archctx 0.2.1 → 0.2.3

package/bin/archctx.mjs

@@ -696,13 +696,13 @@ function productVersionManifest() {
       sqliteMigrations: "0001_runtime_state..0004_changeset_journal",
       codeGraph: {
         packageName: "@colbymchenry/codegraph",
-        requiredVersion: "1.0.1",
+        requiredVersion: "1.4.0",
         adapter: "codegraph-cli"
       }
     }
   };
 }
-var ARCHCONTEXT_PRODUCT_NAME = "archctx", ARCHCONTEXT_PRODUCT_VERSION = "0.2.1", ARCHCONTEXT_PACKAGE_MANAGER = "bun@1.3.10", ARCHCONTEXT_NODE_RANGE = ">=24 <26", LOCAL_RUNTIME_RPC_SCHEMA_VERSION = "archcontext.runtime-rpc/v1", ARCHCONTEXT_SCHEMA_SET_VERSION = "2026-06-25.al0-ledger";
+var ARCHCONTEXT_PRODUCT_NAME = "archctx", ARCHCONTEXT_PRODUCT_VERSION = "0.2.3", ARCHCONTEXT_PACKAGE_MANAGER = "bun@1.3.10", ARCHCONTEXT_NODE_RANGE = ">=24 <26", LOCAL_RUNTIME_RPC_SCHEMA_VERSION = "archcontext.runtime-rpc/v1", ARCHCONTEXT_SCHEMA_SET_VERSION = "2026-06-25.al0-ledger";
 // packages/contracts/src/index.ts
 var init_src = __esm(() => {
   init_control_plane_routes();
@@ -5145,8 +5145,8 @@ var init_src7 = __esm(() => {
 
 // packages/surfaces/cli/src/main.ts
 import { execFileSync as execFileSync8, spawn as spawn2, spawnSync as spawnSync3 } from "child_process";
-import { accessSync, chmodSync as chmodSync5, closeSync as closeSync7, constants, existsSync as existsSync14, mkdirSync as mkdirSync9, openSync as openSync7, readFileSync as readFileSync13, rmSync as rmSync10, statSync as statSync8, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname10, join as join10, resolve as resolve17 } from "path";
+import { accessSync as accessSync2, chmodSync as chmodSync5, closeSync as closeSync7, constants, existsSync as existsSync15, mkdirSync as mkdirSync9, openSync as openSync7, readFileSync as readFileSync14, rmSync as rmSync10, statSync as statSync8, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname11, join as join10, resolve as resolve18 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // packages/contracts/src/index.ts
@@ -5292,8 +5292,8 @@ var UNTRUSTED_TOOL_ESCAPE_KEYS = new Set([
 ]);
 
 // packages/cloud/hardening/src/index.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync3, statSync as statSync4 } from "node:fs";
-import { resolve as resolve3 } from "node:path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync4, statSync as statSync4 } from "node:fs";
+import { resolve as resolve4 } from "node:path";
 
 // packages/core/architecture-domain/src/index.ts
 init_src();
@@ -5654,8 +5654,9 @@ init_src2();
 
 // packages/local-runtime/codegraph-adapter/src/index.ts
 import { execFileSync } from "node:child_process";
-import { closeSync, existsSync, openSync, readSync, realpathSync as realpathSync3, statSync as statSync3 } from "node:fs";
-import { basename as basename2, delimiter, isAbsolute, join, posix } from "node:path";
+import { accessSync, closeSync, constants as fsConstants, existsSync, openSync, readFileSync as readFileSync3, readSync, realpathSync as realpathSync3, statSync as statSync3 } from "node:fs";
+import { createRequire as createRequire2 } from "node:module";
+import { basename as basename2, delimiter, dirname, isAbsolute, join, posix, resolve as resolve3 } from "node:path";
 
 // packages/core/architecture-delta/src/index.ts
 init_src();
@@ -6582,9 +6583,11 @@ function numberExtension(value) {
 // packages/local-runtime/codegraph-adapter/src/index.ts
 init_src();
 var REQUIRED_CODEGRAPH_PACKAGE = "@colbymchenry/codegraph";
-var REQUIRED_CODEGRAPH_VERSION = "1.0.1";
+var REQUIRED_CODEGRAPH_VERSION = "1.4.0";
 var CODEGRAPH_TELEMETRY_ENV = "DO_NOT_TRACK";
 var CODEGRAPH_TELEMETRY_DISABLED_VALUE = "1";
+var DEFAULT_CODEGRAPH_BINARY = "codegraph";
+var requireFromAdapter = createRequire2(import.meta.url);
 function disableCodeGraphTelemetryByDefault(env = process.env) {
   env[CODEGRAPH_TELEMETRY_ENV] ??= CODEGRAPH_TELEMETRY_DISABLED_VALUE;
   return env[CODEGRAPH_TELEMETRY_ENV] ?? CODEGRAPH_TELEMETRY_DISABLED_VALUE;
@@ -6595,7 +6598,7 @@ class CodeGraphCliProvider {
   version = REQUIRED_CODEGRAPH_VERSION;
   capabilities = ["index", "context", "impact"];
   workspaceRoot;
-  constructor(workspaceRoot = process.cwd(), binary = "codegraph") {
+  constructor(workspaceRoot = process.cwd(), binary = DEFAULT_CODEGRAPH_BINARY) {
     this.binary = binary;
     this.workspaceRoot = workspaceRoot;
   }
@@ -6679,27 +6682,56 @@ class CodeGraphCliProvider {
     }
   }
 }
-function codeGraphCliInvocation(binary, cwd) {
-  const resolved = resolveExecutable(binary, cwd);
+function codeGraphCliInvocation(binary, cwd, pathValue = process.env.PATH ?? "") {
+  const resolved = resolveExecutable(binary, cwd, pathValue);
   if (resolved && isNodeRuntimeScript(resolved)) {
     return { command: process.execPath, argsPrefix: [resolved] };
   }
+  if (!resolved && binary === DEFAULT_CODEGRAPH_BINARY) {
+    const packagedShim = resolvePackagedCodeGraphShim();
+    if (packagedShim)
+      return { command: process.execPath, argsPrefix: [packagedShim] };
+  }
   return { command: binary, argsPrefix: [] };
 }
-function resolveExecutable(binary, cwd) {
+function resolveExecutable(binary, cwd, pathValue) {
   if (binary.includes("/") || binary.includes("\\")) {
     const path = isAbsolute(binary) ? binary : join(cwd, binary);
     return existsSync(path) ? realpathSync3.native(path) : undefined;
   }
-  for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+  for (const dir of pathValue.split(delimiter)) {
     if (!dir)
       continue;
     const path = join(dir, binary);
-    if (existsSync(path))
+    if (isExecutablePath(path))
       return realpathSync3.native(path);
   }
   return;
 }
+function isExecutablePath(path) {
+  try {
+    if (!statSync3(path).isFile())
+      return false;
+    if (process.platform !== "win32")
+      accessSync(path, fsConstants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolvePackagedCodeGraphShim() {
+  try {
+    const manifestPath = requireFromAdapter.resolve(`${REQUIRED_CODEGRAPH_PACKAGE}/package.json`);
+    const manifest = JSON.parse(readFileSync3(manifestPath, "utf8"));
+    const relativeBin = manifest.bin?.codegraph;
+    if (manifest.version !== REQUIRED_CODEGRAPH_VERSION || !relativeBin)
+      return;
+    const shimPath = resolve3(dirname(manifestPath), relativeBin);
+    return existsSync(shimPath) ? realpathSync3.native(shimPath) : undefined;
+  } catch {
+    return;
+  }
+}
 function isNodeRuntimeScript(path) {
   if (/\.[cm]?js$/i.test(path))
     return true;
@@ -7094,7 +7126,7 @@ function uninstallMarker(content, host) {
 `).trim();
 }
 function dependencyAudit(root) {
-  const packageJson = JSON.parse(readFileSync3(resolve3(root, "package.json"), "utf8"));
+  const packageJson = JSON.parse(readFileSync4(resolve4(root, "package.json"), "utf8"));
   const issues = [];
   if (!packageJson.engines?.node?.includes(">=24"))
     issues.push("node engine must include >=24");
@@ -7107,7 +7139,7 @@ function secretScan(root) {
       continue;
     if (file === "packages/cloud/hardening/src/index.ts" || file.includes("/test/"))
       continue;
-    const body = readFileSync3(resolve3(root, file), "utf8");
+    const body = readFileSync4(resolve4(root, file), "utf8");
     if (/(sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{20,}|BEGIN PRIVATE KEY)/.test(body))
       findings.push(file);
   }
@@ -7141,11 +7173,11 @@ function listFiles(root) {
   walk(".");
   return out;
   function walk(relativeDir) {
-    for (const entry of readdirSync3(resolve3(root, relativeDir), { withFileTypes: true })) {
+    for (const entry of readdirSync3(resolve4(root, relativeDir), { withFileTypes: true })) {
       if ([".git", "node_modules", "coverage"].includes(entry.name))
         continue;
       const child = relativeDir === "." ? entry.name : `${relativeDir}/${entry.name}`;
-      const full = resolve3(root, child);
+      const full = resolve4(root, child);
       if (entry.isDirectory())
         walk(child);
       if (entry.isFile() && statSync4(full).size < 1e6)
@@ -7157,10 +7189,10 @@ function listFiles(root) {
 // packages/local-runtime/local-store-sqlite/src/index.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { createHash as createHash5, randomUUID } from "node:crypto";
-import { chmodSync, closeSync as closeSync2, existsSync as existsSync2, fsyncSync, lstatSync, mkdirSync, openSync as openSync2, readFileSync as readFileSync4, realpathSync as realpathSync4, renameSync, rmSync, writeFileSync } from "node:fs";
-import { createRequire as createRequire2 } from "node:module";
+import { chmodSync, closeSync as closeSync2, existsSync as existsSync2, fsyncSync, lstatSync, mkdirSync, openSync as openSync2, readFileSync as readFileSync5, realpathSync as realpathSync4, renameSync, rmSync, writeFileSync } from "node:fs";
+import { createRequire as createRequire3 } from "node:module";
 import { homedir } from "node:os";
-import { dirname, isAbsolute as isAbsolute2, join as join2, relative as relative3, resolve as resolve4 } from "node:path";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, relative as relative3, resolve as resolve5 } from "node:path";
 
 // packages/core/architecture-ledger/src/index.ts
 init_src();
@@ -7493,7 +7525,7 @@ function planYamlToArchitectureLedgerImport(input) {
     payloadVersion: "archcontext.architecture-ledger-yaml-import/v1",
     repository: input.repository,
     worktree: input.worktree,
-    baseDigest: sourceDigest,
+    baseDigest: architectureLedgerStateDigest(emptyArchitectureLedgerState()),
     resultingDigest: graphDigest,
     headSha: input.worktree.headSha,
     actor: { kind: "migration", id: "archctx-ledger-yaml-import" },
@@ -7677,8 +7709,6 @@ function planYamlToArchitectureLedgerRebuild(input) {
   const plan = planYamlToArchitectureLedgerImport(input);
   const previousGraphDigest = architectureLedgerStateDigest(input.previousState);
   const deleteOperations = architectureLedgerDeletionOperations(input.previousState, plan.state);
-  if (deleteOperations.length === 0)
-    return plan;
   const payload = architectureLedgerPayload(plan.event);
   const event = normalizeArchitectureLedgerEvent({
     ...plan.event,
@@ -8244,41 +8274,41 @@ function projectArchitectureLedgerStateToYamlFiles(state) {
   const canonical = canonicalArchitectureLedgerState(state);
   const files = [
     ...canonical.entities.map((entity) => {
+      const declared = declaredProjectionRecord(entity.metadata, ["archcontext.node/v1"], `entity ${entity.entityId}`);
+      const summary = entity.summary;
+      if (!summary)
+        throw new Error(`architecture-ledger-projection-invalid: entity ${entity.entityId} requires summary`);
       const body = canonicalArchitectureYaml({
+        ...declared,
         schemaVersion: "archcontext.node/v1",
         id: entity.entityId,
         kind: entity.kind,
         name: entity.canonicalName,
         status: entity.status,
-        ...entity.path ? { path: entity.path } : {},
-        ...entity.summary ? { summary: entity.summary } : {},
-        ...entity.metadata ? { metadata: entity.metadata } : {}
+        summary
       });
       return projectionFile(`.archcontext/model/nodes/${pathSegment(entity.entityId)}.yaml`, body, "entity", entity.entityId);
     }),
     ...canonical.relations.map((relation) => {
-      const body = canonicalArchitectureYaml({
+      const declared = declaredProjectionRecord(relation.metadata, ["archcontext.relation/v1", "archcontext.cross-repo-relation/v1"], `relation ${relation.relationId}`);
+      const schemaVersion = requireStringField(declared, "schemaVersion", `relation ${relation.relationId}`);
+      const body = schemaVersion === "archcontext.cross-repo-relation/v1" ? canonicalArchitectureYaml({ ...declared, id: relation.relationId, kind: relation.kind }) : canonicalArchitectureYaml({
+        ...declared,
         schemaVersion: "archcontext.relation/v1",
         id: relation.relationId,
         kind: relation.kind,
         source: relation.sourceEntityId,
-        target: relation.targetEntityId,
-        status: relation.status,
-        ...relation.summary ? { summary: relation.summary } : {},
-        ...relation.metadata ? { metadata: relation.metadata } : {}
+        target: relation.targetEntityId
       });
       return projectionFile(`.archcontext/model/relations/${pathSegment(relation.relationId)}.yaml`, body, "relation", relation.relationId);
     }),
     ...canonical.constraints.map((constraint) => {
+      const declared = declaredProjectionRecord(constraint.metadata, ["archcontext.constraint/v1"], `constraint ${constraint.constraintId}`);
       const body = canonicalArchitectureYaml({
+        ...declared,
         schemaVersion: "archcontext.constraint/v1",
         id: constraint.constraintId,
-        kind: constraint.kind,
-        subject: constraint.subjectId,
-        status: constraint.status,
-        ...constraint.severity ? { severity: constraint.severity } : {},
-        ...constraint.summary ? { summary: constraint.summary } : {},
-        ...constraint.metadata ? { metadata: constraint.metadata } : {}
+        ...constraint.severity ? { severity: constraint.severity } : {}
       });
       return projectionFile(`.archcontext/model/constraints/${pathSegment(constraint.constraintId)}.yaml`, body, "constraint", constraint.constraintId);
     })
@@ -8453,12 +8483,11 @@ function yamlRecordToLedgerOperation(value, path, schemaVersion) {
     const entityId = requireStringField(value, "id", path);
     const entity = {
       entityId,
-      kind: stringField(value, "kind") ?? "component",
-      canonicalName: stringField(value, "name") ?? stringField(value, "canonicalName") ?? entityId,
-      status: activeStatus(value.status),
-      ...stringField(value, "path") ? { path: stringField(value, "path") } : {},
-      ...stringField(value, "summary") ? { summary: stringField(value, "summary") } : {},
-      ...metadataField(value, ["schemaVersion", "id", "kind", "name", "canonicalName", "status", "path", "summary"])
+      kind: requireStringField(value, "kind", path),
+      canonicalName: requireStringField(value, "name", path),
+      status: declaredStatus(value.status, path),
+      summary: requireStringField(value, "summary", path),
+      metadata: { declared: value }
     };
     return { operation: { op: "upsert_entity", entity }, targetKind: "entity", targetId: entityId };
   }
@@ -8466,12 +8495,12 @@ function yamlRecordToLedgerOperation(value, path, schemaVersion) {
     const relationId = requireStringField(value, "id", path);
     const relation = {
       relationId,
-      kind: stringField(value, "kind") ?? "depends_on",
+      kind: requireStringField(value, "kind", path),
       sourceEntityId: requireStringField(value, "source", path),
       targetEntityId: requireStringField(value, "target", path),
-      status: activeStatus(value.status),
-      ...stringField(value, "summary") ?? stringField(value, "intent") ? { summary: stringField(value, "summary") ?? stringField(value, "intent") } : {},
-      ...metadataField(value, ["schemaVersion", "id", "kind", "source", "target", "status", "summary", "intent"])
+      status: "active",
+      summary: requireStringField(value, "intent", path),
+      metadata: { declared: value }
     };
     return { operation: { op: "upsert_relation", relation }, targetKind: "relation", targetId: relationId };
   }
@@ -8481,25 +8510,28 @@ function yamlRecordToLedgerOperation(value, path, schemaVersion) {
     const target = repoScopedTarget(value.target, path, "target");
     const relation = {
       relationId,
-      kind: stringField(value, "kind") ?? "depends_on",
+      kind: requireStringField(value, "kind", path),
       sourceEntityId: source,
       targetEntityId: target,
-      status: activeStatus(value.status),
-      ...stringField(value, "intent") ? { summary: stringField(value, "intent") } : {},
-      ...metadataField(value, ["schemaVersion", "id", "kind", "source", "target", "status", "intent"])
+      status: "active",
+      summary: requireStringField(value, "intent", path),
+      metadata: { declared: value }
     };
     return { operation: { op: "upsert_relation", relation }, targetKind: "relation", targetId: relationId };
   }
   if (schemaVersion === "archcontext.constraint/v1") {
     const constraintId = requireStringField(value, "id", path);
+    const scope = requiredRecordField(value, "scope", path);
+    const rule = requiredRecordField(value, "rule", path);
+    const subjectId = firstStringArrayValue(scope.nodes) ?? firstStringArrayValue(scope.relations) ?? "repository";
     const constraint = {
       constraintId,
-      kind: stringField(value, "kind") ?? "constraint",
-      subjectId: stringField(value, "subject") ?? stringField(value, "subjectId") ?? "repository",
-      status: activeStatus(value.status),
-      ...severityField(value.severity) ? { severity: severityField(value.severity) } : {},
-      ...stringField(value, "summary") ? { summary: stringField(value, "summary") } : {},
-      ...metadataField(value, ["schemaVersion", "id", "kind", "subject", "subjectId", "status", "severity", "summary"])
+      kind: requireStringField(rule, "type", path),
+      subjectId,
+      status: "active",
+      severity: requiredSeverity(value.severity, path),
+      summary: requireStringField(value, "rationale", path),
+      metadata: { declared: value }
     };
     return { operation: { op: "upsert_constraint", constraint }, targetKind: "constraint", targetId: constraintId };
   }
@@ -8636,19 +8668,30 @@ function isEvidenceOnlySchema(schemaVersion) {
 function isGeneratedProjectionFile(file) {
   return file.schemaVersion === "archcontext.generated/v1" || file.path === ".archcontext/generated" || file.path.startsWith(".archcontext/generated/") || file.body.includes("Generated by ArchContext");
 }
-function metadataField(value, omitted) {
-  const metadata = {};
-  const explicit = value.metadata;
-  if (isRecord(explicit)) {
-    for (const key of Object.keys(explicit).sort())
-      metadata[key] = explicit[key];
-  }
-  for (const key of Object.keys(value).sort()) {
-    if (omitted.includes(key) || key === "metadata")
-      continue;
-    metadata[key] = value[key];
+function declaredProjectionRecord(metadata, allowedSchemaVersions, label) {
+  const declared = metadata?.declared;
+  if (!isRecord(declared))
+    throw new Error(`architecture-ledger-projection-invalid: ${label} has no declared YAML record`);
+  const schemaVersion = requireStringField(declared, "schemaVersion", label);
+  if (!allowedSchemaVersions.includes(schemaVersion)) {
+    throw new Error(`architecture-ledger-projection-invalid: ${label} has unsupported declared schema ${schemaVersion}`);
   }
-  return Object.keys(metadata).length === 0 ? {} : { metadata };
+  return declared;
+}
+function requiredRecordField(value, key, path) {
+  const field = value[key];
+  if (!isRecord(field))
+    throw new Error(`${path}: ${key} is required`);
+  return field;
+}
+function firstStringArrayValue(value) {
+  return Array.isArray(value) ? value.find((item) => typeof item === "string" && item.length > 0) : undefined;
+}
+function requiredSeverity(value, path) {
+  const severity = severityField(value);
+  if (!severity)
+    throw new Error(`${path}: severity is required`);
+  return severity;
 }
 function declaredYamlSubject(value, path) {
   const id = stringField(value, "id");
@@ -8681,8 +8724,10 @@ function requireStringField(value, key, path) {
 function stringField(value, key) {
   return typeof value[key] === "string" ? value[key] : undefined;
 }
-function activeStatus(value) {
-  return value === "deprecated" || value === "removed" ? value : "active";
+function declaredStatus(value, path) {
+  if (value === "active" || value === "planned" || value === "deprecated" || value === "removed")
+    return value;
+  throw new Error(`${path}: status is required`);
 }
 function severityField(value) {
   return value === "notice" || value === "warning" || value === "error" || value === "critical" ? value : undefined;
@@ -8768,10 +8813,85 @@ function validateArchitectureLedgerEvent(event) {
   if (event.worktree.workspaceId.length === 0 || event.worktree.storageWorkspaceId.length === 0 || event.worktree.headSha.length === 0) {
     throw new Error(`architecture-ledger-invalid-event: worktree identity required for ${event.eventId}`);
   }
+  assertArchitectureLedgerPersistenceSafe(event.payload, `event.payload for ${event.eventId}`);
+  if (event.extensions)
+    assertArchitectureLedgerPersistenceSafe(event.extensions, `event.extensions for ${event.eventId}`);
+  assertArchitectureLedgerPersistenceSafe(event.provenance, `event.provenance for ${event.eventId}`);
   const payload = architectureLedgerPayload(event);
   for (const operation of payload.operations ?? [])
     validateArchitectureLedgerOperation(operation, event.eventId);
 }
+var ARCHITECTURE_LEDGER_MAX_PERSISTED_JSON_BYTES = 262144;
+var ARCHITECTURE_LEDGER_MAX_PERSISTED_STRING_BYTES = 8192;
+var ARCHITECTURE_LEDGER_MAX_PERSISTED_DEPTH = 32;
+var ARCHITECTURE_LEDGER_FORBIDDEN_RAW_KEYS = new Set([
+  "rawsource",
+  "sourcebody",
+  "sourcecode",
+  "rawdiff",
+  "diffbody",
+  "rawpatch",
+  "patchbody",
+  "prompt",
+  "promptbody",
+  "completion",
+  "completionbody",
+  "codegraphoutput",
+  "fullcodegraphoutput",
+  "webhookbody",
+  "rawwebhook",
+  "secret",
+  "secrets",
+  "credential",
+  "credentials",
+  "privatekey",
+  "accesstoken",
+  "refreshtoken"
+]);
+var ARCHITECTURE_LEDGER_SAFE_SENSITIVE_KEY_SUFFIX = /(?:digest|id|ids|count|counts|ref|refs|path|paths|persisted)$/;
+var ARCHITECTURE_LEDGER_FORBIDDEN_STRING_PATTERNS = [
+  /diff --git /,
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+  /\bgh[pousr]_[A-Za-z0-9]{20,}\b/,
+  /\bsk-[A-Za-z0-9_-]{20,}\b/,
+  /\bAKIA[A-Z0-9]{16}\b/,
+  /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/i,
+  /\b(?:api[_-]?key|secret|token|password|private[_-]?key)\s*[:=]\s*["']?[^\s"',;]{8,}/i
+];
+function assertArchitectureLedgerPersistenceSafe(value, label = "architecture-ledger-value") {
+  const encoded = JSON.stringify(value);
+  if (Buffer2.byteLength(encoded, "utf8") > ARCHITECTURE_LEDGER_MAX_PERSISTED_JSON_BYTES) {
+    throw new Error(`architecture-ledger-privacy-denied: persisted JSON exceeds size limit at ${label}`);
+  }
+  visit(value, label, 0);
+  function visit(current, path, depth) {
+    if (depth > ARCHITECTURE_LEDGER_MAX_PERSISTED_DEPTH) {
+      throw new Error(`architecture-ledger-privacy-denied: persisted JSON exceeds depth limit at ${path}`);
+    }
+    if (typeof current === "string") {
+      if (Buffer2.byteLength(current, "utf8") > ARCHITECTURE_LEDGER_MAX_PERSISTED_STRING_BYTES) {
+        throw new Error(`architecture-ledger-privacy-denied: persisted string exceeds size limit at ${path}`);
+      }
+      if (ARCHITECTURE_LEDGER_FORBIDDEN_STRING_PATTERNS.some((pattern) => pattern.test(current))) {
+        throw new Error(`architecture-ledger-privacy-denied: forbidden raw or secret-shaped content at ${path}`);
+      }
+      return;
+    }
+    if (current === null || typeof current !== "object")
+      return;
+    if (Array.isArray(current)) {
+      current.forEach((item, index) => visit(item, `${path}[${index}]`, depth + 1));
+      return;
+    }
+    for (const [key, child] of Object.entries(current)) {
+      const normalizedKey = key.replace(/[-_]/g, "").toLowerCase();
+      if (ARCHITECTURE_LEDGER_FORBIDDEN_RAW_KEYS.has(normalizedKey) && !ARCHITECTURE_LEDGER_SAFE_SENSITIVE_KEY_SUFFIX.test(normalizedKey)) {
+        throw new Error(`architecture-ledger-privacy-denied: forbidden persisted field at ${path}.${key}`);
+      }
+      visit(child, `${path}.${key}`, depth + 1);
+    }
+  }
+}
 function validateArchitectureLedgerOperation(operation, eventId) {
   if (!operation || typeof operation !== "object" || !("op" in operation)) {
     throw new Error(`architecture-ledger-invalid-operation: ${eventId}`);
@@ -8894,7 +9014,7 @@ function requireNonEmpty(value, label, eventId) {
   }
 }
 function requireActiveStatus(value, eventId) {
-  if (!["active", "deprecated", "removed"].includes(value)) {
+  if (!["active", "planned", "deprecated", "removed"].includes(value)) {
     throw new Error(`architecture-ledger-invalid-operation: invalid status for ${eventId}`);
   }
 }
@@ -8906,7 +9026,7 @@ function assertRecord(value, label) {
 
