v0.11.0 — knowledge graph, reviewed writes, delta sync

• A facts layer: ats kg. Durable subject–predicate–object knowledge beside the tasks, in an embedded append-only log (no graph server). Agents propose facts and retractions; a human ratifies — the only write path — and every fact carries proposer, ratifier, source, and temporal validity. ats kg ask answers with deterministic lexical scoring plus provenance (zero LLM); retraction closes a fact's validity interval instead of deleting it, so "what did we believe then" stays answerable. ats kg export --cypher emits a load script for embedded graph engines (LadybugDB/Kùzu dialect); the store travels with ats state export. Recommended pairing for dedicated graph engines, stated in the README: Graphiti as the graph database server, LadybugDB as the embedded graph database.
• Reviewed writes: approvalRequired is now enforced. A write whose target task declares intent.approvalRequired — or lists the action (or generic write) in security.approvalRequiredFor — stages into a review queue instead of reaching the backend; ATS_REVIEW_ALL=1 gates every write, including creates. ats review list/show/approve/reject/apply runs the queue; applied writes go through the normal adapter path with the approver recorded in the action ledger, so they stay undoable. A failed apply keeps the item approved with its error — never silently lost.
• No silently dropped sources. The remaining paths where a failed source could vanish without reaching warnings now surface: per-project failures inside the composite fallback fetch, a composite child whose native search errors, and TickTick project fetches in the adapter's own corpus loader, search, hybrid keyword pool, and vector sync. The TickTick loader also stops caching a known-partial corpus — previously it cached whatever survived and served the subset as complete for the whole TTL.
• Composite fusion identity is namespaced. Task ids from composite children are prefixed <backend>:<taskId> like project ids, so two backends emitting the same raw id can no longer merge into one fused result. Routing accepts both namespaced and raw ids; ids copied from find output resolve unchanged.
• ats cache sync works for every adapter. Previously it errored unless the adapter shipped its own cache extension, while doctor could report the corpus cache stale with no way to refresh it. The cache subcommands now fall back to Core's corpus cache (status/sync/clear, cron-friendly), and Core gains an optional bulkFetchDelta({cursor, since}) adapter hook: changed tasks apply as whole-item replacements over the prior corpus — never a field merge — with the adapter's cursor persisted for the next round. Backends without a changes API keep the full-refresh path.
• Completed-task history in retrieval. The adapter contract gains optional listCompletedTasks(); ats find --include-completed appends completed items per query (never into the shared cache), each carrying status: 'completed'. TickTick maps its existing completed-tasks support onto the contract; the composite unions children and names the ones that cannot answer; an adapter without the method degrades the result with an explicit warning instead of silently answering from active tasks only.
• Safe under concurrent agents. A shared lock/atomic-write module now guards every state file: the corpus cache is replaced atomically under a lock (a torn cache was previously possible), the action ledger appends under a lock (before-image lines can exceed the size the OS appends atomically), and the whole undo critical section holds the ledger lock so two concurrent undos of the same action can never double-apply against the backend.
• Trust boundaries between backends. Composite children can be marked "trust": "public"; a write routed to a public child is screened against configured redaction patterns and blocked with the matching rule named — never silently stripped — so content picked up from a private backend cannot flow into a public one through ATS unnoticed. Invalid patterns fail loudly at config load.
• Portable state: ats state export|import. The ledger, undo before-images, review queue, event checkpoint and spool, usage log, caches, and index metadata bundle into one JSON document and restore elsewhere. Credentials are never bundled (whitelist), and import writes only to the local known state paths — a crafted bundle cannot redirect a write. Also the persistence answer for ephemeral hosted deployments.
• Hygiene that acts, carefully. ats dedup apply turns a detected duplicate cluster into typed links (supersedes/conflicts-with) and optionally closes the duplicates — through the normal write path, so everything is ledgered, undoable, and review-gated. ats garden sweeps for active tasks untouched past a threshold and prints a per-task archive command; detection only, by design.
• One-command agent onboarding. ats agent-setup emits the CLAUDE.md/AGENTS.md policy block for the current install — active adapter, retrieval-first discipline with degraded-result honesty, the review-gate stop rule, and the facts-layer propose-not-write rule — generated from live configuration so it always matches the machine it runs on.
• Vector backfill drains itself. ats sync vector --all loops rounds of the per-run embedding cap until the backfill is exhausted, stopping on any round without forward progress; a sync that had to skip unreadable projects now says so in its report.