ultra-builder-pro-cli 0.22.0 → 0.23.0

package/docs/ARTIFACT-AUTHORITY.md

@@ -59,14 +59,12 @@ inspect -> suggest -> host-native ask -> normalize -> persist -> apply -> read b
 The host-native ask is conditional. An explicit owner instruction can already resolve
 a choice, so the model must not ask
 again merely to manufacture proof. When interaction is needed, the adapter uses the
-host-native question surface. Once the model writes the normalized result through
-`decision.resolve`, `decision.delegate`, or `decision.defer`, the DB treats that result
-as current cross-session intent authority. It does not store or verify a UI receipt,
-raw prompt, or transcript.
+host-native question surface. Once the model batches the normalized result through
+`ultra.record`, the DB treats that result as current cross-session intent authority. It
+does not store or verify a UI receipt, raw prompt, or transcript.
 
 If the accepted decision changes another Ultra authority, the model applies that change
-through its owning MCP tool or digest-bound artifact, reads the result back, and passes
-typed `applied_refs` to `decision.complete`. A decision whose normalized record is
+through `ultra.record` or a digest-bound artifact and reads the result back. A decision whose normalized record is
 itself the complete authority may have no applied reference. Breadcrumb and decision
 read paths recall accepted intent only after the dialogue thread is completed or
 confirmed. A row-backed applied reference names an exact field and canonical value,
@@ -77,7 +75,7 @@ the exact file digest. Row existence alone never proves that intent was applied.
 
 Working material becomes durable only when all applicable conditions hold:
 
-1. the active workflow permits the write;
+1. the current Change and owner authority permit the write;
 2. consequential claims are verified against the checkout, runtime, test result, or
    primary source;
 3. the model writes through the owning MCP operation or immutable artifact path;
@@ -122,9 +120,9 @@ as delivered.
 
 ## Context and plan authority
 
-`change.context` is a pure compiler. It reads accepted Change, task, baseline, checkout,
-and provider-reference authority and writes one immutable manifest plus its DB snapshot
-row. It never updates provider references or semantic Change fields. Each snapshot is
+The Context compiler used by `ultra.checkpoint` reads accepted Change, task, baseline,
+checkout, and provider-reference authority and writes one immutable manifest plus its
+DB snapshot row. It never updates provider references or semantic Change fields. Each snapshot is
 identified exactly by `change_id`, nullable `task_id`, `role`, and `gate`; consumers
 must not substitute a newer snapshot from a different tuple.
 
@@ -141,8 +139,8 @@ A current plan is a Change-owned pair:
 - `<artifact_root>/plan.md` is the deterministic human projection of the same plan and
   task contracts.
 
-`plan.export` selects both paths from the owning Change and accepts no arbitrary output
-path. `verify-plan` binds the JSON digest and the preceding `plan/planning` snapshot;
+The Plan checkpoint selects both paths from the owning Change and accepts no arbitrary
+output path. It binds the JSON digest and the preceding `plan/planning` snapshot;
 the artifact registry records both plan files with that context provenance. Publication
 preflights both path authorities and prior digests, rejects symlinked ancestors or
 targets, and journals the two file replacements so a registry or event failure restores
@@ -152,7 +150,7 @@ never current write or dispatch authority.
 
 ## Registry contract
 
-`artifact.record` is the public writer for a semantic or evidence file that is not
+`ultra.record` is the public writer for a semantic or evidence file that is not
 already registered by its owning workflow operation. Every managed registry row has:
 
 - a typed `owner_type` and `owner_id`;
@@ -190,7 +188,7 @@ pretending that an old row satisfies the current registry contract.
 
 ## Dependency and orphan diagnosis
 
-`system.doctor` compares the registry, dependency graph, filesystem, and owner
+`ultra.doctor` compares the registry, dependency graph, filesystem, and owner
 tables. It reports:
 
 - unregistered semantic or evidence files;
@@ -235,7 +233,7 @@ Change creation or update, plan acceptance, durable task-contract or status chan
 task expansion or deletion, and Change convergence or archive. A direct edit is
 rejected by host hooks and fails digest validation even without hooks.
 