 // packages/local-runtime/local-store-sqlite/src/index.ts
 init_src();
-var runtimeRequire = createRequire2(import.meta.url);
+var runtimeRequire = createRequire3(import.meta.url);
 var SQLITE_SIDECAR_SUFFIXES = ["", "-wal", "-shm"];
 var LEGACY_MIGRATION_MARKER_FILE = "runtime.sqlite.migration.json";
 var LEGACY_MIGRATION_LOCK_FILE = "runtime.sqlite.migration.lock";
@@ -8943,6 +9063,7 @@ var REQUIRED_LOCAL_STORE_TABLES = [
 ];
 var SQLITE_PRAGMAS = [
   "PRAGMA journal_mode = WAL",
+  "PRAGMA synchronous = FULL",
   "PRAGMA foreign_keys = ON",
   "PRAGMA busy_timeout = 5000"
 ];
@@ -9464,6 +9585,13 @@ var LOCAL_SQLITE_MIGRATIONS = [
       )`,
       "CREATE INDEX IF NOT EXISTS idx_audit_runs_status ON audit_runs(storage_repository_id, storage_workspace_id, status)"
     ]
+  },
+  {
+    id: "0011_changeset_cleanup_cursor",
+    statements: [
+      "ALTER TABLE changeset_journal ADD COLUMN cleanup_completed_at TEXT",
+      "CREATE INDEX IF NOT EXISTS idx_changeset_journal_cleanup_pending ON changeset_journal(status, cleanup_completed_at, updated_at)"
+    ]
   }
 ];
 var ARCHCONTEXT_STATE_DIR_ENV = "ARCHCONTEXT_STATE_DIR";
@@ -9471,7 +9599,7 @@ var ARCHCONTEXT_LOCAL_STORE_PATH_ENV = "ARCHCONTEXT_LOCAL_STORE_PATH";
 function defaultArchContextStateRoot(env = process.env, platform = process.platform, home = homedir()) {
   const override = env[ARCHCONTEXT_STATE_DIR_ENV];
   if (override)
-    return { path: resolve4(override), source: "environment" };
+    return { path: resolve5(override), source: "environment" };
   if (platform === "darwin")
     return { path: join2(home, "Library", "Application Support", "ArchContext"), source: "os-user-data" };
   if (platform === "win32")
@@ -9489,7 +9617,7 @@ function runtimeStatePaths(root = process.cwd(), env = process.env) {
   const stateRoot = defaultArchContextStateRoot(env);
   const repositoryStateDir = join2(stateRoot.path, "repositories", storageRepositoryId);
   const workspaceStateDir = join2(repositoryStateDir, "worktrees", storageWorkspaceId);
-  const legacyControlDir = resolve4(canonicalRepositoryRoot3, ".archcontext", ".local");
+  const legacyControlDir = resolve5(canonicalRepositoryRoot3, ".archcontext", ".local");
   return {
     schemaVersion: "archcontext.runtime-state-paths/v1",
     stateRoot: stateRoot.path,
@@ -9557,7 +9685,7 @@ function migrateLegacyLocalStoreIfNeeded(root = process.cwd(), env = process.env
       status: "explicit-local-store-override"
     });
   }
-  ensurePrivateDir(dirname(paths.localStorePath));
+  ensurePrivateDir(dirname2(paths.localStorePath));
   const legacyExists = existsSync2(paths.legacyLocalStorePath);
   const integrityCheck = {};
   const quarantinedFiles = [];
@@ -9655,7 +9783,7 @@ function readAppliedLocalSqliteMigrations(db) {
 }
 function openSqliteDatabaseSync(databasePath) {
   if (databasePath !== ":memory:")
-    ensurePrivateDir(dirname(databasePath));
+    ensurePrivateDir(dirname2(databasePath));
   try {
     const nodeSqlite = runtimeRequire("node:sqlite");
     const db2 = new nodeSqlite.DatabaseSync(databasePath);
@@ -9832,7 +9960,7 @@ function publishStagedLocalStore(stagingPath, targetPath) {
   }
   renameSync(stagingPath, targetPath);
   makePrivateFile(targetPath);
-  fsyncDirectory(dirname(targetPath));
+  fsyncDirectory(dirname2(targetPath));
 }
 function writeLegacyMigrationMarker(paths, integrityCheck, quarantinedFiles) {
   const markerPath = legacyMigrationMarkerPath(paths);
@@ -9848,7 +9976,7 @@ function writeLegacyMigrationMarker(paths, integrityCheck, quarantinedFiles) {
 }
 function acquireLegacyMigrationLock(paths) {
   const lockPath = legacyMigrationLockPath(paths);
-  ensurePrivateDir(dirname(lockPath));
+  ensurePrivateDir(dirname2(lockPath));
   try {
     const fd = openSync2(lockPath, "wx", 384);
     writeFileSync(fd, JSON.stringify({
@@ -9877,7 +10005,7 @@ function releaseLegacyMigrationLock(lock) {
 }
 function isStaleMigrationLock(lockPath) {
   try {
-    const parsed = JSON.parse(readFileSync4(lockPath, "utf8"));
+    const parsed = JSON.parse(readFileSync5(lockPath, "utf8"));
     if (typeof parsed.pid !== "number" || parsed.pid <= 0)
       return true;
     return !isProcessAlive(parsed.pid);
@@ -9912,7 +10040,7 @@ function quarantineExistingLocalStore(paths) {
     quarantinedFiles.push(target);
   }
   fsyncDirectory(quarantineDir);
-  fsyncDirectory(dirname(paths.localStorePath));
+  fsyncDirectory(dirname2(paths.localStorePath));
   return quarantinedFiles;
 }
 function legacyMigrationMarkerPath(paths) {
@@ -9922,7 +10050,7 @@ function legacyMigrationLockPath(paths) {
   return join2(paths.workspaceStateDir, LEGACY_MIGRATION_LOCK_FILE);
 }
 function writePrivateJson(path, value) {
-  ensurePrivateDir(dirname(path));
+  ensurePrivateDir(dirname2(path));
   const fd = openSync2(path, "w", 384);
   try {
     writeFileSync(fd, JSON.stringify(value, null, 2), "utf8");
@@ -9931,7 +10059,7 @@ function writePrivateJson(path, value) {
     closeSync2(fd);
   }
   makePrivateFile(path);
-  fsyncDirectory(dirname(path));
+  fsyncDirectory(dirname2(path));
 }
 function ensurePrivateDir(path) {
   mkdirSync(path, { recursive: true, mode: 448 });
@@ -9961,10 +10089,10 @@ function readGitPath(root, args) {
   }
 }
 function resolveMaybeRelative(base, path) {
-  return isAbsolute2(path) ? resolve4(path) : resolve4(base, path);
+  return isAbsolute2(path) ? resolve5(path) : resolve5(base, path);
 }
 function canonicalPath(path) {
-  const resolved = resolve4(path);
+  const resolved = resolve5(path);
   try {
     return realpathSync4.native(resolved);
   } catch {
@@ -9972,8 +10100,8 @@ function canonicalPath(path) {
   }
 }
 function isPathInsideOrSame(path, parent) {
-  const child = resolve4(path);
-  const base = resolve4(parent);
+  const child = resolve5(path);
+  const base = resolve5(parent);
   const fromBase = relative3(base, child);
   return fromBase === "" || !!fromBase && !fromBase.startsWith("..") && !isAbsolute2(fromBase);
 }
@@ -10004,21 +10132,21 @@ function isIgnorableDirectoryFsyncError(error) {
 // packages/local-runtime/git-adapter/src/index.ts
 import { execFileSync as execFileSync3, spawnSync } from "node:child_process";
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, mkdtempSync, rmSync as rmSync2 } from "node:fs";
-import { dirname as dirname2, join as join3, resolve as resolve5 } from "node:path";
+import { dirname as dirname3, join as join3, resolve as resolve6 } from "node:path";
 init_src();
 function findRepositoryRoot(start) {
   try {
-    return resolve5(execFileSync3("git", ["rev-parse", "--show-toplevel"], {
+    return resolve6(execFileSync3("git", ["rev-parse", "--show-toplevel"], {
       cwd: start,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim());
   } catch {
-    let cursor = resolve5(start);
+    let cursor = resolve6(start);
     while (true) {
-      if (existsSync3(resolve5(cursor, ".git")))
+      if (existsSync3(resolve6(cursor, ".git")))
         return cursor;
-      const parent = dirname2(cursor);
+      const parent = dirname3(cursor);
       if (parent === cursor)
         break;
       cursor = parent;
@@ -10041,18 +10169,19 @@ function readHeadSha(root) {
 // packages/local-runtime/runtime-daemon/src/index.ts
 import { randomBytes } from "node:crypto";
 import { execFileSync as execFileSync6 } from "node:child_process";
-import { chmodSync as chmodSync3, closeSync as closeSync5, existsSync as existsSync12, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, openSync as openSync5, readdirSync as readdirSync8, readFileSync as readFileSync11, rmSync as rmSync8, statSync as statSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync as chmodSync3, closeSync as closeSync5, existsSync as existsSync13, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, openSync as openSync5, readdirSync as readdirSync8, readFileSync as readFileSync12, rmSync as rmSync8, statSync as statSync6, writeFileSync as writeFileSync6 } from "node:fs";
 import { createServer } from "node:http";
 import { tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname8, join as join8, resolve as resolve15 } from "node:path";
+import { dirname as dirname9, join as join8, resolve as resolve16 } from "node:path";
 
 // packages/core/changeset-engine/src/index.ts
 init_src();
-import { closeSync as closeSync3, existsSync as existsSync4, fsyncSync as fsyncSync2, lstatSync as lstatSync2, mkdirSync as mkdirSync3, openSync as openSync3, readFileSync as readFileSync5, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname3, resolve as resolve7 } from "node:path";
+import { closeSync as closeSync3, existsSync as existsSync5, fsyncSync as fsyncSync2, lstatSync as lstatSync2, mkdirSync as mkdirSync3, openSync as openSync3, readFileSync as readFileSync6, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname4, resolve as resolve8 } from "node:path";
 
 // packages/core/policy-engine/src/index.ts
-import { isAbsolute as isAbsolute3, relative as relative4, resolve as resolve6, sep as sep3 } from "node:path";
+import { existsSync as existsSync4, realpathSync as realpathSync5 } from "node:fs";
+import { isAbsolute as isAbsolute3, relative as relative4, resolve as resolve7, sep as sep3 } from "node:path";
 init_src();
 var INVALID_COMPAT_REASONS = new Set(["just in case", "safer to keep", "many internal callers", "large diff", "old code already exists"]);
 var PLACEHOLDER_DIGEST = `sha256:${"0".repeat(64)}`;
@@ -10062,6 +10191,7 @@ var ALLOWLIST = [
   ".archcontext/practices/",
   ".archcontext/waivers/",
   ".archcontext/decisions/",
+  ".archcontext/backups/",
   ".archcontext/generated/",
   "docs/architecture/"
 ];
@@ -10092,12 +10222,27 @@ function assertAllowedArchContextPath(root, relativePath) {
   if (!ALLOWLIST.some((prefix) => normalized.startsWith(prefix))) {
     throw new Error(`Path is outside ArchContext write allowlist: ${relativePath}`);
   }
-  const absoluteRoot = resolve6(root);
-  const absoluteTarget = resolve6(root, relativePath);
+  const absoluteRoot = resolve7(root);
+  const absoluteTarget = resolve7(root, relativePath);
   const targetFromRoot = relative4(absoluteRoot, absoluteTarget);
   if (targetFromRoot === "" || targetFromRoot === ".." || targetFromRoot.startsWith(`..${sep3}`) || isAbsolute3(targetFromRoot)) {
     throw new Error(`Path escapes repository: ${relativePath}`);
   }
+  if (!existsSync4(absoluteRoot))
+    return;
+  const canonicalRoot = realpathSync5.native(absoluteRoot);
+  let existingAncestor = absoluteTarget;
+  while (!existsSync4(existingAncestor)) {
+    const parent = resolve7(existingAncestor, "..");
+    if (parent === existingAncestor)
+      throw new Error(`Path has no existing repository ancestor: ${relativePath}`);
+    existingAncestor = parent;
+  }
+  const canonicalAncestor = realpathSync5.native(existingAncestor);
+  const ancestorFromRoot = relative4(canonicalRoot, canonicalAncestor);
+  if (ancestorFromRoot === ".." || ancestorFromRoot.startsWith(`..${sep3}`) || isAbsolute3(ancestorFromRoot)) {
+    throw new Error(`Path escapes repository through symlink: ${relativePath}`);
+  }
 }
 function evaluateChangeSetPaths(root, paths) {
   const findings = [];
@@ -10157,6 +10302,7 @@ class ChangeSetEngine {
     if (!approved)
       throw new Error("ChangeSet must be approved before apply");
     const deps = this.requireDeps();
+    await this.validateModel(root, draft, deps, "before");
     const backups = [];
     const journalId = await deps.journal?.beginChangeSet(root, draft);
     let journalCommitted = false;
@@ -10171,10 +10317,7 @@ class ChangeSetEngine {
               if (options.faultAfterOperations && applied >= options.faultAfterOperations)
                 throw new Error("fault-injection");
             }
-          } else {
-            this.rebuildGeneratedProjection(root, deps);
-            applied += 1;
-          }
+          } else {}
           if (options.faultAfterOperations && applied >= options.faultAfterOperations)
             throw new Error("fault-injection");
           continue;
@@ -10186,15 +10329,24 @@ class ChangeSetEngine {
         if (options.faultAfterOperations && applied >= options.faultAfterOperations)
           throw new Error("fault-injection");
       }
-      this.rebuildGeneratedProjection(root, deps);
-      await this.validateModel(root, draft, deps);
-      await options.afterModelValidatedBeforeCommit?.({ root, draft, journalId });
-      if (journalId) {
+      for (const projection of deps.projection.planGeneratedProjection(root)) {
+        await this.applyFileOperation(root, projection.path, projection.expectedHash, projection.body, projection.operation, backups, journalId, applied + 1);
+        applied += 1;
+        if (options.faultAfterOperations && applied >= options.faultAfterOperations)
+          throw new Error("fault-injection");
+      }
+      await this.validateModel(root, draft, deps, "after");
+      const commit = await options.afterModelValidatedBeforeCommit?.({ root, draft, journalId });
+      if (commit?.journalCommitted)
+        journalCommitted = true;
+      if (journalId && !journalCommitted) {
         await deps.journal?.commitChangeSet(journalId);
         journalCommitted = true;
       }
       try {
         cleanupBackups(backups);
+        if (journalId)
+          await deps.journal?.completeChangeSetCleanup(journalId);
       } catch {}
       const appliedDraft = { ...draft, status: "applied" };
       this.states.set(draft.id, appliedDraft);
@@ -10210,11 +10362,11 @@ class ChangeSetEngine {
       throw error;
     }
   }
-  rebuildGeneratedProjection(root, deps) {
-    deps.projection.rebuildGeneratedProjection(root);
-  }
-  async validateModel(root, draft, deps) {
-    await deps.modelStore.validateModel({ root, repositoryId: draft.reason.taskSessionId, headSha: draft.base.headSha });
+  async validateModel(root, draft, deps, phase) {
+    const result = await deps.modelStore.validateModel({ root, repositoryId: draft.reason.taskSessionId, headSha: draft.base.headSha });
+    if (!result.valid) {
+      throw new Error(`ChangeSet model validation failed ${phase} apply: ${result.errors.join("; ") || "unknown validation error"}`);
+    }
   }
   requireDeps() {
     if (!this.deps)
@@ -10224,20 +10376,17 @@ class ChangeSetEngine {
   async applyFileOperation(root, path, expectedHash, body, operation, backups, journalId, sequence) {
     assertSafeTarget(root, path);
     const deps = this.requireDeps();
-    const absolute = resolve7(root, path);
-    const existed = existsSync4(absolute);
+    const absolute = resolve8(root, path);
+    const existed = existsSync5(absolute);
     const backupPath = `${absolute}.archctx-backup`;
     const tempPath = operation === "delete_entity" ? undefined : `${absolute}.archctx-tmp-${process.pid}-${sequence}`;
-    if (existsSync4(backupPath))
+    if (existsSync5(backupPath))
       throw new Error(`Backup path already exists: ${path}`);
-    if (existed) {
+    if (existed)
       assertExpectedHash(absolute, expectedHash);
-      renameSync2(absolute, backupPath);
-      fsyncDirectory2(dirname3(absolute));
-    } else if (expectedHash !== "missing") {
+    else if (expectedHash !== "missing")
       throw new Error(`Expected missing file hash for new path: ${path}`);
-    }
-    backups.push({ path: absolute, backupPath, tempPath, existed });
+    const backup = { path: absolute, backupPath, tempPath, existed };
     if (journalId) {
       await deps.journal?.recordChangeSetFile(journalId, {
         path,
@@ -10247,6 +10396,11 @@ class ChangeSetEngine {
         operation
       });
     }
+    backups.push(backup);
+    if (existed) {
+      renameSync2(absolute, backupPath);
+      fsyncDirectory2(dirname4(absolute));
+    }
     if (operation === "delete_entity") {
       rmSync3(absolute, { force: true });
     } else {
@@ -10256,22 +10410,22 @@ class ChangeSetEngine {
 }
 function assertSafeTarget(root, path) {
   assertAllowedArchContextPath(root, path);
-  const absolute = resolve7(root, path);
-  if (existsSync4(absolute) && lstatSync2(absolute).isSymbolicLink()) {
+  const absolute = resolve8(root, path);
+  if (existsSync5(absolute) && lstatSync2(absolute).isSymbolicLink()) {
     throw new Error(`Refusing to write symlink target: ${path}`);
   }
 }
 function assertExpectedHash(path, expectedHash) {
-  const actual = digestJson({ body: readFileSync5(path, "utf8") });
+  const actual = digestJson({ body: readFileSync6(path, "utf8") });
   if (expectedHash !== actual)
     throw new Error(`Expected hash mismatch: ${path}`);
 }
 function atomicWriteFile(path, tempPath, body) {
-  mkdirSync3(dirname3(path), { recursive: true });
+  mkdirSync3(dirname4(path), { recursive: true });
   writeFileSync2(tempPath, body, "utf8");
   fsyncFile(tempPath);
   renameSync2(tempPath, path);
-  fsyncDirectory2(dirname3(path));
+  fsyncDirectory2(dirname4(path));
 }
 function fsyncFile(path) {
   const fd = openSync3(path, process.platform === "win32" ? "r+" : "r");
@@ -10332,10 +10486,15 @@ function rollback(backups) {
   for (const backup of backups.reverse()) {
     if (backup.tempPath)
       rmSync3(backup.tempPath, { recursive: true, force: true });
-    rmSync3(backup.path, { recursive: true, force: true });
-    if (backup.existed && existsSync4(backup.backupPath))
-      renameSync2(backup.backupPath, backup.path);
-    fsyncDirectory2(dirname3(backup.path));
+    if (backup.existed) {
+      if (existsSync5(backup.backupPath)) {
+        rmSync3(backup.path, { recursive: true, force: true });
+        renameSync2(backup.backupPath, backup.path);
+      }
+    } else {
+      rmSync3(backup.path, { recursive: true, force: true });
+    }
+    fsyncDirectory2(dirname4(backup.path));
   }
 }
 function cleanupBackups(backups) {
@@ -10540,19 +10699,19 @@ function digestSuffix2(digest) {
 }
 
 // packages/core/application/src/index.ts
-import { existsSync as existsSync7, statSync as statSync5 } from "node:fs";
-import { extname, resolve as resolve10 } from "node:path";
+import { existsSync as existsSync8, statSync as statSync5 } from "node:fs";
+import { extname, resolve as resolve11 } from "node:path";
 
 // packages/core/context-compiler/src/index.ts
 init_src();
 
