archctx 0.4.6 → 0.4.8

package/bin/archctx.mjs

@@ -961,8 +961,123 @@ function projectionApplyReceiptInvariantIssues(input) {
   if (digestJson(input.result.applyReceipt) !== digestJson(input.identity)) {
     issues.push("projection apply receipt result must carry the same apply identity");
   }
+  if (input.recovery)
+    issues.push(...projectionApplyRecoveryBindingInvariantIssues(input.recovery, input));
   return issues;
 }
+function projectionApplyRecoveryBindingInvariantIssues(binding, receipt) {
+  const issues = [
+    ...sortedUniqueIssues("recovery.targets", binding.targets),
+    ...sortedUniqueIssues("recovery.changedPaths", binding.changedPaths)
+  ];
+  if (binding.schemaVersion !== PROJECTION_APPLY_RECOVERY_BINDING_SCHEMA_VERSION) {
+    issues.push("recovery schemaVersion is invalid");
+  }
+  if (binding.targets.length === 0)
+    issues.push("recovery targets must contain at least one projection target");
+  if (receipt) {
+    if (binding.receiptDigest !== receipt.result.receiptDigest) {
+      issues.push("recovery receiptDigest must match the committed result receiptDigest");
+    }
+    if (binding.originalExpectedSnapshot.repositoryId !== receipt.result.inputSnapshot.repositoryId || binding.originalExpectedSnapshot.workspaceId !== receipt.result.inputSnapshot.workspaceId || binding.originalExpectedSnapshot.headSha !== receipt.result.inputSnapshot.headSha || binding.originalExpectedSnapshot.worktreeDigest !== receipt.result.inputSnapshot.worktreeDigest) {
+      issues.push("recovery originalExpectedSnapshot must match the committed input snapshot");
+    }
+    if (binding.rendererVersion !== receipt.result.outputSnapshot.rendererVersion || binding.layoutVersion !== receipt.result.outputSnapshot.layoutVersion || digestJson(binding.generatedFrom) !== digestJson(receipt.result.outputSnapshot.generatedFrom)) {
+      issues.push("recovery renderer, layout, and CodeGraph provenance must match the committed output snapshot");
+    }
+    const expectedDigests = projectionApplyReceiptResultingDigests(receipt);
+    if (!expectedDigests || digestJson(binding.expectedResultingDigests) !== digestJson(expectedDigests)) {
+      issues.push("recovery expectedResultingDigests must match committed refresh signals");
+    }
+  }
+  return issues;
+}
+function projectionApplyRecoveryIntentInvariantIssues(input) {
+  const issues = [];
+  if (input.schemaVersion !== PROJECTION_APPLY_RECOVERY_INTENT_SCHEMA_VERSION)
+    issues.push("recovery intent schemaVersion is invalid");
+  if (!/^[a-zA-Z0-9_.:-]+$/.test(input.requestId))
+    issues.push("recovery intent requestId must use the stable identifier character set");
+  if (input.profile !== "repo-harness/v1")
+    issues.push("recovery intent profile is invalid");
+  for (const field of ["lookupKey", "applyId"]) {
+    if (!/^sha256:[a-f0-9]{64}$/.test(input.receipt[field]))
+      issues.push(`recovery intent receipt.${field} must be a SHA-256 digest`);
+  }
+  return issues;
+}
+function projectionApplyRecoveryProofDigest(input) {
+  return digestJson(input);
+}
+function projectionApplyRecoveryProofInvariantIssues(input) {
+  const issues = [
+    ...sortedUniqueIssues("acceptedChange.reasonCodes", input.acceptedChange.reasonCodes),
+    ...sortedUniqueIssues("acceptedChange.affectedNodeIds", input.acceptedChange.affectedNodeIds)
+  ];
+  if (input.schemaVersion !== PROJECTION_APPLY_RECOVERY_PROOF_SCHEMA_VERSION)
+    issues.push("recovery proof schemaVersion is invalid");
+  if (!/^[a-zA-Z0-9_.:-]+$/.test(input.requestId))
+    issues.push("recovery proof requestId must use the stable identifier character set");
+  if (input.current.snapshot.generatedFrom.codeGraphStatus !== "ready")
+    issues.push("recovery proof requires a ready current CodeGraph snapshot");
+  const { proofDigest: _proofDigest, deliveryStatus: _deliveryStatus, ...payload } = input;
+  if (projectionApplyRecoveryProofDigest(payload) !== input.proofDigest) {
+    issues.push("recovery proofDigest must bind the semantic proof payload");
+  }
+  return issues;
+}
+function projectionApplyRecoveryResultInvariantIssues(input) {
+  const issues = [
+    ...projectionApplyRecoveryProofInvariantIssues(input.proof),
+    ...input.refreshSignals.flatMap((signal, index) => architectureRefreshSignalInvariantIssues(signal, `refreshSignals[${index}]`)),
+    ...sortedUniqueIssues("refreshSignals.signalId", input.refreshSignals.map((signal) => signal.signalId))
+  ];
+  if (input.schemaVersion !== PROJECTION_APPLY_RECOVERY_RESULT_SCHEMA_VERSION) {
+    issues.push("recovery result schemaVersion is invalid");
+  }
+  if (input.proof.deliveryStatus === "already-delivered" && input.refreshSignals.length > 0) {
+    issues.push("already-delivered recovery result cannot repeat refreshSignals");
+  }
+  for (const [index, signal] of input.refreshSignals.entries()) {
+    const prefix = `refreshSignals[${index}]`;
+    if (signal.projectionReceiptDigest !== input.proof.receipt.receiptDigest) {
+      issues.push(`${prefix}.projectionReceiptDigest must match recovery proof receiptDigest`);
+    }
+    if (digestJson(signal.acceptedChange) !== digestJson(input.proof.acceptedChange)) {
+      issues.push(`${prefix}.acceptedChange must match recovery proof approval`);
+    }
+    if (digestJson(signal.resultingDigests) !== digestJson(input.proof.expectedResultingDigests)) {
+      issues.push(`${prefix}.resultingDigests must match recovery proof`);
+    }
+  }
+  return issues;
+}
+function projectionApplyRecoveryProofReceiptInvariantIssues(proof, receipt) {
+  const issues = [
+    ...projectionApplyRecoveryProofInvariantIssues(proof),
+    ...projectionApplyReceiptInvariantIssues(receipt)
+  ];
+  const binding = receipt.recovery;
+  if (!binding)
+    return [...issues, "committed projection receipt does not support semantic recovery"];
+  if (proof.receipt.lookupKey !== receipt.identity.lookupKey || proof.receipt.applyId !== receipt.identity.applyId || proof.receipt.receiptDigest !== receipt.result.receiptDigest) {
+    issues.push("recovery proof receipt identity must match the committed receipt");
+  }
+  if (digestJson(proof.acceptedChange) !== digestJson(receipt.identity.acceptedChange) || digestJson(proof.expectedResultingDigests) !== digestJson(binding.expectedResultingDigests)) {
+    issues.push("recovery proof approval binding must match the committed receipt");
+  }
+  if (digestJson(proof.current.resultingDigests) !== digestJson(binding.expectedResultingDigests) || proof.current.ownedOutputDigest !== binding.ownedOutputDigest || proof.current.snapshot.rendererVersion !== binding.rendererVersion || proof.current.snapshot.layoutVersion !== binding.layoutVersion || digestJson(proof.current.snapshot.generatedFrom) !== digestJson(binding.generatedFrom)) {
+    issues.push("recovery proof current state must match the committed recovery binding");
+  }
+  return issues;
+}
+function projectionApplyReceiptResultingDigests(receipt) {
+  const signals = receipt.result.refreshSignals;
+  if (signals.length === 0)
+    return;
+  const [first] = signals;
+  return signals.every((signal) => digestJson(signal.resultingDigests) === digestJson(first.resultingDigests)) ? first.resultingDigests : undefined;
+}
 function architectureRefreshSignalInvariantIssues(input, prefix = "signal") {
   const issues = [
     ...sortedUniqueIssues(`${prefix}.reasonCodes`, input.reasonCodes),
@@ -1006,7 +1121,7 @@ function sortedUniqueIssues(label, values) {
   const expected = [...new Set(values)].sort();
   return expected.length === values.length && expected.every((value, index) => value === values[index]) ? [] : [`${label} must be sorted and unique`];
 }
-var PROJECTION_REQUEST_SCHEMA_VERSION = "archcontext.projection-request/v1", PROJECTION_RESULT_SCHEMA_VERSION = "archcontext.projection-result/v2", PROJECTION_APPLY_IDENTITY_SCHEMA_VERSION = "archcontext.projection-apply-identity/v1", ARCHITECTURE_REFRESH_SIGNAL_SCHEMA_VERSION = "archcontext.architecture-refresh-signal/v1", ARCHCTX_CAPABILITIES_SCHEMA_VERSION = "archcontext.capabilities/v1", ARCHITECTURE_DOCS_RENDERER_VERSION = "archcontext.docs-renderer/v4", AGENT_CONTEXT_RENDERER_VERSION = "archcontext.agent-context-renderer/v1", PROJECTION_MODES, PROJECTION_TARGETS, ARCHITECTURE_MAJOR_CHANGE_REASON_CODES, ARCHCTX_FEATURES;
+var PROJECTION_REQUEST_SCHEMA_VERSION = "archcontext.projection-request/v1", PROJECTION_RESULT_SCHEMA_VERSION = "archcontext.projection-result/v2", PROJECTION_APPLY_IDENTITY_SCHEMA_VERSION = "archcontext.projection-apply-identity/v1", PROJECTION_APPLY_RECOVERY_BINDING_SCHEMA_VERSION = "archcontext.projection-apply-recovery-binding/v1", PROJECTION_APPLY_RECOVERY_INTENT_SCHEMA_VERSION = "archcontext.projection-apply-recovery-intent/v1", PROJECTION_APPLY_RECOVERY_PROOF_SCHEMA_VERSION = "archcontext.projection-apply-recovery-proof/v1", PROJECTION_APPLY_RECOVERY_RESULT_SCHEMA_VERSION = "archcontext.projection-apply-recovery-result/v1", ARCHITECTURE_REFRESH_SIGNAL_SCHEMA_VERSION = "archcontext.architecture-refresh-signal/v1", ARCHCTX_CAPABILITIES_SCHEMA_VERSION = "archcontext.capabilities/v1", ARCHITECTURE_DOCS_RENDERER_VERSION = "archcontext.docs-renderer/v4", AGENT_CONTEXT_RENDERER_VERSION = "archcontext.agent-context-renderer/v1", PROJECTION_MODES, PROJECTION_TARGETS, ARCHITECTURE_MAJOR_CHANGE_REASON_CODES, ARCHCTX_FEATURES;
 var init_projection = __esm(() => {
   init_schema();
   PROJECTION_MODES = ["check", "plan", "apply", "adopt"];
@@ -1030,6 +1145,7 @@ var init_projection = __esm(() => {
     "architecture-docs-renderer-v2",
     "architecture-refresh-signal-v1",
     "projection-apply-receipt-v1",
+    "projection-apply-recovery-v1",
     "projection-protocol-v2"
   ];
 });
@@ -1088,7 +1204,7 @@ function productVersionManifest() {
     }
   };
 }
-var ARCHCONTEXT_PRODUCT_NAME = "archctx", ARCHCONTEXT_PRODUCT_VERSION = "0.4.6", ARCHCONTEXT_PACKAGE_MANAGER = "bun@1.3.10", ARCHCONTEXT_NODE_RANGE = ">=24 <26", LOCAL_RUNTIME_RPC_SCHEMA_VERSION = "archcontext.runtime-rpc/v1", ARCHCONTEXT_SCHEMA_SET_VERSION = "2026-07-11.explorer-view-v2";
+var ARCHCONTEXT_PRODUCT_NAME = "archctx", ARCHCONTEXT_PRODUCT_VERSION = "0.4.8", ARCHCONTEXT_PACKAGE_MANAGER = "bun@1.4.0", ARCHCONTEXT_NODE_RANGE = ">=22.22 <26", LOCAL_RUNTIME_RPC_SCHEMA_VERSION = "archcontext.runtime-rpc/v1", ARCHCONTEXT_SCHEMA_SET_VERSION = "2026-07-11.explorer-view-v2";
 
 // packages/contracts/src/validator.ts
 function validateJsonSchema(schema, value) {
@@ -1837,7 +1953,7 @@ var init_src2 = __esm(() => {
 
 // node_modules/.bun/@colbymchenry+codegraph@1.5.0/node_modules/@colbymchenry/codegraph/npm-sdk.js
 var require_npm_sdk = __commonJS(function(exports, module) {
-  var __dirname = "/Users/ancienttwo/Projects/arch-context-wt-projection-proof-apply-reconcile/node_modules/.bun/@colbymchenry+codegraph@1.5.0/node_modules/@colbymchenry/codegraph";
+  var __dirname = "/Users/ancienttwo/Projects/arch-context-wt-release-048/node_modules/.bun/@colbymchenry+codegraph@1.5.0/node_modules/@colbymchenry/codegraph";
   var path = __require("path");
   var os = __require("os");
   var fs = __require("fs");
@@ -5623,7 +5739,7 @@ var init_src7 = __esm(() => {
 
 // packages/surfaces/cli/src/main.ts
 import { execFileSync as execFileSync8, spawn as spawn2, spawnSync as spawnSync3 } from "child_process";
-import { accessSync as accessSync3, chmodSync as chmodSync5, closeSync as closeSync8, constants, existsSync as existsSync17, mkdirSync as mkdirSync9, openSync as openSync8, readFileSync as readFileSync16, rmSync as rmSync10, statSync as statSync11, writeFileSync as writeFileSync8 } from "fs";
+import { accessSync as accessSync3, chmodSync as chmodSync6, closeSync as closeSync8, constants, existsSync as existsSync17, mkdirSync as mkdirSync9, openSync as openSync8, readFileSync as readFileSync16, rmSync as rmSync10, statSync as statSync11, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname11, join as join10, resolve as resolve19 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
@@ -8339,17 +8455,15 @@ function stickyArchitectureDocumentationProjectionProvenance(current, existingMa
     if (!prior)
       return current;
     assertArchitectureDocumentationProjectionProvenance(prior, current.rendererVersion);
-    return architectureDocumentationSemanticProvenanceDigest(prior) === architectureDocumentationSemanticProvenanceDigest(current) ? prior : current;
+    return architectureDocumentationStickyProvenanceDigest(prior) === architectureDocumentationStickyProvenanceDigest(current) ? prior : current;
   } catch {
     return current;
   }
 }
-function architectureDocumentationSemanticProvenanceDigest(provenance) {
+function architectureDocumentationStickyProvenanceDigest(provenance) {
   return digestJson({
     sourceTreeDigest: provenance.sourceTreeDigest,
     modelDigest: provenance.modelDigest,
-    codeGraphDigest: provenance.codeGraphDigest,
-    indexedWorktreeDigest: provenance.indexedWorktreeDigest,
     rendererVersion: provenance.rendererVersion,
     layoutVersion: provenance.layoutVersion,
     generatedFrom: provenance.generatedFrom
@@ -10397,13 +10511,21 @@ function diagnostics() {
   const egress = localEgressStatus();
   return {
     node: process.version,
-    supportedNode: /^v(24|25)\./.test(process.version),
+    supportedNode: isSupportedNodeVersion(process.version),
     codeGraphVersion: REQUIRED_CODEGRAPH_VERSION,
     privacyRouteDigest: controlPlaneRouteDigest(),
     secureDefaults: secureDefaults(),
     egress
   };
 }
+function isSupportedNodeVersion(version) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(version);
+  if (!match)
+    return false;
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  return major < 26 && (major > 22 || major === 22 && minor >= 22);
+}
 function secureDefaults() {
   return {
     tunnelEnabledByDefault: false,
@@ -10449,8 +10571,9 @@ function uninstallMarker(content, host) {
 function dependencyAudit(root) {
   const packageJson = JSON.parse(readFileSync6(resolve6(root, "package.json"), "utf8"));
   const issues = [];
-  if (!packageJson.engines?.node?.includes(">=24"))
-    issues.push("node engine must include >=24");
+  if (packageJson.engines?.node !== ARCHCONTEXT_NODE_RANGE) {
+    issues.push(`node engine must equal ${ARCHCONTEXT_NODE_RANGE}`);
+  }
   return { ok: issues.length === 0, issues };
 }
 function secretScan(root) {
@@ -13950,6 +14073,12 @@ var LOCAL_SQLITE_MIGRATIONS = [
       )`,
       "CREATE INDEX IF NOT EXISTS idx_projection_apply_receipts_journal ON projection_apply_receipts(journal_id)"
     ]
+  },
+  {
+    id: "0020_projection_apply_recovery_proof",
+    statements: [
+      "ALTER TABLE projection_apply_receipts ADD COLUMN recovery_proof_json TEXT"
+    ]
   }
 ];
 var ARCHCONTEXT_STATE_DIR_ENV = "ARCHCONTEXT_STATE_DIR";
@@ -14119,7 +14248,6 @@ function recoverRuntimeStateTarget(input) {
     ensurePrivateDir(stagingDir);
     assertRuntimeStateRecoveryPrivatePermissions(stagingDir, 448);
     migrateSqliteDatabaseSync(stagingPath);
-    compactSqliteDatabase(stagingPath);
     const stagingIntegrity = assertCurrentLocalStore(stagingPath);
     receiptPath = join2(quarantineDirectory, RUNTIME_STATE_RECOVERY_RECEIPT_FILE);
     writeRuntimeStateRecoveryReceipt(receiptPath, {
@@ -14248,7 +14376,6 @@ function migrateLegacyLocalStoreIfNeeded(root = process.cwd(), env = process.env
     integrityCheck.legacy = vacuumLegacySqliteInto(paths.legacyLocalStorePath, stagingPath);
     makePrivateFile(stagingPath);
     migrateSqliteDatabaseSync(stagingPath);
-    compactSqliteDatabase(stagingPath);
     integrityCheck.staging = assertCurrentLocalStore(stagingPath);
     publishStagedLocalStore(stagingPath, paths.localStorePath);
     integrityCheck.target = assertCurrentLocalStore(paths.localStorePath);
@@ -14269,10 +14396,17 @@ function migrateLegacyLocalStoreIfNeeded(root = process.cwd(), env = process.env
 function upgradeExistingLocalStoreTarget(paths, integrityCheck) {
   const lock = acquireLegacyMigrationLock(paths);
   try {
-    assertUpgradeableLocalStoreTarget(paths.localStorePath);
-    integrityCheck.target = assertSqliteIntegrity(paths.localStorePath);
-    migrateSqliteDatabaseSync(paths.localStorePath);
-    compactSqliteDatabase(paths.localStorePath);
+    const db = openSqliteDatabaseSync(paths.localStorePath);
+    let compacted = false;
+    try {
+      integrityCheck.target = assertUpgradeableLocalStoreTarget(db, paths.localStorePath);
+      migrateOpenedSqliteDatabase(db);
+      compacted = true;
+    } finally {
+      db.close();
+    }
+    if (compacted)
+      removeSqliteSidecars(paths.localStorePath);
     integrityCheck.target = assertCurrentLocalStore(paths.localStorePath);
     delete integrityCheck.error;
     const markerPath = writeLegacyMigrationMarker(paths, integrityCheck, []);
@@ -14900,30 +15034,41 @@ function readAppliedLocalSqliteMigrations(db) {
     return new Set;
   return new Set(db.prepare("SELECT id FROM schema_migrations").all().map((row) => String(row.id)));
 }
-function openSqliteDatabaseSync(databasePath) {
-  if (databasePath !== ":memory:")
-    ensurePrivateDir(dirname2(databasePath));
-  try {
-    const nodeSqlite = runtimeRequire("node:sqlite");
-    const db2 = new nodeSqlite.DatabaseSync(databasePath);
-    return {
-      exec: (sql) => db2.exec(sql),
-      prepare: (sql) => db2.prepare(sql),
-      close: () => db2.close()
-    };
-  } catch (error) {
-    if (error.code !== "ERR_UNKNOWN_BUILTIN_MODULE" && error.code !== "MODULE_NOT_FOUND") {
-      throw error;
-    }
-  }
-  const bunSqlite = runtimeRequire("bun:sqlite");
+function selectSqliteRuntime() {
+  if (process.versions.bun)
+    return "bun";
+  if (process.versions.node)
+    return "node";
+  throw new Error("Unsupported SQLite runtime: archctx requires the Bun or Node runtime, but neither process.versions.bun nor process.versions.node is set.");
+}
+function adaptBunSqliteDatabase(bunSqlite, databasePath) {
   const db = new bunSqlite.Database(databasePath);
+  const releaseStatements = () => db.clearQueryCache();
   return {
     exec: (sql) => db.exec(sql),
     prepare: (sql) => db.query(sql),
+    releaseStatements,
+    close: () => {
+      releaseStatements();
+      db.close();
+    }
+  };
+}
+function adaptNodeSqliteDatabase(nodeSqlite, databasePath) {
+  const db = new nodeSqlite.DatabaseSync(databasePath);
+  return {
+    exec: (sql) => db.exec(sql),
+    prepare: (sql) => db.prepare(sql),
     close: () => db.close()
   };
 }
+function openSqliteDatabaseSync(databasePath) {
+  if (databasePath !== ":memory:")
+    ensurePrivateDir(dirname2(databasePath));
+  if (selectSqliteRuntime() === "bun")
+    return adaptBunSqliteDatabase(runtimeRequire("bun:sqlite"), databasePath);
+  return adaptNodeSqliteDatabase(runtimeRequire("node:sqlite"), databasePath);
+}
 function legacyMigrationResult(migrated, skippedReason, paths, copiedFiles, details) {
   return {
     schemaVersion: "archcontext.legacy-local-store-migration/v1",
@@ -14970,7 +15115,6 @@ function runtimeStateRecoveryStartupProbe(paths, sourceFiles) {
       makePrivateFile(target);
     }
     migrateSqliteDatabaseSync(probePath);
-    compactSqliteDatabase(probePath);
     assertCurrentLocalStore(probePath);
     return { ok: true };
   } catch (error) {
@@ -15185,20 +15329,16 @@ function assertCurrentLocalStoreSchema(db, path) {
     throw new Error(`SQLite local store schema incomplete for ${path}: missing migrations ${missingMigrations.join(", ")}`);
   }
 }
-function assertUpgradeableLocalStoreTarget(path) {
-  const db = openSqliteDatabaseSync(path);
-  try {
-    const integrity = sqliteIntegrityCheckOpenDatabase(db, path);
-    const tables = new Set(db.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((row) => String(row.name)));
-    const hasArchContextMarker = ["schema_migrations", "task_states", "repository_sessions", "snapshots"].some((table) => tables.has(table));
-    if (!hasArchContextMarker) {
-      throw new Error(`SQLite target is not an ArchContext local store candidate: ${path}`);
-    }
-    if (integrity !== "ok")
-      throw new Error(`SQLite integrity_check failed for ${path}: ${integrity}`);
-  } finally {
-    db.close();
+function assertUpgradeableLocalStoreTarget(db, path) {
+  const integrity = sqliteIntegrityCheckOpenDatabase(db, path);
+  const tables = new Set(db.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((row) => String(row.name)));
+  const hasArchContextMarker = ["schema_migrations", "task_states", "repository_sessions", "snapshots"].some((table) => tables.has(table));
+  if (!hasArchContextMarker) {
+    throw new Error(`SQLite target is not an ArchContext local store candidate: ${path}`);
   }
+  if (integrity !== "ok")
+    throw new Error(`SQLite integrity_check failed for ${path}: ${integrity}`);
+  return integrity;
 }
 function assertTrustedLegacyLocalStoreSource(paths) {
   const stat = lstatSync2(paths.legacyLocalStorePath);
@@ -15227,23 +15367,29 @@ function vacuumLegacySqliteInto(sourcePath, targetPath) {
 }
 function migrateSqliteDatabaseSync(databasePath) {
   const db = openSqliteDatabaseSync(databasePath);
+  let compacted = false;
   try {
-    applyLocalSqliteMigrations(db);
-    backfillArchitectureEventDirectScope(db);
-    backfillArchitectureChangeFeed(db);
+    migrateOpenedSqliteDatabase(db);
+    compacted = true;
   } finally {
     db.close();
   }
+  if (compacted)
+    removeSqliteSidecars(databasePath);
 }
-function compactSqliteDatabase(databasePath) {
-  const db = openSqliteDatabaseSync(databasePath);
-  try {
-    db.exec("PRAGMA busy_timeout = 5000");
-    db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
-    db.exec("PRAGMA journal_mode = DELETE");
-  } finally {
-    db.close();
-  }
+function migrateOpenedSqliteDatabase(db) {
+  applyLocalSqliteMigrations(db);
+  backfillArchitectureEventDirectScope(db);
+  backfillArchitectureChangeFeed(db);
+  compactMigratedSqliteDatabase(db);
+}
+function compactMigratedSqliteDatabase(db) {
+  db.exec("PRAGMA busy_timeout = 5000");
+  db.releaseStatements?.();
+  db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+  db.exec("PRAGMA journal_mode = DELETE");
+}
+function removeSqliteSidecars(databasePath) {
   for (const suffix of ["-wal", "-shm"])
     rmSync(`${databasePath}${suffix}`, { force: true });
 }
@@ -15930,15 +16076,15 @@ function runCodeGraphCli2(binary, workspaceRoot, args) {
 // packages/local-runtime/runtime-daemon/src/index.ts
 import { randomBytes } from "node:crypto";
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { chmodSync as chmodSync3, closeSync as closeSync6, existsSync as existsSync15, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, openSync as openSync6, readdirSync as readdirSync9, readFileSync as readFileSync14, rmSync as rmSync8, statSync as statSync9, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync as chmodSync4, closeSync as closeSync6, existsSync as existsSync15, lstatSync as lstatSync7, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, openSync as openSync6, readdirSync as readdirSync9, readFileSync as readFileSync14, rmSync as rmSync8, statSync as statSync9, writeFileSync as writeFileSync6 } from "node:fs";
 import { createServer } from "node:http";
 import { tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname10, join as join9, resolve as resolve18 } from "node:path";
+import { basename as basename6, dirname as dirname10, join as join9, resolve as resolve18, sep as sep7 } from "node:path";
 
