@askexenow/exe-os 0.9.374 → 0.9.376

package/dist/{chunk-DIXXEE3S.js → chunk-BQXYXJYC.js}

@@ -1,19 +1,17 @@
+import {
+  persistSupportArtifact
+} from "./chunk-KO3OHI6V.js";
 import {
   exportOrchestration,
   importOrchestration,
   validatePackage
-} from "./chunk-BBSIEYF5.js";
+} from "./chunk-LNAFLXL7.js";
 import {
   runDriftProbes
-} from "./chunk-T3QUKNLI.js";
-import {
-  persistSupportArtifact
-} from "./chunk-U6SUKSZR.js";
-import {
-  queueSupportStatusUpdateSync
-} from "./chunk-GSJLB6JI.js";
+} from "./chunk-LM443ORV.js";
 import {
   assertVerdictAttribution,
+  isVerifiedStatus,
   parseDeliveryProof,
   registerAddBugReportComment,
   registerGetBugReport,
@@ -29,14 +27,20 @@ import {
   resolveAttribution,
   resolveVerificationArtifact,
   verificationArtifactInputSchema
-} from "./chunk-ZL4AGWAH.js";
+} from "./chunk-BNWWVYRN.js";
 import {
   supportCommitSchema,
   supportIdSchema,
   supportProductSchema,
   supportTaskIdSchema,
   supportVersionSchema
-} from "./chunk-5H47VHB7.js";
+} from "./chunk-UWX6MMCX.js";
+import {
+  queueSupportStatusUpdateSync
+} from "./chunk-7THUQU44.js";
+import {
+  promotedRulesDropped
+} from "./chunk-YLHACCCB.js";
 import {
   DEFAULT_LIST_LIMIT,
   MAX_IMPORTANCE,
@@ -45,7 +49,11 @@ import {
   ingestDocument,
   listDocumentsByWorkspace,
   updateChunksImportance
-} from "./chunk-KTU3EAWK.js";
+} from "./chunk-YAACLBZ7.js";
+import {
+  isRerankerAvailable,
+  rerankWithScores
+} from "./chunk-KM7DAG5J.js";
 import {
   CLAIM_TTL_MINUTES,
   acquireClaim,
@@ -56,47 +64,25 @@ import {
   normalizeTarget,
   releaseClaim,
   resolveHolderSession
-} from "./chunk-GNUAL43X.js";
+} from "./chunk-MFASHRJ6.js";
 import {
   StewardGate
-} from "./chunk-SEQIPGLU.js";
-import {
-  DreamingEngine
-} from "./chunk-UM3N6VND.js";
-import {
-  isRerankerAvailable,
-  rerankWithScores
-} from "./chunk-2AJGV5UL.js";
-import {
-  getEntityByName,
-  getEntityNeighbors,
-  getGraphStats,
-  getHotEntities,
-  getRelationships,
-  searchEntities
-} from "./chunk-CRCB5S7I.js";
+} from "./chunk-IZLML47J.js";
 import {
   listRecentSessionEvents
-} from "./chunk-2ZOEC4KC.js";
+} from "./chunk-ND75TGPR.js";
+import {
+  DreamingEngine
+} from "./chunk-PFAVHC5N.js";
 import {
   AUTO_WAKE_MAX_RETRIES
-} from "./chunk-VMTZ4RUW.js";
+} from "./chunk-DDMGQ5Q3.js";
 import {
   DEFAULT_EXPLORE_DURATION_MS,
   getPlayMode,
   listExploreSessions,
   setPlayMode
-} from "./chunk-23MVDXLY.js";
-import {
-  getToolUsageStats
-} from "./chunk-6WIFPD2P.js";
-import {
-  getToolCapabilityIndex
-} from "./chunk-YO4BO2CL.js";
-import {
-  isToolAllowed,
-  isToolAllowedForPlan
-} from "./chunk-GLQEJOXE.js";
+} from "./chunk-MAXD5JQL.js";
 import {
   analyzeBlastRadius,
   buildCodeContextIndexAsync,
@@ -106,43 +92,48 @@ import {
   searchCodeContext,
   searchCodeContextSemantic,
   traceCodeSymbol
-} from "./chunk-GS7LIT34.js";
+} from "./chunk-IPHLUZ37.js";
 import {
   getCachedLicenseGate,
   refreshLicenseGate
-} from "./chunk-DB55JZHU.js";
+} from "./chunk-MSLWRWTI.js";
 import {
-  createOrg
-} from "./chunk-Q3AXXKDF.js";
+  getToolUsageStats
+} from "./chunk-YZ4AEMR7.js";
 import {
-  InviteError,
-  completeOrgJoin,
-  fetchInviteOffer
-} from "./chunk-T35RCQFE.js";
+  getToolCapabilityIndex
+} from "./chunk-QIEYJ4KZ.js";
+import {
+  isToolAllowed,
+  isToolAllowedForPlan
+} from "./chunk-GLQEJOXE.js";
 import {
   assertOrgPartnerRuntimeReady,
   orgPartnerRuntimeStatus
-} from "./chunk-6SCGLHJ7.js";
+} from "./chunk-JVWLHBAV.js";
 import {
   getMailboxInboxState
-} from "./chunk-A6PDF4BO.js";
+} from "./chunk-XTQ7R2PA.js";
 import {
   draftOrgUpBrief,
   listOpenDrafts,
   listSentBriefs,
   reviewOpenDraft,
   sendOpenDraft
-} from "./chunk-PLZSZOZN.js";
