@askexenow/exe-os 0.9.340 → 0.9.342

package/dist/{chunk-HEPR6QTL.js → chunk-AOHXREB7.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-2I23RPSI.js";
 import {
   listBackups
-} from "./chunk-ATOU6CYR.js";
+} from "./chunk-OLMQ4UOF.js";
 import {
   getEmotionalBaseline,
   renderEmotionalBaselineSection
@@ -20,16 +20,108 @@ import {
 import {
   EXE_AI_DIR,
   loadConfigSync
-} from "./chunk-7Y5UDEVM.js";
+} from "./chunk-WZHZCDDO.js";
 import {
   atomicWriteJson
-} from "./chunk-SHIICYJW.js";
+} from "./chunk-BYTDMAGB.js";
 
 // src/lib/database.ts
-import { chmodSync, existsSync as existsSync3, statSync, copyFileSync, unlinkSync as unlinkSync2, openSync, closeSync, mkdirSync as mkdirSync2, renameSync as renameSync2, readFileSync as readFileSync3, writeSync, fsyncSync, fstatSync } from "fs";
+import { chmodSync, existsSync as existsSync4, statSync, copyFileSync, unlinkSync as unlinkSync3, openSync as openSync2, closeSync as closeSync2, mkdirSync as mkdirSync2, renameSync as renameSync2, readFileSync as readFileSync3, writeSync, fsyncSync, fstatSync } from "fs";
 import { createClient } from "@libsql/client";
 import { homedir, totalmem } from "os";
-import { join } from "path";
+import { join, dirname } from "path";
+
+// src/lib/legacy-db-cleanup.ts
+import { existsSync, lstatSync, openSync, readSync, closeSync, unlinkSync } from "fs";
+import path from "path";
+var SQLITE_PLAINTEXT_MAGIC = "SQLite format 3\0";
+var LEGACY_MAIN_STUBS = [
+  "db.sqlite",
+  "db.sqlite3",
+  "db",
+  "db.sqlite.corrupted"
+];
+var SIDECAR_PARENT = "db.sqlite";
+var LEGACY_SIDECARS = [
+  "db.sqlite-wal",
+  "db.sqlite-shm",
+  "db.sqlite-journal"
+];
+var PROTECTED_DB_NAMES = [
+  "memories.db",
+  "exe-mem.db",
+  "exe-os.db",
+  "exe.db"
+];
+function isPlaintextSqlite(filePath) {
+  let fd = -1;
+  try {
+    fd = openSync(filePath, "r");
+    const buf = Buffer.alloc(16);
+    const read = readSync(fd, buf, 0, 16, 0);
+    if (read < 16) return false;
+    return buf.toString("latin1") === SQLITE_PLAINTEXT_MAGIC;
+  } catch {
+    return false;
+  } finally {
+    if (fd >= 0) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
+function inspect(filePath) {
+  try {
+    const st = lstatSync(filePath);
+    if (st.isSymbolicLink() || !st.isFile()) return { removable: false, size: -1 };
+    return { removable: true, size: st.size };
+  } catch {
+    return { removable: false, size: -1 };
+  }
+}
+function cleanupLegacyPlaintextStubs(dir, activeDbPath) {
+  const removed = [];
+  const activeBase = activeDbPath ? path.basename(activeDbPath) : null;
+  const skip = (name) => name === activeBase || PROTECTED_DB_NAMES.includes(name);
+  for (const name of LEGACY_MAIN_STUBS) {
+    if (skip(name)) continue;
+    const filePath = path.join(dir, name);
+    try {
+      const { removable, size } = inspect(filePath);
+      if (!removable) continue;
+      if (size === 0 || isPlaintextSqlite(filePath)) {
+        unlinkSync(filePath);
+        removed.push(filePath);
+      }
+    } catch {
+    }
+  }
+  const parentPath = path.join(dir, SIDECAR_PARENT);
+  const parentRemoved = removed.some((p) => path.basename(p) === SIDECAR_PARENT);
+  const parentGone = parentRemoved || !existsSync(parentPath);
+  if (parentGone) {
+    for (const name of LEGACY_SIDECARS) {
+      if (skip(name)) continue;
+      const filePath = path.join(dir, name);
