From 9c70c36c9cfc29babf13cfc438390337b44708c6 Mon Sep 17 00:00:00 2001
From: John Siracusa <siracusa5@users.noreply.github.com>
Date: Wed, 29 Jul 2026 02:36:33 -0400
Subject: [PATCH 1/2] feat(core): bind runtime to project profiles

Signed-off-by: John Siracusa <siracusa5@users.noreply.github.com>
---
 CLAUDE.md                                     |   4 +-
 apps/desktop/src/cli/cli.mjs                  |   6 +-
 apps/desktop/src/main/settings-sync.mjs       |   7 +-
 apps/desktop/test/settings-sync.test.mjs      |   2 +-
 .../docs/getting-started/connect-an-agent.md  |  26 +
 .../docs/docs/guides/capture-write-path.md    |   6 +
 .../docs/docs/guides/promoting-concepts.md    |  75 ++-
 .../src/content/docs/docs/reference/cli.md    |  65 ++-
 .../content/docs/docs/reference/manifest.md   |  17 +-
 .../content/docs/docs/reference/mcp-tools.md  |  10 +-
 .../docs/reference/updates-and-privacy.md     |  11 +-
 examples/team-sync-pack/README.md             |   4 +-
 package.json                                  |   2 +-
 packages/core/src/capture.mjs                 | 145 ++++-
 packages/core/src/manifest.mjs                |  24 +
 packages/core/src/mcp-server.mjs              |  98 +++-
 packages/core/src/profile-cli.mjs             | 216 +++++++
 packages/core/src/profile-runtime.mjs         | 101 ++++
 packages/core/src/promote.mjs                 | 424 ++++++++++++--
 packages/core/src/resolver.mjs                |  21 +-
 packages/core/src/sources/cache.mjs           |   2 +-
 packages/core/src/sources/git-core.mjs        |  45 +-
 packages/core/src/sources/git-sync.mjs        |  15 +-
 packages/core/src/sources/mcp.mjs             |  32 +-
 packages/core/src/write.mjs                   |  69 ++-
 packages/core/tests/capture-test.sh           |  12 +-
 packages/core/tests/git-sync-test.sh          |   8 +-
 packages/core/tests/manifest.test.mjs         |  31 +
 packages/core/tests/profile-runtime-test.sh   | 529 ++++++++++++++++++
 packages/core/tests/smoke-test.sh             |   1 +
 profile.mjs                                   |   9 +
 .../capturing-and-promoting-context.md        |   2 +-
 .../adversarial-review.md                     |  91 +++
 specs/contextcake-project-profiles/design.md  |   6 +-
 specs/contextcake-project-profiles/spec.md    |   5 +-
 35 files changed, 1906 insertions(+), 215 deletions(-)
 create mode 100644 packages/core/src/profile-cli.mjs
 create mode 100644 packages/core/src/profile-runtime.mjs
 create mode 100755 packages/core/tests/profile-runtime-test.sh
 create mode 100755 profile.mjs

diff --git a/CLAUDE.md b/CLAUDE.md
index ec5dd9c..36eb393 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -18,8 +18,8 @@ node mcp-server.mjs --personal ~/kb-personal --shared ~/kb-shared
 node mcp-server.mjs --manifest layers.json --capture --telemetry --harness claude-code
 
 # Promote a live capture through the review queue (request, then approve)
-node promote.mjs --from-live ~/kb-live --capture captures/investigation/<id> --target ~/kb-team
-node promote.mjs --from-live ~/kb-live --target ~/kb-team --approve ~/kb-team/_review/promotions/<slug>.md
+node promote.mjs --legacy-paths --from-live ~/kb-live --capture captures/investigation/<id> --target ~/kb-team
+node promote.mjs --legacy-paths --from-live ~/kb-live --target ~/kb-team --approve ~/kb-team/_review/promotions/<slug>.md
 
 # Team activity dashboard data (feed + cross-brain-hit metrics)
 node team-activity.mjs --live-root ~/kb-live --out apps/control-surface/team-activity.json
diff --git a/apps/desktop/src/cli/cli.mjs b/apps/desktop/src/cli/cli.mjs
index 9ddd162..8b00d52 100644
--- a/apps/desktop/src/cli/cli.mjs
+++ b/apps/desktop/src/cli/cli.mjs
@@ -33,8 +33,9 @@ const COMMANDS = {
   resolve: { entry: 'resolver.mjs', manifest: true, blurb: 'resolve a concept across layers' },
   ingest: { entry: 'ingest.mjs', manifest: false, blurb: 'classify repo events into signals' },
   write: { entry: 'write.mjs', manifest: true, blurb: 'write captured signals into a layer' },
-  promote: { entry: 'promote.mjs', manifest: false, blurb: 'promote a concept up one layer' },
+  promote: { entry: 'promote.mjs', manifest: true, blurb: 'promote a live capture inside one profile' },
   pack: { entry: 'pack-cli.mjs', manifest: false, blurb: 'inspect, install, update, and roll back local Packs' },
+  profile: { entry: 'profile-cli.mjs', manifest: true, blurb: 'inspect and manage project profiles' },
 }
 
 function usage() {
@@ -72,7 +73,8 @@ if (!command) {
 }
 
 const args = [...rest]
-if (command.manifest && !args.includes('--manifest') && !args.includes('--personal')) {
+const isHelp = args.some((arg) => ['help', '--help', '-h'].includes(arg))
+if (command.manifest && !isHelp && !args.includes('--manifest') && !args.includes('--personal') && !args.includes('--legacy-paths')) {
   if (!fs.existsSync(DEFAULT_MANIFEST)) {
     console.error(`contextcake: no manifest at ${DEFAULT_MANIFEST}`)
     console.error('Open the ContextCake app to run first-time setup, or pass --manifest.')
diff --git a/apps/desktop/src/main/settings-sync.mjs b/apps/desktop/src/main/settings-sync.mjs
index b82eded..98f2f6f 100644
--- a/apps/desktop/src/main/settings-sync.mjs
+++ b/apps/desktop/src/main/settings-sync.mjs
@@ -3,7 +3,9 @@ import fs from 'node:fs'
 import path from 'node:path'
 import { isDeepStrictEqual } from 'node:util'
 
-const SYNC_FIELDS = ['theme', 'updateCheck', 'activeProfile', 'profiles', 'sources']
+// activeProfile is deliberately local-only: remote activity must never select
+// a profile that can open machine-local paths or trusted executable sources.
+const SYNC_FIELDS = ['theme', 'updateCheck', 'profiles', 'sources']
 const SCRUBBED = new Set(['execution', 'path', 'secret'])
 const SECRET_KEY = /(?:^|_)(?:password|passwd|secret|token|api_?key|authorization|cookie|credential)(?:$|_)/i
 const CONTEXT_KEY = /^(?:content|contents|body|document|documents|knowledge|markdown|payload|raw|resolved|sections|text)$/i
@@ -128,9 +130,6 @@ function assertSettingsShape(settings) {
   if (settings.updateCheck !== undefined && typeof settings.updateCheck !== 'boolean') {
     throw new Error('Settings sync rejected an invalid update preference.')
   }
-  if (settings.activeProfile !== undefined && typeof settings.activeProfile !== 'string') {
-    throw new Error('Settings sync rejected an invalid active profile.')
-  }
   const assertSources = (sources) => {
     if (!Array.isArray(sources)) throw new Error('Settings sync rejected invalid source definitions.')
     for (const source of sources) {
diff --git a/apps/desktop/test/settings-sync.test.mjs b/apps/desktop/test/settings-sync.test.mjs
index f60e5e3..142fc25 100644
--- a/apps/desktop/test/settings-sync.test.mjs
+++ b/apps/desktop/test/settings-sync.test.mjs
@@ -36,7 +36,7 @@ test('scrubSettings recursively removes absolute paths and indirect secrets', ()
 })
 
 test('prepareSyncPayload allowlists metadata and rejects credentials or context', () => {
-  assert.deepEqual(prepareSyncPayload({ theme: 'light', updateCheck: true, privateNotes: 'never upload' }), {
+  assert.deepEqual(prepareSyncPayload({ theme: 'light', updateCheck: true, activeProfile: 'work', privateNotes: 'never upload' }), {
     theme: 'light',
     updateCheck: true,
   })
diff --git a/apps/site/src/content/docs/docs/getting-started/connect-an-agent.md b/apps/site/src/content/docs/docs/getting-started/connect-an-agent.md
index 9e25c2e..43b815c 100644
--- a/apps/site/src/content/docs/docs/getting-started/connect-an-agent.md
+++ b/apps/site/src/content/docs/docs/getting-started/connect-an-agent.md
@@ -17,6 +17,11 @@ Point it at the bundled demo:
 node mcp-server.mjs --manifest apps/playground/manifest.json
 ```
 
+With a Project Profiles manifest, register this command once. The server selects
+`--profile` when explicitly supplied; otherwise it uses the deepest project
+mapping that contains the MCP process's startup working directory, then falls
+back to `default`.
+
 Or use the legacy two-layer form, no manifest file required:
 
 ```bash
@@ -44,6 +49,27 @@ The server identifies itself over the MCP `initialize` handshake as
 `contextcake`. Any MCP-compatible client — not just Claude Code — can spawn it
 the same way: `command` is `node`, `args` are the script path and flags.
 
+## Verify automatic selection
+
+From a mapped project folder, first confirm the CLI selection:
+
+```bash
+cd /ABS/PATH/TO/MAPPED/PROJECT
+contextcake profile current
+```
+
+Start a new agent session from that folder. Its MCP initialization instructions
+should name the same stable profile id and `reason: project`; the display label
+is available in structured initialization metadata. Then call `list_concepts`
+and confirm only that profile's concepts appear. The project path itself is
+never included in MCP instructions.
+
+Some clients do not start a global stdio server with the project as its working
+directory. For those clients, automatic folder mapping is unavailable. Use the
+default profile, or create a separately named opt-in registration whose command
+is `contextcake mcp --profile <id>`. Do not replace the one global automatic
+registration unless that client requires it.
+
 ## Tools
 
 | Tool | What it returns |
diff --git a/apps/site/src/content/docs/docs/guides/capture-write-path.md b/apps/site/src/content/docs/docs/guides/capture-write-path.md
index ea6a798..cd641b5 100644
--- a/apps/site/src/content/docs/docs/guides/capture-write-path.md
+++ b/apps/site/src/content/docs/docs/guides/capture-write-path.md
@@ -100,6 +100,8 @@ Flags: `--signals <file>` (required), `--manifest <file>` (required),
 `--target-layer <name>` (defaults to the highest layer level below 3 — i.e.
 not personal — or level 3 if that's the only layer available),
 `--dry-run` (prints what would be written without touching disk), `--help`.
+The target must be a non-live local OKF layer; plain Markdown-folder sources
+and live capture repositories are not batch-write targets.
 
 Per signal:
 
@@ -111,6 +113,10 @@ Per signal:
   — pending a human decision. A signal that already resolves to an existing
   file is skipped rather than overwritten.
 
+Destinations are validated as concept ids. Traversal and symlinked parents or
+files are rejected before a write, so classifier output cannot escape the
+selected profile's target root.
+
 Every written or staged concept carries `draft: true`, `source: <repo>`, and
 an `updated` date in its frontmatter, plus a `## Context {#context}` section
 with the recommended action and a `## Signals {#signals}` section listing the
diff --git a/apps/site/src/content/docs/docs/guides/promoting-concepts.md b/apps/site/src/content/docs/docs/guides/promoting-concepts.md
index d5bebe6..86b8904 100644
--- a/apps/site/src/content/docs/docs/guides/promoting-concepts.md
+++ b/apps/site/src/content/docs/docs/guides/promoting-concepts.md
@@ -1,31 +1,62 @@
 ---
 title: Promoting concepts
-description: Move a concept up the stack — personal to shared.
+description: Promote a live capture into a curated layer without crossing profile boundaries.
 ---
 
-A concept that started as a personal note often deserves to become team
-knowledge. `promote.mjs` copies a concept from a personal OKF bundle into a
-shared bundle, rewrites its links, and rebuilds the shared index — it doesn't
-touch the resolver or the manifest at all; it operates directly on two
-bundle directories.
+A useful live capture often deserves to become curated team knowledge.
+`promote.mjs` uses the same Project Profile selection as MCP, resolves both
+the live source and curated target from that one profile, and stages a review
+before it removes anything from the live repository.
 
 ## Usage
 
+Request a promotion:
+
 ```bash
-node promote.mjs --personal <dir> --shared <dir> --file <concept-or-path> [--dry-run] [--print-git]
+contextcake promote --capture captures/investigation/<id> --target-layer team --dest systems/<id>
 ```
 
-`--personal <dir>` and `--shared <dir>` are the two bundle roots (required).
-`--file <concept-or-path>` is the concept to promote — a bare id like
-`decisions/primary-db` or a path, with or without `.md` (required).
+The command selects an explicit `--profile <id>`, the deepest project mapping
+for the current directory, or `default`, in that order. The selected profile
+must contain exactly one `live: true` local OKF layer and the named curated
+`--target-layer`.
+
+After reviewing the generated file under the curated layer's
+`_review/promotions/` directory, approve it:
+
+```bash
+contextcake promote --approve /ABS/PATH/team/_review/promotions/<slug>.md --target-layer team
+```
+
+The review carries the profile id, manifest revision, live-layer and
+target-layer fingerprints, capture id, destination, and capture-content hash
+from the request. Approval reselects the same profile and fails if configuration
+or capture content changed. ContextCake holds the manifest boundary across that
+check and the local mutation. Only after the curated write verifies and the
+live deletion commits does it remove the review entry; a failed commit restores
+the capture and leaves the review retryable.
+
+Live captures and review entries must be regular files inside their selected
+layer roots. Symlinked files and any parent path that escapes its selected root
+are rejected rather than followed.
+The editable review carries an opaque binding id; its authoritative tuple is
+kept in ContextCake's machine-local state, not in the team repository. This
+lets people edit the proposed prose without letting the review redefine its
+source capture, destination, or trust boundary.
+
+## Legacy raw-directory mode
+
+The original personal-to-shared copy and raw live-root flow remain available
+for advanced compatibility. They require `--legacy-paths` so a command that
+bypasses Project Profile isolation is explicit:
 
 ```bash
-node promote.mjs --personal ~/kb-personal --shared ~/kb-team --file decisions/primary-db
+node promote.mjs --legacy-paths --personal ~/kb-personal --shared ~/kb-team --file decisions/primary-db
+node promote.mjs --legacy-paths --from-live ~/kb-live --capture captures/investigation/<id> --target ~/kb-team
 ```
 
-This copies `~/kb-personal/decisions/primary-db.md` to
-`~/kb-team/decisions/primary-db.md`, preserving its relative path, and
-rewrites the shared bundle's `index.md` to include it.
+The remaining options on this page describe that legacy personal-to-shared
+copy mode.
 
 ## Link rewriting
 
@@ -54,7 +85,7 @@ the shared index authoritative without hand-maintaining it.
 touching disk:
 
 ```bash
-node promote.mjs --personal ~/kb-personal --shared ~/kb-team --file decisions/primary-db --dry-run
+node promote.mjs --legacy-paths --personal ~/kb-personal --shared ~/kb-team --file decisions/primary-db --dry-run
 ```
 
 ```json
@@ -74,7 +105,7 @@ node promote.mjs --personal ~/kb-personal --shared ~/kb-team --file decisions/pr
 — it doesn't run them for you:
 
 ```bash
-node promote.mjs --personal ~/kb-personal --shared ~/kb-team --file decisions/primary-db --print-git
+node promote.mjs --legacy-paths --personal ~/kb-personal --shared ~/kb-team --file decisions/primary-db --print-git
 ```
 
 ```
@@ -95,13 +126,13 @@ override it. Since the shared bundle is its own git repo, promotion becomes a
 normal reviewable PR against team or company knowledge — nothing is written
 straight to a shared main branch unreviewed.
 
-## Why directories, not a manifest
+## Why the legacy mode still exists
 
-`promote.mjs` takes `--personal`/`--shared` directories rather than
-`--manifest`/`--target-layer` like `write.mjs`. Promotion is a bundle-to-bundle
-file operation between two known OKF roots you already have local paths to
-— it doesn't need the full source-adapter machinery that lets a manifest
-layer be `mcp` or a remote clone.
+Older scripts may already know two explicit bundle roots and may not use a
+ContextCake manifest. `--legacy-paths` preserves that workflow, but it cannot
+claim cross-profile isolation or bind an approval to a manifest revision. New
+team-sync workflows should use `--manifest`/`--target-layer` (or the packaged
+CLI defaults) instead.
 
 ## Next
 
diff --git a/apps/site/src/content/docs/docs/reference/cli.md b/apps/site/src/content/docs/docs/reference/cli.md
index 42610a9..bf85b0f 100644
--- a/apps/site/src/content/docs/docs/reference/cli.md
+++ b/apps/site/src/content/docs/docs/reference/cli.md
@@ -16,13 +16,14 @@ merge, level precedence, provenance, and per-section conflicts — and prints it
 JSON.
 
 ```
-node resolver.mjs --manifest <file> --concept <id>
+node resolver.mjs --manifest <file> --concept <id> [--profile <id>]
 ```
 
 | Flag | Required | Meaning |
 |------|----------|---------|
 | `--manifest <file>` | yes | Path to the [layers manifest](/docs/reference/manifest). |
 | `--concept <id>` | yes | Concept ID to resolve, e.g. `decisions/primary-db`. |
+| `--profile <id>` | no | Select this profile before inspecting the working directory. |
 | `--help`, `-h` | no | Print usage and exit. |
 
 ```bash
@@ -41,13 +42,14 @@ cascade mode (a manifest) or the legacy two-layer mode (explicit personal + shar
 directories).
 
 ```
-node mcp-server.mjs --manifest <file>
+node mcp-server.mjs --manifest <file> [--profile <id>]
 node mcp-server.mjs --personal <dir> --shared <dir>
 ```
 
 | Flag | Required | Meaning |
 |------|----------|---------|
 | `--manifest <file>` | one mode | Cascade mode: resolve the full stack in the manifest. |
+| `--profile <id>` | no | Explicit profile override. Otherwise the server uses its startup working directory, then `default`. |
 | `--personal <dir>` | one mode | Legacy mode: personal bundle directory (level 3). Use with `--shared`. |
 | `--shared <dir>` | one mode | Legacy mode: shared bundle directory (level 0). Use with `--personal`. |
 | `--help`, `-h` | no | Print usage and exit. |
@@ -62,6 +64,32 @@ The server speaks MCP over stdin/stdout. See [MCP tools](/docs/reference/mcp-too
 for the tools it exposes and [Connect an agent](/docs/getting-started/connect-an-agent)
 for wiring it into a client.
 
+The MCP initialization instructions identify the stable profile id and reason
+(`explicit`, `project`, `default`, or `legacy-default`) without including a
+local project path. The human-readable label is returned as structured
+initialization metadata rather than instruction prose, so synced display text
+cannot become an agent directive. Selection is fixed for that process lifetime.
+
+## profile
+
+Inspects and manages local Project Profiles without opening source adapters:
+
+```bash
+contextcake profile current [--profile <id>] [--json]
+contextcake profile list [--json]
+contextcake profile create <label> [--project <path>]
+contextcake profile map <id> <path>
+contextcake profile unmap <path>
+contextcake profile delete <id> [--confirm]
+```
+
+`current` reports the selected id, label, reason, and matched root when one
+applies. `create` is the deliberate migration point for a flat manifest and
+returns the verified backup path. Project folders are canonicalized locally and
+never synced. `delete` refuses `default`, previews affected mappings and Pack
+assignments, and requires `--confirm`; it removes references but never source,
+Pack, overlay, cache, or live-repository files.
+
 ## ingest.mjs
 
 Classifies a list of normalized repo signal events through the context policy and
@@ -127,14 +155,15 @@ bundle. `team_candidate` signals are written directly; `review_required` signals
 staged under `_review/` for human approval; `ignore` and `local` are skipped.
 