 // packages/core/practice-catalog/src/index.ts
 init_src();
-import { existsSync as existsSync5, lstatSync as lstatSync3, readdirSync as readdirSync4, readFileSync as readFileSync6, realpathSync as realpathSync5 } from "node:fs";
-import { dirname as dirname4, relative as relative5, resolve as resolve8, sep as sep4 } from "node:path";
+import { existsSync as existsSync6, lstatSync as lstatSync3, readdirSync as readdirSync4, readFileSync as readFileSync7, realpathSync as realpathSync6 } from "node:fs";
+import { dirname as dirname5, relative as relative5, resolve as resolve9, sep as sep4 } from "node:path";
 import { fileURLToPath } from "node:url";
 var PRACTICE_CATALOG_VERSION = "2026.06.0";
-var BUILTIN_PRACTICE_ASSETS_DIR = resolve8(dirname4(fileURLToPath(import.meta.url)), "../assets");
+var BUILTIN_PRACTICE_ASSETS_DIR = resolve9(dirname5(fileURLToPath(import.meta.url)), "../assets");
 var ALLOWED_CHECK_IDS = new Set([
   "compatibility-contract-required",
   "no-new-cycle",
@@ -10604,13 +10763,13 @@ var PRACTICE_ROOT_KEYS = new Set([
   "overlay"
 ]);
 function loadPracticeCatalog(options = {}) {
-  const root = options.root ? resolve8(options.root) : process.cwd();
+  const root = options.root ? resolve9(options.root) : process.cwd();
   const builtInAssetsDir = options.builtInAssetsDir ?? BUILTIN_PRACTICE_ASSETS_DIR;
   const errors = [];
   const warnings = [];
-  const builtIn = loadAssetFiles(resolve8(builtInAssetsDir, "practices"), "curated-static", errors);
-  const profiles = loadProfileFiles(resolve8(builtInAssetsDir, "profiles"), errors);
-  const sources = loadSourceFiles(resolve8(builtInAssetsDir, "sources"), errors);
+  const builtIn = loadAssetFiles(resolve9(builtInAssetsDir, "practices"), "curated-static", errors);
+  const profiles = loadProfileFiles(resolve9(builtInAssetsDir, "profiles"), errors);
+  const sources = loadSourceFiles(resolve9(builtInAssetsDir, "sources"), errors);
   const overlays = options.includeRepoOverlay === false ? [] : loadRepoOverlayAssets(root, errors);
   const merged = mergeCatalogAssets(builtIn, overlays, errors, options.now ?? new Date().toISOString());
   const sourceIds = new Set(sources.map((source) => source.id));
@@ -10796,8 +10955,8 @@ function loadProfileFiles(dir, errors) {
   return profiles.sort((a, b) => a.id.localeCompare(b.id));
 }
 function loadRepoOverlayAssets(root, errors) {
-  const overlayRoot = resolve8(root, ".archcontext/practices");
-  if (!existsSync5(overlayRoot))
+  const overlayRoot = resolve9(root, ".archcontext/practices");
+  if (!existsSync6(overlayRoot))
     return [];
   const out = [];
   for (const path of listDataFiles(overlayRoot, overlayRoot, errors)) {
@@ -11140,7 +11299,7 @@ function validateProfile(value, path, errors) {
   return invalid ? undefined : profile;
 }
 function listDataFiles(dir, allowedRoot, errors) {
-  if (!existsSync5(dir))
+  if (!existsSync6(dir))
     return [];
   const out = [];
   const rootReal = safeRealpath(allowedRoot);
@@ -11160,7 +11319,7 @@ function listDataFiles(dir, allowedRoot, errors) {
     }
     if (stat.isDirectory()) {
       for (const entry of readdirSync4(current, { withFileTypes: true }))
-        walk(resolve8(current, entry.name));
+        walk(resolve9(current, entry.name));
       return;
     }
     if (!/\.(ya?ml|json)$/.test(current))
@@ -11175,7 +11334,7 @@ function listDataFiles(dir, allowedRoot, errors) {
 }
 function parseDataFile(path, errors) {
   try {
-    const body = readFileSync6(path, "utf8").replace(/^\uFEFF/, "").trim();
+    const body = readFileSync7(path, "utf8").replace(/^\uFEFF/, "").trim();
     const withoutDocumentMarker = body.startsWith("---") ? body.replace(/^---\s*/, "").trim() : body;
     return JSON.parse(withoutDocumentMarker);
   } catch (error) {
@@ -11202,14 +11361,14 @@ function assertRealChild(root, path) {
 }
 function safeRealpath(path) {
   try {
-    return realpathSync5.native(path);
+    return realpathSync6.native(path);
   } catch {
-    return resolve8(path);
+    return resolve9(path);
   }
 }
 function isRealChild(rootReal, pathReal) {
   const rel = relative5(rootReal, pathReal);
-  return rel === "" || !rel.startsWith("..") && !rel.includes(`..${sep4}`) && !resolve8(rel).startsWith("..");
+  return rel === "" || !rel.startsWith("..") && !rel.includes(`..${sep4}`) && !resolve9(rel).startsWith("..");
 }
 function displayPath(path) {
   return path.split(sep4).join("/");
@@ -11773,8 +11932,8 @@ function checkResult(input, result) {
 }
 // packages/core/practice-engine/src/enforcement.ts
 init_src();
-import { existsSync as existsSync6, lstatSync as lstatSync4, readdirSync as readdirSync5, readFileSync as readFileSync7 } from "node:fs";
-import { basename as basename3, join as join4, relative as relative6, resolve as resolve9, sep as sep5 } from "node:path";
+import { existsSync as existsSync7, lstatSync as lstatSync4, readdirSync as readdirSync5, readFileSync as readFileSync8 } from "node:fs";
+import { basename as basename3, join as join4, relative as relative6, resolve as resolve10, sep as sep5 } from "node:path";
 var ENFORCEMENT_RANK = { advisory: 0, checkpoint: 1, complete: 2 };
 var POLICY_MODES = new Set(["advisory", "active", "fail-open", "fail-closed"]);
 var DEFAULT_POLICY = {
@@ -11797,16 +11956,16 @@ function shouldEvaluatePracticeEnforcement(policy) {
   return practiceEnforcementPolicyMode(policy) !== "advisory";
 }
 function loadPracticeEnforcementPolicy(root) {
-  const path = resolve9(root, ".archcontext/policies/practices.yaml");
-  if (!existsSync6(path))
+  const path = resolve10(root, ".archcontext/policies/practices.yaml");
+  if (!existsSync7(path))
     return defaultPracticeEnforcementPolicy();
   assertRepoPolicyFile(root, path, ".archcontext/policies/practices.yaml");
   const parsed = parseJsonYamlFile(path);
   return validatePracticeEnforcementPolicy(parsed, ".archcontext/policies/practices.yaml");
 }
 function loadPracticeWaivers(root) {
-  const dir = resolve9(root, ".archcontext/waivers");
-  if (!existsSync6(dir))
+  const dir = resolve10(root, ".archcontext/waivers");
+  if (!existsSync7(dir))
     return [];
   const stat = lstatSync4(dir);
   if (stat.isSymbolicLink())
@@ -11826,17 +11985,17 @@ function loadPracticeWaivers(root) {
   return waivers.sort((left, right) => waiverDigest(left).localeCompare(waiverDigest(right)));
 }
 function loadPracticeWaiverOwnerRegistry(root) {
-  const modelDir = resolve9(root, ".archcontext/model/nodes");
+  const modelDir = resolve10(root, ".archcontext/model/nodes");
   const sources = [];
   const subjects = [];
-  if (existsSync6(modelDir)) {
+  if (existsSync7(modelDir)) {
     if (lstatSync4(modelDir).isSymbolicLink())
       throw new Error("practice-owner-registry-symlink-denied");
     for (const path of collectFiles(root, ".archcontext/model/nodes")) {
-      const absolute = resolve9(root, path);
+      const absolute = resolve10(root, path);
       if (lstatSync4(absolute).isSymbolicLink())
         throw new Error(`practice-owner-registry-symlink-denied: ${path}`);
-      const body = readFileSync7(absolute, "utf8");
+      const body = readFileSync8(absolute, "utf8");
       const lifecycleOwners = extractOwnershipOwners(body, "lifecycle");
       const dataOwners = extractOwnershipOwners(body, "data");
       for (const kind of ["lifecycle", "data"]) {
@@ -12111,12 +12270,12 @@ function isVagueReason(reason) {
   return /^(temporary|cleanup later|todo|tbd|later|just in case)$/i.test(trimmed);
 }
 function parseJsonYamlFile(path) {
-  const body = readFileSync7(path, "utf8").replace(/^\uFEFF/, "").trim();
+  const body = readFileSync8(path, "utf8").replace(/^\uFEFF/, "").trim();
   const withoutDocumentMarker = body.startsWith("---") ? body.replace(/^---\s*/, "").trim() : body;
   return JSON.parse(withoutDocumentMarker);
 }
 function collectFiles(root, relativeDir) {
-  const dir = resolve9(root, relativeDir);
+  const dir = resolve10(root, relativeDir);
   const out = [];
   for (const entry of readdirSync5(dir, { withFileTypes: true })) {
     const child = `${relativeDir}/${entry.name}`;
@@ -12204,8 +12363,8 @@ function assertRepoPolicyFile(root, path, relativePath) {
   assertRepoRelativePath(relativePath);
   if (lstatSync4(path).isSymbolicLink())
     throw new Error(`practice-policy-symlink-denied: ${relativePath}`);
-  const rootResolved = resolve9(root);
-  const pathResolved = resolve9(path);
+  const rootResolved = resolve10(root);
+  const pathResolved = resolve10(path);
   const rel = relative6(rootResolved, pathResolved);
   if (rel === "" || rel.startsWith("..") || rel.includes(`..${sep5}`))
     throw new Error(`practice-policy-path-escape: ${relativePath}`);
@@ -13641,8 +13800,8 @@ function classifyCheckpointPath(root, path) {
     return "ignored";
   if (isGeneratedCheckpointPath(path))
     return "generated";
-  const absolute = resolve10(root, path);
-  if (!existsSync7(absolute))
+  const absolute = resolve11(root, path);
+  if (!existsSync8(absolute))
     return "deleted";
   try {
     if (!statSync5(absolute).isFile())
@@ -14848,8 +15007,8 @@ function uniqueSorted4(values) {
 
 // packages/core/projection-engine/src/index.ts
 init_src();
-import { existsSync as existsSync8, readdirSync as readdirSync6, readFileSync as readFileSync8 } from "node:fs";
-import { basename as basename4, resolve as resolve11 } from "node:path";
+import { existsSync as existsSync9, readdirSync as readdirSync6, readFileSync as readFileSync9 } from "node:fs";
+import { basename as basename4, resolve as resolve12 } from "node:path";
 function nativeNodeSource(node) {
   const value = node.source;
   if (!value || typeof value !== "object" || Array.isArray(value))
@@ -14891,12 +15050,6 @@ function renderArchitectureDocumentationProjection(input) {
   });
   const targets = rendered.map((file) => file.target);
   const expectedByPath = new Map(rendered.map((file) => [file.path, file]));
-  const drift = architectureDocumentationProjectionDrift({
-    targets,
-    expectedFiles: rendered,
-    existingFiles: input.existingFiles ?? []
-  });
-  const rejected = drift.diffs.filter((diff) => diff.reasonCode === "projection-ambiguous-ownership");
   const projectionDigest = digestJson({
     rendererVersion,
     sourceDigest: input.sourceDigest,
@@ -14907,6 +15060,38 @@ function renderArchitectureDocumentationProjection(input) {
       generatedBodyDigest: file.generatedBodyDigest
     })).sort((left, right) => left.path.localeCompare(right.path))
   });
+  const manifestValue = {
+    schemaVersion: "archcontext.architecture-docs-projection-manifest/v1",
+    rendererVersion,
+    sourceDigest: input.sourceDigest,
+    projectionDigest,
+    targetCount: targets.length,
+    fileCount: rendered.length,
+    targets: targets.map((target) => ({
+      targetId: target.targetId,
+      type: target.type,
+      scope: target.scope,
+      path: target.path,
+      ownership: target.ownership,
+      rendererVersion: target.rendererVersion,
+      format: target.format,
+      sourceDigest: target.sourceDigest,
+      outputDigest: target.outputDigest
+    }))
+  };
+  const manifest = {
+    path: "docs/architecture/.projection-manifest.json",
+    body: `${JSON.stringify(manifestValue, null, 2)}
+`,
+    digest: digestJson(manifestValue)
+  };
+  const drift = architectureDocumentationProjectionDrift({
+    targets,
+    expectedFiles: rendered,
+    expectedManifest: manifest,
+    existingFiles: input.existingFiles ?? []
+  });
+  const rejected = drift.diffs.filter((diff) => diff.reasonCode === "projection-ambiguous-ownership");
   return {
     schemaVersion: "archcontext.architecture-docs-projection-plan/v1",
     rendererVersion,
@@ -14914,6 +15099,7 @@ function renderArchitectureDocumentationProjection(input) {
     projectionDigest,
     targets,
     files: rendered.filter((file) => !rejected.some((diff) => diff.path === file.path && diff.targetId === file.target.targetId)),
+    manifest,
     drift: {
       ...drift,
       diffs: drift.diffs.map((diff) => ({
@@ -14943,12 +15129,12 @@ function architectureDocumentationSourceDigest(input) {
   });
 }
 function loadArchitectureDecisionRecords(root) {
-  const dir = resolve11(root, "docs/adr");
-  if (!existsSync8(dir))
+  const dir = resolve12(root, "docs/adr");
+  if (!existsSync9(dir))
     return [];
   return readdirSync6(dir).filter((file) => /^ADR-\d{4}-.+\.md$/.test(file)).sort().map((file) => {
     const path = `docs/adr/${file}`;
-    const body = readFileSync8(resolve11(root, path), "utf8");
+    const body = readFileSync9(resolve12(root, path), "utf8");
     const title = body.match(/^#\s+(.+)$/m)?.[1]?.trim() ?? basename4(file, ".md");
     const status = body.match(/^Status:\s*(.+)$/mi)?.[1]?.trim();
     return {
@@ -14970,17 +15156,17 @@ function loadArchitectureDocumentationFiles(root) {
     "docs/architecture/diagrams/architecture.structurizr.json",
     "docs/architecture/.projection-manifest.json"
   ]) {
-    const absolute = resolve11(root, entry);
-    if (existsSync8(absolute))
-      files.push({ path: entry, body: readFileSync8(absolute, "utf8") });
+    const absolute = resolve12(root, entry);
+    if (existsSync9(absolute))
+      files.push({ path: entry, body: readFileSync9(absolute, "utf8") });
   }
   for (const dir of ["docs/architecture/modules", "docs/architecture/relations"]) {
-    const absoluteDir = resolve11(root, dir);
-    if (!existsSync8(absoluteDir))
+    const absoluteDir = resolve12(root, dir);
+    if (!existsSync9(absoluteDir))
       continue;
     for (const file of readdirSync6(absoluteDir).filter((name) => name.endsWith(".md")).sort()) {
       const path = `${dir}/${file}`;
-      files.push({ path, body: readFileSync8(resolve11(root, path), "utf8") });
+      files.push({ path, body: readFileSync9(resolve12(root, path), "utf8") });
     }
   }
   return files.sort((left, right) => left.path.localeCompare(right.path));
@@ -15074,19 +15260,19 @@ function exportDocumentationStructurizrWorkspace(model) {
 }
 function loadNativeModelFromArchContext(root) {
   return {
-    nodes: readYamlObjects(resolve11(root, ".archcontext/model/nodes")),
-    relations: readYamlObjects(resolve11(root, ".archcontext/model/relations"))
+    nodes: readYamlObjects(resolve12(root, ".archcontext/model/nodes")),
+    relations: readYamlObjects(resolve12(root, ".archcontext/model/relations"))
   };
 }
 function mermaidId(id) {
   return stableId(id).replace(/-/g, "_").replace(/\./g, "_");
 }
 function readYamlObjects(dir) {
-  if (!existsSync8(dir))
+  if (!existsSync9(dir))
     return [];
   return readdirSync6(dir).filter((file) => /\.ya?ml$/.test(file)).sort().map((file) => {
-    const path = resolve11(dir, file);
-    return parseJsonOrStableYaml(readFileSync8(path, "utf8"), path);
+    const path = resolve12(dir, file);
+    return parseJsonOrStableYaml(readFileSync9(path, "utf8"), path);
   });
 }
 function escapeMermaid(value) {
@@ -15317,6 +15503,34 @@ function architectureDocumentationProjectionDrift(input) {
   const expectedByPath = new Map(input.expectedFiles.map((file) => [file.path, file]));
   const targetIds = new Set(input.targets.map((target) => target.targetId));
   const diffs = [];
+  const existingManifest = existingByPath.get(input.expectedManifest.path);
+  if (!existingManifest) {
+    diffs.push({
+      path: input.expectedManifest.path,
+      reasonCode: "projection-manifest-missing",
+      expectedDigest: input.expectedManifest.digest
+    });
+  } else {
+    try {
+      const parsed = JSON.parse(existingManifest.body);
+      const actualDigest = digestJson(parsed);
+      if (actualDigest !== input.expectedManifest.digest) {
+        diffs.push({
+          path: input.expectedManifest.path,
+          reasonCode: "projection-manifest-stale",
+          expectedDigest: input.expectedManifest.digest,
+          actualDigest
+        });
+      }
+    } catch {
+      diffs.push({
+        path: input.expectedManifest.path,
+        reasonCode: "projection-manifest-invalid",
+        expectedDigest: input.expectedManifest.digest,
+        actualDigest: digestJson({ path: existingManifest.path, body: existingManifest.body })
+      });
+    }
+  }
   for (const expected of input.expectedFiles) {
     const existing = existingByPath.get(expected.path);
     if (!existing) {
@@ -15355,6 +15569,8 @@ function architectureDocumentationProjectionDrift(input) {
     }
   }
   for (const existing of input.existingFiles) {
+    if (existing.path === input.expectedManifest.path)
+      continue;
     if (!isManagedArchitectureDocumentationPath(existing.path) || expectedByPath.has(existing.path))
       continue;
     const region = findAnyGeneratedRegion(existing.body);
@@ -15403,7 +15619,7 @@ function generatedEndMarker(targetId) {
   return `${ARCHITECTURE_DOCS_GENERATED_END_PREFIX} target="${targetId}" -->`;
 }
 function isManagedArchitectureDocumentationPath(path) {
-  return /^docs\/architecture\/(modules|relations)\/.+\.md$/.test(path) || /^docs\/architecture\/diagrams\/architecture\.(mmd|likec4|structurizr\.json)$/.test(path) || path === "docs/architecture/index.md" || path === "docs/architecture/changelog.md" || path === "docs/architecture/decisions/index.md";
+  return /^docs\/architecture\/(modules|relations)\/.+\.md$/.test(path) || /^docs\/architecture\/diagrams\/architecture\.(mmd|likec4|structurizr\.json)$/.test(path) || path === "docs/architecture/index.md" || path === "docs/architecture/changelog.md" || path === "docs/architecture/decisions/index.md" || path === "docs/architecture/.projection-manifest.json";
 }
 function pathSegment2(id) {
   return stableId(id).replace(/\./g, "-");
@@ -16613,23 +16829,23 @@ init_src();
 