+      try {
+        const { removable } = inspect(filePath);
+        if (!removable) continue;
+        unlinkSync(filePath);
+        removed.push(filePath);
+      } catch {
+      }
+    }
+  }
+  if (removed.length > 0) {
+    process.stderr.write(
+      `[exe-os] Removed ${removed.length} legacy plaintext SQLite stub(s) from ${dir}: ${removed.map((p) => path.basename(p)).join(", ")}
+`
+    );
+  }
+  return removed;
+}
 
 // src/lib/db-retry.ts
 var MAX_RETRIES = 5;
@@ -82,24 +174,24 @@ function wrapWithRetry(client) {
 
 // src/lib/employees.ts
 import { readFile, mkdir } from "fs/promises";
-import { existsSync as existsSync2, symlinkSync, readlinkSync, readFileSync as readFileSync2, renameSync, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, lstatSync as lstatSync2, symlinkSync, readlinkSync, readFileSync as readFileSync2, renameSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
 import { execSync } from "child_process";
-import path2 from "path";
+import path3 from "path";
 import os from "os";
 
 // src/lib/identity.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { readdirSync } from "fs";
-import path from "path";
+import path2 from "path";
 import { createHash } from "crypto";
-var IDENTITY_DIR = path.join(EXE_AI_DIR, "identity");
+var IDENTITY_DIR = path2.join(EXE_AI_DIR, "identity");
 function ensureDir() {
-  if (!existsSync(IDENTITY_DIR)) {
+  if (!existsSync2(IDENTITY_DIR)) {
     mkdirSync(IDENTITY_DIR, { recursive: true });
   }
 }
 function identityPath(agentId) {
-  return path.join(IDENTITY_DIR, `${agentId}.md`);
+  return path2.join(IDENTITY_DIR, `${agentId}.md`);
 }
 function sanitizeIdentityBody(body) {
   return body.replace(/<!--[\s\S]*?-->/g, "").trim();
@@ -147,7 +239,7 @@ function contentHash(content) {
 }
 function getIdentity(agentId) {
   const filePath = identityPath(agentId);
-  if (!existsSync(filePath)) return null;
+  if (!existsSync2(filePath)) return null;
   const raw = readFileSync(filePath, "utf-8");
   const { frontmatter, body } = parseFrontmatter(raw);
   return {
@@ -231,7 +323,7 @@ ${teamLines.join("\n")}`);
 }
 
 // src/lib/employees.ts
-var EMPLOYEES_PATH = path2.join(EXE_AI_DIR, "exe-employees.json");
+var EMPLOYEES_PATH = path3.join(EXE_AI_DIR, "exe-employees.json");
 var DEFAULT_BOOT_TIMEOUT_MS = 45e3;
 var DEFAULT_COORDINATOR_TEMPLATE_NAME = "exe";
 var COORDINATOR_ROLE = "COO";
@@ -271,13 +363,40 @@ var MANAGER_ROLES = /* @__PURE__ */ new Map([
   ["cmo", /* @__PURE__ */ new Set(["content production specialist", "specialist"])],
   ["gm", /* @__PURE__ */ new Set(["specialist"])]
 ]);
+function isManagementRole(role) {
+  return isCoordinatorRole(role) || MANAGER_ROLES.has(normalizeRole(role));
+}
+function isManagementIdentity(agentId, employees = loadEmployeesSync()) {
+  if (!agentId) return false;
+  if (agentId === "default") return true;
+  const base = baseAgentName(agentId, employees);
+  const emp = getEmployee(employees, base);
+  return isManagementRole(emp?.role);
+}
+var _authzUnenforcedWarned = false;
+function warnAuthzUnenforcedOnce() {
+  if (_authzUnenforcedWarned) return;
+  _authzUnenforcedWarned = true;
+  console.warn(
+    "[employees] chain-of-command authz is UNENFORCED: no roster configured (exe-employees.json missing/empty). Cross-agent writes are permitted. Configure a roster to enforce the chain of command."
