Approve/commit now write FAV staging in the domain transaction, recover-apply materializes scratch collections, and unpublished or GET paths cannot mutate the registry. Co-authored-by: Cursor <cursoragent@cursor.com>
Keep FAV_DEGRADED_READ off by default and mount an independent vault volume beside runtime data. Co-authored-by: Cursor <cursoragent@cursor.com>