 ```
-node write.mjs --signals <file> --manifest <file> --target-layer <name>
+node write.mjs --signals <file> --manifest <file> [--profile <id>] --target-layer <name>
 ```
 
 | Flag | Required | Meaning |
 |------|----------|---------|
 | `--signals <file>` | yes | The `signals.json` produced by `ingest.mjs`. |
 | `--manifest <file>` | yes | Manifest whose layers name the write targets. |
-| `--target-layer <name>` | no | Layer to write into. Defaults to the highest level below 3 (team, company, etc.). |
+| `--profile <id>` | no | Explicit profile override; otherwise use cwd mapping then `default`. |
+| `--target-layer <name>` | no | Curated local OKF layer to write into. Plain Markdown folders and live layers are rejected. Defaults to the highest eligible level below 3. |
 | `--dry-run` | no | Report what would be written without touching disk. |
 | `--help`, `-h` | no | Print usage and exit. |
 
@@ -146,26 +175,24 @@ See [The capture write path](/docs/guides/capture-write-path).
 
 ## promote.mjs
 
-Copies one markdown concept from a personal OKF bundle into a shared bundle,
-rewriting personal links and rebuilding the shared `index.md`. It works over two
-**directories**, not a manifest.
+Profile-aware live promotion resolves both the live source and curated target
+from one selected profile:
 
-```
-node promote.mjs --personal <dir> --shared <dir> --file <concept-or-path>
+```bash
+node promote.mjs --manifest <file> [--profile <id>] --capture <id> --target-layer <name> [--dest <id>]
+node promote.mjs --manifest <file> [--profile <id>] --approve <review-file> --target-layer <name> [--telemetry]
 ```
 
-| Flag | Required | Meaning |
-|------|----------|---------|
-| `--personal <dir>` | yes | Source personal bundle directory. |
-| `--shared <dir>` | yes | Destination shared bundle directory. |
-| `--file <concept-or-path>` | yes | Concept ID or path to promote (`.md` optional). |
-| `--branch <name>` | no | Branch name suggested by `--print-git`. Defaults to `promote/<concept-slug>` — `.md` dropped and every character outside `[a-zA-Z0-9._-]` (including `/`) collapsed to a hyphen, e.g. `decisions/primary-db` → `promote/decisions-primary-db`. |
-| `--dry-run` | no | Print the planned operations and promoted content as JSON; write nothing. |
-| `--print-git` | no | After writing, print suggested `git` commands to open a PR. |
-| `--help`, `-h` | no | Print usage and exit. |
+The review file records the profile id, manifest revision, live-layer and
+target-layer fingerprints, capture id, destination, and capture-content hash.
+Approval fails closed if configuration or capture content changed after staging.
+
+The old directory-to-directory commands remain available only as an explicit
+advanced compatibility mode and carry no Project Profile isolation guarantee:
 
 ```bash
-node promote.mjs --personal ~/kb-personal --shared ~/kb-team --file decisions/primary-db --print-git
+node promote.mjs --legacy-paths --from-live <root> --capture <id> --target <root>
+node promote.mjs --legacy-paths --personal <dir> --shared <dir> --file <concept-or-path> [--dry-run] [--print-git]
 ```
 
 See [Promoting concepts](/docs/guides/promoting-concepts).
diff --git a/apps/site/src/content/docs/docs/reference/manifest.md b/apps/site/src/content/docs/docs/reference/manifest.md
index 5db5944..073fa2c 100644
--- a/apps/site/src/content/docs/docs/reference/manifest.md
+++ b/apps/site/src/content/docs/docs/reference/manifest.md
@@ -8,11 +8,9 @@ project mappings, layer stacks, and Pack assignments. Every command that resolve
 knowledge is pointed at one with `--manifest`.
 
 ContextCake still reads the original flat `layers` shape without rewriting it.
-The Project Profiles rollout adds a canonical v2 shape with a required `default`
-profile. The shared manifest and Pack code understand v2 now; automatic profile
-selection in `resolver.mjs` and `mcp-server.mjs` arrives in the next implementation
-slice. Until that wiring ships, keep agent-facing manifests flat rather than
-manually converting them.
+The canonical v2 shape adds a required `default` profile. `resolver.mjs`,
+`mcp-server.mjs`, `write.mjs`, live capture, telemetry, and profile-aware
+promotion all select one profile before they open or write a source.
 
 ## Current flat schema
 
@@ -74,8 +72,7 @@ The v2 rules are intentionally strict:
 - `projects` maps absolute, machine-local folders to profile ids. The paths are
   never uploaded by settings sync.
 - `pendingSources` holds synced descriptors that are incomplete or not yet
-  trusted on this machine. The later profile UI will present them as repair tasks;
-  the engine never treats them as runnable layers.
+  trusted on this machine. The engine never treats them as runnable layers.
 - Canonical v2 has `profiles` and no top-level `layers`.
 
 ### Selection order
@@ -91,6 +88,12 @@ An explicit or matched unknown profile fails closed. It never falls through to
 unrelated default context. Symlink aliases are resolved to real paths; two equally
 specific aliases that name different profiles are a configuration error.
 
+The selection is bound for the lifetime of an MCP process. Changing a mapping or
+the app's visible profile does not redirect an already-running agent. Restart the
+agent session after configuration changes. Pending capture and promotion approvals
+also revalidate the manifest revision and live/target layer identities before they
+write, and hold the manifest mutation lock through the local write boundary.
+
 ### Migration and transitional manifests
 
 Existing flat manifests are not migrated on read. Creating the first additional
diff --git a/apps/site/src/content/docs/docs/reference/mcp-tools.md b/apps/site/src/content/docs/docs/reference/mcp-tools.md
index f1dee54..768b871 100644
--- a/apps/site/src/content/docs/docs/reference/mcp-tools.md
+++ b/apps/site/src/content/docs/docs/reference/mcp-tools.md
@@ -6,7 +6,7 @@ description: search, read_file, list_concepts, get_links, find_captures, whats_n
 `mcp-server.mjs` is a stdio MCP server that exposes the resolved cascade to AI
 agents as one effective, read-time OKF graph. Reads resolve through the same
 section/field merge as the CLI — level precedence, provenance, per-section
-conflicts — over every source in the manifest.
+conflicts — over only the sources in the profile selected at process startup.
 
 ## The read tools
 
@@ -31,6 +31,12 @@ default server stays read-only. Both feed the two-phase show-before-share flow:
 | `log_capture` | Validates a capture, scans for credentials, and returns a rendered preview plus a single-use staging token. Nothing is shared yet. |
 | `confirm_capture` | Commits and shares a staged capture — call only after the user has seen the preview and approved. |
 
+The server finds a live layer only inside the selected profile. A staging token
+is bound to the profile id, manifest revision, and live-layer fingerprint;
+confirmation re-reads that configuration and rejects the write if it changed.
+The shared manifest lock stays held through the local write and commit, so a
+concurrent profile edit cannot retarget the operation between check and write.
+
 ## search
 
 Full-text search across every layer, scored and deduplicated by concept ID.
@@ -155,7 +161,7 @@ Start it against a manifest (cascade mode) or an explicit two-layer stack (legac
 mode):
 
 ```bash
-node mcp-server.mjs --manifest apps/playground/manifest.json
+node mcp-server.mjs --manifest apps/playground/manifest.json [--profile <id>]
 ```
 
 ```bash
diff --git a/apps/site/src/content/docs/docs/reference/updates-and-privacy.md b/apps/site/src/content/docs/docs/reference/updates-and-privacy.md
index 888b966..e646f13 100644
--- a/apps/site/src/content/docs/docs/reference/updates-and-privacy.md
+++ b/apps/site/src/content/docs/docs/reference/updates-and-privacy.md
@@ -83,8 +83,8 @@ The server-side account data includes:
 - Supabase Auth audit logs, which can include the user ID, IP address, user agent,
   provider metadata, and event timestamps;
 - one owner-only `user_settings` row. Its JSON blob is limited to 1,000,000 bytes
-  and can contain only `theme`, `updateCheck`, `activeProfile`, `profiles`, and
-  `sources`. Profile metadata is limited to names/labels, source membership,
+  and can contain only `theme`, `updateCheck`, `profiles`, and `sources`.
+  Profile metadata is limited to names/labels, source membership,
   theme preference, and manifest layers. Source metadata is limited to its
   name, kind, precedence, repository/ref/origin, cache policy, and scrubbed
   placeholders for machine-local execution or credentials.
@@ -99,6 +99,13 @@ ContextCake never syncs knowledge or document content, resolved output, integrat
 tokens, environment-variable values, absolute local paths, analytics, or telemetry.
 Those stay on the Mac. Deleting the account removes the Supabase Auth user and the
 cascading settings row; local ContextCake files and settings are left untouched.
+Project-folder mappings, matched roots, and the app's active profile are also
+local-only. A remote settings row cannot activate a profile or redirect a trusted
+local executable source.
+Profile-aware promotion keeps a small machine-local binding record containing
+opaque ids, configuration fingerprints, and a capture hash until approval
+finishes. It contains no context body and is never part of settings sync or the
+team live repository.
 Supabase-managed operational and audit logs follow the project's configured retention
 and are not necessarily removed when the account is deleted.
 
diff --git a/examples/team-sync-pack/README.md b/examples/team-sync-pack/README.md
index 4d26b80..11c220d 100644
--- a/examples/team-sync-pack/README.md
+++ b/examples/team-sync-pack/README.md
@@ -93,9 +93,9 @@ promotion:
 