+  );
+}
 function canManage(callerName, callerRole, targetName, employees = loadEmployeesSync()) {
-  if (canCoordinate(callerName, callerRole, employees)) return true;
+  void callerRole;
+  if (callerName === "default") return true;
+  if (employees.length === 0) {
+    warnAuthzUnenforcedOnce();
+    return true;
+  }
+  const callerBase = baseAgentName(callerName ?? "", employees);
+  const callerEmp = getEmployee(employees, callerBase);
+  if (!callerEmp) return false;
+  const effectiveCallerRole = callerEmp.role;
+  if (isCoordinatorRole(effectiveCallerRole)) return true;
   const targetBase = baseAgentName(targetName, employees);
   const targetEmp = getEmployee(employees, targetBase);
   if (!targetEmp) return false;
-  const normalizedCallerRole = normalizeRole(callerRole);
-  const allowedSubordinates = MANAGER_ROLES.get(normalizedCallerRole);
+  const allowedSubordinates = MANAGER_ROLES.get(normalizeRole(effectiveCallerRole));
   if (!allowedSubordinates) return false;
   return allowedSubordinates.has(normalizeRole(targetEmp.role));
 }
@@ -299,7 +418,7 @@ function validateEmployeeName(name) {
   return { valid: true };
 }
 async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync2(employeesPath)) {
+  if (!existsSync3(employeesPath)) {
     return [];
   }
   const raw = await readFile(employeesPath, "utf-8");
@@ -310,17 +429,36 @@ async function loadEmployees(employeesPath = EMPLOYEES_PATH) {
   }
 }
 async function saveEmployees(employees, employeesPath = EMPLOYEES_PATH) {
-  await mkdir(path2.dirname(employeesPath), { recursive: true });
+  await mkdir(path3.dirname(employeesPath), { recursive: true });
   await atomicWriteJson(employeesPath, employees);
 }
-function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
-  if (!existsSync2(employeesPath)) return [];
+function loadEmployeesState(employeesPath = EMPLOYEES_PATH) {
+  let raw;
   try {
-    return JSON.parse(readFileSync2(employeesPath, "utf-8"));
+    raw = readFileSync2(employeesPath, "utf-8");
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOENT") {
+      try {
+        lstatSync2(employeesPath);
+        return { employees: [], status: "error" };
+      } catch {
+        return { employees: [], status: "missing" };
+      }
+    }
+    return { employees: [], status: "error" };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return { employees: [], status: "error" };
+    return { employees: parsed, status: "ok" };
   } catch {
-    return [];
+    return { employees: [], status: "error" };
   }
 }
+function loadEmployeesSync(employeesPath = EMPLOYEES_PATH) {
+  return loadEmployeesState(employeesPath).employees;
+}
 function getEmployee(employees, name) {
   return employees.find((e) => e.name.toLowerCase() === name.toLowerCase());
 }
@@ -340,8 +478,9 @@ function hasRole(agentName, role) {
 function baseAgentName(name, employees) {
   const match = name.match(/^([a-zA-Z]+)\d+$/);
   if (!match) return name;
-  const base = match[1];
   const roster = employees ?? loadEmployeesSync();
+  if (getEmployee(roster, name)) return name;
+  const base = match[1];
   if (getEmployee(roster, base)) return base;
   return name;
 }
@@ -380,13 +519,13 @@ function addEmployee(employees, employee) {
   }
   return [...employees, normalized];
 }