-`task.ledger_import` validates schema, full and per-record digests, bounded ancestry,
+`ultra.sync { action: import }` validates schema, full and per-record digests, bounded ancestry,
 Change ownership, task parents, and local active sessions. A clean record fast-forwards.
 A record changed on both sides, a non-descendant checkpoint, or a remote update to a
 locally active task stops with a typed conflict. Re-importing the same checkpoint
@@ -245,7 +243,8 @@ HEAD, scope bytes, verification, or accepted dirty state. Publication remains bl
 until that local baseline converges, preventing one unvalidated checkout from
 downgrading team authority.
 
-Legacy v4.4/v4.5 projections are replaced only through `task.ledger_publish`. The
+Legacy v4.4/v4.5 projections are replaced only through
+`ultra.sync { action: publish }`. The
 publisher first compares every available durable field with SQLite, writes the exact
 legacy bytes to `.ultra/.runtime/backups/task-ledger/`, and refuses any mismatch.
 Doctor diagnoses this state but never performs the semantic replacement.

package/docs/ROADMAP.md

@@ -57,14 +57,14 @@ sharing one authoritative workflow store.
 
 ```
 spec/                       ← Phase 1 single source of truth
-├── mcp-tools.yaml          (60 live tools across 9 families)
+├── mcp-tools.yaml          (7 public kernel tools + 60 hidden compatibility operations)
 ├── cli-protocol.md         (CLI ↔ MCP mapping table)
 ├── schemas/                (state-db.sql + 4 JSON schemas)
 ├── fixtures/{valid,invalid}/  (+ v4.4-project for migration)
 └── scripts/test-all.cjs    (npm run test:spec — 7 validation stages)
 
 mcp-server/                 ← Phase 2 authoritative state layer
-├── server.cjs              (stdio MCP server, 60 task/session/baseline/change/decision/workflow/artifact/system/plan tools)
+├── server.cjs              (stdio MCP server with a 7-tool public façade)
 ├── lib/
 │   ├── state-db.cjs        (SQLite + WAL + pragmas)
 │   ├── state-ops.cjs       (full write API, status state machine)

package/docs/RUNTIME-COMPAT-MATRIX.md

@@ -46,7 +46,7 @@ not presented as nonexistent custom agents.
 
 | Lifecycle | Claude Code | OpenCode | Codex | Kimi Code 0.26+ |
 |---|---|---|---|---|
-| Session context/health | FULL, active-workflow breadcrumb on native `SessionStart` | FULL, native JS plugin injects only an active-workflow breadcrumb; health via `system.doctor` | FULL, active-workflow breadcrumb on native `SessionStart` | FULL, active-workflow breadcrumb via native hooks |
+| Session context/health | FULL, active-workflow breadcrumb on native `SessionStart` | FULL, native JS plugin injects only an active-workflow breadcrumb; health via `ultra.doctor` | FULL, active-workflow breadcrumb on native `SessionStart` | FULL, active-workflow breadcrumb via native hooks |
 | Active edit boundary | FULL, `PreToolUse Edit|Write` | FULL, `tool.execute.before` rejects managed checkpoint/projection writes | FULL, `PreToolUse Edit|Write|apply_patch` | FULL, native `PreToolUse Edit|Write` deny contract |
 | Pre-compact checkpoint | FULL | FULL | FULL | FULL, native `PreCompact` |
 | Post-compact context injection | FULL | FULL, native compacting context | FULL, native `PostCompact` restore | DEGRADED; checkpoint restoration runs, but Kimi 0.26/0.27 does not reinject fire-and-forget hook text |
@@ -68,7 +68,8 @@ they do not deny edits or stop active incident work.
 | Capability | Claude Code | OpenCode | Codex | Kimi Code 0.26+ |
 |---|---|---|---|---|
 | stdio MCP registration | plugin `.mcp.json` | `opencode.json` local MCP entry | plugin `.mcp.json` | plugin `mcpServers` entry |
-| Live/declared contracts | 60 | 60 | 60 | 60 |
+| Public discovered MCP tools | 7 | 7 | 7 | 7 |
+| Hidden 0.22 compatibility operations | 60 | 60 | 60 | 60 |
 | Structured user alignment | `AskUserQuestion` in interactive sessions | `question` when permission is not denied | `request_user_input` when the current mode exposes it | `AskUserQuestion` outside auto mode |
 | Greenfield/brownfield baseline adoption | FULL | FULL | FULL | FULL |
 | Context Manifest v3 / breadcrumb | FULL | FULL, same bundled read-only DB reader as every hook | FULL | FULL |
@@ -79,10 +80,10 @@ they do not deny edits or stop active incident work.
 | Git team checkpoint | `.ultra/tasks/tasks.json` | `.ultra/tasks/tasks.json` | `.ultra/tasks/tasks.json` | `.ultra/tasks/tasks.json` |
 | General memory-provider API | N/A | N/A | N/A | N/A |
 
-All 60 `task.*`, `session.*`, `baseline.*`, `change.*`, `decision.*`,
-`workflow.*`, `artifact.*`, `system.*`, and `plan.*` operations
-registered by `mcp-server/server.cjs` are live. Review, impact discovery, skill
-loading, and user interaction remain host-native surfaces.
+All hosts discover the seven `ultra.*` persistence and safety tools. The sixty
+fine-grained 0.22 operations remain callable but undiscoverable for one compatibility