 ```bash
 # request (stages under _review/promotions/ in the curated bundle)
-node promote.mjs --from-live ~/kb-live --capture captures/investigation/<id> --target ~/kb-team
+node promote.mjs --legacy-paths --from-live ~/kb-live --capture captures/investigation/<id> --target ~/kb-team
 # approve (writes the curated concept durably, THEN cleans up)
-node promote.mjs --from-live ~/kb-live --target ~/kb-team --approve ~/kb-team/_review/promotions/<slug>.md
+node promote.mjs --legacy-paths --from-live ~/kb-live --target ~/kb-team --approve ~/kb-team/_review/promotions/<slug>.md
 ```
 
 Defaults: `decision` → `decisions/`, `investigation` → `systems/`; `gotcha`
diff --git a/package.json b/package.json
index 6531bc3..369f9b5 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
   "description": "Federated team knowledge with cascading layer precedence — OKF-compatible, MCP-ready.",
   "type": "module",
   "scripts": {
-    "test": "bash packages/core/tests/smoke-test.sh && bash packages/core/tests/resolver-test.sh && bash packages/core/tests/source-test.sh && bash packages/core/tests/files-source-test.sh && bash packages/core/tests/github-source-test.sh && node --test packages/core/tests/manifest.test.mjs && bash packages/core/tests/pack-test.sh && bash packages/core/tests/git-sync-test.sh && bash packages/core/tests/capture-test.sh && bash packages/core/tests/team-sync-mcp-test.sh && bash packages/core/tests/playground-test.sh && bash packages/core/tests/service-test.sh && bash packages/core/tests/mcp-respawn-test.sh && bash packages/core/tests/setup-robustness-test.sh",
+    "test": "bash packages/core/tests/smoke-test.sh && bash packages/core/tests/resolver-test.sh && bash packages/core/tests/source-test.sh && bash packages/core/tests/files-source-test.sh && bash packages/core/tests/github-source-test.sh && node --test packages/core/tests/manifest.test.mjs && bash packages/core/tests/profile-runtime-test.sh && bash packages/core/tests/pack-test.sh && bash packages/core/tests/git-sync-test.sh && bash packages/core/tests/capture-test.sh && bash packages/core/tests/team-sync-mcp-test.sh && bash packages/core/tests/playground-test.sh && bash packages/core/tests/service-test.sh && bash packages/core/tests/mcp-respawn-test.sh && bash packages/core/tests/setup-robustness-test.sh",
     "mcp": "node mcp-server.mjs",
     "playground": "node apps/playground/server.mjs",
     "console:live": "npm --prefix apps/console run build:live && node apps/playground/server.mjs --console apps/console/dist",
diff --git a/packages/core/src/capture.mjs b/packages/core/src/capture.mjs
index 88e56a6..0abf122 100644
--- a/packages/core/src/capture.mjs
+++ b/packages/core/src/capture.mjs
@@ -195,20 +195,44 @@ export function renderCapture(capture, { author, capturedAt }) {
 // parent dir is created — a symlinked parent that escapes root. The final
 // component is handled at write time by writeFileInRoot (O_NOFOLLOW).
 export function assertInsideRoot(root, relFilePath) {
-  const target = path.resolve(root, relFilePath);
-  const rel = path.relative(root, target);
+  const absoluteRoot = path.resolve(root);
+  const target = path.resolve(absoluteRoot, relFilePath);
+  const rel = path.relative(absoluteRoot, target);
   if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel)) {
     throw new Error(`Path escapes live root: ${relFilePath}`);
   }
-  fs.mkdirSync(path.dirname(target), { recursive: true });
-  const realDir = fs.realpathSync(path.dirname(target));
-  const realRoot = fs.realpathSync(root);
-  if (realDir !== realRoot && !realDir.startsWith(realRoot + path.sep)) {
-    throw new Error(`Path escapes live root: ${relFilePath}`);
-  }
+  fs.mkdirSync(absoluteRoot, { recursive: true, mode: 0o700 });
+  ensureSafeParentDirectories(absoluteRoot, path.dirname(target), relFilePath);
   return target;
 }
 
+function ensureSafeParentDirectories(absoluteRoot, parent, relFilePath) {
+  const realRoot = fs.realpathSync(absoluteRoot);
+  const relativeParent = path.relative(absoluteRoot, parent);
+  let current = absoluteRoot;
+  for (const segment of relativeParent.split(path.sep).filter(Boolean)) {
+    current = path.join(current, segment);
+    let stat;
+    try {
+      stat = fs.lstatSync(current);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      // Create one component only after its parent has been verified. A
+      // recursive mkdir here would follow a committed outward symlink and
+      // mutate that external tree before the later realpath check.
+      fs.mkdirSync(current, { mode: 0o700 });
+      stat = fs.lstatSync(current);
+    }
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+      throw new Error(`Path escapes live root through a non-directory or symlink: ${relFilePath}`);
+    }
+    const realCurrent = fs.realpathSync(current);
+    if (realCurrent !== realRoot && !realCurrent.startsWith(realRoot + path.sep)) {
+      throw new Error(`Path escapes live root: ${relFilePath}`);
+    }
+  }
+}
+
 // Writes inside root without following a symlinked final component. O_NOFOLLOW
 // makes open() fail with ELOOP if `target` is a symlink, closing the
 // dangling-symlink escape (a teammate committing captures/x.md -> ~/.ssh/...
@@ -251,9 +275,38 @@ export function appendFileInRoot(root, relFilePath, data) {
   return target;
 }
 
+// Reads an existing regular file without following a symlinked parent or final
+// component. Team live repositories are a trust boundary, so promotion must
+// never turn a committed symlink into an arbitrary local-file disclosure.
+export function readFileInRoot(root, relFilePath, encoding = "utf8") {
+  const target = path.resolve(root, relFilePath);
+  const rel = path.relative(root, target);
+  if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel)) {
+    throw new Error(`Path escapes live root: ${relFilePath}`);
+  }
+  const realRoot = fs.realpathSync(root);
+  const realDir = fs.realpathSync(path.dirname(target));
+  if (realDir !== realRoot && !realDir.startsWith(realRoot + path.sep)) {
+    throw new Error(`Path escapes live root: ${relFilePath}`);
+  }
+  let fd;
+  try {
+    fd = fs.openSync(target, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+  } catch (error) {
+    if (error.code === "ELOOP") throw new Error(`Refusing to read through a symlink: ${relFilePath}`);
+    throw error;
+  }
+  try {
+    if (!fs.fstatSync(fd).isFile()) throw new Error(`Read target is not a regular file: ${relFilePath}`);
+    return fs.readFileSync(fd, encoding);
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
 // ---- two-phase staging ---------------------------------------------------------------
 
-const staged = new Map(); // token -> { capture, id, author, capturedAt, stagedAt }
+const staged = new Map(); // token -> { capture, id, author, capturedAt, stagedAt, binding }
 
 function sweep(now) {
   for (const [token, entry] of staged) {
@@ -275,7 +328,7 @@ function uniqueId(root, kind, author, title) {
 }
 
 export async function stageCapture(payload, ctx) {
-  const { root, profileName = null, policyPath = defaultCapturePolicyPath, now = Date.now } = ctx;
+  const { root, profileName = null, policyPath = defaultCapturePolicyPath, now = Date.now, binding = null } = ctx;
   sweep(now);
 
   const validation = validateCapture(payload);
@@ -316,37 +369,73 @@ export async function stageCapture(payload, ctx) {
     const oldest = [...staged.entries()].sort((a, b) => a[1].stagedAt - b[1].stagedAt)[0];
     if (oldest) staged.delete(oldest[0]);
   }
-  staged.set(token, { capture: payload, id, author, capturedAt, stagedAt: now() });
+  staged.set(token, {
+    capture: payload,
+    id,
+    author,
+    capturedAt,
+    stagedAt: now(),
+    binding: binding ? { ...binding } : null,
+  });
 
   const preview = warnings.length > 0 ? `> ⚠ ${warnings.join("\n> ⚠ ")}\n\n${rendered}` : rendered;
   return { staged: true, token, id, preview, warnings, route: routed.route };
 }
 
 export async function confirmCapture(token, ctx) {
-  const { root, now = Date.now, onEvent = null } = ctx;
+  const {
+    root,
+    now = Date.now,
+    onEvent = null,
+    binding = null,
+    revalidateBinding = null,
+    withBindingLock = null,
+  } = ctx;
   sweep(now);
 
   const entry = staged.get(token);
   staged.delete(token); // single-use, consumed even if the write below fails
   if (!entry) throw new Error("Unknown, expired, or already-used staging token — stage the capture again.");
 
-  // Re-check uniqueness at confirm time (a teammate's capture may have landed).
-  const id = fs.existsSync(path.join(root, `${entry.id}.md`)) ? uniqueId(root, entry.capture.kind, entry.author, entry.capture.title) : entry.id;
-  normalizeConceptId(id);
-  writeFileInRoot(root, `${id}.md`, renderCapture(entry.capture, { author: entry.author, capturedAt: entry.capturedAt }));
-
-  const extraPaths = typeof onEvent === "function"
-    ? (onEvent({ event: "confirm", concept: id, captureKind: entry.capture.kind, user: entry.author }) ?? [])
-    : [];
-  try {
-    await commitPaths(root, [`${id}.md`, ...extraPaths], `feat: capture ${id}`, { author: entry.author });
-  } catch (error) {
-    // Commit failed (lock contention, etc.): don't strand an untracked file
-    // that a later commit could sweep up. The token is already consumed —
-    // the caller re-stages.
-    try { fs.rmSync(path.join(root, `${id}.md`), { force: true }); } catch { /* best effort */ }
-    throw error;
+  if (entry.binding && typeof withBindingLock !== "function") {
+    const current = typeof revalidateBinding === "function"
+      ? revalidateBinding(entry.binding)
+      : binding;
+    if (!current || !sameBinding(entry.binding, current)) {
+      throw new Error("The selected profile or live-layer configuration changed after staging. Stage the capture again in a new session.");
+    }
   }
+
+  const persist = async () => {
+    // Re-check uniqueness at confirm time (a teammate's capture may have landed).
+    const id = fs.existsSync(path.join(root, `${entry.id}.md`)) ? uniqueId(root, entry.capture.kind, entry.author, entry.capture.title) : entry.id;
+    normalizeConceptId(id);
+    writeFileInRoot(root, `${id}.md`, renderCapture(entry.capture, { author: entry.author, capturedAt: entry.capturedAt }));
+
+    const extraPaths = typeof onEvent === "function"
+      ? (onEvent({ event: "confirm", concept: id, captureKind: entry.capture.kind, user: entry.author }) ?? [])
+      : [];
+    try {
+      await commitPaths(root, [`${id}.md`, ...extraPaths], `feat: capture ${id}`, { author: entry.author });
+    } catch (error) {
+      // Commit failed (lock contention, etc.): don't strand an untracked file
+      // that a later commit could sweep up. The token is already consumed —
+      // the caller re-stages.
+      try { fs.rmSync(path.join(root, `${id}.md`), { force: true }); } catch { /* best effort */ }
+      throw error;
+    }
+    return id;
+  };
+
+  const id = entry.binding && typeof withBindingLock === "function"
+    ? await withBindingLock(entry.binding, persist)
+    : await persist();
   const pushed = await push(root);
   return { id, pushed: pushed.pushed === true, ...(pushed.queued ? { queued: true } : {}) };
 }
+
+function sameBinding(left, right) {
+  return left.profileId === right.profileId
+    && left.manifestRevision === right.manifestRevision
+    && left.liveLayerFingerprint === right.liveLayerFingerprint;
+}
diff --git a/packages/core/src/manifest.mjs b/packages/core/src/manifest.mjs
index 627a92e..c362d73 100644
--- a/packages/core/src/manifest.mjs
+++ b/packages/core/src/manifest.mjs
@@ -287,6 +287,30 @@ export function withManifestLock(manifestPath, mutate, {
   }
 }
 
+// Async counterpart for profile-bound runtime writes. Holding the same lock
+// across revalidation and the resulting filesystem/git mutation closes the
+// race where a concurrent profile edit could retarget a write after the check.
+export async function withManifestLockAsync(manifestPath, mutate, {
+  timeoutMs = MANIFEST_LOCK_TIMEOUT_MS,
+  staleMs = MANIFEST_LOCK_STALE_MS,
+} = {}) {
+  const resolved = path.resolve(manifestPath);
+  const lockPath = `${resolved}.lock`;
+  fs.mkdirSync(path.dirname(resolved), { recursive: true, mode: 0o700 });
+  const deadline = Date.now() + timeoutMs;
+  let token = tryAcquireManifestLock(lockPath, staleMs);
+  while (token === null) {
+    if (Date.now() >= deadline) throw new Error(`Timed out acquiring the ContextCake manifest lock at ${lockPath}.`);
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    token = tryAcquireManifestLock(lockPath, staleMs);
+  }
+  try {
+    return await mutate();
+  } finally {
+    releaseManifestLock(lockPath, token);
+  }
+}
+
 export function mutateContextManifest(manifestPath, mutate, {
   allowMissing = true,
   allowLegacy = true,
diff --git a/packages/core/src/mcp-server.mjs b/packages/core/src/mcp-server.mjs
index b56838b..de1075a 100755
--- a/packages/core/src/mcp-server.mjs
+++ b/packages/core/src/mcp-server.mjs
@@ -5,19 +5,23 @@
 // resolver.mjs (level precedence, provenance, per-section conflicts) over the
 // source adapters in sources/ (OKF-local bundles + foreign graphs over MCP).
 //
-//   node mcp-server.mjs --manifest layers.json
+//   node mcp-server.mjs --manifest manifest.json [--profile work]
 //   node mcp-server.mjs --personal <dir> --shared <dir>   # legacy 2-layer stack
 
-import fs from "node:fs";
 import path from "node:path";
 import readline from "node:readline";
 import { resolveConcept } from "./resolver.mjs";
 import { buildSources } from "./sources/index.mjs";
 import { isTraversal } from "./sources/okf-local.mjs";
-import { resolveLiveLayer } from "./sources/git-sync.mjs";
 import { commitPaths, push } from "./sources/git-core.mjs";
 import { appendFileInRoot, stageCapture, confirmCapture, resolveAuthor } from "./capture.mjs";
 import { slugify } from "./classify-context.mjs";
+import {
+  buildProfileSources,
+  loadProfileRuntime,
+  resolveProfileLiveLayer,
+  withProfileLiveBinding,
+} from "./profile-runtime.mjs";
 
 const args = parseArgs(process.argv.slice(2));
 
@@ -26,15 +30,25 @@ if (args.help) {
   process.exit(0);
 }
 
-const layers = buildLayers(args);
+const runtime = args.manifest
+  ? loadProfileRuntime(args.manifest, { requestedProfile: args.profile ?? null, cwd: process.cwd() })
+  : null;
+const selection = runtime?.selection ?? {
+  mode: "legacy-paths",
+  profileId: "default",
+  profileLabel: "Default",
+  reason: "legacy-default",
+  matchedProjectRoot: null,
+};
+const layers = runtime ? buildProfileSources(runtime) : buildLegacyLayers(args);
 if (layers.length === 0) {
-  printHelp();
+  console.error(`Selected profile "${selection.profileLabel}" (${selection.profileId}) has no usable sources.`);
   process.exit(1);
 }
 
-const liveLayer = args.manifest
-  ? resolveLiveLayer(JSON.parse(fs.readFileSync(args.manifest, "utf8")), path.dirname(args.manifest))
-  : null;
+const { liveLayer, binding: liveLayerBinding } = runtime
+  ? resolveProfileLiveLayer(runtime)
+  : { liveLayer: null, binding: null };
 if ((args.capture || args.telemetry) && !liveLayer) {
   console.error(
     "--capture/--telemetry require a live layer: mark exactly one okf-local layer with \"live\": true and a \"git\" block in the manifest.",
@@ -46,6 +60,7 @@ const layerByName = new Map(layers.map((layer) => [layer.name, layer]));
 const serverInfo = { name: "contextcake", version: "0.1.0" };
 const serverInstructions = [
   "Consult ContextCake before answering project-specific questions.",
+  `Selected ContextCake profile id: ${selection.profileId}; reason: ${selection.reason}.`,
   "Start with list_concepts or search, then read the relevant resolved concept.",
   "Treat sourceLayer as precedence rather than certainty, preserve provenance, and surface conflicting guidance with its layers instead of silently reconciling it.",
   "Check find_captures before starting an investigation — captures are unreviewed teammate findings; weigh author and date.",
@@ -249,8 +264,16 @@ async function commitAndPushTelemetry() {
 }
 
 const rl = readline.createInterface({ input: process.stdin, crlfDelay: Infinity });
+const inFlight = new Set();
+let shutdownPromise = null;
 
-rl.on("line", async (line) => {
+rl.on("line", (line) => {
+  const pending = processLine(line);
+  inFlight.add(pending);
+  void pending.finally(() => inFlight.delete(pending));
+});
+
+async function processLine(line) {
   if (!line.trim()) return;
   let message;
   try {
@@ -265,15 +288,33 @@ rl.on("line", async (line) => {
   } catch (error) {
     write({ jsonrpc: "2.0", id: message.id ?? null, error: { code: -32000, message: error.message } });
   }
-});
+}
 
-// On stdin close (session end) flush accumulated telemetry to the shared repo.
-// Fire-and-forget: the pending promise keeps the loop alive until the git op
-// finishes, then the process exits naturally (no forced exit that could cut
-// off an in-flight response).
-rl.on("close", () => {
-  if (args.telemetry) void commitAndPushTelemetry();
-});
+async function shutdown() {
+  if (!shutdownPromise) {
+    shutdownPromise = (async () => {
+      if (args.telemetry) await commitAndPushTelemetry();
+      await Promise.allSettled(layers.map((layer) => Promise.resolve().then(() => layer.close?.())));
+    })();
+  }
+  return shutdownPromise;
+}
+
+async function drainAndShutdown() {
+  await Promise.allSettled([...inFlight]);
+  await shutdown();
+}
+
+// Finish already-received requests before closing spawned source adapters.
+// This lets piped stdio clients close stdin immediately without cutting off
+// their final response, while ensuring a long-lived foreign MCP child cannot
+// keep ContextCake alive after the harness disconnects.
+rl.on("close", () => { void drainAndShutdown(); });
+for (const signal of ["SIGINT", "SIGTERM"]) {
+  process.once(signal, () => {
+    void drainAndShutdown().finally(() => process.exit(0));
+  });
+}
 
 async function handleMessage(message) {
   const { id, method, params = {} } = message;
@@ -287,6 +328,15 @@ async function handleMessage(message) {
         capabilities: { tools: {} },
         serverInfo,
         instructions: serverInstructions,
+        _meta: {
+          contextcake: {
+            selectedProfile: {
+              id: selection.profileId,
+              label: selection.profileLabel,
+              reason: selection.reason,
+            },
+          },
+        },
       },
     };
   }
@@ -392,6 +442,7 @@ function captureContext() {
     root: liveLayer.root,
     profileName: liveLayer.profileName,
     retentionDays: liveLayer.retentionDays,
+    binding: liveLayerBinding,
   };
 }
 
@@ -404,6 +455,7 @@ async function logCapture(toolArgs) {
 async function confirmCaptureTool({ token }) {
   const result = await confirmCapture(token, {
     ...captureContext(),
+    withBindingLock: (expected, mutate) => withProfileLiveBinding(runtime, expected, mutate),
     onEvent: ({ concept, captureKind }) => {
       emitTelemetry({ event: "confirm", concept, layer: liveLayer.name, captureKind });
       // Deliberately do NOT ride telemetry along on the capture commit: that
@@ -532,11 +584,7 @@ async function getLinks({ concept_id }) {
 
 // ---- helpers --------------------------------------------------------------
 
-function buildLayers(parsed) {
-  if (parsed.manifest) {
-    const manifest = JSON.parse(fs.readFileSync(parsed.manifest, "utf8"));
-    return buildSources(manifest, path.dirname(parsed.manifest));
-  }
+function buildLegacyLayers(parsed) {
   if (parsed.personal && parsed.shared) {
     return buildSources(
       {
@@ -699,12 +747,14 @@ function write(message) {
 
 function printHelp() {
   console.log(`Usage:
-  node mcp-server.mjs --manifest layers.json
+  node mcp-server.mjs --manifest manifest.json [--profile <id>]
   node mcp-server.mjs --personal <dir> --shared <dir>
 
 Stdio MCP server exposing a cascade of knowledge sources (OKF-local bundles +
 foreign graphs over MCP) as one effective read-time OKF graph. read_file
 resolves the effective concept (section/field merge + provenance + per-section
-conflicts); pass a layer name to read a single layer's raw concept.
+conflicts); pass a layer name to read a single layer's raw concept. With a
+manifest, selection order is explicit --profile, deepest project mapping for
+the process working directory, then default.
 `);
 }
diff --git a/packages/core/src/profile-cli.mjs b/packages/core/src/profile-cli.mjs
new file mode 100644
index 0000000..8224d25
--- /dev/null
+++ b/packages/core/src/profile-cli.mjs
@@ -0,0 +1,216 @@
+#!/usr/bin/env node
+
+// Read-only profile inspection and locked local profile configuration.
+// No command in this file opens a source adapter.
+
+import fs from "node:fs";
+import path from "node:path";
+import {
+  classifyManifest,
+  createProfileId,
+  listManifestProfiles,
+  migrateManifestToV2,
+  mutateContextManifest,
+  normalizeProfileLabel,
+  readContextManifest,
+  selectManifestProfile,
+} from "./manifest.mjs";
+
+main();
+
+function main() {
+  const { command, positionals, options } = parseArgs(process.argv.slice(2));
+  if (options.help || !command || command === "help") {
+    printHelp();
+    process.exit(command || options.help ? 0 : 1);
+  }
+  if (!options.manifest) throw new Error("--manifest <file> is required.");
+  const manifestPath = path.resolve(options.manifest);
+
+  if (command === "current") return currentProfile(manifestPath, options);
+  if (command === "list") return listProfiles(manifestPath, options);
+  if (command === "create") return createProfile(manifestPath, positionals, options);
+  if (command === "map") return mapProject(manifestPath, positionals, options);
+  if (command === "unmap") return unmapProject(manifestPath, positionals, options);
+  if (command === "delete") return deleteProfile(manifestPath, positionals, options);
+  throw new Error(`Unknown profile command: ${command}`);
+}
+
+function currentProfile(manifestPath, options) {
+  const manifest = readContextManifest(manifestPath, { allowMissing: false, validatePacks: false });
+  const selected = selectManifestProfile(manifest, {
+    requestedProfile: options.profile ?? null,
+    cwd: process.cwd(),
+  });
+  const result = {
+    id: selected.profileId,
+    label: selected.profileLabel,
+    reason: selected.reason,
+    mode: selected.mode,
+    sourceCount: selected.layers.length,
+    ...(selected.matchedProjectRoot ? { matchedProjectRoot: selected.matchedProjectRoot } : {}),
+    ...(selected.warnings.length ? { warnings: selected.warnings } : {}),
+  };