 // packages/core/changeset-engine/src/index.ts
 init_src();
-import { closeSync as closeSync4, existsSync as existsSync8, fsyncSync as fsyncSync2, lstatSync as lstatSync3, mkdirSync as mkdirSync3, openSync as openSync4, readFileSync as readFileSync9, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname5, resolve as resolve11 } from "node:path";
+import { chmodSync as chmodSync2, closeSync as closeSync4, existsSync as existsSync8, fsyncSync as fsyncSync2, lstatSync as lstatSync3, mkdirSync as mkdirSync3, openSync as openSync4, readFileSync as readFileSync9, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname5, isAbsolute as isAbsolute5, relative as relative6, resolve as resolve11, sep as sep4 } from "node:path";
 
 // packages/core/policy-engine/src/index.ts
 import { existsSync as existsSync7, realpathSync as realpathSync6 } from "node:fs";
@@ -16209,14 +16355,57 @@ function assertSafeTarget(root, path, scope) {
     throw new Error(`Refusing to write symlink target: ${path}`);
   }
 }
+function writeFileWithoutFollowingSymlinks(request) {
+  const absoluteRoot = resolve11(request.root);
+  const absolute = assertPathHasNoSymlinkSegments(request.root, request.path);
+  const segments = relative6(absoluteRoot, absolute).split(sep4);
+  if (existsSync8(absolute))
+    assertExpectedHash(absolute, request.expectedHash);
+  else if (request.expectedHash !== "missing")
+    throw new Error(`Expected missing file hash for new path: ${request.path}`);
+  mkdirSync3(dirname5(absolute), { recursive: true });
+  assertNoSymlinkSegments2(absoluteRoot, segments, request.path);
+  atomicWriteFile(absolute, `${absolute}.archctx-tmp-${process.pid}-${nextNoFollowWriteSequence()}`, request.body, request.mode);
+}
+function assertPathHasNoSymlinkSegments(root, path) {
+  const absoluteRoot = resolve11(root);
+  const absolute = resolve11(absoluteRoot, path);
+  const contained = relative6(absoluteRoot, absolute);
+  if (contained === "" || contained === ".." || contained.startsWith(`..${sep4}`) || isAbsolute5(contained)) {
+    throw new Error(`Path escapes repository: ${path}`);
+  }
+  assertNoSymlinkSegments2(absoluteRoot, contained.split(sep4), path);
+  return absolute;
+}
+var noFollowWriteSequence = 0;
+function nextNoFollowWriteSequence() {
+  noFollowWriteSequence += 1;
+  return noFollowWriteSequence;
+}
+function assertNoSymlinkSegments2(absoluteRoot, segments, displayPath) {
+  let current = absoluteRoot;
+  for (const segment of segments) {
+    current = resolve11(current, segment);
+    let stat;
+    try {
+      stat = lstatSync3(current);
+    } catch {
+      return;
+    }
+    if (stat.isSymbolicLink())
+      throw new Error(`Refusing to write through symlink: ${displayPath}`);
+  }
+}
 function assertExpectedHash(path, expectedHash) {
   const actual = digestJson({ body: readFileSync9(path, "utf8") });
   if (expectedHash !== actual)
     throw new Error(`Expected hash mismatch: ${path}`);
 }
-function atomicWriteFile(path, tempPath, body) {
+function atomicWriteFile(path, tempPath, body, mode) {
   mkdirSync3(dirname5(path), { recursive: true });
-  writeFileSync2(tempPath, body, "utf8");
+  writeFileSync2(tempPath, body, mode === undefined ? "utf8" : { encoding: "utf8", mode, flag: "wx" });
+  if (mode !== undefined)
+    chmodSync2(tempPath, mode);
   fsyncFile2(tempPath);
   renameSync2(tempPath, path);
   fsyncDirectory2(dirname5(path));
@@ -16502,7 +16691,7 @@ init_src();
 // packages/core/practice-catalog/src/index.ts
 init_src();
 import { existsSync as existsSync9, lstatSync as lstatSync4, readdirSync as readdirSync6, readFileSync as readFileSync10, realpathSync as realpathSync7 } from "node:fs";
-import { dirname as dirname6, relative as relative6, resolve as resolve12, sep as sep4 } from "node:path";
+import { dirname as dirname6, relative as relative7, resolve as resolve12, sep as sep5 } from "node:path";
 import { fileURLToPath } from "node:url";
 var PRACTICE_CATALOG_VERSION = "2026.06.0";
 var BUILTIN_PRACTICE_ASSETS_DIR = resolve12(dirname6(fileURLToPath(import.meta.url)), "../assets");
@@ -16754,7 +16943,7 @@ function loadRepoOverlayAssets(root, errors) {
     return [];
   const out = [];
   for (const path of listDataFiles(overlayRoot, overlayRoot, errors)) {
-    const relativePath = `.archcontext/practices/${relative6(overlayRoot, path).split(sep4).join("/")}`;
+    const relativePath = `.archcontext/practices/${relative7(overlayRoot, path).split(sep5).join("/")}`;
     try {
       assertRepoRelativePath(relativePath);
       assertRealChild(root, path);
@@ -17161,11 +17350,11 @@ function safeRealpath(path) {
   }
 }
 function isRealChild(rootReal, pathReal) {
-  const rel = relative6(rootReal, pathReal);
-  return rel === "" || !rel.startsWith("..") && !rel.includes(`..${sep4}`) && !resolve12(rel).startsWith("..");
+  const rel = relative7(rootReal, pathReal);
+  return rel === "" || !rel.startsWith("..") && !rel.includes(`..${sep5}`) && !resolve12(rel).startsWith("..");
 }
 function displayPath(path) {
-  return path.split(sep4).join("/");
+  return path.split(sep5).join("/");
 }
 function isRecord2(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -17727,7 +17916,7 @@ function checkResult(input, result) {
 // packages/core/practice-engine/src/enforcement.ts
 init_src();
 import { existsSync as existsSync10, lstatSync as lstatSync5, readdirSync as readdirSync7, readFileSync as readFileSync11 } from "node:fs";
-import { basename as basename5, join as join5, relative as relative7, resolve as resolve13, sep as sep5 } from "node:path";
+import { basename as basename5, join as join5, relative as relative8, resolve as resolve13, sep as sep6 } from "node:path";
 var ENFORCEMENT_RANK = { advisory: 0, checkpoint: 1, complete: 2 };
 var POLICY_MODES = new Set(["advisory", "active", "fail-open", "fail-closed"]);
 var DEFAULT_POLICY = {
@@ -18159,8 +18348,8 @@ function assertRepoPolicyFile(root, path, relativePath) {
     throw new Error(`practice-policy-symlink-denied: ${relativePath}`);
   const rootResolved = resolve13(root);
   const pathResolved = resolve13(path);
-  const rel = relative7(rootResolved, pathResolved);
-  if (rel === "" || rel.startsWith("..") || rel.includes(`..${sep5}`))
+  const rel = relative8(rootResolved, pathResolved);
+  if (rel === "" || rel.startsWith("..") || rel.includes(`..${sep6}`))
     throw new Error(`practice-policy-path-escape: ${relativePath}`);
   if (basename5(pathResolved).startsWith("."))
     throw new Error(`practice-policy-hidden-file-denied: ${relativePath}`);
@@ -18891,6 +19080,32 @@ function createInterventionProposal(input) {
 }
 
 // packages/core/context-compiler/src/index.ts
+var SELF_REFERENTIAL_CONTEXT_EXTENSION_KEYS = ["byteLength", "budgetExceeded", "digest"];
+function canonicalContextMeasurementForm(context) {
+  const extensions = { ...context.extensions };
+  for (const key of SELF_REFERENTIAL_CONTEXT_EXTENSION_KEYS)
+    delete extensions[key];
+  return { ...context, extensions };
+}
+function finalizeContextBudgetMetadata(context, maxBytes) {
+  const canonical = canonicalContextMeasurementForm(context);
+  const byteLength = Buffer.byteLength(JSON.stringify(canonical), "utf8");
+  const withMetadata = {
+    ...canonical,
+    extensions: {
+      ...canonical.extensions,
+      byteLength,
+      budgetExceeded: byteLength > maxBytes
+    }
+  };
+  return {
+    ...withMetadata,
+    extensions: {
+      ...withMetadata.extensions,
+      digest: digestJson(withMetadata)
+    }
+  };
+}
 async function compileTaskContext(input) {
   const model = await input.modelStore.validateModel(input.workspace);
   const ledgerReadback = await input.architectureLedger?.queryForTask({
@@ -19101,7 +19316,6 @@ async function compileLandscapeTaskContext(input) {
   });
 }
 function finalizeContext(context, digests) {
-  const byteLength = Buffer.byteLength(JSON.stringify(context), "utf8");
   const withMetadata = {
     ...context,
     extensions: {
@@ -19117,18 +19331,10 @@ function finalizeContext(context, digests) {
       codeFactsMode: digests.codeFactsMode,
       landscapeDigest: digests.landscapeDigest,
       activeRepositories: digests.activeRepositories,
-      crossRepoRelations: digests.crossRepoRelations,
-      byteLength,
-      budgetExceeded: byteLength > digests.maxBytes
-    }
-  };
-  return {
-    ...withMetadata,
-    extensions: {
-      ...withMetadata.extensions,
-      digest: digestJson(withMetadata)
+      crossRepoRelations: digests.crossRepoRelations
     }
   };
+  return finalizeContextBudgetMetadata(withMetadata, digests.maxBytes);
 }
 function trimPracticeGuidance(guidance, maxMatches) {
   const matches2 = guidance.matches.slice(0, maxMatches);
@@ -21770,6 +21976,7 @@ function clampInteger(value, min, max) {
 
 // packages/local-runtime/runtime-daemon/src/index.ts
 init_src();
+init_src();
 