-var IDENTITY_DIR2 = path2.join(EXE_AI_DIR, "identity");
+var IDENTITY_DIR2 = path3.join(EXE_AI_DIR, "identity");
 var TEAM_SECTION_RE = /^## Team\b.*$/m;
 function appendToCoordinatorTeam(employee) {
   const coordinator = getCoordinatorEmployee(loadEmployeesSync());
   if (!coordinator) return;
-  const idPath = path2.join(IDENTITY_DIR2, `${coordinator.name}.md`);
-  if (!existsSync2(idPath)) return;
+  const idPath = path3.join(IDENTITY_DIR2, `${coordinator.name}.md`);
+  if (!existsSync3(idPath)) return;
   const content = readFileSync2(idPath, "utf-8");
   if (content.includes(`**${capitalize(employee.name)}`)) return;
   const teamMatch = content.match(TEAM_SECTION_RE);
@@ -437,16 +576,16 @@ async function normalizeRosterCase(rosterPath) {
       emp.name = emp.name.toLowerCase();
       changed = true;
       try {
-        const identityDir = path2.join(os.homedir(), ".exe-os", "identity");
-        const oldPath = path2.join(identityDir, `${oldName}.md`);
-        const newPath = path2.join(identityDir, `${emp.name}.md`);
-        if (existsSync2(oldPath) && !existsSync2(newPath)) {
+        const identityDir = path3.join(os.homedir(), ".exe-os", "identity");
+        const oldPath = path3.join(identityDir, `${oldName}.md`);
+        const newPath = path3.join(identityDir, `${emp.name}.md`);
+        if (existsSync3(oldPath) && !existsSync3(newPath)) {
           renameSync(oldPath, newPath);
-        } else if (existsSync2(oldPath) && oldPath !== newPath) {
+        } else if (existsSync3(oldPath) && oldPath !== newPath) {
           const content = readFileSync2(oldPath, "utf-8");
           writeFileSync2(newPath, content, "utf-8");
           if (oldPath.toLowerCase() !== newPath.toLowerCase()) {
-            unlinkSync(oldPath);
+            unlinkSync2(oldPath);
           }
         }
       } catch {
@@ -474,7 +613,7 @@ function registerBinSymlinks(name) {
     errors.push("Could not find 'exe-os' in PATH");
     return { created, skipped, errors };
   }
-  const binDir = path2.dirname(exeBinPath);
+  const binDir = path3.dirname(exeBinPath);
   let target;
   try {
     target = readlinkSync(exeBinPath);
@@ -484,8 +623,8 @@ function registerBinSymlinks(name) {
   }
   for (const suffix of ["", "-opencode"]) {
     const linkName = `${name}${suffix}`;
-    const linkPath = path2.join(binDir, linkName);
-    if (existsSync2(linkPath)) {
+    const linkPath = path3.join(binDir, linkName);
+    if (existsSync3(linkPath)) {
       skipped.push(linkName);
       continue;
     }
@@ -501,7 +640,7 @@ function registerBinSymlinks(name) {
 
 // src/lib/database-adapter.ts
 import os2 from "os";
-import path3 from "path";
+import path4 from "path";
 import { createRequire } from "module";
 import { pathToFileURL } from "url";
 var VIEW_MAPPINGS = [
@@ -865,8 +1004,8 @@ async function loadPrismaClient() {
         }
         return new PrismaClient2();
       }
-      const exeDbRoot = process.env.EXE_DB_ROOT ?? path3.join(os2.homedir(), "exe-db");
-      const requireFromExeDb = createRequire(path3.join(exeDbRoot, "package.json"));
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path4.join(os2.homedir(), "exe-db");
+      const requireFromExeDb = createRequire(path4.join(exeDbRoot, "package.json"));
       const prismaEntry = requireFromExeDb.resolve("@prisma/client");