+release; new Skills do not call them. Review, impact discovery, skill loading, model
+reasoning, and user interaction remain host-native surfaces.
 
 When a native structured question surface is unavailable, the shared interaction
 contract permits one concise direct question only if ordinary conversation is still

package/docs/STATE-DB-ACCESS-POLICY.md

@@ -26,7 +26,7 @@ bugs.
   but never `UPDATE` / `DELETE`.
 
 The CLI may indirectly mutate ordinary workflow tables by spawning the MCP server over
-stdio and calling `task.update`, `session.spawn`, etc. — but the actual
+stdio and calling the public `ultra.*` kernel — but the actual
 SQLite write is performed by the MCP server's writer connection. The documented
 exceptions are initial schema/baseline creation, migration, and explicitly
 authorized backup-first doctor recovery. The CLI never provides a parallel raw
@@ -36,8 +36,8 @@ The append-only carve-out for `events` exists because `events.id INTEGER
 PRIMARY KEY AUTOINCREMENT` makes concurrent inserts collision-free under
 WAL + `busy_timeout`. This lets hooks and short-lived CLI invocations
 record audit observations without paying the cost of a full MCP round trip.
-It does not grant lifecycle authority: external writers and public
-`task.append_event` use the published observation allowlist, while lifecycle event
+It does not grant lifecycle authority: external writers use the published observation
+allowlist, while lifecycle event
 names are emitted only inside the mutation that owns the corresponding state change.
 Consumers must verify mutable rows rather than infer success from an event name.
 
@@ -74,16 +74,16 @@ resolve the mount/runtime constraint before retrying.
 
 | Table              | Writer of record                                      |
 |--------------------|--------------------------------------------------------|
-| `baselines`        | MCP server (`baseline.start` / `baseline.record` / `baseline.converge`); initialization and legacy-projection migration may create only the first draft or compatibility row |
-| `tasks`            | MCP server (`task.create` / `task.update` / `task.delete`) |
-| `changes`          | MCP server (`change.create` / `change.update` / `change.converge` / `change.archive`) |
-| `decision_threads`, `decision_items` | MCP server (`decision.thread_start` / `decision.open` / `decision.resolve` / `decision.delegate` / `decision.defer` / `decision.supersede` / `decision.complete` / `decision.checkpoint`); pending recovery state, normalized accepted intent, durable effects, typed applied references, lifecycle completion, and optional artifact checkpoints are stored, never UI receipts, prompts, or transcripts |
-| `workflow_runs`, `workflow_steps` | MCP server (`workflow.start` / `workflow.step` / `workflow.complete`); skills provide evidence inputs but never write rows directly |
-| `artifacts`, `artifact_edges` | MCP server (`artifact.record`); workflow-owned registration may use the same internal registry transaction |
-| `context_snapshots`, `spec_learning_candidates`, `trace_links` | MCP server through change lifecycle tools |
+| `baselines`        | MCP server through `ultra.record`, `ultra.checkpoint`, and `ultra.archive`; initialization and legacy migration may create only the first draft or compatibility row |
+| `tasks`            | MCP server through `ultra.record`, `ultra.checkpoint`, and `ultra.sync` |
+| `changes`          | MCP server through `ultra.record`, `ultra.checkpoint`, and `ultra.archive` |
+| `decision_threads`, `decision_items` | MCP server through `ultra.record`; normalized accepted intent and applied references are stored, never UI receipts, prompts, or transcripts |
+| `workflow_runs`, `workflow_steps` | MCP server internally through `ultra.checkpoint`; Skills supply semantic evidence but never drive individual rows |
+| `artifacts`, `artifact_edges` | MCP server through `ultra.record` and checkpoint-owned registration |
+| `context_snapshots`, `spec_learning_candidates`, `trace_links` | MCP server through `ultra.record` and `ultra.checkpoint` |
 | `incidents`, `projection_jobs`, `event_consumers`, `circuit_breaker` | MCP server; backup-first doctor recovery may perform only documented mechanical transitions |
-| `events`           | MCP server for lifecycle events; approved processes and `task.append_event` for allowlisted append-only observations |
-| `sessions`         | MCP server (`session.spawn` / `session.close` / `session.heartbeat`); orchestrator may write status transitions |
+| `events`           | MCP server for lifecycle events; approved processes and `ultra.record` for allowlisted append-only observations |
+| `sessions`         | MCP server through `ultra.session`; orchestrator may write status transitions |
 | `telemetry`        | MCP server (collected from tool-call wrappers); orchestrator may dump bulk samples |
 | `specs_refs`       | MCP server (rebuilt on `spec_changed` event); orchestrator may rebuild |
