, input) {
+    const session = await this.openSession(root);
+    const model = await this.modelStore.validateModel(session.workspace);
+    if (!model.valid)
+      throw new Error(`Architecture projection ChangeSet base model is invalid: ${model.errors.join("; ")}`);
+    const projectionFiles = input.files.map((file) => ({
+      path: file.path,
+      body: file.body.endsWith(`
+`) ? file.body : `${file.body}
+`,
+      expectedHash: expectedFileHash(root, file.path)
+    }));
+    const operations = [
+      ...projectionFiles.length > 0 ? [{ op: "render_projection", expectedHash: "missing", projectionFiles }] : [],
+      ...input.removedPaths.map((path) => ({
+        op: "delete_entity",
+        path,
+        expectedHash: expectedFileHash(root, path)
+      }))
+    ];
+    const draft = this.changeSetEngine.approve(this.changeSetEngine.plan({
+      id: input.id,
+      base: {
+        headSha: session.workspace.headSha,
+        worktreeDigest: session.snapshot.worktreeDigest,
+        modelDigest: model.modelDigest
+      },
+      reason: { taskSessionId: input.id },
+      operations
+    }));
+    await this.changeSetEngine.apply(root, draft, { approved: true });
+  }
+  async applyArchitectureProjectionRollbackChangeSet(root, projectedFiles, currentFiles, createdAt) {
+    const targetPaths = new Set(projectedFiles.map((file) => file.path));
+    const backupBase = `.archcontext/backups/ledger-rollback/${safePathSegment(createdAt)}`;
+    const backupRelativePath = uniqueBackupPath(root, backupBase);
+    const manifestPath = `${backupRelativePath}/manifest.json`;
+    const { backup, manifest } = architectureProjectionRollbackBackup(currentFiles, {
+      createdAt,
+      path: backupRelativePath,
+      manifestPath
+    });
+    const removedPaths = currentFiles.filter((file) => !targetPaths.has(file.path)).map((file) => file.path);
+    await this.applyArchitectureProjectionChangeSet(root, {
+      id: `changeset.ledger-rollback-${shortDigest3(digestJson({ createdAt, projectionDigest: architectureLedgerProjectionDigest(projectedFiles) }))}`,
+      files: [
+        ...currentFiles.map((file) => ({
+          path: join8(backupRelativePath, archContextRelativePath(file.path)),
+          body: file.body
+        })),
+        { path: manifestPath, body: `${JSON.stringify(manifest, null, 2)}
+` },
+        ...projectedFiles.map(({ path, body }) => ({ path, body }))
+      ],
+      removedPaths
+    });
+    return {
+      backup,
+      writtenPaths: projectedFiles.map((file) => file.path),
+      removedPaths
+    };
+  }
   async ledgerState(root) {
     this.assertRunning();
     return okEnvelope("ledger.state", await this.architectureLedgerReadback(root));
@@ -21796,8 +22303,13 @@ class ArchctxDaemon {
       const scope = await this.architectureLedgerScope(root);
       const state = await this.localStore.readArchitectureLedgerState(scope);
       const projectedFiles = projectArchitectureLedgerStateToYamlFiles(state);
-      if (writes)
-        writeArchitectureProjectionFiles(root, projectedFiles);
+      if (writes) {
+        await this.applyArchitectureProjectionChangeSet(root, {
+          id: `changeset.ledger-project-${shortDigest3(architectureLedgerProjectionDigest(projectedFiles))}`,
+          files: projectedFiles.map(({ path, body }) => ({ path, body })),
+          removedPaths: []
+        });
+      }
       const drift = compareArchitectureLedgerStateToYaml({
         state,
         files: listModelFiles(root),
@@ -21947,7 +22459,7 @@ class ArchctxDaemon {
       const projectedFiles = projectArchitectureLedgerStateToYamlFiles(state);
       const currentManagedFiles = listModelFiles(root).filter((file) => isArchitectureLedgerManagedModelPath(file.path));
       const backupPlan = architectureProjectionRollbackBackup(currentManagedFiles);
-      const writeResult = writes ? replaceArchitectureProjectionFilesForYamlRollback(root, projectedFiles, currentManagedFiles, this.clock()) : { backup: backupPlan.backup, writtenPaths: [], removedPaths: [] };
+      const writeResult = writes ? await this.applyArchitectureProjectionRollbackChangeSet(root, projectedFiles, currentManagedFiles, this.clock()) : { backup: backupPlan.backup, writtenPaths: [], removedPaths: [] };
       const drift = compareArchitectureLedgerStateToYaml({
         state,
         files: listModelFiles(root),
@@ -21986,9 +22498,12 @@ class ArchctxDaemon {
       return errorEnvelope("ledger.rebuild", "AC_SCHEMA_INVALID", "ledger rebuild currently requires --from-git");
     return this.withWriter(async () => {
       this.assertFreshWorktree(root, input.expectedWorktreeDigest, "ledger rebuild --from-git");
-      const scope = await this.architectureLedgerScope(root);
+      const scope = await this.architectureLedgerGitScope(root);
       const files = listModelFiles(root);
-      const previousState = await this.localStore.readArchitectureLedgerState(scope);
+      const exactReplay = await this.localStore.replayArchitectureLedger(scope);
+      const exactScopeHasEvents = exactReplay.events.length > 0;
+      const authorityScope = exactScopeHasEvents ? scope : await this.localStore.resolveLatestArchitectureLedgerScope(scope);
+      const previousState = exactScopeHasEvents ? exactReplay.state : await this.localStore.readArchitectureLedgerState(authorityScope);
       const previousGraphDigest = architectureLedgerStateDigest(previousState);
       const rebuildCommand = input.acceptExternalProjection ? "archctx ledger rebuild --from-git --accept-external-projection" : "archctx ledger rebuild --from-git";
       const plan = planYamlToArchitectureLedgerRebuild({
@@ -21998,12 +22513,18 @@ class ArchctxDaemon {
         command: rebuildCommand,
         previousState
       });
+      const importPlan = planYamlToArchitectureLedgerImport({
+        ...scope,
+        files,
+        createdAt: this.clock(),
+        command: rebuildCommand
+      });
       if (plan.unsupportedFiles.length > 0) {
         return errorEnvelope("ledger.rebuild", "AC_SCHEMA_INVALID", "ledger rebuild requires supported YAML model files");
       }