       const module = await import(pathToFileURL(prismaEntry).href);
       const PrismaClient = module.PrismaClient ?? module.default?.PrismaClient;
@@ -1113,13 +1252,25 @@ async function executeAddColumn(client, sql, context = "migration add column") {
     return false;
   }
 }
+async function ensureIdempotencyKeyMigration(client) {
+  await executeAddColumn(
+    client,
+    `ALTER TABLE tasks ADD COLUMN idempotency_key TEXT`,
+    "migration add tasks.idempotency_key"
+  );
+  await client.execute(
+    `CREATE UNIQUE INDEX IF NOT EXISTS idx_tasks_idempotency_key
+       ON tasks(idempotency_key)
+       WHERE idempotency_key IS NOT NULL`
+  );
+}
 async function migrateReflectionDedup(client) {
   const added = await executeAddColumn(
     client,
     "ALTER TABLE memory_reflections ADD COLUMN dedup_key TEXT",
     "migration add memory_reflections.dedup_key"
   );
-  const { reflectionDedupKey } = await import("./memory-reflection-6N4J2FL7.js");
+  const { reflectionDedupKey } = await import("./memory-reflection-WVNFBJAA.js");
   const keyForRow = (row) => {
     let sources = [];
     try {
@@ -1233,7 +1384,7 @@ function pidIsAlive(pid) {
   }
 }
 function tryTakeLock(lockPath) {
-  _lockFd = openSync(lockPath, "wx");
+  _lockFd = openSync2(lockPath, "wx");
   try {
     writeSync(_lockFd, `${process.pid}
 `);
@@ -1244,6 +1395,18 @@ function tryTakeLock(lockPath) {
     logCatchDebug("lock pid write", e);
   }
 }
+function isDbLockHeldByLiveProcess() {
+  try {
+    const lockPath = dbLockPath();
+    if (!existsSync4(lockPath)) return false;
+    const holderPid = readLockHolderPid(lockPath);
+    if (holderPid === null) return false;
+    if (holderPid === process.pid) return false;
+    return pidIsAlive(holderPid);
+  } catch {
+    return false;
+  }
+}
 async function acquireDbLock(options = {}) {
   const lockPath = dbLockPath();
   const waitMs = options.waitMs ?? dbLockWaitMs();
@@ -1281,7 +1444,7 @@ async function acquireDbLock(options = {}) {
 `
       );
       try {
-        unlinkSync2(lockPath);
+        unlinkSync3(lockPath);
       } catch (e) {
         logCatchDebug("stale lock unlink", e);
       }
@@ -1313,7 +1476,7 @@ function releaseDbLock() {
   if (_lockFd !== null) {
     const identity = _lockIdentity;
     try {
-      closeSync(_lockFd);
+      closeSync2(_lockFd);
     } catch (e) {
       logCatchDebug("lock close", e);
     }
@@ -1323,7 +1486,7 @@ function releaseDbLock() {
       const lockPath = identity?.path ?? dbLockPath();
       const st = statSync(lockPath);
       if (!identity || st.dev === identity.dev && st.ino === identity.ino) {
-        unlinkSync2(lockPath);
+        unlinkSync3(lockPath);
       }
     } catch (e) {
       logCatchDebug("lock unlink", e);
@@ -1376,7 +1539,7 @@ async function _attemptBackupRestore(config) {
     renameSync2(config.dbPath, corruptPath);
     for (const suffix of ["-wal", "-shm"]) {
       const sidePath = config.dbPath + suffix;
-      if (existsSync3(sidePath)) {
+      if (existsSync4(sidePath)) {
         try {
           renameSync2(sidePath, corruptPath + suffix);
         } catch {
@@ -1402,7 +1565,7 @@ async function _attemptBackupRestore(config) {
     try {
       copyFileSync(backup.path, config.dbPath);