+  output(result, options, `${result.label} (${result.id}) — ${result.reason}${result.matchedProjectRoot ? `\nProject: ${result.matchedProjectRoot}` : ""}`);
+}
+
+function listProfiles(manifestPath, options) {
+  const manifest = readContextManifest(manifestPath, { allowMissing: false, validatePacks: false });
+  const profiles = listManifestProfiles(manifest);
+  output(profiles, options, profiles.map((profile) => (
+    `${profile.id}\t${profile.label}\t${profile.sourceCount} source${profile.sourceCount === 1 ? "" : "s"}`
+      + `\t${profile.mappingCount} mapping${profile.mappingCount === 1 ? "" : "s"}`
+      + `${profile.valid ? "" : "\tneeds repair"}`
+  )).join("\n"));
+}
+
+function createProfile(manifestPath, positionals, options) {
+  const label = normalizeProfileLabel(positionals.join(" "));
+  const before = readContextManifest(manifestPath, { allowMissing: false });
+  const id = createProfileId(label, Object.keys(before.profiles ?? {}));
+  const result = migrateManifestToV2(manifestPath, {
+    newProfile: { id, label, layers: [] },
+    projectPath: options.project ? path.resolve(options.project) : null,
+  });
+  const response = {
+    created: id,
+    label,
+    action: result.action,
+    ...(options.project ? { project: fs.realpathSync.native(path.resolve(options.project)) } : {}),
+    ...(result.backupPath ? { backupPath: result.backupPath, backupHash: result.backupHash } : {}),
+  };
+  output(response, options, `Created ${label} (${response.created})${response.project ? `\nMapped ${response.project}` : ""}${response.backupPath ? `\nBackup: ${response.backupPath}` : ""}`);
+}
+
+function mapProject(manifestPath, positionals, options) {
+  const [profileId, projectPath] = positionals;
+  if (!profileId || !projectPath || positionals.length !== 2) throw new Error("Usage: profile map <id> <path> --manifest <file>");
+  const canonical = canonicalProjectPath(projectPath);
+  mutateContextManifest(manifestPath, (manifest) => {
+    requireV2(manifest, "Project mappings");
+    if (!Object.hasOwn(manifest.profiles, profileId)) throw new Error(`Unknown ContextCake profile: ${profileId}`);
+    manifest.projects ??= {};
+    for (const [configuredRoot, configuredProfile] of Object.entries(manifest.projects)) {
+      let existingCanonical;
+      try { existingCanonical = fs.realpathSync.native(configuredRoot); } catch { continue; }
+      if (existingCanonical !== canonical) continue;
+      if (configuredProfile !== profileId) {
+        throw new Error(`Project mapping already belongs to profile ${configuredProfile}: ${configuredRoot}`);
+      }
+      delete manifest.projects[configuredRoot];
+    }
+    manifest.projects[canonical] = profileId;
+  }, { allowMissing: false });
+  output({ mapped: canonical, profileId }, options, `Mapped ${canonical} -> ${profileId}`);
+}
+
+function unmapProject(manifestPath, positionals, options) {
+  const [requested] = positionals;
+  if (!requested || positionals.length !== 1) throw new Error("Usage: profile unmap <path> --manifest <file>");
+  const absolute = path.resolve(requested);
+  let canonical = null;
+  try { canonical = fs.realpathSync.native(absolute); } catch { /* stale mapping can still be removed by exact path */ }
+  let removed = null;
+  mutateContextManifest(manifestPath, (manifest) => {
+    requireV2(manifest, "Project mappings");
+    for (const configuredRoot of Object.keys(manifest.projects ?? {})) {
+      let matches = path.normalize(configuredRoot) === path.normalize(absolute);
+      if (!matches && canonical) {
+        try { matches = fs.realpathSync.native(configuredRoot) === canonical; } catch { /* stale */ }
+      }
+      if (!matches) continue;
+      removed = configuredRoot;
+      delete manifest.projects[configuredRoot];
+      break;
+    }
+    if (!removed) throw new Error(`No project mapping for: ${absolute}`);
+  }, { allowMissing: false });
+  output({ unmapped: removed }, options, `Removed mapping ${removed}`);
+}
+
+function deleteProfile(manifestPath, positionals, options) {
+  const [profileId] = positionals;
+  if (!profileId || positionals.length !== 1) throw new Error("Usage: profile delete <id> --manifest <file> [--confirm]");
+  if (profileId === "default") throw new Error("The default profile cannot be deleted.");
+  const manifest = readContextManifest(manifestPath, { allowMissing: false });
+  requireV2(manifest, "Profile deletion");
+  if (!Object.hasOwn(manifest.profiles, profileId)) throw new Error(`Unknown ContextCake profile: ${profileId}`);
+  const mappings = Object.keys(manifest.projects ?? {}).filter((root) => manifest.projects[root] === profileId);
+  const packAssignments = [];
+  for (const [packId, record] of Object.entries(manifest.packs ?? {})) {
+    if ((record.assignments ?? []).some((assignment) => assignment.profile === profileId)) packAssignments.push(packId);
+  }
+  const preview = { profileId, mappings, packAssignments, sourceCount: manifest.profiles[profileId].layers.length };
+  if (!options.confirm) {
+    output({ ...preview, deleted: false, confirmationRequired: true }, options,
+      `Delete ${profileId}? ${mappings.length} project mapping(s), ${packAssignments.length} Pack assignment(s), and the profile reference will be removed.\nUnderlying source, Pack, overlay, cache, and live-repository files will remain.\nRe-run with --confirm.`);
+    process.exitCode = 2;
+    return;
+  }
+  mutateContextManifest(manifestPath, (candidate) => {
+    requireV2(candidate, "Profile deletion");
+    if (!Object.hasOwn(candidate.profiles, profileId)) throw new Error(`Unknown ContextCake profile: ${profileId}`);
+    delete candidate.profiles[profileId];
+    for (const [root, assignedProfile] of Object.entries(candidate.projects ?? {})) {
+      if (assignedProfile === profileId) delete candidate.projects[root];
+    }
+    for (const record of Object.values(candidate.packs ?? {})) {
+      record.assignments = (record.assignments ?? []).filter((assignment) => assignment.profile !== profileId);
+    }
+  }, { allowMissing: false });
+  output({ ...preview, deleted: true }, options, `Deleted profile ${profileId}. Underlying files were not removed.`);
+}
+
+function canonicalProjectPath(value) {
+  const absolute = path.resolve(value);
+  const stat = fs.statSync(absolute);
+  if (!stat.isDirectory()) throw new Error(`Project mapping must name a directory: ${absolute}`);
+  return fs.realpathSync.native(absolute);
+}
+
+function requireV2(manifest, operation) {
+  if (classifyManifest(manifest) !== "v2") {
+    throw new Error(`${operation} require Manifest v2. Create a profile first to migrate this manifest safely.`);
+  }
+}
+
+function output(value, options, text) {
+  console.log(options.json ? JSON.stringify(value, null, 2) : text);
+}
+
+function parseArgs(argv) {
+  const options = {};
+  const positionals = [];
+  let command = null;
+  const booleanFlags = new Set(["json", "confirm", "help"]);
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "-h") options.help = true;
+    else if (arg.startsWith("--")) {
+      const key = arg.slice(2);
+      if (booleanFlags.has(key)) options[key] = true;
+      else {
+        if (argv[index + 1] === undefined || argv[index + 1].startsWith("--")) throw new Error(`${arg} requires a value.`);
+        options[key] = argv[index + 1];
+        index += 1;
+      }
+    } else if (command === null) command = arg;
+    else positionals.push(arg);
+  }
+  return { command, positionals, options };
+}
+
+function printHelp() {
+  console.log(`Usage: contextcake profile <command> [options]
+
+  current [--profile <id>] [--json]  Show the selected profile and reason
+  list [--json]                      List profiles without opening sources
+  create <label> [--project <path>] Create an empty profile; safely migrate legacy manifests
+  map <id> <path>                    Map a local project folder to a profile
+  unmap <path>                       Remove one project mapping
+  delete <id> [--confirm]            Remove references only; never source files
+
+All commands require --manifest <file>. Automatic selection uses the current
+working directory; --profile wins when provided to current.
+`);
+}
diff --git a/packages/core/src/profile-runtime.mjs b/packages/core/src/profile-runtime.mjs
new file mode 100644
index 0000000..a583e05
--- /dev/null
+++ b/packages/core/src/profile-runtime.mjs
@@ -0,0 +1,101 @@
+// Immutable per-process Project Profile context.
+//
+// Runtime callers select exactly once before opening adapters. They receive a
+// flat runtime manifest containing only the selected layers plus the global
+// engine settings; the complete manifest stays here for configuration and
+// binding revalidation only.
+
+import path from "node:path";
+import {
+  manifestRevision,
+  readContextManifest,
+  selectManifestProfile,
+  sourceConfigFingerprint,
+  withManifestLockAsync,
+} from "./manifest.mjs";
+import { buildSources } from "./sources/index.mjs";
+import { resolveLiveLayer } from "./sources/git-sync.mjs";
+
+export function loadProfileRuntime(manifestPath, {
+  requestedProfile = null,
+  cwd = process.cwd(),
+  realpath,
+} = {}) {
+  const resolvedManifestPath = path.resolve(manifestPath);
+  const manifestDir = path.dirname(resolvedManifestPath);
+  // Selection performs profile-scoped Pack validation so drift in an inactive
+  // profile is a warning rather than a reason to open or block this stack.
+  const manifest = readContextManifest(resolvedManifestPath, { allowMissing: false, validatePacks: false });
+  const selection = selectManifestProfile(manifest, {
+    requestedProfile,
+    cwd,
+    ...(realpath ? { realpath } : {}),
+  });
+  const revision = manifestRevision(manifest);
+  const runtimeManifest = {
+    layers: selection.layers,
+    ...(manifest.settings ? { settings: manifest.settings } : {}),
+  };
+  return {
+    manifestPath: resolvedManifestPath,
+    manifestDir,
+    selection: Object.freeze({ ...selection, layers: Object.freeze([...selection.layers]) }),
+    revision,
+    runtimeManifest,
+  };
+}
+
+export function buildProfileSources(runtime, options = {}) {
+  return buildSources(runtime.runtimeManifest, runtime.manifestDir, {
+    ...options,
+    profileId: runtime.selection.profileId,
+  });
+}
+
+export function resolveProfileLiveLayer(runtime) {
+  const liveLayer = resolveLiveLayer(runtime.selection.layers, runtime.manifestDir);
+  if (!liveLayer) return { liveLayer: null, binding: null };
+  return {
+    liveLayer,
+    binding: Object.freeze({
+      profileId: runtime.selection.profileId,
+      manifestRevision: runtime.revision,
+      liveLayerFingerprint: sourceConfigFingerprint(
+        runtime.selection.profileId,
+        liveLayer.layer,
+        runtime.manifestDir,
+      ),
+    }),
+  };
+}
+
+// Re-select the process-bound profile explicitly. A changed project mapping
+// cannot redirect an already-running MCP process, while deletion, invalidation,
+// or any manifest revision/live-layer change fails the pending write closed.
+export function revalidateProfileLiveBinding(runtime, expectedBinding) {
+  const current = loadProfileRuntime(runtime.manifestPath, {
+    requestedProfile: runtime.selection.profileId,
+    cwd: runtime.selection.matchedProjectRoot ?? process.cwd(),
+  });
+  const { binding } = resolveProfileLiveLayer(current);
+  if (!binding) throw new Error(`Profile ${expectedBinding.profileId} no longer has a live layer.`);
+  if (!sameProfileBinding(expectedBinding, binding)) {
+    throw new Error("The selected profile or live-layer configuration changed after staging. Stage the write again in a new session.");
+  }
+  return binding;
+}
+
+export function withProfileLiveBinding(runtime, expectedBinding, mutate) {
+  if (typeof mutate !== "function") throw new Error("A profile-bound mutation callback is required.");
+  return withManifestLockAsync(runtime.manifestPath, async () => {
+    const binding = revalidateProfileLiveBinding(runtime, expectedBinding);
+    return mutate(binding);
+  });
+}
+
+export function sameProfileBinding(left, right) {
+  return Boolean(left && right)
+    && left.profileId === right.profileId
+    && left.manifestRevision === right.manifestRevision
+    && left.liveLayerFingerprint === right.liveLayerFingerprint;
+}
diff --git a/packages/core/src/promote.mjs b/packages/core/src/promote.mjs
index 4d6c0c6..08827b1 100755
--- a/packages/core/src/promote.mjs
+++ b/packages/core/src/promote.mjs
@@ -1,22 +1,53 @@
 #!/usr/bin/env node
 
+import crypto from "node:crypto";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
-import { parseConcept } from "./sources/okf-local.mjs";
-import { commitPaths, push } from "./sources/git-core.mjs";
-import { appendFileInRoot, resolveAuthor, writeFileInRoot } from "./capture.mjs";
+import { normalizeConceptId as normalizeOkfConceptId, parseConcept } from "./sources/okf-local.mjs";
+import { commitPaths, commitPathsWithMutation, push, runGit } from "./sources/git-core.mjs";
+import { appendFileInRoot, readFileInRoot, resolveAuthor, writeFileInRoot } from "./capture.mjs";
 import { slugify } from "./classify-context.mjs";
+import { sourceConfigFingerprint, withManifestLockAsync } from "./manifest.mjs";
+import { loadProfileRuntime, resolveProfileLiveLayer } from "./profile-runtime.mjs";
+
+const PROMOTION_KEYS = [
+  "promoteTo",
+  "promotedFrom",
+  "promotionProfile",
+  "promotionRevision",
+  "promotionLiveFingerprint",
+  "promotionTargetFingerprint",
+  "promotionCapture",
+  "promotionDestination",
+  "promotionCaptureHash",
+  "promotionBinding",
+];
 
 const args = parseArgs(process.argv.slice(2));
 
-if (args["from-live"]) {
+if (args.manifest) {
+  await runProfilePromotion(args);
+  process.exit(0);
+}
+
+if (args["legacy-paths"] && args["from-live"]) {
   await runFromLive(args);
   process.exit(0);
 }
 
-if (args.help || !args.personal || !args.shared || !args.file) {
+if (args.help) {
   printHelp();
-  process.exit(args.help ? 0 : 1);
+  process.exit(0);
+}
+
+if (!args["legacy-paths"]) {
+  throw new Error("Profile-aware promotion requires --manifest. To use raw directory roots, pass --legacy-paths explicitly.");
+}
+
+if (!args.personal || !args.shared || !args.file) {
+  printHelp();
+  process.exit(1);
 }
 
 const personalRoot = path.resolve(args.personal);
@@ -68,6 +99,41 @@ if (args["print-git"]) {
 //   writes the curated concept, verifies it is durable, and only then removes
 //   the review entry and the live capture. Re-running approve is idempotent.
 
+async function runProfilePromotion(parsed) {
+  const manifestPath = path.resolve(parsed.manifest);
+  return withManifestLockAsync(manifestPath, async () => {
+    const runtime = loadProfileRuntime(manifestPath, {
+      requestedProfile: parsed.profile ?? null,
+      cwd: process.cwd(),
+    });
+    const { liveLayer, binding: liveBinding } = resolveProfileLiveLayer(runtime);
+    if (!liveLayer) throw new Error(`Selected profile ${runtime.selection.profileId} does not have a live layer.`);
+    const targetName = parsed["target-layer"];
+    if (!targetName) throw new Error("--target-layer <name> is required in profile-aware mode.");
+    const targetLayer = runtime.selection.layers.find((layer) => layer.name === targetName);
+    if (!targetLayer) throw new Error(`Layer ${targetName} is not in selected profile ${runtime.selection.profileId}.`);
+    if (targetLayer.live === true) throw new Error("The promotion target must be a curated layer, not the live layer.");
+    if ((targetLayer.source ?? "okf-local") !== "okf-local" || typeof targetLayer.path !== "string") {
+      throw new Error(`Promotion target ${targetName} must be a local OKF layer.`);
+    }
+    const curatedRoot = path.resolve(runtime.manifestDir, targetLayer.path);
+    const profileBinding = {
+      profileId: runtime.selection.profileId,
+      manifestRevision: runtime.revision,
+      liveLayerFingerprint: liveBinding.liveLayerFingerprint,
+      targetLayer: targetName,
+      targetLayerFingerprint: sourceConfigFingerprint(runtime.selection.profileId, targetLayer, runtime.manifestDir),
+    };
+    const bound = { ...parsed, _profileBinding: profileBinding, _manifestPath: manifestPath };
+    if (parsed.approve) {
+      const reviewPath = resolveProfileReviewPath(curatedRoot, parsed.approve);
+      return approvePromotion(liveLayer.root, curatedRoot, reviewPath, bound);
+    }
+    if (parsed.capture) return requestPromotion(liveLayer.root, curatedRoot, parsed.capture, bound);
+    throw new Error("Pass --capture <id> to request a promotion or --approve <review-file> to finalize one.");
+  });
+}
+
 function kindDest(kind) {
   return { decision: "decisions", investigation: "systems" }[kind] ?? null;
 }
@@ -88,10 +154,17 @@ function captureSlug(captureId) {
   return sep === -1 ? base : base.slice(sep + 2);
 }
 
-function requestPromotion(liveRoot, curatedRoot, captureId, parsed) {
-  const sourcePath = safeJoin(liveRoot, `${captureId}.md`);
-  if (!fs.existsSync(sourcePath)) throw new Error(`Capture not found in live layer: ${captureId}`);
-  const raw = fs.readFileSync(sourcePath, "utf8");
+async function requestPromotion(liveRoot, curatedRoot, captureId, parsed) {
+  captureId = safePromotionConceptId(captureId, "capture");
+  if (!captureId.startsWith("captures/")) throw new Error("Promotion source must be a live capture id under captures/.");
+  let raw;
+  try {
+    raw = readFileInRoot(liveRoot, `${captureId}.md`);
+  } catch (error) {
+    if (error.code === "ENOENT") throw new Error(`Capture not found in live layer: ${captureId}`);
+    throw error;
+  }
+  assertNoReservedPromotionKeys(raw);
   const { frontmatter } = parseConcept(raw);
 
   let dest = parsed.dest ?? null;
@@ -100,50 +173,317 @@ function requestPromotion(liveRoot, curatedRoot, captureId, parsed) {
     if (!prefix) throw new Error(`Kind "${frontmatter.kind}" has no default destination — pass --dest <concept-id>.`);
     dest = `${prefix}/${captureSlug(captureId)}`;
   }
+  dest = safePromotionConceptId(dest, "destination");
 
   const reviewRel = `_review/promotions/${slugify(path.posix.basename(dest))}.md`;
-  const staged = raw.replace(/^---\n/, `---\npromoteTo: ${dest}\npromotedFrom: ${captureId}\n`);
-  writeFileInRoot(curatedRoot, reviewRel, staged);
+  if (fs.existsSync(safeJoin(curatedRoot, reviewRel))) {
+    throw new Error(`Promotion review already exists: ${reviewRel}`);
+  }
+  const binding = parsed._profileBinding;
+  const captureHash = sha256(raw);
+  let liveHeadAtStage = null;
+  if (binding) {
+    const tracked = await runGit(liveRoot, ["ls-files", "--error-unmatch", "--", `${captureId}.md`], { allowFailure: true });
+    if (!tracked.ok) throw new Error("Profile-aware promotion requires a committed live capture. Sync or confirm it before staging.");
+    const head = await runGit(liveRoot, ["rev-parse", "HEAD"], { allowFailure: true });
+    if (!head.ok || !/^[a-f0-9]{40,64}$/i.test(head.stdout)) throw new Error("Could not bind promotion to the live repository revision.");
+    liveHeadAtStage = head.stdout;
+  }
+  const bindingNonce = binding
+    ? createPromotionBinding(parsed._manifestPath, {
+      profileId: binding.profileId,
+      manifestRevision: binding.manifestRevision,
+      liveLayerFingerprint: binding.liveLayerFingerprint,
+      targetLayerFingerprint: binding.targetLayerFingerprint,
+      captureId,
+      dest,
+      captureHash,
+      reviewRel,
+      liveHeadAtStage,
+      cleanupCommitted: false,
+    })
+    : null;
+  const bindingFrontmatter = binding
+    ? [
+      `promotionProfile: ${binding.profileId}`,
+      `promotionRevision: ${binding.manifestRevision}`,
+      `promotionLiveFingerprint: ${binding.liveLayerFingerprint}`,
+      `promotionTargetFingerprint: ${binding.targetLayerFingerprint}`,
+      `promotionCapture: ${captureId}`,
+      `promotionDestination: ${dest}`,
+      `promotionCaptureHash: ${captureHash}`,
+      `promotionBinding: ${bindingNonce}`,
+    ].join("\n") + "\n"
+    : "";
+  const staged = raw.replace(/^---\n/, `---\npromoteTo: ${dest}\npromotedFrom: ${captureId}\n${bindingFrontmatter}`);
+  try {
+    writeFileInRoot(curatedRoot, reviewRel, staged);
+  } catch (error) {
+    if (bindingNonce) deletePromotionBinding(parsed._manifestPath, bindingNonce);
+    throw error;
+  }
   console.log(`Staged promotion request: ${reviewRel} -> ${dest}`);
 }
 
 async function approvePromotion(liveRoot, curatedRoot, reviewPath, parsed) {
   if (!fs.existsSync(reviewPath)) throw new Error(`Review file not found: ${reviewPath}`);
-  const { frontmatter, sections } = parseConcept(fs.readFileSync(reviewPath, "utf8"));
-  const dest = frontmatter.promoteTo;
-  const captureId = frontmatter.promotedFrom;
-  if (!dest || !captureId) throw new Error("Review file is missing promoteTo/promotedFrom frontmatter.");
+  const reviewRaw = parsed._profileBinding
+    ? readFileInRoot(curatedRoot, path.relative(curatedRoot, reviewPath))
+    : fs.readFileSync(reviewPath, "utf8");
+  assertPromotionReviewKeys(reviewRaw, Boolean(parsed._profileBinding));
+  const { frontmatter, sections } = parseConcept(reviewRaw);
+  if (!frontmatter.promoteTo || !frontmatter.promotedFrom) {
+    throw new Error("Review file is missing promoteTo/promotedFrom frontmatter.");
+  }
+  // A review file is editable by design, so re-apply the same concept-id
+  // boundary used at request time before any read, write, delete, or log.
+  const dest = safePromotionConceptId(frontmatter.promoteTo, "destination");
+  const captureId = safePromotionConceptId(frontmatter.promotedFrom, "capture");
+  if (!captureId.startsWith("captures/")) throw new Error("Promotion source must be a live capture id under captures/.");
+  const reviewRel = toPosix(path.relative(curatedRoot, reviewPath));
+  const authoritative = parsed._profileBinding
+    ? loadPromotionBinding(parsed._manifestPath, frontmatter.promotionBinding)
+    : null;
+  if (parsed._profileBinding) {
+    assertPromotionBinding(frontmatter, parsed._profileBinding, authoritative, { captureId, dest, reviewRel });
+  }
 
   const destRel = `${dest}.md`;
   const destPath = safeJoin(curatedRoot, destRel);
 
-  // Idempotent re-approve: a valid existing curated concept means the write
-  // already happened — do cleanup only, never duplicate.
-  const alreadyDurable = fs.existsSync(destPath) && isDurable(destPath);
-  if (!alreadyDurable) {
-    writeFileInRoot(curatedRoot, destRel, renderCurated(frontmatter, sections, dest));
-    if (!isDurable(destPath)) throw new Error(`Curated write failed verification: ${destRel}`);
+  const liveRel = `${captureId}.md`;
+  let liveRaw = null;
+  try {