       const cursor = architectureLedgerGitCursorFromPlan({ ...scope, plan });
       const previousCursor = await this.localStore.readArchitectureLedgerSourceCursor({
-        ...scope,
+        ...authorityScope,
         cursorId: ARCHITECTURE_LEDGER_GIT_CURSOR_ID
       });
       const cursorChanged = previousCursor?.cursorDigest !== cursor.cursorDigest;
@@ -22019,7 +22540,13 @@ class ArchctxDaemon {
       let rebuildStatus = "unchanged";
       let proposedExternalProjectionChange;
       if (previousGraphDigest === plan.graphDigest) {
-        if (cursorChanged) {
+        if (!exactScopeHasEvents) {
+          append = await this.localStore.appendArchitectureEvents({
+            writer: "runtime-daemon",
+            events: [importPlan.event]
+          });
+          rebuildStatus = isEmptyArchitectureLedgerState(previousState) ? "rebuilt" : "cursor-refreshed";
+        } else if (cursorChanged) {
           const cursorPlan = planGitCursorRefreshToArchitectureLedgerEvent({
             ...scope,
             cursor,
@@ -22035,7 +22562,7 @@ class ArchctxDaemon {
         }
       } else if (!previousStateEmpty && !input.acceptExternalProjection) {
         const proposal = planExternalProjectionChangeToArchitectureLedgerEvent({
-          ...scope,
+          ...authorityScope,
           files,
           createdAt: this.clock(),
           command: rebuildCommand,
@@ -22058,11 +22585,12 @@ class ArchctxDaemon {
       } else {
         append = await this.localStore.appendArchitectureEvents({
           writer: "runtime-daemon",
-          events: [plan.event]
+          events: [exactScopeHasEvents ? plan.event : importPlan.event]
         });
         rebuildStatus = previousStateEmpty ? "rebuilt" : "external-projection-accepted";
       }
-      const replay = await this.localStore.rebuildArchitectureLedgerCurrentState(scope);
+      const replayScope = rebuildStatus === "external-projection-proposed" ? authorityScope : scope;
+      const replay = await this.localStore.rebuildArchitectureLedgerCurrentState(replayScope);
       const drift = compareArchitectureLedgerStateToYaml({
         state: replay.state,
         files: listModelFiles(root),
@@ -22208,6 +22736,9 @@ class ArchctxDaemon {
     return this.running ? this.architectureLedgerContextPort(root) : undefined;
   }
   async architectureLedgerScope(root) {
+    return this.localStore.resolveArchitectureLedgerScope(await this.architectureLedgerGitScope(root));
+  }
+  async architectureLedgerGitScope(root) {
     const session = await this.openSession(root);
     const paths = runtimeStatePaths2(root);
     return {
@@ -22270,7 +22801,7 @@ class ArchctxDaemon {
         cleanup: "remove-run-root"
       }
     };
-    if (existsSync12(paths.lockPath) || existsSync12(paths.manifestPath)) {
+    if (existsSync13(paths.lockPath) || existsSync13(paths.manifestPath)) {
       removePathWithRetry(paths.runRoot);
       throw new Error(`developer-review-run-already-active: ${input.challenge.challengeId}`);
     }
@@ -22327,7 +22858,7 @@ class ArchctxDaemon {
     const errors = [];
     if (run.worktree) {
       try {
-        const hadWorktree = existsSync12(run.worktree.worktreeRoot);
+        const hadWorktree = existsSync13(run.worktree.worktreeRoot);
         removeDetachedReviewWorktree(run.worktree);
         if (hadWorktree)
           removed.push("worktree");
@@ -22341,7 +22872,7 @@ class ArchctxDaemon {
       ["lock", run.lockPath]
     ]) {
       try {
-        const existed = existsSync12(path);
+        const existed = existsSync13(path);
         removePathWithRetry(path);
         if (existed)
           removed.push(kind);
@@ -22370,7 +22901,7 @@ class ArchctxDaemon {
       removedLocks: [],
       skippedActive: []
     };
-    if (!existsSync12(stateDir))
+    if (!existsSync13(stateDir))
       return recovery;
     for (const entry of readdirSync8(stateDir).sort()) {
       if (!entry.endsWith(".json"))
@@ -22738,7 +23269,7 @@ class ArchctxDaemon {
   }
   async restoreRepositorySessions() {
     for (const record of await this.localStore.listRepositorySessions()) {
-      if (!record.root || !existsSync12(record.root))
+      if (!record.root || !existsSync13(record.root))
         continue;
       if (repositoryFingerprint2(record.root) !== record.repositoryId)
         continue;
@@ -23531,7 +24062,7 @@ function recoverStaleDaemonControlFiles(root = process.cwd(), options = {}) {
     rmSync8(connectionPath, { force: true });
     removed.push(connectionReason);
   }
-  if (existsSync12(lockPath) && isStaleLock(lockPath)) {
+  if (existsSync13(lockPath) && isStaleLock(lockPath)) {
     rmSync8(lockPath, { force: true });
     removed.push("stale-lock-file");
   }
@@ -23979,14 +24510,14 @@ function expandWorkspacePackageJson(root, pattern) {
     return [];
   if (!pattern.includes("*")) {
     const path = resolve15(root, pattern, "package.json");
-    return existsSync12(path) ? [path] : [];
+    return existsSync13(path) ? [path] : [];
   }
   if (!pattern.endsWith("/*"))
     return [];
   const base = resolve15(root, pattern.slice(0, -2));
-  if (!existsSync12(base) || !statSync6(base).isDirectory())
+  if (!existsSync13(base) || !statSync6(base).isDirectory())
     return [];
-  return readdirSync8(base, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => resolve15(base, entry.name, "package.json")).filter((path) => existsSync12(path));
+  return readdirSync8(base, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => resolve15(base, entry.name, "package.json")).filter((path) => existsSync13(path));
 }
 function exactVersionFromManifest(manifest, packageName) {
   if (!manifest || typeof manifest !== "object" || Array.isArray(manifest))
@@ -24002,7 +24533,7 @@ function exactVersionFromManifest(manifest, packageName) {
   return;
 }
 function readJsonFile(path) {
-  if (!existsSync12(path))
+  if (!existsSync13(path))
     return;
   try {
     return JSON.parse(readFileSync11(path, "utf8"));
@@ -24015,7 +24546,7 @@ function isExactPackageVersion(value) {
 }
 function readContext7Lockfile(root) {
   const path = resolve15(root, CONTEXT7_LOCKFILE);
-  if (!existsSync12(path)) {