 | `migration_history`| schema initializer and `ultra-tools migrate` or doctor repair |
@@ -91,8 +91,8 @@ resolve the mount/runtime constraint before retrying.
 
 ## 5. Git team checkpoint
 
-Only `task.ledger_publish` may derive `.ultra/tasks/tasks.json` from SQLite, and only
-`task.ledger_import` may merge it into SQLite. Server startup performs one import after
+Only `ultra.sync { action: publish }` may derive `.ultra/tasks/tasks.json` from SQLite,
+and only `ultra.sync { action: import }` may merge it into SQLite. Server startup performs one import after
 opening project authority; later pulls in a long-running process require an explicit
 import. The same checkpoint is idempotent and must not append an event again.
 

package/docs/WORKFLOW-LIFECYCLE.md

@@ -11,7 +11,7 @@ host and project owner. It is the operational companion to
 |---|---|---|
 | Active host and owner | Product judgment, research content, implementation, review findings, and authorization for destructive or external effects | Durable workflow status or fabricated evidence digests |
 | Skill | One reusable procedure and its evidence requirements | Project state, static product doctrine, host-specific tool fiction |
-| MCP | IDs, valid transitions, hard recovery requirements, task contracts, evidence references, output hashes, and gate verdicts | Semantic route selection, research prose, code generation, general memory-provider payloads, or model calls |
+| MCP | Durable checkpoints, task contracts, evidence references, output hashes, team sync, leases, archives, and mechanical recovery | Semantic route selection, research prose, code generation, general memory-provider payloads, or model calls |
 | `.ultra/.runtime/state.db` | Checkout-local lifecycle, index, transition, freshness, and coordination authority for baseline, change, decision, task, workflow, session, event, incident, projection, and evidence references | Prompts, transcripts, general external-memory payloads, semantic prose, or code-graph payloads |
 | `.ultra/tasks/tasks.json` | MCP-published Git checkpoint for portable baseline, Change, task-contract, dependency, and durable status records | Live sessions, leases, `in_progress` ownership, completion hashes, or a parallel write API |
 | Digest-bound artifacts | Registered specification, research, Change, context, test, review, delivery, and verification bodies | Independent lifecycle state or content whose digest no longer matches |
@@ -22,19 +22,22 @@ Together, `.ultra/` is project-local cross-session workflow memory. The detailed
 artifact classes and promotion rules live in
 [`ARTIFACT-AUTHORITY.md`](./ARTIFACT-AUTHORITY.md).
 
-Prompt input can supply facts, content paths, reasons, owner decisions, and
-evidence references. MCP reads the current repository and DB, validates those
-inputs, hashes outputs, and derives status. Prompt input cannot override a task's
-public seam, verification command, context references, workflow summary, gate
-verdict, output digest, or transition validity. A host recommendation is never stored
-as MCP authority.
+Model input can supply facts, content paths, reasons, owner decisions, and evidence
+references. `ultra.record` stores mutable typed drafts and `ultra.checkpoint` attempts
+one durable semantic commit. A semantic rejection returns diagnostics and keeps the
+draft editable. Model input cannot override a task's public seam, evidence digest, or
+accepted checkpoint. A host recommendation is never stored as MCP authority.
 
-Load-bearing owner choices are normalized through `decision.*`; Prompt prose is not
-durable authority. The host acquires observable facts autonomously, exposes one
-current question, and stops. A workflow cannot advance while a matching decision has
-an unanswered blocking question, a blocking deferral, a prepared checkpoint awaiting
-confirmation, or a stale confirmed artifact. A normalized answer alone does not require
-a ceremonial checkpoint.
+Load-bearing owner choices are normalized through `ultra.record`; prompt prose is not
+durable authority. The host acquires observable facts autonomously, exposes one current
+question, and stops. Unanswered material choices remain warnings or checkpoint
+diagnostics until a capability truly needs their result. A normalized answer alone
+does not require a ceremonial checkpoint.
+
+Every host discovers seven public MCP tools: `ultra.context`, `ultra.record`,
+`ultra.checkpoint`, `ultra.sync`, `ultra.session`, `ultra.archive`, and
+`ultra.doctor`. The 0.22 fine-grained operations documented below remain hidden
+compatibility internals for one release. Skills must not drive them one call at a time.
 
 Every change-bound research, plan, dev, test, review, and deliver run inherits
 the baseline id from the owning change workflow. A Prompt cannot switch that
@@ -190,8 +193,10 @@ execution failure.
 ### Workflow run and step
 