+} from "./chunk-YP6UGVEY.js";
+import {
+  createOrg
+} from "./chunk-IKXH4BFC.js";
+import {
+  InviteError,
+  completeOrgJoin,
+  fetchInviteOffer
+} from "./chunk-YZPEQW7H.js";
 import {
   requireOrgPartnerBinding,
   resolveOrgPartnerBindings,
   resolvePartnerIdentities
 } from "./chunk-4YLBKEL5.js";
-import {
-  ORG_KEY_FP_DISPLAY_LEN,
-  orgKeyPinConfirmation,
-  readOrgKeyPin
-} from "./chunk-UBMZ3YQU.js";
 import {
   memberJoinBenefitText,
   seatBenefit
@@ -151,9 +142,22 @@ import {
   loadOrchestrationPhase,
   setOrchestrationPhase
 } from "./chunk-UZDF6FLJ.js";
+import {
+  ORG_KEY_FP_DISPLAY_LEN,
+  orgKeyPinConfirmation,
+  readOrgKeyPin
+} from "./chunk-UBMZ3YQU.js";
+import {
+  getEntityByName,
+  getEntityNeighbors,
+  getGraphStats,
+  getHotEntities,
+  getRelationships,
+  searchEntities
+} from "./chunk-NPXKGBVZ.js";
 import {
   createOrRefreshResumeTask
-} from "./chunk-4SJ4LK4V.js";
+} from "./chunk-HE34XVD5.js";
 import {
   STRUCTURED_BRIEF_TYPES,
   acceptTaskRequest,
@@ -166,7 +170,7 @@ import {
   listTaskRequests,
   setAutoAcceptPolicy,
   setAutoSendPolicy
-} from "./chunk-IN6CAM4F.js";
+} from "./chunk-EHAN752X.js";
 import {
   displayFingerprint
 } from "./chunk-MPVXHYD5.js";
@@ -174,57 +178,58 @@ import {
   getMailboxOutboxStatus,
   listDeliveryReceipts,
   listFailureNotices
-} from "./chunk-4LWBC7CM.js";
+} from "./chunk-NY6SBR4O.js";
+import {
+  registerDeactivateBehavior
+} from "./chunk-42IFYZUN.js";
+import {
+  registerSendMessage,
+  resolveMessageTarget
+} from "./chunk-OOZU5H3T.js";
+import {
+  registerCreateTask,
+  resolveProjectDir
+} from "./chunk-K7UNIEB4.js";
+import {
+  registerListTasks
+} from "./chunk-6WKBTZVL.js";
 import {
   registerUpdateTask
-} from "./chunk-N7VEP5B3.js";
+} from "./chunk-QFR5EKZG.js";
 import {
   registerCreateReminder
-} from "./chunk-44TLJZJ5.js";
+} from "./chunk-FX2QRSRT.js";
 import {
   registerListReminders
-} from "./chunk-NBXDXKLC.js";
+} from "./chunk-LK3XQDBP.js";
 import {
   registerCompleteReminder
-} from "./chunk-AETLDRZB.js";
-import {
-  registerDeactivateBehavior
-} from "./chunk-I4DNJFDR.js";
+} from "./chunk-PEAAX6UA.js";
 import {
   completeReminder,
   createReminder,
   formatAmbiguousReminder,
   listReminders
-} from "./chunk-636LKCKE.js";
-import {
-  registerSendMessage
-} from "./chunk-BJ7AVSY6.js";
-import {
-  registerCreateTask,
-  resolveProjectDir
-} from "./chunk-OVEQE6YS.js";
-import {
-  registerListTasks
-} from "./chunk-IRVOXUSK.js";
+} from "./chunk-Q6ZLQMP2.js";
 import {
   registerImportConversations
-} from "./chunk-GJI77VDO.js";
+} from "./chunk-WVBVUVZB.js";
+import {
+  status
+} from "./chunk-473JUDCT.js";
 import {
   TOKENS_PER_IDLE_MINUTE,
   countKillsSince,
   sumTokensSavedSince
-} from "./chunk-TQAZTRQ3.js";
-import {
-  createSchedule,
-  parseHumanCron
-} from "./chunk-DJ7YXOTU.js";
-import {
-  status
-} from "./chunk-JHI5WMK5.js";
+} from "./chunk-SVXUT2DN.js";
 import {
   evaluateGlobalSpendCap,
   getAgentSpend
-} from "./chunk-PB5S7YOF.js";
+} from "./chunk-GXNBPTPJ.js";
+import {
+  createSchedule,
+  parseHumanCron
+} from "./chunk-T7EF5CQO.js";
 import {
   exportGraphHTML,
   generateGraphReport
@@ -232,7 +237,7 @@ import {
 import {
   readSupervisionState,
   runHealthCheck
-} from "./chunk-AWWKRZMB.js";
+} from "./chunk-4KVSCQND.js";
 import {
   checkCpuStealSync
 } from "./chunk-SSC7EKY2.js";
@@ -244,16 +249,16 @@ import {
   formatReport,
   runAudit,
   shouldFixShards
-} from "./chunk-XNNECNDL.js";
+} from "./chunk-CQFWTWC6.js";
 import {
   formatDegradations,
   getRetrievalHealth
-} from "./chunk-XFTEX77S.js";
+} from "./chunk-OQ4FNDRG.js";
 import {
   hasFailures,
   runHealth,
   runTest
-} from "./chunk-QHJR7IMX.js";
+} from "./chunk-6F3FQCAQ.js";