       const backupWal = backup.path + "-wal";
-      if (existsSync3(backupWal)) {
+      if (existsSync4(backupWal)) {
         copyFileSync(backupWal, config.dbPath + "-wal");
       }
       const opts = {
@@ -1418,15 +1581,15 @@ async function _attemptBackupRestore(config) {
       if (isCorrupt) {
         testClient.close();
         try {
-          unlinkSync2(config.dbPath);
+          unlinkSync3(config.dbPath);
         } catch {
         }
         try {
-          unlinkSync2(config.dbPath + "-wal");
+          unlinkSync3(config.dbPath + "-wal");
         } catch {
         }
         try {
-          unlinkSync2(config.dbPath + "-shm");
+          unlinkSync3(config.dbPath + "-shm");
         } catch {
         }
         process.stderr.write(
@@ -1447,7 +1610,7 @@ async function _attemptBackupRestore(config) {
 `
       );
       try {
-        const { recordDbRestoreEvent } = await import("./db-restore-events-JVEEP52Z.js");
+        const { recordDbRestoreEvent } = await import("./db-restore-events-MQ2DBGEQ.js");
         recordDbRestoreEvent({
           kind: "auto-restore",
           restoredFrom: backup.name,
@@ -1459,7 +1622,7 @@ async function _attemptBackupRestore(config) {
       } catch {
       }
       try {
-        const { pruneCorruptQuarantine } = await import("./db-backup-DLD4QZBO.js");
+        const { pruneCorruptQuarantine } = await import("./db-backup-W2QFSYQC.js");
         pruneCorruptQuarantine();
       } catch {
       }
@@ -1470,15 +1633,15 @@ async function _attemptBackupRestore(config) {
 `
       );
       try {
-        unlinkSync2(config.dbPath);
+        unlinkSync3(config.dbPath);
       } catch {
       }
       try {
-        unlinkSync2(config.dbPath + "-wal");
+        unlinkSync3(config.dbPath + "-wal");
       } catch {
       }
       try {
-        unlinkSync2(config.dbPath + "-shm");
+        unlinkSync3(config.dbPath + "-shm");
       } catch {
       }
       continue;
@@ -1490,7 +1653,7 @@ async function _attemptBackupRestore(config) {
 `
   );
   try {
-    const { recordDbRestoreEvent } = await import("./db-restore-events-JVEEP52Z.js");
+    const { recordDbRestoreEvent } = await import("./db-restore-events-MQ2DBGEQ.js");
     recordDbRestoreEvent({
       kind: "restore-failed",
       quarantinePath: corruptPath,
@@ -1570,21 +1733,25 @@ async function optimizeFtsIndexes(client = getRawClient(), pages = FTS_MERGE_PAG
 var initTurso = initDatabase;
 async function initDatabase(config) {
   assertValidDbPath(config?.dbPath, "initDatabase");
+  try {
+    cleanupLegacyPlaintextStubs(dirname(config.dbPath), config.dbPath);
+  } catch {
+  }
   await acquireDbLock();
-  if (existsSync3(config.dbPath)) {
+  if (existsSync4(config.dbPath)) {
     const dbStat = statSync(config.dbPath);
     if (dbStat.size === 0) {
       const walPath = config.dbPath + "-wal";
-      if (existsSync3(walPath) && statSync(walPath).size > 0) {
+      if (existsSync4(walPath) && statSync(walPath).size > 0) {
         const backupPath = config.dbPath + ".zeroed-" + Date.now();
         copyFileSync(config.dbPath, backupPath);
-        unlinkSync2(config.dbPath);
+        unlinkSync3(config.dbPath);
         process.stderr.write(
           `[database] CRITICAL: DB was 0 bytes. Moved to ${backupPath}, attempting WAL recovery.
