qa/hooks/install.sh points core.hooksPath at qa/hooks, but the four
git-lfs hooks (post-checkout/post-commit/post-merge/pre-push) living
there were untracked. A fresh clone already gets working LFS hooks
auto-installed into .git/hooks by git-lfs itself during checkout --
running install.sh then SILENTLY switches the effective hooksPath away
from that working directory to one missing them, with zero warning.
Tracking these (stock, repo-agnostic git-lfs boilerplate, confirmed
byte-identical to what git-lfs generates) closes the regression: once
core.hooksPath points at qa/hooks, the LFS hooks are there too.

Ledger: ledgers/COLDSTART.md fix #1.

Decision Archie-da38: narrative beats stay authored in the object editor
(ADR-0005/ADR-0016 §56); the overview spine stays read-only. W11's round-trip
friction is fixed by navigation, not a second authoring surface — each spine
row now jumps to the editor at the beat's object with the Narrative panel
scrolled + highlighted on that section, and browser back returns to the
overview for free (an ordinary ADR-0024 place push, no new URL rung).

- App.svelte: openBeat(sectionId) — enters the editor and reuses
  navigateToSection's switchObject+focusSectionId to set the transient
  focus intent (ADR-0024 #1: selected panels/scroll are never in the URL).
- ExhibitOverview.svelte: spine rows call onopenbeat instead of onopenobject;
  a row whose beat object no longer exists (deleteObjectNotesAndMeta drops
  the object but doesn't prune orphaned sections) renders inert (ns-beat-gone)
  instead of linking to a dead target.
- NarrativeEditor.svelte: activeSectionId changes now scroll the target card
  into view, move focus to it (tabindex="-1" + aria-label, so screen readers
  announce it), and play a one-shot outline pulse (geometry, not just color)
  layered on the existing persistent .active border.

…hie-a911)

Durable shape for the section rev-log — the piece the probe explicitly did
not prove (PROBE-structure-revlog sharp edge 5).

- structure-serialize.ts: SectionRecord <-> on-disk JSON, both directions
  carry-sentinel guarded (rule #3). Composed SectionKey strips to the LOCAL
  id at the boundary (sharp edge 4); sectionKey() recomposes on read and
  stays the sole composer (re-asserts containment on untrusted on-disk ids).
- structure-persist.ts: history/{localId}.json pages + history/index.json,
  content pages FIRST / index LAST (rule #1 commit point). Per-page tolerant
  read (rule #2): corrupt page skips-and-reports (StructureCorruptError
  sibling); absent store (no dir / no committed index) reads empty, never
  corrupt, and torn pages never read as complete.
- 15 tests: full author->persist(MemoryFilesystem)->reload->project
  deep-equal vs never-persisted projection (creates, edits, kept tombstone,
  un-delete, resolved conflict, dangling ref); write-order instrument;
  torn-index; missing/torn/wrong-schema/hostile-id pages; per-item skip.

Gates: render-core vitest 901 passed (80 files); tsc --noEmit exit 0;
pnpm -r typecheck exit 0.

…e-aef4)

publishLibrary (and thus libraryToZipFs/libraryToZip and the folder writeTree
path — all sinks share the one projection) now accepts PublishOptions.getStructure
and, for each exhibit whose lookup returns a non-empty section rev-log, writes
{slug}/structure/history/{localId}.json + history/index.json via writeStructure —
the exact layout mergeImportedStructure (Archie-2a9a) reads, unlatching the
zip/folder import merge. Pages-first-index-LAST holds inside the emission (rule #1),
and archie.json stays the LAST write of the whole publish (order test-pinned).

Emission is driven by log EXISTENCE, deliberately NOT by the archie.structureRevlog
flag: a log only exists if the flag was ON while authoring, and a library that HAS
history must carry it regardless of the flag's current position. No log -> no
structure/ dir; the tree is byte-identical to the pre-aef4 output (test-pinned).

Studio wiring: openExhibitStructureDirIfExists (store.ts, non-creating probe — a
publish never grows an empty structure/ dir) + a getStructure closure passed to all
three publish call sites (memory projection / zip / folder), tolerant-read with a
corrupt-page advisory (rule #2).

Proof: two-author end-to-end round trip (A publishes zip with structure -> B with a
concurrent edit imports via openArchieLibrary + replaceProjectFrom -> 2 heads on the
touched section, projected conflicted) + viewer-tolerance pin (published tree with
structure renders identical to one without).

…ingest blocker (scale/ingest-batch)

Every imported object drove one whole-library.json rewrite (JSON.stringify of the
entire library, plus a read-first snapshotIfUnparseable) — a 100×100 collection
ingest paid ~10,000 sequential full-file rewrites, O(N²) cumulative bytes. This
was the #1 blocker for large ingests.

library-meta.svelte.ts:
- Add appendObjects(slug, objects[]) — the bulk sibling of appendObject, modeled
  on removeObjects/patchExhibits: fold N appends through appendObjmectIn into ONE
  meta mutation + ONE awaited persist + ONE `exhibit-assets` dirt. Empty batch is a
  no-op (identity preserved). No signalLibraryChanged (object-append isn't a
  library-STRUCTURE change), matching the singular appendObject.

ingest-flows.ts:
- Add a durable-append batch (beginBatch) with reserveId/add/flushIfFull/flush.
  Media byte-writes and seedMaster stay per object; only the library.json append
  coalesces. The view steers to the landed tail only AFTER its chunk is durable, so
  `current` never points at an object not yet in the reactive meta. reserveId mints
  ids against a running set (the meta isn't mutated until a flush, so nextObjectId
  would otherwise repeat).
- Convert importManifestObjects (manifest + collection), addFiles, and
  newExhibitFromFolder to the batch.
- Chunking decision: persist every 25 objects, NOT one flush at the very end. A
  single end flush is O(N) bytes but a crash mid-import loses the whole import;
  chunking bounds crash-loss to <25 objects (≈ the per-object durability the old
  code paid O(N²) for) while cutting rewrites 25×. A typical IIIF manifest (≤25
  canvases) is thus exactly ONE persist — the collection path's "1 per manifest"
  target — and only a pathologically large single manifest takes several. Every
  batch flush is awaited before the flow returns/navigates (durable-before-navigate);
  progress (setImportStatus) still ticks per object.
- Failure containment: newExhibitFromManifest now catches an exhibit-create throw
  and surfaces it via ctx.alert (the fetch/parse failure channel) — no unhandled
  rejection. importManifestObjects still lets a flush throw propagate so the
  collection drain catches it as fatal (unchanged skip/fatal/createdSlugs semantics).

Tests: pin persist-count (100-canvas manifest → 4 appendObjects, 0 appendObject;
100-file drop → 4; 60 → [25,25,10]; unique ids across the batch) and the
containment behavior; add appendObjects store tests. asset-queue.test.ts's inline
IngestContext mock gains appendObjects (mechanical — forced by the new API).

Gates: apps/studio pnpm typecheck clean; vitest 658/658 green.