 ```text
-run:  active <-> blocked -> ready -> completed
-                              \----> cancelled
+draft: active <-> blocked <-> ready
+          |          |         |
+          +----------+---------+----> cancelled
+                              \----> completed (accepted, immutable)
 
 step: pending -> in_progress -> completed
          |            |
@@ -199,10 +204,10 @@ step: pending -> in_progress -> completed
        blocked ------> in_progress/completed
 ```
 
-Required steps execute in definition order. A step that requires evidence or an
-output cannot complete without it. When the final required step completes, the
-run becomes `ready`; `workflow.complete` revalidates the entire stage before
-making it `completed`.
+Fine-grained steps are internal evidence bookkeeping. `ultra.checkpoint` records and
+validates them in one public call. A missing output returns mutable diagnostics. Draft
+artifact changes reopen `ready` to `active`; only an accepted `completed` revision is
+immutable.
 
 ### Decision thread and item
 
@@ -315,7 +320,8 @@ opens one replacement.
 
 ## 6. Context and prompt follow-through
 
-`change.context` compiles an immutable Context Manifest v3 snapshot. It combines:
+The Context compiler used internally by `ultra.checkpoint` creates an immutable
+Context Manifest v3 snapshot. It combines:
 
 - the bound baseline/change/task identity;
 - a role and lifecycle gate;
@@ -328,11 +334,10 @@ opens one replacement.
 - optional metadata-only external memory or graph references;
 - advisory file/token/context-share budgets, including inline Change/task authority;
 - the current Change and task authority digests;
-- readiness blockers, `allowed_transitions`, and a `required_transition` only for a
-  unique hard-recovery path.
+- readiness warnings and hard mechanical blockers without a semantic route command.
 
 Compilation is pure with respect to accepted Change authority. Provider references are
-updated only through `change.update`; they cannot be smuggled into `change.context`.
+recorded through `ultra.record`; they cannot be smuggled into a checkpoint context.
 Context references retain `expected_digest`, `anchor`, `scope`, and
 `freshness_policy`. `digest` requires byte-current content, `existence` allows an
 implementation target to change while remaining present, and `advisory` reports drift
@@ -349,9 +354,9 @@ Critical stage workflows bind a matching snapshot as a durable output:
 | `deliver` | `check` | `convergence` |
 
 Every lookup is exact on `change_id + task_id + role + gate`. The snapshot path and
-digest are carried into plan, test, review, and delivery artifacts. `plan.export`
-writes only the owning Change's `plan.json` and deterministic `plan.md`, and binds the
-exact planning snapshot and digest to both the artifact registry and `verify-plan`.
+digest are carried into plan, test, review, and delivery artifacts. The Plan
+`ultra.checkpoint` writes the owning Change's `plan.json` and deterministic `plan.md`
+once, and binds the exact planning snapshot and digest to the artifact registry.
 The legacy global `.ultra/execution-plan.json` is read-only migration compatibility,
 not current authority. These rules prevent a later Prompt or a different role packet
 from claiming evidence gathered under another context. Referenced file content remains
@@ -389,9 +394,9 @@ evidence do block.
   fast-forward or conflict handling.
 - A changed checkpoint artifact digest or superseded decision invalidates the linked