 // packages/local-runtime/git-adapter/src/index.ts
 import { execFileSync as execFileSync5, spawnSync as spawnSync2 } from "node:child_process";
@@ -22058,11 +22265,11 @@ function isGitWorktreeError(error) {
 // packages/local-runtime/local-store-sqlite/src/index.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash9, randomUUID as randomUUID2 } from "node:crypto";
-import { chmodSync as chmodSync2, closeSync as closeSync5, copyFileSync as copyFileSync2, existsSync as existsSync13, fsyncSync as fsyncSync3, lstatSync as lstatSync6, mkdirSync as mkdirSync5, openSync as openSync5, readFileSync as readFileSync12, readSync as readSync4, realpathSync as realpathSync8, renameSync as renameSync3, rmSync as rmSync5, statfsSync as statfsSync2, statSync as statSync8, writeFileSync as writeFileSync3 } from "node:fs";
+import { chmodSync as chmodSync3, closeSync as closeSync5, copyFileSync as copyFileSync2, existsSync as existsSync13, fsyncSync as fsyncSync3, lstatSync as lstatSync6, mkdirSync as mkdirSync5, openSync as openSync5, readFileSync as readFileSync12, readSync as readSync4, realpathSync as realpathSync8, renameSync as renameSync3, rmSync as rmSync5, statfsSync as statfsSync2, statSync as statSync8, writeFileSync as writeFileSync3 } from "node:fs";
 import { readdir, readFile } from "node:fs/promises";
 import { createRequire as createRequire5 } from "node:module";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname8, isAbsolute as isAbsolute5, join as join7, relative as relative8, resolve as resolve16 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute6, join as join7, relative as relative9, resolve as resolve16 } from "node:path";
 init_src();
 var runtimeRequire2 = createRequire5(import.meta.url);
 var SQLITE_SIDECAR_SUFFIXES2 = ["", "-wal", "-shm"];
@@ -22878,6 +23085,12 @@ var LOCAL_SQLITE_MIGRATIONS2 = [
       )`,
       "CREATE INDEX IF NOT EXISTS idx_projection_apply_receipts_journal ON projection_apply_receipts(journal_id)"
     ]
+  },
+  {
+    id: "0020_projection_apply_recovery_proof",
+    statements: [
+      "ALTER TABLE projection_apply_receipts ADD COLUMN recovery_proof_json TEXT"
+    ]
   }
 ];
 var CHANGESET_STARTUP_CLEANUP_LIMIT = 100;
@@ -22975,7 +23188,6 @@ function migrateLegacyLocalStoreIfNeeded2(root = process.cwd(), env = process.en
     integrityCheck.legacy = vacuumLegacySqliteInto2(paths.legacyLocalStorePath, stagingPath);
     makePrivateFile2(stagingPath);
     migrateSqliteDatabaseSync2(stagingPath);
-    compactSqliteDatabase2(stagingPath);
     integrityCheck.staging = assertCurrentLocalStore2(stagingPath);
     publishStagedLocalStore2(stagingPath, paths.localStorePath);
     integrityCheck.target = assertCurrentLocalStore2(paths.localStorePath);
@@ -22996,10 +23208,17 @@ function migrateLegacyLocalStoreIfNeeded2(root = process.cwd(), env = process.en
 function upgradeExistingLocalStoreTarget2(paths, integrityCheck) {
   const lock = acquireLegacyMigrationLock2(paths);
   try {
-    assertUpgradeableLocalStoreTarget2(paths.localStorePath);
-    integrityCheck.target = assertSqliteIntegrity2(paths.localStorePath);
-    migrateSqliteDatabaseSync2(paths.localStorePath);
-    compactSqliteDatabase2(paths.localStorePath);
+    const db = openSqliteDatabaseSync2(paths.localStorePath);
+    let compacted = false;
+    try {
+      integrityCheck.target = assertUpgradeableLocalStoreTarget2(db, paths.localStorePath);
+      migrateOpenedSqliteDatabase2(db);
+      compacted = true;
+    } finally {
+      db.close();
+    }
+    if (compacted)
+      removeSqliteSidecars2(paths.localStorePath);
     integrityCheck.target = assertCurrentLocalStore2(paths.localStorePath);
     delete integrityCheck.error;
     const markerPath = writeLegacyMigrationMarker2(paths, integrityCheck, []);
@@ -23082,6 +23301,14 @@ class SqliteLocalStore {
       updatedAt: String(row.updated_at)
     }));
   }
+  async deleteRepositorySession(repositoryId) {
+    const db = await this.database();
+    const existing = db.prepare("SELECT repository_id FROM repository_sessions WHERE repository_id = ?").get(repositoryId);
+    if (!existing)
+      return false;
+    db.prepare("DELETE FROM repository_sessions WHERE repository_id = ?").run(repositoryId);
+    return true;
+  }
   async enqueueRuntimeAgentJob(input) {
     if (input.job.status !== "queued")
       throw new Error("runtime-agent-job-enqueue-requires-queued-status");
@@ -23192,7 +23419,7 @@ class SqliteLocalStore {
         maxAttempts,
         debounceUntil: input.debounceUntil
       });
-      const inserted = runtimeAgentJobById(db, input.job.jobId);
+      const inserted = runtimeAgentJobInScope(db, runtimeAgentJobScope(input.job), input.job.jobId);
       if (!inserted)
         throw new Error(`runtime-agent-job-insert-failed: ${input.job.jobId}`);
       const backpressure = maxQueuedJobs === undefined ? undefined : {
@@ -23276,21 +23503,15 @@ class SqliteLocalStore {
       const nextAttempt = record2.attemptCount + 1;
       if (nextAttempt > record2.maxAttempts) {
         const failed = runtimeAgentJobWithPatch(record2.job, { status: "failed", updatedAt: input.now });
-        db.prepare(`UPDATE runtime_job_queue
-            SET status = ?, job_json = ?, updated_at = ?, attempt_count = ?, lease_owner = NULL,
-              leased_at = NULL, lease_expires_at = NULL, last_error = ?, dead_lettered_at = ?
-            WHERE job_id = ?`).run("failed", stableJson2(failed), input.now, nextAttempt, "max-attempts-exhausted", input.now, record2.job.jobId);
+        updateRuntimeAgentJobInScope(db, input, record2.job.jobId, `status = ?, job_json = ?, updated_at = ?, attempt_count = ?, lease_owner = NULL,
+            leased_at = NULL, lease_expires_at = NULL, last_error = ?, dead_lettered_at = ?`, ["failed", stableJson2(failed), input.now, nextAttempt, "max-attempts-exhausted", input.now]);
         db.exec("COMMIT");
         return;
       }
       const running = runtimeAgentJobWithPatch(record2.job, { status: "running", updatedAt: input.now });
-      db.prepare(`UPDATE runtime_job_queue
-          SET status = ?, job_json = ?, updated_at = ?, attempt_count = ?, lease_owner = ?,
-            leased_at = ?, lease_expires_at = ?, last_error = NULL
-          WHERE job_id = ?`).run("running", stableJson2(running), input.now, nextAttempt, input.workerId, input.now, leaseExpiresAt, record2.job.jobId);
-      const claimed = runtimeAgentJobById(db, record2.job.jobId);
-      if (!claimed)
-        throw new Error(`runtime-agent-job-not-found: ${record2.job.jobId}`);
+      updateRuntimeAgentJobInScope(db, input, record2.job.jobId, `status = ?, job_json = ?, updated_at = ?, attempt_count = ?, lease_owner = ?,
+          leased_at = ?, lease_expires_at = ?, last_error = NULL`, ["running", stableJson2(running), input.now, nextAttempt, input.workerId, input.now, leaseExpiresAt]);
+      const claimed = requireRuntimeAgentJobInScope(db, input, record2.job.jobId);
       db.exec("COMMIT");
       return claimed;
     } catch (error) {
@@ -23300,9 +23521,7 @@ class SqliteLocalStore {
   }
   async completeRuntimeAgentJob(input) {
     const db = await this.database();
-    const record2 = runtimeAgentJobById(db, input.jobId);
-    if (!record2)
-      throw new Error(`runtime-agent-job-not-found: ${input.jobId}`);
+    const record2 = requireRuntimeAgentJobInScope(db, input, input.jobId);
     if (record2.job.status !== "running")
       throw new Error(`runtime-agent-job-complete-requires-running: ${input.jobId}`);
     if (input.workerId && record2.leaseOwner && record2.leaseOwner !== input.workerId) {
@@ -23315,52 +23534,31 @@ class SqliteLocalStore {
       outputDigest: input.outputDigest,
       runMetadata: input.runMetadata
     });
-    db.prepare(`UPDATE runtime_job_queue
-        SET status = ?, job_json = ?, updated_at = ?, output_digest = ?, lease_owner = NULL,
-          leased_at = NULL, lease_expires_at = NULL, last_error = ?, dead_lettered_at = COALESCE(?, dead_lettered_at)
-        WHERE job_id = ?`).run(input.status, stableJson2(job), input.now, input.outputDigest ?? record2.job.outputDigest ?? null, input.error ?? null, deadLetteredAt ?? null, input.jobId);
-    const updated = runtimeAgentJobById(db, input.jobId);
-    if (!updated)
-      throw new Error(`runtime-agent-job-not-found: ${input.jobId}`);
-    return updated;
+    updateRuntimeAgentJobInScope(db, input, input.jobId, `status = ?, job_json = ?, updated_at = ?, output_digest = ?, lease_owner = NULL,
+        leased_at = NULL, lease_expires_at = NULL, last_error = ?, dead_lettered_at = COALESCE(?, dead_lettered_at)`, [input.status, stableJson2(job), input.now, input.outputDigest ?? record2.job.outputDigest ?? null, input.error ?? null, deadLetteredAt ?? null]);
+    return requireRuntimeAgentJobInScope(db, input, input.jobId);
   }
   async retryRuntimeAgentJob(input) {
     const db = await this.database();
-    const record2 = runtimeAgentJobById(db, input.jobId);
-    if (!record2)
-      throw new Error(`runtime-agent-job-not-found: ${input.jobId}`);
+    const record2 = requireRuntimeAgentJobInScope(db, input, input.jobId);
     if (record2.attemptCount >= record2.maxAttempts) {
       const failed = runtimeAgentJobWithPatch(record2.job, { status: "failed", updatedAt: input.now });
-      db.prepare(`UPDATE runtime_job_queue
-          SET status = ?, job_json = ?, updated_at = ?, lease_owner = NULL,
-            leased_at = NULL, lease_expires_at = NULL, last_error = ?, dead_lettered_at = ?
-          WHERE job_id = ?`).run("failed", stableJson2(failed), input.now, input.reason ?? "max-attempts-exhausted", input.now, input.jobId);
+      updateRuntimeAgentJobInScope(db, input, input.jobId, `status = ?, job_json = ?, updated_at = ?, lease_owner = NULL,
+          leased_at = NULL, lease_expires_at = NULL, last_error = ?, dead_lettered_at = ?`, ["failed", stableJson2(failed), input.now, input.reason ?? "max-attempts-exhausted", input.now]);
     } else {
       const queued = runtimeAgentJobWithPatch(record2.job, { status: "queued", updatedAt: input.now });
-      db.prepare(`UPDATE runtime_job_queue
-          SET status = ?, job_json = ?, updated_at = ?, lease_owner = NULL,
-            leased_at = NULL, lease_expires_at = NULL, last_error = ?, dead_lettered_at = NULL
-          WHERE job_id = ?`).run("queued", stableJson2(queued), input.now, input.reason ?? null, input.jobId);
-    }
-    const updated = runtimeAgentJobById(db, input.jobId);
-    if (!updated)
-      throw new Error(`runtime-agent-job-not-found: ${input.jobId}`);
-    return updated;
+      updateRuntimeAgentJobInScope(db, input, input.jobId, `status = ?, job_json = ?, updated_at = ?, lease_owner = NULL,
+          leased_at = NULL, lease_expires_at = NULL, last_error = ?, dead_lettered_at = NULL`, ["queued", stableJson2(queued), input.now, input.reason ?? null]);
+    }
+    return requireRuntimeAgentJobInScope(db, input, input.jobId);
   }
   async cancelRuntimeAgentJob(input) {
     const db = await this.database();
-    const record2 = runtimeAgentJobById(db, input.jobId);
-    if (!record2)
-      throw new Error(`runtime-agent-job-not-found: ${input.jobId}`);
+    const record2 = requireRuntimeAgentJobInScope(db, input, input.jobId);
     const job = runtimeAgentJobWithPatch(record2.job, { status: input.status, updatedAt: input.now });
-    db.prepare(`UPDATE runtime_job_queue
-        SET status = ?, job_json = ?, updated_at = ?, lease_owner = NULL,
-          leased_at = NULL, lease_expires_at = NULL, last_error = ?, superseded_by_job_id = COALESCE(?, superseded_by_job_id)
-        WHERE job_id = ?`).run(input.status, stableJson2(job), input.now, input.reason ?? null, input.supersededByJobId ?? null, input.jobId);
-    const updated = runtimeAgentJobById(db, input.jobId);
-    if (!updated)
-      throw new Error(`runtime-agent-job-not-found: ${input.jobId}`);
-    return updated;
+    updateRuntimeAgentJobInScope(db, input, input.jobId, `status = ?, job_json = ?, updated_at = ?, lease_owner = NULL,
+        leased_at = NULL, lease_expires_at = NULL, last_error = ?, superseded_by_job_id = COALESCE(?, superseded_by_job_id)`, [input.status, stableJson2(job), input.now, input.reason ?? null, input.supersededByJobId ?? null]);
+    return requireRuntimeAgentJobInScope(db, input, input.jobId);
   }
   async cancelStaleRuntimeAgentJobs(input) {
     const db = await this.database();
@@ -23373,6 +23571,8 @@ class SqliteLocalStore {
     const cancelled = [];
     for (const record2 of staleRows) {
       cancelled.push(await this.cancelRuntimeAgentJob({
+        repository: input.repository,
+        worktree: input.worktree,
         jobId: record2.job.jobId,
         status: "expired",
         now: input.now,
@@ -23434,29 +23634,58 @@ class SqliteLocalStore {
         (lookup_key, apply_id, journal_id, receipt_json, created_at, updated_at)
         VALUES (?, ?, ?, ?, ?, ?)`).run(receipt.identity.lookupKey, receipt.identity.applyId, journalId, stableJson2(receipt), createdAt, createdAt);
   }
-  async consumeProjectionApplyReceipt(lookupKey) {
+  async inspectProjectionApplyReceipt(lookupKey) {
+    const db = await this.database();
+    const row = db.prepare(`SELECT receipt.receipt_json, receipt.refresh_consumed_at, receipt.recovery_proof_json
+        FROM projection_apply_receipts receipt
+        JOIN changeset_journal journal ON journal.journal_id = receipt.journal_id
+        WHERE receipt.lookup_key = ? AND journal.status = 'committed'`).get(lookupKey);
+    if (!row?.receipt_json)
+      return;
+    const receipt = parseProjectionApplyReceipt(String(row.receipt_json));
+    const recoveryProof = row.recovery_proof_json === null ? undefined : parseProjectionApplyRecoveryProof(String(row.recovery_proof_json), receipt);
+    return {
+      receipt,
+      deliveryStatus: row.refresh_consumed_at === null ? "pending" : "delivered",
+      ...recoveryProof ? { recoveryProof } : {}
+    };
+  }
+  async consumeProjectionApplyReceiptRecovery(proof) {
     const db = await this.database();
     db.exec("BEGIN IMMEDIATE");
     try {
-      const row = db.prepare(`SELECT receipt.receipt_json, receipt.refresh_consumed_at
+      const row = db.prepare(`SELECT receipt.receipt_json, receipt.refresh_consumed_at, receipt.recovery_proof_json
           FROM projection_apply_receipts receipt
           JOIN changeset_journal journal ON journal.journal_id = receipt.journal_id
-          WHERE receipt.lookup_key = ? AND journal.status = 'committed'`).get(lookupKey);
+          WHERE receipt.lookup_key = ? AND journal.status = 'committed'`).get(proof.receipt.lookupKey);
       if (!row?.receipt_json) {
         db.exec("COMMIT");
         return;
       }
-      const receipt = JSON.parse(String(row.receipt_json));
-      const issues = projectionApplyReceiptInvariantIssues(receipt);
-      if (issues.length > 0)
-        throw new Error(`projection-apply-receipt-invalid: ${issues.join("; ")}`);
-      const refreshSignalsDelivered = row.refresh_consumed_at === null;
-      if (refreshSignalsDelivered) {
-        const consumedAt = nowIso2();
-        db.prepare("UPDATE projection_apply_receipts SET refresh_consumed_at = ?, updated_at = ? WHERE lookup_key = ? AND refresh_consumed_at IS NULL").run(consumedAt, consumedAt, lookupKey);
+      const receipt = parseProjectionApplyReceipt(String(row.receipt_json));
+      const proofIssues = projectionApplyRecoveryProofReceiptInvariantIssues(proof, receipt);
+      if (proofIssues.length > 0)
+        throw new Error(`projection-apply-recovery-proof-invalid: ${proofIssues.join("; ")}`);
+      if (row.refresh_consumed_at !== null) {
+        const stored = row.recovery_proof_json === null ? undefined : parseProjectionApplyRecoveryProof(String(row.recovery_proof_json), receipt);
+        if (!stored)
+          throw new Error("projection-apply-receipt-delivered-without-recovery-proof");
+        db.exec("COMMIT");
+        return {
+          receipt,
+          proof: { ...stored, deliveryStatus: "already-delivered" },
+          refreshSignalsDelivered: false
+        };
       }
+      const deliveredProof = { ...proof, deliveryStatus: "delivered" };
+      const updatedAt = nowIso2();
+      const update = db.prepare(`UPDATE projection_apply_receipts
+         SET refresh_consumed_at = ?, recovery_proof_json = ?, updated_at = ?
+         WHERE lookup_key = ? AND apply_id = ? AND refresh_consumed_at IS NULL AND recovery_proof_json IS NULL`).run(updatedAt, stableJson2(deliveredProof), updatedAt, proof.receipt.lookupKey, proof.receipt.applyId);
+      if (update.changes !== 1)
+        throw new Error("projection-apply-recovery-consume-race");
       db.exec("COMMIT");
-      return { receipt, refreshSignalsDelivered };
+      return { receipt, proof: deliveredProof, refreshSignalsDelivered: true };
     } catch (error) {
       db.exec("ROLLBACK");
       throw error;
@@ -26527,51 +26756,48 @@ async function rebuildDerivedLandscapeState(store, input) {
     digest: landscapeDigest(landscape, scopedRelations)
   };
 }
-async function openSqliteDatabase(databasePath) {
-  if (databasePath !== ":memory:")
-    ensurePrivateDir2(dirname8(databasePath));
-  try {
-    const nodeSqlite = await import("node:sqlite");
-    const db = new nodeSqlite.DatabaseSync(databasePath);
-    return {
-      exec: (sql) => db.exec(sql),
-      prepare: (sql) => db.prepare(sql),
-      close: () => db.close()
-    };
-  } catch {
-    const bunSqlite = await import("bun:sqlite");
-    const db = new bunSqlite.Database(databasePath);
-    return {
-      exec: (sql) => db.exec(sql),
-      prepare: (sql) => db.query(sql),
-      close: () => db.close()
-    };
-  }
+function selectSqliteRuntime2() {
+  if (process.versions.bun)
+    return "bun";
+  if (process.versions.node)
+    return "node";
+  throw new Error("Unsupported SQLite runtime: archctx requires the Bun or Node runtime, but neither process.versions.bun nor process.versions.node is set.");
 }
-function openSqliteDatabaseSync2(databasePath) {
-  if (databasePath !== ":memory:")
-    ensurePrivateDir2(dirname8(databasePath));
-  try {
-    const nodeSqlite = runtimeRequire2("node:sqlite");
-    const db2 = new nodeSqlite.DatabaseSync(databasePath);
-    return {
-      exec: (sql) => db2.exec(sql),
-      prepare: (sql) => db2.prepare(sql),
-      close: () => db2.close()
-    };
-  } catch (error) {
-    if (error.code !== "ERR_UNKNOWN_BUILTIN_MODULE" && error.code !== "MODULE_NOT_FOUND") {
-      throw error;
-    }
-  }
-  const bunSqlite = runtimeRequire2("bun:sqlite");
+function adaptBunSqliteDatabase2(bunSqlite, databasePath) {
   const db = new bunSqlite.Database(databasePath);
+  const releaseStatements = () => db.clearQueryCache();
   return {
     exec: (sql) => db.exec(sql),
     prepare: (sql) => db.query(sql),
+    releaseStatements,
+    close: () => {
+      releaseStatements();
+      db.close();
+    }
+  };
+}
+function adaptNodeSqliteDatabase2(nodeSqlite, databasePath) {
+  const db = new nodeSqlite.DatabaseSync(databasePath);
+  return {
+    exec: (sql) => db.exec(sql),
+    prepare: (sql) => db.prepare(sql),
     close: () => db.close()
   };
 }
+async function openSqliteDatabase(databasePath) {
+  if (databasePath !== ":memory:")
+    ensurePrivateDir2(dirname8(databasePath));
+  if (selectSqliteRuntime2() === "bun")
+    return adaptBunSqliteDatabase2(await import("bun:sqlite"), databasePath);
+  return adaptNodeSqliteDatabase2(await import("node:sqlite"), databasePath);
+}
+function openSqliteDatabaseSync2(databasePath) {
+  if (databasePath !== ":memory:")
+    ensurePrivateDir2(dirname8(databasePath));
+  if (selectSqliteRuntime2() === "bun")
+    return adaptBunSqliteDatabase2(runtimeRequire2("bun:sqlite"), databasePath);
+  return adaptNodeSqliteDatabase2(runtimeRequire2("node:sqlite"), databasePath);
+}
 function legacyMigrationResult2(migrated, skippedReason, paths, copiedFiles, details) {
   return {
     schemaVersion: "archcontext.legacy-local-store-migration/v1",
@@ -26623,20 +26849,16 @@ function assertCurrentLocalStoreSchema2(db, path) {
     throw new Error(`SQLite local store schema incomplete for ${path}: missing migrations ${missingMigrations.join(", ")}`);
   }
 }
-function assertUpgradeableLocalStoreTarget2(path) {
-  const db = openSqliteDatabaseSync2(path);
-  try {
-    const integrity = sqliteIntegrityCheckOpenDatabase2(db, path);
-    const tables = new Set(db.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((row) => String(row.name)));
-    const hasArchContextMarker = ["schema_migrations", "task_states", "repository_sessions", "snapshots"].some((table) => tables.has(table));
-    if (!hasArchContextMarker) {
-      throw new Error(`SQLite target is not an ArchContext local store candidate: ${path}`);
-    }
-    if (integrity !== "ok")
-      throw new Error(`SQLite integrity_check failed for ${path}: ${integrity}`);
-  } finally {
-    db.close();
+function assertUpgradeableLocalStoreTarget2(db, path) {
+  const integrity = sqliteIntegrityCheckOpenDatabase2(db, path);
+  const tables = new Set(db.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((row) => String(row.name)));
+  const hasArchContextMarker = ["schema_migrations", "task_states", "repository_sessions", "snapshots"].some((table) => tables.has(table));
+  if (!hasArchContextMarker) {
+    throw new Error(`SQLite target is not an ArchContext local store candidate: ${path}`);
   }
+  if (integrity !== "ok")
+    throw new Error(`SQLite integrity_check failed for ${path}: ${integrity}`);
+  return integrity;
 }
 function assertTrustedLegacyLocalStoreSource2(paths) {
   const stat = lstatSync6(paths.legacyLocalStorePath);
@@ -26665,23 +26887,29 @@ function vacuumLegacySqliteInto2(sourcePath, targetPath) {
 }
 function migrateSqliteDatabaseSync2(databasePath) {
   const db = openSqliteDatabaseSync2(databasePath);
+  let compacted = false;
   try {
-    applyLocalSqliteMigrations2(db);
-    backfillArchitectureEventDirectScope2(db);
-    backfillArchitectureChangeFeed2(db);
+    migrateOpenedSqliteDatabase2(db);
+    compacted = true;
   } finally {
     db.close();
   }
+  if (compacted)
+    removeSqliteSidecars2(databasePath);
 }
-function compactSqliteDatabase2(databasePath) {
-  const db = openSqliteDatabaseSync2(databasePath);
-  try {
-    db.exec("PRAGMA busy_timeout = 5000");
-    db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
-    db.exec("PRAGMA journal_mode = DELETE");
-  } finally {
-    db.close();
-  }
+function migrateOpenedSqliteDatabase2(db) {
+  applyLocalSqliteMigrations2(db);
+  backfillArchitectureEventDirectScope2(db);
+  backfillArchitectureChangeFeed2(db);
+  compactMigratedSqliteDatabase2(db);
+}
+function compactMigratedSqliteDatabase2(db) {
+  db.exec("PRAGMA busy_timeout = 5000");
+  db.releaseStatements?.();
+  db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+  db.exec("PRAGMA journal_mode = DELETE");
+}
+function removeSqliteSidecars2(databasePath) {
   for (const suffix of ["-wal", "-shm"])
     rmSync5(`${databasePath}${suffix}`, { force: true });
 }
@@ -26812,14 +27040,14 @@ function ensurePrivateDir2(path) {
   mkdirSync5(path, { recursive: true, mode: 448 });
   if (process.platform !== "win32") {
     try {
-      chmodSync2(path, 448);
+      chmodSync3(path, 448);
     } catch {}
   }
 }
 function makePrivateFile2(path) {
   if (process.platform !== "win32") {
     try {
-      chmodSync2(path, 384);
+      chmodSync3(path, 384);
     } catch {}
   }
 }
@@ -26836,7 +27064,7 @@ function readGitPath2(root, args) {
   }
 }
 function resolveMaybeRelative2(base, path) {
-  return isAbsolute5(path) ? resolve16(path) : resolve16(base, path);
+  return isAbsolute6(path) ? resolve16(path) : resolve16(base, path);
 }
 function canonicalPath2(path) {
   const resolved = resolve16(path);
@@ -26849,8 +27077,8 @@ function canonicalPath2(path) {
 function isPathInsideOrSame2(path, parent) {
   const child = resolve16(path);
   const base = resolve16(parent);
-  const fromBase = relative8(base, child);
-  return fromBase === "" || !!fromBase && !fromBase.startsWith("..") && !isAbsolute5(fromBase);
+  const fromBase = relative9(base, child);
+  return fromBase === "" || !!fromBase && !fromBase.startsWith("..") && !isAbsolute6(fromBase);
 }
 function stableStorageId2(prefix, value) {
   return `${prefix}.${createHash9("sha256").update(value).digest("hex").slice(0, 16)}`;
@@ -26942,10 +27170,29 @@ function insertRuntimeAgentJob(db, input) {
         lease_expires_at, last_error, dead_lettered_at, debounce_until, superseded_by_job_id)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, NULL, NULL, NULL, ?, NULL)`).run(input.job.jobId, input.job.repository.repositoryId, input.job.repository.storageRepositoryId, input.job.worktree.workspaceId, input.job.worktree.storageWorkspaceId, input.analysisKind, input.coalesceKey, input.priority, input.job.status, input.job.runnerPort, input.job.fingerprint, input.job.inputDigest, input.job.promptTemplateDigest, input.job.outputDigest ?? null, input.job.stalePolicy, stableJson2(input.job), input.job.queuedAt, input.job.updatedAt, 0, input.maxAttempts, input.debounceUntil ?? null);
 }
-function runtimeAgentJobById(db, jobId) {
-  const row = db.prepare("SELECT * FROM runtime_job_queue WHERE job_id = ?").get(jobId);
+function runtimeAgentJobInScope(db, scope, jobId) {
+  const row = db.prepare(`SELECT * FROM runtime_job_queue
+      WHERE job_id = ?
+        AND storage_repository_id = ?
+        AND storage_workspace_id = ?`).get(jobId, scope.repository.storageRepositoryId, scope.worktree.storageWorkspaceId);
   return row ? runtimeAgentJobRecordFromRow(row) : undefined;
 }
+function requireRuntimeAgentJobInScope(db, scope, jobId) {
+  const record2 = runtimeAgentJobInScope(db, scope, jobId);
+  if (!record2)
+    throw new Error(`runtime-agent-job-not-found-in-scope: ${jobId}`);
+  return record2;
+}
+function updateRuntimeAgentJobInScope(db, scope, jobId, assignments, params) {
+  db.prepare(`UPDATE runtime_job_queue
+      SET ${assignments}
+      WHERE job_id = ?
+        AND storage_repository_id = ?
+        AND storage_workspace_id = ?`).run(...params, jobId, scope.repository.storageRepositoryId, scope.worktree.storageWorkspaceId);
+}
+function runtimeAgentJobScope(job) {
+  return { repository: job.repository, worktree: job.worktree };
+}
 function runtimeAgentJobRecordFromRow(row) {
   return {
     job: JSON.parse(String(row.job_json)),
@@ -26982,6 +27229,30 @@ function runtimeAgentJobWithPatch(job, patch) {
 function nullableString(value) {
   return typeof value === "string" && value.length > 0 ? value : undefined;
 }
+function parseProjectionApplyReceipt(raw) {
+  let receipt;
+  try {
+    receipt = JSON.parse(raw);
+  } catch (error) {
+    throw new Error(`projection-apply-receipt-invalid-json: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const issues = projectionApplyReceiptInvariantIssues(receipt);
+  if (issues.length > 0)
+    throw new Error(`projection-apply-receipt-invalid: ${issues.join("; ")}`);
+  return receipt;
+}
+function parseProjectionApplyRecoveryProof(raw, receipt) {
+  let proof;
+  try {
+    proof = JSON.parse(raw);
+  } catch (error) {
+    throw new Error(`projection-apply-recovery-proof-invalid-json: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const issues = projectionApplyRecoveryProofReceiptInvariantIssues(proof, receipt);
+  if (issues.length > 0)
+    throw new Error(`projection-apply-recovery-proof-invalid: ${issues.join("; ")}`);
+  return proof;
+}
 function nowIso2() {
   return new Date().toISOString();
 }
@@ -27641,13 +27912,13 @@ async function withGithubIssueBodyFile(body, fn, deps = {}) {
     rmSync7(dir, { recursive: true, force: true });
   }
 }
-var SECRET_PATTERNS = [
-  /gh[opsu]_[A-Za-z0-9_]+/,
-  /Bearer\s+[A-Za-z0-9._-]+/i,
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
-  /GITHUB_WEBHOOK_SECRET/i,
-  /installation[_-]?token/i,
-  /jwt/i
+var SECRET_DETECTORS = [
+  { id: "github-token-prefix", pattern: /gh[opsu]_[A-Za-z0-9_]+/ },
+  { id: "bearer-credential", pattern: /Bearer\s+[A-Za-z0-9._-]+/i },
+  { id: "private-key-header", pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { id: "github-webhook-secret", pattern: /GITHUB_WEBHOOK_SECRET/i },
+  { id: "installation-token-value", pattern: /installation[_-]?token["']?\s*[:=]\s*["']?[A-Za-z0-9._-]{16,}/i },
+  { id: "compact-jwt-value", pattern: /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}/ }
 ];
 var GITHUB_ISSUE_BODY_MAX_LENGTH = 65536;
 function githubIssueFooterMarker(runId, draftDigest) {
@@ -27665,11 +27936,19 @@ function preflightGithubIssueDrafts(runId, drafts) {
 