 import {
   isSupportReportSentStatus,
   markSupportReportSent
@@ -264,21 +269,24 @@ import {
 } from "./chunk-2XZ6X3PJ.js";
 import {
   renderClientCOOTemplate
-} from "./chunk-R4CBHKZ2.js";
+} from "./chunk-ZS5JO6QV.js";
 import {
   deactivateGlobalProcedure,
   loadGlobalProcedures,
   storeGlobalProcedure
-} from "./chunk-EXTZSNWL.js";
+} from "./chunk-EPHSISMT.js";
 import {
   PLATFORM_PROCEDURES
-} from "./chunk-PY3FOMRN.js";
+} from "./chunk-BQEZPRUC.js";
 import {
+  beginCloudReupload,
   clearCloudReuploadRequired,
+  cloudResetMemoryBlobs,
   cloudSync,
+  getCloudReuploadInProgress,
   getCloudReuploadRequired,
-  markCloudReuploadRequired
-} from "./chunk-VKJGHAZT.js";
+  markCloudReuploadIncomplete
+} from "./chunk-MGVILAYU.js";
 import {
   orgMembershipPresent,
   readActiveOrgMemberships
@@ -289,7 +297,7 @@ import {
 import {
   findSimilarTrajectories,
   hashSignature
-} from "./chunk-EKE37MO4.js";
+} from "./chunk-GOT5ZHPX.js";
 import {
   BEHAVIOR_CONTENT_MAX_LENGTH,
   GHOST_BEHAVIOR_SQL,
@@ -300,20 +308,20 @@ import {
   reactivateBehavior,
   storeBehavior,
   storeReflexBehavior
-} from "./chunk-WMEYJT4R.js";
+} from "./chunk-6FG34V6D.js";
 import {
   countUnconsolidated,
   groupMemories,
   runConsolidation,
   selectUnconsolidated
-} from "./chunk-VYQ7B7DI.js";
+} from "./chunk-OWVX52XF.js";
 import {
   entityId,
   mergeEntities
-} from "./chunk-ULIBLJ6W.js";
+} from "./chunk-YYC553FO.js";
 import {
   embed
-} from "./chunk-MOGA4Q7F.js";
+} from "./chunk-CKOJP7JI.js";
 import {
   detectDcrIncompatibleConnectorsFromDisk,
   detectExternalMcpFailures,
@@ -327,7 +335,7 @@ import {
 import {
   hybridSearch,
   recentRecords
-} from "./chunk-TFKCERAK.js";
+} from "./chunk-HHT527PV.js";
 import {
   buildFtsMatch,
   tokenizeForFts
@@ -337,21 +345,22 @@ import {
   flushBatch,
   initStore,
   writeMemory
-} from "./chunk-MXPNVSXI.js";
+} from "./chunk-CIEVY5TD.js";
 import {
   updateTask
-} from "./chunk-ZCERWHY2.js";
+} from "./chunk-4M6RXJEY.js";
 import {
   fastDbInit
-} from "./chunk-M4IRPXSZ.js";
+} from "./chunk-IZA7XW2Q.js";
 import {
   MAX_CONCURRENT_WORKERS
-} from "./chunk-ZSODLMFV.js";
+} from "./chunk-HIVOLPLD.js";
 import {
   getActiveAgent
-} from "./chunk-55BEFF4V.js";
+} from "./chunk-5DF4Y6EC.js";
 import {
   UPSTREAM_ATTACHMENT_MAX_CHARS,
+  describeUpstreamFailure,
   isTelemetryRedactionEnabled,
   redactSecrets,
   redactedToolResult,
@@ -360,25 +369,20 @@ import {
   sanitizeUpstreamPayload,
   sanitizeVersionField,
   sanitizedUpstreamBody
-} from "./chunk-4QCFFW2H.js";
+} from "./chunk-5QCIWWFA.js";
 import {
   getMySession,
-  resolveExeSession,
   resolveTask,
   sessionScopeFilter,
   updateTaskStatus,
   writeCheckpoint
-} from "./chunk-AKLQSC6W.js";
-import {
-  isValidSessionScope,
-  sanitizeSessionScope
-} from "./chunk-BTSWFMEH.js";
+} from "./chunk-KI7O64XV.js";
 import {
   listSessions
-} from "./chunk-XH7YL7JM.js";
+} from "./chunk-ZMX22HSS.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-W75GTHR3.js";
+} from "./chunk-3SRZNJKD.js";
 import {
   DEFAULT_MODELS,
   KNOWN_RUNTIMES,
@@ -392,14 +396,18 @@ import {
   assertEmployeeLimit,
   assertFeature,
   assertMemoryLimit
-} from "./chunk-6YVUR3OU.js";
+} from "./chunk-QR3BUMOS.js";
 import {
   readDaemonToken
-} from "./chunk-EKYYMIVT.js";
+} from "./chunk-GPUOUUHA.js";
+import {
+  isValidSessionScope,
+  sanitizeSessionScope
+} from "./chunk-BTSWFMEH.js";
 import {
   getProjectName,
   resolveProjectName
-} from "./chunk-JTVIANUB.js";
+} from "./chunk-AEUGIJDO.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
@@ -408,18 +416,19 @@ import {
   getAccountByName,
   getDefaultAccount
 } from "./chunk-GL57PO3K.js";
+import {
+  pushConversationToCRM
