diff --git a/packaging/appimage/Containerfile.debian b/packaging/appimage/Containerfile.debian
index 933f0c42..0896c4fe 100644
--- a/packaging/appimage/Containerfile.debian
+++ b/packaging/appimage/Containerfile.debian
@@ -48,6 +48,10 @@ RUN node --version \
     && test "$yarn_version" = 1.22.22 \
     && echo "yarn $yarn_version"
 
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends lld \
+    && rm -rf /var/lib/apt/lists/*
+
 COPY container-build-debian.sh /usr/local/bin/build-komp-ac-debian
 RUN chmod 755 /usr/local/bin/build-komp-ac-debian
 
diff --git a/packaging/appimage/README.md b/packaging/appimage/README.md
index 27dd676e..e172f37f 100644
--- a/packaging/appimage/README.md
+++ b/packaging/appimage/README.md
@@ -59,7 +59,15 @@ The host source is mounted read-only and copied into the temporary container.
 Cargo and Yarn caches use named Podman volumes, so neither Cargo target files
 nor frontend dependencies are written into the repository. The source snapshot
 excludes build outputs, local environment files and generated runtime data such
-as Tantivy indexes, dumps and embedded PostgreSQL data.
+as Tantivy indexes, dumps and embedded PostgreSQL data. It also omits profiling
+captures, benchmark and mutation reports, old AppImages, frontend caches, logs,
+and local editor or agent state. Cargo configuration, SQLx offline metadata,
+migrations and all crate/frontend source inputs remain in the snapshot. The
+container validates the completed snapshot and stops before compilation if a
+known runtime, cache or private-data path survived the exclusions. Top-level
+copying is allowlisted to workspace manifests, required crates, `client-gui2`
+and the packaging layer, so unrelated future repository directories are omitted
+by default.
 
 The server feature is a required argument. Nothing implicitly chooses the
 database implementation:
diff --git a/packaging/appimage/container-build-debian.sh b/packaging/appimage/container-build-debian.sh
index d0dc61cf..3e2f7641 100755
--- a/packaging/appimage/container-build-debian.sh
+++ b/packaging/appimage/container-build-debian.sh
@@ -37,19 +37,91 @@ tar \
     --exclude='*/.direnv' \
     --exclude='./.env' \
     --exclude='*/.env' \
+    --exclude='./.env.*' \
+    --exclude='*/.env.*' \
+    --exclude='./.env_*' \
+    --exclude='*/.env_*' \
+    --exclude='*/.envrc' \
+    --exclude='*/.agents' \
+    --exclude='*/.claude' \
+    --exclude='*/.codex' \
+    --exclude='*/.codex-scheduled' \
+    --exclude='*/.forge' \
+    --exclude='*/.opencode' \
+    --exclude='*/.idea' \
+    --exclude='*/.vscode' \
+    --exclude='./.aider*' \
     --exclude='*/tantivy_indexes' \
     --exclude='*/dumps' \
     --exclude='*/.postgres-data' \
     --exclude='*/benchmark-results' \
     --exclude='*/.mutants-run' \
+    --exclude='./mutants*' \
+    --exclude='*/metrics_output' \
+    --exclude='*/metrics.json' \
+    --exclude='*/perf.data*' \
+    --exclude='*/flamegraph.svg' \
     --exclude='*/__pycache__' \
-    --exclude='./client-gui2/node_modules' \
+    --exclude='*/node_modules' \
     --exclude='./client-gui2/dist' \
+    --exclude='./client-gui2/dist-ssr' \
+    --exclude='./client-gui2/coverage' \
+    --exclude='./client-gui2/.vite' \
+    --exclude='./client-gui2/src-tauri/gen/schemas' \
+    --exclude='./client-gui2/scripts' \
+    --exclude='*.tsbuildinfo' \
+    --exclude='*.log' \
+    --exclude='*.swp' \
+    --exclude='*.swo' \
+    --exclude='*~' \
+    --exclude='*.local' \
+    --exclude='./server/docs-prod' \
+    --exclude='./testing' \
+    --exclude='./run_bins' \
+    --exclude='./corporate_erp' \
     --exclude='./debian-dist' \
     --exclude='./result' \
-    -C /source -cf - . \
+    --exclude='./result-*' \
+    -C /source -cf - \
+        Cargo.toml \
+        Cargo.lock \
+        .cargo \
+        .sqlx \
+        client \
+        client-gui2 \
+        common \
+        komp-app \
+        packaging \
+        search \
+        server \
+        tui-canvas \
+        tui-pages \
+        web \
     | tar -C "$source_root" -xf -
 
+unexpected_snapshot_path="$(find "$source_root" \
+    \( \
+        -name target -o \
+        -name node_modules -o \
+        -name tantivy_indexes -o \
+        -name dumps -o \
+        -name .postgres-data -o \
+        -name .direnv -o \
+        -name .env -o \
+        -name '.env.*' -o \
+        -name '.env_*' -o \
+        -name .envrc -o \
+        -name benchmark-results -o \
+        -name metrics_output -o \
+        -name 'perf.data*' \
+    \) \
+    -print -quit)"
+if [[ -n "$unexpected_snapshot_path" ]]; then
+    echo "Generated or private data entered the production snapshot: $unexpected_snapshot_path" >&2
+    exit 1
+fi
+echo "Source snapshot size: $(du -sh "$source_root" | cut -f1)"
+
 cd "$source_root/client-gui2"
 echo "+ yarn install --frozen-lockfile --non-interactive"
 yarn install --frozen-lockfile --non-interactive
@@ -78,6 +150,16 @@ fi
 install -Dm755 "$server_binary" /out/bin/server
 
 cd "$source_root/client-gui2"
+appimage_bundle_dir=/cargo-target/release/bundle/appimage
+case "$appimage_bundle_dir" in
+    /cargo-target/release/bundle/appimage)
+        rm -rf -- "$appimage_bundle_dir"
+        ;;
+    *)
+        echo "Refusing to clear unexpected AppImage staging path: $appimage_bundle_dir" >&2
+        exit 1
+        ;;
+esac
 echo "+ yarn tauri build --bundles appimage"
 set +e
 APPIMAGE_EXTRACT_AND_RUN=1 \
@@ -87,7 +169,7 @@ tauri_status=$?
 set -e
 
 shopt -s nullglob
-gui_appimages=(/cargo-target/release/bundle/appimage/*.AppImage)
+gui_appimages=("$appimage_bundle_dir"/*.AppImage)
 gui_bundle=""
 if [[ $tauri_status -eq 0 && ${#gui_appimages[@]} -gt 0 ]]; then
     gui_bundle="${gui_appimages[0]}"
@@ -99,7 +181,7 @@ if [[ $tauri_status -eq 0 && ${#gui_appimages[@]} -gt 0 ]]; then
 fi
 
 if [[ -z "$gui_bundle" ]]; then
-    gui_appdir=/cargo-target/release/bundle/appimage/komp_ac.AppDir
+    gui_appdir="$appimage_bundle_dir/komp_ac.AppDir"
     if [[ -d "$gui_appdir" ]] \
         && cmp -s /cargo-target/release/client-gui2 "$gui_appdir/usr/bin/client-gui2"; then
         gui_bundle="$gui_appdir"