+  if (!existsSync13(path)) {
     return {
       schemaVersion: CONTEXT7_LOCKFILE_SCHEMA_VERSION,
       provider: "context7",
@@ -24264,48 +24795,9 @@ function auditApproveResultPayload(runId, status, totalCount, issuedIssues) {
     issuedIssues
   };
 }
-function writeArchitectureProjectionFiles(root, files) {
-  for (const file of files) {
-    const absolute = resolve15(root, file.path);
-    mkdirSync7(dirname8(absolute), { recursive: true });
-    writeFileSync6(absolute, file.body.endsWith(`
-`) ? file.body : `${file.body}
-`, "utf8");
-  }
-}
-function replaceArchitectureProjectionFilesForYamlRollback(root, projectedFiles, currentFiles, createdAt) {
-  const targetPaths = new Set(projectedFiles.map((file) => file.path));
-  const backupBase = `.archcontext/backups/ledger-rollback/${safePathSegment(createdAt)}`;
-  const backupRelativePath = uniqueBackupPath(root, backupBase);
-  const manifestPath = `${backupRelativePath}/manifest.json`;
-  const { backup, manifest } = architectureProjectionRollbackBackup(currentFiles, {
-    createdAt,
-    path: backupRelativePath,
-    manifestPath
-  });
-  for (const file of currentFiles) {
-    const backupPath = join8(backupRelativePath, archContextRelativePath(file.path));
-    const absolute = resolve15(root, backupPath);
-    mkdirSync7(dirname8(absolute), { recursive: true });
-    writeFileSync6(absolute, file.body, "utf8");
-  }
-  const manifestAbsolute = resolve15(root, manifestPath);
-  mkdirSync7(dirname8(manifestAbsolute), { recursive: true });
-  writeFileSync6(manifestAbsolute, `${JSON.stringify(manifest, null, 2)}
-`, "utf8");
-  const removedPaths = [];
-  for (const file of currentFiles) {
-    if (targetPaths.has(file.path))
-      continue;
-    rmSync8(resolve15(root, file.path), { force: true });
-    removedPaths.push(file.path);
-  }
-  writeArchitectureProjectionFiles(root, projectedFiles);
-  return {
-    backup,
-    writtenPaths: projectedFiles.map((file) => file.path),
-    removedPaths
-  };
+function expectedFileHash(root, path) {
+  const absolute = resolve15(root, path);
+  return existsSync13(absolute) ? digestJson({ body: readFileSync11(absolute, "utf8") }) : "missing";
 }
 function architectureProjectionRollbackBackup(files, options = {}) {
   const manifest = {
@@ -24332,7 +24824,7 @@ function architectureProjectionRollbackBackup(files, options = {}) {
 function uniqueBackupPath(root, backupBase) {
   let candidate = backupBase;
   let suffix = 2;
-  while (existsSync12(resolve15(root, candidate))) {
+  while (existsSync13(resolve15(root, candidate))) {
     candidate = `${backupBase}-${suffix}`;
     suffix += 1;
   }
@@ -24341,7 +24833,7 @@ function uniqueBackupPath(root, backupBase) {
 function uniqueRuntimeBackupPath(backupBase) {
   let candidate = backupBase;
   let suffix = 2;
-  while (existsSync12(candidate)) {
+  while (existsSync13(candidate)) {
     candidate = backupBase.replace(/\.sqlite$/, `-${suffix}.sqlite`);
     suffix += 1;
   }
@@ -24386,7 +24878,7 @@ function isValidRuntimeRpcConnection(value) {
   return value.schemaVersion === RUNTIME_RPC_VERSION && value.protocol === "http-loopback" && value.version === 1 && typeof value.url === "string" && value.url.startsWith("http://127.0.0.1:") && typeof value.token === "string" && value.token.length > 0 && typeof value.pid === "number" && typeof value.connectionPath === "string" && typeof value.lockPath === "string";
 }
 function staleConnectionFileReason(path, removeUnhealthyConnection) {
-  if (!existsSync12(path))
+  if (!existsSync13(path))
     return;
   try {
     if (!isPrivateControlFile(path))
@@ -24448,7 +24940,7 @@ function parsePracticeCheckpointBaselineState(state, repositoryId, taskSessionId
   return record;
 }
 function completeTaskProjectionDrift(root) {
-  if (!existsSync12(resolve15(root, "docs/architecture/.projection-manifest.json")))
+  if (!existsSync13(resolve15(root, "docs/architecture/.projection-manifest.json")))
     return;
   const loaded = loadArchitectureDocumentationInputs(root);
   const sourceDigest = architectureDocumentationSourceDigest({
@@ -24724,7 +25216,7 @@ init_src();
 // packages/local-runtime/runtime-daemon/src/index.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { chmodSync as chmodSync4, closeSync as closeSync6, existsSync as existsSync13, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync5, openSync as openSync6, readdirSync as readdirSync9, readFileSync as readFileSync12, rmSync as rmSync9, statSync as statSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync4, closeSync as closeSync6, existsSync as existsSync14, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync5, openSync as openSync6, readdirSync as readdirSync9, readFileSync as readFileSync12, rmSync as rmSync9, statSync as statSync7, writeFileSync as writeFileSync7 } from "node:fs";
 import { createServer as createServer2 } from "node:http";
 import { tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname9, join as join9, resolve as resolve16 } from "node:path";
@@ -24837,7 +25329,8 @@ class ArchitectureLedgerReadModelStore2 {
     return this.fallback.writeChangeSetPreview(changeSet);
   }
   async loadLedgerModel(workspace) {
-    const state = await this.localStore.readArchitectureLedgerState(architectureLedgerScopeForWorkspace2(workspace));
+    const scope = await this.localStore.resolveArchitectureLedgerScope(architectureLedgerScopeForWorkspace2(workspace));
+    const state = await this.localStore.readArchitectureLedgerState(scope);
     const projectedFiles = projectArchitectureLedgerStateToYamlFiles(state).map((file) => ({
       path: file.path,
       body: file.body,
@@ -24921,7 +25414,7 @@ class ArchctxDaemon2 {
     this.readModelStore = new ArchitectureLedgerReadModelStore2(this.modelStore, this.localStore, this.architectureLedger);
     this.changeSetEngine = deps.changeSetEngine ?? new ChangeSetEngine({
       modelStore: this.modelStore,
-      projection: { rebuildGeneratedProjection },
+      projection: { planGeneratedProjection },
       journal: this.localStore
     });
     this.devicePrivateKeySigner = deps.devicePrivateKeySigner;
@@ -25873,7 +26366,7 @@ class ArchctxDaemon2 {