 // packages/local-runtime/git-adapter/src/index.ts
 import { execFileSync as execFileSync4, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync9, mkdirSync as mkdirSync4, mkdtempSync as mkdtempSync2, rmSync as rmSync4 } from "node:fs";
-import { dirname as dirname5, join as join5, resolve as resolve12 } from "node:path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync4, mkdtempSync as mkdtempSync2, rmSync as rmSync4 } from "node:fs";
+import { dirname as dirname6, join as join5, resolve as resolve13 } from "node:path";
 import { tmpdir } from "node:os";
 init_src();
 function findRepositoryRoot2(start) {
   try {
-    return resolve12(execFileSync4("git", ["rev-parse", "--show-toplevel"], {
+    return resolve13(execFileSync4("git", ["rev-parse", "--show-toplevel"], {
       cwd: start,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim());
   } catch {
-    let cursor = resolve12(start);
+    let cursor = resolve13(start);
     while (true) {
-      if (existsSync9(resolve12(cursor, ".git")))
+      if (existsSync10(resolve13(cursor, ".git")))
         return cursor;
-      const parent = dirname5(cursor);
+      const parent = dirname6(cursor);
       if (parent === cursor)
         break;
       cursor = parent;
@@ -16729,7 +16945,7 @@ function prepareDetachedReviewWorktree(input) {
       observed: {}
     };
   }
-  const parent = input.tempRoot ? resolve12(input.tempRoot) : tmpdir();
+  const parent = input.tempRoot ? resolve13(input.tempRoot) : tmpdir();
   mkdirSync4(parent, { recursive: true });
   const temporaryRoot = mkdtempSync2(join5(parent, "archctx-review-worktree-"));
   const worktreeRoot = join5(temporaryRoot, "worktree");
@@ -16781,7 +16997,7 @@ function removeDetachedReviewWorktree(worktree) {
   } catch {
     removePathWithRetry(worktree.worktreeRoot);
   } finally {
-    removePathWithRetry(worktree.temporaryRoot || dirname5(worktree.worktreeRoot));
+    removePathWithRetry(worktree.temporaryRoot || dirname6(worktree.worktreeRoot));
   }
 }
 function removePathWithRetry(path) {
@@ -16898,13 +17114,13 @@ function isGitWorktreeError(error) {
 // packages/local-runtime/local-store-sqlite/src/index.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash6, randomUUID as randomUUID2 } from "node:crypto";
-import { chmodSync as chmodSync2, closeSync as closeSync4, existsSync as existsSync10, fsyncSync as fsyncSync3, lstatSync as lstatSync5, mkdirSync as mkdirSync5, openSync as openSync4, readFileSync as readFileSync9, realpathSync as realpathSync6, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync3 } from "node:fs";
+import { chmodSync as chmodSync2, closeSync as closeSync4, existsSync as existsSync11, fsyncSync as fsyncSync3, lstatSync as lstatSync5, mkdirSync as mkdirSync5, openSync as openSync4, readFileSync as readFileSync10, realpathSync as realpathSync7, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync3 } from "node:fs";
 import { readdir, readFile } from "node:fs/promises";
-import { createRequire as createRequire3 } from "node:module";
+import { createRequire as createRequire4 } from "node:module";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join6, relative as relative7, resolve as resolve13 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute4, join as join6, relative as relative7, resolve as resolve14 } from "node:path";
 init_src();
-var runtimeRequire2 = createRequire3(import.meta.url);
+var runtimeRequire2 = createRequire4(import.meta.url);
 var SQLITE_SIDECAR_SUFFIXES2 = ["", "-wal", "-shm"];
 var LEGACY_MIGRATION_MARKER_FILE2 = "runtime.sqlite.migration.json";
 var LEGACY_MIGRATION_LOCK_FILE2 = "runtime.sqlite.migration.lock";
@@ -16941,6 +17157,7 @@ var REQUIRED_LOCAL_STORE_TABLES2 = [
 ];
 var SQLITE_PRAGMAS2 = [
   "PRAGMA journal_mode = WAL",
+  "PRAGMA synchronous = FULL",
   "PRAGMA foreign_keys = ON",
   "PRAGMA busy_timeout = 5000"
 ];
@@ -17462,14 +17679,22 @@ var LOCAL_SQLITE_MIGRATIONS2 = [
       )`,
       "CREATE INDEX IF NOT EXISTS idx_audit_runs_status ON audit_runs(storage_repository_id, storage_workspace_id, status)"
     ]
+  },
+  {
+    id: "0011_changeset_cleanup_cursor",
+    statements: [
+      "ALTER TABLE changeset_journal ADD COLUMN cleanup_completed_at TEXT",
+      "CREATE INDEX IF NOT EXISTS idx_changeset_journal_cleanup_pending ON changeset_journal(status, cleanup_completed_at, updated_at)"
+    ]
   }
 ];
+var CHANGESET_STARTUP_CLEANUP_LIMIT = 100;
 var ARCHCONTEXT_STATE_DIR_ENV2 = "ARCHCONTEXT_STATE_DIR";
 var ARCHCONTEXT_LOCAL_STORE_PATH_ENV2 = "ARCHCONTEXT_LOCAL_STORE_PATH";
 function defaultArchContextStateRoot2(env = process.env, platform = process.platform, home = homedir2()) {
   const override = env[ARCHCONTEXT_STATE_DIR_ENV2];
   if (override)
-    return { path: resolve13(override), source: "environment" };
+    return { path: resolve14(override), source: "environment" };
   if (platform === "darwin")
     return { path: join6(home, "Library", "Application Support", "ArchContext"), source: "os-user-data" };
   if (platform === "win32")
@@ -17487,7 +17712,7 @@ function runtimeStatePaths2(root = process.cwd(), env = process.env) {
   const stateRoot = defaultArchContextStateRoot2(env);
   const repositoryStateDir = join6(stateRoot.path, "repositories", storageRepositoryId);
   const workspaceStateDir = join6(repositoryStateDir, "worktrees", storageWorkspaceId);
-  const legacyControlDir = resolve13(canonicalRepositoryRoot3, ".archcontext", ".local");
+  const legacyControlDir = resolve14(canonicalRepositoryRoot3, ".archcontext", ".local");
   return {
     schemaVersion: "archcontext.runtime-state-paths/v1",
     stateRoot: stateRoot.path,
@@ -17521,11 +17746,11 @@ function migrateLegacyLocalStoreIfNeeded2(root = process.cwd(), env = process.en
       status: "explicit-local-store-override"
     });
   }
-  ensurePrivateDir2(dirname6(paths.localStorePath));
-  const legacyExists = existsSync10(paths.legacyLocalStorePath);
+  ensurePrivateDir2(dirname7(paths.localStorePath));
+  const legacyExists = existsSync11(paths.legacyLocalStorePath);
   const integrityCheck = {};
   const quarantinedFiles = [];
-  const targetExists = existsSync10(paths.localStorePath);
+  const targetExists = existsSync11(paths.localStorePath);
   if (targetExists) {
     try {
       integrityCheck.target = assertCurrentLocalStore2(paths.localStorePath);
@@ -17989,6 +18214,11 @@ class SqliteLocalStore {
       throw new Error(`ChangeSet journal not found: ${journalId}`);
     db.prepare("UPDATE changeset_journal SET status = ?, updated_at = ?, completed_at = ? WHERE journal_id = ?").run("committed", nowIso2(), nowIso2(), journalId);
   }
+  async completeChangeSetCleanup(journalId) {
+    const db = await this.database();
+    const completedAt = nowIso2();
+    db.prepare("UPDATE changeset_journal SET cleanup_completed_at = ?, updated_at = ? WHERE journal_id = ? AND status = ?").run(completedAt, completedAt, journalId, "committed");
+  }
   async abortChangeSet(journalId, reason) {
     const db = await this.database();
     const row = db.prepare("SELECT metadata_json FROM changeset_journal WHERE journal_id = ?").get(journalId);
@@ -17999,37 +18229,61 @@ class SqliteLocalStore {
   }
   recoverPendingChangeSets() {
     const db = this.requireOpenDatabase();
-    const committed = db.prepare("SELECT files_json FROM changeset_journal WHERE status = ?").all("committed");
+    const committed = db.prepare(`SELECT journal_id, files_json FROM changeset_journal
+        WHERE status = ? AND cleanup_completed_at IS NULL
+        ORDER BY updated_at, journal_id
+        LIMIT ?`).all("committed", CHANGESET_STARTUP_CLEANUP_LIMIT);
     for (const row of committed) {
-      cleanupCommittedJournalFiles(JSON.parse(String(row.files_json)));
+      try {
+        cleanupCommittedJournalFiles(JSON.parse(String(row.files_json)));
+        const completedAt = nowIso2();
+        db.prepare("UPDATE changeset_journal SET cleanup_completed_at = ?, updated_at = ? WHERE journal_id = ?").run(completedAt, completedAt, String(row.journal_id));
+      } catch {}
     }
     const rows = db.prepare("SELECT journal_id, root, files_json, metadata_json FROM changeset_journal WHERE status = ?").all("pending");
+    let recovered = 0;
     for (const row of rows) {
-      const files = JSON.parse(String(row.files_json));
-      const metadata = JSON.parse(String(row.metadata_json));
-      const plannedLedgerEvent = changeSetJournalPlannedLedgerEvent(metadata);
-      const existingLedgerEvent = plannedLedgerEvent ? architectureEventByIdempotency(db, plannedLedgerEvent) : undefined;
-      if (plannedLedgerEvent && existingLedgerEvent) {
-        const expectedEventHash = normalizeArchitectureLedgerEvent(plannedLedgerEvent, existingLedgerEvent.previousEventHash).eventHash;
-        if (expectedEventHash !== existingLedgerEvent.event.eventHash) {
-          throw new Error(`changeset-ledger-recovery-idempotency-conflict: ${plannedLedgerEvent.idempotencyKey}`);
+      let metadata = {};
+      try {
+        const files = JSON.parse(String(row.files_json));
+        metadata = JSON.parse(String(row.metadata_json));
+        const plannedLedgerEvent = changeSetJournalPlannedLedgerEvent(metadata);
+        const existingLedgerEvent = plannedLedgerEvent ? architectureEventByIdempotency(db, plannedLedgerEvent) : undefined;
+        if (plannedLedgerEvent && existingLedgerEvent) {
+          const expectedEventHash = normalizeArchitectureLedgerEvent(plannedLedgerEvent, existingLedgerEvent.previousEventHash).eventHash;
+          if (expectedEventHash !== existingLedgerEvent.event.eventHash) {
+            throw new Error(`changeset-ledger-recovery-idempotency-conflict: ${plannedLedgerEvent.idempotencyKey}`);
+          }
+          cleanupCommittedJournalFiles(files);
+          const completedAt2 = nowIso2();
+          db.prepare("UPDATE changeset_journal SET status = ?, metadata_json = ?, updated_at = ?, completed_at = ?, cleanup_completed_at = ? WHERE journal_id = ?").run("committed", stableJson(withChangeSetJournalArchitectureLedger(metadata, {
+            recovery: {
+              schemaVersion: "archcontext.changeset-ledger-recovery/v1",
+              status: "ledger-append-detected",
+              eventId: existingLedgerEvent.event.eventId,
+              eventHash: existingLedgerEvent.event.eventHash ?? "",
+              recoveredAt: completedAt2
+            }
+          })), completedAt2, completedAt2, completedAt2, String(row.journal_id));
+          recovered += 1;
+          continue;
         }
-        cleanupCommittedJournalFiles(files);
-        db.prepare("UPDATE changeset_journal SET status = ?, metadata_json = ?, updated_at = ?, completed_at = ? WHERE journal_id = ?").run("committed", stableJson(withChangeSetJournalArchitectureLedger(metadata, {
-          recovery: {
-            schemaVersion: "archcontext.changeset-ledger-recovery/v1",
-            status: "ledger-append-detected",
-            eventId: existingLedgerEvent.event.eventId,
-            eventHash: existingLedgerEvent.event.eventHash ?? "",
-            recoveredAt: nowIso2()
+        recoverJournalFiles(String(row.root), files);
+        const completedAt = nowIso2();
+        db.prepare("UPDATE changeset_journal SET status = ?, updated_at = ?, completed_at = ?, cleanup_completed_at = ? WHERE journal_id = ?").run("recovered", completedAt, completedAt, completedAt, String(row.journal_id));
+        recovered += 1;
+      } catch (error) {
+        db.prepare("UPDATE changeset_journal SET metadata_json = ?, updated_at = ? WHERE journal_id = ?").run(stableJson({
+          ...metadata,
+          recoveryError: {
+            schemaVersion: "archcontext.changeset-recovery-error/v1",
+            message: error instanceof Error ? error.message : String(error),
+            failedAt: nowIso2()
           }
-        })), nowIso2(), nowIso2(), String(row.journal_id));
-        continue;
+        }), nowIso2(), String(row.journal_id));
       }
-      recoverJournalFiles(String(row.root), files);
-      db.prepare("UPDATE changeset_journal SET status = ?, updated_at = ?, completed_at = ? WHERE journal_id = ?").run("recovered", nowIso2(), nowIso2(), String(row.journal_id));
     }
-    return rows.length;
+    return recovered;
   }
   async saveTaskState(taskSessionId, state) {
     const db = await this.database();
@@ -18127,52 +18381,38 @@ class SqliteLocalStore {
     for (const event of input.events)
       validateArchitectureLedgerEvent(event);
     const db = await this.database();
-    const startedAt = Date.now();
-    const appendedEvents = [];
-    const duplicateEvents = [];
     db.exec("BEGIN IMMEDIATE");
     try {
-      let processed = 0;
-      for (const event of input.events) {
-        const duplicate = architectureEventByIdempotency(db, event);
-        if (duplicate) {
-          const expectedDuplicateHash = normalizeArchitectureLedgerEvent(event, duplicate.previousEventHash).eventHash;
-          if (expectedDuplicateHash !== duplicate.event.eventHash) {
-            throw new Error(`architecture-ledger-idempotency-conflict: ${event.idempotencyKey}`);
-          }
-          duplicateEvents.push(duplicate.event);
-          continue;
-        }
-        const previousEventHash = latestArchitectureEventHash(db, event.repository.storageRepositoryId, event.worktree.storageWorkspaceId);
-        const normalized = normalizeArchitectureLedgerEvent(event, previousEventHash);
-        insertArchitectureEvent(db, normalized);
-        persistArchitectureLedgerArtifacts(db, normalized);
-        materializeArchitectureLedgerEvent(db, normalized);
-        appendedEvents.push(normalized);
-        processed += 1;
-        if (input.faultAfterEvents !== undefined && processed >= input.faultAfterEvents)
-          throw new Error("architecture-ledger-fault-injection");
-      }
-      const scope = architectureScopeFromEvent(input.events[0] ?? duplicateEvents[0]);
-      const state = scope ? readArchitectureLedgerStateFromDb(db, scope) : emptyArchitectureLedgerState();
-      if (scope) {
-        recordArchitectureLedgerOperation(db, {
-          scope,
-          operationKind: "append_events",
-          durationMs: Date.now() - startedAt,
-          rowCount: appendedEvents.length,
-          rebuildReason: null
-        });
-      }
+      const result = appendArchitectureEventsInOpenTransaction(db, input);
       db.exec("COMMIT");
-      return {
-        appendedEvents,
-        duplicateEvents,
-        graphDigest: architectureLedgerStateDigest(state),
-        entityCount: state.entities.length,
-        relationCount: state.relations.length,
-        constraintCount: state.constraints.length
-      };
+      return result;
+    } catch (error) {
+      db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  async appendArchitectureEventsAndCommitChangeSet(journalId, input) {
+    if (input.writer !== "runtime-daemon")
+      throw new Error("architecture-ledger-writer-must-be-runtime-daemon");
+    for (const event of input.events)
+      validateArchitectureLedgerEvent(event);
+    const db = await this.database();
+    db.exec("BEGIN IMMEDIATE");
+    try {
+      const row = db.prepare("SELECT status, metadata_json FROM changeset_journal WHERE journal_id = ?").get(journalId);
+      if (!row)
+        throw new Error(`ChangeSet journal not found: ${journalId}`);
+      if (String(row.status) !== "pending")
+        throw new Error(`ChangeSet journal is not pending: ${journalId}`);
+      const metadata = JSON.parse(String(row.metadata_json));
+      const result = appendArchitectureEventsInOpenTransaction(db, input);
+      const completedAt = nowIso2();
+      db.prepare("UPDATE changeset_journal SET status = ?, metadata_json = ?, updated_at = ?, completed_at = ? WHERE journal_id = ?").run("committed", stableJson(withChangeSetJournalArchitectureLedger(metadata, {
+        append: changeSetLedgerAppendSummary(result),
+        appendedAt: completedAt
+      })), completedAt, completedAt, journalId);
+      db.exec("COMMIT");
+      return result;
     } catch (error) {
       db.exec("ROLLBACK");
       throw error;
@@ -18186,24 +18426,50 @@ class SqliteLocalStore {
         WHERE storage_repository_id = ?
           AND storage_workspace_id = ?
           ${statusClause}
-        ORDER BY created_at DESC, run_id ASC`).all(input.repository.storageRepositoryId, input.worktree.storageWorkspaceId, ...statuses).map((row) => JSON.parse(String(row.run_json)));
+        ORDER BY created_at DESC, run_id ASC`).all(input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree), ...statuses).map((row) => JSON.parse(String(row.run_json)));
+  }
+  async resolveArchitectureLedgerScope(input) {
+    const db = await this.database();
+    const rows = db.prepare(`SELECT event_json FROM architecture_events
+        WHERE storage_repository_id = ? AND workspace_id = ? AND branch = ?
+        ORDER BY event_sequence DESC`).all(input.repository.storageRepositoryId, input.worktree.workspaceId, input.worktree.branch);
+    for (const row of rows) {
+      const event = JSON.parse(String(row.event_json));
+      if (event.worktree.storageWorkspaceId === input.worktree.storageWorkspaceId) {
+        return architectureScopeFromEvent(event);
+      }
+    }
+    return input;
+  }
+  async resolveLatestArchitectureLedgerScope(input) {
+    const db = await this.database();
+    const rows = db.prepare(`SELECT event_json FROM architecture_events
+        WHERE storage_repository_id = ? AND workspace_id = ?
+        ORDER BY event_sequence DESC`).all(input.repository.storageRepositoryId, input.worktree.workspaceId);
+    for (const row of rows) {
+      const event = JSON.parse(String(row.event_json));
+      if (event.worktree.storageWorkspaceId === input.worktree.storageWorkspaceId) {
+        return architectureScopeFromEvent(event);
+      }
+    }
+    return input;
   }
   async getAuditRun(input) {
     const db = await this.database();
     const row = db.prepare(`SELECT run_json FROM audit_runs
-        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND run_id = ?`).get(input.repository.storageRepositoryId, input.worktree.storageWorkspaceId, input.runId);
+        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND run_id = ?`).get(input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree), architectureLedgerStorageId(input.worktree, input.runId));
     return row ? JSON.parse(String(row.run_json)) : undefined;
   }
   async readArchitectureLedgerSourceCursor(input) {
     const db = await this.database();
     const row = db.prepare(`SELECT cursor_json FROM source_cursors
-        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND cursor_id = ?`).get(input.repository.storageRepositoryId, input.worktree.storageWorkspaceId, input.cursorId);
+        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND cursor_id = ?`).get(input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree), architectureLedgerStorageId(input.worktree, input.cursorId));
     return row ? JSON.parse(String(row.cursor_json)) : undefined;
   }
   async createArchitectureLedgerSnapshot(input) {
     const db = await this.database();
     const startedAt = Date.now();
-    const latest = latestArchitectureEvent(db, input.repository.storageRepositoryId, input.worktree.storageWorkspaceId);
+    const latest = latestArchitectureEvent(db, input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree));
     if (!latest)
       throw new Error("architecture-ledger-snapshot-requires-event");
     const state = readArchitectureLedgerStateFromDb(db, input);
@@ -18217,7 +18483,7 @@ class SqliteLocalStore {
         (snapshot_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, branch, head_sha, worktree_digest,
           source_mode, last_event_id, last_event_hash, graph_digest, projection_digest, entity_count, relation_count,
           constraint_count, input_digests_json, snapshot_json, created_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(snapshot.snapshotId, snapshot.repository.repositoryId, snapshot.repository.storageRepositoryId, snapshot.worktree.workspaceId, snapshot.worktree.storageWorkspaceId, snapshot.worktree.branch, snapshot.worktree.headSha, snapshot.worktree.worktreeDigest, snapshot.sourceMode, snapshot.eventCursor.lastEventId, snapshot.eventCursor.lastEventHash, snapshot.graphDigest, snapshot.projectionDigest, snapshot.entityCount, snapshot.relationCount, snapshot.constraintCount, stableJson(snapshot.inputDigests), stableJson(snapshot), snapshot.createdAt);
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(snapshot.snapshotId, snapshot.repository.repositoryId, snapshot.repository.storageRepositoryId, snapshot.worktree.workspaceId, architectureLedgerWorkspaceKey(snapshot.worktree), snapshot.worktree.branch, snapshot.worktree.headSha, snapshot.worktree.worktreeDigest, snapshot.sourceMode, architectureLedgerStorageId(snapshot.worktree, snapshot.eventCursor.lastEventId), snapshot.eventCursor.lastEventHash, snapshot.graphDigest, snapshot.projectionDigest, snapshot.entityCount, snapshot.relationCount, snapshot.constraintCount, stableJson(snapshot.inputDigests), stableJson(snapshot), snapshot.createdAt);
     recordArchitectureLedgerOperation(db, {
       scope: input,
       operationKind: "create_snapshot",
@@ -18286,16 +18552,16 @@ class SqliteLocalStore {
     const db = await this.database();
     const startedAt = Date.now();
     const snapshot = db.prepare(`SELECT last_event_id FROM architecture_snapshots
-        WHERE snapshot_id = ? AND storage_repository_id = ? AND storage_workspace_id = ?`).get(input.beforeSnapshotId, input.repository.storageRepositoryId, input.worktree.storageWorkspaceId);
+        WHERE snapshot_id = ? AND storage_repository_id = ? AND storage_workspace_id = ?`).get(input.beforeSnapshotId, input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree));
     if (!snapshot)
       throw new Error(`architecture-ledger-snapshot-not-found: ${input.beforeSnapshotId}`);
     const cursor = db.prepare("SELECT event_sequence FROM architecture_events WHERE event_id = ?").get(String(snapshot.last_event_id));
     if (!cursor)
       throw new Error(`architecture-ledger-snapshot-cursor-not-found: ${String(snapshot.last_event_id)}`);
     const before = Number(db.prepare(`SELECT COUNT(*) AS count FROM architecture_events
-        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND event_sequence <= ? AND compacted_by_snapshot_id IS NULL`).get(input.repository.storageRepositoryId, input.worktree.storageWorkspaceId, Number(cursor.event_sequence))?.count ?? 0);
+        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND event_sequence <= ? AND compacted_by_snapshot_id IS NULL`).get(input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree), Number(cursor.event_sequence))?.count ?? 0);
     db.prepare(`UPDATE architecture_events SET compacted_by_snapshot_id = ?
-        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND event_sequence <= ? AND compacted_by_snapshot_id IS NULL`).run(input.beforeSnapshotId, input.repository.storageRepositoryId, input.worktree.storageWorkspaceId, Number(cursor.event_sequence));
+        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND event_sequence <= ? AND compacted_by_snapshot_id IS NULL`).run(input.beforeSnapshotId, input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree), Number(cursor.event_sequence));
     recordArchitectureLedgerOperation(db, {
       scope: input,
       operationKind: "compact_events",
@@ -18315,7 +18581,7 @@ class SqliteLocalStore {
     const replay = await this.verifyArchitectureLedgerReplay(input);
     if (!replay.ok)
       failures.push(...replay.mismatches);
-    const snapshotCount = Number(db.prepare("SELECT COUNT(*) AS count FROM architecture_snapshots WHERE storage_repository_id = ? AND storage_workspace_id = ?").get(input.repository.storageRepositoryId, input.worktree.storageWorkspaceId)?.count ?? 0);
+    const snapshotCount = Number(db.prepare("SELECT COUNT(*) AS count FROM architecture_snapshots WHERE storage_repository_id = ? AND storage_workspace_id = ?").get(input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree))?.count ?? 0);
     const result = {
       ok: failures.length === 0,
       graphDigest: replay.materializedDigest,
@@ -18334,8 +18600,8 @@ class SqliteLocalStore {
   }
   async backupArchitectureLedger(input) {
     const db = await this.database();
-    ensurePrivateDir2(dirname6(input.backupPath));
-    if (existsSync10(input.backupPath))
+    ensurePrivateDir2(dirname7(input.backupPath));
+    if (existsSync11(input.backupPath))
       rmSync5(input.backupPath, { force: true });
     db.exec(`VACUUM INTO ${sqliteStringLiteral2(input.backupPath)}`);
     return { backupPath: input.backupPath, integrity: assertSqliteIntegrity2(input.backupPath) };
@@ -18366,9 +18632,80 @@ class SqliteLocalStore {
 function architectureScopeFromEvent(event) {
   return event ? { repository: event.repository, worktree: event.worktree } : undefined;
 }
+function architectureLedgerWorkspaceKey(worktree) {
+  return `ledger-scope:${digestJson({
+    storageWorkspaceId: worktree.storageWorkspaceId,
+    branch: worktree.branch,
+    headSha: worktree.headSha,
+    worktreeDigest: worktree.worktreeDigest
+  }).slice("sha256:".length)}`;
+}
+function architectureLedgerStorageId(worktree, logicalId) {
+  return `${architectureLedgerWorkspaceKey(worktree)}:${logicalId}`;
+}
+function appendArchitectureEventsInOpenTransaction(db, input) {
+  const startedAt = Date.now();
+  const appendedEvents = [];
+  const duplicateEvents = [];
+  let processed = 0;
+  for (const event of input.events) {
+    const duplicate = architectureEventByIdempotency(db, event);
+    if (duplicate) {
+      const expectedDuplicateHash = normalizeArchitectureLedgerEvent(event, duplicate.previousEventHash).eventHash;
+      if (expectedDuplicateHash !== duplicate.event.eventHash) {
+        throw new Error(`architecture-ledger-idempotency-conflict: ${event.idempotencyKey}`);
+      }
+      duplicateEvents.push(duplicate.event);
+      continue;
+    }
+    const previousEventHash = latestArchitectureEventHash(db, event.repository.storageRepositoryId, architectureLedgerWorkspaceKey(event.worktree));
+    const normalized = normalizeArchitectureLedgerEvent(event, previousEventHash);
+    const operations = architectureLedgerPayload(normalized).operations ?? [];
+    const scope2 = architectureScopeFromEvent(normalized);
+    if (operations.length > 0) {
+      const currentDigest = architectureLedgerStateDigest(readArchitectureLedgerStateFromDb(db, scope2));
+      if (normalized.baseDigest !== currentDigest) {
+        throw new Error(`architecture-ledger-base-digest-conflict: expected ${currentDigest}, received ${normalized.baseDigest}`);
+      }
+    }
+    insertArchitectureEvent(db, normalized);
+    persistArchitectureLedgerArtifacts(db, normalized);
+    materializeArchitectureLedgerEvent(db, normalized);
+    if (operations.length > 0) {
+      const resultingDigest = architectureLedgerStateDigest(readArchitectureLedgerStateFromDb(db, scope2));
+      if (normalized.resultingDigest !== resultingDigest) {
+        throw new Error(`architecture-ledger-resulting-digest-conflict: expected ${resultingDigest}, received ${normalized.resultingDigest}`);
+      }
+    }
+    appendedEvents.push(normalized);
+    processed += 1;
+    if (input.faultAfterEvents !== undefined && processed >= input.faultAfterEvents) {
+      throw new Error("architecture-ledger-fault-injection");
+    }
+  }
+  const scope = architectureScopeFromEvent(input.events[0] ?? duplicateEvents[0]);
+  const state = scope ? readArchitectureLedgerStateFromDb(db, scope) : emptyArchitectureLedgerState();
+  if (scope) {
+    recordArchitectureLedgerOperation(db, {
+      scope,
+      operationKind: "append_events",
+      durationMs: Date.now() - startedAt,
+      rowCount: appendedEvents.length,
+      rebuildReason: null
+    });
+  }
+  return {
+    appendedEvents,
+    duplicateEvents,
+    graphDigest: architectureLedgerStateDigest(state),
+    entityCount: state.entities.length,
+    relationCount: state.relations.length,
+    constraintCount: state.constraints.length
+  };
+}
 function architectureEventByIdempotency(db, event) {
   const row = db.prepare(`SELECT event_json, previous_event_hash FROM architecture_events
-      WHERE storage_repository_id = ? AND storage_workspace_id = ? AND idempotency_key = ?`).get(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, event.idempotencyKey);
+      WHERE storage_repository_id = ? AND storage_workspace_id = ? AND idempotency_key = ?`).get(event.repository.storageRepositoryId, architectureLedgerWorkspaceKey(event.worktree), event.idempotencyKey);
   return row ? {
     event: JSON.parse(String(row.event_json)),
     previousEventHash: row.previous_event_hash === null || row.previous_event_hash === undefined ? null : String(row.previous_event_hash)
@@ -18384,11 +18721,12 @@ function latestArchitectureEvent(db, storageRepositoryId, storageWorkspaceId) {
   return row ? { event: JSON.parse(String(row.event_json)), eventHash: String(row.event_hash) } : undefined;
 }
 function insertArchitectureEvent(db, event) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT INTO architecture_events
       (event_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, branch, head_sha, worktree_digest,
         event_type, payload_version, source, actor_kind, actor_id, base_digest, resulting_digest, previous_event_hash,
         event_hash, idempotency_key, payload_json, provenance_json, event_json, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.eventId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, event.eventType, event.payloadVersion, event.source, event.actor.kind, event.actor.id, event.baseDigest, event.resultingDigest, event.previousEventHash ?? null, event.eventHash, event.idempotencyKey, stableJson(event.payload), stableJson(event.provenance), stableJson(event), event.timestamp);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, event.eventId), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, event.eventType, event.payloadVersion, event.source, event.actor.kind, event.actor.id, event.baseDigest, event.resultingDigest, event.previousEventHash ?? null, event.eventHash, event.idempotencyKey, stableJson(event.payload), stableJson(event.provenance), stableJson(event), event.timestamp);
   insertArchitectureLedgerFts(db, "event", architectureLedgerPayload(event).summary ?? "", architectureLedgerPayload(event).rationale ?? "", architectureLedgerPayload(event).title ?? "", "");
   const payload = architectureLedgerPayload(event);
   insertArchitectureLedgerSearchDoc(db, event, {
@@ -18402,11 +18740,13 @@ function insertArchitectureEvent(db, event) {
 }
 function persistArchitectureLedgerArtifacts(db, event) {
   const payload = architectureLedgerPayload(event);
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
+  const storageEventId = architectureLedgerStorageId(event.worktree, event.eventId);
   for (const evidence of payload.evidenceItems ?? []) {
     db.prepare(`INSERT OR REPLACE INTO evidence_items
         (evidence_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, kind, strength,
           polarity, origin, subject, selector_json, summary, coverage_json, supports_json, provenance_json, evidence_json, digest, created_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(evidence.evidenceId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, evidence.kind, evidence.strength, evidence.polarity, evidence.origin, evidence.subject, stableJson(evidence.selector), evidence.summary, stableJson(evidence.coverage), stableJson(evidence.supports), stableJson(evidence.provenance), stableJson(evidence), evidence.digest, evidence.createdAt);
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, evidence.evidenceId), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, storageEventId, evidence.kind, evidence.strength, evidence.polarity, evidence.origin, evidence.subject, stableJson(evidence.selector), evidence.summary, stableJson(evidence.coverage), stableJson(evidence.supports), stableJson(evidence.provenance), stableJson(evidence), evidence.digest, evidence.createdAt);
     insertArchitectureLedgerFts(db, "evidence", evidence.summary, "", "", evidence.summary);
     insertArchitectureLedgerSearchDoc(db, event, {
       docId: `evidence:${evidence.evidenceId}`,
@@ -18421,7 +18761,7 @@ function persistArchitectureLedgerArtifacts(db, event) {
     db.prepare(`INSERT OR REPLACE INTO evidence_bindings
         (binding_id, evidence_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id,