+} from "./chunk-ML4S5SHZ.js";
 import {
   createNewTrigger,
   deleteTrigger,
   isScheduledTrigger,
   loadTriggers,
   sanitizeParam
-} from "./chunk-GM7TLYOK.js";
-import {
-  pushConversationToCRM
-} from "./chunk-ML4S5SHZ.js";
+} from "./chunk-K3VDF6II.js";
 import {
   EMPLOYEES_PATH,
+  IdentityWriteError,
   addEmployee,
   baseAgentName,
   canCoordinate,
@@ -434,15 +443,15 @@ import {
   loadEmployees,
   loadEmployeesState,
   loadEmployeesSync,
+  mutateIdentity,
   repairFtsTable,
-  saveEmployees,
-  updateIdentity
-} from "./chunk-TAMDAOCU.js";
+  saveEmployees
+} from "./chunk-66CGXQUA.js";
 import {
   getEventLoopLagMs,
   isDaemonAlive,
   isEventLoopDegraded
-} from "./chunk-V3W3SATA.js";
+} from "./chunk-CL4J4757.js";
 import {
   DEFAULT_RUNTIME
 } from "./chunk-WNBZJSQT.js";
@@ -461,7 +470,7 @@ import {
   refreshLicense,
   saveLicense,
   validateLicense
-} from "./chunk-L6RXG36J.js";
+} from "./chunk-Y2HD2YB7.js";
 import {
   PLAN_LIMITS
 } from "./chunk-A7XLR3K7.js";
@@ -542,6 +551,47 @@ function formatRetrievalModes() {
 
 // src/mcp/tools/recall-my-memory.ts
 import { z } from "zod";
+var RAW_FALLBACK_MIN_RELEVANCE = 0.75;
+var RAW_FALLBACK_MIN_IMPROVEMENT = 0.2;
+function fallbackRelevance(query, text5) {
+  const queryTerms = tokenizeForFts(query, { maxTerms: 16 });
+  if (queryTerms.length === 0) return 0;
+  const textTerms = tokenizeForFts(text5, { maxTerms: 2048 });
+  const textSet = new Set(textTerms);
+  const covered = queryTerms.filter((term) => textSet.has(term)).length;
+  const coverage = covered / queryTerms.length;
+  let longestOrderedRun = 0;
+  for (let textIndex = 0; textIndex < textTerms.length; textIndex++) {
+    for (let queryIndex = 0; queryIndex < queryTerms.length; queryIndex++) {
+      let run = 0;
+      while (textTerms[textIndex + run] !== void 0 && textTerms[textIndex + run] === queryTerms[queryIndex + run]) {
+        run++;
+      }
+      longestOrderedRun = Math.max(longestOrderedRun, run);
+    }
+  }
+  const orderedProximity = longestOrderedRun / queryTerms.length;
+  const exact = longestOrderedRun === queryTerms.length ? 1 : 0;
+  return coverage * 0.7 + orderedProximity * 0.2 + exact * 0.1;
+}
+function bestFallbackRelevance(query, records) {
+  return records.reduce(
+    (best, record) => Math.max(best, fallbackRelevance(query, record.raw_text)),
+    0
+  );
+}
+function isRawRecord(record) {
+  return record.memory_type == null || record.memory_type === "raw";
+}
+function chooseRawFallbackResults(query, curated, rawInclusive) {
+  if (curated.length === 0) return rawInclusive;
+  const curatedScore = bestFallbackRelevance(query, curated);
+  const rawScore = bestFallbackRelevance(query, rawInclusive.filter(isRawRecord));
+  if (rawScore >= RAW_FALLBACK_MIN_RELEVANCE && rawScore >= curatedScore + RAW_FALLBACK_MIN_IMPROVEMENT) {
+    return rawInclusive;
+  }
+  return curated;
+}
 function formatMemoryBody(rawText, maxChars, memoryId) {
   if (rawText.length <= maxChars) return rawText;
   const idHint = memoryId ? `get_memory_by_id(id='${memoryId}')` : "get_memory_by_id";
@@ -615,7 +665,7 @@ function registerRecallMyMemory(server) {
         include_source: z.boolean().optional().default(false).describe(
           "When true, attach parent document metadata (filename, mime, source_type) to each result. Default false."
         ),
-        retrieval_mode: z.enum(RETRIEVAL_MODES).optional().default("no_raw").describe(`Typed retrieval mode. ${formatRetrievalModes()}`),
+        retrieval_mode: z.enum(RETRIEVAL_MODES).optional().describe(`Typed retrieval mode. ${formatRetrievalModes()}`),
         kind: z.string().optional().describe(
           "Filter by memory_type: decision, procedure, observation, raw, conversation, behavior."