   decision checkpoint and blocks matching workflow advancement until reconfirmed.
-- `workflow.revise` creates a candidate without deleting the completed prior run.
-  `workflow.supersede` promotes only a completed matching candidate, preserves both
-  histories, and invalidates only the prior run's transitive registered consumers.
+- A rejected draft is repaired in place or explicitly abandoned. A new accepted
+  revision preserves prior accepted history and invalidates only true transitive
+  registered consumers.
 
 ## 8. Entry flows
 
@@ -459,13 +464,14 @@ evidence rather than bypassing them.
 | `ultra-doctor` | read-only diagnosis and authorized mechanical recovery | required recovery only when unique; otherwise safe alternatives |
 
 Every row permits `ultra-think` when material owner authority is missing and permits
-`ultra-doctor` when state or installed-runtime authority is unhealthy. MCP makes one
-of them required only when no safe alternative exists. Neither capability creates a
-parallel workflow or substitutes a Prompt summary for DB state.
+`ultra-doctor` when state or installed-runtime authority is unhealthy. The host model
+recommends either from current evidence; hard MCP blockers remain limited to the
+mechanical safety boundary. Neither capability creates a parallel workflow or
+substitutes a prompt summary for DB state.
 
 ## 9. Recovery and diagnosis
 
-Use `system.doctor` for project authority and
+Use `ultra.doctor` for project authority and
 `ubp --all --global --doctor` for installed host assets. Both are read-only
 unless an explicit project repair command is chosen.
 

package/mcp-server/lib/artifact-registry.cjs

@@ -505,10 +505,34 @@ function invalidateConsumersFromEndpointInTx(db, start, {
     }
     if (endpoint.type === 'workflow') {
       const row = db.prepare(
-        'SELECT metadata_json, change_id, task_id FROM workflow_runs WHERE id = ?',
+        'SELECT status, metadata_json, change_id, task_id FROM workflow_runs WHERE id = ?',
       ).get(endpoint.id);
       if (row) {
         const metadata = parseJson(row.metadata_json, {});
+        if (['active', 'blocked', 'ready'].includes(row.status)) {
+          delete metadata.authority_invalidation;
+          metadata.draft_dirty = true;
+          db.prepare(
+            `UPDATE workflow_runs
+             SET status = CASE WHEN status = 'ready' THEN 'active' ELSE status END,
+                 metadata_json = ?,
+                 updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+             WHERE id = ?`,
+          ).run(JSON.stringify(metadata), endpoint.id);
+          ops.appendEventInTx(db, {
+            type: 'workflow_draft_changed',
+            change_id: row.change_id,
+            task_id: row.task_id,
+            payload: {
+              workflow_id: endpoint.id,
+              source_type: start.type,
+              source_id: start.id,
+              reason,
+            },
+          });
+          queue.push(...outgoingEdges(db, endpoint));
+          continue;
+        }
         if (metadata.authority_invalidation?.invalidated !== true) {
           metadata.authority_invalidation = {
             invalidated: true,

package/mcp-server/lib/change-workflow.cjs

@@ -39,7 +39,7 @@ const SEMANTIC_AUTHORITY_FIELDS = new Set([
 const CHANGE_TRANSITIONS = Object.freeze({
   active: new Set(['active', 'blocked', 'cancelled']),
   blocked: new Set(['active', 'blocked', 'cancelled']),
-  ready: new Set(['ready']),
+  ready: new Set(['active', 'ready', 'cancelled']),
