Merge branch 'feat/phase1' into task/8

# Conflicts:
#	docs/ARCHITECTURE.md
#	docs/DECISIONS.md
#	docs/TODO.md

docs/TODO.md

@@ -24,15 +24,13 @@ Small, specific, independently actionable. Remove only when actually done.
     file, and compare steps and token use.
 
 ## Known issues
-- [ ] Sync: `list` records are snapshotted but not applied to `lists` (Trakt/Hardcover emit them). Decide
-  the mapping (one list per record, items by matched work) and apply it through the change engine.
-- [ ] Sync: accepting a `removed` event on an engagement de-duplicated across sources soft-deletes it even if
-  another connection still reports it; consider detaching that connection's `engagement_sources` row instead.
-- [ ] Sync: pending `changed`/`conflict` events for a value the source has since moved past stay pending;
-  consider superseding them when a newer value for the same field arrives.
 - [ ] Sync: two concurrent runs of the same connection can both insert a new `source_records` row for one key
   (one fails on the unique key and is logged as a record error). The job worker should lock per connection.
-- [ ] Sync: `ingestListens` does one lookup and one insert per listen; batch it for large backfills.
+- [ ] Restore: a new child work whose parent+position collides with an existing child of a re-matched parent fails
+  with `ImportError("conflict")` instead of being merged or repositioned.
+- [ ] Restore: an unlink of identical attachment bytes between the pre-write and the commit could remove the file;
+  mitigated by re-writing after commit, not locked.
+- [ ] Export bundles hold attachment bytes in memory; very large libraries need a streaming zip.
 - [ ] Admin merge does not merge colliding children recursively; colliding children stay under the tombstoned parent.
 - [ ] Matching: a shared parent resolved without external IDs or position (title/year reuse in
   `packages/core/src/matching.ts`) has no unique key, so concurrent matches can create it twice.