 ${footer}
 `;
-    const payload = [draft.title, body, ...draft.labels].join(`
-`);
-    for (const pattern of SECRET_PATTERNS) {
-      if (pattern.test(payload)) {
-        return { ok: false, reason: `github issue draft ${draft.draftId} matched a secret-shaped pattern; publishing aborted for the entire run` };
+    const scanned = [
+      { field: "title", text: draft.title },
+      { field: "body", text: body },
+      ...draft.labels.map((label) => ({ field: "label", text: label }))
+    ];
+    for (const { field, text } of scanned) {
+      for (const detector of SECRET_DETECTORS) {
+        if (detector.pattern.test(text)) {
+          return {
+            ok: false,
+            reason: `github issue draft ${draft.draftId} matched a secret-shaped pattern (detector ${detector.id}) in its ${field}; publishing aborted for the entire run`
+          };
+        }
       }
     }
     if (body.length > GITHUB_ISSUE_BODY_MAX_LENGTH) {
@@ -28491,6 +28770,8 @@ function auditGithubIssuesEnabledInManifestText(manifestText) {
   return false;
 }
 var RUNTIME_RPC_VERSION = LOCAL_RUNTIME_RPC_SCHEMA_VERSION;
+var RUNTIME_RPC_MAX_REQUEST_BODY_BYTES = 16 * 1024 * 1024;
+var RUNTIME_RPC_REQUEST_BODY_TIMEOUT_MS = 30000;
 
 class RuntimeUpdateInputError extends Error {
 }
@@ -29074,12 +29355,15 @@ class ArchctxDaemon {
     const scope = await this.architectureLedgerScope(repositoryRoot);
     const jobs = await this.localStore.listRuntimeAgentJobs(scope);
     const record2 = jobs.find((candidate) => candidate.job.jobId === input.jobId);
-    if (record2 && record2.job.status !== "running") {
+    if (!record2)
+      return runtimeAgentJobOutOfScopeEnvelope("jobs.complete", input.jobId);
+    if (record2.job.status !== "running") {
       return errorEnvelope("jobs.complete", "AC_PRECONDITION_FAILED", `runtime agent job completion requires a running job: ${input.jobId}`);
     }
     if (input.status === "succeeded") {
-      if (record2 && record2.job.stalePolicy === "cancel-on-head-change" && isRuntimeAgentJobCursorStale(record2.job, scope)) {
+      if (record2.job.stalePolicy === "cancel-on-head-change" && isRuntimeAgentJobCursorStale(record2.job, scope)) {
         await this.localStore.cancelRuntimeAgentJob({
+          ...scope,
           jobId: input.jobId,
           status: "expired",
           now: input.now ?? this.clock(),
@@ -29091,7 +29375,7 @@ class ArchctxDaemon {
     if (input.proposalPlan) {
       const validation = validateRuntimeAgentProposalPlan({
         proposalPlan: input.proposalPlan,
-        job: record2?.job,
+        job: record2.job,
         jobId: input.jobId,
         outputDigest: input.outputDigest
       });
@@ -29103,6 +29387,7 @@ class ArchctxDaemon {
       proposalPlan: input.proposalPlan
     } : input.runMetadata;
     const job = await this.localStore.completeRuntimeAgentJob({
+      ...scope,
       jobId: input.jobId,
       status: input.status,
       workerId: input.workerId,
@@ -29115,8 +29400,12 @@ class ArchctxDaemon {
   }
   async jobsRetry(root, input) {
     this.assertRunning();
-    await this.architectureLedgerScope(findRepositoryRoot2(root));
+    const scope = await this.architectureLedgerScope(findRepositoryRoot2(root));
+    if (!await this.runtimeAgentJobInScope(scope, input.jobId)) {
+      return runtimeAgentJobOutOfScopeEnvelope("jobs.retry", input.jobId);
+    }
     const job = await this.localStore.retryRuntimeAgentJob({
+      ...scope,
       jobId: input.jobId,
       reason: input.reason,
       now: input.now ?? this.clock()
@@ -29125,8 +29414,12 @@ class ArchctxDaemon {
   }
   async jobsCancel(root, input) {
     this.assertRunning();
-    await this.architectureLedgerScope(findRepositoryRoot2(root));
+    const scope = await this.architectureLedgerScope(findRepositoryRoot2(root));
+    if (!await this.runtimeAgentJobInScope(scope, input.jobId)) {
+      return runtimeAgentJobOutOfScopeEnvelope("jobs.cancel", input.jobId);
+    }
     const job = await this.localStore.cancelRuntimeAgentJob({
+      ...scope,
       jobId: input.jobId,
       status: input.status ?? "cancelled",
       reason: input.reason,
@@ -29135,6 +29428,10 @@ class ArchctxDaemon {
     });
     return okEnvelope("jobs.cancel", { job });
   }
+  async runtimeAgentJobInScope(scope, jobId) {
+    const jobs = await this.localStore.listRuntimeAgentJobs(scope);
+    return jobs.find((candidate) => candidate.job.jobId === jobId);
+  }
   async auditRun(root, input = {}) {
     this.assertRunning();
     const repositoryRoot = findRepositoryRoot2(root);
@@ -29358,14 +29655,22 @@ class ArchctxDaemon {
     return typeof manifestRaw === "string" && auditGithubIssuesEnabledInManifestText(manifestRaw);
   }
   async canFileGithubIssues(root) {
-    const repoNameWithOwner = repositoryNameWithOwner(root);
-    if (repoNameWithOwner === "local/unknown") {
+    const target = readGitRemoteTarget(root);
+    if (!target) {
       return {
         ok: false,
         code: "AC_PRECONDITION_FAILED",
         message: "audit approve requires a resolvable GitHub owner/repo; git remote 'origin' is missing or is not a parseable GitHub URL"
       };
     }
+    if (target.host !== SUPPORTED_GITHUB_REMOTE_HOST) {
+      return {
+        ok: false,
+        code: "AC_PRECONDITION_FAILED",
+        message: `audit approve supports ${SUPPORTED_GITHUB_REMOTE_HOST} remotes only (ADR-0042); git remote 'origin' resolves to host "${target.host}", and ${target.owner}/${target.repo} there is not the same repository as ${target.owner}/${target.repo} on ${SUPPORTED_GITHUB_REMOTE_HOST}`
+      };
+    }
+    const repoNameWithOwner = `${target.owner}/${target.repo}`;
     const token = process.env[AUDIT_APPROVE_GH_TOKEN_ENV];
     if (!token) {
       return {
@@ -29393,7 +29698,7 @@ class ArchctxDaemon {
         message: `audit approve received an unrecognized visibility "${probedVisibility}" for ${repoNameWithOwner}; refusing to guess whether it is safe to publish`
       };
     }
-    return { ok: true, repoNameWithOwner, visibility, token };
+    return { ok: true, host: target.host, repoNameWithOwner, visibility, token };
   }
   async auditList(root, input = {}) {
     this.assertRunning();
@@ -29468,9 +29773,9 @@ class ArchctxDaemon {
       const capability = await this.canFileGithubIssues(repositoryRoot);
       if (!capability.ok)
         return errorEnvelope("audit.approve", capability.code, capability.message);
-      const expectedConfirmToken = `public:${capability.repoNameWithOwner}:${run.baseSha}:${run.runId}`;
+      const expectedConfirmToken = `public:${capability.host}/${capability.repoNameWithOwner}:${run.baseSha}:${run.runId}`;
       if (capability.visibility !== "private" && input.confirmPublicToken !== expectedConfirmToken) {
-        return errorEnvelope("audit.approve", "AC_USER_CONFIRMATION_REQUIRED", `audit run ${run.runId} targets a ${capability.visibility} repository (${capability.repoNameWithOwner}); rerun with explicit confirmation: archctx audit approve ${run.runId} --confirm-public-repo ${expectedConfirmToken}`);
+        return errorEnvelope("audit.approve", "AC_USER_CONFIRMATION_REQUIRED", `audit run ${run.runId} targets a ${capability.visibility} repository (${capability.host}/${capability.repoNameWithOwner}); rerun with explicit confirmation: archctx audit approve ${run.runId} --confirm-public-repo ${expectedConfirmToken}`);
       }
       const preflight = preflightGithubIssueDrafts(run.runId, drafts);
       if (!preflight.ok)
@@ -29701,7 +30006,8 @@ class ArchctxDaemon {
           return errorEnvelope("docs.pin", "AC_SCHEMA_INVALID", "docs pin requires --library-id and --version");
         assertContext7LibraryId(input.libraryId);
         assertContext7Version(input.version);
-        const lock = upsertContext7Pin(readContext7Lockfile(session.workspace.root), {
+        const current = readContext7LockfileState(session.workspace.root);
+        const lock = upsertContext7Pin(current.lock, {
           libraryId: input.libraryId,
           version: input.version,
           pinnedAt: this.clock(),
@@ -29715,7 +30021,7 @@ class ArchctxDaemon {
             lock
           });
         }
-        writeContext7Lockfile(session.workspace.root, lock);
+        writeContext7Lockfile(session.workspace.root, lock, current.expectedHash);
         return okEnvelope("docs.pin", {
           schemaVersion: "archcontext.context7-pin/v1",
           approved: true,
@@ -30057,12 +30363,55 @@ class ArchctxDaemon {
       });
     });
   }
-  async reconcileProjectionApply(root, lookupKey) {
+  async inspectProjectionApplyReceipt(root, lookupKey) {
+    this.assertRunning();
+    await this.openSession(root);
+    const inspection = await this.localStore.inspectProjectionApplyReceipt(lookupKey);
+    return okEnvelope("projection.inspect-receipt", {
+      found: inspection !== undefined,
+      ...inspection ?? {}
+    });
+  }
+  async recoverProjectionApply(root, intent) {
     this.assertRunning();
+    const intentIssues = projectionApplyRecoveryIntentInvariantIssues(intent);
+    if (intentIssues.length > 0) {
+      return errorEnvelope("projection.recover", "AC_SCHEMA_INVALID", `projection recovery intent invariant failed: ${intentIssues.join("; ")}`);
+    }
     return this.withWriter(async () => {
-      await this.openSession(root);
-      const consumption = await this.localStore.consumeProjectionApplyReceipt(lookupKey);
-      return okEnvelope("projection.reconcile", {
+      const session = await this.openSession(root);
+      const inspection = await this.localStore.inspectProjectionApplyReceipt(intent.receipt.lookupKey);
+      if (!inspection || inspection.receipt.identity.applyId !== intent.receipt.applyId) {
+        return errorEnvelope("projection.recover", "AC_PRECONDITION_FAILED", "committed projection apply receipt was not found");
+      }
+      if (inspection.deliveryStatus === "delivered") {
+        if (!inspection.recoveryProof) {
+          return errorEnvelope("projection.recover", "AC_PRECONDITION_FAILED", "committed projection receipt was delivered without a recovery proof");
+        }
+        return okEnvelope("projection.recover", {
+          found: true,
+          receipt: inspection.receipt,
+          proof: { ...inspection.recoveryProof, deliveryStatus: "already-delivered" },
+          refreshSignalsDelivered: false
+        });
+      }
+      let fixedPoint;
+      try {
+        fixedPoint = buildRuntimeProjectionRecoveryFixedPoint(root);
+      } catch (error) {
+        return errorEnvelope("projection.recover", "AC_PRECONDITION_FAILED", error instanceof Error ? error.message : String(error));
+      }
+      const issues = runtimeProjectionRecoveryFixedPointIssues(inspection.receipt, fixedPoint);
+      if (issues.length > 0) {
+        return errorEnvelope("projection.recover", "AC_PRECONDITION_FAILED", `projection recovery proof failed: ${issues.join("; ")}`);
+      }
+      const proof = createRuntimeProjectionRecoveryProof(intent, inspection.receipt, fixedPoint);
+      const currentWorktreeDigest = runtimeWorktreeDigest(root, "architecture-documentation-projection");
+      if (session.workspace.repositoryId !== proof.current.snapshot.repositoryId || session.workspace.headSha !== proof.current.snapshot.headSha || currentWorktreeDigest !== proof.current.snapshot.worktreeDigest) {
+        return errorEnvelope("projection.recover", "AC_PRECONDITION_FAILED", "projection recovery authority changed before delivery");
+      }
+      const consumption = await this.localStore.consumeProjectionApplyReceiptRecovery(proof);
+      return okEnvelope("projection.recover", {
         found: consumption !== undefined,
         ...consumption ?? {}
       });
@@ -30131,7 +30480,6 @@ class ArchctxDaemon {
     await this.changeSetEngine.apply(root, draft, { approved: true });
   }
   async applyArchitectureProjectionRollbackChangeSet(root, projectedFiles, currentFiles, createdAt) {
-    const targetPaths = new Set(projectedFiles.map((file) => file.path));
     const backupBase = `.archcontext/backups/ledger-rollback/${safePathSegment(createdAt)}`;
     const backupRelativePath = uniqueBackupPath(root, backupBase);
     const manifestPath = `${backupRelativePath}/manifest.json`;
@@ -30140,7 +30488,7 @@ class ArchctxDaemon {
       path: backupRelativePath,
       manifestPath
     });
-    const removedPaths = currentFiles.filter((file) => !targetPaths.has(file.path)).map((file) => file.path);
+    const removedPaths = obsoleteManagedProjectionPaths(currentFiles, projectedFiles);
     await this.applyArchitectureProjectionChangeSet(root, {
       id: `changeset.ledger-rollback-${shortDigest3(digestJson({ createdAt, projectionDigest: architectureLedgerProjectionDigest(projectedFiles) }))}`,
       files: [
@@ -30514,11 +30862,12 @@ class ArchctxDaemon {
       const scope = await this.architectureLedgerScope(root);
       const state = await this.localStore.readArchitectureLedgerState(scope);
       const projectedFiles = projectArchitectureLedgerStateToYamlFiles(state);
+      const removedPaths = obsoleteManagedProjectionPaths(listModelFiles(root).filter((file) => isArchitectureLedgerManagedModelPath(file.path)), projectedFiles);
       if (writes) {
         await this.applyArchitectureProjectionChangeSet(root, {
           id: `changeset.ledger-project-${shortDigest3(architectureLedgerProjectionDigest(projectedFiles))}`,
           files: projectedFiles.map(({ path, body }) => ({ path, body })),
-          removedPaths: []
+          removedPaths
         });
       }
       const drift = compareArchitectureLedgerStateToYaml({
@@ -30539,6 +30888,7 @@ class ArchctxDaemon {
         projectionDigest: architectureLedgerProjectionDigest(projectedFiles),
         graphDigest: architectureLedgerStateDigest(state),
         writtenPaths: writes ? projectedFiles.map((file) => file.path) : [],
+        removedPaths: writes ? removedPaths : [],
         projectedFiles: writes ? undefined : projectedFiles,
         drift,
         reconcile
@@ -31015,12 +31365,21 @@ class ArchctxDaemon {
     const paths = createDeveloperReviewRunPaths({
       sourceRoot,
       challengeId: input.challenge.challengeId,
-      tempRoot: input.tempRoot,
-      stateDir: input.stateDir
+      tempRoot: input.tempRoot
     });
     mkdirSync7(paths.stateDir, { recursive: true });
     mkdirSync7(paths.runRoot, { recursive: true });
     mkdirSync7(paths.worktreeTempRoot, { recursive: true });
+    const createdAt = this.clock();
+    writeDeveloperReviewRunOwnerMarker({
+      runRoot: paths.runRoot,
+      runId: paths.runId,
+      challengeId: input.challenge.challengeId,
+      stateDir: paths.stateDir,
+      manifestPath: paths.manifestPath,
+      lockPath: paths.lockPath,
+      createdAt
+    });
     const preparing = {
       schemaVersion: "archcontext.developer-review-run/v1",
       runId: paths.runId,
@@ -31032,7 +31391,7 @@ class ArchctxDaemon {
       manifestPath: paths.manifestPath,
       lockPath: paths.lockPath,
       pid: process.pid,
-      createdAt: this.clock(),
+      createdAt,
       status: "preparing",
       codeGraphTemporaryState: {
         root: paths.runRoot,
@@ -31092,12 +31451,13 @@ class ArchctxDaemon {
     }
   }
   cleanupDeveloperReviewRun(run) {
+    const targets = resolveOwnedDeveloperReviewRunTargets(run);
     const removed = [];
     const errors = [];
-    if (run.worktree) {
+    if (targets.worktree) {
       try {
-        const hadWorktree = existsSync15(run.worktree.worktreeRoot);
-        removeDetachedReviewWorktree(run.worktree);
+        const hadWorktree = existsSync15(targets.worktree.worktreeRoot);
+        removeDetachedReviewWorktree(targets.worktree);
         if (hadWorktree)
           removed.push("worktree");
       } catch (error) {
@@ -31105,10 +31465,12 @@ class ArchctxDaemon {
       }
     }
     for (const [kind, path] of [
-      ["run-root", run.runRoot],
-      ["manifest", run.manifestPath],
-      ["lock", run.lockPath]
+      ["run-root", targets.runRoot],
+      ["manifest", targets.manifestPath],
+      ["lock", targets.lockPath]
     ]) {
+      if (!path)
+        continue;
       try {
         const existed = existsSync15(path);
         removePathWithRetry(path);
@@ -31130,14 +31492,15 @@ class ArchctxDaemon {
   recoverDeveloperReviewRuns(input) {
     this.assertRunning();
     const sourceRoot = findRepositoryRoot2(input.repositoryRoot);
-    const stateDir = input.stateDir ? resolve18(input.stateDir) : defaultDeveloperReviewRunStateDir(sourceRoot);
+    const stateDir = defaultDeveloperReviewRunStateDir(sourceRoot);
     const recovery = {
       schemaVersion: "archcontext.developer-review-run-recovery/v1",
       sourceRoot,
       stateDir,
       recovered: [],
       removedLocks: [],
-      skippedActive: []
+      skippedActive: [],
+      rejected: []
     };
     if (!existsSync15(stateDir))
       return recovery;
@@ -31145,21 +31508,39 @@ class ArchctxDaemon {
       if (!entry.endsWith(".json"))
         continue;
       const manifestPath = join9(stateDir, entry);
+      const stats = lstatIfExists(manifestPath);
+      if (!stats || !stats.isFile()) {
+        recovery.rejected.push(`${entry}: not-a-regular-file`);
+        continue;
+      }
       const manifest = readDeveloperReviewRunManifest(manifestPath);
       if (!manifest) {
         rmSync8(manifestPath, { force: true });
         continue;
       }
+      if (resolve18(manifest.manifestPath) !== manifestPath) {
+        recovery.rejected.push(`${entry}: manifest-path-mismatch`);
+        continue;
+      }
       if (!input.force && isDeveloperReviewPidAlive(manifest.pid)) {
         recovery.skippedActive.push(manifest.runId);
         continue;
       }
-      recovery.recovered.push(this.cleanupDeveloperReviewRun(manifest));
+      try {
+        recovery.recovered.push(this.cleanupDeveloperReviewRun(manifest));
+      } catch (error) {
+        recovery.rejected.push(`${entry}: ${error instanceof Error ? error.message : String(error)}`);
+      }
     }
     for (const entry of readdirSync9(stateDir).sort()) {
       if (!entry.endsWith(".lock"))
         continue;
       const lockPath = join9(stateDir, entry);
+      const stats = lstatIfExists(lockPath);
+      if (!stats || !stats.isFile()) {
+        recovery.rejected.push(`${entry}: not-a-regular-file`);
+        continue;
+      }
       const lock = readJsonObject(lockPath);
       const pid = typeof lock?.pid === "number" ? lock.pid : undefined;
       const runId = typeof lock?.runId === "string" ? lock.runId : entry;
@@ -31321,16 +31702,46 @@ class ArchctxDaemon {
   }
   async repoRemove(repositoryId) {
     this.assertRunning();
-    this.sessions.delete(repositoryId);
+    const hadOpenSession = this.sessions.has(repositoryId);
+    const hadPersistedSession = (await this.localStore.listRepositorySessions()).some((session) => session.repositoryId === repositoryId);
+    const registered = this.landscape?.repositories.some((repo) => repo.repositoryId === repositoryId) ?? false;
+    if (!registered && !hadOpenSession && !hadPersistedSession) {
+      return errorEnvelope("repo.remove", "AC_REPO_NOT_FOUND", `repository is not registered: ${repositoryId}`);
+    }
+    let detachedRelationIds = [];
+    let nextLandscape;
     if (this.landscape) {
-      this.landscape = {
+      detachedRelationIds = (await this.localStore.listCrossRepoRelations(this.landscape)).filter((relation) => relation.source.repositoryId === repositoryId || relation.target.repositoryId === repositoryId).map((relation) => relation.id).sort();
+      const detached = new Set(detachedRelationIds);
+      const next = {
         ...this.landscape,
         repositories: this.landscape.repositories.filter((repo) => repo.repositoryId !== repositoryId),
-        relations: this.landscape.relations
+        relations: this.landscape.relations.filter((relationId) => !detached.has(relationId)),
+        ...this.landscape.scope === undefined ? {} : {
+          scope: {
+            ...this.landscape.scope,
+            defaultActiveRepositories: (this.landscape.scope.defaultActiveRepositories ?? []).filter((activeId) => activeId !== repositoryId)
+          }
+        }
       };
-      await this.localStore.saveLandscape(this.landscape);
+      const validation = validateLandscape(next, await this.localStore.listCrossRepoRelations(next));
+      if (!validation.valid) {
+        return errorEnvelope("repo.remove", "AC_SCHEMA_INVALID", validation.errors.join("; "));
+      }
+      nextLandscape = next;
+    }
+    this.sessions.delete(repositoryId);
+    await this.localStore.deleteRepositorySession(repositoryId);
+    if (nextLandscape) {
+      this.landscape = nextLandscape;
+      await this.localStore.saveLandscape(nextLandscape);
     }
-    return okEnvelope("repo.remove", { repositoryId, removed: true });
+    return okEnvelope("repo.remove", {
+      repositoryId,
+      removed: true,
+      sessionRemoved: hadOpenSession || hadPersistedSession,
+      detachedRelationIds
+    });
   }
   async loadLandscape(landscape) {
     this.assertRunning();
@@ -32186,16 +32597,76 @@ data: ${payload}
   }
 }
 