+    liveRaw = readFileInRoot(liveRoot, liveRel);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  if (authoritative && liveRaw !== null && sha256(liveRaw) !== authoritative.captureHash) {
+    throw new Error("The live capture changed after the promotion request. Stage the promotion again.");
+  }
+  if (authoritative && liveRaw === null && authoritative.cleanupCommitted !== true) {
+    const reconciled = await reconcilePromotionCleanup(liveRoot, authoritative);
+    if (!reconciled) {
+      throw new Error("The bound live capture is missing without a verifiable cleanup commit. Restore it or stage the promotion again.");
+    }
+    authoritative.cleanupCommitted = true;
+    writePromotionBinding(parsed._manifestPath, frontmatter.promotionBinding, authoritative);
   }
 
-  // Only after the curated write is durable: remove review entry + live capture.
-  fs.rmSync(reviewPath, { force: true });
-  const livePath = safeJoin(liveRoot, `${captureId}.md`);
-  if (fs.existsSync(livePath)) {
-    const telemetryPath = parsed.telemetry
-      ? await emitPromoteEvent(liveRoot, captureId, frontmatter, dest)
-      : null;
-    fs.rmSync(livePath);
-    await commitPaths(
-      liveRoot,
-      [`${captureId}.md`, ...(telemetryPath ? [telemetryPath] : [])],
-      `chore: promote ${captureId} -> ${dest}`,
-    );
+  // Rewriting the reviewed bytes is idempotent and prevents an unrelated
+  // pre-existing file (or symlink) from being mistaken for this promotion.
+  // writeFileInRoot refuses symlinked parents and final components.
+  writeFileInRoot(curatedRoot, destRel, renderCurated(frontmatter, sections, dest));
+  if (!isDurable(destPath)) throw new Error(`Curated write failed verification: ${destRel}`);
+
+  // Keep the review until the live deletion is committed. The repo lock is
+  // acquired before rm; if add/commit fails, restore the exact capture and
+  // clear the staged deletion so approval remains resumable.
+  if (liveRaw !== null) {
+    await commitPathsWithMutation(liveRoot, [liveRel], `chore: promote ${captureId} -> ${dest}`, {
+      mutate: () => fs.rmSync(safeJoin(liveRoot, liveRel)),
+      rollback: async () => {
+        writeFileInRoot(liveRoot, liveRel, liveRaw);
+        const restored = await runGit(liveRoot, ["restore", "--staged", "--", liveRel], { allowFailure: true });
+        if (!restored.ok) throw new Error(`could not restore git index: ${restored.stderr}`);
+      },
+    });
+
+    if (authoritative) {
+      authoritative.cleanupCommitted = true;
+      writePromotionBinding(parsed._manifestPath, frontmatter.promotionBinding, authoritative);
+    }
+
+    if (parsed.telemetry) {
+      const telemetryPath = await emitPromoteEvent(liveRoot, captureId, frontmatter, dest);
+      if (telemetryPath) {
+        try { await commitPaths(liveRoot, [telemetryPath], `chore: telemetry for promotion ${captureId}`); } catch { /* retry on next sync */ }
+      }
+    }
+  }
+  if (liveRaw !== null || authoritative?.cleanupCommitted === true) {
     const pushed = await push(liveRoot);
     if (pushed.queued) console.error("promote: live cleanup committed locally; push queued (run sync to retry)");
   }
+  fs.rmSync(reviewPath, { force: true });
+  if (authoritative) deletePromotionBinding(parsed._manifestPath, frontmatter.promotionBinding);
   console.log(`Promoted ${captureId} -> ${dest}`);
 }
 
+function assertPromotionBinding(frontmatter, current, authoritative, { captureId, dest, reviewRel }) {
+  if (!authoritative || typeof authoritative !== "object") {
+    throw new Error("Promotion review has no authoritative local binding. Stage it again.");
+  }
+  const currentConfig = {
+    profileId: current.profileId,
+    manifestRevision: current.manifestRevision,
+    liveLayerFingerprint: current.liveLayerFingerprint,
+    targetLayerFingerprint: current.targetLayerFingerprint,
+  };
+  if (Object.values(currentConfig).some((value) => typeof value !== "string" || !value)) {
+    throw new Error("Promotion review is missing its Project Profile binding. Stage it again.");
+  }
+  if (Object.keys(currentConfig).some((key) => authoritative[key] !== currentConfig[key])) {
+    throw new Error("The selected profile, manifest, live layer, or target layer changed after staging. Stage the promotion again.");
+  }
+  const stagedFields = {
+    profileId: frontmatter.promotionProfile,
+    manifestRevision: frontmatter.promotionRevision,
+    liveLayerFingerprint: frontmatter.promotionLiveFingerprint,
+    targetLayerFingerprint: frontmatter.promotionTargetFingerprint,
+    captureId: frontmatter.promotionCapture,
+    dest: frontmatter.promotionDestination,
+    captureHash: frontmatter.promotionCaptureHash,
+  };
+  if (Object.keys(stagedFields).some((key) => stagedFields[key] !== authoritative[key])) {
+    throw new Error("Promotion review metadata does not match its authoritative local binding. Stage it again.");
+  }
+  if (authoritative.captureId !== captureId || authoritative.dest !== dest || authoritative.reviewRel !== reviewRel) {
+    throw new Error("Promotion source or destination binding does not match the review. Stage it again.");
+  }
+  if (typeof authoritative.captureHash !== "string" || !/^[a-f0-9]{64}$/.test(authoritative.captureHash)) {
+    throw new Error("Promotion review is missing a valid live-capture hash. Stage it again.");
+  }
+}
+
+function assertNoReservedPromotionKeys(content) {
+  const counts = frontmatterKeyCounts(content);
+  const found = PROMOTION_KEYS.filter((key) => (counts.get(key) ?? 0) > 0);
+  if (found.length) throw new Error(`Live capture contains reserved promotion frontmatter: ${found.join(", ")}.`);
+}
+
+function assertPromotionReviewKeys(content, profileAware) {
+  const counts = frontmatterKeyCounts(content);
+  const required = profileAware ? PROMOTION_KEYS : ["promoteTo", "promotedFrom"];
+  for (const key of required) {
+    if ((counts.get(key) ?? 0) !== 1) throw new Error(`Promotion review must contain exactly one ${key} frontmatter field.`);
+  }
+  for (const key of PROMOTION_KEYS) {
+    if ((counts.get(key) ?? 0) > 1) throw new Error(`Promotion review contains duplicate ${key} frontmatter.`);
+  }
+}
+
+function frontmatterKeyCounts(content) {
+  if (!content.startsWith("---\n")) throw new Error("Promotion content must have YAML frontmatter.");
+  const end = content.indexOf("\n---", 4);
+  if (end === -1) throw new Error("Promotion content has unterminated YAML frontmatter.");
+  const counts = new Map();
+  for (const line of content.slice(4, end).split(/\r?\n/)) {
+    const key = line.match(/^([A-Za-z0-9_-]+):/)?.[1];
+    if (key) counts.set(key, (counts.get(key) ?? 0) + 1);
+  }
+  return counts;
+}
+
+function sha256(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+
+async function reconcilePromotionCleanup(liveRoot, authoritative) {
+  if (typeof authoritative.liveHeadAtStage !== "string" || !/^[a-f0-9]{40,64}$/i.test(authoritative.liveHeadAtStage)) return false;
+  const expected = `chore: promote ${authoritative.captureId} -> ${authoritative.dest}`;
+  const history = await runGit(
+    liveRoot,
+    ["log", "--format=%s", `${authoritative.liveHeadAtStage}..HEAD`, "--", `${authoritative.captureId}.md`],
+    { allowFailure: true },
+  );
+  return history.ok && history.stdout.split("\n").includes(expected);
+}
+
+function createPromotionBinding(manifestPath, record) {
+  const nonce = crypto.randomUUID();
+  writePromotionBinding(manifestPath, nonce, record, { exclusive: true });
+  return nonce;
+}
+
+function loadPromotionBinding(manifestPath, nonce) {
+  assertPromotionNonce(nonce);
+  const root = promotionBindingDirectory(manifestPath);
+  let record;
+  try {
+    record = JSON.parse(readFileInRoot(root, `${nonce}.json`));
+  } catch (error) {
+    throw new Error(`Could not load the authoritative local promotion binding: ${error.message}`);
+  }
+  if (!record || typeof record !== "object" || Array.isArray(record)) {
+    throw new Error("Authoritative local promotion binding is malformed. Stage the promotion again.");
+  }
+  return record;
+}
+
+function writePromotionBinding(manifestPath, nonce, record, { exclusive = false } = {}) {
+  assertPromotionNonce(nonce);
+  const root = promotionBindingDirectory(manifestPath);
+  const filePath = path.join(root, `${nonce}.json`);
+  const bytes = `${JSON.stringify(record, null, 2)}\n`;
+  if (exclusive) {
+    const fd = fs.openSync(filePath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600);
+    try { fs.writeFileSync(fd, bytes); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+    return;
+  }
+  const temporary = `${filePath}.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`;
+  const fd = fs.openSync(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600);
+  try { fs.writeFileSync(fd, bytes); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+  fs.renameSync(temporary, filePath);
+}
+
+function deletePromotionBinding(manifestPath, nonce) {
+  assertPromotionNonce(nonce);
+  fs.rmSync(path.join(promotionBindingDirectory(manifestPath), `${nonce}.json`), { force: true });
+}
+
+function promotionBindingDirectory(manifestPath) {
+  const configured = process.env.CONTEXTCAKE_LOCAL_STATE_DIR;
+  let localState;
+  if (configured) localState = path.resolve(configured);
+  else if (process.platform === "darwin") localState = path.join(os.homedir(), "Library", "Application Support", "ContextCake", "Local State");
+  else if (process.platform === "win32") localState = path.join(process.env.LOCALAPPDATA ?? os.homedir(), "ContextCake", "Local State");
+  else localState = path.join(process.env.XDG_STATE_HOME ?? path.join(os.homedir(), ".local", "state"), "contextcake");
+  const directory = path.join(localState, "promotion-bindings", sha256(path.resolve(manifestPath)));
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const stat = fs.lstatSync(directory);
+  if (stat.isSymbolicLink() || !stat.isDirectory()) throw new Error("Local promotion-binding store must be a regular directory.");
+  return directory;
+}
+
+function assertPromotionNonce(value) {
+  if (typeof value !== "string" || !/^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/i.test(value)) {
+    throw new Error("Promotion review has an invalid local binding id. Stage it again.");
+  }
+}
+
+function safePromotionConceptId(value, label) {
+  if (typeof value !== "string" || !value || /[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(`Promotion ${label} must be a non-empty concept id without control characters.`);
+  }
+  const normalized = normalizeOkfConceptId(value);
+  if (normalized === "." || path.posix.isAbsolute(normalized)) throw new Error(`Invalid promotion ${label}: ${value}`);
+  return normalized;
+}
+
+function resolveProfileReviewPath(curatedRoot, requested) {
+  const reviewRoot = path.resolve(curatedRoot, "_review", "promotions");
+  const requestedPath = path.resolve(requested);
+  const relative = path.relative(reviewRoot, requestedPath);
+  if (relative === "" || relative.startsWith(`..${path.sep}`) || relative === ".." || path.isAbsolute(relative)) {
+    throw new Error("--approve must name a review file under the selected target layer's _review/promotions directory.");
+  }
+  const requestedStat = fs.lstatSync(requestedPath);
+  if (requestedStat.isSymbolicLink() || !requestedStat.isFile()) {
+    throw new Error("Promotion review must be a regular file, not a symlink or directory.");
+  }
+  const realRoot = fs.realpathSync.native(reviewRoot);
+  const realReview = fs.realpathSync.native(requestedPath);
+  const realRelative = path.relative(realRoot, realReview);
+  if (realRelative.startsWith(`..${path.sep}`) || realRelative === ".." || path.isAbsolute(realRelative)) {
+    throw new Error("Promotion review path escapes the selected target layer.");
+  }
+  // Return the lexical path under curatedRoot after proving its canonical
+  // target stays under the canonical review root. This preserves containment
+  // when macOS aliases /var to /private/var.
+  return requestedPath;
+}
+
 function isDurable(filePath) {
   try {
     const parsed = parseConcept(fs.readFileSync(filePath, "utf8"));
@@ -285,7 +625,7 @@ function parseArgs(argv) {
     const arg = argv[index];
     if (arg === "--help" || arg === "-h") {
       parsed.help = true;
-    } else if (arg === "--dry-run" || arg === "--print-git" || arg === "--telemetry") {
+    } else if (arg === "--dry-run" || arg === "--print-git" || arg === "--telemetry" || arg === "--legacy-paths") {
       parsed[arg.slice(2)] = true;
     } else if (arg.startsWith("--")) {
       parsed[arg.slice(2)] = argv[index + 1];
@@ -296,9 +636,17 @@ function parseArgs(argv) {
 }
 
 function printHelp() {
-  console.log(`Usage: node promote.mjs --personal <dir> --shared <dir> --file <concept-or-path> [--dry-run] [--print-git]
+  console.log(`Usage:
+  node promote.mjs --manifest <file> [--profile <id>] --capture <id> --target-layer <name> [--dest <id>]
+  node promote.mjs --manifest <file> [--profile <id>] --approve <review-file> --target-layer <name> [--telemetry]
+
+Legacy raw-path mode (no Project Profile isolation guarantee):
+  node promote.mjs --legacy-paths --from-live <root> --capture <id> --target <root>
+  node promote.mjs --legacy-paths --personal <dir> --shared <dir> --file <concept-or-path> [--dry-run] [--print-git]
 
-Copies a markdown concept from the personal OKF bundle into the shared bundle and rebuilds shared index.md.
+Profile-aware mode resolves both roots from one selected profile and binds the
+review to its manifest revision and layer identities. Raw directory roots are
+available only through the explicit --legacy-paths compatibility mode.
 `);
 }
 
diff --git a/packages/core/src/resolver.mjs b/packages/core/src/resolver.mjs
index 45bdf0b..fee39dd 100644
--- a/packages/core/src/resolver.mjs
+++ b/packages/core/src/resolver.mjs
@@ -13,14 +13,12 @@
 //   - Per-section suppression: `{#anchor override=none}` tombstone hides a section.
 //
 // Usage:
-//   node resolver.mjs --manifest layers.json --concept decisions/primary-db
+//   node resolver.mjs --manifest manifest.json --concept decisions/primary-db [--profile work]
 //
 // manifest.json: { "layers": [ {"name":"company","level":0,"path":"..."}, ... ] }
 
-import fs from "node:fs";
-import path from "node:path";
 import { pathToFileURL } from "node:url";
-import { buildSources } from "./sources/index.mjs";
+import { buildProfileSources, loadProfileRuntime } from "./profile-runtime.mjs";
 
 if (isMainModule(import.meta.url)) {
   main().catch((e) => { console.error(e.message); process.exit(1); });
@@ -34,12 +32,15 @@ async function main() {
     return;
   }
 
-  if (!args.concept) {
+  if (!args.concept || !args.manifest) {
     throw new Error("Provide --concept <id> and --manifest <file>.");
   }
 
-  const manifest = JSON.parse(fs.readFileSync(args.manifest, "utf8"));
-  const sources = buildSources(manifest, path.dirname(args.manifest));
+  const runtime = loadProfileRuntime(args.manifest, {
+    requestedProfile: args.profile ?? null,
+    cwd: process.cwd(),
+  });
+  const sources = buildProfileSources(runtime);
 
   try {
     const resolved = await resolveConcept(args.concept, sources);
@@ -172,12 +173,14 @@ function parseArgs(argv) {
 
 function printHelp() {
   console.log(`Usage:
-  node resolver.mjs --manifest layers.json --concept <id>
+  node resolver.mjs --manifest manifest.json --concept <id> [--profile <id>]
 
 Resolves an OKF concept across an ordered source stack (level desc), merging per
 section and per frontmatter field with provenance. Higher level wins per section;
 per-section suppression via {#anchor override=none}.
 
-manifest.json: { "layers": [ {"name":"company","level":0,"path":"..."}, ... ] }
+Profile selection order: explicit --profile, deepest project mapping containing
+the current working directory, then default. Flat manifests remain the virtual
+default profile.
 `);
 }
diff --git a/packages/core/src/sources/cache.mjs b/packages/core/src/sources/cache.mjs
index e598cb0..7f0049b 100644
--- a/packages/core/src/sources/cache.mjs
+++ b/packages/core/src/sources/cache.mjs
@@ -90,7 +90,7 @@ export function withCache(source, { ttlMs = 300000, cacheDir = null, namespace =
       return wrapped.lastSynced;
     },
     close() {
-      source.close();
+      return source.close();
     },
   };
   return wrapped;
diff --git a/packages/core/src/sources/git-core.mjs b/packages/core/src/sources/git-core.mjs
index fda7bdf..fa488d2 100644
--- a/packages/core/src/sources/git-core.mjs
+++ b/packages/core/src/sources/git-core.mjs
@@ -152,16 +152,49 @@ function identityArgs(author) {
 // per-invocation -c pair — never writes config.
 export async function commitPaths(root, paths, message, { author = null, lockRetryMs, lockRetries } = {}) {
   if (!Array.isArray(paths) || paths.length === 0) throw new Error("commitPaths requires at least one path");
+  return withRepoLock(root, "commit", () => commitPathsUnlocked(root, paths, message, author), { lockRetryMs, lockRetries });
+}
+
+// Acquires the repo lock before a caller mutates the working tree, then commits
+// only the named paths. If add/commit fails, rollback runs while the same lock
+// is still held so the operation can remain safely retryable.
+export async function commitPathsWithMutation(root, paths, message, {
+  mutate,
+  rollback,
+  author = null,
+  lockRetryMs,
+  lockRetries,
+} = {}) {
+  if (!Array.isArray(paths) || paths.length === 0) throw new Error("commitPathsWithMutation requires at least one path");
+  if (typeof mutate !== "function" || typeof rollback !== "function") {
+    throw new Error("commitPathsWithMutation requires mutate and rollback callbacks");
+  }
   return withRepoLock(root, "commit", async () => {
-    await runGit(root, ["add", "--", ...paths]);
-    const ident = (await hasIdentity(root)) ? [] : identityArgs(author);
-    // Pathspec commit: commit ONLY these paths, so a pre-existing staged change
-    // (e.g. a prior failed op) can't be swept into this commit's message.
-    await runGit(root, [...ident, "commit", "-m", message, "--", ...paths]);
-    return { committed: true };
+    await mutate();
+    try {
+      return await commitPathsUnlocked(root, paths, message, author);
+    } catch (error) {
+      try {
+        await rollback(error);
+      } catch (rollbackError) {
+        const combined = new Error(`${error.message}; rollback failed: ${rollbackError.message}`);
+        combined.code = "RollbackFailed";
+        throw combined;
+      }
+      throw error;
+    }
   }, { lockRetryMs, lockRetries });
 }
 
+async function commitPathsUnlocked(root, paths, message, author) {
+  await runGit(root, ["add", "--", ...paths]);
+  const ident = (await hasIdentity(root)) ? [] : identityArgs(author);
+  // Pathspec commit: commit ONLY these paths, so a pre-existing staged change
+  // (e.g. a prior failed op) can't be swept into this commit's message.
+  await runGit(root, [...ident, "commit", "-m", message, "--", ...paths]);
+  return { committed: true };
+}
+
 async function pushOnce(root) {
   const result = await runGit(root, ["push", "--quiet"], { allowFailure: true });
   if (result.ok) return { pushed: true };
diff --git a/packages/core/src/sources/git-sync.mjs b/packages/core/src/sources/git-sync.mjs
index bdc4dfe..5cff243 100644
--- a/packages/core/src/sources/git-sync.mjs
+++ b/packages/core/src/sources/git-sync.mjs
@@ -65,16 +65,20 @@ export function withGitSync(source, { root, pullTtlMs = 90000, retentionDays = 1
       return wrapped.lastSynced;
     },
     close() {
-      source.close();
+      return source.close();
     },
   };
   return wrapped;
 }
 
-// Narrow data facade over the manifest: callers get paths and config for the
-// single live layer, never a mutable source. Mutations go through git-core.
-export function resolveLiveLayer(manifest, manifestDir) {
-  const live = (manifest.layers ?? []).filter((layer) => layer.live === true);
+// Narrow data facade over an already-selected layer stack: callers get paths
+// and config for the single live layer, never the full manifest or a mutable
+// source. Mutations go through git-core.
+export function resolveLiveLayer(selectedLayers, manifestDir) {
+  if (!Array.isArray(selectedLayers)) {
+    throw new Error("resolveLiveLayer requires an already-selected layer array.");
+  }
+  const live = selectedLayers.filter((layer) => layer.live === true);
   if (live.length === 0) return null;
   if (live.length > 1) {
     throw new Error(`Manifest declares ${live.length} live layers (${live.map((l) => l.name).join(", ")}); exactly one is allowed`);
@@ -87,6 +91,7 @@ export function resolveLiveLayer(manifest, manifestDir) {
     throw new Error(`Live layer "${layer.name}" requires a "git" block ({ pullTtlSeconds, retentionDays, profileName })`);
   }
   return {
+    layer,
     name: layer.name,
     root: path.resolve(manifestDir, layer.path),
     pullTtlMs: (Number(layer.git.pullTtlSeconds ?? 90)) * 1000,
diff --git a/packages/core/src/sources/mcp.mjs b/packages/core/src/sources/mcp.mjs
index 529ca60..0932229 100644
--- a/packages/core/src/sources/mcp.mjs
+++ b/packages/core/src/sources/mcp.mjs
@@ -152,14 +152,42 @@ export function createMcpSource({ name, level, command, args = [], respawnCooldo
       await ready;
       return send("tools/list", {});
     },
-    close() {
+    async close() {
       closed = true;
       if (rl) { try { rl.close(); } catch {} rl = null; }
-      if (child) { try { child.kill(); } catch {} child = null; }
+      const running = child;
+      if (!running) return;
+      try { running.stdin.end(); } catch {}
+      try { running.kill("SIGTERM"); } catch {}
+      if (!(await waitForExit(running, 300))) {
+        try { running.kill("SIGKILL"); } catch {}
+        await waitForExit(running, 700);
+      }
+      try { running.stdin.destroy(); } catch {}
+      try { running.stdout.destroy(); } catch {}
+      if (child === running) child = null;
     },
   };
 }
 
+function waitForExit(child, timeoutMs) {
+  if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve(true);
+  return new Promise((resolve) => {
+    let settled = false;
+    const finish = (exited) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.off("exit", onExit);
+      resolve(exited);
+    };
+    const onExit = () => finish(true);
+    const timer = setTimeout(() => finish(false), timeoutMs);
+    timer.unref?.();
+    child.once("exit", onExit);
+  });
+}
+
 // The translation: arbitrary foreign shape -> OKF { frontmatter, sections }.
 // foreign: { title, kind, facts:[{topic,text,lastTouched}], see_also:[] }
 function translateToOkf(node) {