           target_kind, target_id, binding_reason, authority_effect, provenance_json, binding_json, created_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(binding.bindingId, binding.evidenceId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, binding.target.kind, binding.target.id, binding.bindingReason, binding.authorityEffect, stableJson(binding.provenance), stableJson(binding), binding.createdAt);
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, binding.bindingId), architectureLedgerStorageId(event.worktree, binding.evidenceId), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, storageEventId, binding.target.kind, binding.target.id, binding.bindingReason, binding.authorityEffect, stableJson(binding.provenance), stableJson(binding), binding.createdAt);
   }
   for (const run of payload.recommendationRuns ?? [])
     persistRecommendationRun(db, event, run);
@@ -18441,17 +18781,19 @@ function persistArchitectureLedgerArtifacts(db, event) {
     persistProjectionState(db, event, payload.projectionState);
 }
 function persistRecommendationRun(db, event, run) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO recommendation_runs
       (run_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, status, catalog_digest,
         input_digest, output_digest, metrics_json, run_json, started_at, completed_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(run.runId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, run.status, run.catalogDigest, run.inputDigest, run.outputDigest, stableJson(run.metrics), stableJson(run), run.startedAt, run.completedAt ?? null);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, run.runId), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, architectureLedgerStorageId(event.worktree, event.eventId), run.status, run.catalogDigest, run.inputDigest, run.outputDigest, stableJson(run.metrics), stableJson(run), run.startedAt, run.completedAt ?? null);
 }
 function persistRecommendation(db, event, recommendation) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO recommendations
       (recommendation_id, run_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, fingerprint,
         subject, practice_id, status, confidence, enforcement, risk, uncertainty, evidence_binding_ids_json, explanation_json,
         recommendation_json, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(recommendation.recommendationId, recommendation.runId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, recommendation.fingerprint, recommendation.subject, recommendation.practiceId ?? null, recommendation.status, recommendation.confidence, recommendation.enforcement, recommendation.risk, recommendation.uncertainty, stableJson(recommendation.evidenceBindingIds), stableJson(recommendation.explanation), stableJson(recommendation), recommendation.createdAt, recommendation.updatedAt);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, recommendation.recommendationId), architectureLedgerStorageId(event.worktree, recommendation.runId), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, architectureLedgerStorageId(event.worktree, event.eventId), recommendation.fingerprint, recommendation.subject, recommendation.practiceId ?? null, recommendation.status, recommendation.confidence, recommendation.enforcement, recommendation.risk, recommendation.uncertainty, stableJson(recommendation.evidenceBindingIds), stableJson(recommendation.explanation), stableJson(recommendation), recommendation.createdAt, recommendation.updatedAt);
   insertArchitectureLedgerFts(db, "recommendation", recommendation.explanation.join(`
 `), "", recommendation.subject, recommendation.explanation.join(`
 `));
@@ -18468,44 +18810,51 @@ function persistRecommendation(db, event, recommendation) {
   });
 }
 function persistAgentJob(db, event, job) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO agent_jobs
       (job_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, status, runner_port,
         fingerprint, input_digest, output_digest, stale_policy, job_json, queued_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(job.jobId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, job.status, job.runnerPort, job.fingerprint, job.inputDigest, job.outputDigest ?? null, job.stalePolicy, stableJson(job), job.queuedAt, job.updatedAt);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, job.jobId), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, architectureLedgerStorageId(event.worktree, event.eventId), job.status, job.runnerPort, job.fingerprint, job.inputDigest, job.outputDigest ?? null, job.stalePolicy, stableJson(job), job.queuedAt, job.updatedAt);
 }
 function persistAuditRun(db, event, run) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO audit_runs
       (run_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, job_id, report_id, status,
         repo_name_with_owner, repo_visibility, base_sha, input_digest, output_digest, run_json, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(run.runId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, run.jobId, run.reportId, run.status, run.repoNameWithOwner, run.repoVisibility, run.baseSha, run.inputDigest, run.outputDigest, stableJson(run), run.createdAt);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, run.runId), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, architectureLedgerStorageId(event.worktree, event.eventId), run.jobId, run.reportId, run.status, run.repoNameWithOwner, run.repoVisibility, run.baseSha, run.inputDigest, run.outputDigest, stableJson(run), run.createdAt);
 }
 function persistProjectionState(db, event, state) {
   const path = String(state.path ?? "projection");
   const projectionDigest = typeof state.projectionDigest === "string" ? state.projectionDigest : digestJson(state);
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO projection_state
       (projection_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, path, projection_digest, state_json, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(String(state.projectionId ?? stableLedgerId("projection", event.eventId, path)), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, path, projectionDigest, stableJson(state), event.timestamp);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, String(state.projectionId ?? stableLedgerId("projection", event.eventId, path))), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, architectureLedgerStorageId(event.worktree, event.eventId), path, projectionDigest, stableJson(state), event.timestamp);
 }
 function persistSourceCursor(db, event, cursor) {
   const source = String(cursor.source ?? event.source);
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO source_cursors
       (cursor_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, source, cursor_json, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(String(cursor.cursorId ?? stableLedgerId("cursor", event.eventId, source)), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, source, stableJson(cursor), event.timestamp);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(architectureLedgerStorageId(event.worktree, String(cursor.cursorId ?? stableLedgerId("cursor", event.eventId, source))), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, source, stableJson(cursor), event.timestamp);
 }
 function persistGenericLedgerJson(db, event, table, idColumn, jsonColumn, value, prefix) {
   const id = String(value[idColumn] ?? value.id ?? stableLedgerId(prefix, event.eventId, stableJson(value)));
+  const storageId = architectureLedgerStorageId(event.worktree, id);
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   if (table === "recommendation_feedback") {
     db.prepare(`INSERT OR REPLACE INTO recommendation_feedback
         (feedback_id, recommendation_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, feedback_json, created_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(id, String(value.recommendationId ?? value.recommendation_id ?? "unknown"), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, stableJson(value), String(value.createdAt ?? event.timestamp));
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(storageId, architectureLedgerStorageId(event.worktree, String(value.recommendationId ?? value.recommendation_id ?? "unknown")), event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, architectureLedgerStorageId(event.worktree, event.eventId), stableJson(value), String(value.createdAt ?? event.timestamp));
     return;
   }
   db.prepare(`INSERT OR REPLACE INTO waivers
       (waiver_id, repository_id, storage_repository_id, workspace_id, storage_workspace_id, event_id, target_kind, target_id, waiver_json, created_at, expires_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(id, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, event.worktree.storageWorkspaceId, event.eventId, String(value.targetKind ?? value.target_kind ?? "unknown"), String(value.targetId ?? value.target_id ?? "unknown"), stableJson(value), String(value.createdAt ?? event.timestamp), value.expiresAt ? String(value.expiresAt) : null);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(storageId, event.repository.repositoryId, event.repository.storageRepositoryId, event.worktree.workspaceId, workspaceKey, architectureLedgerStorageId(event.worktree, event.eventId), String(value.targetKind ?? value.target_kind ?? "unknown"), String(value.targetId ?? value.target_id ?? "unknown"), stableJson(value), String(value.createdAt ?? event.timestamp), value.expiresAt ? String(value.expiresAt) : null);
 }
 function materializeArchitectureLedgerEvent(db, event) {
   const payload = architectureLedgerPayload(event);
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   for (const operation of payload.operations ?? []) {
     switch (operation.op) {
       case "upsert_entity":
@@ -18513,31 +18862,32 @@ function materializeArchitectureLedgerEvent(db, event) {
         break;
       case "delete_entity":
         deleteArchitectureLedgerSearchDocs(db, { repository: event.repository, worktree: event.worktree }, [operation.entityId]);
-        db.prepare("DELETE FROM architecture_entities_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND entity_id = ?").run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, operation.entityId);
-        db.prepare("DELETE FROM architecture_relations_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND (source_entity_id = ? OR target_entity_id = ?)").run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, operation.entityId, operation.entityId);
+        db.prepare("DELETE FROM architecture_entities_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND entity_id = ?").run(event.repository.storageRepositoryId, workspaceKey, operation.entityId);
+        db.prepare("DELETE FROM architecture_relations_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND (source_entity_id = ? OR target_entity_id = ?)").run(event.repository.storageRepositoryId, workspaceKey, operation.entityId, operation.entityId);
         break;
       case "upsert_relation":
         upsertArchitectureRelation(db, event, operation.relation);
         break;
       case "delete_relation":
         deleteArchitectureLedgerSearchDocs(db, { repository: event.repository, worktree: event.worktree }, [operation.relationId]);
-        db.prepare("DELETE FROM architecture_relations_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND relation_id = ?").run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, operation.relationId);
+        db.prepare("DELETE FROM architecture_relations_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND relation_id = ?").run(event.repository.storageRepositoryId, workspaceKey, operation.relationId);
         break;
       case "upsert_constraint":
         upsertArchitectureConstraint(db, event, operation.constraint);
         break;
       case "delete_constraint":
         deleteArchitectureLedgerSearchDocs(db, { repository: event.repository, worktree: event.worktree }, [operation.constraintId]);
-        db.prepare("DELETE FROM architecture_constraints_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND constraint_id = ?").run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, operation.constraintId);
+        db.prepare("DELETE FROM architecture_constraints_current WHERE storage_repository_id = ? AND storage_workspace_id = ? AND constraint_id = ?").run(event.repository.storageRepositoryId, workspaceKey, operation.constraintId);
         break;
     }
   }
 }
 function upsertArchitectureEntity(db, event, entity) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO architecture_entities_current
       (storage_repository_id, storage_workspace_id, entity_id, repository_id, workspace_id, branch, head_sha, worktree_digest,
         kind, canonical_name, status, path, summary, metadata_json, last_event_id, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, entity.entityId, event.repository.repositoryId, event.worktree.workspaceId, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, entity.kind, entity.canonicalName, entity.status, entity.path ?? null, entity.summary ?? null, stableJson(entity.metadata ?? {}), event.eventId, event.timestamp);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.repository.storageRepositoryId, workspaceKey, entity.entityId, event.repository.repositoryId, event.worktree.workspaceId, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, entity.kind, entity.canonicalName, entity.status, entity.path ?? null, entity.summary ?? null, stableJson(entity.metadata ?? {}), architectureLedgerStorageId(event.worktree, event.eventId), event.timestamp);
   insertArchitectureLedgerFts(db, "entity", entity.summary ?? "", "", entity.canonicalName, "");
   insertArchitectureLedgerSearchDoc(db, event, {
     docId: `entity:${entity.entityId}`,
@@ -18550,10 +18900,11 @@ function upsertArchitectureEntity(db, event, entity) {
   });
 }
 function upsertArchitectureRelation(db, event, relation) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO architecture_relations_current
       (storage_repository_id, storage_workspace_id, relation_id, repository_id, workspace_id, branch, head_sha, worktree_digest,
         kind, source_entity_id, target_entity_id, status, summary, metadata_json, last_event_id, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, relation.relationId, event.repository.repositoryId, event.worktree.workspaceId, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, relation.kind, relation.sourceEntityId, relation.targetEntityId, relation.status, relation.summary ?? null, stableJson(relation.metadata ?? {}), event.eventId, event.timestamp);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.repository.storageRepositoryId, workspaceKey, relation.relationId, event.repository.repositoryId, event.worktree.workspaceId, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, relation.kind, relation.sourceEntityId, relation.targetEntityId, relation.status, relation.summary ?? null, stableJson(relation.metadata ?? {}), architectureLedgerStorageId(event.worktree, event.eventId), event.timestamp);
   insertArchitectureLedgerFts(db, "relation", relation.summary ?? "", "", relation.relationId, "");
   insertArchitectureLedgerSearchDoc(db, event, {
     docId: `relation:${relation.relationId}`,
@@ -18566,10 +18917,11 @@ function upsertArchitectureRelation(db, event, relation) {
   });
 }
 function upsertArchitectureConstraint(db, event, constraint) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`INSERT OR REPLACE INTO architecture_constraints_current
       (storage_repository_id, storage_workspace_id, constraint_id, repository_id, workspace_id, branch, head_sha, worktree_digest,
         kind, subject_id, status, severity, summary, metadata_json, last_event_id, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, constraint.constraintId, event.repository.repositoryId, event.worktree.workspaceId, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, constraint.kind, constraint.subjectId, constraint.status, constraint.severity ?? null, constraint.summary ?? null, stableJson(constraint.metadata ?? {}), event.eventId, event.timestamp);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.repository.storageRepositoryId, workspaceKey, constraint.constraintId, event.repository.repositoryId, event.worktree.workspaceId, event.worktree.branch, event.worktree.headSha, event.worktree.worktreeDigest, constraint.kind, constraint.subjectId, constraint.status, constraint.severity ?? null, constraint.summary ?? null, stableJson(constraint.metadata ?? {}), architectureLedgerStorageId(event.worktree, event.eventId), event.timestamp);
   insertArchitectureLedgerFts(db, "constraint", constraint.summary ?? "", "", constraint.constraintId, "");
   insertArchitectureLedgerSearchDoc(db, event, {
     docId: `constraint:${constraint.constraintId}`,
@@ -18582,7 +18934,7 @@ function upsertArchitectureConstraint(db, event, constraint) {
   });
 }
 function readArchitectureLedgerStateFromDb(db, scope) {
-  const scopeParams = [scope.repository.storageRepositoryId, scope.worktree.storageWorkspaceId];
+  const scopeParams = [scope.repository.storageRepositoryId, architectureLedgerWorkspaceKey(scope.worktree)];
   const entities = db.prepare(`SELECT entity_id, kind, canonical_name, status, path, summary, metadata_json
       FROM architecture_entities_current
       WHERE storage_repository_id = ? AND storage_workspace_id = ?
@@ -18623,7 +18975,7 @@ function readArchitectureLedgerStateFromDb(db, scope) {
 }
 function readArchitectureLedgerNeighborhoodFromDb(db, input) {
   const depth = Math.max(0, Math.floor(input.depth));
-  const scopeParams = [input.repository.storageRepositoryId, input.worktree.storageWorkspaceId];
+  const scopeParams = [input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree)];
   const entityIds = [...new Set(db.prepare(`WITH RECURSIVE seed(entity_id) AS (
         SELECT entity_id FROM architecture_entities_current
           WHERE storage_repository_id = ? AND storage_workspace_id = ? AND entity_id = ?
@@ -18704,42 +19056,43 @@ function architectureEventsForReplay(db, input) {
   let untilEventId = input.untilEventId;
   if (input.snapshotId) {
     const snapshot = db.prepare(`SELECT last_event_id FROM architecture_snapshots
-        WHERE snapshot_id = ? AND storage_repository_id = ? AND storage_workspace_id = ?`).get(input.snapshotId, input.repository.storageRepositoryId, input.worktree.storageWorkspaceId);
+        WHERE snapshot_id = ? AND storage_repository_id = ? AND storage_workspace_id = ?`).get(input.snapshotId, input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree));
     if (!snapshot)
       throw new Error(`architecture-ledger-snapshot-not-found: ${input.snapshotId}`);
     untilEventId = String(snapshot.last_event_id);
   }
   const rows = db.prepare(`SELECT event_id, event_json FROM architecture_events
       WHERE storage_repository_id = ? AND storage_workspace_id = ?
-      ORDER BY event_sequence`).all(input.repository.storageRepositoryId, input.worktree.storageWorkspaceId);
+      ORDER BY event_sequence`).all(input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree));
   const events = [];
   for (const row of rows) {
     const event = JSON.parse(String(row.event_json));
     events.push(event);
-    if (untilEventId && String(row.event_id) === untilEventId)
+    if (untilEventId && (String(row.event_id) === untilEventId || event.eventId === untilEventId))
       break;
   }
   return events;
 }
 function deleteArchitectureCurrentState(db, scope) {
   for (const table of ["architecture_entities_current", "architecture_relations_current", "architecture_constraints_current"]) {
-    db.prepare(`DELETE FROM ${table} WHERE storage_repository_id = ? AND storage_workspace_id = ?`).run(scope.repository.storageRepositoryId, scope.worktree.storageWorkspaceId);
+    db.prepare(`DELETE FROM ${table} WHERE storage_repository_id = ? AND storage_workspace_id = ?`).run(scope.repository.storageRepositoryId, architectureLedgerWorkspaceKey(scope.worktree));
   }
 }
 function insertArchitectureLedgerFts(db, kind, summary, rationale, title, evidenceSummary) {
   db.prepare("INSERT INTO architecture_ledger_fts(kind, summary, rationale, title, evidence_summary) VALUES (?, ?, ?, ?, ?)").run(kind, summary, rationale, title, evidenceSummary);
 }
 function insertArchitectureLedgerSearchDoc(db, event, doc) {
+  const workspaceKey = architectureLedgerWorkspaceKey(event.worktree);
   db.prepare(`DELETE FROM architecture_ledger_search_fts
-      WHERE storage_repository_id = ? AND storage_workspace_id = ? AND doc_id = ?`).run(event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, doc.docId);
+      WHERE storage_repository_id = ? AND storage_workspace_id = ? AND doc_id = ?`).run(event.repository.storageRepositoryId, workspaceKey, doc.docId);
   db.prepare(`INSERT INTO architecture_ledger_search_fts
       (doc_id, storage_repository_id, storage_workspace_id, target_kind, target_id, subject_id, title, summary, rationale, evidence_summary)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(doc.docId, event.repository.storageRepositoryId, event.worktree.storageWorkspaceId, doc.targetKind, doc.targetId, doc.subjectId ?? null, doc.title ?? "", doc.summary ?? "", doc.rationale ?? "", doc.evidenceSummary ?? "");
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(doc.docId, event.repository.storageRepositoryId, workspaceKey, doc.targetKind, doc.targetId, doc.subjectId ?? null, doc.title ?? "", doc.summary ?? "", doc.rationale ?? "", doc.evidenceSummary ?? "");
 }
 function deleteArchitectureLedgerSearchDocs(db, scope, ids) {
   for (const id of ids) {
     db.prepare(`DELETE FROM architecture_ledger_search_fts
-        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND (target_id = ? OR subject_id = ?)`).run(scope.repository.storageRepositoryId, scope.worktree.storageWorkspaceId, id, id);
+        WHERE storage_repository_id = ? AND storage_workspace_id = ? AND (target_id = ? OR subject_id = ?)`).run(scope.repository.storageRepositoryId, architectureLedgerWorkspaceKey(scope.worktree), id, id);
   }
 }
 function queryArchitectureLedgerSearchFts(db, input) {
@@ -18753,7 +19106,7 @@ function queryArchitectureLedgerSearchFts(db, input) {
       WHERE storage_repository_id = ? AND storage_workspace_id = ?
         AND architecture_ledger_search_fts MATCH ?
       ORDER BY rank, target_kind, target_id
-      LIMIT ?`).all(input.repository.storageRepositoryId, input.worktree.storageWorkspaceId, matchQuery, limit);
+      LIMIT ?`).all(input.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.worktree), matchQuery, limit);
   return rows.map((row) => {
     const title = String(row.title ?? "");
     const summary = String(row.summary ?? "");
@@ -18797,7 +19150,7 @@ function ftsMatchKind(query, doc) {
 function recordArchitectureLedgerOperation(db, input) {
   db.prepare(`INSERT INTO architecture_ledger_operations
       (operation_id, storage_repository_id, storage_workspace_id, operation_kind, duration_ms, row_count, rebuild_reason, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(`ledger_operation_${randomUUID2()}`, input.scope.repository.storageRepositoryId, input.scope.worktree.storageWorkspaceId, input.operationKind, Math.max(0, Math.trunc(input.durationMs)), input.rowCount, input.rebuildReason, nowIso2());
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(`ledger_operation_${randomUUID2()}`, input.scope.repository.storageRepositoryId, architectureLedgerWorkspaceKey(input.scope.worktree), input.operationKind, Math.max(0, Math.trunc(input.durationMs)), input.rowCount, input.rebuildReason, nowIso2());
 }
 function stableLedgerId(prefix, ...parts) {
   return `${prefix}.${createHash6("sha256").update(parts.join("\x00")).digest("hex").slice(0, 24)}`;
@@ -18836,7 +19189,7 @@ function readAppliedLocalSqliteMigrations2(db) {
 async function rebuildDerivedLandscapeState(store, input) {
   const landscapePath = input.landscapePath ?? LANDSCAPE_FILE;
   const relationsDir = input.relationsDir ?? ".archcontext/relations";
-  const landscape = parseLandscapeFile(await readFile(resolve13(input.root, landscapePath), "utf8"), landscapePath);
+  const landscape = parseLandscapeFile(await readFile(resolve14(input.root, landscapePath), "utf8"), landscapePath);
   const relations = await readRelationFiles(input.root, relationsDir);
   const scopedRelations = relations.filter((relation) => landscape.relations.includes(relation.id));
   const relationIds = new Set(relations.map((relation) => relation.id));
@@ -18863,7 +19216,7 @@ async function rebuildDerivedLandscapeState(store, input) {
 }
 async function openSqliteDatabase(databasePath) {
   if (databasePath !== ":memory:")
-    ensurePrivateDir2(dirname6(databasePath));
+    ensurePrivateDir2(dirname7(databasePath));
   try {
     const nodeSqlite = await import("node:sqlite");
     const db = new nodeSqlite.DatabaseSync(databasePath);
@@ -18884,7 +19237,7 @@ async function openSqliteDatabase(databasePath) {
 }
 function openSqliteDatabaseSync2(databasePath) {
   if (databasePath !== ":memory:")
-    ensurePrivateDir2(dirname6(databasePath));
+    ensurePrivateDir2(dirname7(databasePath));
   try {
     const nodeSqlite = runtimeRequire2("node:sqlite");
     const db2 = new nodeSqlite.DatabaseSync(databasePath);
@@ -18980,7 +19333,7 @@ function assertTrustedLegacyLocalStoreSource2(paths) {
   if (!stat.isFile()) {
     throw new Error(`Legacy SQLite source must be a regular file: ${paths.legacyLocalStorePath}`);
   }
-  const sourceRealPath = realpathSync6.native(paths.legacyLocalStorePath);
+  const sourceRealPath = realpathSync7.native(paths.legacyLocalStorePath);
   if (!isPathInsideOrSame2(sourceRealPath, paths.repositoryRoot)) {
     throw new Error(`Legacy SQLite source must stay inside the repository root: ${paths.legacyLocalStorePath}`);
   }
@@ -19034,12 +19387,12 @@ function sqliteStringLiteral2(value) {
 function publishStagedLocalStore2(stagingPath, targetPath) {
   for (const suffix of SQLITE_SIDECAR_SUFFIXES2) {
     const path = `${targetPath}${suffix}`;
-    if (existsSync10(path))
+    if (existsSync11(path))
       throw new Error(`Cannot publish migrated SQLite over existing target file: ${path}`);
   }
   renameSync3(stagingPath, targetPath);
   makePrivateFile2(targetPath);
-  fsyncDirectory3(dirname6(targetPath));
+  fsyncDirectory3(dirname7(targetPath));
 }
 function writeLegacyMigrationMarker2(paths, integrityCheck, quarantinedFiles) {
   const markerPath = legacyMigrationMarkerPath2(paths);
@@ -19055,7 +19408,7 @@ function writeLegacyMigrationMarker2(paths, integrityCheck, quarantinedFiles) {
 }
 function acquireLegacyMigrationLock2(paths) {
   const lockPath = legacyMigrationLockPath2(paths);
-  ensurePrivateDir2(dirname6(lockPath));
+  ensurePrivateDir2(dirname7(lockPath));
   try {
     const fd = openSync4(lockPath, "wx", 384);
     writeFileSync3(fd, JSON.stringify({
@@ -19084,7 +19437,7 @@ function releaseLegacyMigrationLock2(lock) {
 }
 function isStaleMigrationLock2(lockPath) {
   try {
-    const parsed = JSON.parse(readFileSync9(lockPath, "utf8"));
+    const parsed = JSON.parse(readFileSync10(lockPath, "utf8"));
     if (typeof parsed.pid !== "number" || parsed.pid <= 0)
       return true;
     return !isProcessAlive2(parsed.pid);
@@ -19106,20 +19459,20 @@ function quarantineExistingLocalStore2(paths) {
   const quarantinedFiles = [];
   for (const suffix of SQLITE_SIDECAR_SUFFIXES2) {
     const source = `${paths.localStorePath}${suffix}`;
-    if (!existsSync10(source))
+    if (!existsSync11(source))
       continue;
     const target = join6(quarantineDir, `runtime.sqlite${suffix}`);
     renameSync3(source, target);
     quarantinedFiles.push(target);
   }
   const markerPath = legacyMigrationMarkerPath2(paths);
-  if (existsSync10(markerPath)) {
+  if (existsSync11(markerPath)) {
     const target = join6(quarantineDir, LEGACY_MIGRATION_MARKER_FILE2);
     renameSync3(markerPath, target);
     quarantinedFiles.push(target);
   }
   fsyncDirectory3(quarantineDir);
-  fsyncDirectory3(dirname6(paths.localStorePath));
+  fsyncDirectory3(dirname7(paths.localStorePath));
   return quarantinedFiles;
 }
 function legacyMigrationMarkerPath2(paths) {
@@ -19129,7 +19482,7 @@ function legacyMigrationLockPath2(paths) {
   return join6(paths.workspaceStateDir, LEGACY_MIGRATION_LOCK_FILE2);
 }
 function writePrivateJson2(path, value) {
-  ensurePrivateDir2(dirname6(path));
+  ensurePrivateDir2(dirname7(path));
   const fd = openSync4(path, "w", 384);
   try {
     writeFileSync3(fd, JSON.stringify(value, null, 2), "utf8");
@@ -19138,7 +19491,7 @@ function writePrivateJson2(path, value) {
     closeSync4(fd);
   }
   makePrivateFile2(path);
-  fsyncDirectory3(dirname6(path));
+  fsyncDirectory3(dirname7(path));
 }
 function ensurePrivateDir2(path) {
   mkdirSync5(path, { recursive: true, mode: 448 });
@@ -19168,19 +19521,19 @@ function readGitPath2(root, args) {
   }
 }
 function resolveMaybeRelative2(base, path) {
-  return isAbsolute4(path) ? resolve13(path) : resolve13(base, path);
+  return isAbsolute4(path) ? resolve14(path) : resolve14(base, path);
 }
 function canonicalPath2(path) {
-  const resolved = resolve13(path);
+  const resolved = resolve14(path);
   try {
-    return realpathSync6.native(resolved);
+    return realpathSync7.native(resolved);
   } catch {
     return resolved;
   }
 }
 function isPathInsideOrSame2(path, parent) {
-  const child = resolve13(path);
-  const base = resolve13(parent);
+  const child = resolve14(path);
+  const base = resolve14(parent);
   const fromBase = relative7(base, child);
   return fromBase === "" || !!fromBase && !fromBase.startsWith("..") && !isAbsolute4(fromBase);
 }
@@ -19363,32 +19716,40 @@ function changeSetLedgerAppendSummary(result) {
 }
 function changeSetJournalPlannedLedgerEvent(metadata) {
   const architectureLedger = metadata.architectureLedger;
-  if (!isJsonRecord(architectureLedger))
+  if (architectureLedger === undefined)
     return;
+  if (!isJsonRecord(architectureLedger))
+    throw new Error("changeset-ledger-recovery-metadata-malformed");
   const plannedEvent = architectureLedger.plannedEvent;
-  if (!isJsonRecord(plannedEvent))
+  if (plannedEvent === undefined)
     return;
+  if (!isJsonRecord(plannedEvent))
+    throw new Error("changeset-ledger-recovery-planned-event-malformed");
+  const event = plannedEvent;
   try {
-    const event = plannedEvent;
     validateArchitectureLedgerEvent(event);
-    return event;
-  } catch {
-    return;
+  } catch (error) {
+    throw new Error(`changeset-ledger-recovery-planned-event-invalid: ${error instanceof Error ? error.message : String(error)}`);
   }
+  return event;
 }
 function isJsonRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function recoverJournalFiles(root, files) {
   for (const file of [...files].reverse()) {
-    const absolute = resolve13(root, file.path);
+    const absolute = resolve14(root, file.path);
     if (file.tempPath)
       rmSync5(file.tempPath, { recursive: true, force: true });
-    rmSync5(absolute, { recursive: true, force: true });
-    if (file.existed && file.backupPath && existsSync10(file.backupPath)) {
-      renameSync3(file.backupPath, absolute);
+    if (file.existed) {
+      if (file.backupPath && existsSync11(file.backupPath)) {
+        rmSync5(absolute, { recursive: true, force: true });
+        renameSync3(file.backupPath, absolute);
+      }
+    } else {
+      rmSync5(absolute, { recursive: true, force: true });
     }
-    fsyncDirectory3(dirname6(absolute));
+    fsyncDirectory3(dirname7(absolute));
   }
 }
 function cleanupCommittedJournalFiles(files) {
@@ -19425,7 +19786,7 @@ function reviewTaskSessionId(result) {
 async function readRelationFiles(root, relationsDir) {
   let entries;
   try {
-    entries = await readdir(resolve13(root, relationsDir), { withFileTypes: true });
+    entries = await readdir(resolve14(root, relationsDir), { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT")
       return [];
@@ -19436,15 +19797,25 @@ async function readRelationFiles(root, relationsDir) {
     if (!entry.isFile() || !/\.(json|ya?ml)$/.test(entry.name))
       continue;
     const relativePath = join6(relationsDir, entry.name).split("\\").join("/");
-    relations.push(parseCrossRepoRelationFile(await readFile(resolve13(root, relativePath), "utf8"), relativePath));
+    relations.push(parseCrossRepoRelationFile(await readFile(resolve14(root, relativePath), "utf8"), relativePath));
   }
   return relations.sort((a, b) => a.id.localeCompare(b.id));
 }
 