+class RuntimeRpcTransportError extends Error {
+  code;
+  method;
+  timeoutMs;
+  elapsedMs;
+  constructor(code, method, timeoutMs, elapsedMs) {
+    super(code === "RPC_TIMEOUT" ? `runtime RPC timeout: ${method} exceeded ${timeoutMs}ms` : `runtime RPC cancelled: ${method} aborted after ${elapsedMs}ms`);
+    this.code = code;
+    this.method = method;
+    this.timeoutMs = timeoutMs;
+    this.elapsedMs = elapsedMs;
+    this.name = "RuntimeRpcTransportError";
+  }
+}
+var RUNTIME_RPC_CLIENT_TIMEOUT_POLICY = {
+  health: 5000,
+  short: 15000,
+  normal: 120000,
+  long: 900000
+};
+var RUNTIME_RPC_SHORT_METHODS = new Set([
+  "shutdown",
+  "runtimeStatus",
+  "landscapeStatus",
+  "repoList",
+  "explorerStatus",
+  "explorerServiceContract",
+  "jobsList",
+  "jobsStats",
+  "ledgerState",
+  "ledgerDrift",
+  "stopExplorer",
+  "revokeExplorerToken"
+]);
+var RUNTIME_RPC_LONG_METHODS = new Set([
+  "init",
+  "sync",
+  "prepare",
+  "context",
+  "checkpoint",
+  "auditRun",
+  "auditApprove",
+  "recommendations",
+  "book",
+  "ledgerRebuild",
+  "ledgerMigrate",
+  "startDeveloperReviewRun",
+  "runSignedDeveloperReviewAttestation"
+]);
+function runtimeRpcMethodTimeout(method, policy) {
+  if (RUNTIME_RPC_SHORT_METHODS.has(method))
+    return policy.short;
+  if (RUNTIME_RPC_LONG_METHODS.has(method))
+    return policy.long;
+  return policy.normal;
+}
+
 class RuntimeRpcClient {
   connection;
-  constructor(connection) {
+  options;
+  timeouts;
+  constructor(connection, options = {}) {
     this.connection = connection;
+    this.options = options;
+    this.timeouts = { ...RUNTIME_RPC_CLIENT_TIMEOUT_POLICY, ...options.timeouts };
   }
   async health() {
-    const response = await fetch(`${this.connection.url}health`, {
+    return await this.request("health", this.timeouts.health, `${this.connection.url}health`, {
       headers: { "X-ArchContext-RPC-Version": RUNTIME_RPC_VERSION }
     });
-    return await response.json();
   }
   async shutdown() {
     return this.call("shutdown", []);
@@ -32279,8 +32750,11 @@ class RuntimeRpcClient {
   applyUpdate(root, input) {
     return this.call("applyUpdate", [root, input]);
   }
-  reconcileProjectionApply(root, lookupKey) {
-    return this.call("reconcileProjectionApply", [root, lookupKey]);
+  inspectProjectionApplyReceipt(root, lookupKey) {
+    return this.call("inspectProjectionApplyReceipt", [root, lookupKey]);
+  }
+  recoverProjectionApply(root, intent) {
+    return this.call("recoverProjectionApply", [root, intent]);
   }
   ledgerState(root) {
     return this.call("ledgerState", [root]);
@@ -32358,7 +32832,7 @@ class RuntimeRpcClient {
     return unwrapRpcData(await this.call("recoverDeveloperReviewRuns", [input]));
   }
   async call(method, params) {
-    const response = await fetch(`${this.connection.url}rpc`, {
+    return await this.request(method, runtimeRpcMethodTimeout(method, this.timeouts), `${this.connection.url}rpc`, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${this.connection.token}`,
@@ -32367,7 +32841,35 @@ class RuntimeRpcClient {
       },
       body: JSON.stringify({ schemaVersion: RUNTIME_RPC_VERSION, method, params })
     });
-    return await response.json();
+  }
+  async request(method, timeoutMs, url, init) {
+    const controller = new AbortController;
+    const startedAt = Date.now();
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, timeoutMs);
+    const callerSignal = this.options.signal;
+    const onCallerAbort = () => controller.abort();
+    if (callerSignal?.aborted)
+      controller.abort();
+    else
+      callerSignal?.addEventListener("abort", onCallerAbort, { once: true });
+    try {
+      const response = await fetch(url, { ...init, signal: controller.signal });
+      return await response.json();
+    } catch (error) {
+      const elapsedMs = Date.now() - startedAt;
+      if (timedOut)
+        throw new RuntimeRpcTransportError("RPC_TIMEOUT", method, timeoutMs, elapsedMs);
+      if (callerSignal?.aborted)
+        throw new RuntimeRpcTransportError("RPC_ABORTED", method, timeoutMs, elapsedMs);
+      throw error;
+    } finally {
+      clearTimeout(timer);
+      callerSignal?.removeEventListener("abort", onCallerAbort);
+    }
   }
 }
 