         ),
@@ -648,7 +698,7 @@ function registerRecallMyMemory(server) {
     }) => {
       try {
         {
-          const { ensureReadDbReady } = await import("./fast-db-init-L2RGKJWH.js");
+          const { ensureReadDbReady } = await import("./fast-db-init-GWUZ746B.js");
           if (!await ensureReadDbReady()) {
             return {
               content: [{ type: "text", text: "No matching memories found." }]
@@ -662,7 +712,8 @@ function registerRecallMyMemory(server) {
           };
         }
         const { agentId } = getActiveAgent();
-        const recentRetrievalMode = recent ? "all" : retrieval_mode;
+        const wasRetrievalModeDefaulted = retrieval_mode === void 0;
+        const recentRetrievalMode = recent ? "all" : retrieval_mode ?? "no_raw";
         const searchOptions = applyRetrievalMode({
           projectName: project_name,
           hasError: has_error,
@@ -690,16 +741,27 @@ function registerRecallMyMemory(server) {
           if (results.length === 0 && (has_error !== void 0 || tool_name)) {
             results = await recentRecords(agentId, searchOptions, limit);
           }
-          if (results.length === 0 && !kind && searchOptions.includeRaw === false) {
+          const curatedScore = bestFallbackRelevance(query, results);
+          const shouldProbeRaw = results.length === 0 || curatedScore < RAW_FALLBACK_MIN_RELEVANCE;
+          if (shouldProbeRaw && !kind && searchOptions.includeRaw === false && wasRetrievalModeDefaulted) {
             const rawInclusiveOptions = { ...searchOptions, includeRaw: true };
-            results = await hybridSearch(query, agentId, rawInclusiveOptions);
+            const rawInclusiveResults = await hybridSearch(
+              query,
+              agentId,
+              rawInclusiveOptions
+            );
+            results = chooseRawFallbackResults(
+              query,
+              results,
+              rawInclusiveResults
+            );
           }
         }
         const FEDERATION_THRESHOLD = 3;
         let federatedCount = 0;
         if (!recent && query && results.length < FEDERATION_THRESHOLD) {
           try {
-            const { searchCodeContextSemantic: searchCodeContextSemantic2 } = await import("./code-context-index-NOJSHLPN.js");
+            const { searchCodeContextSemantic: searchCodeContextSemantic2 } = await import("./code-context-index-LIDOFKOR.js");
             const codeResults = await Promise.race([
               searchCodeContextSemantic2(query, { limit: 5 }),
               new Promise((_, rej) => setTimeout(() => rej(new Error("timeout")), 2e3))
@@ -860,7 +922,7 @@ function registerAskTeamMemory(server) {
         }, safeMode);
         if (!effectiveIncludeRaw) searchOptions.includeRaw = false;
         {
-          const { ensureReadDbReady } = await import("./fast-db-init-L2RGKJWH.js");
+          const { ensureReadDbReady } = await import("./fast-db-init-GWUZ746B.js");
           if (!await ensureReadDbReady()) {
             return {
               content: [
@@ -950,11 +1012,11 @@ function registerStoreMemory(server) {
       }
       const { agentId, agentRole } = getActiveAgent();
       if (kind === "prospective") {
-        const { createProspectiveMemory } = await import("./prospective-memory-KR3P4T6N.js");
+        const { createProspectiveMemory } = await import("./prospective-memory-GEO6E3UL.js");
         let sessionScope = null;
         try {
-          const { resolveExeSession: resolveExeSession2 } = await import("./lib/tmux-routing.js");
-          sessionScope = resolveExeSession2() ?? null;
+          const { resolveExeSession } = await import("./lib/tmux-routing.js");
+          sessionScope = resolveExeSession() ?? null;
         } catch {
         }
         const record = await createProspectiveMemory({
@@ -1328,7 +1390,7 @@ function registerSearchEverything(server) {
     },
     async (params) => {
       try {
-        const { ensureReadDbReady } = await import("./fast-db-init-L2RGKJWH.js");
+        const { ensureReadDbReady } = await import("./fast-db-init-GWUZ746B.js");
         if (!await ensureReadDbReady()) {
           return {
             content: [
@@ -1950,7 +2012,7 @@ async function handleSupersede(input) {
   }
   try {
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-ONPPEWQV.js");
+    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-BOBBUJ74.js");
     const { writeMemory: writeMemory2, flushBatch: flushBatch2 } = await import("./lib/store.js");
     const { randomUUID: randomUUID2 } = await import("crypto");
     const client = getClient2();
@@ -1985,7 +2047,7 @@ async function handleSupersede(input) {
 `
     );
     const sessionId = process.env.SESSION_ID ?? "manual";
-    const { getProjectName: getProjectName2 } = await import("./project-name-LJVFMYTQ.js");
+    const { getProjectName: getProjectName2 } = await import("./project-name-WKSNNKXK.js");
     const projectName = input.project_name ?? getProjectName2();
     const newId = randomUUID2();
     await writeMemory2({
@@ -2020,7 +2082,7 @@ New memory id: ${newId}`
 }
 async function handleResonanceQuery(input) {