diff --git a/packages/core/src/write.mjs b/packages/core/src/write.mjs
index 6f3fd83..4b9caed 100644
--- a/packages/core/src/write.mjs
+++ b/packages/core/src/write.mjs
@@ -13,6 +13,10 @@
 import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
+import { assertInsideRoot, writeFileInRoot } from "./capture.mjs";
+import { withManifestLock } from "./manifest.mjs";
+import { loadProfileRuntime } from "./profile-runtime.mjs";
+import { normalizeConceptId } from "./sources/okf-local.mjs";
 
 if (isMainModule(import.meta.url)) {
   main();
@@ -30,18 +34,27 @@ function main() {
   if (!args.manifest) throw new Error("--manifest <file> is required");
 
   const signals = readJson(args.signals);
-  const manifest = JSON.parse(fs.readFileSync(args.manifest, "utf8"));
-  const layers = (manifest.layers ?? []).map((layer) => ({
-    name: layer.name,
-    level: Number(layer.level),
-    root: path.resolve(path.dirname(args.manifest), layer.path),
-  }));
-
-  const targetLayer = selectTargetLayer(layers, args["target-layer"]);
   const dryRun = args["dry-run"] === true || args["dry-run"] === "true";
   const date = new Date().toISOString().slice(0, 10);
-
-  const results = writeSignals(signals, targetLayer, { dryRun, date });
+  const results = withManifestLock(args.manifest, () => {
+    const runtime = loadProfileRuntime(args.manifest, {
+      requestedProfile: args.profile ?? null,
+      cwd: process.cwd(),
+    });
+    const layers = runtime.selection.layers
+      // Plain Markdown folders and live repositories are read/capture surfaces,
+      // not batch-ingest targets. Only curated OKF layers are writable here.
+      .filter((layer) => (layer.source ?? "okf-local") === "okf-local" && layer.live !== true)
+      .filter((layer) => typeof layer.path === "string")
+      .map((layer) => ({
+        name: layer.name,
+        level: Number(layer.level),
+        root: path.resolve(runtime.manifestDir, layer.path),
+      }));
+
+    const targetLayer = selectTargetLayer(layers, args["target-layer"]);
+    return writeSignals(signals, targetLayer, { dryRun, date });
+  });
 
   const written = results.filter((r) => r.status === "written");
   const staged = results.filter((r) => r.status === "staged");
@@ -80,23 +93,30 @@ function processSignal(signal, targetLayer, { dryRun, date }) {
   if (!destination) {
     return { signalId: signal.id, status: "skipped", reason: "no destination" };
   }
+  if (typeof destination !== "string") throw new Error(`Signal ${signal.id ?? "<unknown>"} destination must be a concept id.`);
+  const normalizedDestination = normalizeConceptId(destination);
 
   // review_required goes into _review/ staging; team_candidate goes directly.
-  const conceptPath = isReview
-    ? path.join(targetLayer.root, "_review", destination.replace(/^review\//, ""))
-    : path.join(targetLayer.root, destination);
-
-  const conceptFile = `${conceptPath}.md`;
+  const relativeConcept = isReview
+    ? path.posix.join("_review", normalizedDestination.replace(/^review\//, ""))
+    : normalizedDestination;
+  const relativeFile = `${relativeConcept}.md`;
+  let conceptFile = path.resolve(targetLayer.root, relativeFile);
 
-  if (!dryRun && fs.existsSync(conceptFile)) {
-    return { signalId: signal.id, status: "skipped", reason: "already exists", path: conceptFile };
+  if (!dryRun) {
+    conceptFile = assertInsideRoot(targetLayer.root, relativeFile);
+    if (fs.existsSync(conceptFile)) {
+      const stat = fs.lstatSync(conceptFile);
+      if (stat.isSymbolicLink()) throw new Error(`Refusing to inspect or overwrite a symlink: ${relativeFile}`);
+      if (!stat.isFile()) throw new Error(`Write target is not a regular file: ${relativeFile}`);
+      return { signalId: signal.id, status: "skipped", reason: "already exists", path: conceptFile };
+    }
   }
 
   const content = generateConcept(signal, date, isReview);
 
   if (!dryRun) {
-    fs.mkdirSync(path.dirname(conceptFile), { recursive: true });
-    fs.writeFileSync(conceptFile, content, "utf8");
+    writeFileInRoot(targetLayer.root, relativeFile, content);
   }
 
   return {
@@ -195,16 +215,19 @@ function parseArgs(argv) {
 
 function printHelp() {
   console.log(`Usage:
-  node write.mjs --signals signals.json --manifest layers.json
-  node write.mjs --signals signals.json --manifest layers.json --target-layer team
+  node write.mjs --signals signals.json --manifest manifest.json [--profile <id>]
+  node write.mjs --signals signals.json --manifest manifest.json --target-layer team
   node write.mjs --signals signals.json --manifest layers.json --dry-run
 
-Writes captured OKF concepts from ingest signals into a target layer bundle.
+Writes captured OKF concepts from ingest signals into a curated local OKF layer.
   team_candidate  → written directly to the target layer directory
   review_required → staged under _review/ for human approval
   ignore / local  → skipped
 
 Default target layer: highest level < 3 in the manifest (team, group, or company).
-Pass --target-layer <name> to specify explicitly.
+Pass --target-layer <name> to specify explicitly. Profile selection order is
+explicit --profile, deepest project mapping for the current working directory,
+then default. Plain Markdown-folder sources and live layers are never batch
+write targets; traversal and symlink destinations are rejected.
 `);
 }
diff --git a/packages/core/tests/capture-test.sh b/packages/core/tests/capture-test.sh
index 6f585bd..d59eb17 100755
--- a/packages/core/tests/capture-test.sh
+++ b/packages/core/tests/capture-test.sh
@@ -232,7 +232,7 @@ grep -q '"hasToken":true' <<<"$out" || fail "review_required should still stage"
 grep -qi 'review' <<<"$out" || fail "review_required should carry a warning" "$out"
 
 # ---- promotion: request stages under _review/promotions --------------------------------
-node "$promote" --from-live "$live" --capture captures/investigation/alice-example--timeout-the-webhook-mystery --target "$curated" > /dev/null
+node "$promote" --legacy-paths --from-live "$live" --capture captures/investigation/alice-example--timeout-the-webhook-mystery --target "$curated" > /dev/null
 review_file="$curated/_review/promotions/timeout-the-webhook-mystery.md"
 [ -f "$review_file" ] || fail "promotion request should stage under _review/promotions"
 grep -q 'promoteTo: systems/timeout-the-webhook-mystery' "$review_file" || fail "investigation should default to systems/ dest" "$(cat "$review_file")"
@@ -240,14 +240,14 @@ grep -q 'promoteTo: systems/timeout-the-webhook-mystery' "$review_file" || fail
 
 # gotcha without --dest errors
 set +e
-node "$promote" --from-live "$live" --capture captures/gotcha/alice-example--reuse-token --target "$curated" 2>"$tmpdir/err.txt"
+node "$promote" --legacy-paths --from-live "$live" --capture captures/gotcha/alice-example--reuse-token --target "$curated" 2>"$tmpdir/err.txt"
 rc=$?
 set -e
 [ $rc -ne 0 ] || fail "gotcha promotion without --dest must error"
 grep -q -- '--dest' "$tmpdir/err.txt" || fail "error should mention --dest" "$(cat "$tmpdir/err.txt")"
 
 # ---- promotion: approve = durable write, then cleanup ----------------------------------
-node "$promote" --from-live "$live" --target "$curated" --approve "$review_file" --telemetry > /dev/null
+node "$promote" --legacy-paths --from-live "$live" --target "$curated" --approve "$review_file" --telemetry > /dev/null
 [ -f "$curated/systems/timeout-the-webhook-mystery.md" ] || fail "approve should write the curated concept"
 grep -q 'status:' "$curated/systems/timeout-the-webhook-mystery.md" && fail "curated concept must not keep unreviewed status"
 grep -q 'promoted from' "$curated/systems/timeout-the-webhook-mystery.md" || fail "curated concept should carry provenance"
@@ -267,14 +267,14 @@ if (!events.some(e => e.event === 'promote' && e.concept === 'captures/investiga
 " "$promote_telemetry" || fail "promote telemetry event"
 
 # ---- promotion: failure between curated write and cleanup is recoverable ----------------
-node "$promote" --from-live "$live" --capture captures/investigation/alice-example--timeout-the-webhook-mystery-2 --target "$curated" --dest systems/retry-durable > /dev/null
+node "$promote" --legacy-paths --from-live "$live" --capture captures/investigation/alice-example--timeout-the-webhook-mystery-2 --target "$curated" --dest systems/retry-durable > /dev/null
 review2="$curated/_review/promotions/retry-durable.md"
 mv "$bare" "$bare.away"   # push will fail; approve reports partial
-node "$promote" --from-live "$live" --target "$curated" --approve "$review2" > "$tmpdir/approve1.txt" 2>&1 || true
+node "$promote" --legacy-paths --from-live "$live" --target "$curated" --approve "$review2" > "$tmpdir/approve1.txt" 2>&1 || true
 [ -f "$curated/systems/retry-durable.md" ] || fail "curated write must stand even when live push fails" "$(cat "$tmpdir/approve1.txt")"
 mv "$bare.away" "$bare"
 # re-approve is idempotent: curated already valid → cleanup only, no duplicate
-node "$promote" --from-live "$live" --target "$curated" --approve "$review2" > /dev/null 2>&1 || true
+node "$promote" --legacy-paths --from-live "$live" --target "$curated" --approve "$review2" > /dev/null 2>&1 || true
 count="$(grep -c 'promoted from' "$curated/systems/retry-durable.md")"
 [ "$count" = "1" ] || fail "re-approve must not duplicate provenance" "$count"
 
diff --git a/packages/core/tests/git-sync-test.sh b/packages/core/tests/git-sync-test.sh
index 9a9df60..482a732 100755
--- a/packages/core/tests/git-sync-test.sh
+++ b/packages/core/tests/git-sync-test.sh
@@ -305,7 +305,7 @@ out="$(node_run "
 import { resolveLiveLayer } from '$core/sources/git-sync.mjs';
 import fs from 'node:fs';
 const m = JSON.parse(fs.readFileSync('$tmpdir/m-good.json', 'utf8'));
-console.log(JSON.stringify(resolveLiveLayer(m, '$tmpdir')));
+console.log(JSON.stringify(resolveLiveLayer(m.layers, '$tmpdir')));
 ")"
 grep -q '"name":"team-live"' <<<"$out" || fail "resolveLiveLayer should find the live layer" "$out"
 grep -q '"pullTtlMs":90000' <<<"$out" || fail "resolveLiveLayer should expose pullTtlMs" "$out"
@@ -319,7 +319,7 @@ EOF
 out="$(node_run "
 import { resolveLiveLayer } from '$core/sources/git-sync.mjs';
 import fs from 'node:fs';
-try { resolveLiveLayer(JSON.parse(fs.readFileSync('$tmpdir/m-two.json', 'utf8')), '$tmpdir'); console.log('NO_ERROR'); }
+try { resolveLiveLayer(JSON.parse(fs.readFileSync('$tmpdir/m-two.json', 'utf8')).layers, '$tmpdir'); console.log('NO_ERROR'); }
 catch (e) { console.log('ERR:' + e.message); }
 ")"
 grep -q 'ERR:' <<<"$out" || fail "two live layers must be rejected" "$out"
@@ -332,14 +332,14 @@ EOF
 out="$(node_run "
 import { resolveLiveLayer } from '$core/sources/git-sync.mjs';
 import fs from 'node:fs';
-try { resolveLiveLayer(JSON.parse(fs.readFileSync('$tmpdir/m-nogit.json', 'utf8')), '$tmpdir'); console.log('NO_ERROR'); }
+try { resolveLiveLayer(JSON.parse(fs.readFileSync('$tmpdir/m-nogit.json', 'utf8')).layers, '$tmpdir'); console.log('NO_ERROR'); }
 catch (e) { console.log('ERR:' + e.message); }
 ")"
 grep -q 'ERR:' <<<"$out" || fail "live layer without git block must be rejected" "$out"
 
 out="$(node_run "
 import { resolveLiveLayer } from '$core/sources/git-sync.mjs';
-console.log(JSON.stringify(resolveLiveLayer({ layers: [ { name: 'x', level: 1, source: 'okf-local', path: 'bob' } ] }, '$tmpdir')));
+console.log(JSON.stringify(resolveLiveLayer([ { name: 'x', level: 1, source: 'okf-local', path: 'bob' } ], '$tmpdir')));
 ")"
 grep -q 'null' <<<"$out" || fail "no live layer should resolve to null" "$out"
 
diff --git a/packages/core/tests/manifest.test.mjs b/packages/core/tests/manifest.test.mjs
index e9d01ed..dc0ef36 100644
--- a/packages/core/tests/manifest.test.mjs
+++ b/packages/core/tests/manifest.test.mjs
@@ -22,6 +22,7 @@ import {
   validateContextManifest,
   verifyManifestBackup,
   withManifestLock,
+  withManifestLockAsync,
   writeContextManifest,
 } from "../src/manifest.mjs";
 import { withCache } from "../src/sources/cache.mjs";
@@ -432,6 +433,36 @@ test("manifest mutation locking preserves concurrent updates and times out safel
   fs.rmSync(`${manifestPath}.lock`);
 });
 
+test("async profile write leases exclude concurrent manifest mutation", async (t) => {
+  const root = temporaryDirectory(t);
+  const manifestPath = path.join(root, "manifest.json");
+  writeContextManifest(manifestPath, { layers: [] });
+
+  let entered;
+  const enteredPromise = new Promise((resolve) => { entered = resolve; });
+  let release;
+  const releasePromise = new Promise((resolve) => { release = resolve; });
+  const holder = withManifestLockAsync(manifestPath, async () => {
+    entered();
+    await releasePromise;
+  });
+  await enteredPromise;
+
+  const writerScript = `
+    import { mutateContextManifest } from ${JSON.stringify(pathToFileURL(manifestModule).href)};
+    const [manifestPath] = process.argv.slice(1);
+    mutateContextManifest(manifestPath, (manifest) => { manifest.writerCompleted = true; });
+  `;
+  let writerCompleted = false;
+  const writer = runNode(writerScript, [manifestPath]).then(() => { writerCompleted = true; });
+  await new Promise((resolve) => setTimeout(resolve, 100));
+  assert.equal(writerCompleted, false, "manifest mutation entered during the async write lease");
+
+  release();
+  await Promise.all([holder, writer]);
+  assert.equal(readContextManifest(manifestPath).writerCompleted, true);
+});
+
 test("concurrent source, Pack, and first-profile mutations cannot lose an update", async (t) => {
   const root = temporaryDirectory(t);
   const manifestPath = path.join(root, "manifest.json");
diff --git a/packages/core/tests/profile-runtime-test.sh b/packages/core/tests/profile-runtime-test.sh
new file mode 100755
index 0000000..761700d
--- /dev/null
+++ b/packages/core/tests/profile-runtime-test.sh
@@ -0,0 +1,529 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Project Profiles PR2: one selected stack across resolver, MCP, write,
+# capture/telemetry, promotion, cache identity, and the profile CLI.
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+core="$repo_root/packages/core/src"
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+fail() { echo "FAIL: $1" >&2; [ "${2:-}" ] && echo "$2" >&2; exit 1; }
+
+export GIT_CONFIG_GLOBAL="$tmpdir/gitconfig"
+export GIT_CONFIG_SYSTEM=/dev/null
+export CONTEXTCAKE_LOCAL_STATE_DIR="$tmpdir/local-state"
+git config --file "$tmpdir/gitconfig" user.name "Profile Tester"
+git config --file "$tmpdir/gitconfig" user.email "profiles@example.invalid"
+git config --file "$tmpdir/gitconfig" init.defaultBranch main
+
+mkdir -p "$tmpdir/default" "$tmpdir/work" "$tmpdir/curated" "$tmpdir/project/nested" "$tmpdir/sibling"
+cat > "$tmpdir/default/default-only.md" <<'EOF'
+---
+type: context
+title: Default sentinel
+---
+
+# Default sentinel
+
+Only the default profile may reveal DEFAULT-SECRET-SENTINEL.
+
+[Work sentinel](work-only.md)
+EOF
+cat > "$tmpdir/work/work-only.md" <<'EOF'
+---
+type: context
+title: Work sentinel
+---
+
+# Work sentinel
+
+Only the work profile may reveal WORK-SECRET-SENTINEL.
+EOF
+
+bare="$tmpdir/live-remote.git"
+git init --quiet --bare "$bare"
+live="$tmpdir/work-live"
+git clone --quiet "$bare" "$live" 2>/dev/null
+( cd "$live" && git commit --quiet --allow-empty -m init && git push --quiet -u origin main )
+default_bare="$tmpdir/default-live-remote.git"
+git init --quiet --bare "$default_bare"
+default_live="$tmpdir/default-live"
+git clone --quiet "$default_bare" "$default_live" 2>/dev/null
+( cd "$default_live" && git commit --quiet --allow-empty -m init && git push --quiet -u origin main )
+
+manifest="$tmpdir/manifest.json"
+cat > "$manifest" <<EOF
+{
+  "profiles": {
+    "default": {
+      "label": "Default",
+      "layers": [
+        { "name": "same-name", "level": 2, "source": "files", "path": "default", "cache": { "dir": "cache", "ttlSeconds": 60 } },
+        { "name": "team-live", "level": 0, "source": "okf-local", "path": "default-live", "live": true,
+          "git": { "pullTtlSeconds": 0, "retentionDays": 14 } }
+      ]
+    },
+    "work": {
+      "label": "Work",
+      "layers": [
+        { "name": "same-name", "level": 2, "source": "files", "path": "work", "cache": { "dir": "cache", "ttlSeconds": 60 } },
+        { "name": "curated", "level": 1, "source": "okf-local", "path": "curated" },
+        { "name": "team-live", "level": 0, "source": "okf-local", "path": "work-live", "live": true,
+          "git": { "pullTtlSeconds": 0, "retentionDays": 14 } }
+      ]
+    }
+  },
+  "projects": { "$tmpdir/project": "work" }
+}
+EOF
+
+# Resolver: cwd mapping wins, explicit override wins over cwd, sibling prefixes do not match.
+out="$(cd "$tmpdir/project/nested" && node "$core/resolver.mjs" --manifest "$manifest" --concept work-only)"
+grep -q 'WORK-SECRET-SENTINEL' <<<"$out" || fail "mapped resolver did not use work profile" "$out"
+set +e
+out="$(cd "$tmpdir/project/nested" && node "$core/resolver.mjs" --manifest "$manifest" --concept default-only 2>&1)"
+rc=$?
+set -e
+[ $rc -ne 0 ] || fail "mapped resolver leaked default concept" "$out"
+out="$(cd "$tmpdir/project/nested" && node "$core/resolver.mjs" --manifest "$manifest" --profile default --concept default-only)"
+grep -q 'DEFAULT-SECRET-SENTINEL' <<<"$out" || fail "explicit resolver override did not win"
+out="$(cd "$tmpdir/sibling" && node "$core/profile-cli.mjs" current --manifest "$manifest" --json)"
+node -e "const x=JSON.parse(process.argv[1]); if(x.id!=='default'||x.reason!=='default') throw new Error(JSON.stringify(x))" "$out" \
+  || fail "sibling path should select default" "$out"
+
+# MCP: one process-selected stack, dynamic instructions, and no cross-profile list/read/search.
+rpc_lines='{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18"}}
+{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"list_concepts","arguments":{}}}
+{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"search","arguments":{"query":"SECRET SENTINEL"}}}
+{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"get_links","arguments":{"concept_id":"work-only"}}}
+{"jsonrpc":"2.0","id":5,"method":"tools/call","params":{"name":"read_file","arguments":{"concept_id":"work-only"}}}
+{"jsonrpc":"2.0","id":6,"method":"tools/call","params":{"name":"read_file","arguments":{"concept_id":"default-only"}}}'
+out="$(cd "$tmpdir/project/nested" && printf '%b\n' "$rpc_lines" | node "$core/mcp-server.mjs" --manifest "$manifest")"
+node -e "
+const rows=process.argv[1].trim().split('\n').map(JSON.parse);
+const byId=new Map(rows.map(row=>[row.id,row]));
+const instructions=byId.get(1).result.instructions;
+if(!instructions.includes('profile id: work; reason: project')) throw new Error('profile instructions missing');
+if(instructions.includes('Work')) throw new Error('untrusted profile label entered instructions');
+const profileMeta=byId.get(1).result._meta.contextcake.selectedProfile;
+if(profileMeta.id!=='work'||profileMeta.label!=='Work'||profileMeta.reason!=='project') throw new Error('structured profile metadata missing');
+const listed=JSON.parse(byId.get(2).result.content[0].text).map(x=>x.id);
+if(!listed.includes('work-only') || listed.includes('default-only')) throw new Error('list isolation failed: '+listed);
+const searched=JSON.parse(byId.get(3).result.content[0].text).map(x=>x.id);
+if(!searched.includes('work-only') || searched.includes('default-only')) throw new Error('search isolation failed: '+searched);
+const links=JSON.parse(byId.get(4).result.content[0].text);
+if(links.incoming.some(link=>link.id==='default-only')) throw new Error('link isolation failed: '+JSON.stringify(links));
+const selectedRead=byId.get(5).result.content[0].text;
+if(!selectedRead.includes('WORK-SECRET-SENTINEL')) throw new Error('selected read failed: '+selectedRead);
+const rejectedRead=byId.get(6);
+if(!rejectedRead.error || !rejectedRead.error.message.includes('not found')) throw new Error('cross-profile read was not rejected: '+JSON.stringify(rejectedRead));
+" "$out" || fail "MCP selected-stack isolation" "$out"
+out="$(cd "$tmpdir/project/nested" && printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"list_concepts","arguments":{}}}' | node "$core/mcp-server.mjs" --manifest "$manifest" --profile default)"
+node -e "const r=process.argv[1].trim().split('\n').map(JSON.parse); const row=r.find(x=>x.id===2); const ids=JSON.parse(row.result.content[0].text).map(x=>x.id); if(!ids.includes('default-only')||ids.includes('work-only')) throw new Error(ids)" "$out" \
+  || fail "MCP explicit override isolation" "$out"
+
+# Closing harness stdin drains received requests, then closes selected adapters
+# so a long-lived foreign MCP child cannot keep ContextCake alive.
+cat > "$tmpdir/long-lived-mcp.mjs" <<'EOF'
+import readline from "node:readline";
+process.on("SIGTERM", () => {});
+const rl = readline.createInterface({ input: process.stdin });
+rl.on("line", (line) => {
+  const row = JSON.parse(line);
+  if (row.method === "initialize") console.log(JSON.stringify({ jsonrpc: "2.0", id: row.id, result: {} }));
+  else if (row.method === "tools/call") console.log(JSON.stringify({ jsonrpc: "2.0", id: row.id, result: { content: [{ type: "text", text: JSON.stringify({ nodes: [] }) }] } }));
+});
+setInterval(() => {}, 60_000);
+EOF
+cat > "$tmpdir/mcp-shutdown-manifest.json" <<EOF
+{"profiles":{"default":{"label":"Default","layers":[{"name":"foreign","level":1,"source":"mcp","command":"node","args":["$tmpdir/long-lived-mcp.mjs"],"cache":{"ttlSeconds":60}}]}}}
+EOF
+set +e
+out="$(node -e "
+const {spawn}=require('child_process');
+const p=spawn('node',['$core/mcp-server.mjs','--manifest','$tmpdir/mcp-shutdown-manifest.json'],{stdio:['pipe','pipe','inherit']});
+let stdout=''; p.stdout.on('data',d=>stdout+=d);
+const timer=setTimeout(()=>{p.kill('SIGKILL');console.error('shutdown timeout');process.exit(2)},5000);
+p.on('exit',code=>{clearTimeout(timer);process.stdout.write(stdout);process.exit(code===0?0:1)});
+p.stdin.end('{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{}}\\n{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"list_concepts\",\"arguments\":{}}}\\n');
+")"
+rc=$?
+set -e
+[ $rc -eq 0 ] || fail "MCP did not exit after closing a long-lived selected source" "$out"
+node -e "const rows=process.argv[1].trim().split('\n').map(JSON.parse);if(!rows.some(x=>x.id===2&&x.result))throw new Error(process.argv[1])" "$out" \
+  || fail "MCP shutdown cut off an in-flight response" "$out"
+
+# Profile-aware cache calls produce separate opaque namespaces for same-named sources.
+find "$tmpdir/cache" -mindepth 1 -maxdepth 1 -type d | sort > "$tmpdir/cache-dirs.txt"