@@ -32418,7 +32920,7 @@ class ArchctxRuntimeRpcServer {
       startedAt: (this.options.clock ?? (() => new Date().toISOString()))()
     };
     writeFileSync6(connectionPath, JSON.stringify(this.connection, null, 2), { mode: 384 });
-    chmodSync3(connectionPath, 384);
+    chmodSync4(connectionPath, 384);
     this.armIdleTimer();
     return this.connection;
   }
@@ -32512,13 +33014,26 @@ class ArchctxRuntimeRpcServer {
       writeJson(response, 401, { schemaVersion: RUNTIME_RPC_VERSION, ok: false, error: "runtime RPC token required" });
       return;
     }
-    const body = await readRequestJson(request);
-    if (body.schemaVersion !== RUNTIME_RPC_VERSION) {
-      writeJson(response, 400, { schemaVersion: RUNTIME_RPC_VERSION, ok: false, error: "runtime RPC version mismatch" });
-      return;
-    }
     this.inFlightRpcRequests += 1;
     try {
+      const read = await readRpcRequestBody(request, {
+        maxBytes: this.options.maxRequestBodyBytes ?? RUNTIME_RPC_MAX_REQUEST_BODY_BYTES,
+        timeoutMs: this.options.requestBodyTimeoutMs ?? RUNTIME_RPC_REQUEST_BODY_TIMEOUT_MS
+      });
+      if (!read.ok) {
+        if (read.kind === "rejected")
+          writeJson(response, read.status, { schemaVersion: RUNTIME_RPC_VERSION, ok: false, error: read.error });
+        return;
+      }
+      if (!read.value || typeof read.value !== "object" || Array.isArray(read.value)) {
+        writeJson(response, 400, { schemaVersion: RUNTIME_RPC_VERSION, ok: false, error: "runtime RPC request body must be an object" });
+        return;
+      }
+      const body = read.value;
+      if (body.schemaVersion !== RUNTIME_RPC_VERSION) {
+        writeJson(response, 400, { schemaVersion: RUNTIME_RPC_VERSION, ok: false, error: "runtime RPC version mismatch" });
+        return;
+      }
       const result = await this.dispatch(body.method ?? "", body.params ?? []);
       writeJson(response, 200, result);
       if (body.method === "shutdown")
@@ -32585,8 +33100,10 @@ class ArchctxRuntimeRpcServer {
         return this.daemon.completeTask(params[0], params[1]);
       case "applyUpdate":
         return this.daemon.applyUpdate(params[0], params[1]);
-      case "reconcileProjectionApply":
-        return this.daemon.reconcileProjectionApply(params[0], params[1]);
+      case "inspectProjectionApplyReceipt":
+        return this.daemon.inspectProjectionApplyReceipt(params[0], params[1]);
+      case "recoverProjectionApply":
+        return this.daemon.recoverProjectionApply(params[0], params[1]);
       case "ledgerState":
         return this.daemon.ledgerState(params[0]);
       case "ledgerDrift":
@@ -32630,13 +33147,13 @@ class ArchctxRuntimeRpcServer {
       case "runtimeStatus":
         return this.daemon.runtimeStatus(params[0]);
       case "startDeveloperReviewRun":
-        return okEnvelope("developerReview.startRun", this.daemon.startDeveloperReviewRun(params[0]));
+        return okEnvelope("developerReview.startRun", this.daemon.startDeveloperReviewRun(decodeStartDeveloperReviewRunParams(params)));
       case "runSignedDeveloperReviewAttestation":
-        return okEnvelope("developerReview.attestation", await this.daemon.runSignedDeveloperReviewAttestation(params[0]));
+        return okEnvelope("developerReview.attestation", await this.daemon.runSignedDeveloperReviewAttestation(decodeSignedDeveloperReviewAttestationParams(params)));
       case "cleanupDeveloperReviewRun":
-        return okEnvelope("developerReview.cleanupRun", this.daemon.cleanupDeveloperReviewRun(params[0]));
+        return okEnvelope("developerReview.cleanupRun", this.daemon.cleanupDeveloperReviewRun(decodeDeveloperReviewRunManifest(params[0], "cleanupDeveloperReviewRun")));
       case "recoverDeveloperReviewRuns":
-        return okEnvelope("developerReview.recoverRuns", this.daemon.recoverDeveloperReviewRuns(params[0]));
+        return okEnvelope("developerReview.recoverRuns", this.daemon.recoverDeveloperReviewRuns(decodeRecoverDeveloperReviewRunsParams(params)));
       case "shutdown":
         return okEnvelope("daemon.stop", { stopping: true });
       default:
@@ -32814,6 +33331,9 @@ function shouldSkipGeneratedProjectionJob(metadata, input) {
 function isRuntimeAgentJobCursorStale(job, scope) {
   return job.worktree.headSha !== scope.worktree.headSha || job.worktree.worktreeDigest !== scope.worktree.worktreeDigest;
 }
+function runtimeAgentJobOutOfScopeEnvelope(requestId, jobId) {
+  return errorEnvelope(requestId, "AC_PRECONDITION_FAILED", `runtime agent job does not belong to this repository/worktree: ${jobId}`, "runtime-agent-job-out-of-scope");
+}
 function runtimeWorktreeDigest(root, profile) {
   switch (profile) {
     case "repository":
@@ -32824,6 +33344,137 @@ function runtimeWorktreeDigest(root, profile) {
       throw new RuntimeUpdateInputError(`unsupported worktree digest profile: ${String(profile)}`);
   }
 }
+function buildRuntimeProjectionRecoveryFixedPoint(root) {
+  const loaded = loadArchitectureDocumentationInputs(root, REPO_HARNESS_PROJECTION_PROFILE);
+  const sourceDigest = digestJson({
+    model: loaded.model,
+    profile: REPO_HARNESS_PROJECTION_PROFILE,
+    decisions: loaded.decisions.map((decision) => ({ id: decision.id, path: decision.path, title: decision.title, status: decision.status }))
+  });
+  const codeGraphInputs = prepareArchitectureDocumentationProjectionSnapshot(root, loaded.model);
+  const provenance = codeGraphInputs.provenance;
+  const projection3 = renderArchitectureDocumentationProjection({
+    model: loaded.model,
+    profile: REPO_HARNESS_PROJECTION_PROFILE,
+    decisions: loaded.decisions,
+    existingFiles: loaded.existingFiles,
+    verifiedAgainst: assertArchitectureProjectionVerifiedAgainst({
+      branch: readCurrentBranch(root),
+      commit: readHeadSha2(root),
+      committedAt: readHeadCommittedAt(root)
+    }),
+    sourceChangesSinceStamp: loadCapabilitySourceChangesSinceStamps(root, loaded.model),
+    sourceScaleSignals: loadCapabilitySourceScaleSignals(root, loaded.model),
+    importGraphs: codeGraphInputs.importGraphs,
+    selectorEvidence: codeGraphInputs.selectorEvidence,
+    provenance,
+    sourceDigest,
+    generatedAt: new Date(0).toISOString(),
+    refreshContext: {
+      repositoryId: repositoryFingerprint2(root),
+      workspaceId: runtimeProjectionWorkspaceId(root),
+      headSha: provenance.baseHeadSha,
+      worktreeDigest: provenance.worktreeDigest
+    }
+  });
+  const snapshot = {
+    repositoryId: repositoryFingerprint2(root),
+    workspaceId: runtimeProjectionWorkspaceId(root),
+    headSha: readHeadSha2(root),
+    worktreeDigest: architectureDocumentationProjectionWorktreeDigest(root, loaded.model),
+    baseHeadSha: projection3.provenance.baseHeadSha,
+    sourceTreeDigest: projection3.provenance.sourceTreeDigest,
+    modelDigest: projection3.provenance.modelDigest,
+    codeGraphDigest: projection3.provenance.codeGraphDigest,
+    indexedWorktreeDigest: projection3.provenance.indexedWorktreeDigest,
+    projectionInputDigest: projection3.provenance.projectionInputDigest,
+    rendererVersion: projection3.provenance.rendererVersion,
+    layoutVersion: projection3.provenance.layoutVersion,
+    generatedFrom: projection3.provenance.generatedFrom
+  };
+  return {
+    projection: projection3,
+    snapshot,
+    ownedOutputDigest: runtimeProjectionOwnedOutputDigest({ files: [...projection3.files, projection3.manifest] })
+  };
+}
+function runtimeProjectionRecoveryFixedPointIssues(receipt, fixedPoint) {
+  const binding = receipt.recovery;
+  if (!binding)
+    return ["committed projection receipt does not support semantic recovery"];
+  const issues = [];
+  const projection3 = fixedPoint.projection;
+  if (!projection3.drift.ok || projection3.rejected.length > 0)
+    issues.push("projection owned outputs are not a clean fixed point");
+  if (projection3.majorChange.mode !== "none" || projection3.majorChange.reasonCodes.length > 0 || projection3.majorChange.affectedNodeIds.length > 0) {
+    issues.push("current architecture state contains an unresolved major change");
+  }
+  if (projection3.refreshSignals.length > 0)
+    issues.push("current architecture state has unresolved refresh signals");
+  for (const field of ["repositoryId", "workspaceId", "headSha", "worktreeDigest"]) {
+    if (fixedPoint.snapshot[field] !== binding.originalExpectedSnapshot[field]) {
+      issues.push(`current projection snapshot differs from the approved snapshot: ${field}`);
+    }
+  }
+  if (binding.generatedFrom.codeGraphStatus !== "ready")
+    issues.push("approved CodeGraph snapshot is unavailable");
+  if (projection3.provenance.generatedFrom.codeGraphStatus !== "ready")
+    issues.push("current CodeGraph snapshot is unavailable");
+  if (digestJson(projection3.architectureDigests) !== digestJson(binding.expectedResultingDigests)) {
+    issues.push("current model, source, flow-proof, or projection digest differs from the approved result");
+  }
+  if (projection3.provenance.projectionInputDigest !== receipt.result.outputSnapshot.projectionInputDigest || projection3.provenance.codeGraphDigest !== receipt.result.outputSnapshot.codeGraphDigest || projection3.provenance.rendererVersion !== binding.rendererVersion || projection3.provenance.layoutVersion !== binding.layoutVersion || digestJson(projection3.provenance.generatedFrom) !== digestJson(binding.generatedFrom)) {
+    issues.push("current renderer, layout, or CodeGraph provenance differs from the approved result");
+  }
+  if (fixedPoint.ownedOutputDigest !== binding.ownedOutputDigest)
+    issues.push("current projection-owned output bytes differ from the approved result");
+  if (fixedPoint.snapshot.generatedFrom.codeGraphStatus !== "ready")
+    issues.push("current proof snapshot requires CodeGraph ready");
+  return issues;
+}
+function createRuntimeProjectionRecoveryProof(intent, receipt, fixedPoint) {
+  const current = {
+    snapshot: fixedPoint.snapshot,
+    resultingDigests: fixedPoint.projection.architectureDigests,
+    ownedOutputDigest: fixedPoint.ownedOutputDigest,
+    fixedPointDigest: digestJson({
+      schemaVersion: "archcontext.projection-apply-recovery-fixed-point/v1",
+      snapshot: fixedPoint.snapshot,
+      resultingDigests: fixedPoint.projection.architectureDigests,
+      ownedOutputDigest: fixedPoint.ownedOutputDigest,
+      drift: fixedPoint.projection.drift,
+      majorChange: fixedPoint.projection.majorChange,
+      refreshSignalIds: fixedPoint.projection.refreshSignals.map((signal) => signal.signalId)
+    })
+  };
+  const payload = {
+    schemaVersion: "archcontext.projection-apply-recovery-proof/v1",
+    requestId: intent.requestId,
+    requestDigest: digestJson(intent),
+    receipt: {
+      lookupKey: receipt.identity.lookupKey,
+      applyId: receipt.identity.applyId,
+      receiptDigest: receipt.result.receiptDigest
+    },
+    acceptedChange: receipt.identity.acceptedChange,
+    expectedResultingDigests: receipt.recovery.expectedResultingDigests,
+    current
+  };
+  return {
+    ...payload,
+    proofDigest: projectionApplyRecoveryProofDigest(payload),
+    deliveryStatus: "delivered"
+  };
+}
+function runtimeProjectionOwnedOutputDigest(projection3) {
+  return digestJson({
+    schemaVersion: "archcontext.projection-owned-output/v1",
+    files: projection3.files.map((file) => ({ path: file.path, body: file.body })).sort((left, right) => left.path.localeCompare(right.path))
+  });
+}
+function runtimeProjectionWorkspaceId(root) {
+  return `workspace.${digestJson({ root: canonicalRepositoryRoot2(root) }).replace(/^sha256:/, "").slice(0, 16)}`;
+}
 function isArchContextGeneratedProjectionPath(path) {
   return path.replace(/\\/g, "/").startsWith(".archcontext/generated/");
 }
@@ -33175,13 +33826,18 @@ function runtimeAttestationIdentity(snapshot, composition) {
     })
   };
 }
+var DEVELOPER_REVIEW_RUN_ROOT_PREFIX = "archctx-developer-review-";
+var DEVELOPER_REVIEW_RUN_OWNER_MARKER_FILE = ".archctx-developer-review-run.json";
+var DEVELOPER_REVIEW_RUN_OWNER_SCHEMA_VERSION = "archcontext.developer-review-run-owner/v1";
+var DEVELOPER_REVIEW_RUN_ROOT_SUFFIX = /^[A-Za-z0-9]{6}$/;
+var DEVELOPER_REVIEW_RUN_ID_SUFFIX = /^[0-9a-f]{12}$/;
 function createDeveloperReviewRunPaths(input) {
   const safeChallengeId = safeControlFileSegment(input.challengeId);
   const runId = `${safeChallengeId}-${randomBytes(6).toString("hex")}`;
-  const stateDir = input.stateDir ? resolve18(input.stateDir) : defaultDeveloperReviewRunStateDir(input.sourceRoot);
+  const stateDir = defaultDeveloperReviewRunStateDir(input.sourceRoot);
   const tempParent = input.tempRoot ? resolve18(input.tempRoot) : tmpdir3();
   mkdirSync7(tempParent, { recursive: true });
-  const runRoot = mkdtempSync4(join9(tempParent, `archctx-developer-review-${safeChallengeId.slice(0, 32)}-`));
+  const runRoot = mkdtempSync4(join9(tempParent, `${DEVELOPER_REVIEW_RUN_ROOT_PREFIX}${safeChallengeId.slice(0, 32)}-`));
   return {
     runId,
     stateDir,
@@ -33191,6 +33847,92 @@ function createDeveloperReviewRunPaths(input) {
     lockPath: join9(stateDir, `${safeChallengeId}.lock`)
   };
 }
+function writeDeveloperReviewRunOwnerMarker(input) {
+  const marker = {
+    schemaVersion: DEVELOPER_REVIEW_RUN_OWNER_SCHEMA_VERSION,
+    runId: input.runId,
+    challengeId: input.challengeId,
+    stateDir: input.stateDir,
+    manifestPath: input.manifestPath,
+    lockPath: input.lockPath,
+    pid: process.pid,
+    createdAt: input.createdAt
+  };
+  writePrivateJson3(join9(input.runRoot, DEVELOPER_REVIEW_RUN_OWNER_MARKER_FILE), marker, "wx");
+}
+function readDeveloperReviewRunOwnerMarker(path) {
+  const stats = lstatIfExists(path);
+  if (!stats || !stats.isFile())
+    return;
+  const parsed = readJsonObject(path);
+  if (!parsed || parsed.schemaVersion !== DEVELOPER_REVIEW_RUN_OWNER_SCHEMA_VERSION)
+    return;
+  if (typeof parsed.runId !== "string" || typeof parsed.challengeId !== "string")
+    return;
+  if (typeof parsed.manifestPath !== "string" || typeof parsed.lockPath !== "string")
+    return;
+  return parsed;
+}
+function developerReviewRunNotOwned(reason) {
+  return new Error(`developer-review-run-not-owned: ${reason}`);
+}
+function resolveOwnedDeveloperReviewRunTargets(run) {
+  const safeChallengeId = safeControlFileSegment(run.challengeId);
+  const runIdSuffix = run.runId.startsWith(`${safeChallengeId}-`) ? run.runId.slice(safeChallengeId.length + 1) : undefined;
+  if (!runIdSuffix || !DEVELOPER_REVIEW_RUN_ID_SUFFIX.test(runIdSuffix))
+    throw developerReviewRunNotOwned("run-id");
+  const stateDir = defaultDeveloperReviewRunStateDir(run.sourceRoot);
+  const manifestPath = join9(stateDir, `${safeChallengeId}.json`);
+  const lockPath = join9(stateDir, `${safeChallengeId}.lock`);
+  if (resolve18(run.manifestPath) !== manifestPath)
+    throw developerReviewRunNotOwned("manifest-path");
+  if (resolve18(run.lockPath) !== lockPath)
+    throw developerReviewRunNotOwned("lock-path");
+  const runRoot = resolve18(run.runRoot);
+  const runRootPrefix = `${DEVELOPER_REVIEW_RUN_ROOT_PREFIX}${safeChallengeId.slice(0, 32)}-`;
+  const runRootName = basename6(runRoot);
+  if (!runRootName.startsWith(runRootPrefix) || !DEVELOPER_REVIEW_RUN_ROOT_SUFFIX.test(runRootName.slice(runRootPrefix.length))) {
+    throw developerReviewRunNotOwned("run-root-name");
+  }
+  const worktreeTempRoot = join9(runRoot, "worktrees");
+  if (resolve18(run.worktreeTempRoot) !== worktreeTempRoot)
+    throw developerReviewRunNotOwned("worktree-temp-root");
+  if (resolve18(run.codeGraphTemporaryState.root) !== runRoot)
+    throw developerReviewRunNotOwned("codegraph-temporary-state-root");
+  const runRootStats = lstatIfExists(runRoot);
+  if (!runRootStats)
+    return { stateDir, manifestPath, lockPath };
+  if (!runRootStats.isDirectory())
+    throw developerReviewRunNotOwned("run-root-not-a-directory");
+  const marker = readDeveloperReviewRunOwnerMarker(join9(runRoot, DEVELOPER_REVIEW_RUN_OWNER_MARKER_FILE));
+  if (!marker)
+    throw developerReviewRunNotOwned("run-root-owner-marker-missing");
+  if (marker.runId !== run.runId || marker.challengeId !== run.challengeId)
+    throw developerReviewRunNotOwned("run-root-owner-marker-mismatch");
+  if (marker.manifestPath !== manifestPath || marker.lockPath !== lockPath)
+    throw developerReviewRunNotOwned("run-root-owner-marker-mismatch");
+  if (!run.worktree)
+    return { stateDir, manifestPath, lockPath, runRoot };
+  const temporaryRoot = resolve18(run.worktree.temporaryRoot);
+  const worktreeRoot = resolve18(run.worktree.worktreeRoot);
+  if (!isContainedPath(worktreeTempRoot, temporaryRoot))
+    throw developerReviewRunNotOwned("worktree-temporary-root");
+  if (!isContainedPath(temporaryRoot, worktreeRoot))
+    throw developerReviewRunNotOwned("worktree-root");
+  if (defaultDeveloperReviewRunStateDir(run.worktree.sourceRoot) !== stateDir)
+    throw developerReviewRunNotOwned("worktree-source-root");
+  return { stateDir, manifestPath, lockPath, runRoot, worktree: { ...run.worktree, temporaryRoot, worktreeRoot } };
+}
+function isContainedPath(parent, child) {
+  return child === parent || child.startsWith(parent.endsWith(sep7) ? parent : `${parent}${sep7}`);
+}
+function lstatIfExists(path) {
+  try {
+    return lstatSync7(path);
+  } catch {
+    return;
+  }
+}
 function safeControlFileSegment(value) {
   const sanitized = value.replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 80);
   return sanitized.length > 0 ? sanitized : "developer-review";
@@ -33257,9 +33999,7 @@ function appendExternalDocumentationToContext(context, resource, candidate, maxB