 // packages/local-runtime/model-store-yaml/src/index.ts
 init_src();
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readdirSync as readdirSync7, readFileSync as readFileSync10, rmSync as rmSync6, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname7, resolve as resolve14 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, readdirSync as readdirSync7, readFileSync as readFileSync11, rmSync as rmSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname8, resolve as resolve15 } from "node:path";
+var GENERATED_ARCHITECTURE_PATH = ".archcontext/generated/ARCHITECTURE.md";
+var GENERATED_ARCHITECTURE_BODY = [
+  "<!-- Generated by ArchContext. Do not edit by hand. -->",
+  "",
+  "# Architecture",
+  "",
+  "Model projection is generated from `.archcontext/model`.",
+  ""
+].join(`
+`);
 function createDefaultManifest(productId, productName) {
   return {
     schemaVersion: "archcontext.manifest/v1",
@@ -19594,21 +19965,55 @@ function initializeArchContextModel(root, productName = "ArchContext Project") {
   rebuildGeneratedProjection(root);
 }
 function rebuildGeneratedProjection(root) {
-  rmSync6(resolve14(root, ".archcontext/generated"), { recursive: true, force: true });
-  writeFile(root, ".archcontext/generated/ARCHITECTURE.md", [
-    "<!-- Generated by ArchContext. Do not edit by hand. -->",
-    "",
-    "# Architecture",
-    "",
-    "Model projection is generated from `.archcontext/model`.",
-    ""
-  ].join(`
-`));
+  for (const operation of planGeneratedProjection(root)) {
+    if (operation.operation === "delete_entity") {
+      rmSync6(resolve15(root, operation.path), { force: true });
+    } else {
+      writeFile(root, operation.path, operation.body);
+    }
+  }
+}
+function planGeneratedProjection(root) {
+  const desiredBody = GENERATED_ARCHITECTURE_BODY;
+  const desiredAbsolute = resolve15(root, GENERATED_ARCHITECTURE_PATH);
+  const operations = [];
+  if (!existsSync12(desiredAbsolute) || readFileSync11(desiredAbsolute, "utf8") !== desiredBody) {
+    operations.push({
+      path: GENERATED_ARCHITECTURE_PATH,
+      expectedHash: existsSync12(desiredAbsolute) ? digestJson({ body: readFileSync11(desiredAbsolute, "utf8") }) : "missing",
+      body: desiredBody,
+      operation: "render_projection"
+    });
+  }
+  for (const path of collectGeneratedProjectionFiles(root)) {
+    if (path === GENERATED_ARCHITECTURE_PATH)
+      continue;
+    const body = readFileSync11(resolve15(root, path), "utf8");
+    operations.push({
+      path,
+      expectedHash: digestJson({ body }),
+      body: "",
+      operation: "delete_entity"
+    });
+  }
+  return operations.sort((left, right) => left.path.localeCompare(right.path));
+}
+function collectGeneratedProjectionFiles(root) {
+  const generatedRoot = ".archcontext/generated";
+  if (!existsSync12(resolve15(root, generatedRoot)))
+    return [];
+  const walk = (relativeDir) => readdirSync7(resolve15(root, relativeDir), { withFileTypes: true }).flatMap((entry) => {
+    const child = `${relativeDir}/${entry.name}`;
+    if (entry.isDirectory())
+      return walk(child);
+    return entry.isFile() ? [child] : [];
+  });
+  return walk(generatedRoot).sort();
 }
 