   try {
-    const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-CMNSWS6B.js");
+    const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-523TKQPZ.js");
     const subAction = input.resonance_action ?? "hot_pairs";
     const limit = input.limit ?? 20;
     if (subAction === "hot_pairs") {
@@ -2125,7 +2187,7 @@ function registerMemory(server) {
         return handleResonanceQuery(input);
       }
       if (action === "update_working_memory" || action === "get_working_memory") {
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-ONPPEWQV.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-BOBBUJ74.js");
         const { agentId } = getActiveAgent2();
         const { readWorkingMemoryWithMeta, writeWorkingMemory, WORKING_MEMORY_MAX_BYTES } = await import("./working-memory-DPFRSKH3.js");
         if (action === "get_working_memory") {
@@ -2151,9 +2213,9 @@ function registerMemory(server) {
         }
       }
       if (action === "core_get" || action === "core_set" || action === "core_delete") {
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-ONPPEWQV.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-BOBBUJ74.js");
         const { agentId } = getActiveAgent2();
-        const { getCoreMemory, setCoreMemory, deleteCoreMemory, formatCoreMemoryBlock } = await import("./core-memory-7I7RE2SJ.js");
+        const { getCoreMemory, setCoreMemory, deleteCoreMemory, formatCoreMemoryBlock } = await import("./core-memory-UIZKCY4L.js");
         if (action === "core_get") {
           const entries = await getCoreMemory(agentId);
           const block = formatCoreMemoryBlock(entries);
@@ -2183,7 +2245,6 @@ function registerMemory(server) {
         legacyArgs.limit ??= 10;
         legacyArgs.include_archived ??= false;
         legacyArgs.include_source ??= false;
-        legacyArgs.retrieval_mode ??= "no_raw";
         legacyArgs.debug ??= false;
         if (!legacyArgs.recent && !legacyArgs.query) {
           return errorResult('memory action "recall" requires query unless recent=true');
@@ -2205,13 +2266,13 @@ function registerMemory(server) {
           if (!storeTrigger || !storeTriggerAction) {
             return errorResult('memory action "store" with kind="reflex" requires trigger and trigger_action fields');
           }
-          const { formatReflexContent, storeReflexBehavior: storeReflexBehavior2 } = await import("./behaviors-ZJ45TFBJ.js");
+          const { formatReflexContent, storeReflexBehavior: storeReflexBehavior2 } = await import("./behaviors-GPI4BLTC.js");
           const reflexText = formatReflexContent(storeTrigger, storeTriggerAction);
           legacyArgs.text ??= reflexText;
           legacyArgs.query ??= reflexText;
           try {
-            const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-ONPPEWQV.js");
-            const { getProjectName: getProjectName2 } = await import("./project-name-LJVFMYTQ.js");
+            const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-BOBBUJ74.js");
+            const { getProjectName: getProjectName2 } = await import("./project-name-WKSNNKXK.js");
             const agent = getActiveAgent2();
             const behaviorId = await storeReflexBehavior2({
               agentId: agent.agentId,
@@ -2272,15 +2333,16 @@ function registerQueryRelationships(server) {
         entity_name: z13.string().optional().describe("Specific entity to explore (for example an agent, project, or vendor name)"),
         relationship_type: z13.string().optional().describe("Filter by relationship type (e.g., 'implemented', 'depends_on', 'worked_on')"),
         max_depth: z13.number().default(2).describe("How many hops to traverse (default: 2)"),
-        as_of: z13.string().optional().describe("ISO 8601 timestamp for time-travel. Returns relationships valid at that point in time.")
+        as_of: z13.string().optional().describe("ISO 8601 timestamp for time-travel. Returns relationships valid at that point in time."),
+        project_name: z13.string().optional().describe("Scope results to a single project")
       }
     },
-    async ({ query, entity_name, relationship_type, max_depth, as_of }) => {
+    async ({ query, entity_name, relationship_type, max_depth, as_of, project_name: projectName }) => {
       const client = getClient();
       if (entity_name) {
-        const entity = await getEntityByName(client, entity_name);
+        const entity = await getEntityByName(client, entity_name, void 0, projectName);
         if (!entity) {
-          const matches = await searchEntities(client, entity_name, 5);
+          const matches = await searchEntities(client, entity_name, 5, projectName);
           if (matches.length === 0) {
             return {
               content: [{
@@ -2300,7 +2362,8 @@ ${matchList}`
         }
         const rels = await getRelationships(client, entity.id, {
           type: relationship_type,
-          asOf: as_of
+          asOf: as_of,
+          projectName
         });
         if (rels.length === 0) {
           return {
@@ -2314,7 +2377,7 @@ ${matchList}`