     const absolute = resolve16(session.workspace.root, path);
     const body = `${JSON.stringify(waiver, null, 2)}
 `;
-    const expectedHash = existsSync13(absolute) ? digestJson({ body: readFileSync12(absolute, "utf8") }) : "missing";
+    const expectedHash = existsSync14(absolute) ? digestJson({ body: readFileSync12(absolute, "utf8") }) : "missing";
     const draft = this.changeSetEngine.plan({
       id: input.id ?? `changeset.practice-waiver-${waiverId.replace(/[^A-Za-z0-9_-]/g, "-")}`,
       base: {
@@ -26212,6 +26705,16 @@ class ArchctxDaemon2 {
       const draft = this.changesets.get(input.id);
       if (!draft)
         throw new Error(`Unknown ChangeSet: ${input.id}`);
+      if (draft.base.headSha !== session.workspace.headSha)
+        throw new Error("ChangeSet HEAD changed before apply");
+      if (draft.base.worktreeDigest !== current)
+        throw new Error("ChangeSet worktree digest changed before apply");
+      const currentModel = await this.readModelStore.validateModel(session.workspace);
+      if (!currentModel.valid) {
+        throw new Error(`ChangeSet base model is invalid: ${currentModel.errors.join("; ") || "unknown validation error"}`);
+      }
+      if (draft.base.modelDigest !== currentModel.modelDigest)
+        throw new Error("ChangeSet model digest changed before apply");
       const approved = input.approved ? this.changeSetEngine.approve(draft) : draft;
       let ledgerAppend;
       const writesLedger = architectureLedgerWriteAppendsEvents2(this.architectureLedger.writeMode);
@@ -26228,6 +26731,7 @@ class ArchctxDaemon2 {
             relationCount: appended.relationCount,
             constraintCount: appended.constraintCount
           };
+          return { journalCommitted: Boolean(journalId) };
         } : undefined
       });
       return okEnvelope("apply_update", {
@@ -26261,14 +26765,72 @@ class ArchctxDaemon2 {
     });
     if (journalId)
       await this.localStore.recordChangeSetLedgerPlan(journalId, { event: plan.event });
-    const result = await this.localStore.appendArchitectureEvents({
-      writer: "runtime-daemon",
-      events: [plan.event]
-    });
-    if (journalId)
-      await this.localStore.recordChangeSetLedgerAppend(journalId, { result });
+    const appendInput = { writer: "runtime-daemon", events: [plan.event] };
+    const result = journalId ? await this.localStore.appendArchitectureEventsAndCommitChangeSet(journalId, appendInput) : await this.localStore.appendArchitectureEvents(appendInput);
     return result;
   }
+  async applyArchitectureProjectionChangeSet(root, input) {
+    const session = await this.openSession(root);
+    const model = await this.modelStore.validateModel(session.workspace);
+    if (!model.valid)
+      throw new Error(`Architecture projection ChangeSet base model is invalid: ${model.errors.join("; ")}`);
+    const projectionFiles = input.files.map((file) => ({
+      path: file.path,
+      body: file.body.endsWith(`
+`) ? file.body : `${file.body}
+`,
+      expectedHash: expectedFileHash2(root, file.path)
+    }));
+    const operations = [
+      ...projectionFiles.length > 0 ? [{ op: "render_projection", expectedHash: "missing", projectionFiles }] : [],
+      ...input.removedPaths.map((path) => ({
+        op: "delete_entity",
+        path,
+        expectedHash: expectedFileHash2(root, path)
+      }))
+    ];
+    const draft = this.changeSetEngine.approve(this.changeSetEngine.plan({
+      id: input.id,
+      base: {
+        headSha: session.workspace.headSha,
+        worktreeDigest: session.snapshot.worktreeDigest,
+        modelDigest: model.modelDigest
+      },
+      reason: { taskSessionId: input.id },
+      operations
+    }));
+    await this.changeSetEngine.apply(root, draft, { approved: true });
+  }
+  async applyArchitectureProjectionRollbackChangeSet(root, projectedFiles, currentFiles, createdAt) {
+    const targetPaths = new Set(projectedFiles.map((file) => file.path));
+    const backupBase = `.archcontext/backups/ledger-rollback/${safePathSegment2(createdAt)}`;
+    const backupRelativePath = uniqueBackupPath2(root, backupBase);
+    const manifestPath = `${backupRelativePath}/manifest.json`;
+    const { backup, manifest } = architectureProjectionRollbackBackup2(currentFiles, {
+      createdAt,
+      path: backupRelativePath,
+      manifestPath
+    });
+    const removedPaths = currentFiles.filter((file) => !targetPaths.has(file.path)).map((file) => file.path);
+    await this.applyArchitectureProjectionChangeSet(root, {
+      id: `changeset.ledger-rollback-${shortDigest4(digestJson({ createdAt, projectionDigest: architectureLedgerProjectionDigest(projectedFiles) }))}`,
+      files: [
+        ...currentFiles.map((file) => ({
+          path: join9(backupRelativePath, archContextRelativePath2(file.path)),
+          body: file.body
+        })),
+        { path: manifestPath, body: `${JSON.stringify(manifest, null, 2)}
+` },
+        ...projectedFiles.map(({ path, body }) => ({ path, body }))
+      ],
+      removedPaths
+    });
+    return {
+      backup,
+      writtenPaths: projectedFiles.map((file) => file.path),
+      removedPaths
+    };
+  }
   async ledgerState(root) {
     this.assertRunning();
     return okEnvelope("ledger.state", await this.architectureLedgerReadback(root));
@@ -26622,8 +27184,13 @@ class ArchctxDaemon2 {
       const scope = await this.architectureLedgerScope(root);
       const state = await this.localStore.readArchitectureLedgerState(scope);
       const projectedFiles = projectArchitectureLedgerStateToYamlFiles(state);
-      if (writes)
-        writeArchitectureProjectionFiles2(root, projectedFiles);
+      if (writes) {
+        await this.applyArchitectureProjectionChangeSet(root, {
+          id: `changeset.ledger-project-${shortDigest4(architectureLedgerProjectionDigest(projectedFiles))}`,
+          files: projectedFiles.map(({ path, body }) => ({ path, body })),
+          removedPaths: []
+        });
+      }
       const drift = compareArchitectureLedgerStateToYaml({
         state,
         files: listModelFiles(root),
@@ -26773,7 +27340,7 @@ class ArchctxDaemon2 {