 class YamlModelStore {
   async loadManifest(workspace) {
-    return readFileSync10(resolve14(workspace.root, ".archcontext/manifest.yaml"), "utf8");
+    return readFileSync11(resolve15(workspace.root, ".archcontext/manifest.yaml"), "utf8");
   }
   async loadModel(workspace) {
     return listModelFiles(workspace.root);
@@ -19617,7 +20022,7 @@ class YamlModelStore {
     const errors = [];
     for (const required of [".archcontext/manifest.yaml", ".archcontext/product.yaml"]) {
       try {
-        readFileSync10(resolve14(workspace.root, required), "utf8");
+        readFileSync11(resolve15(workspace.root, required), "utf8");
       } catch {
         errors.push(`missing ${required}`);
       }
@@ -19647,7 +20052,7 @@ function listModelFiles(root) {
     "docs/adr"
   ]);
   return paths.map((path) => {
-    const body = readFileSync10(resolve14(root, path), "utf8");
+    const body = readFileSync11(resolve15(root, path), "utf8");
     return {
       path,
       body,
@@ -19659,8 +20064,8 @@ function listModelFiles(root) {
 function collectArchContextFiles(root, entries) {
   const files = [];
   for (const entry of entries) {
-    const absolute = resolve14(root, entry);
-    if (!existsSync11(absolute))
+    const absolute = resolve15(root, entry);
+    if (!existsSync12(absolute))
       continue;
     const stat = readdirOrFile(absolute);
     if (stat === "file") {
@@ -19673,7 +20078,7 @@ function collectArchContextFiles(root, entries) {
   return [...new Set(files)].sort();
   function walk(relativeDir) {
     const out = [];
-    const dir = resolve14(root, relativeDir);
+    const dir = resolve15(root, relativeDir);
     for (const entry of readdirSync7(dir, { withFileTypes: true })) {
       const child = `${relativeDir}/${entry.name}`;
       if (entry.isDirectory())
@@ -19714,8 +20119,8 @@ function writeYaml(root, path, value) {
   writeFile(root, path, stableYaml(value));
 }
 function writeFile(root, path, body) {
-  const absolute = resolve14(root, path);
-  mkdirSync6(dirname7(absolute), { recursive: true });
+  const absolute = resolve15(root, path);
+  mkdirSync6(dirname8(absolute), { recursive: true });
   writeFileSync4(absolute, body.endsWith(`
 `) ? body : `${body}
 `, "utf8");
@@ -20075,7 +20480,8 @@ class ArchitectureLedgerReadModelStore {
     return this.fallback.writeChangeSetPreview(changeSet);
   }
   async loadLedgerModel(workspace) {
-    const state = await this.localStore.readArchitectureLedgerState(architectureLedgerScopeForWorkspace(workspace));
+    const scope = await this.localStore.resolveArchitectureLedgerScope(architectureLedgerScopeForWorkspace(workspace));
+    const state = await this.localStore.readArchitectureLedgerState(scope);
     const projectedFiles = projectArchitectureLedgerStateToYamlFiles(state).map((file) => ({
       path: file.path,
       body: file.body,
@@ -20159,7 +20565,7 @@ class ArchctxDaemon {
     this.readModelStore = new ArchitectureLedgerReadModelStore(this.modelStore, this.localStore, this.architectureLedger);
     this.changeSetEngine = deps.changeSetEngine ?? new ChangeSetEngine({
       modelStore: this.modelStore,
-      projection: { rebuildGeneratedProjection },
+      projection: { planGeneratedProjection },
       journal: this.localStore
     });
     this.devicePrivateKeySigner = deps.devicePrivateKeySigner;
@@ -21108,10 +21514,10 @@ class ArchctxDaemon {
       return errorEnvelope("practices.waive", "AC_SCHEMA_INVALID", error instanceof Error ? error.message : String(error));
     }
     const path = `.archcontext/waivers/${waiverId}.json`;
-    const absolute = resolve15(session.workspace.root, path);
+    const absolute = resolve16(session.workspace.root, path);
     const body = `${JSON.stringify(waiver, null, 2)}
 `;
-    const expectedHash = existsSync12(absolute) ? digestJson({ body: readFileSync11(absolute, "utf8") }) : "missing";
+    const expectedHash = existsSync13(absolute) ? digestJson({ body: readFileSync12(absolute, "utf8") }) : "missing";
     const draft = this.changeSetEngine.plan({
       id: input.id ?? `changeset.practice-waiver-${waiverId.replace(/[^A-Za-z0-9_-]/g, "-")}`,
       base: {
@@ -21450,6 +21856,16 @@ class ArchctxDaemon {
       const draft = this.changesets.get(input.id);
       if (!draft)
         throw new Error(`Unknown ChangeSet: ${input.id}`);
+      if (draft.base.headSha !== session.workspace.headSha)
+        throw new Error("ChangeSet HEAD changed before apply");
+      if (draft.base.worktreeDigest !== current)
+        throw new Error("ChangeSet worktree digest changed before apply");
+      const currentModel = await this.readModelStore.validateModel(session.workspace);
+      if (!currentModel.valid) {
+        throw new Error(`ChangeSet base model is invalid: ${currentModel.errors.join("; ") || "unknown validation error"}`);
+      }
+      if (draft.base.modelDigest !== currentModel.modelDigest)
+        throw new Error("ChangeSet model digest changed before apply");
       const approved = input.approved ? this.changeSetEngine.approve(draft) : draft;
       let ledgerAppend;
       const writesLedger = architectureLedgerWriteAppendsEvents(this.architectureLedger.writeMode);
@@ -21466,6 +21882,7 @@ class ArchctxDaemon {
             relationCount: appended.relationCount,
             constraintCount: appended.constraintCount
           };
+          return { journalCommitted: Boolean(journalId) };
         } : undefined
       });
       return okEnvelope("apply_update", {
@@ -21499,14 +21916,72 @@ class ArchctxDaemon {
     });
     if (journalId)
       await this.localStore.recordChangeSetLedgerPlan(journalId, { event: plan.event });
-    const result = await this.localStore.appendArchitectureEvents({
-      writer: "runtime-daemon",
-      events: [plan.event]
-    });
-    if (journalId)
-      await this.localStore.recordChangeSetLedgerAppend(journalId, { result });
+    const appendInput = { writer: "runtime-daemon", events: [plan.event] };
+    const result = journalId ? await this.localStore.appendArchitectureEventsAndCommitChangeSet(journalId, appendInput) : await this.localStore.appendArchitectureEvents(appendInput);
     return result;
   }
+  async applyArchitectureProjectionChangeSet(root, input) {
+    const session = await this.openSession(root);
+    const model = await this.modelStore.validateModel(session.workspace);
+    if (!model.valid)
+      throw new Error(`Architecture projection ChangeSet base model is invalid: ${model.errors.join("; ")}`);
+    const projectionFiles = input.files.map((file) => ({
+      path: file.path,
+      body: file.body.endsWith(`
+`) ? file.body : `${file.body}
+`,
+      expectedHash: expectedFileHash(root, file.path)
+    }));
+    const operations = [
+      ...projectionFiles.length > 0 ? [{ op: "render_projection", expectedHash: "missing", projectionFiles }] : [],
+      ...input.removedPaths.map((path) => ({
+        op: "delete_entity",
+        path,
+        expectedHash: expectedFileHash(root, path)
+      }))
+    ];
+    const draft = this.changeSetEngine.approve(this.changeSetEngine.plan({
+      id: input.id,
+      base: {
+        headSha: session.workspace.headSha,
+        worktreeDigest: session.snapshot.worktreeDigest,
+        modelDigest: model.modelDigest
+      },
+      reason: { taskSessionId: input.id },
+      operations
+    }));
+    await this.changeSetEngine.apply(root, draft, { approved: true });
+  }
+  async applyArchitectureProjectionRollbackChangeSet(root, projectedFiles, currentFiles, createdAt) {
+    const targetPaths = new Set(projectedFiles.map((file) => file.path));
+    const backupBase = `.archcontext/backups/ledger-rollback/${safePathSegment(createdAt)}`;
+    const backupRelativePath = uniqueBackupPath(root, backupBase);
+    const manifestPath = `${backupRelativePath}/manifest.json`;
+    const { backup, manifest } = architectureProjectionRollbackBackup(currentFiles, {
+      createdAt,
+      path: backupRelativePath,
+      manifestPath
+    });
+    const removedPaths = currentFiles.filter((file) => !targetPaths.has(file.path)).map((file) => file.path);
+    await this.applyArchitectureProjectionChangeSet(root, {
+      id: `changeset.ledger-rollback-${shortDigest3(digestJson({ createdAt, projectionDigest: architectureLedgerProjectionDigest(projectedFiles) }))}`,
+      files: [
+        ...currentFiles.map((file) => ({
+          path: join8(backupRelativePath, archContextRelativePath(file.path)),
+          body: file.body
+        })),
+        { path: manifestPath, body: `${JSON.stringify(manifest, null, 2)}
+` },
+        ...projectedFiles.map(({ path, body }) => ({ path, body }))
+      ],
+      removedPaths
+    });
+    return {
+      backup,
+      writtenPaths: projectedFiles.map((file) => file.path),
+      removedPaths
+    };
+  }
   async ledgerState(root) {
     this.assertRunning();
     return okEnvelope("ledger.state", await this.architectureLedgerReadback(root));
@@ -21860,8 +22335,13 @@ class ArchctxDaemon {
       const scope = await this.architectureLedgerScope(root);
       const state = await this.localStore.readArchitectureLedgerState(scope);
       const projectedFiles = projectArchitectureLedgerStateToYamlFiles(state);
-      if (writes)
-        writeArchitectureProjectionFiles(root, projectedFiles);
+      if (writes) {
+        await this.applyArchitectureProjectionChangeSet(root, {
+          id: `changeset.ledger-project-${shortDigest3(architectureLedgerProjectionDigest(projectedFiles))}`,
+          files: projectedFiles.map(({ path, body }) => ({ path, body })),
+          removedPaths: []
+        });
+      }
       const drift = compareArchitectureLedgerStateToYaml({
         state,
         files: listModelFiles(root),
@@ -22011,7 +22491,7 @@ class ArchctxDaemon {
       const projectedFiles = projectArchitectureLedgerStateToYamlFiles(state);
       const currentManagedFiles = listModelFiles(root).filter((file) => isArchitectureLedgerManagedModelPath(file.path));
       const backupPlan = architectureProjectionRollbackBackup(currentManagedFiles);
-      const writeResult = writes ? replaceArchitectureProjectionFilesForYamlRollback(root, projectedFiles, currentManagedFiles, this.clock()) : { backup: backupPlan.backup, writtenPaths: [], removedPaths: [] };
+      const writeResult = writes ? await this.applyArchitectureProjectionRollbackChangeSet(root, projectedFiles, currentManagedFiles, this.clock()) : { backup: backupPlan.backup, writtenPaths: [], removedPaths: [] };
       const drift = compareArchitectureLedgerStateToYaml({
         state,
         files: listModelFiles(root),
@@ -22050,9 +22530,12 @@ class ArchctxDaemon {
       return errorEnvelope("ledger.rebuild", "AC_SCHEMA_INVALID", "ledger rebuild currently requires --from-git");
     return this.withWriter(async () => {
       this.assertFreshWorktree(root, input.expectedWorktreeDigest, "ledger rebuild --from-git");
-      const scope = await this.architectureLedgerScope(root);
+      const scope = await this.architectureLedgerGitScope(root);
       const files = listModelFiles(root);
-      const previousState = await this.localStore.readArchitectureLedgerState(scope);
+      const exactReplay = await this.localStore.replayArchitectureLedger(scope);
+      const exactScopeHasEvents = exactReplay.events.length > 0;
+      const authorityScope = exactScopeHasEvents ? scope : await this.localStore.resolveLatestArchitectureLedgerScope(scope);
+      const previousState = exactScopeHasEvents ? exactReplay.state : await this.localStore.readArchitectureLedgerState(authorityScope);
       const previousGraphDigest = architectureLedgerStateDigest(previousState);
       const rebuildCommand = input.acceptExternalProjection ? "archctx ledger rebuild --from-git --accept-external-projection" : "archctx ledger rebuild --from-git";
       const plan = planYamlToArchitectureLedgerRebuild({
@@ -22062,12 +22545,18 @@ class ArchctxDaemon {
         command: rebuildCommand,
         previousState
       });
+      const importPlan = planYamlToArchitectureLedgerImport({
+        ...scope,
+        files,
+        createdAt: this.clock(),
+        command: rebuildCommand
+      });
       if (plan.unsupportedFiles.length > 0) {
         return errorEnvelope("ledger.rebuild", "AC_SCHEMA_INVALID", "ledger rebuild requires supported YAML model files");
       }
       const cursor = architectureLedgerGitCursorFromPlan({ ...scope, plan });
       const previousCursor = await this.localStore.readArchitectureLedgerSourceCursor({
-        ...scope,
+        ...authorityScope,
         cursorId: ARCHITECTURE_LEDGER_GIT_CURSOR_ID
       });
       const cursorChanged = previousCursor?.cursorDigest !== cursor.cursorDigest;
@@ -22083,7 +22572,13 @@ class ArchctxDaemon {
       let rebuildStatus = "unchanged";
       let proposedExternalProjectionChange;
       if (previousGraphDigest === plan.graphDigest) {
-        if (cursorChanged) {
+        if (!exactScopeHasEvents) {
+          append = await this.localStore.appendArchitectureEvents({
+            writer: "runtime-daemon",
+            events: [importPlan.event]
+          });
+          rebuildStatus = isEmptyArchitectureLedgerState(previousState) ? "rebuilt" : "cursor-refreshed";
+        } else if (cursorChanged) {
           const cursorPlan = planGitCursorRefreshToArchitectureLedgerEvent({
             ...scope,
             cursor,
@@ -22099,7 +22594,7 @@ class ArchctxDaemon {
         }
       } else if (!previousStateEmpty && !input.acceptExternalProjection) {
         const proposal = planExternalProjectionChangeToArchitectureLedgerEvent({
-          ...scope,
+          ...authorityScope,
           files,
           createdAt: this.clock(),
           command: rebuildCommand,
@@ -22122,11 +22617,12 @@ class ArchctxDaemon {
       } else {
         append = await this.localStore.appendArchitectureEvents({
           writer: "runtime-daemon",
-          events: [plan.event]
+          events: [exactScopeHasEvents ? plan.event : importPlan.event]
         });
         rebuildStatus = previousStateEmpty ? "rebuilt" : "external-projection-accepted";
       }
-      const replay = await this.localStore.rebuildArchitectureLedgerCurrentState(scope);
+      const replayScope = rebuildStatus === "external-projection-proposed" ? authorityScope : scope;
+      const replay = await this.localStore.rebuildArchitectureLedgerCurrentState(replayScope);
       const drift = compareArchitectureLedgerStateToYaml({
         state: replay.state,
         files: listModelFiles(root),
@@ -22272,6 +22768,9 @@ class ArchctxDaemon {
     return this.running ? this.architectureLedgerContextPort(root) : undefined;
   }
   async architectureLedgerScope(root) {
+    return this.localStore.resolveArchitectureLedgerScope(await this.architectureLedgerGitScope(root));
+  }
+  async architectureLedgerGitScope(root) {
     const session = await this.openSession(root);
     const paths = runtimeStatePaths2(root);
     return {
@@ -22334,7 +22833,7 @@ class ArchctxDaemon {
         cleanup: "remove-run-root"
       }
     };
-    if (existsSync12(paths.lockPath) || existsSync12(paths.manifestPath)) {
+    if (existsSync13(paths.lockPath) || existsSync13(paths.manifestPath)) {
       removePathWithRetry(paths.runRoot);
       throw new Error(`developer-review-run-already-active: ${input.challenge.challengeId}`);
     }
@@ -22391,7 +22890,7 @@ class ArchctxDaemon {
     const errors = [];
     if (run.worktree) {
       try {
-        const hadWorktree = existsSync12(run.worktree.worktreeRoot);
+        const hadWorktree = existsSync13(run.worktree.worktreeRoot);
         removeDetachedReviewWorktree(run.worktree);
         if (hadWorktree)
           removed.push("worktree");
@@ -22405,7 +22904,7 @@ class ArchctxDaemon {
       ["lock", run.lockPath]
     ]) {
       try {
-        const existed = existsSync12(path);
+        const existed = existsSync13(path);
         removePathWithRetry(path);
         if (existed)
           removed.push(kind);
@@ -22425,7 +22924,7 @@ class ArchctxDaemon {
   recoverDeveloperReviewRuns(input) {
     this.assertRunning();
     const sourceRoot = findRepositoryRoot2(input.repositoryRoot);
-    const stateDir = input.stateDir ? resolve15(input.stateDir) : defaultDeveloperReviewRunStateDir(sourceRoot);
+    const stateDir = input.stateDir ? resolve16(input.stateDir) : defaultDeveloperReviewRunStateDir(sourceRoot);
     const recovery = {
       schemaVersion: "archcontext.developer-review-run-recovery/v1",
       sourceRoot,
@@ -22434,7 +22933,7 @@ class ArchctxDaemon {
       removedLocks: [],
       skippedActive: []
     };
-    if (!existsSync12(stateDir))
+    if (!existsSync13(stateDir))
       return recovery;
     for (const entry of readdirSync8(stateDir).sort()) {
       if (!entry.endsWith(".json"))
@@ -22802,7 +23301,7 @@ class ArchctxDaemon {
   }
   async restoreRepositorySessions() {
     for (const record of await this.localStore.listRepositorySessions()) {
-      if (!record.root || !existsSync12(record.root))
+      if (!record.root || !existsSync13(record.root))
         continue;
       if (repositoryFingerprint2(record.root) !== record.repositoryId)
         continue;
@@ -23229,8 +23728,8 @@ class ArchctxRuntimeRpcServer {
     const root = this.options.root ?? process.cwd();
     const connectionPath = this.options.connectionPath ?? defaultDaemonConnectionPath(root);
     const lockPath = this.options.lockPath ?? defaultDaemonLockPath(root);
-    mkdirSync7(dirname8(connectionPath), { recursive: true });
-    mkdirSync7(dirname8(lockPath), { recursive: true });
+    mkdirSync7(dirname9(connectionPath), { recursive: true });
+    mkdirSync7(dirname9(lockPath), { recursive: true });
     this.lockFd = acquireDaemonLock(lockPath, root);
     const token = this.options.token ?? randomBytes(18).toString("base64url");
     const server = createServer((request, response) => {
@@ -23535,7 +24034,7 @@ function readRuntimeRpcConnectionFile(root = process.cwd()) {
   try {
     if (!isPrivateControlFile(path))
       return;
-    const parsed = JSON.parse(readFileSync11(path, "utf8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf8"));
     if (!parsed || typeof parsed !== "object")
       return;
     return {
@@ -23576,7 +24075,7 @@ function readRuntimeRpcConnection(root = process.cwd()) {
   try {
     if (!isPrivateControlFile(path))
       return;
-    const parsed = JSON.parse(readFileSync11(path, "utf8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf8"));
     return isValidRuntimeRpcConnection(parsed) ? parsed : undefined;
   } catch {
     return;
@@ -23595,7 +24094,7 @@ function recoverStaleDaemonControlFiles(root = process.cwd(), options = {}) {
     rmSync8(connectionPath, { force: true });
     removed.push(connectionReason);
   }
-  if (existsSync12(lockPath) && isStaleLock(lockPath)) {
+  if (existsSync13(lockPath) && isStaleLock(lockPath)) {
     rmSync8(lockPath, { force: true });
     removed.push("stale-lock-file");
   }
@@ -23854,8 +24353,8 @@ function schemaVersionKind(schemaVersion) {
 function createDeveloperReviewRunPaths(input) {
   const safeChallengeId = safeControlFileSegment(input.challengeId);
   const runId = `${safeChallengeId}-${randomBytes(6).toString("hex")}`;
-  const stateDir = input.stateDir ? resolve15(input.stateDir) : defaultDeveloperReviewRunStateDir(input.sourceRoot);
-  const tempParent = input.tempRoot ? resolve15(input.tempRoot) : tmpdir3();
+  const stateDir = input.stateDir ? resolve16(input.stateDir) : defaultDeveloperReviewRunStateDir(input.sourceRoot);
+  const tempParent = input.tempRoot ? resolve16(input.tempRoot) : tmpdir3();
   mkdirSync7(tempParent, { recursive: true });
   const runRoot = mkdtempSync4(join8(tempParent, `archctx-developer-review-${safeChallengeId.slice(0, 32)}-`));
   return {
@@ -24001,7 +24500,7 @@ function readExactPackageVersion(root, packageName) {
   return;
 }
 function readPackageLockExactVersion(root, packageName) {
-  const lock = readJsonFile(resolve15(root, "package-lock.json"));
+  const lock = readJsonFile(resolve16(root, "package-lock.json"));
   if (!lock || typeof lock !== "object" || Array.isArray(lock))
     return;
   const packages = lock.packages;
@@ -24019,7 +24518,7 @@ function readPackageLockExactVersion(root, packageName) {
   return;
 }
 function packageManifestPaths(root) {
-  const paths = [resolve15(root, "package.json")];
+  const paths = [resolve16(root, "package.json")];
   const rootManifest = readJsonFile(paths[0]);
   for (const pattern of workspacePatternsFromManifest(rootManifest)) {
     for (const path of expandWorkspacePackageJson(root, pattern))
@@ -24042,15 +24541,15 @@ function expandWorkspacePackageJson(root, pattern) {
   if (pattern.includes("**") || pattern.startsWith("/") || pattern.includes("\\"))
     return [];
   if (!pattern.includes("*")) {
-    const path = resolve15(root, pattern, "package.json");
-    return existsSync12(path) ? [path] : [];
+    const path = resolve16(root, pattern, "package.json");
+    return existsSync13(path) ? [path] : [];
   }
   if (!pattern.endsWith("/*"))
     return [];
-  const base = resolve15(root, pattern.slice(0, -2));
-  if (!existsSync12(base) || !statSync6(base).isDirectory())
+  const base = resolve16(root, pattern.slice(0, -2));
+  if (!existsSync13(base) || !statSync6(base).isDirectory())
     return [];
-  return readdirSync8(base, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => resolve15(base, entry.name, "package.json")).filter((path) => existsSync12(path));
+  return readdirSync8(base, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => resolve16(base, entry.name, "package.json")).filter((path) => existsSync13(path));
 }
 function exactVersionFromManifest(manifest, packageName) {
   if (!manifest || typeof manifest !== "object" || Array.isArray(manifest))
@@ -24066,10 +24565,10 @@ function exactVersionFromManifest(manifest, packageName) {
   return;
 }
 function readJsonFile(path) {
-  if (!existsSync12(path))
+  if (!existsSync13(path))
     return;
   try {
-    return JSON.parse(readFileSync11(path, "utf8"));
+    return JSON.parse(readFileSync12(path, "utf8"));
   } catch {
     return;
   }
@@ -24078,15 +24577,15 @@ function isExactPackageVersion(value) {
   return /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(value);
 }
 function readContext7Lockfile(root) {
-  const path = resolve15(root, CONTEXT7_LOCKFILE);
-  if (!existsSync12(path)) {
+  const path = resolve16(root, CONTEXT7_LOCKFILE);
+  if (!existsSync13(path)) {
     return {
       schemaVersion: CONTEXT7_LOCKFILE_SCHEMA_VERSION,
       provider: "context7",
       libraries: []
     };
   }
-  const parsed = JSON.parse(readFileSync11(path, "utf8"));
+  const parsed = JSON.parse(readFileSync12(path, "utf8"));
   if (parsed.schemaVersion !== CONTEXT7_LOCKFILE_SCHEMA_VERSION || parsed.provider !== "context7" || !Array.isArray(parsed.libraries)) {
     throw new Error("Invalid Context7 lockfile");
   }
@@ -24107,13 +24606,13 @@ function upsertContext7Pin(lock, pin) {
   };
 }
 function writeContext7Lockfile(root, lock) {
-  writePrivateJson3(resolve15(root, CONTEXT7_LOCKFILE), lock);
+  writePrivateJson3(resolve16(root, CONTEXT7_LOCKFILE), lock);
 }
 function writeDeveloperReviewRunManifest(manifest) {
   writePrivateJson3(manifest.manifestPath, manifest);
 }
 function writePrivateJson3(path, value, flag = "w") {
-  mkdirSync7(dirname8(path), { recursive: true });
+  mkdirSync7(dirname9(path), { recursive: true });
   writeFileSync6(path, JSON.stringify(value, null, 2), { mode: 384, flag });
   chmodSync3(path, 384);
 }
@@ -24137,7 +24636,7 @@ function readDeveloperReviewRunManifest(path) {
 }
 function readJsonObject(path) {
   try {
-    const parsed = JSON.parse(readFileSync11(path, "utf8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : undefined;
   } catch {
     return;
@@ -24328,48 +24827,9 @@ function auditApproveResultPayload(runId, status, totalCount, issuedIssues) {
     issuedIssues
   };
 }
-function writeArchitectureProjectionFiles(root, files) {
-  for (const file of files) {
-    const absolute = resolve15(root, file.path);
-    mkdirSync7(dirname8(absolute), { recursive: true });
-    writeFileSync6(absolute, file.body.endsWith(`
-`) ? file.body : `${file.body}
-`, "utf8");
-  }
-}
-function replaceArchitectureProjectionFilesForYamlRollback(root, projectedFiles, currentFiles, createdAt) {
-  const targetPaths = new Set(projectedFiles.map((file) => file.path));
-  const backupBase = `.archcontext/backups/ledger-rollback/${safePathSegment(createdAt)}`;
-  const backupRelativePath = uniqueBackupPath(root, backupBase);
-  const manifestPath = `${backupRelativePath}/manifest.json`;
-  const { backup, manifest } = architectureProjectionRollbackBackup(currentFiles, {
-    createdAt,
-    path: backupRelativePath,
-    manifestPath
-  });
-  for (const file of currentFiles) {
-    const backupPath = join8(backupRelativePath, archContextRelativePath(file.path));
-    const absolute = resolve15(root, backupPath);
-    mkdirSync7(dirname8(absolute), { recursive: true });
-    writeFileSync6(absolute, file.body, "utf8");
-  }
-  const manifestAbsolute = resolve15(root, manifestPath);
-  mkdirSync7(dirname8(manifestAbsolute), { recursive: true });
-  writeFileSync6(manifestAbsolute, `${JSON.stringify(manifest, null, 2)}
-`, "utf8");
-  const removedPaths = [];
-  for (const file of currentFiles) {
-    if (targetPaths.has(file.path))
-      continue;
-    rmSync8(resolve15(root, file.path), { force: true });
-    removedPaths.push(file.path);
-  }
-  writeArchitectureProjectionFiles(root, projectedFiles);
-  return {
-    backup,
-    writtenPaths: projectedFiles.map((file) => file.path),
-    removedPaths
-  };
+function expectedFileHash(root, path) {
+  const absolute = resolve16(root, path);
+  return existsSync13(absolute) ? digestJson({ body: readFileSync12(absolute, "utf8") }) : "missing";
 }
 function architectureProjectionRollbackBackup(files, options = {}) {
   const manifest = {
@@ -24396,7 +24856,7 @@ function architectureProjectionRollbackBackup(files, options = {}) {
 function uniqueBackupPath(root, backupBase) {
   let candidate = backupBase;
   let suffix = 2;
-  while (existsSync12(resolve15(root, candidate))) {
+  while (existsSync13(resolve16(root, candidate))) {
     candidate = `${backupBase}-${suffix}`;
     suffix += 1;
   }
@@ -24405,7 +24865,7 @@ function uniqueBackupPath(root, backupBase) {
 function uniqueRuntimeBackupPath(backupBase) {
   let candidate = backupBase;
   let suffix = 2;
-  while (existsSync12(candidate)) {
+  while (existsSync13(candidate)) {
     candidate = backupBase.replace(/\.sqlite$/, `-${suffix}.sqlite`);
     suffix += 1;
   }
@@ -24450,12 +24910,12 @@ function isValidRuntimeRpcConnection(value) {
   return value.schemaVersion === RUNTIME_RPC_VERSION && value.protocol === "http-loopback" && value.version === 1 && typeof value.url === "string" && value.url.startsWith("http://127.0.0.1:") && typeof value.token === "string" && value.token.length > 0 && typeof value.pid === "number" && typeof value.connectionPath === "string" && typeof value.lockPath === "string";
 }
 function staleConnectionFileReason(path, removeUnhealthyConnection) {
-  if (!existsSync12(path))
+  if (!existsSync13(path))
     return;
   try {
     if (!isPrivateControlFile(path))
       return "insecure-connection-file";
-    const parsed = JSON.parse(readFileSync11(path, "utf8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf8"));
     if (!isValidRuntimeRpcConnection(parsed))
       return "invalid-connection-file";
     if (!isProcessAlive3(parsed.pid))
@@ -24473,7 +24933,7 @@ function isPrivateControlFile(path) {
 }
 function isStaleLock(lockPath) {
   try {
-    const lock = JSON.parse(readFileSync11(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync12(lockPath, "utf8"));
     if (typeof lock.pid !== "number" || lock.pid <= 0)
       return true;
     return !isProcessAlive3(lock.pid);
@@ -24512,7 +24972,7 @@ function parsePracticeCheckpointBaselineState(state, repositoryId, taskSessionId
   return record;
 }
 function completeTaskProjectionDrift(root) {
-  if (!existsSync12(resolve15(root, "docs/architecture/.projection-manifest.json")))
+  if (!existsSync13(resolve16(root, "docs/architecture/.projection-manifest.json")))
     return;
   const loaded = loadArchitectureDocumentationInputs(root);
   const sourceDigest = architectureDocumentationSourceDigest({
@@ -24788,10 +25248,10 @@ init_src();
 // packages/local-runtime/runtime-daemon/src/index.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { chmodSync as chmodSync4, closeSync as closeSync6, existsSync as existsSync13, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync5, openSync as openSync6, readdirSync as readdirSync9, readFileSync as readFileSync12, rmSync as rmSync9, statSync as statSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync4, closeSync as closeSync6, existsSync as existsSync14, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync5, openSync as openSync6, readdirSync as readdirSync9, readFileSync as readFileSync13, rmSync as rmSync9, statSync as statSync7, writeFileSync as writeFileSync7 } from "node:fs";
 import { createServer as createServer2 } from "node:http";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname9, join as join9, resolve as resolve16 } from "node:path";
+import { dirname as dirname10, join as join9, resolve as resolve17 } from "node:path";
 init_src();
 var RUNTIME_AGENT_HOOK_DEFAULT_MAX_QUEUED_JOBS2 = 32;
 var RUNTIME_AGENT_HOOK_DEFAULT_PRIORITY2 = 0;
@@ -24901,7 +25361,8 @@ class ArchitectureLedgerReadModelStore2 {
     return this.fallback.writeChangeSetPreview(changeSet);
   }
   async loadLedgerModel(workspace) {
-    const state = await this.localStore.readArchitectureLedgerState(architectureLedgerScopeForWorkspace2(workspace));
+    const scope = await this.localStore.resolveArchitectureLedgerScope(architectureLedgerScopeForWorkspace2(workspace));
+    const state = await this.localStore.readArchitectureLedgerState(scope);
     const projectedFiles = projectArchitectureLedgerStateToYamlFiles(state).map((file) => ({
       path: file.path,
       body: file.body,
@@ -24985,7 +25446,7 @@ class ArchctxDaemon2 {
     this.readModelStore = new ArchitectureLedgerReadModelStore2(this.modelStore, this.localStore, this.architectureLedger);
     this.changeSetEngine = deps.changeSetEngine ?? new ChangeSetEngine({
       modelStore: this.modelStore,
-      projection: { rebuildGeneratedProjection },
+      projection: { planGeneratedProjection },
       journal: this.localStore
     });
     this.devicePrivateKeySigner = deps.devicePrivateKeySigner;
@@ -25934,10 +26395,10 @@ class ArchctxDaemon2 {
       return errorEnvelope("practices.waive", "AC_SCHEMA_INVALID", error instanceof Error ? error.message : String(error));
     }
     const path = `.archcontext/waivers/${waiverId}.json`;