+[ "$(wc -l < "$tmpdir/cache-dirs.txt" | tr -d ' ')" -eq 2 ] || fail "same-named profiles should have two cache namespaces" "$(cat "$tmpdir/cache-dirs.txt")"
+
+# Batch write selects the same mapped stack.
+cat > "$tmpdir/signals.json" <<'EOF'
+{"signals":[{"id":"write-1","route":"team_candidate","destination":"systems/profile-write","title":"Profile write","repo":"test/repo","action":"WORK-WRITE-SENTINEL"}]}
+EOF
+( cd "$tmpdir/project/nested" && node "$core/write.mjs" --signals "$tmpdir/signals.json" --manifest "$manifest" --target-layer curated >/dev/null )
+[ -f "$tmpdir/curated/systems/profile-write.md" ] || fail "write did not target selected profile"
+[ ! -f "$tmpdir/default/systems/profile-write.md" ] || fail "write crossed into default profile"
+set +e
+( cd "$tmpdir/project/nested" && node "$core/write.mjs" --signals "$tmpdir/signals.json" --manifest "$manifest" --target-layer same-name >/dev/null 2>&1 )
+rc=$?
+set -e
+[ $rc -ne 0 ] || fail "batch write should reject a plain Markdown-folder source"
+
+# Batch destinations are untrusted classifier output: traversal, symlinked
+# parents, and symlinked final files must not escape or overwrite anything.
+cat > "$tmpdir/traversal-signals.json" <<'EOF'
+{"signals":[{"id":"escape","route":"team_candidate","destination":"../default/cross-profile-leak","title":"Escape","repo":"test/repo"}]}
+EOF
+set +e
+( cd "$tmpdir/project/nested" && node "$core/write.mjs" --signals "$tmpdir/traversal-signals.json" --manifest "$manifest" --target-layer curated >/dev/null 2>&1 )
+rc=$?
+set -e
+[ $rc -ne 0 ] || fail "batch traversal destination should be rejected"
+[ ! -f "$tmpdir/default/cross-profile-leak.md" ] || fail "batch traversal crossed into another profile"
+
+mkdir -p "$tmpdir/outside-write"
+ln -s "$tmpdir/outside-write" "$tmpdir/curated/escape-parent"
+cat > "$tmpdir/symlink-parent-signals.json" <<'EOF'
+{"signals":[{"id":"parent-link","route":"team_candidate","destination":"escape-parent/new/leak","title":"Parent link","repo":"test/repo"}]}
+EOF
+set +e
+( cd "$tmpdir/project/nested" && node "$core/write.mjs" --signals "$tmpdir/symlink-parent-signals.json" --manifest "$manifest" --target-layer curated >/dev/null 2>&1 )
+rc=$?
+set -e
+[ $rc -ne 0 ] || fail "batch symlinked parent should be rejected"
+[ ! -e "$tmpdir/outside-write/new" ] || fail "batch write created directories through a symlinked parent"
+
+printf 'DO-NOT-OVERWRITE\n' > "$tmpdir/outside-write/final.md"
+ln -s "$tmpdir/outside-write/final.md" "$tmpdir/curated/final-link.md"
+cat > "$tmpdir/symlink-final-signals.json" <<'EOF'
+{"signals":[{"id":"final-link","route":"team_candidate","destination":"final-link","title":"Final link","repo":"test/repo"}]}
+EOF
+set +e
+( cd "$tmpdir/project/nested" && node "$core/write.mjs" --signals "$tmpdir/symlink-final-signals.json" --manifest "$manifest" --target-layer curated >/dev/null 2>&1 )
+rc=$?
+set -e
+[ $rc -ne 0 ] || fail "batch symlinked final file should be rejected"
+grep -q 'DO-NOT-OVERWRITE' "$tmpdir/outside-write/final.md" || fail "batch write overwrote symlink target"
+
+# A staged capture is bound to the startup profile + manifest revision. Editing
+# even local profile metadata before confirmation consumes and rejects it.
+out="$(node -e "
+const {spawn}=require('child_process'), fs=require('fs');
+const p=spawn('node',['$core/mcp-server.mjs','--manifest','$manifest','--profile','work','--capture'],{cwd:'$tmpdir/project'});
+let buf='', state=0, staged=null; const rows=[];
+const send=o=>p.stdin.write(JSON.stringify(o)+'\n');
+p.stdout.on('data',d=>{buf+=d;let i;while((i=buf.indexOf('\n'))!==-1){const line=buf.slice(0,i);buf=buf.slice(i+1);if(!line.trim())continue;const row=JSON.parse(line);rows.push(row);
+  if(state===0){state=1;send({jsonrpc:'2.0',id:2,method:'tools/call',params:{name:'log_capture',arguments:{kind:'gotcha',title:'Bound capture',sections:{body:'Must stay in work'}}}});}
+  else if(state===1){state=2;staged=JSON.parse(row.result.content[0].text);const m=JSON.parse(fs.readFileSync('$manifest','utf8'));m.profiles.work.label='Work renamed during session';fs.writeFileSync('$manifest',JSON.stringify(m,null,2)+'\n');send({jsonrpc:'2.0',id:3,method:'tools/call',params:{name:'confirm_capture',arguments:{token:staged.token}}});}
+  else if(state===2){console.log(JSON.stringify(row));p.stdin.end();}
+}});
+p.on('exit',()=>process.exit(0));send({jsonrpc:'2.0',id:1,method:'initialize',params:{}});setTimeout(()=>{p.kill();process.exit(1)},15000);
+")"
+node -e "const r=JSON.parse(process.argv[1]); if(!r.error||!r.error.message.includes('changed after staging')) throw new Error(JSON.stringify(r))" "$out" \
+  || fail "capture confirmation should reject a changed binding" "$out"
+[ ! -f "$live/captures/gotcha/profile-tester--bound-capture.md" ] || fail "rejected capture reached live layer"
+
+# A fresh process can confirm into the selected same-named live layer; capture
+# and content-free telemetry never touch the default profile's live repo.
+out="$(node -e "
+const {spawn}=require('child_process');
+const p=spawn('node',['$core/mcp-server.mjs','--manifest','$manifest','--profile','work','--capture','--telemetry','--harness','profile-test'],{cwd:'$tmpdir/project'});
+let buf='', state=0, staged=null; const send=o=>p.stdin.write(JSON.stringify(o)+'\n');
+p.stdout.on('data',d=>{buf+=d;let i;while((i=buf.indexOf('\n'))!==-1){const line=buf.slice(0,i);buf=buf.slice(i+1);if(!line.trim())continue;const row=JSON.parse(line);
+  if(state===0){state=1;send({jsonrpc:'2.0',id:2,method:'tools/call',params:{name:'log_capture',arguments:{kind:'gotcha',title:'Selected capture',sections:{body:'Work live only'}}}});}
+  else if(state===1){state=2;staged=JSON.parse(row.result.content[0].text);send({jsonrpc:'2.0',id:3,method:'tools/call',params:{name:'confirm_capture',arguments:{token:staged.token}}});}
+  else if(state===2){console.log(JSON.stringify(row));p.stdin.end();}
+}});
+p.on('exit',()=>process.exit(0));send({jsonrpc:'2.0',id:1,method:'initialize',params:{}});setTimeout(()=>{p.kill();process.exit(1)},20000);
+")"
+node -e "const r=JSON.parse(process.argv[1]); const x=JSON.parse(r.result.content[0].text); if(!x.id||!x.pushed) throw new Error(JSON.stringify(r))" "$out" \
+  || fail "selected capture confirmation" "$out"
+[ -f "$live/captures/gotcha/profile-tester--selected-capture.md" ] || fail "selected capture missing from work live layer"
+[ ! -f "$default_live/captures/gotcha/profile-tester--selected-capture.md" ] || fail "capture crossed into default live layer"
+[ -d "$live/telemetry/profile-tester" ] || fail "selected telemetry missing from work live layer"
+[ ! -d "$default_live/telemetry" ] || fail "telemetry crossed into default live layer"
+
+# Profile-aware promotion resolves both roots from the selected profile and
+# binds approval to the same revision and layer fingerprints.
+mkdir -p "$live/captures/investigation"
+cat > "$live/captures/investigation/profile-tester--promotion-one.md" <<'EOF'
+---
+kind: investigation
+title: Promotion one
+author: Profile Tester
+captured: 2026-07-29T00:00:00.000Z
+status: unreviewed
+---
+
+# Promotion one
+
+## Fix {#fix}
+
+Use the selected profile only.
+EOF
+( cd "$live" && git add -A && git commit -qm "seed profile promotion" && git push -q )
+node "$core/promote.mjs" --manifest "$manifest" --profile work --capture captures/investigation/profile-tester--promotion-one --target-layer curated --dest systems/profile-promotion >/dev/null
+review="$tmpdir/curated/_review/promotions/profile-promotion.md"
+[ -f "$review" ] || fail "profile-aware promotion request missing"
+node "$core/promote.mjs" --manifest "$manifest" --profile work --approve "$review" --target-layer curated >/dev/null
+[ -f "$tmpdir/curated/systems/profile-promotion.md" ] || fail "profile-aware promotion did not write curated target"
+[ ! -f "$live/captures/investigation/profile-tester--promotion-one.md" ] || fail "successful profile promotion did not clean live capture"
+
+# A live-repo symlink must never turn promotion into a local file read.
+printf 'LOCAL-SECRET-MUST-NOT-BE-PROMOTED\n' > "$tmpdir/outside-promotion-secret.md"
+mkdir -p "$live/captures/investigation"
+ln -s "$tmpdir/outside-promotion-secret.md" "$live/captures/investigation/profile-tester--symlink.md"
+( cd "$live" && git add -A && git commit -qm "seed malicious capture symlink" && git push -q )
+set +e
+out="$(node "$core/promote.mjs" --manifest "$manifest" --profile work --capture captures/investigation/profile-tester--symlink --target-layer curated --dest systems/symlink-leak 2>&1)"
+rc=$?
+set -e
+[ $rc -ne 0 ] || fail "promotion should reject a symlinked live capture" "$out"
+[ ! -f "$tmpdir/curated/_review/promotions/symlink-leak.md" ] || fail "symlinked capture reached the review queue"
+
+# An unreviewed capture cannot pre-seed reserved frontmatter that overrides the
+# trusted promotion source/destination or binding fields.
+cat > "$live/captures/investigation/profile-tester--reserved.md" <<'EOF'
+---
+kind: investigation
+title: Reserved keys
+author: Profile Tester
+captured: 2026-07-29T00:00:00.000Z
+status: unreviewed
+promoteTo: systems/redirected
+---
+
+# Reserved keys
+
+## Fix {#fix}
+
+Must be rejected before staging.
+EOF
+( cd "$live" && git add -A && git commit -qm "seed reserved promotion metadata" && git push -q )
+set +e
+out="$(node "$core/promote.mjs" --manifest "$manifest" --profile work --capture captures/investigation/profile-tester--reserved --target-layer curated --dest systems/reserved 2>&1)"
+rc=$?
+set -e
+[ $rc -ne 0 ] || fail "promotion should reject reserved capture frontmatter" "$out"
+[ ! -f "$tmpdir/curated/_review/promotions/reserved.md" ] || fail "reserved promotion metadata reached review"
+
+# A commit failure after live deletion begins must restore the exact capture,
+# clear its staged deletion, and keep the review retryable.
+cat > "$live/captures/investigation/profile-tester--retryable.md" <<'EOF'
+---
+kind: investigation
+title: Retryable promotion
+author: Profile Tester
+captured: 2026-07-29T00:00:00.000Z
+status: unreviewed
+---
+
+# Retryable promotion
+
+## Fix {#fix}
+
+Commit failure must preserve this capture.
+EOF
+( cd "$live" && git add -A && git commit -qm "seed retryable promotion" && git push -q )
+node "$core/promote.mjs" --manifest "$manifest" --profile work --capture captures/investigation/profile-tester--retryable --target-layer curated --dest systems/retryable >/dev/null
+retry_review="$tmpdir/curated/_review/promotions/retryable.md"
+cat > "$live/.git/hooks/pre-commit" <<'EOF'
+#!/usr/bin/env sh
+exit 1
+EOF
+chmod +x "$live/.git/hooks/pre-commit"
+set +e
+out="$(node "$core/promote.mjs" --manifest "$manifest" --profile work --approve "$retry_review" --target-layer curated 2>&1)"
+rc=$?
+set -e
+[ $rc -ne 0 ] || fail "forced promotion commit failure should fail approval" "$out"
+[ -f "$retry_review" ] || fail "failed promotion removed its review"
+[ -f "$live/captures/investigation/profile-tester--retryable.md" ] || fail "failed promotion did not restore its live capture"
+[ -z "$(cd "$live" && git diff --cached --name-only -- captures/investigation/profile-tester--retryable.md)" ] || fail "failed promotion left capture deletion staged"
+rm "$live/.git/hooks/pre-commit"
+node "$core/promote.mjs" --manifest "$manifest" --profile work --approve "$retry_review" --target-layer curated >/dev/null
+[ ! -f "$retry_review" ] || fail "retryable promotion did not clear review after success"
+[ ! -f "$live/captures/investigation/profile-tester--retryable.md" ] || fail "retryable promotion did not clean live capture"
+
+# Editing both visible field pairs and the capture hash still cannot redirect a
+# promotion because the authoritative tuple lives in machine-local state.
+cat > "$live/captures/investigation/profile-tester--binding-source.md" <<'EOF'
+---
+kind: investigation
+title: Binding source
+author: Profile Tester
+captured: 2026-07-29T00:00:00.000Z
+status: unreviewed
+---
+
+# Binding source
+
+## Fix {#fix}
+
+This is the authorized source.
+EOF
+cat > "$live/captures/investigation/profile-tester--binding-redirect.md" <<'EOF'
+---
+kind: investigation
+title: Binding redirect
+author: Profile Tester
+captured: 2026-07-29T00:00:00.000Z
+status: unreviewed
+---
+
+# Binding redirect
+
+## Fix {#fix}
+
+This source must not be substituted.
+EOF
+( cd "$live" && git add -A && git commit -qm "seed promotion binding attack" && git push -q )
+node "$core/promote.mjs" --manifest "$manifest" --profile work --capture captures/investigation/profile-tester--binding-source --target-layer curated --dest systems/binding-source >/dev/null
+binding_review="$tmpdir/curated/_review/promotions/binding-source.md"
+node -e "
+const fs=require('fs'),crypto=require('crypto');
+const review=process.argv[1], redirect=process.argv[2];
+const hash=crypto.createHash('sha256').update(fs.readFileSync(redirect)).digest('hex');
+let raw=fs.readFileSync(review,'utf8');
+raw=raw.replace(/^promoteTo:.*$/m,'promoteTo: systems/binding-redirected')
+  .replace(/^promotedFrom:.*$/m,'promotedFrom: captures/investigation/profile-tester--binding-redirect')
+  .replace(/^promotionCapture:.*$/m,'promotionCapture: captures/investigation/profile-tester--binding-redirect')
+  .replace(/^promotionDestination:.*$/m,'promotionDestination: systems/binding-redirected')
+  .replace(/^promotionCaptureHash:.*$/m,'promotionCaptureHash: '+hash);
+fs.writeFileSync(review,raw);
+" "$binding_review" "$live/captures/investigation/profile-tester--binding-redirect.md"
+set +e
+out="$(node "$core/promote.mjs" --manifest "$manifest" --profile work --approve "$binding_review" --target-layer curated 2>&1)"
+rc=$?
+set -e
+[ $rc -ne 0 ] || fail "editable review metadata should not replace its local binding" "$out"
+grep -q 'authoritative local binding' <<<"$out" || fail "binding mismatch error should name the authoritative boundary" "$out"
+[ -f "$live/captures/investigation/profile-tester--binding-source.md" ] || fail "binding attack removed authorized source"
+[ -f "$live/captures/investigation/profile-tester--binding-redirect.md" ] || fail "binding attack removed substituted source"
+[ ! -f "$tmpdir/curated/systems/binding-redirected.md" ] || fail "binding attack wrote substituted destination"
+
+# If repo-lock acquisition fails only after the deletion commit, the local
+# binding records that cleanup and a retry pushes before clearing the review.
+cat > "$live/captures/investigation/profile-tester--push-retry.md" <<'EOF'
+---
+kind: investigation
+title: Push retry
+author: Profile Tester
+captured: 2026-07-29T00:00:00.000Z
+status: unreviewed
+---
+
+# Push retry
+
+## Fix {#fix}
+
+The review survives a post-commit push lock.
+EOF
+( cd "$live" && git add -A && git commit -qm "seed push retry promotion" && git push -q )
+node "$core/promote.mjs" --manifest "$manifest" --profile work --capture captures/investigation/profile-tester--push-retry --target-layer curated --dest systems/push-retry >/dev/null
+push_review="$tmpdir/curated/_review/promotions/push-retry.md"
+cat > "$live/.git/hooks/post-commit" <<'EOF'
+#!/usr/bin/env sh
+mv .contextcake.lock .contextcake.lock.saved
+node -e 'require("fs").writeFileSync(".contextcake.lock",JSON.stringify({pid:process.pid,ts:Date.now(),op:"push-test",token:"replacement"}))'
+EOF
+chmod +x "$live/.git/hooks/post-commit"
+set +e
+out="$(node "$core/promote.mjs" --manifest "$manifest" --profile work --approve "$push_review" --target-layer curated 2>&1)"
+rc=$?
+set -e
+[ $rc -ne 0 ] || fail "forced post-commit push lock should fail approval" "$out"
+[ -f "$push_review" ] || fail "post-commit push failure removed review"
+[ ! -f "$live/captures/investigation/profile-tester--push-retry.md" ] || fail "post-commit push failure should retain durable deletion"
+rm "$live/.git/hooks/post-commit" "$live/.contextcake.lock" "$live/.contextcake.lock.saved"
+node "$core/promote.mjs" --manifest "$manifest" --profile work --approve "$push_review" --target-layer curated >/dev/null
+[ ! -f "$push_review" ] || fail "push retry did not clear review after retrying push"
+
+# Simulate a crash after the live deletion commit but before local binding state
+# flips to cleanupCommitted. Approval reconciles the exact commit from git.
+cat > "$live/captures/investigation/profile-tester--crash-window.md" <<'EOF'
+---
+kind: investigation
+title: Crash window
+author: Profile Tester
+captured: 2026-07-29T00:00:00.000Z
+status: unreviewed
+---
+
+# Crash window
+
+## Fix {#fix}
+
+Git history makes the post-commit crash resumable.
+EOF
+( cd "$live" && git add -A && git commit -qm "seed crash-window promotion" && git push -q )
+node "$core/promote.mjs" --manifest "$manifest" --profile work --capture captures/investigation/profile-tester--crash-window --target-layer curated --dest systems/crash-window >/dev/null
+crash_review="$tmpdir/curated/_review/promotions/crash-window.md"
+( cd "$live" && rm captures/investigation/profile-tester--crash-window.md && git add -- captures/investigation/profile-tester--crash-window.md && git commit -qm "chore: promote captures/investigation/profile-tester--crash-window -> systems/crash-window" )
+node "$core/promote.mjs" --manifest "$manifest" --profile work --approve "$crash_review" --target-layer curated >/dev/null
+[ ! -f "$crash_review" ] || fail "post-commit crash reconciliation did not clear review"
+[ -f "$tmpdir/curated/systems/crash-window.md" ] || fail "post-commit crash reconciliation did not preserve curated write"
+
+mkdir -p "$live/captures/investigation"
+cat > "$live/captures/investigation/profile-tester--promotion-stale.md" <<'EOF'
+---
+kind: investigation
+title: Promotion stale
+author: Profile Tester
+captured: 2026-07-29T00:00:00.000Z
+status: unreviewed
+---
+
+# Promotion stale
+
+## Fix {#fix}
+
+This approval must be rejected after configuration changes.
+EOF
+( cd "$live" && git add -A && git commit -qm "seed stale promotion" && git push -q )
+node "$core/promote.mjs" --manifest "$manifest" --profile work --capture captures/investigation/profile-tester--promotion-stale --target-layer curated --dest systems/profile-promotion-stale >/dev/null
+stale_review="$tmpdir/curated/_review/promotions/profile-promotion-stale.md"
+node -e "const fs=require('fs');const m=JSON.parse(fs.readFileSync('$manifest','utf8'));m.profiles.work.label='Work changed after promotion request';fs.writeFileSync('$manifest',JSON.stringify(m,null,2)+'\n')"
+set +e
+out="$(node "$core/promote.mjs" --manifest "$manifest" --profile work --approve "$stale_review" --target-layer curated 2>&1)"
+rc=$?
+set -e
+[ $rc -ne 0 ] || fail "stale promotion approval should fail" "$out"
+grep -q 'changed after staging' <<<"$out" || fail "stale promotion error should explain binding change" "$out"
+[ -f "$live/captures/investigation/profile-tester--promotion-stale.md" ] || fail "stale approval removed live capture"
+[ ! -f "$tmpdir/curated/systems/profile-promotion-stale.md" ] || fail "stale approval wrote curated content"
+
+# Profile CLI: create migrates safely, current/list are adapter-free, mapping is
+# canonical, deletion previews references and removes references only.
+legacy="$tmpdir/legacy.json"
+cat > "$legacy" <<EOF
+{"layers":[{"name":"legacy","level":1,"source":"files","path":"$tmpdir/default"}]}
+EOF
+out="$(node "$core/profile-cli.mjs" create "Extra Profile" --manifest "$legacy" --project "$tmpdir/project" --json)"
+node -e "const x=JSON.parse(process.argv[1]); if(x.created!=='extra-profile'||!x.backupPath) throw new Error(JSON.stringify(x)); require('fs').accessSync(x.backupPath)" "$out" \
+  || fail "profile create/migration result" "$out"
+node "$core/profile-cli.mjs" unmap "$tmpdir/project" --manifest "$legacy" >/dev/null
+out="$(cd "$tmpdir/project/nested" && node "$core/profile-cli.mjs" current --manifest "$legacy" --json)"
+node -e "const x=JSON.parse(process.argv[1]); if(x.id!=='default'||x.reason!=='default') throw new Error(JSON.stringify(x))" "$out" \
+  || fail "profile unmap should restore default selection" "$out"
+node "$core/profile-cli.mjs" map extra-profile "$tmpdir/project" --manifest "$legacy" >/dev/null
+out="$(cd "$tmpdir/project/nested" && node "$core/profile-cli.mjs" current --manifest "$legacy" --json)"
+node -e "const x=JSON.parse(process.argv[1]); if(x.id!=='extra-profile'||x.reason!=='project') throw new Error(JSON.stringify(x))" "$out" \
+  || fail "profile current should report mapped profile" "$out"
+out="$(node "$core/profile-cli.mjs" list --manifest "$legacy" --json)"
+node -e "const x=JSON.parse(process.argv[1]); if(!x.some(p=>p.id==='default')||!x.some(p=>p.id==='extra-profile')) throw new Error(JSON.stringify(x))" "$out" \
+  || fail "profile list"
+set +e
+node "$core/profile-cli.mjs" delete extra-profile --manifest "$legacy" >/dev/null 2>&1
+rc=$?
+set -e
+[ $rc -eq 2 ] || fail "profile delete must require --confirm"
+node "$core/profile-cli.mjs" delete extra-profile --manifest "$legacy" --confirm >/dev/null
+out="$(node "$core/profile-cli.mjs" list --manifest "$legacy" --json)"
+node -e "const x=JSON.parse(process.argv[1]); if(x.some(p=>p.id==='extra-profile')) throw new Error(JSON.stringify(x))" "$out" \
+  || fail "confirmed profile deletion"
+[ -d "$tmpdir/project" ] || fail "profile deletion removed underlying project folder"
+
+echo "profile runtime test passed (selection + MCP/write isolation + cache + capture binding + promotion + CLI)"
diff --git a/packages/core/tests/smoke-test.sh b/packages/core/tests/smoke-test.sh
index 0202957..ced2337 100755
--- a/packages/core/tests/smoke-test.sh
+++ b/packages/core/tests/smoke-test.sh
@@ -46,6 +46,7 @@ Operational checklist for login incidents.
 EOF
 
 node "$repo_root/promote.mjs" \
+  --legacy-paths \
   --personal "$personal" \
   --shared "$shared" \
   --file scratch/auth-notes
diff --git a/profile.mjs b/profile.mjs
new file mode 100755
index 0000000..b4ce9ab
--- /dev/null
+++ b/profile.mjs
@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const target = path.join(here, "packages/core/src/profile-cli.mjs");
+process.argv[1] = target;
+await import(pathToFileURL(target).href);
diff --git a/specs/contextcake-packs/packs/contextcake/use-cases/capturing-and-promoting-context.md b/specs/contextcake-packs/packs/contextcake/use-cases/capturing-and-promoting-context.md
index 49bfae6..5a151f7 100644
--- a/specs/contextcake-packs/packs/contextcake/use-cases/capturing-and-promoting-context.md
+++ b/specs/contextcake-packs/packs/contextcake/use-cases/capturing-and-promoting-context.md
@@ -56,7 +56,7 @@ team, or team to company. `promote.mjs` does that as a direct bundle-to-
 bundle operation, not through the manifest:
 