 `
         );
         try {
-          const { recordDbRestoreEvent } = await import("./db-restore-events-JVEEP52Z.js");
+          const { recordDbRestoreEvent } = await import("./db-restore-events-MQ2DBGEQ.js");
           recordDbRestoreEvent({
             kind: "wal-recovery",
             quarantinePath: backupPath,
@@ -1598,7 +1765,7 @@ async function initDatabase(config) {
 `
         );
         try {
-          const { recordDbRestoreEvent } = await import("./db-restore-events-JVEEP52Z.js");
+          const { recordDbRestoreEvent } = await import("./db-restore-events-MQ2DBGEQ.js");
           recordDbRestoreEvent({
             kind: "zeroed-no-wal",
             detail: "DB was 0 bytes at startup with no WAL available \u2014 data may be lost"
@@ -1865,7 +2032,7 @@ function getRawClient() {
 function tryGetRawClient() {
   return _client;
 }
-var CURRENT_SCHEMA_VERSION = 10;
+var CURRENT_SCHEMA_VERSION = 17;
 var _migrationBlockRuns = 0;
 function _getMigrationBlockRuns() {
   return _migrationBlockRuns;
@@ -1897,6 +2064,23 @@ async function ensureSchema() {
       await client.execute("PRAGMA libsql_vector_search_ef = 128");
     } catch {
     }
+    try {
+      const idxProbe = await client.execute({
+        sql: "SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?",
+        args: ["idx_tasks_idempotency_key"]
+      });
+      if (idxProbe.rows.length === 0) {
+        process.stderr.write(
+          "[database] repairing missing idx_tasks_idempotency_key on already-current DB (bug c06a8803)\n"
+        );
+        await ensureIdempotencyKeyMigration(client);
+      }
+    } catch (e) {
+      process.stderr.write(
+        `[database] idempotency index repair check failed: ${e instanceof Error ? e.message : String(e)}
+`
+      );
+    }
     return;
   }
   _migrationBlockRuns++;
@@ -1969,6 +2153,9 @@ async function ensureSchema() {
   }
   await executeAddColumn(client, "ALTER TABLE memories ADD COLUMN embedding_model TEXT", "migration add memories.embedding_model");
   await client.execute("CREATE INDEX IF NOT EXISTS idx_memories_embedding_model ON memories(embedding_model)");
+  await client.execute(
+    "CREATE INDEX IF NOT EXISTS idx_memories_null_vector ON memories(id) WHERE vector IS NULL"
+  );
   let needsFtsMigration = false;
   try {
     const ftsCheck = await client.execute(
@@ -2073,6 +2260,12 @@ async function ensureSchema() {
 
     CREATE INDEX IF NOT EXISTS idx_tasks_assignee_status
       ON tasks(assigned_to, status);
+
+    -- Boot reconciles every exe/**/*.md task file against this table by
+    -- task_file (exe-boot.ts). Without this index every lookup was a full table
+    -- scan \u2014 576 of them per boot (bug 4b2d2d10). Additive: index only.
+    CREATE INDEX IF NOT EXISTS idx_tasks_task_file
+      ON tasks(task_file);
   `);
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS orchestration_events (
@@ -2220,14 +2413,43 @@ async function ensureSchema() {
       ON consolidations(consolidated_memory_id);
   `);
   await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS reminders (
+    CREATE TABLE IF NOT EXISTS memory_reads (
       id            TEXT PRIMARY KEY,
-      text          TEXT NOT NULL,
-      created_at    TEXT NOT NULL,
-      due_date      TEXT,
-      completed_at  TEXT
+      memory_id     TEXT NOT NULL,
+      agent_id      TEXT,
+      task_id       TEXT,
+      session_scope TEXT,
+      source        TEXT NOT NULL,
+      query         TEXT,
+      rank_position INTEGER NOT NULL,
+      timestamp     TEXT NOT NULL
     );
+
+    CREATE INDEX IF NOT EXISTS idx_memory_reads_memory
+      ON memory_reads(memory_id);
+
+    CREATE INDEX IF NOT EXISTS idx_memory_reads_task
