docs: reconcile catalog run history and fleet state

PROJECT_STATE.md

@@ -66,13 +66,21 @@ Git and are supplied only through installation-local protected files.
 ## Database management
 
 The database, table, and authoritative physical-schema catalog slices are implemented. Database
-management opens a responsive AG Grid master-detail surface, lists every YAML workspace, creates
-at most one PostgreSQL database configuration per workspace, edits direct PostgreSQL, REST API, or
-SSH-tunnel installation bindings, replaces write-only encrypted secrets, and tests supported
-connector bindings.
+Management now opens the Fleet Ledger presentation by default inside `AppShell`, lists every YAML
+workspace, creates at most one PostgreSQL database configuration per workspace, edits direct
+PostgreSQL, REST API, or SSH-tunnel installation bindings, replaces write-only encrypted secrets,
+and tests supported connector bindings. The surface keeps one responsive AG Grid visible at a time:
+databases lead to tables, tables lead to columns, and relationships are a sibling database view.
+Parent navigation remains explicit through the breadcrumb and emphasized back control.
 
-Configured databases use pure hierarchical navigation through `Overview`, `Tables`, and
-`Relationships`; a selected table has `Overview` and `Columns`. Physical membership, source
+Selection-scoped operations use one action selector plus an explicit **Run** control; ineligible
+actions remain visible with their disabled reason, while row-scoped actions stay in the pinned final
+column. The KPI strip reads installation-wide or selected-database aggregates from
+`GET /catalog/metrics`. Database configuration, metadata editors, synchronization history,
+description history, and sensitive-field review/history use the production APIs in right-side
+drawers rather than prototype fixtures; closing a history drawer does not stop its background run.
+
+Physical membership, source
 comments, column types/default/nullability/PK positions, and constraint-level ordered FK pairs are
 projections of the external schema. They cannot be created, renamed, or structurally edited by
 hand, but administrators can explicitly clear catalog tables, columns, or relationships without
@@ -82,6 +90,12 @@ relationships. Curated and generated descriptions are editable; generated descri
 and Database Management can generate or consolidate them for selected tables, selected columns,
 all targets, or only targets whose Generated Description is missing.
 
+The previous Database Management renderer remains a temporary comparison fallback for development
+and staging only: `?db-ui=legacy` is honored in Vite development or when
+`VITE_DB_MANAGEMENT_LEGACY=true`; it is not a production presentation. The standalone Fleet Ledger
+prototype on port `5173` also remains temporary until owner acceptance of the integrated surface,
+after which both migration aids can be removed.
+
 Schema refresh is one durable asynchronous engine with database-table, database-column,
 selected-table-column, relationship, and full-database actions. Database-level menus expose the
 table, all-column, relationship, and full scopes separately; selecting tables exposes column
@@ -115,6 +129,10 @@ only on structural metadata for one selected database, selected tables, or selec
 backend divides large scopes into deterministic model requests of at most ten columns, also bounded
 by helper message size, and combines their results, but the proposal remains an unsaved draft until
 the human reviews and saves it.
+Each started suggestion attempt records a separate Sensitive Data Suggestion Run with aggregate
+counters and safe ordered events. This operational history never stores per-column proposals,
+prompts, raw model output, or provider diagnostics; reloading still discards an unsaved review
+draft.
 For unprotected columns, up to five source rows and five representative non-null values may be sent
 transiently to the configured model provider. Protected columns are omitted from source reads and
 replaced in the prompt by deterministic plausible values derived only from their metadata. Existing