       const projectedFiles = projectArchitectureLedgerStateToYamlFiles(state);
       const currentManagedFiles = listModelFiles(root).filter((file) => isArchitectureLedgerManagedModelPath2(file.path));
       const backupPlan = architectureProjectionRollbackBackup2(currentManagedFiles);
-      const writeResult = writes ? replaceArchitectureProjectionFilesForYamlRollback2(root, projectedFiles, currentManagedFiles, this.clock()) : { backup: backupPlan.backup, writtenPaths: [], removedPaths: [] };
+      const writeResult = writes ? await this.applyArchitectureProjectionRollbackChangeSet(root, projectedFiles, currentManagedFiles, this.clock()) : { backup: backupPlan.backup, writtenPaths: [], removedPaths: [] };
       const drift = compareArchitectureLedgerStateToYaml({
         state,
         files: listModelFiles(root),
@@ -26812,9 +27379,12 @@ class ArchctxDaemon2 {
       return errorEnvelope("ledger.rebuild", "AC_SCHEMA_INVALID", "ledger rebuild currently requires --from-git");
     return this.withWriter(async () => {
       this.assertFreshWorktree(root, input.expectedWorktreeDigest, "ledger rebuild --from-git");
-      const scope = await this.architectureLedgerScope(root);
+      const scope = await this.architectureLedgerGitScope(root);
       const files = listModelFiles(root);
-      const previousState = await this.localStore.readArchitectureLedgerState(scope);
+      const exactReplay = await this.localStore.replayArchitectureLedger(scope);
+      const exactScopeHasEvents = exactReplay.events.length > 0;
+      const authorityScope = exactScopeHasEvents ? scope : await this.localStore.resolveLatestArchitectureLedgerScope(scope);
+      const previousState = exactScopeHasEvents ? exactReplay.state : await this.localStore.readArchitectureLedgerState(authorityScope);
       const previousGraphDigest = architectureLedgerStateDigest(previousState);
       const rebuildCommand = input.acceptExternalProjection ? "archctx ledger rebuild --from-git --accept-external-projection" : "archctx ledger rebuild --from-git";
       const plan = planYamlToArchitectureLedgerRebuild({
@@ -26824,12 +27394,18 @@ class ArchctxDaemon2 {
         command: rebuildCommand,
         previousState
       });
+      const importPlan = planYamlToArchitectureLedgerImport({
+        ...scope,
+        files,
+        createdAt: this.clock(),
+        command: rebuildCommand
+      });
       if (plan.unsupportedFiles.length > 0) {
         return errorEnvelope("ledger.rebuild", "AC_SCHEMA_INVALID", "ledger rebuild requires supported YAML model files");
       }
       const cursor = architectureLedgerGitCursorFromPlan({ ...scope, plan });
       const previousCursor = await this.localStore.readArchitectureLedgerSourceCursor({
-        ...scope,
+        ...authorityScope,
         cursorId: ARCHITECTURE_LEDGER_GIT_CURSOR_ID
       });
       const cursorChanged = previousCursor?.cursorDigest !== cursor.cursorDigest;
@@ -26845,7 +27421,13 @@ class ArchctxDaemon2 {
       let rebuildStatus = "unchanged";
       let proposedExternalProjectionChange;
       if (previousGraphDigest === plan.graphDigest) {
-        if (cursorChanged) {
+        if (!exactScopeHasEvents) {
+          append = await this.localStore.appendArchitectureEvents({
+            writer: "runtime-daemon",
+            events: [importPlan.event]
+          });
+          rebuildStatus = isEmptyArchitectureLedgerState2(previousState) ? "rebuilt" : "cursor-refreshed";
+        } else if (cursorChanged) {
           const cursorPlan = planGitCursorRefreshToArchitectureLedgerEvent({
             ...scope,
             cursor,
@@ -26861,7 +27443,7 @@ class ArchctxDaemon2 {
         }
       } else if (!previousStateEmpty && !input.acceptExternalProjection) {
         const proposal = planExternalProjectionChangeToArchitectureLedgerEvent({
-          ...scope,
+          ...authorityScope,
           files,
           createdAt: this.clock(),
           command: rebuildCommand,
@@ -26884,11 +27466,12 @@ class ArchctxDaemon2 {
       } else {
         append = await this.localStore.appendArchitectureEvents({
           writer: "runtime-daemon",
-          events: [plan.event]
+          events: [exactScopeHasEvents ? plan.event : importPlan.event]
         });
         rebuildStatus = previousStateEmpty ? "rebuilt" : "external-projection-accepted";
       }
-      const replay = await this.localStore.rebuildArchitectureLedgerCurrentState(scope);
+      const replayScope = rebuildStatus === "external-projection-proposed" ? authorityScope : scope;
+      const replay = await this.localStore.rebuildArchitectureLedgerCurrentState(replayScope);
       const drift = compareArchitectureLedgerStateToYaml({
         state: replay.state,
         files: listModelFiles(root),
@@ -27034,6 +27617,9 @@ class ArchctxDaemon2 {
     return this.running ? this.architectureLedgerContextPort(root) : undefined;
   }
   async architectureLedgerScope(root) {
+    return this.localStore.resolveArchitectureLedgerScope(await this.architectureLedgerGitScope(root));
+  }
+  async architectureLedgerGitScope(root) {
     const session = await this.openSession(root);
     const paths = runtimeStatePaths2(root);
     return {
@@ -27096,7 +27682,7 @@ class ArchctxDaemon2 {
         cleanup: "remove-run-root"
       }
     };
-    if (existsSync13(paths.lockPath) || existsSync13(paths.manifestPath)) {
+    if (existsSync14(paths.lockPath) || existsSync14(paths.manifestPath)) {
       removePathWithRetry(paths.runRoot);
       throw new Error(`developer-review-run-already-active: ${input.challenge.challengeId}`);
     }
@@ -27153,7 +27739,7 @@ class ArchctxDaemon2 {
     const errors = [];
     if (run.worktree) {
       try {
-        const hadWorktree = existsSync13(run.worktree.worktreeRoot);
+        const hadWorktree = existsSync14(run.worktree.worktreeRoot);
         removeDetachedReviewWorktree(run.worktree);
         if (hadWorktree)
           removed.push("worktree");
@@ -27167,7 +27753,7 @@ class ArchctxDaemon2 {
       ["lock", run.lockPath]
     ]) {
       try {
-        const existed = existsSync13(path);