           const confLabel = r.confidenceLabel && r.confidenceLabel !== "extracted" ? `[${r.confidenceLabel.toUpperCase()} ${r.confidence.toFixed(1)}] ` : "";
           return `- ${confLabel}${r.sourceName} \u2192[${r.type}]\u2192 ${r.targetName} (w: ${r.weight.toFixed(1)})`;
         });
-        const neighbors = await getEntityNeighbors(client, entity.id, max_depth, as_of);
+        const neighbors = await getEntityNeighbors(client, entity.id, max_depth, as_of, projectName);
         const neighborLine = neighbors.length > 1 ? `
 
 Connected entities (${max_depth} hops): ${neighbors.filter((n) => n.entity.id !== entity.id).map((n) => `${n.entity.name} (${n.entity.type})`).join(", ")}` : "";
@@ -2330,19 +2393,20 @@ ${relLines.join("\n")}${neighborLine}`
         };
       }
       if (query) {
-        const matches = await searchEntities(client, query, 10);
+        const matches = await searchEntities(client, query, 10, projectName);
         if (matches.length === 0) {
-          const stats2 = await getGraphStats(client);
+          const stats2 = await getGraphStats(client, projectName);
+          const scopeLabel = projectName ? ` in project "${projectName}"` : "";
           return {
             content: [{
               type: "text",
-              text: `No entities matching "${query}" found. Graph has ${stats2.entities} entities and ${stats2.relationships} relationships.`
+              text: `No entities matching "${query}" found${scopeLabel}. Graph has ${stats2.entities} entities and ${stats2.relationships} relationships${scopeLabel}.`
             }]
           };
         }
         const results = [];
         for (const entity of matches.slice(0, 5)) {
-          const rels = await getRelationships(client, entity.id, { type: relationship_type, asOf: as_of });
+          const rels = await getRelationships(client, entity.id, { type: relationship_type, asOf: as_of, projectName });
           const relSummary = rels.length > 0 ? rels.slice(0, 3).map((r) => `  ${r.sourceName} \u2192[${r.type}]\u2192 ${r.targetName}`).join("\n") : "  (no relationships)";
           results.push(`### ${entity.name} (${entity.type})
 ${relSummary}`);
@@ -2354,12 +2418,12 @@ ${relSummary}`);
           }]
         };
       }
-      const stats = await getGraphStats(client);
+      const stats = await getGraphStats(client, projectName);
       const typeBreakdown = Object.entries(stats.types).map(([type, count]) => `- ${type}: ${count}`).join("\n");
       return {
         content: [{
           type: "text",
-          text: `Knowledge Graph Summary:
+          text: `Knowledge Graph Summary${projectName ? ` \u2014 ${projectName}` : ""}:
 - ${stats.entities} entities
 - ${stats.relationships} relationships
 
@@ -2466,6 +2530,7 @@ function registerGetTask(server) {
       lines.push(
         "",
         `**ID:** ${String(row.id)}`,
+        `**Mode:** ${row.execution_mode === "checklist" ? "checklist (no execution side effects)" : "durable tmux dispatch"}`,
         `**Status:** ${String(row.status)}`,
         `**Priority:** ${String(row.priority)}`,
         `**Assigned by:** ${String(row.assigned_by)}`,
@@ -2482,6 +2547,16 @@ function registerGetTask(server) {
       if (row.reviewer) {
         lines.push(`**Reviewer:** ${String(row.reviewer)}`);
       }
+      const isCompletionStatus = String(row.status) === "done" || String(row.status) === "needs_review" || String(row.status) === "closed";
+      if (row.pr_url) {
+        lines.push(`**PR:** ${String(row.pr_url)}`);
+      } else if (row.pr_number) {
+        lines.push(`**PR:** #${String(row.pr_number)}`);
+      } else if (row.pr_no_reason) {
+        lines.push(`**PR:** none \u2014 ${String(row.pr_no_reason)}`);
+      } else if (isCompletionStatus) {
+        lines.push(`**PR:** untracked (no pr_number/pr_url/pr_no_reason recorded on this task)`);
+      }
       const budgetTokens = row.budget_tokens !== null ? Number(row.budget_tokens) : null;
       const budgetFallback = row.budget_fallback_model !== null ? String(row.budget_fallback_model) : null;
       if (budgetTokens !== null || budgetFallback !== null) {
@@ -2566,12 +2641,43 @@ function registerGetTask(server) {
 
 // src/mcp/tools/close-task.ts
 import { z as z15 } from "zod";
+
+// src/lib/task-request-scope.ts
+function rootTaskSessionName(value) {
+  const raw = (value ?? "").trim();
+  if (!raw) return "";
+  const lastDash = raw.lastIndexOf("-");
+  return lastDash >= 0 ? raw.slice(lastDash + 1) : raw;
+}
+function resolveTaskRequestScope(explicit) {
+  const candidates = [];
+  try {
+    candidates.push([getAgentContext()?.sessionHint ?? "", "als"]);
+  } catch {
+  }
+  candidates.push([process.env.EXE_SESSION_NAME || process.env.EXE_SESSION || "", "env"]);
+  for (const [sessionName, source] of candidates) {
+    const scope2 = rootTaskSessionName(sessionName);
+    if (scope2 && isValidSessionScope(scope2)) return { scope: scope2, sessionName, source };
+  }
+  const explicitValue = (explicit ?? "").trim();
+  if (!explicitValue) return null;
+  const scope = rootTaskSessionName(explicitValue);
+  if (!isValidSessionScope(scope)) {
