Every generated file's content hash is recorded. On any later run, a file you edited is left alone — always.
Fingerprints live in ai-project.config.json alongside the generator version that wrote them. This is the mechanism that makes add and upgrade safe to run against a project someone has already been working in.
add --replace needs to remove what the technology it is swapping out exclusively owned. Rather than tracking which builder wrote which file, it diffs the file set recorded at the previous generation against what the new selection produces — anything that vanishes is a deletion candidate, split by the same fingerprint check. Untouched is safe to delete; hand-edited blocks the entire replace, so nothing is deleted or written.
package.json and .env.example persist with correctly recomputed content, so they need no special case — just the normal flush.
After a replace, the tool walks up from each removed file's directory and removes it and any now-empty ancestor, up to but not including the project root. It only removes a directory it finds genuinely empty, so unrelated content is never touched.
Builders write into an in-memory tree. Disk is touched only after every builder has succeeded, so a failure partway through can never leave a half-written project.