The human ledger and the document body are different stores. Record the projection intent in the same transaction as the ledger, and clear it only when the body write succeeds so a retry cannot append a second revision.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unauthorized actors no longer grab leases; controlled PATCH projects through
DocGov so author_last_edited and audit survive, with idempotent retry on failure.
Co-authored-by: Cursor <cursoragent@cursor.com>