   archived: new Set(),
   cancelled: new Set(),
 });
@@ -702,11 +702,8 @@ function compileContext(db, input, { rootDir = process.cwd() } = {}) {
   const recommendation = spine.recommendation;
   const durableSpine = { ...spine };
   delete durableSpine.recommendation;
-  const snapshotId = `ctx-${crypto.randomUUID().slice(0, 12)}`;
-  const manifest = {
+  const semanticManifest = {
     schema_version: '3.0',
-    snapshot_id: snapshotId,
-    generated_at: nowIso(),
     change: {
       id: change.id, title: change.title, kind: change.kind, status: change.status,
       intent: change.intent, docs_impact: change.docs_impact, base_commit: change.base_commit,
@@ -734,6 +731,43 @@ function compileContext(db, input, { rootDir = process.cwd() } = {}) {
     providers,
     provider_boundary: 'metadata references only; memory and code graph content remain external',
   };
+  const identityHash = crypto.createHash('sha256')
+    .update(JSON.stringify(semanticManifest))
+    .digest('hex');
+  const snapshotId = `ctx-${identityHash.slice(0, 12)}`;
+  const existing = db.prepare(
+    `SELECT manifest_path, manifest_hash
+     FROM context_snapshots WHERE id = ?`,
+  ).get(snapshotId);
+  if (existing) {
+    const existingPath = path.resolve(rootDir, existing.manifest_path);
+    if (!fs.existsSync(existingPath)) {
+      throw new ChangeWorkflowError(
+        'CONTEXT_SNAPSHOT_CORRUPT',
+        `content-addressed Context snapshot is missing: ${existing.manifest_path}`,
+      );
+    }
+    const bytes = fs.readFileSync(existingPath);
+    const existingHash = crypto.createHash('sha256').update(bytes).digest('hex');
+    if (existingHash !== existing.manifest_hash) {
+      throw new ChangeWorkflowError(
+        'CONTEXT_SNAPSHOT_CORRUPT',
+        `content-addressed Context snapshot digest changed: ${existing.manifest_path}`,
+      );
+    }
+    return {
+      manifest: JSON.parse(bytes.toString('utf8')),
+      recommendation,
+      context_manifest_path: existingPath,
+      manifest_hash: existingHash,
+    };
+  }
+  const manifest = {
+    schema_version: semanticManifest.schema_version,
+    snapshot_id: snapshotId,
+    generated_at: nowIso(),
+    ...Object.fromEntries(Object.entries(semanticManifest).filter(([key]) => key !== 'schema_version')),
+  };
   const artifactDir = path.resolve(rootDir, change.artifact_root);
   fs.mkdirSync(artifactDir, { recursive: true });
   const manifestPath = path.join(artifactDir, 'contexts', `${snapshotId}.json`);
@@ -1005,7 +1039,7 @@ function assertTaskCreationAllowed(db, input = {}, { rootDir = process.cwd() } =
 function updateChange(db, id, patch = {}, { rootDir = process.cwd() } = {}) {
   const current = readChange(db, id);
   if (!current) throw new ChangeWorkflowError('CHANGE_NOT_FOUND', `change ${id} not found`);
-  if (['ready', 'archived', 'cancelled'].includes(current.status)) {
+  if (['archived', 'cancelled'].includes(current.status)) {
     throw new ChangeWorkflowError('CHANGE_NOT_MUTABLE', `change ${id} is ${current.status}`);
   }
   for (const field of Object.keys(patch)) {
@@ -1059,6 +1093,8 @@ function updateChange(db, id, patch = {}, { rootDir = process.cwd() } = {}) {
           );
         }
         sets.push('status = ?'); values.push(patch.status);
+      } else if (current.status === 'ready' && Object.keys(patch).length > 0) {
+        sets.push('status = ?'); values.push('active');
       }
       if (sets.length === 0) return current;
       sets.push('updated_at = ?'); values.push(nowIso(), id);