+        const existed = existsSync14(path);
         removePathWithRetry(path);
         if (existed)
           removed.push(kind);
@@ -27196,7 +27782,7 @@ class ArchctxDaemon2 {
       removedLocks: [],
       skippedActive: []
     };
-    if (!existsSync13(stateDir))
+    if (!existsSync14(stateDir))
       return recovery;
     for (const entry of readdirSync9(stateDir).sort()) {
       if (!entry.endsWith(".json"))
@@ -27564,7 +28150,7 @@ class ArchctxDaemon2 {
   }
   async restoreRepositorySessions() {
     for (const record of await this.localStore.listRepositorySessions()) {
-      if (!record.root || !existsSync13(record.root))
+      if (!record.root || !existsSync14(record.root))
         continue;
       if (repositoryFingerprint2(record.root) !== record.repositoryId)
         continue;
@@ -28470,14 +29056,14 @@ function expandWorkspacePackageJson2(root, pattern) {
     return [];
   if (!pattern.includes("*")) {
     const path = resolve16(root, pattern, "package.json");
-    return existsSync13(path) ? [path] : [];
+    return existsSync14(path) ? [path] : [];
   }
   if (!pattern.endsWith("/*"))
     return [];
   const base = resolve16(root, pattern.slice(0, -2));
-  if (!existsSync13(base) || !statSync7(base).isDirectory())
+  if (!existsSync14(base) || !statSync7(base).isDirectory())
     return [];
-  return readdirSync9(base, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => resolve16(base, entry.name, "package.json")).filter((path) => existsSync13(path));
+  return readdirSync9(base, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => resolve16(base, entry.name, "package.json")).filter((path) => existsSync14(path));
 }
 function exactVersionFromManifest2(manifest, packageName) {
   if (!manifest || typeof manifest !== "object" || Array.isArray(manifest))
@@ -28493,7 +29079,7 @@ function exactVersionFromManifest2(manifest, packageName) {
   return;
 }
 function readJsonFile2(path) {
-  if (!existsSync13(path))
+  if (!existsSync14(path))
     return;
   try {
     return JSON.parse(readFileSync12(path, "utf8"));
@@ -28506,7 +29092,7 @@ function isExactPackageVersion2(value) {
 }
 function readContext7Lockfile2(root) {
   const path = resolve16(root, CONTEXT7_LOCKFILE2);
-  if (!existsSync13(path)) {
+  if (!existsSync14(path)) {
     return {
       schemaVersion: CONTEXT7_LOCKFILE_SCHEMA_VERSION,
       provider: "context7",
@@ -28735,48 +29321,9 @@ function auditApproveResultPayload2(runId, status, totalCount, issuedIssues) {
     issuedIssues
   };
 }
-function writeArchitectureProjectionFiles2(root, files) {
-  for (const file of files) {
-    const absolute = resolve16(root, file.path);
-    mkdirSync8(dirname9(absolute), { recursive: true });
-    writeFileSync7(absolute, file.body.endsWith(`
-`) ? file.body : `${file.body}
-`, "utf8");
-  }
-}
-function replaceArchitectureProjectionFilesForYamlRollback2(root, projectedFiles, currentFiles, createdAt) {
-  const targetPaths = new Set(projectedFiles.map((file) => file.path));
-  const backupBase = `.archcontext/backups/ledger-rollback/${safePathSegment2(createdAt)}`;
-  const backupRelativePath = uniqueBackupPath2(root, backupBase);
-  const manifestPath = `${backupRelativePath}/manifest.json`;
-  const { backup, manifest } = architectureProjectionRollbackBackup2(currentFiles, {
-    createdAt,
-    path: backupRelativePath,
-    manifestPath
-  });
-  for (const file of currentFiles) {
-    const backupPath = join9(backupRelativePath, archContextRelativePath2(file.path));
-    const absolute = resolve16(root, backupPath);
-    mkdirSync8(dirname9(absolute), { recursive: true });
-    writeFileSync7(absolute, file.body, "utf8");
-  }
-  const manifestAbsolute = resolve16(root, manifestPath);
-  mkdirSync8(dirname9(manifestAbsolute), { recursive: true });
-  writeFileSync7(manifestAbsolute, `${JSON.stringify(manifest, null, 2)}
-`, "utf8");
-  const removedPaths = [];
-  for (const file of currentFiles) {
-    if (targetPaths.has(file.path))
-      continue;
-    rmSync9(resolve16(root, file.path), { force: true });
-    removedPaths.push(file.path);
-  }
-  writeArchitectureProjectionFiles2(root, projectedFiles);
-  return {
-    backup,
-    writtenPaths: projectedFiles.map((file) => file.path),
-    removedPaths
-  };
+function expectedFileHash2(root, path) {
+  const absolute = resolve16(root, path);
+  return existsSync14(absolute) ? digestJson({ body: readFileSync12(absolute, "utf8") }) : "missing";
 }
 function architectureProjectionRollbackBackup2(files, options = {}) {
   const manifest = {
@@ -28803,7 +29350,7 @@ function architectureProjectionRollbackBackup2(files, options = {}) {
 function uniqueBackupPath2(root, backupBase) {
   let candidate = backupBase;
   let suffix = 2;
-  while (existsSync13(resolve16(root, candidate))) {
+  while (existsSync14(resolve16(root, candidate))) {
     candidate = `${backupBase}-${suffix}`;
     suffix += 1;
   }
@@ -28812,7 +29359,7 @@ function uniqueBackupPath2(root, backupBase) {
 function uniqueRuntimeBackupPath2(backupBase) {
   let candidate = backupBase;
   let suffix = 2;
-  while (existsSync13(candidate)) {
+  while (existsSync14(candidate)) {
     candidate = backupBase.replace(/\.sqlite$/, `-${suffix}.sqlite`);
     suffix += 1;
   }
@@ -28874,7 +29421,7 @@ function parsePracticeCheckpointBaselineState2(state, repositoryId, taskSessionI
   return record;
 }
 function completeTaskProjectionDrift2(root) {
-  if (!existsSync13(resolve16(root, "docs/architecture/.projection-manifest.json")))
+  if (!existsSync14(resolve16(root, "docs/architecture/.projection-manifest.json")))
     return;
   const loaded = loadArchitectureDocumentationInputs(root);
   const sourceDigest = architectureDocumentationSourceDigest({
@@ -28991,6 +29538,7 @@ function writeHtml2(response, statusCode, body) {
 }
 
 // packages/surfaces/mcp-local/src/index.ts
+var MCP_PROTOCOL_VERSION = "2025-03-26";
 var LOCAL_MCP_TOOLS = [
   {
     name: "archcontext_prepare_task",
@@ -29302,9 +29850,17 @@ async function runStdioMcpLoop(input, output, log = (line) => process.stderr.wri
   log("[archctx-mcp] started");
   for await (const line of input) {
     const message = JSON.parse(line);