-    const absolute = resolve16(session.workspace.root, path);
+    const absolute = resolve17(session.workspace.root, path);
     const body = `${JSON.stringify(waiver, null, 2)}
 `;
-    const expectedHash = existsSync13(absolute) ? digestJson({ body: readFileSync12(absolute, "utf8") }) : "missing";
+    const expectedHash = existsSync14(absolute) ? digestJson({ body: readFileSync13(absolute, "utf8") }) : "missing";
     const draft = this.changeSetEngine.plan({
       id: input.id ?? `changeset.practice-waiver-${waiverId.replace(/[^A-Za-z0-9_-]/g, "-")}`,
       base: {
@@ -26276,6 +26737,16 @@ class ArchctxDaemon2 {
       const draft = this.changesets.get(input.id);
       if (!draft)
         throw new Error(`Unknown ChangeSet: ${input.id}`);
+      if (draft.base.headSha !== session.workspace.headSha)
+        throw new Error("ChangeSet HEAD changed before apply");
+      if (draft.base.worktreeDigest !== current)
+        throw new Error("ChangeSet worktree digest changed before apply");
+      const currentModel = await this.readModelStore.validateModel(session.workspace);
+      if (!currentModel.valid) {
+        throw new Error(`ChangeSet base model is invalid: ${currentModel.errors.join("; ") || "unknown validation error"}`);
+      }
+      if (draft.base.modelDigest !== currentModel.modelDigest)
+        throw new Error("ChangeSet model digest changed before apply");
       const approved = input.approved ? this.changeSetEngine.approve(draft) : draft;
       let ledgerAppend;
       const writesLedger = architectureLedgerWriteAppendsEvents2(this.architectureLedger.writeMode);
@@ -26292,6 +26763,7 @@ class ArchctxDaemon2 {
             relationCount: appended.relationCount,
             constraintCount: appended.constraintCount
           };
+          return { journalCommitted: Boolean(journalId) };
         } : undefined
       });
       return okEnvelope("apply_update", {
@@ -26325,14 +26797,72 @@ class ArchctxDaemon2 {
     });
     if (journalId)
       await this.localStore.recordChangeSetLedgerPlan(journalId, { event: plan.event });
-    const result = await this.localStore.appendArchitectureEvents({
-      writer: "runtime-daemon",
-      events: [plan.event]
-    });
-    if (journalId)
-      await this.localStore.recordChangeSetLedgerAppend(journalId, { result });
+    const appendInput = { writer: "runtime-daemon", events: [plan.event] };
+    const result = journalId ? await this.localStore.appendArchitectureEventsAndCommitChangeSet(journalId, appendInput) : await this.localStore.appendArchitectureEvents(appendInput);
     return result;
   }
+  async applyArchitectureProjectionChangeSet(root, input) {
+    const session = await this.openSession(root);
+    const model = await this.modelStore.validateModel(session.workspace);
+    if (!model.valid)
+      throw new Error(`Architecture projection ChangeSet base model is invalid: ${model.errors.join("; ")}`);
+    const projectionFiles = input.files.map((file) => ({
+      path: file.path,
+      body: file.body.endsWith(`
+`) ? file.body : `${file.body}
+`,
+      expectedHash: expectedFileHash2(root, file.path)
+    }));
+    const operations = [
+      ...projectionFiles.length > 0 ? [{ op: "render_projection", expectedHash: "missing", projectionFiles }] : [],
+      ...input.removedPaths.map((path) => ({
+        op: "delete_entity",
+        path,
+        expectedHash: expectedFileHash2(root, path)
+      }))
+    ];
+    const draft = this.changeSetEngine.approve(this.changeSetEngine.plan({
+      id: input.id,
+      base: {
+        headSha: session.workspace.headSha,
+        worktreeDigest: session.snapshot.worktreeDigest,
+        modelDigest: model.modelDigest
+      },
+      reason: { taskSessionId: input.id },
+      operations
+    }));
+    await this.changeSetEngine.apply(root, draft, { approved: true });
+  }
+  async applyArchitectureProjectionRollbackChangeSet(root, projectedFiles, currentFiles, createdAt) {
+    const targetPaths = new Set(projectedFiles.map((file) => file.path));
+    const backupBase = `.archcontext/backups/ledger-rollback/${safePathSegment2(createdAt)}`;
+    const backupRelativePath = uniqueBackupPath2(root, backupBase);
+    const manifestPath = `${backupRelativePath}/manifest.json`;
+    const { backup, manifest } = architectureProjectionRollbackBackup2(currentFiles, {
+      createdAt,
+      path: backupRelativePath,
+      manifestPath
+    });
+    const removedPaths = currentFiles.filter((file) => !targetPaths.has(file.path)).map((file) => file.path);
+    await this.applyArchitectureProjectionChangeSet(root, {
+      id: `changeset.ledger-rollback-${shortDigest4(digestJson({ createdAt, projectionDigest: architectureLedgerProjectionDigest(projectedFiles) }))}`,
+      files: [
+        ...currentFiles.map((file) => ({
+          path: join9(backupRelativePath, archContextRelativePath2(file.path)),
+          body: file.body
+        })),
+        { path: manifestPath, body: `${JSON.stringify(manifest, null, 2)}
+` },
+        ...projectedFiles.map(({ path, body }) => ({ path, body }))
+      ],
+      removedPaths
+    });
+    return {
+      backup,
+      writtenPaths: projectedFiles.map((file) => file.path),
+      removedPaths
+    };
+  }
   async ledgerState(root) {
     this.assertRunning();
     return okEnvelope("ledger.state", await this.architectureLedgerReadback(root));
@@ -26686,8 +27216,13 @@ class ArchctxDaemon2 {
       const scope = await this.architectureLedgerScope(root);
       const state = await this.localStore.readArchitectureLedgerState(scope);
       const projectedFiles = projectArchitectureLedgerStateToYamlFiles(state);
-      if (writes)
-        writeArchitectureProjectionFiles2(root, projectedFiles);
+      if (writes) {
+        await this.applyArchitectureProjectionChangeSet(root, {
+          id: `changeset.ledger-project-${shortDigest4(architectureLedgerProjectionDigest(projectedFiles))}`,
+          files: projectedFiles.map(({ path, body }) => ({ path, body })),
+          removedPaths: []
+        });
+      }
       const drift = compareArchitectureLedgerStateToYaml({
         state,
         files: listModelFiles(root),
@@ -26837,7 +27372,7 @@ class ArchctxDaemon2 {
       const projectedFiles = projectArchitectureLedgerStateToYamlFiles(state);
       const currentManagedFiles = listModelFiles(root).filter((file) => isArchitectureLedgerManagedModelPath2(file.path));
       const backupPlan = architectureProjectionRollbackBackup2(currentManagedFiles);
-      const writeResult = writes ? replaceArchitectureProjectionFilesForYamlRollback2(root, projectedFiles, currentManagedFiles, this.clock()) : { backup: backupPlan.backup, writtenPaths: [], removedPaths: [] };
+      const writeResult = writes ? await this.applyArchitectureProjectionRollbackChangeSet(root, projectedFiles, currentManagedFiles, this.clock()) : { backup: backupPlan.backup, writtenPaths: [], removedPaths: [] };
       const drift = compareArchitectureLedgerStateToYaml({
         state,
         files: listModelFiles(root),
@@ -26876,9 +27411,12 @@ class ArchctxDaemon2 {
       return errorEnvelope("ledger.rebuild", "AC_SCHEMA_INVALID", "ledger rebuild currently requires --from-git");
     return this.withWriter(async () => {
       this.assertFreshWorktree(root, input.expectedWorktreeDigest, "ledger rebuild --from-git");
-      const scope = await this.architectureLedgerScope(root);
+      const scope = await this.architectureLedgerGitScope(root);
       const files = listModelFiles(root);
-      const previousState = await this.localStore.readArchitectureLedgerState(scope);
+      const exactReplay = await this.localStore.replayArchitectureLedger(scope);
+      const exactScopeHasEvents = exactReplay.events.length > 0;
+      const authorityScope = exactScopeHasEvents ? scope : await this.localStore.resolveLatestArchitectureLedgerScope(scope);
+      const previousState = exactScopeHasEvents ? exactReplay.state : await this.localStore.readArchitectureLedgerState(authorityScope);
       const previousGraphDigest = architectureLedgerStateDigest(previousState);
       const rebuildCommand = input.acceptExternalProjection ? "archctx ledger rebuild --from-git --accept-external-projection" : "archctx ledger rebuild --from-git";
       const plan = planYamlToArchitectureLedgerRebuild({
@@ -26888,12 +27426,18 @@ class ArchctxDaemon2 {
         command: rebuildCommand,
         previousState
       });
+      const importPlan = planYamlToArchitectureLedgerImport({
+        ...scope,
+        files,
+        createdAt: this.clock(),
+        command: rebuildCommand
+      });
       if (plan.unsupportedFiles.length > 0) {
         return errorEnvelope("ledger.rebuild", "AC_SCHEMA_INVALID", "ledger rebuild requires supported YAML model files");
       }
       const cursor = architectureLedgerGitCursorFromPlan({ ...scope, plan });
       const previousCursor = await this.localStore.readArchitectureLedgerSourceCursor({
-        ...scope,
+        ...authorityScope,
         cursorId: ARCHITECTURE_LEDGER_GIT_CURSOR_ID
       });
       const cursorChanged = previousCursor?.cursorDigest !== cursor.cursorDigest;
@@ -26909,7 +27453,13 @@ class ArchctxDaemon2 {
       let rebuildStatus = "unchanged";
       let proposedExternalProjectionChange;
       if (previousGraphDigest === plan.graphDigest) {
-        if (cursorChanged) {
+        if (!exactScopeHasEvents) {
+          append = await this.localStore.appendArchitectureEvents({
+            writer: "runtime-daemon",
+            events: [importPlan.event]
+          });
+          rebuildStatus = isEmptyArchitectureLedgerState2(previousState) ? "rebuilt" : "cursor-refreshed";
+        } else if (cursorChanged) {
           const cursorPlan = planGitCursorRefreshToArchitectureLedgerEvent({
             ...scope,
             cursor,
@@ -26925,7 +27475,7 @@ class ArchctxDaemon2 {
         }
       } else if (!previousStateEmpty && !input.acceptExternalProjection) {
         const proposal = planExternalProjectionChangeToArchitectureLedgerEvent({
-          ...scope,
+          ...authorityScope,
           files,
           createdAt: this.clock(),
           command: rebuildCommand,
@@ -26948,11 +27498,12 @@ class ArchctxDaemon2 {
       } else {
         append = await this.localStore.appendArchitectureEvents({
           writer: "runtime-daemon",
-          events: [plan.event]
+          events: [exactScopeHasEvents ? plan.event : importPlan.event]
         });
         rebuildStatus = previousStateEmpty ? "rebuilt" : "external-projection-accepted";
       }
-      const replay = await this.localStore.rebuildArchitectureLedgerCurrentState(scope);
+      const replayScope = rebuildStatus === "external-projection-proposed" ? authorityScope : scope;
+      const replay = await this.localStore.rebuildArchitectureLedgerCurrentState(replayScope);
       const drift = compareArchitectureLedgerStateToYaml({
         state: replay.state,
         files: listModelFiles(root),
@@ -27098,6 +27649,9 @@ class ArchctxDaemon2 {
     return this.running ? this.architectureLedgerContextPort(root) : undefined;
   }
   async architectureLedgerScope(root) {
+    return this.localStore.resolveArchitectureLedgerScope(await this.architectureLedgerGitScope(root));
+  }
+  async architectureLedgerGitScope(root) {
     const session = await this.openSession(root);
     const paths = runtimeStatePaths2(root);
     return {
@@ -27160,7 +27714,7 @@ class ArchctxDaemon2 {
         cleanup: "remove-run-root"
       }
     };
-    if (existsSync13(paths.lockPath) || existsSync13(paths.manifestPath)) {
+    if (existsSync14(paths.lockPath) || existsSync14(paths.manifestPath)) {
       removePathWithRetry(paths.runRoot);
       throw new Error(`developer-review-run-already-active: ${input.challenge.challengeId}`);
     }
@@ -27217,7 +27771,7 @@ class ArchctxDaemon2 {
     const errors = [];
     if (run.worktree) {
       try {
-        const hadWorktree = existsSync13(run.worktree.worktreeRoot);
+        const hadWorktree = existsSync14(run.worktree.worktreeRoot);
         removeDetachedReviewWorktree(run.worktree);
         if (hadWorktree)
           removed.push("worktree");
@@ -27231,7 +27785,7 @@ class ArchctxDaemon2 {
       ["lock", run.lockPath]
     ]) {
       try {
-        const existed = existsSync13(path);
+        const existed = existsSync14(path);
         removePathWithRetry(path);
         if (existed)
           removed.push(kind);
@@ -27251,7 +27805,7 @@ class ArchctxDaemon2 {
   recoverDeveloperReviewRuns(input) {
     this.assertRunning();
     const sourceRoot = findRepositoryRoot2(input.repositoryRoot);
-    const stateDir = input.stateDir ? resolve16(input.stateDir) : defaultDeveloperReviewRunStateDir2(sourceRoot);
+    const stateDir = input.stateDir ? resolve17(input.stateDir) : defaultDeveloperReviewRunStateDir2(sourceRoot);
     const recovery = {
       schemaVersion: "archcontext.developer-review-run-recovery/v1",
       sourceRoot,
@@ -27260,7 +27814,7 @@ class ArchctxDaemon2 {
       removedLocks: [],
       skippedActive: []
     };
-    if (!existsSync13(stateDir))
+    if (!existsSync14(stateDir))
       return recovery;
     for (const entry of readdirSync9(stateDir).sort()) {
       if (!entry.endsWith(".json"))
@@ -27628,7 +28182,7 @@ class ArchctxDaemon2 {
   }
   async restoreRepositorySessions() {
     for (const record of await this.localStore.listRepositorySessions()) {
-      if (!record.root || !existsSync13(record.root))
+      if (!record.root || !existsSync14(record.root))
         continue;
       if (repositoryFingerprint2(record.root) !== record.repositoryId)
         continue;
@@ -28082,7 +28636,7 @@ function readRuntimeRpcConnection2(root = process.cwd()) {
   try {
     if (!isPrivateControlFile2(path))
       return;
-    const parsed = JSON.parse(readFileSync12(path, "utf8"));
+    const parsed = JSON.parse(readFileSync13(path, "utf8"));
     return isValidRuntimeRpcConnection2(parsed) ? parsed : undefined;
   } catch {
     return;
@@ -28345,8 +28899,8 @@ function schemaVersionKind2(schemaVersion) {
 function createDeveloperReviewRunPaths2(input) {
   const safeChallengeId = safeControlFileSegment2(input.challengeId);
   const runId = `${safeChallengeId}-${randomBytes2(6).toString("hex")}`;
-  const stateDir = input.stateDir ? resolve16(input.stateDir) : defaultDeveloperReviewRunStateDir2(input.sourceRoot);
-  const tempParent = input.tempRoot ? resolve16(input.tempRoot) : tmpdir4();
+  const stateDir = input.stateDir ? resolve17(input.stateDir) : defaultDeveloperReviewRunStateDir2(input.sourceRoot);
+  const tempParent = input.tempRoot ? resolve17(input.tempRoot) : tmpdir4();
   mkdirSync8(tempParent, { recursive: true });
   const runRoot = mkdtempSync5(join9(tempParent, `archctx-developer-review-${safeChallengeId.slice(0, 32)}-`));
   return {
@@ -28492,7 +29046,7 @@ function readExactPackageVersion2(root, packageName) {
   return;
 }
 function readPackageLockExactVersion2(root, packageName) {
-  const lock = readJsonFile2(resolve16(root, "package-lock.json"));
+  const lock = readJsonFile2(resolve17(root, "package-lock.json"));
   if (!lock || typeof lock !== "object" || Array.isArray(lock))
     return;
   const packages = lock.packages;
@@ -28510,7 +29064,7 @@ function readPackageLockExactVersion2(root, packageName) {
   return;
 }
 function packageManifestPaths2(root) {
-  const paths = [resolve16(root, "package.json")];
+  const paths = [resolve17(root, "package.json")];
   const rootManifest = readJsonFile2(paths[0]);
   for (const pattern of workspacePatternsFromManifest2(rootManifest)) {
     for (const path of expandWorkspacePackageJson2(root, pattern))
@@ -28533,15 +29087,15 @@ function expandWorkspacePackageJson2(root, pattern) {
   if (pattern.includes("**") || pattern.startsWith("/") || pattern.includes("\\"))
     return [];
   if (!pattern.includes("*")) {
-    const path = resolve16(root, pattern, "package.json");
-    return existsSync13(path) ? [path] : [];
+    const path = resolve17(root, pattern, "package.json");
+    return existsSync14(path) ? [path] : [];
   }
   if (!pattern.endsWith("/*"))
     return [];
-  const base = resolve16(root, pattern.slice(0, -2));
-  if (!existsSync13(base) || !statSync7(base).isDirectory())
+  const base = resolve17(root, pattern.slice(0, -2));
+  if (!existsSync14(base) || !statSync7(base).isDirectory())
     return [];
-  return readdirSync9(base, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => resolve16(base, entry.name, "package.json")).filter((path) => existsSync13(path));
+  return readdirSync9(base, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => resolve17(base, entry.name, "package.json")).filter((path) => existsSync14(path));
 }
 function exactVersionFromManifest2(manifest, packageName) {
   if (!manifest || typeof manifest !== "object" || Array.isArray(manifest))
@@ -28557,10 +29111,10 @@ function exactVersionFromManifest2(manifest, packageName) {
   return;
 }
 function readJsonFile2(path) {
-  if (!existsSync13(path))
+  if (!existsSync14(path))
     return;
   try {
-    return JSON.parse(readFileSync12(path, "utf8"));
+    return JSON.parse(readFileSync13(path, "utf8"));
   } catch {
     return;
   }
@@ -28569,15 +29123,15 @@ function isExactPackageVersion2(value) {
   return /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(value);
 }
 function readContext7Lockfile2(root) {
-  const path = resolve16(root, CONTEXT7_LOCKFILE2);
-  if (!existsSync13(path)) {
+  const path = resolve17(root, CONTEXT7_LOCKFILE2);
+  if (!existsSync14(path)) {
     return {
       schemaVersion: CONTEXT7_LOCKFILE_SCHEMA_VERSION,
       provider: "context7",
       libraries: []
     };
   }
-  const parsed = JSON.parse(readFileSync12(path, "utf8"));
+  const parsed = JSON.parse(readFileSync13(path, "utf8"));
   if (parsed.schemaVersion !== CONTEXT7_LOCKFILE_SCHEMA_VERSION || parsed.provider !== "context7" || !Array.isArray(parsed.libraries)) {
     throw new Error("Invalid Context7 lockfile");
   }
@@ -28598,13 +29152,13 @@ function upsertContext7Pin2(lock, pin) {
   };
 }
 function writeContext7Lockfile2(root, lock) {
-  writePrivateJson4(resolve16(root, CONTEXT7_LOCKFILE2), lock);
+  writePrivateJson4(resolve17(root, CONTEXT7_LOCKFILE2), lock);
 }
 function writeDeveloperReviewRunManifest2(manifest) {
   writePrivateJson4(manifest.manifestPath, manifest);
 }
 function writePrivateJson4(path, value, flag = "w") {
-  mkdirSync8(dirname9(path), { recursive: true });
+  mkdirSync8(dirname10(path), { recursive: true });
   writeFileSync7(path, JSON.stringify(value, null, 2), { mode: 384, flag });
   chmodSync4(path, 384);
 }
@@ -28628,7 +29182,7 @@ function readDeveloperReviewRunManifest2(path) {
 }
 function readJsonObject2(path) {
   try {
-    const parsed = JSON.parse(readFileSync12(path, "utf8"));
+    const parsed = JSON.parse(readFileSync13(path, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : undefined;
   } catch {
     return;
@@ -28799,48 +29353,9 @@ function auditApproveResultPayload2(runId, status, totalCount, issuedIssues) {
     issuedIssues
   };
 }
-function writeArchitectureProjectionFiles2(root, files) {
-  for (const file of files) {
-    const absolute = resolve16(root, file.path);
-    mkdirSync8(dirname9(absolute), { recursive: true });
-    writeFileSync7(absolute, file.body.endsWith(`
-`) ? file.body : `${file.body}
-`, "utf8");
-  }
-}
-function replaceArchitectureProjectionFilesForYamlRollback2(root, projectedFiles, currentFiles, createdAt) {
-  const targetPaths = new Set(projectedFiles.map((file) => file.path));
-  const backupBase = `.archcontext/backups/ledger-rollback/${safePathSegment2(createdAt)}`;
-  const backupRelativePath = uniqueBackupPath2(root, backupBase);
-  const manifestPath = `${backupRelativePath}/manifest.json`;
-  const { backup, manifest } = architectureProjectionRollbackBackup2(currentFiles, {
-    createdAt,
-    path: backupRelativePath,
-    manifestPath
-  });
-  for (const file of currentFiles) {
-    const backupPath = join9(backupRelativePath, archContextRelativePath2(file.path));
-    const absolute = resolve16(root, backupPath);
-    mkdirSync8(dirname9(absolute), { recursive: true });
-    writeFileSync7(absolute, file.body, "utf8");
-  }
-  const manifestAbsolute = resolve16(root, manifestPath);
-  mkdirSync8(dirname9(manifestAbsolute), { recursive: true });
-  writeFileSync7(manifestAbsolute, `${JSON.stringify(manifest, null, 2)}
-`, "utf8");
-  const removedPaths = [];
-  for (const file of currentFiles) {
-    if (targetPaths.has(file.path))
-      continue;
-    rmSync9(resolve16(root, file.path), { force: true });
-    removedPaths.push(file.path);
-  }
-  writeArchitectureProjectionFiles2(root, projectedFiles);
-  return {
-    backup,
-    writtenPaths: projectedFiles.map((file) => file.path),
-    removedPaths
-  };
+function expectedFileHash2(root, path) {
+  const absolute = resolve17(root, path);
+  return existsSync14(absolute) ? digestJson({ body: readFileSync13(absolute, "utf8") }) : "missing";
 }
 function architectureProjectionRollbackBackup2(files, options = {}) {
   const manifest = {
@@ -28867,7 +29382,7 @@ function architectureProjectionRollbackBackup2(files, options = {}) {
 function uniqueBackupPath2(root, backupBase) {
   let candidate = backupBase;
   let suffix = 2;
-  while (existsSync13(resolve16(root, candidate))) {
+  while (existsSync14(resolve17(root, candidate))) {
     candidate = `${backupBase}-${suffix}`;
     suffix += 1;
   }
@@ -28876,7 +29391,7 @@ function uniqueBackupPath2(root, backupBase) {
 function uniqueRuntimeBackupPath2(backupBase) {
   let candidate = backupBase;
   let suffix = 2;
-  while (existsSync13(candidate)) {
+  while (existsSync14(candidate)) {
     candidate = backupBase.replace(/\.sqlite$/, `-${suffix}.sqlite`);
     suffix += 1;
   }
@@ -28938,7 +29453,7 @@ function parsePracticeCheckpointBaselineState2(state, repositoryId, taskSessionI
   return record;
 }
 function completeTaskProjectionDrift2(root) {
-  if (!existsSync13(resolve16(root, "docs/architecture/.projection-manifest.json")))
+  if (!existsSync14(resolve17(root, "docs/architecture/.projection-manifest.json")))
     return;
   const loaded = loadArchitectureDocumentationInputs(root);
   const sourceDigest = architectureDocumentationSourceDigest({
@@ -29524,7 +30039,7 @@ async function runCliUnchecked(command2 = "help", args2 = [], cwd, deps = {}) {
         const subcommand = args2[0] ?? "list";
         if (subcommand === "add") {
           const root = readFlag(args2, "--root") ?? cwd;
-          if (resolve17(root) !== resolve17(cwd)) {
+          if (resolve18(root) !== resolve18(cwd)) {
             return errorEnvelope("repo.add", "AC_CAPABILITY_UNSUPPORTED", "Multi-repo architecture context is outside the Local Core MVP; run archctx inside one Git repository.");
           }
           const daemon2 = await runtime();
@@ -30197,37 +30712,10 @@ function buildArchitectureDocsProjection(root, generatedAt) {
     sourceDigest,
     generatedAt
   });
-  const manifestBody = `${JSON.stringify({
-    schemaVersion: "archcontext.architecture-docs-projection-manifest/v1",
-    rendererVersion: plan.rendererVersion,
-    sourceDigest: plan.sourceDigest,
-    projectionDigest: plan.projectionDigest,
-    targetCount: plan.targets.length,
-    fileCount: plan.files.length,
-    targets: plan.targets.map((target) => ({
-      targetId: target.targetId,
-      type: target.type,
-      scope: target.scope,
-      path: target.path,
-      ownership: target.ownership,
-      rendererVersion: target.rendererVersion,
-      format: target.format,
-      sourceDigest: target.sourceDigest,
-      outputDigest: target.outputDigest
-    }))
-  }, null, 2)}
-`;
-  const manifest = {
-    path: "docs/architecture/.projection-manifest.json",
-    body: manifestBody,
-    digest: digestJson({ path: "docs/architecture/.projection-manifest.json", body: manifestBody }),
-    target: plan.targets[0],
-    generatedBodyDigest: digestJson({ body: manifestBody })
-  };
   return {
     plan,
-    manifest,
-    files: [...plan.files, manifest]
+    manifest: plan.manifest,
+    files: [...plan.files, plan.manifest]
   };
 }
 function architectureDocsRenderProjectionOperation(root, files) {
@@ -30242,8 +30730,8 @@ function architectureDocsRenderProjectionOperation(root, files) {
   };
 }
 function currentBodyHash(root, path) {
-  const absolute = resolve17(root, path);
-  return existsSync14(absolute) ? digestJson({ body: readFileSync13(absolute, "utf8") }) : "missing";
+  const absolute = resolve18(root, path);
+  return existsSync15(absolute) ? digestJson({ body: readFileSync14(absolute, "utf8") }) : "missing";
 }
 async function runPracticesCommand(args2, cwd, daemon) {
   const subcommand = args2[0] ?? "list";
@@ -30590,12 +31078,12 @@ function auditManifestGateRoot(cwd) {
   }
 }
 function auditGithubIssuesEnabled(cwd) {
-  const manifestPath = resolve17(auditManifestGateRoot(cwd), ".archcontext/manifest.yaml");
-  if (!existsSync14(manifestPath))
+  const manifestPath = resolve18(auditManifestGateRoot(cwd), ".archcontext/manifest.yaml");
+  if (!existsSync15(manifestPath))
     return false;
   let raw;
   try {
-    raw = readFileSync13(manifestPath, "utf8");
+    raw = readFileSync14(manifestPath, "utf8");
   } catch {
     return false;
   }
@@ -31190,11 +31678,11 @@ async function digestReviewChallenge(challenge) {
 }
 function defaultGithubDeveloperReviewStatePath(cwd, pullRequestNumber) {
   const suffix = pullRequestNumber ? `github-developer-review-pr-${pullRequestNumber}.json` : "github-developer-review.json";
-  return join10(dirname10(defaultDaemonConnectionPath(cwd)), suffix);
+  return join10(dirname11(defaultDaemonConnectionPath(cwd)), suffix);
 }
 async function writeGithubDeveloperReviewState(cwd, state) {
   const path = defaultGithubDeveloperReviewStatePath(cwd, state.challenge.pullRequestNumber);
-  mkdirSync9(dirname10(path), { recursive: true });
+  mkdirSync9(dirname11(path), { recursive: true });
   const serialized = `${JSON.stringify(state, null, 2)}
 `;
   assertNoCliSecretMaterial(serialized);
@@ -31204,10 +31692,10 @@ async function writeGithubDeveloperReviewState(cwd, state) {
   return { state, path };
 }
 function readGithubDeveloperReviewState(path) {
-  if (!existsSync14(path))
+  if (!existsSync15(path))
     return;
   try {
-    const parsed = JSON.parse(readFileSync13(path, "utf8"));
+    const parsed = JSON.parse(readFileSync14(path, "utf8"));
     if (parsed.schemaVersion !== "archcontext.github-developer-review-state/v1")
       return;
     if (!parsed.challenge || typeof parsed.challenge.pullRequestNumber !== "number")
@@ -31253,13 +31741,13 @@ function sanitizeGithubDeveloperReviewState(state, statePath) {
   return data;
 }
 function defaultGithubConnectionPath(cwd) {
-  return join10(dirname10(defaultDaemonConnectionPath(cwd)), "github-connection.json");
+  return join10(dirname11(defaultDaemonConnectionPath(cwd)), "github-connection.json");
 }
 function readGithubConnection(path) {
-  if (!existsSync14(path))
+  if (!existsSync15(path))
     return;
   try {
-    const parsed = JSON.parse(readFileSync13(path, "utf8"));
+    const parsed = JSON.parse(readFileSync14(path, "utf8"));
     if (parsed.schemaVersion !== "archcontext.github-connection/v1" || parsed.status !== "connected")
       return;
     return parsed;
@@ -31268,7 +31756,7 @@ function readGithubConnection(path) {
   }
 }
 function writeGithubConnection(path, record) {
-  mkdirSync9(dirname10(path), { recursive: true });
+  mkdirSync9(dirname11(path), { recursive: true });
   const serialized = `${JSON.stringify(record, null, 2)}
 `;
   assertNoCliSecretMaterial(serialized);
@@ -31303,7 +31791,7 @@ async function readReviewChallengeV2Arg(args2, cwd, commandName = "github verify
   if (!inline && !challengePath)
     return { ok: false, message: `${commandName} requires --challenge-json or --challenge-path` };
   try {
-    const raw = inline ?? readFileSync13(resolve17(cwd, challengePath), "utf8");
+    const raw = inline ?? readFileSync14(resolve18(cwd, challengePath), "utf8");
     const parsed = JSON.parse(raw);
     const attestation = await Promise.resolve().then(() => (init_src7(), exports_src3));
     const assertReviewChallengeV23 = attestation.assertReviewChallengeV2;
@@ -31770,16 +32258,16 @@ function doctorSqlite(cwd) {
   const legacyLocalStore = inspectLegacyLocalStoreMigration(cwd);
   return {
     path,
-    exists: existsSync14(path),
+    exists: existsSync15(path),
     migrations: productVersionManifest().runtime.sqliteMigrations,
     legacyPath: paths.legacyLocalStorePath,
-    legacyExists: existsSync14(paths.legacyLocalStorePath),
+    legacyExists: existsSync15(paths.legacyLocalStorePath),
     legacyLocalStore
   };
 }
 function doctorPermissions(cwd) {
   const paths = runtimeStatePaths(cwd);
-  const controlDir = dirname10(defaultDaemonConnectionPath(cwd));
+  const controlDir = dirname11(defaultDaemonConnectionPath(cwd));
   return {
     workspace: pathAccess(cwd),
     stateRoot: pathAccess(paths.stateRoot),
@@ -31804,7 +32292,7 @@ function runtimePathsReport(cwd) {
   };
 }
 function pathAccess(path) {
-  const exists = existsSync14(path);
+  const exists = existsSync15(path);
   return {
     path,
     exists,
@@ -31815,7 +32303,7 @@ function pathAccess(path) {
 }
 function canAccess(path, mode) {
   try {
-    accessSync(path, mode);
+    accessSync2(path, mode);
     return true;
   } catch {
     return false;
@@ -32024,7 +32512,7 @@ async function startBackgroundDaemon(args2, cwd) {
   }
   const recovery = discovered.recovery;
   const connectionPath = defaultDaemonConnectionPath(cwd);
-  const controlDir = dirname10(connectionPath);
+  const controlDir = dirname11(connectionPath);
   const logPath = join10(controlDir, "archctxd.log");
   mkdirSync9(controlDir, { recursive: true });
   const logFd = openSync7(logPath, "a", 384);
@@ -32223,11 +32711,11 @@ async function waitForDaemonReady(cwd, timeoutMs, shouldStop) {
   return;
 }
 function sleep(ms) {
-  return new Promise((resolve18) => setTimeout(resolve18, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 function readFileTail(path, maxBytes = 4096) {
   try {
-    const content = readFileSync13(path, "utf8");
+    const content = readFileSync14(path, "utf8");
     return content.slice(Math.max(0, content.length - maxBytes)).replace(/\s+/g, " ").trim();
   } catch {
     return "<unavailable>";
@@ -32236,8 +32724,8 @@ function readFileTail(path, maxBytes = 4096) {
 async function runForegroundDaemon(cwd, args2) {
   const daemon = await createStartedProductionDaemon({ root: cwd });
   let resolveStopped;
-  const stopped = new Promise((resolve18) => {
-    resolveStopped = resolve18;
+  const stopped = new Promise((resolve19) => {
+    resolveStopped = resolve19;
   });
   const idleTimeoutFlag = readFlag(args2, "--idle-timeout-ms");
   const server = new ArchctxRuntimeRpcServer(daemon, {