 ```bash
-node promote.mjs --personal ~/kb-personal --shared ~/kb-team --file decisions/primary-db
+node promote.mjs --legacy-paths --personal ~/kb-personal --shared ~/kb-team --file decisions/primary-db
 ```
 
 It copies the file, rewrites any `personal:`-scoped links to shared-relative
diff --git a/specs/contextcake-project-profiles/adversarial-review.md b/specs/contextcake-project-profiles/adversarial-review.md
index 5540ad6..df63d72 100644
--- a/specs/contextcake-project-profiles/adversarial-review.md
+++ b/specs/contextcake-project-profiles/adversarial-review.md
@@ -111,6 +111,97 @@ that resolves live and target layers by identity from one selected manifest and
 revalidates before writing. Raw-path promotion remains an explicitly separate
 legacy/advanced mode without a profile-isolation claim.
 
+### B8. Batch destinations could escape the selected profile
+
+**Finding:** Runtime selection alone did not make `write.mjs` safe. Classifier
+destinations were joined directly to a layer root, generic Markdown-folder
+sources were treated as writable, and symlinked parents could be followed.
+
+**Impact:** Crafted signal data could overwrite a sibling profile or mutate a
+read-only source. A recursive directory creation could even touch an external
+tree before the later containment check rejected the final write.
+
+**Resolution:** Accepted. Batch writes now target only non-live local OKF
+layers, normalize destinations as concept ids, validate every existing parent
+before creating one directory component at a time, and use no-follow writes.
+Traversal, nested outward-symlink, final-symlink, and Markdown-folder fixtures
+all fail closed.
+
+### B9. Editable promotion metadata was not an authoritative binding
+
+**Finding:** Storing capture id, destination, and content hash only in the
+editable review file made the binding self-authored. An editor could change both
+visible field pairs and the hash together.
+
+**Impact:** A malicious review change could substitute another in-profile live
+capture or curated destination while retaining valid profile fingerprints.
+
+**Resolution:** Accepted. Profile-aware staging writes an opaque nonce into the
+review and stores the authoritative tuple in machine-local runtime state keyed
+by the manifest and nonce. Approval compares profile/layer fingerprints,
+capture, destination, capture hash, and review identity against that independent
+record. Reserved and duplicate promotion keys and symlinked source/review files
+are rejected.
+
+### B10. Revalidation and writes had a manifest race
+
+**Finding:** Capture and promotion re-read the manifest before writing, but did
+not exclude a concurrent profile deletion or retarget between the check and the
+filesystem mutation.
+
+**Impact:** A stale-root write could land despite the documented fail-closed
+binding promise.
+
+**Resolution:** Accepted. The shared manifest lock now has an async write lease.
+Capture confirmation holds it from binding revalidation through the local git
+commit; profile-aware promotion and batch write hold the same boundary across
+selection and local mutation. A barrier-controlled test proves concurrent
+manifest mutation waits for the lease.
+
+### B11. Promotion failure could destroy its retry surface
+
+**Finding:** Approval removed the review and live capture before the deletion
+commit succeeded. A later push-lock failure also left a committed deletion whose
+retry path skipped the push and cleared the review.
+
+**Impact:** Lock or git failures could make approval unresumable or silently
+leave cleanup only in a local commit.
+
+**Resolution:** Accepted. The repo lock is acquired before deleting the capture;
+commit failure restores the exact bytes and index state while retaining the
+review. The local binding records a durable cleanup commit, so a retry with an
+already-absent capture must retry the push before clearing the review. Forced
+pre-commit and post-commit lock tests cover both paths. If the process stops in
+the narrow interval after commit and before that state update, retry reconciles
+the exact expected deletion commit from git history before continuing.
+
+### B12. Synced labels could become agent instructions
+
+**Finding:** Profile labels are safe display strings but can originate in synced
+metadata. Quoting or labeling arbitrary prose as untrusted does not stop semantic
+prompt injection when that prose remains inside MCP `instructions`.
+
+**Impact:** A remote label change could influence a newly started agent session
+despite `activeProfile` correctly remaining local-only.
+
+**Resolution:** Accepted. MCP instructions contain only the regex-constrained
+profile id and enum selection reason. The label is returned separately as
+structured initialization metadata. The spec and design now state that boundary.
+
+### B13. Foreign MCP children could outlive the harness session
+
+**Finding:** Closing harness stdin flushed telemetry but did not reliably close
+selected adapters, and a foreign MCP child could ignore `SIGTERM`.
+
+**Impact:** ContextCake could remain alive after its harness disconnected,
+retaining a trusted executable child and stale process-bound profile snapshot.
+
+**Resolution:** Accepted. Shutdown drains already-received requests, awaits all
+adapter closes, ends child stdin, waits for bounded `SIGTERM`, and escalates to
+`SIGKILL`. Cache and git-sync decorators return the underlying async close so
+the wait cannot be dropped. The cached integration fixture deliberately ignores
+`SIGTERM` and still proves bounded exit without cutting off its final response.
+
 ## 2. Non-Blocking Findings and Resolutions
 
 | Finding | Disposition |
diff --git a/specs/contextcake-project-profiles/design.md b/specs/contextcake-project-profiles/design.md
index 2ba27b3..658fbc0 100644
--- a/specs/contextcake-project-profiles/design.md
+++ b/specs/contextcake-project-profiles/design.md
@@ -315,8 +315,10 @@ telemetry.
   capture context, link traversal, and telemetry initialization.
 - Make `resolveLiveLayer()` accept selected layers rather than search the full
   manifest.
-- Add the profile label, id, and non-sensitive selection reason to MCP
-  initialization instructions. Do not include a project path.
+- Add the stable profile id and non-sensitive selection reason to MCP
+  initialization instructions. Return the human-readable label only as
+  structured initialization metadata so synced display text cannot become
+  instruction prose. Do not include a project path.
 - Keep the four baseline read-tool schemas byte-for-byte stable and preserve the
   two additional team-sync read tools.
 - Keep capture opt-in. The selector must complete before the server exposes
diff --git a/specs/contextcake-project-profiles/spec.md b/specs/contextcake-project-profiles/spec.md
index f30563e..4d35724 100644
--- a/specs/contextcake-project-profiles/spec.md
+++ b/specs/contextcake-project-profiles/spec.md
@@ -236,8 +236,9 @@ registration.
 ### 5.6 Agent connection and verification
 
 - [ ] WHEN an MCP process initializes THE SYSTEM SHALL include the selected
-  profile label, id, and selection reason in its non-secret usage instructions
-  without changing the existing read-tool schemas.
+  profile id and selection reason in its non-secret usage instructions, return
+  the human-readable label only as structured initialization metadata, and
+  SHALL NOT change the existing read-tool schemas.
 - [ ] WHEN a user runs `contextcake profile current` THE SYSTEM SHALL report the
   selected profile, selection reason, and matched project root if applicable;
   machine-readable JSON SHALL be available.

From af1f22243d684b0562f6296943caadd7336aac13 Mon Sep 17 00:00:00 2001
From: John Siracusa <siracusa5@users.noreply.github.com>
Date: Wed, 29 Jul 2026 02:59:37 -0400
Subject: [PATCH 2/2] fix(core): release the manifest lock before promotion's
 network push
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

runProfilePromotion held the shared manifest lock for the entire
approve step, including the git push at the end. The manifest lock
times out after 15s (MANIFEST_LOCK_TIMEOUT_MS), but a push can take
much longer (retry-with-rebase against a 90s per-call git timeout) —
so a slow or retried push could make every other profile-aware
operation sharing that manifest (a concurrent capture confirm,
another promotion, a profile-cli edit) fail with a spurious "Timed
out acquiring the ContextCake manifest lock" error.

confirmCapture already avoids this by releasing the lock before
pushing; promotion's own adversarial-review notes (B10) describe the
same "selection through local mutation" boundary but the
implementation held the lock through the push too. Split
approvePromotion into commitPromotion (validate, write curated
concept, commit the live deletion — stays inside the lock) and
finalizePromotion (push + review/binding cleanup — runs after the
lock is released), matching the documented design.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: John Siracusa <siracusa5@users.noreply.github.com>
---
 packages/core/src/promote.mjs               | 53 +++++++++++++++++----
 packages/core/tests/profile-runtime-test.sh | 51 ++++++++++++++++++++
 2 files changed, 96 insertions(+), 8 deletions(-)

diff --git a/packages/core/src/promote.mjs b/packages/core/src/promote.mjs
index 08827b1..3b76b4a 100755
--- a/packages/core/src/promote.mjs
+++ b/packages/core/src/promote.mjs
@@ -99,9 +99,14 @@ if (args["print-git"]) {
 //   writes the curated concept, verifies it is durable, and only then removes
 //   the review entry and the live capture. Re-running approve is idempotent.
 
+// The manifest lock guards selection + local mutation only (matching capture
+// confirmation's boundary) — never the network push. A push can take far
+// longer than the manifest lock's own timeout, and holding the lock through it
+// would stall or spuriously fail every other profile-aware operation sharing
+// this manifest (concurrent captures, other promotions, profile-cli edits).
 async function runProfilePromotion(parsed) {
   const manifestPath = path.resolve(parsed.manifest);
-  return withManifestLockAsync(manifestPath, async () => {
+  const pending = await withManifestLockAsync(manifestPath, async () => {
     const runtime = loadProfileRuntime(manifestPath, {
       requestedProfile: parsed.profile ?? null,
       cwd: process.cwd(),
@@ -127,11 +132,16 @@ async function runProfilePromotion(parsed) {
     const bound = { ...parsed, _profileBinding: profileBinding, _manifestPath: manifestPath };
     if (parsed.approve) {
       const reviewPath = resolveProfileReviewPath(curatedRoot, parsed.approve);
-      return approvePromotion(liveLayer.root, curatedRoot, reviewPath, bound);
+      const outcome = await commitPromotion(liveLayer.root, curatedRoot, reviewPath, bound);
+      return { kind: "approve", liveRoot: liveLayer.root, ...outcome };
+    }
+    if (parsed.capture) {
+      await requestPromotion(liveLayer.root, curatedRoot, parsed.capture, bound);
+      return { kind: "capture" };
     }
-    if (parsed.capture) return requestPromotion(liveLayer.root, curatedRoot, parsed.capture, bound);
     throw new Error("Pass --capture <id> to request a promotion or --approve <review-file> to finalize one.");
   });
+  if (pending.kind === "approve") await finalizePromotion(pending);
 }
 
 function kindDest(kind) {
@@ -143,7 +153,10 @@ async function runFromLive(parsed) {
   const curatedRoot = parsed.target ? path.resolve(parsed.target) : null;
   if (!curatedRoot) throw new Error("--target <curated-root> is required");
 
-  if (parsed.approve) return approvePromotion(liveRoot, curatedRoot, path.resolve(parsed.approve), parsed);
+  if (parsed.approve) {
+    const outcome = await commitPromotion(liveRoot, curatedRoot, path.resolve(parsed.approve), parsed);
+    return finalizePromotion({ liveRoot, ...outcome });
+  }
   if (parsed.capture) return requestPromotion(liveRoot, curatedRoot, parsed.capture, parsed);
   throw new Error("Pass --capture <id> to request a promotion or --approve <review-file> to finalize one.");
 }
@@ -225,7 +238,12 @@ async function requestPromotion(liveRoot, curatedRoot, captureId, parsed) {
   console.log(`Staged promotion request: ${reviewRel} -> ${dest}`);
 }
 
-async function approvePromotion(liveRoot, curatedRoot, reviewPath, parsed) {
+// Validates the review, writes the curated concept, and commits the live
+// deletion — everything that must stay behind the manifest lock (in
+// profile-aware mode) so a concurrent profile edit can't retarget the write.
+// Returns a descriptor for finalizePromotion to push and clean up afterward,
+// outside the lock.
+async function commitPromotion(liveRoot, curatedRoot, reviewPath, parsed) {
   if (!fs.existsSync(reviewPath)) throw new Error(`Review file not found: ${reviewPath}`);
   const reviewRaw = parsed._profileBinding
     ? readFileInRoot(curatedRoot, path.relative(curatedRoot, reviewPath))
@@ -279,6 +297,7 @@ async function approvePromotion(liveRoot, curatedRoot, reviewPath, parsed) {
   // Keep the review until the live deletion is committed. The repo lock is
   // acquired before rm; if add/commit fails, restore the exact capture and
   // clear the staged deletion so approval remains resumable.
+  let needsPush = false;
   if (liveRaw !== null) {
     await commitPathsWithMutation(liveRoot, [liveRel], `chore: promote ${captureId} -> ${dest}`, {
       mutate: () => fs.rmSync(safeJoin(liveRoot, liveRel)),
@@ -300,13 +319,31 @@ async function approvePromotion(liveRoot, curatedRoot, reviewPath, parsed) {
         try { await commitPaths(liveRoot, [telemetryPath], `chore: telemetry for promotion ${captureId}`); } catch { /* retry on next sync */ }
       }
     }
-  }
-  if (liveRaw !== null || authoritative?.cleanupCommitted === true) {
+    needsPush = true;
+  } else if (authoritative?.cleanupCommitted === true) {
+    needsPush = true;
+  }
+
+  return {
+    needsPush,
+    reviewPath,
+    captureId,
+    dest,
+    manifestPath: parsed._manifestPath ?? null,
+    promotionBinding: authoritative ? frontmatter.promotionBinding : null,
+  };
+}
+
+// Push (best-effort — a queued/failed push is retried later by sync()) and
+// clean up the review + local binding. Runs after the manifest lock (if any)
+// has been released, since nothing here touches manifest-guarded state.
+async function finalizePromotion({ liveRoot, needsPush, reviewPath, captureId, dest, manifestPath, promotionBinding }) {
+  if (needsPush) {
     const pushed = await push(liveRoot);
     if (pushed.queued) console.error("promote: live cleanup committed locally; push queued (run sync to retry)");
   }
   fs.rmSync(reviewPath, { force: true });
-  if (authoritative) deletePromotionBinding(parsed._manifestPath, frontmatter.promotionBinding);
+  if (manifestPath && promotionBinding) deletePromotionBinding(manifestPath, promotionBinding);
   console.log(`Promoted ${captureId} -> ${dest}`);
 }
 
diff --git a/packages/core/tests/profile-runtime-test.sh b/packages/core/tests/profile-runtime-test.sh
index 761700d..4518218 100755
--- a/packages/core/tests/profile-runtime-test.sh
+++ b/packages/core/tests/profile-runtime-test.sh
@@ -271,6 +271,57 @@ node "$core/promote.mjs" --manifest "$manifest" --profile work --approve "$revie
 [ -f "$tmpdir/curated/systems/profile-promotion.md" ] || fail "profile-aware promotion did not write curated target"
 [ ! -f "$live/captures/investigation/profile-tester--promotion-one.md" ] || fail "successful profile promotion did not clean live capture"
 
+# A slow network push must not keep the manifest lock. Once the local deletion
+# commit is durable, a profile edit can proceed while push is still in flight.
+cat > "$live/captures/investigation/profile-tester--lock-release.md" <<'EOF'
+---
+kind: investigation
+title: Lock release
+author: Profile Tester
+captured: 2026-07-29T00:00:00.000Z
+status: unreviewed
+---
+
+# Lock release
+
+## Fix {#fix}
+
+Do not hold the manifest lock during a slow push.
+EOF
+( cd "$live" && git add -A && git commit -qm "seed promotion lock release" && git push -q )
+node "$core/promote.mjs" --manifest "$manifest" --profile work --capture captures/investigation/profile-tester--lock-release --target-layer curated --dest systems/lock-release >/dev/null
+lock_release_review="$tmpdir/curated/_review/promotions/lock-release.md"
+cat > "$live/.git/hooks/pre-push" <<EOF
+#!/usr/bin/env sh
+: > "$tmpdir/promotion-push-started"
+while [ ! -f "$tmpdir/promotion-push-release" ]; do sleep 0.05; done
+EOF
+chmod +x "$live/.git/hooks/pre-push"
+( node "$core/promote.mjs" --manifest "$manifest" --profile work --approve "$lock_release_review" --target-layer curated >"$tmpdir/promotion-lock-release.out" 2>&1 ) &
+promotion_pid=$!
+for _ in {1..40}; do
+  [ -f "$tmpdir/promotion-push-started" ] && break
+  sleep 0.05
+done
+[ -f "$tmpdir/promotion-push-started" ] || fail "promotion did not reach its blocked push"
+( node "$core/profile-cli.mjs" map work "$tmpdir/project" --manifest "$manifest" >"$tmpdir/profile-map-during-push.out" 2>&1 && : > "$tmpdir/profile-map-during-push.complete" ) &
+map_pid=$!
+for _ in {1..40}; do
+  [ -f "$tmpdir/profile-map-during-push.complete" ] && break
+  sleep 0.05
+done
+if [ ! -f "$tmpdir/profile-map-during-push.complete" ]; then
+  : > "$tmpdir/promotion-push-release"
+  wait "$promotion_pid" || true
+  wait "$map_pid" || true
+  fail "slow promotion push kept the manifest lock" "$(cat "$tmpdir/profile-map-during-push.out")"
+fi
+: > "$tmpdir/promotion-push-release"
+wait "$promotion_pid" || fail "promotion failed after releasing blocked push" "$(cat "$tmpdir/promotion-lock-release.out")"
+wait "$map_pid" || fail "profile map failed during promotion push" "$(cat "$tmpdir/profile-map-during-push.out")"
+rm "$live/.git/hooks/pre-push"
+[ ! -f "$lock_release_review" ] || fail "lock-release promotion did not clear review"
+
 # A live-repo symlink must never turn promotion into a local file read.
 printf 'LOCAL-SECRET-MUST-NOT-BE-PROMOTED\n' > "$tmpdir/outside-promotion-secret.md"
 mkdir -p "$live/captures/investigation"