+    if (message.id === undefined)
+      continue;
     let result;
-    if (message.method === "tools/list") {
+    if (message.method === "initialize") {
+      result = mcpInitializeResult(message.params?.protocolVersion);
+    } else if (message.method === "ping") {
+      result = {};
+    } else if (message.method === "tools/list") {
       result = { tools: server.listTools() };
+    } else if (message.method === "tools/call") {
+      result = await server.callTool(message.params?.name, message.params?.arguments ?? {});
     } else if (message.method === "resources/list") {
       result = { resources: await server.listResources(message.params?.root) };
     } else if (message.method === "resources/read") {
@@ -29314,11 +29870,28 @@ async function runStdioMcpLoop(input, output, log = (line) => process.stderr.wri
         contents: content === undefined ? [] : [{ uri, mimeType: "application/json", text: JSON.stringify(content) }]
       };
     } else {
-      result = await server.callTool(message.params?.name, message.params?.arguments ?? {});
+      result = {
+        content: errorEnvelope("mcp", "AC_SCHEMA_INVALID", `Unknown MCP method: ${message.method}`),
+        dataClassification: "local-metadata"
+      };
     }
     output(JSON.stringify({ jsonrpc: "2.0", id: message.id, result }));
   }
 }
+function mcpInitializeResult(clientProtocolVersion) {
+  const product = productVersionManifest().product;
+  return {
+    protocolVersion: typeof clientProtocolVersion === "string" ? clientProtocolVersion : MCP_PROTOCOL_VERSION,
+    capabilities: {
+      tools: { listChanged: false },
+      resources: { subscribe: false, listChanged: false }
+    },
+    serverInfo: {
+      name: product.name,
+      version: product.version
+    }
+  };
+}
 function isExternalDocumentationResourceUri(uri) {
   return /^archcontext:\/\/external-docs\/context7\/sha256:[0-9a-f]{64}$/.test(uri);
 }
@@ -29365,6 +29938,8 @@ if (__require.main == __require.module) {
 `);
     if (result.ok === false)
       process.exitCode = 1;
+    if (command === "resolve")
+      process.exitCode = resolveCommandExitCode(result);
   }
 }
 async function* stdinLines() {
@@ -29621,6 +30196,37 @@ async function runCliUnchecked(command2 = "help", args2 = [], cwd, deps = {}) {
             revocation: "archctx tunnel --revoke"
           }
         };
+      case "resolve": {
+        const path = readFlag(args2, "--path");
+        if (!path)
+          return errorEnvelope("resolve", "AC_SCHEMA_INVALID", "resolve requires --path");
+        if (!isRepoRelativePosixPath(path)) {
+          return errorEnvelope("resolve", "AC_SCHEMA_INVALID", "resolve --path must be a repository-relative POSIX path");
+        }
+        const model = loadNativeModelFromArchContext(cwd);
+        const outcome = resolveArchitectureOwnerForPath(model.nodes, path);
+        if (outcome.status === "matched") {
+          const node = outcome.node;
+          return okEnvelope("resolve", {
+            matched: true,
+            ambiguous: false,
+            stableId: node.id,
+            kind: node.kind,
+            name: node.name,
+            ...node.source ? { source: node.source } : {},
+            ...node.extensions ? { extensions: node.extensions } : {}
+          });
+        }
+        if (outcome.status === "ambiguous") {
+          return okEnvelope("resolve", {
+            matched: false,
+            ambiguous: true,
+            path,
+            candidates: outcome.candidates.map((node) => node.id)
+          });
+        }
+        return okEnvelope("resolve", { matched: false, ambiguous: false, path });
+      }
       case "help":
       default:
         return {
@@ -29628,8 +30234,8 @@ async function runCliUnchecked(command2 = "help", args2 = [], cwd, deps = {}) {
           ok: true,
           requestId: "help",
           data: {
-            commands: ["init", "sync", "validate", "context", "status", "daemon", "repo", "landscape", "ledger", "book", "recommendations", "explore", "prepare", "practices", "checkpoint", "hook", "hooks", "investigate", "agents", "jobs", "audit", "plan", "apply", "review", "complete", "github", "config", "mcp", "install", "uninstall", "doctor", "update", "paths", "privacy-audit", "export", "import", "tunnel"],
-            examples: ["archctx init --name MyApp", "archctx ledger migrate --from-yaml --dry-run", "archctx ledger promote --mode authoritative --preflight --rollback-plan", "archctx book recommendations --open --explain", "archctx recommendations accept --id recommendation.<id> --reason 'Accepted after local readback.'", "archctx recommendations metrics", "archctx practices validate --strict", "archctx practices list --json", "archctx practices waivers", "archctx practices waive --practice-id modularity.no-new-cycle --owner team-architecture --reason 'External migration window requires this edge until cutover.' --review-at 2026-07-10T00:00:00.000Z --expires-at 2026-07-24T00:00:00.000Z --evidence-digest sha256:<64-hex> --subject module.a->module.b", "archctx checkpoint --task-session-id task_cli", "archctx investigate --runner-port codex", "archctx agents status --status queued,running", "archctx agents budget", "archctx hook enqueue --event post-edit --path src/app.ts", "archctx jobs list --status queued", "archctx audit run --reason 'quarterly architecture audit'", "archctx audit run --no-wait", "archctx audit list --status pending", "archctx audit show audit_run.<id>", "archctx audit approve audit_run.<id>", "archctx audit approve audit_run.<id> --confirm-public-repo public:<owner/repo>:<baseSha>:<runId>", "archctx audit approve audit_run.<id> --resume", "archctx hooks install --host codex", "archctx paths", "archctx update --check", "archctx doctor --check-updates", "archctx github connect", "archctx github status", "archctx daemon start", "archctx explore start --foreground", "archctx export likec4", "archctx import structurizr --content '<json>'", "archctx tunnel"]
