CI red on main: "Check renderer architecture" fails from a stale renderer-architecture ledger #4250

What happened

Every push to main since #4088 fails CI on the test job → "Check renderer architecture" step (e.g. run for 563452d80 #4088, and 8c491e64b #3741). The step runs apps/desktop/scripts/check-renderer-architecture.mjs --base <BASE_SHA> and reports the committed ledger apps/desktop/renderer-architecture.json no longer matching the renderer source tree:

Renderer architecture check failed:
- legacy AppShell transitive renderer closure changed; expected [...] received [...]
- src/renderer/app-shell.tsx: dependencyPaths changed; ...
- unclassified legacy renderer file set changed; ...

Root cause. #4088 introduced the ledger, but generated it on a branch that predated the session-collaboration feature (#4196 / #4198) already merged into main. So the committed ledger omits those files/graph entries (session-collaboration-dialog.tsx, use-session-collaboration-dialog.ts, locales/session-collaboration-copy.ts, session-turn-request-composer.tsx, plus the wiring into app-shell.tsx, runtime-host-profiles-section.tsx, workhub-coordination-lifecycle.ts) while the tree contains them.

Why it can't be fixed by regenerating the ledger alone. Regenerating fixes the snapshot check, but the monotonic-debt ratchet then fails: it compares the committed ledger against the base commit's committed ledger, and that base ledger under-reports its own tree. Recording the already-present debt looks like brand-new debt (new unclassified renderer source files are forbidden, new dependency debt ..., 25 violations). Because CI's BASE_SHA always carries the stale ledger, no forward commit can record the missing entries — the ledger is wedged.

How to reproduce

1. Check out main (any commit at/after 563452d80).
2. cd apps/desktop && node scripts/check-renderer-architecture.mjs --base <previous main commit>
3. Observe the check fail with the "changed; expected/received" mismatches above. Regenerating with --write then re-running --base swaps them for ~25 "debt increased / forbidden" ratchet violations.

Environment

• Maka commit: 8c491e64b (main), also 563452d80 (refactor(desktop): lock renderer root architecture #4088)
• OS: CI Ubuntu runner (also reproduces locally on macOS)
• Surface: Desktop (apps/desktop)
• Node.js: repo toolchain

Logs, screenshots, or additional context

The ratchet compares base ledger vs current ledger; the design assumes the base ledger is consistent with the base tree, which #4088's baseline is not. Fix in progress: derive the ratchet floor from the base commit's actual source tree (detached git worktree) instead of trusting the base ledger, and regenerate the ledger to record the session-collaboration surface.