   const resources = context.resources.some((entry) => entry.uri === resource.uri) ? context.resources : [...context.resources, externalResource];
   const unknown = `External documentation is advisory and untrusted for ${candidate.packageName}@${candidate.version}: ${candidate.intent}`;
   const unknowns = context.unknowns.includes(unknown) ? context.unknowns : [...context.unknowns, unknown];
-  const extensionWithoutDigest = { ...context.extensions };
-  delete extensionWithoutDigest.digest;
-  const withoutDigest = {
+  const augmented = {
     ...context,
     unknowns,
     resources,
@@ -33278,7 +34018,7 @@ function appendExternalDocumentationToContext(context, resource, candidate, maxB
       }
     },
     extensions: {
-      ...extensionWithoutDigest,
+      ...context.extensions,
       externalDocumentationDigest: digestJson({
         provider: resource.provider,
         libraryId: candidate.libraryId,
@@ -33289,22 +34029,7 @@ function appendExternalDocumentationToContext(context, resource, candidate, maxB
       })
     }
   };
-  const byteLength = Buffer.byteLength(JSON.stringify(withoutDigest), "utf8");
-  const withMetadata = {
-    ...withoutDigest,
-    extensions: {
-      ...withoutDigest.extensions,
-      byteLength,
-      budgetExceeded: byteLength > maxBytes
-    }
-  };
-  return {
-    ...withMetadata,
-    extensions: {
-      ...withMetadata.extensions,
-      digest: digestJson(withMetadata)
-    }
-  };
+  return finalizeContextBudgetMetadata(augmented, maxBytes);
 }
 function prepareContextHasVersionRelatedUnknown(context) {
   const unknowns = context.unknowns.join(" ").toLowerCase();
@@ -33402,15 +34127,22 @@ function isExactPackageVersion(value) {
   return /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(value);
 }
 function readContext7Lockfile(root) {
-  const path = resolve18(root, CONTEXT7_LOCKFILE);
+  return readContext7LockfileState(root).lock;
+}
+function readContext7LockfileState(root) {
+  const path = assertPathHasNoSymlinkSegments(root, CONTEXT7_LOCKFILE);
   if (!existsSync15(path)) {
     return {
-      schemaVersion: CONTEXT7_LOCKFILE_SCHEMA_VERSION,
-      provider: "context7",
-      libraries: []
+      lock: {
+        schemaVersion: CONTEXT7_LOCKFILE_SCHEMA_VERSION,
+        provider: "context7",
+        libraries: []
+      },
+      expectedHash: "missing"
     };
   }
-  const parsed = JSON.parse(readFileSync14(path, "utf8"));
+  const body = readFileSync14(path, "utf8");
+  const parsed = JSON.parse(body);
   if (parsed.schemaVersion !== CONTEXT7_LOCKFILE_SCHEMA_VERSION || parsed.provider !== "context7" || !Array.isArray(parsed.libraries)) {
     throw new Error("Invalid Context7 lockfile");
   }
@@ -33419,8 +34151,11 @@ function readContext7Lockfile(root) {
     assertContext7Version(library.version);
   }
   return {
-    ...parsed,
-    libraries: [...parsed.libraries].sort((a, b) => a.libraryId.localeCompare(b.libraryId))
+    lock: {
+      ...parsed,
+      libraries: [...parsed.libraries].sort((a, b) => a.libraryId.localeCompare(b.libraryId))
+    },
+    expectedHash: digestJson({ body })
   };
 }
 function upsertContext7Pin(lock, pin) {
@@ -33430,8 +34165,14 @@ function upsertContext7Pin(lock, pin) {
     libraries: [...lock.libraries.filter((library) => library.libraryId !== pin.libraryId), pin].sort((a, b) => a.libraryId.localeCompare(b.libraryId))
   };
 }
-function writeContext7Lockfile(root, lock) {
-  writePrivateJson3(resolve18(root, CONTEXT7_LOCKFILE), lock);
+function writeContext7Lockfile(root, lock, expectedHash) {
+  writeFileWithoutFollowingSymlinks({
+    root,
+    path: CONTEXT7_LOCKFILE,
+    body: JSON.stringify(lock, null, 2),
+    mode: 384,
+    expectedHash
+  });
 }
 function writeDeveloperReviewRunManifest(manifest) {
   writePrivateJson3(manifest.manifestPath, manifest);
@@ -33439,25 +34180,192 @@ function writeDeveloperReviewRunManifest(manifest) {
 function writePrivateJson3(path, value, flag = "w") {
   mkdirSync7(dirname10(path), { recursive: true });
   writeFileSync6(path, JSON.stringify(value, null, 2), { mode: 384, flag });
-  chmodSync3(path, 384);
+  chmodSync4(path, 384);
 }
 function readDeveloperReviewRunManifest(path) {
-  const parsed = readJsonObject(path);
-  if (!parsed || parsed.schemaVersion !== "archcontext.developer-review-run/v1")
-    return;
-  if (typeof parsed.runId !== "string" || typeof parsed.challengeId !== "string")
-    return;
-  if (typeof parsed.repositoryId !== "number" || typeof parsed.sourceRoot !== "string")
-    return;
-  if (typeof parsed.runRoot !== "string" || typeof parsed.worktreeTempRoot !== "string")
-    return;
-  if (typeof parsed.manifestPath !== "string" || typeof parsed.lockPath !== "string")
-    return;
-  if (typeof parsed.pid !== "number" || typeof parsed.createdAt !== "string")
-    return;
-  if (parsed.status !== "preparing" && parsed.status !== "running")
+  try {
+    return decodeDeveloperReviewRunManifest(readJsonObject(path), "developer-review-run-manifest");
+  } catch {
     return;
-  return parsed;
+  }
+}
+function rpcInputInvalid(context, detail) {
+  return new Error(`runtime-rpc-input-invalid: ${context} ${detail}`);
+}
+function decodeRpcRecord(value, context, label, allowedKeys) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw rpcInputInvalid(context, `${label} must be an object`);
+  const record2 = value;
+  for (const key of Object.keys(record2)) {
+    if (!allowedKeys.includes(key))
+      throw rpcInputInvalid(context, `${label} has unknown field ${key}`);
+  }
+  return record2;
+}
+function rpcString(record2, context, label) {
+  const value = record2[label];
+  if (typeof value !== "string" || value.length === 0)
+    throw rpcInputInvalid(context, `${label} must be a non-empty string`);
+  return value;
+}
+function rpcOptionalString(record2, context, label) {
+  return record2[label] === undefined ? undefined : rpcString(record2, context, label);
+}
+function rpcNumber(record2, context, label) {
+  const value = record2[label];
+  if (typeof value !== "number" || !Number.isFinite(value))
+    throw rpcInputInvalid(context, `${label} must be a number`);
+  return value;
+}
+function rpcLiteral(record2, context, label, allowed) {
+  const value = record2[label];
+  if (typeof value !== "string" || !allowed.includes(value))
+    throw rpcInputInvalid(context, `${label} is not an accepted value`);
+  return value;
+}
+function decodeRpcReviewChallengeV2(value, context) {
+  const record2 = decodeRpcRecord(value, context, "challenge", [
+    "schemaVersion",
+    "challengeId",
+    "installationId",
+    "repositoryId",
+    "pullRequestNumber",
+    "headSha",
+    "baseSha",
+    "nonce",
+    "requiredTrust",
+    "policyProfileId",
+    "createdAt",
+    "expiresAt",
+    "status"
+  ]);
+  return {
+    schemaVersion: rpcLiteral(record2, context, "schemaVersion", ["archcontext.review-challenge/v2"]),
+    challengeId: rpcString(record2, context, "challengeId"),
+    installationId: rpcNumber(record2, context, "installationId"),
+    repositoryId: rpcNumber(record2, context, "repositoryId"),
+    pullRequestNumber: rpcNumber(record2, context, "pullRequestNumber"),
+    headSha: rpcString(record2, context, "headSha"),
+    baseSha: rpcString(record2, context, "baseSha"),
+    nonce: rpcString(record2, context, "nonce"),
+    requiredTrust: rpcLiteral(record2, context, "requiredTrust", ["developer", "organization"]),
+    policyProfileId: rpcString(record2, context, "policyProfileId"),
+    createdAt: rpcString(record2, context, "createdAt"),
+    expiresAt: rpcString(record2, context, "expiresAt"),
+    status: rpcLiteral(record2, context, "status", ["PENDING", "LEASED", "SUBMITTED", "VERIFIED", "REJECTED", "SUPERSEDED", "EXPIRED"])
+  };
+}
+function decodeRpcDetachedReviewWorktree(value, context, label = "worktree") {
+  const record2 = decodeRpcRecord(value, context, label, [
+    "schemaVersion",
+    "sourceRoot",
+    "worktreeRoot",
+    "temporaryRoot",
+    "headSha",
+    "headTreeOid",
+    "detached",
+    "clean"
+  ]);
+  if (record2.detached !== true)
+    throw rpcInputInvalid(context, `${label}.detached must be true`);
+  if (record2.clean !== true)
+    throw rpcInputInvalid(context, `${label}.clean must be true`);
+  return {
+    schemaVersion: rpcLiteral(record2, context, "schemaVersion", ["archcontext.detached-review-worktree/v1"]),
+    sourceRoot: rpcString(record2, context, "sourceRoot"),
+    worktreeRoot: rpcString(record2, context, "worktreeRoot"),
+    temporaryRoot: rpcString(record2, context, "temporaryRoot"),
+    headSha: rpcString(record2, context, "headSha"),
+    headTreeOid: rpcString(record2, context, "headTreeOid"),
+    detached: true,
+    clean: true
+  };
+}
+function decodeDeveloperReviewRunManifest(value, context) {
+  const record2 = decodeRpcRecord(value, context, "run", [
+    "schemaVersion",
+    "runId",
+    "challengeId",
+    "repositoryId",
+    "sourceRoot",
+    "runRoot",
+    "worktreeTempRoot",
+    "manifestPath",
+    "lockPath",
+    "pid",
+    "createdAt",
+    "status",
+    "codeGraphTemporaryState",
+    "worktree"
+  ]);
+  const codeGraphTemporaryState = decodeRpcRecord(record2.codeGraphTemporaryState, context, "run.codeGraphTemporaryState", ["root", "cleanup"]);
+  return {
+    schemaVersion: rpcLiteral(record2, context, "schemaVersion", ["archcontext.developer-review-run/v1"]),
+    runId: rpcString(record2, context, "runId"),
+    challengeId: rpcString(record2, context, "challengeId"),
+    repositoryId: rpcNumber(record2, context, "repositoryId"),
+    sourceRoot: rpcString(record2, context, "sourceRoot"),
+    runRoot: rpcString(record2, context, "runRoot"),
+    worktreeTempRoot: rpcString(record2, context, "worktreeTempRoot"),
+    manifestPath: rpcString(record2, context, "manifestPath"),
+    lockPath: rpcString(record2, context, "lockPath"),
+    pid: rpcNumber(record2, context, "pid"),
+    createdAt: rpcString(record2, context, "createdAt"),
+    status: rpcLiteral(record2, context, "status", ["preparing", "running"]),
+    codeGraphTemporaryState: {
+      root: rpcString(codeGraphTemporaryState, context, "root"),
+      cleanup: rpcLiteral(codeGraphTemporaryState, context, "cleanup", ["remove-run-root"])
+    },
+    ...record2.worktree === undefined ? {} : { worktree: decodeRpcDetachedReviewWorktree(record2.worktree, context, "run.worktree") }
+  };
+}
+function decodeStartDeveloperReviewRunParams(params) {
+  const context = "startDeveloperReviewRun";
+  const record2 = decodeRpcRecord(params[0], context, "params[0]", ["repositoryRoot", "challenge", "expectedHeadTreeOid"]);
+  const expectedHeadTreeOid = rpcOptionalString(record2, context, "expectedHeadTreeOid");
+  return {
+    repositoryRoot: rpcString(record2, context, "repositoryRoot"),
+    challenge: decodeRpcReviewChallengeV2(record2.challenge, context),
+    ...expectedHeadTreeOid === undefined ? {} : { expectedHeadTreeOid }
+  };
+}
+function decodeSignedDeveloperReviewAttestationParams(params) {
+  const context = "runSignedDeveloperReviewAttestation";
+  const record2 = decodeRpcRecord(params[0], context, "params[0]", [
+    "challenge",
+    "worktree",
+    "keyRef",
+    "principalId",
+    "publicKeyId",
+    "taskSessionId",
+    "mergeBaseSha",
+    "startedAt",
+    "completedAt"
+  ]);
+  const optional = {
+    taskSessionId: rpcOptionalString(record2, context, "taskSessionId"),
+    mergeBaseSha: rpcOptionalString(record2, context, "mergeBaseSha"),
+    startedAt: rpcOptionalString(record2, context, "startedAt"),
+    completedAt: rpcOptionalString(record2, context, "completedAt")
+  };
+  return {
+    challenge: decodeRpcReviewChallengeV2(record2.challenge, context),
+    worktree: decodeRpcDetachedReviewWorktree(record2.worktree, context),
+    keyRef: rpcString(record2, context, "keyRef"),
+    principalId: rpcString(record2, context, "principalId"),
+    publicKeyId: rpcString(record2, context, "publicKeyId"),
+    ...Object.fromEntries(Object.entries(optional).filter(([, value]) => value !== undefined))
+  };
+}
+function decodeRecoverDeveloperReviewRunsParams(params) {
+  const context = "recoverDeveloperReviewRuns";
+  const record2 = decodeRpcRecord(params[0], context, "params[0]", ["repositoryRoot", "force"]);
+  if (record2.force !== undefined && typeof record2.force !== "boolean")
+    throw rpcInputInvalid(context, "force must be a boolean");
+  return {
+    repositoryRoot: rpcString(record2, context, "repositoryRoot"),
+    ...record2.force === undefined ? {} : { force: record2.force }
+  };
 }
 function readJsonObject(path) {
   try {
@@ -33642,33 +34550,42 @@ function readCurrentBranch(root) {
   }
 }
 function repositoryNameWithOwner(root) {
+  const target = readGitRemoteTarget(root);
+  return target ? `${target.owner}/${target.repo}` : "local/unknown";
+}
+var SUPPORTED_GITHUB_REMOTE_HOST = "github.com";
+function readGitRemoteTarget(root) {
   try {
     const url = execFileSync7("git", ["remote", "get-url", "origin"], {
       cwd: root,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
-    return parseGitRemoteOwnerRepo(url) ?? "local/unknown";
+    return parseGitRemoteTarget(url);
   } catch {
-    return "local/unknown";
+    return;
   }
 }
-function parseGitRemoteOwnerRepo(url) {
+function parseGitRemoteTarget(url) {
   const stripped = url.trim().replace(/\.git$/, "");
-  const scpMatch = /^[^/@]+@[^:/]+:(.+)$/.exec(stripped);
+  const scpMatch = /^[^/@]+@([^:/]+):(.+)$/.exec(stripped);
   if (scpMatch)
-    return normalizeOwnerRepoPath(scpMatch[1]);
+    return gitRemoteTarget(scpMatch[1], scpMatch[2]);
   try {
-    return normalizeOwnerRepoPath(new URL(stripped).pathname);
+    const parsed = new URL(stripped);
+    return gitRemoteTarget(parsed.hostname, parsed.pathname);
   } catch {
     return;
   }
 }
-function normalizeOwnerRepoPath(path) {
+function gitRemoteTarget(host, path) {
+  const canonicalHost = host.trim().toLowerCase();
+  if (!canonicalHost)
+    return;
   const segments = path.split("/").map((segment) => segment.trim()).filter(Boolean);
   if (segments.length < 2)
     return;
-  return segments.slice(-2).join("/");
+  return { host: canonicalHost, owner: segments[segments.length - 2], repo: segments[segments.length - 1] };
 }
 function normalizeGithubRepoVisibility(value) {
   const lowered = value.trim().toLowerCase();
@@ -33684,6 +34601,10 @@ function auditApproveResultPayload(runId, status, totalCount, issuedIssues) {
     issuedIssues
   };
 }
+function obsoleteManagedProjectionPaths(currentFiles, projectedFiles) {
+  const targetPaths = new Set(projectedFiles.map((file) => file.path));
+  return currentFiles.filter((file) => !targetPaths.has(file.path)).map((file) => file.path);
+}
 function expectedFileHash(root, path) {
   const absolute = resolve18(root, path);
   return existsSync15(absolute) ? digestJson({ body: readFileSync14(absolute, "utf8") }) : "missing";
@@ -33978,13 +34899,63 @@ function isRpcVersionHeaderCompatible(request) {
   const header = requestRpcVersionHeader(request);
   return header === undefined || header === RUNTIME_RPC_VERSION;
 }
-async function readRequestJson(request) {
-  const chunks = [];
-  for await (const chunk of request)
-    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-  if (chunks.length === 0)
-    return {};
-  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+async function readRpcRequestBody(request, limits) {
+  const declaredLength = Number(request.headers["content-length"]);
+  if (Number.isFinite(declaredLength) && declaredLength > limits.maxBytes) {
+    request.pause();
+    return { ok: false, kind: "rejected", status: 413, error: "runtime RPC request body exceeds the configured limit" };
+  }
+  return await new Promise((resolveBody) => {
+    let chunks = [];
+    let size = 0;
+    let settled = false;
+    const timer = setTimeout(() => {
+      settle({ ok: false, kind: "rejected", status: 408, error: "runtime RPC request body read timeout" });
+    }, limits.timeoutMs);
+    const settle = (result) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      chunks = [];
+      request.off("data", onData);
+      request.off("end", onEnd);
+      request.off("aborted", onAborted);
+      request.off("error", onAborted);
+      request.off("close", onClose);
+      if (!result.ok)
+        request.pause();
+      resolveBody(result);
+    };
+    const onData = (chunk) => {
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      size += buffer.length;
+      if (size > limits.maxBytes) {
+        settle({ ok: false, kind: "rejected", status: 413, error: "runtime RPC request body exceeds the configured limit" });
+        return;
+      }
+      chunks.push(buffer);
+    };
+    const onEnd = () => {
+      if (size === 0) {
+        settle({ ok: true, value: {} });
+        return;
+      }
+      const body = Buffer.concat(chunks).toString("utf8");
+      try {
+        settle({ ok: true, value: JSON.parse(body) });
+      } catch {
+        settle({ ok: false, kind: "rejected", status: 400, error: "runtime RPC request body is not valid JSON" });
+      }
+    };
+    const onAborted = () => settle({ ok: false, kind: "aborted" });
+    const onClose = () => settle({ ok: false, kind: "aborted" });
+    request.on("data", onData);
+    request.on("end", onEnd);
+    request.on("aborted", onAborted);
+    request.on("error", onAborted);
+    request.on("close", onClose);
+  });
 }
 function writeJson(response, statusCode, body) {
   response.writeHead(statusCode, { "Content-Type": "application/json; charset=utf-8" });
@@ -34140,20 +35111,82 @@ function structurizrElementType(kind) {
 init_src();
 