+      ON memory_reads(task_id);
+
+    CREATE INDEX IF NOT EXISTS idx_memory_reads_ts
+      ON memory_reads(timestamp);
+
+    CREATE INDEX IF NOT EXISTS idx_memory_reads_agent
+      ON memory_reads(agent_id, session_scope);
   `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS reminders (
+      id             TEXT PRIMARY KEY,
+      text           TEXT NOT NULL,
+      created_at     TEXT NOT NULL,
+      due_date       TEXT,
+      completed_at   TEXT,
+      daily_push     TEXT,
+      last_pushed_at TEXT
+    );
+  `);
+  await executeAddColumn(client, `ALTER TABLE reminders ADD COLUMN daily_push TEXT`, "migration add reminders.daily_push");
+  await executeAddColumn(client, `ALTER TABLE reminders ADD COLUMN last_pushed_at TEXT`, "migration add reminders.last_pushed_at");
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS notifications (
       id          TEXT PRIMARY KEY,
@@ -2312,6 +2534,46 @@ async function ensureSchema() {
     CREATE INDEX IF NOT EXISTS idx_messages_target_scope_status
       ON messages(target_agent, session_scope, status, created_at);
   `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS notification_ledger (
+      id              TEXT PRIMARY KEY,
+      session_scope   TEXT,
+      project         TEXT,
+      target_agent    TEXT NOT NULL,
+      target_role     TEXT NOT NULL DEFAULT 'employee',
+      target_session  TEXT,
+      kind            TEXT NOT NULL,
+      intercom_reason TEXT,
+      task_id         TEXT,
+      task_file       TEXT,
+      payload_json    TEXT,
+      dedup_key       TEXT,
+      delivery_state  TEXT NOT NULL DEFAULT 'pending',
+      ack_state       TEXT NOT NULL DEFAULT 'unacked',
+      retry_count     INTEGER NOT NULL DEFAULT 0,
+      max_retries     INTEGER NOT NULL DEFAULT 10,
+      next_retry_at   TEXT,
+      boot_generation INTEGER,
+      created_at      TEXT NOT NULL,
+      delivered_at    TEXT,
+      acked_at        TEXT,
+      expires_at      TEXT,
+      last_error      TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_nledger_scope_state
+      ON notification_ledger(session_scope, delivery_state, next_retry_at);
+
+    CREATE INDEX IF NOT EXISTS idx_nledger_target
+      ON notification_ledger(target_agent, session_scope, delivery_state);
+
+    CREATE INDEX IF NOT EXISTS idx_nledger_task
+      ON notification_ledger(task_id);
+
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_nledger_dedup
+      ON notification_ledger(session_scope, dedup_key)
+      WHERE dedup_key IS NOT NULL AND delivery_state IN ('pending', 'delivered');
+  `);
   try {
     await client.execute({
       sql: `UPDATE memories SET project_name = 'exe-create' WHERE project_name = 'web'`,
@@ -3563,6 +3825,8 @@ async function ensureSchema() {
   for (const table of founderIdTables) {
     await executeAddColumn(client, `ALTER TABLE ${table} ADD COLUMN founder_id TEXT DEFAULT NULL`);
   }
+  await ensureIdempotencyKeyMigration(client);
+  await executeAddColumn(client, `ALTER TABLE tasks ADD COLUMN enforcement_note TEXT`);
   await client.executeMultiple(`
     CREATE TABLE IF NOT EXISTS investigation_attempts (
       id TEXT PRIMARY KEY,
@@ -3795,6 +4059,7 @@ async function disposeDatabase() {
 export {
   dbLockWaitMs,
   DbLockHeldError,
+  isDbLockHeldByLiveProcess,
   acquireDbLock,
   releaseDbLock,
   WAL_ESCALATION_THRESHOLD_BYTES,
@@ -3837,12 +4102,15 @@ export {
   getCoordinatorDisplayTitle,
   isCoordinatorName,
   canCoordinate,
+  isManagementRole,
+  isManagementIdentity,
   canManage,
   VALID_AGENT_NAME,
   VALID_AGENT_NAME_DESCRIPTION,
   validateEmployeeName,
   loadEmployees,
   saveEmployees,
+  loadEmployeesState,
   loadEmployeesSync,
   getEmployee,
   getEmployeeByRole,