+            commands: ["init", "sync", "validate", "context", "status", "daemon", "repo", "landscape", "ledger", "book", "recommendations", "explore", "prepare", "practices", "checkpoint", "hook", "hooks", "investigate", "agents", "jobs", "audit", "plan", "apply", "review", "complete", "github", "config", "mcp", "install", "uninstall", "doctor", "update", "paths", "privacy-audit", "export", "import", "resolve", "tunnel"],
+            examples: ["archctx init --name MyApp", "archctx ledger migrate --from-yaml --dry-run", "archctx ledger promote --mode authoritative --preflight --rollback-plan", "archctx book recommendations --open --explain", "archctx recommendations accept --id recommendation.<id> --reason 'Accepted after local readback.'", "archctx recommendations metrics", "archctx practices validate --strict", "archctx practices list --json", "archctx practices waivers", "archctx practices waive --practice-id modularity.no-new-cycle --owner team-architecture --reason 'External migration window requires this edge until cutover.' --review-at 2026-07-10T00:00:00.000Z --expires-at 2026-07-24T00:00:00.000Z --evidence-digest sha256:<64-hex> --subject module.a->module.b", "archctx checkpoint --task-session-id task_cli", "archctx investigate --runner-port codex", "archctx agents status --status queued,running", "archctx agents budget", "archctx hook enqueue --event post-edit --path src/app.ts", "archctx jobs list --status queued", "archctx audit run --reason 'quarterly architecture audit'", "archctx audit run --no-wait", "archctx audit list --status pending", "archctx audit show audit_run.<id>", "archctx audit approve audit_run.<id>", "archctx audit approve audit_run.<id> --confirm-public-repo public:<owner/repo>:<baseSha>:<runId>", "archctx audit approve audit_run.<id> --resume", "archctx hooks install --host codex", "archctx paths", "archctx update --check", "archctx doctor --check-updates", "archctx github connect", "archctx github status", "archctx daemon start", "archctx explore start --foreground", "archctx export likec4", "archctx import structurizr --content '<json>'", "archctx resolve --path packages/core/projection-engine/src/index.ts", "archctx tunnel"]
           }
         };
     }
@@ -30074,37 +30680,10 @@ function buildArchitectureDocsProjection(root, generatedAt) {
     sourceDigest,
     generatedAt
   });
-  const manifestBody = `${JSON.stringify({
-    schemaVersion: "archcontext.architecture-docs-projection-manifest/v1",
-    rendererVersion: plan.rendererVersion,
-    sourceDigest: plan.sourceDigest,
-    projectionDigest: plan.projectionDigest,
-    targetCount: plan.targets.length,
-    fileCount: plan.files.length,
-    targets: plan.targets.map((target) => ({
-      targetId: target.targetId,
-      type: target.type,
-      scope: target.scope,
-      path: target.path,
-      ownership: target.ownership,
-      rendererVersion: target.rendererVersion,
-      format: target.format,
-      sourceDigest: target.sourceDigest,
-      outputDigest: target.outputDigest
-    }))
-  }, null, 2)}
-`;
-  const manifest = {
-    path: "docs/architecture/.projection-manifest.json",
-    body: manifestBody,
-    digest: digestJson({ path: "docs/architecture/.projection-manifest.json", body: manifestBody }),
-    target: plan.targets[0],
-    generatedBodyDigest: digestJson({ body: manifestBody })
-  };
   return {
     plan,
-    manifest,
-    files: [...plan.files, manifest]
+    manifest: plan.manifest,
+    files: [...plan.files, plan.manifest]
   };
 }
 function architectureDocsRenderProjectionOperation(root, files) {
@@ -30120,7 +30699,7 @@ function architectureDocsRenderProjectionOperation(root, files) {
 }
 function currentBodyHash(root, path) {
   const absolute = resolve17(root, path);
-  return existsSync14(absolute) ? digestJson({ body: readFileSync13(absolute, "utf8") }) : "missing";
+  return existsSync15(absolute) ? digestJson({ body: readFileSync13(absolute, "utf8") }) : "missing";
 }
 async function runPracticesCommand(args2, cwd, daemon) {
   const subcommand = args2[0] ?? "list";
@@ -30468,7 +31047,7 @@ function auditManifestGateRoot(cwd) {
 }
 function auditGithubIssuesEnabled(cwd) {
   const manifestPath = resolve17(auditManifestGateRoot(cwd), ".archcontext/manifest.yaml");
-  if (!existsSync14(manifestPath))
+  if (!existsSync15(manifestPath))
     return false;
   let raw;
   try {
@@ -31081,7 +31660,7 @@ async function writeGithubDeveloperReviewState(cwd, state) {
   return { state, path };
 }
 function readGithubDeveloperReviewState(path) {
-  if (!existsSync14(path))
+  if (!existsSync15(path))
     return;
   try {
     const parsed = JSON.parse(readFileSync13(path, "utf8"));
@@ -31133,7 +31712,7 @@ function defaultGithubConnectionPath(cwd) {
   return join10(dirname10(defaultDaemonConnectionPath(cwd)), "github-connection.json");
 }
 function readGithubConnection(path) {
-  if (!existsSync14(path))
+  if (!existsSync15(path))
     return;
   try {
     const parsed = JSON.parse(readFileSync13(path, "utf8"));
@@ -31647,10 +32226,10 @@ function doctorSqlite(cwd) {
   const legacyLocalStore = inspectLegacyLocalStoreMigration(cwd);
   return {
     path,
-    exists: existsSync14(path),
+    exists: existsSync15(path),
     migrations: productVersionManifest().runtime.sqliteMigrations,
     legacyPath: paths.legacyLocalStorePath,
-    legacyExists: existsSync14(paths.legacyLocalStorePath),
+    legacyExists: existsSync15(paths.legacyLocalStorePath),
     legacyLocalStore
   };
 }
@@ -31681,7 +32260,7 @@ function runtimePathsReport(cwd) {
   };
 }
 function pathAccess(path) {
-  const exists = existsSync14(path);
+  const exists = existsSync15(path);
   return {
     path,
     exists,
@@ -32164,6 +32743,16 @@ function renderResult(result, format) {
   return `OK ${result.requestId}
 ${JSON.stringify(result.data, null, 2)}`;
 }
+function resolveCommandExitCode(result) {
+  if (!result || result.ok !== true)
+    return 1;
+  const data = result.data;
+  if (data?.matched === true)
+    return 0;
+  if (data?.ambiguous === true)
+    return 2;
+  return 1;
+}
 function readFlag(args2, flag) {
   const index = args2.indexOf(flag);
   if (index === -1)
@@ -32193,5 +32782,6 @@ function readRepeatedFlag(args2, flag) {
 }
 export {
   runForegroundDaemon,
-  runCli
+  runCli,
+  resolveCommandExitCode
 };