 // packages/local-runtime/runtime-daemon/src/index.ts
-import { chmodSync as chmodSync4, closeSync as closeSync7, existsSync as existsSync16, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync5, openSync as openSync7, readdirSync as readdirSync10, readFileSync as readFileSync15, rmSync as rmSync9, statSync as statSync10, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync5, closeSync as closeSync7, existsSync as existsSync16, lstatSync as lstatSync8, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync5, openSync as openSync7, readdirSync as readdirSync10, readFileSync as readFileSync15, rmSync as rmSync9, statSync as statSync10, writeFileSync as writeFileSync7 } from "node:fs";
+init_src();
 init_src();
 var DEFAULT_DAEMON_IDLE_TIMEOUT_MS2 = 30 * 60000;
 var RUNTIME_RPC_VERSION2 = LOCAL_RUNTIME_RPC_SCHEMA_VERSION;
+var RUNTIME_RPC_MAX_REQUEST_BODY_BYTES2 = 16 * 1024 * 1024;
+class RuntimeRpcTransportError2 extends Error {
+  code;
+  method;
+  timeoutMs;
+  elapsedMs;
+  constructor(code, method, timeoutMs, elapsedMs) {
+    super(code === "RPC_TIMEOUT" ? `runtime RPC timeout: ${method} exceeded ${timeoutMs}ms` : `runtime RPC cancelled: ${method} aborted after ${elapsedMs}ms`);
+    this.code = code;
+    this.method = method;
+    this.timeoutMs = timeoutMs;
+    this.elapsedMs = elapsedMs;
+    this.name = "RuntimeRpcTransportError";
+  }
+}
+var RUNTIME_RPC_CLIENT_TIMEOUT_POLICY2 = {
+  health: 5000,
+  short: 15000,
+  normal: 120000,
+  long: 900000
+};
+var RUNTIME_RPC_SHORT_METHODS2 = new Set([
+  "shutdown",
+  "runtimeStatus",
+  "landscapeStatus",
+  "repoList",
+  "explorerStatus",
+  "explorerServiceContract",
+  "jobsList",
+  "jobsStats",
+  "ledgerState",
+  "ledgerDrift",
+  "stopExplorer",
+  "revokeExplorerToken"
+]);
+var RUNTIME_RPC_LONG_METHODS2 = new Set([
+  "init",
+  "sync",
+  "prepare",
+  "context",
+  "checkpoint",
+  "auditRun",
+  "auditApprove",
+  "recommendations",
+  "book",
+  "ledgerRebuild",
+  "ledgerMigrate",
+  "startDeveloperReviewRun",
+  "runSignedDeveloperReviewAttestation"
+]);
+function runtimeRpcMethodTimeout2(method, policy) {
+  if (RUNTIME_RPC_SHORT_METHODS2.has(method))
+    return policy.short;
+  if (RUNTIME_RPC_LONG_METHODS2.has(method))
+    return policy.long;
+  return policy.normal;
+}
+
 class RuntimeRpcClient2 {
   connection;
-  constructor(connection) {
+  options;
+  timeouts;
+  constructor(connection, options = {}) {
     this.connection = connection;
+    this.options = options;
+    this.timeouts = { ...RUNTIME_RPC_CLIENT_TIMEOUT_POLICY2, ...options.timeouts };
   }
   async health() {
-    const response = await fetch(`${this.connection.url}health`, {
+    return await this.request("health", this.timeouts.health, `${this.connection.url}health`, {
       headers: { "X-ArchContext-RPC-Version": RUNTIME_RPC_VERSION2 }
     });
-    return await response.json();
   }
   async shutdown() {
     return this.call("shutdown", []);
@@ -34237,8 +35270,11 @@ class RuntimeRpcClient2 {
   applyUpdate(root, input) {
     return this.call("applyUpdate", [root, input]);
   }
-  reconcileProjectionApply(root, lookupKey) {
-    return this.call("reconcileProjectionApply", [root, lookupKey]);
+  inspectProjectionApplyReceipt(root, lookupKey) {
+    return this.call("inspectProjectionApplyReceipt", [root, lookupKey]);
+  }
+  recoverProjectionApply(root, intent) {
+    return this.call("recoverProjectionApply", [root, intent]);
   }
   ledgerState(root) {
     return this.call("ledgerState", [root]);
@@ -34316,7 +35352,7 @@ class RuntimeRpcClient2 {
     return unwrapRpcData2(await this.call("recoverDeveloperReviewRuns", [input]));
   }
   async call(method, params) {
-    const response = await fetch(`${this.connection.url}rpc`, {
+    return await this.request(method, runtimeRpcMethodTimeout2(method, this.timeouts), `${this.connection.url}rpc`, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${this.connection.token}`,
@@ -34325,7 +35361,35 @@ class RuntimeRpcClient2 {
       },
       body: JSON.stringify({ schemaVersion: RUNTIME_RPC_VERSION2, method, params })
     });
-    return await response.json();
+  }
+  async request(method, timeoutMs, url, init) {
+    const controller = new AbortController;
+    const startedAt = Date.now();
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, timeoutMs);
+    const callerSignal = this.options.signal;
+    const onCallerAbort = () => controller.abort();
+    if (callerSignal?.aborted)
+      controller.abort();
+    else
+      callerSignal?.addEventListener("abort", onCallerAbort, { once: true });
+    try {
+      const response = await fetch(url, { ...init, signal: controller.signal });
+      return await response.json();
+    } catch (error) {
+      const elapsedMs = Date.now() - startedAt;
+      if (timedOut)
+        throw new RuntimeRpcTransportError2("RPC_TIMEOUT", method, timeoutMs, elapsedMs);
+      if (callerSignal?.aborted)
+        throw new RuntimeRpcTransportError2("RPC_ABORTED", method, timeoutMs, elapsedMs);
+      throw error;
+    } finally {
+      clearTimeout(timer);
+      callerSignal?.removeEventListener("abort", onCallerAbort);
+    }
   }
 }
 function defaultDaemonConnectionPath2(root = process.cwd()) {
@@ -35100,7 +36164,7 @@ async function runCliUnchecked(command2 = "help", args2 = [], cwd, deps = {}) {
           requestId: "help",
           data: {
             commands: ["capabilities", "projection", "init", "sync", "validate", "context", "status", "daemon", "state", "repo", "landscape", "ledger", "book", "recommendations", "explore", "prepare", "practices", "checkpoint", "hook", "hooks", "investigate", "agents", "jobs", "audit", "plan", "apply", "review", "complete", "github", "config", "mcp", "install", "uninstall", "doctor", "update", "paths", "privacy-audit", "export", "import", "resolve", "tunnel"],
-            examples: ["archctx init --name MyApp", "archctx state recover --from-git", "archctx ledger migrate --from-yaml --dry-run", "archctx ledger promote --mode authoritative --preflight --rollback-plan", "archctx book recommendations --open --explain", "archctx recommendations accept --id recommendation.<id> --reason 'Accepted after local readback.'", "archctx recommendations metrics", "archctx practices validate --strict", "archctx practices list --json", "archctx practices waivers", "archctx practices waive --practice-id modularity.no-new-cycle --owner team-architecture --reason 'External migration window requires this edge until cutover.' --review-at 2026-07-10T00:00:00.000Z --expires-at 2026-07-24T00:00:00.000Z --evidence-digest sha256:<64-hex> --subject module.a->module.b", "archctx checkpoint --task-session-id task_cli", "archctx investigate --runner-port codex", "archctx agents status --status queued,running", "archctx agents budget", "archctx hook enqueue --event post-edit --path src/app.ts", "archctx jobs list --status queued", "archctx audit run --reason 'quarterly architecture audit'", "archctx audit run --no-wait", "archctx audit list --status pending", "archctx audit show audit_run.<id>", "archctx audit approve audit_run.<id>", "archctx audit approve audit_run.<id> --confirm-public-repo public:<owner/repo>:<baseSha>:<runId>", "archctx audit approve audit_run.<id> --resume", "archctx hooks install --host codex", "archctx paths", "archctx update --check", "archctx doctor --check-updates", "archctx github connect", "archctx github status", "archctx daemon start", "archctx explore start --foreground", "archctx export likec4", "archctx import structurizr --content '<json>'", "archctx resolve --path packages/core/projection-engine/src/index.ts", "archctx tunnel"]
+            examples: ["archctx init --name MyApp", "archctx state recover --from-git", "archctx ledger migrate --from-yaml --dry-run", "archctx ledger promote --mode authoritative --preflight --rollback-plan", "archctx book recommendations --open --explain", "archctx recommendations accept --id recommendation.<id> --reason 'Accepted after local readback.'", "archctx recommendations metrics", "archctx practices validate --strict", "archctx practices list --json", "archctx practices waivers", "archctx practices waive --practice-id modularity.no-new-cycle --owner team-architecture --reason 'External migration window requires this edge until cutover.' --review-at 2026-07-10T00:00:00.000Z --expires-at 2026-07-24T00:00:00.000Z --evidence-digest sha256:<64-hex> --subject module.a->module.b", "archctx checkpoint --task-session-id task_cli", "archctx investigate --runner-port codex", "archctx agents status --status queued,running", "archctx agents budget", "archctx hook enqueue --event post-edit --path src/app.ts", "archctx jobs list --status queued", "archctx audit run --reason 'quarterly architecture audit'", "archctx audit run --no-wait", "archctx audit list --status pending", "archctx audit show audit_run.<id>", "archctx audit approve audit_run.<id>", "archctx audit approve audit_run.<id> --confirm-public-repo public:<host>/<owner>/<repo>:<baseSha>:<runId>", "archctx audit approve audit_run.<id> --resume", "archctx hooks install --host codex", "archctx paths", "archctx update --check", "archctx doctor --check-updates", "archctx github connect", "archctx github status", "archctx daemon start", "archctx explore start --foreground", "archctx export likec4", "archctx import structurizr --content '<json>'", "archctx resolve --path packages/core/projection-engine/src/index.ts", "archctx tunnel"]
           }
         };
     }
@@ -35792,9 +36856,11 @@ async function runArchitectureDocsAdoptionCommand(args2, root, daemon, projectio
   });
 }
 async function runProjectionProtocolCommand(args2, cwd, daemon) {
-  if ((args2[0] ?? "run") !== "run") {
-    return errorEnvelope("projection", "AC_SCHEMA_INVALID", "projection requires run --request-json <ProjectionRequestV1>");
-  }
+  const subcommand = args2[0] ?? "run";
+  if (subcommand === "recover")
+    return runProjectionApplyRecoveryCommand(args2.slice(1), cwd, daemon);
+  if (subcommand !== "run")
+    return errorEnvelope("projection", "AC_SCHEMA_INVALID", "projection requires run|recover --request-json <request>");
   const raw = readFlag(args2, "--request-json");
   if (!raw)
     return errorEnvelope("projection.run", "AC_SCHEMA_INVALID", "projection run requires --request-json");
@@ -35809,21 +36875,19 @@ async function runProjectionProtocolCommand(args2, cwd, daemon) {
   if (request.mode === "apply" && request.acceptedChange) {
     try {
       assertProjectionExpectedSnapshotAgainstModel(request, root, loadNativeModelFromArchContext(root));
+      const inspected = await daemon.inspectProjectionApplyReceipt(root, projectionApplyLookupKey({
+        repositoryId: request.expected.repositoryId,
+        workspaceId: request.expected.workspaceId,
+        acceptedChange: request.acceptedChange
+      }));
+      if (!inspected.ok)
+        return inspected;
+      if (inspected.data.found === true) {
+        return errorEnvelope("projection.run", "AC_PRECONDITION_FAILED", "committed projection receipt requires explicit projection recover");
+      }
     } catch (error) {
       return errorEnvelope("projection.run", "AC_PRECONDITION_FAILED", error instanceof Error ? error.message : String(error));
     }
-    const reconciled = await daemon.reconcileProjectionApply(root, projectionApplyLookupKey({
-      repositoryId: request.expected.repositoryId,
-      workspaceId: request.expected.workspaceId,
-      acceptedChange: request.acceptedChange
-    }));
-    if (!reconciled.ok)
-      return reconciled;
-    const data = reconciled.data;
-    if (data.found === true) {
-      const receipt = data.receipt;
-      return projectionProtocolResultEnvelope(data.refreshSignalsDelivered === true ? projectionResultDelivery(receipt.result, "applied", receipt.result.refreshSignals, request.requestId) : projectionResultDelivery(receipt.result, "noop", [], request.requestId));
-    }
   }
   let projection3;
   try {
@@ -35864,21 +36928,51 @@ async function runProjectionProtocolCommand(args2, cwd, daemon) {
   }
   if (request.mode === "apply" && !projection3.plan.drift.ok) {
     const changeSetId = `changeset.docs-projection-${projection3.plan.projectionDigest.replace(/^sha256:/, "").slice(0, 16)}`;
+    let fixedPointProjection;
+    try {
+      fixedPointProjection = request.acceptedChange ? buildArchitectureDocsProjection(root, generatedAt, REPO_HARNESS_PROJECTION_PROFILE, projection3.files) : projection3;
+      if (request.acceptedChange && (fixedPointProjection.plan.rejected.length > 0 || fixedPointProjection.plan.majorChange.mode !== "none" || fixedPointProjection.plan.refreshSignals.length > 0)) {
+        return errorEnvelope("projection.run", "AC_PRECONDITION_FAILED", "accepted projection did not produce a no-accepted-change semantic fixed point");
+      }
+    } catch (error) {
+      return errorEnvelope("projection.run", "AC_PRECONDITION_FAILED", error instanceof Error ? error.message : String(error));
+    }
+    const committedFiles = projectionProtocolFilesForExpectedOutput(root, fixedPointProjection);
+    const committedSignals = request.acceptedChange ? projection3.plan.refreshSignals.map((signal) => ({
+      ...signal,
+      resultingDigests: fixedPointProjection.plan.architectureDigests
+    })) : fixedPointProjection.plan.refreshSignals;
     const applyIdentity = request.acceptedChange ? createProjectionApplyIdentity({
       repositoryId: request.expected.repositoryId,
       workspaceId: request.expected.workspaceId,
       acceptedChange: request.acceptedChange,
       changeSetId,
       idempotencyKey: `idem_${changeSetId}`,
-      files: projectionProtocolFiles(projection3),
-      refreshSignals: projection3.plan.refreshSignals
+      files: committedFiles,
+      refreshSignals: committedSignals
     }) : undefined;
-    const appliedResult = projectionProtocolResult(request, projection3, "applied", projection3, applyIdentity);
-    const applyReceipt = applyIdentity ? { schemaVersion: "archcontext.projection-apply-receipt/v1", identity: applyIdentity, result: appliedResult } : undefined;
+    const appliedResult = projectionProtocolResult(request, projection3, "applied", fixedPointProjection, applyIdentity, {
+      files: committedFiles,
+      refreshSignals: committedSignals
+    });
+    let recoveryBinding;
+    if (applyIdentity) {
+      try {
+        recoveryBinding = createProjectionApplyRecoveryBinding(request, fixedPointProjection, appliedResult);
+      } catch (error) {
+        return errorEnvelope("projection.run", "AC_PRECONDITION_FAILED", error instanceof Error ? error.message : String(error));
+      }
+    }
+    const applyReceipt = applyIdentity ? {
+      schemaVersion: "archcontext.projection-apply-receipt/v1",
+      identity: applyIdentity,
+      result: appliedResult,
+      recovery: recoveryBinding
+    } : undefined;
     const planned = await daemon.planUpdate(root, {
       id: changeSetId,
       reason: { taskSessionId: request.requestId },
-      operations: [architectureDocsRenderProjectionOperation(root, projection3.files)],
+      operations: [architectureDocsRenderProjectionOperation(root, fixedPointProjection.files)],
       worktreeDigestPrecondition: {
         profile: "architecture-documentation-projection",
         expectedDigest: request.expected.worktreeDigest
@@ -35912,18 +37006,120 @@ async function runProjectionProtocolCommand(args2, cwd, daemon) {
     if (!postApplyMatches) {
       return projectionProtocolResultEnvelope(projectionResultDelivery(appliedResult, "applied-reconcile-required", []));
     }
-    const reconciled = await daemon.reconcileProjectionApply(root, applyReceipt.identity.lookupKey);
-    if (!reconciled.ok)
-      return reconciled;
-    const consumption = reconciled.data;
-    if (consumption.found !== true || consumption.refreshSignalsDelivered !== true) {
+    const delivery = await daemon.recoverProjectionApply(root, {
+      schemaVersion: PROJECTION_APPLY_RECOVERY_INTENT_SCHEMA_VERSION,
+      requestId: request.requestId,
+      profile: REPO_HARNESS_PROJECTION_PROFILE,
+      receipt: {
+        lookupKey: applyReceipt.identity.lookupKey,
+        applyId: applyReceipt.identity.applyId
+      }
+    });
+    if (!delivery.ok)
+      return delivery;
+    const delivered = delivery.data;
+    if (delivered.found !== true || delivered.refreshSignalsDelivered !== true) {
       return errorEnvelope("projection.run", "AC_PRECONDITION_FAILED", "committed projection apply receipt was not available for first delivery");
     }
-    return projectionProtocolResultEnvelope(consumption.receipt.result);
+    return projectionProtocolResultEnvelope(projectionResultDelivery(appliedResult, "applied", delivered.receipt.result.refreshSignals, request.requestId));
   }
   const status = projection3.plan.drift.ok ? "noop" : "planned";
   return projectionProtocolEnvelope(request, projection3, status);
 }
+async function runProjectionApplyRecoveryCommand(args2, cwd, daemon) {
+  const raw = readFlag(args2, "--request-json");
+  if (!raw)
+    return errorEnvelope("projection.recover", "AC_SCHEMA_INVALID", "projection recover requires --request-json");
+  let intent;
+  try {
+    intent = parseProjectionApplyRecoveryIntent(raw);
+  } catch (error) {
+    return errorEnvelope("projection.recover", "AC_SCHEMA_INVALID", error instanceof Error ? error.message : String(error));
+  }
+  return recoverProjectionApplyIntent(intent, findRepositoryRoot(cwd), daemon);
+}
+async function recoverProjectionApplyIntent(intent, root, daemon) {
+  let recovered;
+  try {
+    recovered = await daemon.recoverProjectionApply(root, intent);
+  } catch (error) {
+    return errorEnvelope("projection.recover", "AC_PRECONDITION_FAILED", error instanceof Error ? error.message : String(error));
+  }
+  if (!recovered.ok)
+    return recovered;
+  const consumption = recovered.data;
+  if (consumption.found !== true || !consumption.receipt || !consumption.proof) {
+    return errorEnvelope("projection.recover", "AC_PRECONDITION_FAILED", "committed projection apply receipt was unavailable for recovery delivery");
+  }
+  return projectionApplyRecoveryResultEnvelope({
+    schemaVersion: PROJECTION_APPLY_RECOVERY_RESULT_SCHEMA_VERSION,
+    proof: consumption.proof,
+    refreshSignals: consumption.refreshSignalsDelivered ? consumption.receipt.result.refreshSignals : []
+  });
+}
+function createProjectionApplyRecoveryBinding(request, projection3, result) {
+  const provenance = projection3.plan.provenance;
+  return {
+    schemaVersion: "archcontext.projection-apply-recovery-binding/v1",
+    targets: [...request.targets],
+    changedPaths: [...request.changedPaths],
+    originalExpectedSnapshot: { ...request.expected },
+    expectedResultingDigests: projection3.plan.architectureDigests,
+    rendererVersion: provenance.rendererVersion,
+    layoutVersion: provenance.layoutVersion,
+    generatedFrom: provenance.generatedFrom,
+    ownedOutputDigest: projectionOwnedOutputDigest(projection3),
+    receiptDigest: result.receiptDigest
+  };
+}
+function projectionOwnedOutputDigest(projection3) {
+  return digestJson({
+    schemaVersion: "archcontext.projection-owned-output/v1",
+    files: projection3.files.map((file) => ({ path: file.path, body: file.body })).sort((left, right) => left.path.localeCompare(right.path))
+  });
+}
+function projectionApplyRecoveryResultEnvelope(result) {
+  const issues = projectionApplyRecoveryResultInvariantIssues(result);
+  return issues.length === 0 ? okEnvelope("projection.recover", result) : errorEnvelope("projection.recover", "AC_SCHEMA_INVALID", `projection recovery result invariant failed: ${issues.join("; ")}`);
+}
+function parseProjectionApplyRecoveryIntent(raw) {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new Error("projection recovery intent is not valid JSON");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("projection recovery intent must be an object");
+  const input = value;
+  const allowedKeys = new Set(["schemaVersion", "requestId", "profile", "receipt"]);
+  const unsupported = Object.keys(input).find((key) => !allowedKeys.has(key));
+  if (unsupported)
+    throw new Error(`projection recovery intent contains unsupported property: ${unsupported}`);
+  if (input.schemaVersion !== PROJECTION_APPLY_RECOVERY_INTENT_SCHEMA_VERSION)
+    throw new Error("projection recovery intent schemaVersion mismatch");
+  if (input.profile !== REPO_HARNESS_PROJECTION_PROFILE)
+    throw new Error(`projection recovery intent profile must be ${REPO_HARNESS_PROJECTION_PROFILE}`);
+  if (typeof input.requestId !== "string")
+    throw new Error("projection recovery intent requestId is required");
+  const receipt = input.receipt;
+  if (!receipt || typeof receipt !== "object" || Array.isArray(receipt))
+    throw new Error("projection recovery intent receipt must be an object");
+  const receiptInput = receipt;
+  const receiptUnsupported = Object.keys(receiptInput).find((key) => key !== "lookupKey" && key !== "applyId");
+  if (receiptUnsupported)
+    throw new Error(`projection recovery intent receipt contains unsupported property: ${receiptUnsupported}`);
+  for (const field of ["lookupKey", "applyId"]) {
+    if (typeof receiptInput[field] !== "string" || !/^sha256:[a-f0-9]{64}$/.test(receiptInput[field])) {
+      throw new Error(`projection recovery intent receipt.${field} is invalid`);
+    }
+  }
+  const intent = input;
+  const issues = projectionApplyRecoveryIntentInvariantIssues(intent);
+  if (issues.length > 0)
+    throw new Error(`projection recovery intent invariant failed: ${issues.join("; ")}`);
+  return intent;
+}
 function parseProjectionProtocolRequest(raw) {
   let value;
   try {
@@ -36019,10 +37215,10 @@ function projectionProtocolHumanStatus(request, projection3) {
 function projectionProtocolEnvelope(request, input, status, output = input) {
   return projectionProtocolResultEnvelope(projectionProtocolResult(request, input, status, output));
 }
-function projectionProtocolResult(request, input, status, output = input, applyReceipt) {
+function projectionProtocolResult(request, input, status, output = input, applyReceipt, overrides) {
   const inputSnapshot = projectionProtocolSnapshot(request, input.plan.provenance);
   const outputSnapshot = projectionProtocolSnapshot(request, output.plan.provenance);
-  const files = projectionProtocolFiles(input);
+  const files = overrides?.files ?? projectionProtocolFiles(input);
   const affectedNodeIds = projectionProtocolAffectedNodes(input);
   const requestPayloadDigest = digestJson(request);
   const humanActions = [];
@@ -36035,7 +37231,7 @@ function projectionProtocolResult(request, input, status, output = input, applyR
       requestPayloadDigest
     });
   }
-  const refreshSignals = [...output.plan.refreshSignals].sort((left, right) => left.signalId < right.signalId ? -1 : left.signalId > right.signalId ? 1 : 0);
+  const refreshSignals = [...overrides?.refreshSignals ?? output.plan.refreshSignals].sort((left, right) => left.signalId < right.signalId ? -1 : left.signalId > right.signalId ? 1 : 0);
   const withoutReceipt = {
     schemaVersion: "archcontext.projection-result/v2",
     requestId: request.requestId,
@@ -36103,6 +37299,19 @@ function projectionProtocolFiles(projection3) {
     return [];
   }).sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
 }
+function projectionProtocolFilesForExpectedOutput(root, projection3) {
+  return projection3.files.flatMap((file) => {
+    const preimageDigest = currentProjectionFileDigest(root, file.path);
+    const outputDigest = digestJson({ path: file.path, body: file.body });
+    if (preimageDigest === outputDigest)
+      return [];
+    return preimageDigest === "missing" ? [{ path: file.path, action: "create", preimageDigest: null, outputDigest }] : [{ path: file.path, action: "update", preimageDigest, outputDigest }];
+  }).sort((left, right) => left.path.localeCompare(right.path));
+}
+function currentProjectionFileDigest(root, path) {
+  const absolute = resolve19(root, path);
+  return existsSync17(absolute) ? digestJson({ path, body: readFileSync16(absolute, "utf8") }) : "missing";
+}
 function projectionProtocolAffectedNodes(projection3) {
   const targetNodes = new Map(projection3.plan.targets.flatMap((target) => target.scope.kind === "entity" ? [[target.targetId, target.scope.id]] : []));
   return [...new Set([
@@ -37148,7 +38357,7 @@ async function writeGithubDeveloperReviewState(cwd, state) {
   assertNoCliSecretMaterial(serialized);
   writeFileSync8(path, serialized, { mode: 384 });
   if (process.platform !== "win32")
-    chmodSync5(path, 384);
+    chmodSync6(path, 384);
   return { state, path };
 }
 function readGithubDeveloperReviewState(path) {
@@ -37222,7 +38431,7 @@ function writeGithubConnection(path, record2) {
   assertNoCliSecretMaterial(serialized);
   writeFileSync8(path, serialized, { mode: 384 });
   if (process.platform !== "win32")
-    chmodSync5(path, 384);
+    chmodSync6(path, 384);
 }
 function sanitizeGithubConnection(record2, connectionPath) {
   return {