+    throw new Error(
+      `Invalid session_scope "${explicitValue}". Use a coordinator scope token like exe2, not a tmux command or free text.`
+    );
+  }
+  return { scope, sessionName: explicitValue, source: "explicit_param" };
+}
+
+// src/mcp/tools/close-task.ts
 var CLOSE_TASK_ALLOWED_ROLES = /* @__PURE__ */ new Set(["CTO"]);
 var CLOSEABLE_STATUSES = /* @__PURE__ */ new Set(["needs_review", "done"]);
 async function respawnAssigneeAfterClose(input) {
-  const { resolveExeSession: resolveExeSession2, employeeSessionName, ensureEmployee } = await import("./lib/tmux-routing.js");
+  const { resolveExeSession, employeeSessionName, ensureEmployee } = await import("./lib/tmux-routing.js");
   const { shouldAutoInstance } = await import("./lib/employees.js");
-  const exeSession = input.taskScope ?? resolveExeSession2();
+  const exeSession = input.taskScope ?? resolveExeSession();
   if (!exeSession) return { respawned: false, reason: "no coordinator session" };
   if (!input.projectName) {
     process.stderr.write(
@@ -2596,8 +2702,8 @@ async function respawnAssigneeAfterClose(input) {
   } catch {
   }
   try {
-    const { cleanupAgentWorktree } = await import("./worktree-sweep-BNBD4RFX.js");
-    const { getGitRoot } = await import("./worktree-W47CIMJ6.js");
+    const { cleanupAgentWorktree } = await import("./worktree-sweep-EV5YQ2OB.js");
+    const { getGitRoot } = await import("./worktree-Q25PZST6.js");
     const root = getGitRoot(projectDir);
     if (root) {
       const notes = await cleanupAgentWorktree(root, input.assignee);
@@ -2644,6 +2750,35 @@ async function respawnAssigneeAfterClose(input) {
   );
   return { respawned: true, projectDir };
 }
+function resolveTaskPrAttribution(input) {
+  const { matchedPrs, mergedPrs, existingPrNumber, assignee } = input;
+  if (mergedPrs.length === 0) return { prNumber: void 0, prUrl: void 0, note: "" };
+  if (matchedPrs.length > 1) {
+    const list = matchedPrs.map((p) => `#${p.number} (${p.headRefName})`).join(", ");
+    return {
+      prNumber: void 0,
+      prUrl: void 0,
+      note: `\u26A0\uFE0F ${matchedPrs.length} open PRs matched assignee "${assignee}": ${list}. The branch filter matches the ASSIGNEE, not this task, so which PR belongs to THIS task is ambiguous. They were merged as requested, but NONE was auto-recorded as this task's pr_number \u2014 set it with update_task(pr_url=...).`
+    };
+  }
+  const only = mergedPrs[0];
+  const belongsToAssignee = only.headRefName === `${assignee}-work` || only.headRefName.startsWith(`${assignee}-`);
+  if (!belongsToAssignee) {
+    return {
+      prNumber: void 0,
+      prUrl: void 0,
+      note: `\u26A0\uFE0F close_task merged PR #${only.number} from branch "${only.headRefName}", which matched assignee "${assignee}" only by BASE NAME, not by the full assignee id \u2014 for a numbered assignee that branch belongs to a different instance. Not recorded as this task's pr_number; set it with update_task(pr_url=...) if it really is this task's PR.`
+    };
+  }
+  if (existingPrNumber !== null && existingPrNumber !== only.number) {
+    return {
+      prNumber: void 0,
+      prUrl: void 0,
+      note: `\u26A0\uFE0F This task already recorded PR #${existingPrNumber}, but close_task merged #${only.number} from assignee "${assignee}"'s branches. Keeping the already-recorded #${existingPrNumber}: a self-reported PR is task-specific, whereas this match is only assignee-specific.`
+    };
+  }
+  return { prNumber: only.number, prUrl: only.url, note: "" };
+}
 function registerCloseTask(server) {
   server.registerTool(
     "close_task",
@@ -2660,10 +2795,20 @@ function registerCloseTask(server) {
       const agent = getActiveAgent();
       const { getClient: getClient2 } = await import("./lib/database.js");
       const client = getClient2();
-      const mySession = resolveExeSession();
+      const requestScope = resolveTaskRequestScope();
+      if (!requestScope) {
+        return {
+          content: [{
+            type: "text",
+            text: "close_task requires a resolvable session scope (from X-Exe-Session or the launch environment) and none could be determined. Refusing to close without a session scope to avoid mutating tasks outside this caller's coordinator lane."
+          }],
+          isError: true
+        };
+      }
+      const mySession = requestScope.scope;
       let row;
       try {
-        row = await resolveTask(client, task_id, mySession);
+        row = await resolveTask(client, task_id, mySession, "mutate", agent.agentId);
       } catch {
         return {
           content: [{
@@ -2677,7 +2822,7 @@ function registerCloseTask(server) {
       const callerIsAssignedReviewer = Boolean(agent.agentId) && taskReviewer !== null && agent.agentId === taskReviewer;
       const canClose = canCoordinate(agent.agentId, agent.agentRole) || CLOSE_TASK_ALLOWED_ROLES.has(agent.agentRole ?? "") || callerIsAssignedReviewer;
       try {
-        const { StewardGate: StewardGate2 } = await import("./steward-gate-BFCCMCSW.js");
+        const { StewardGate: StewardGate2 } = await import("./steward-gate-KMLS5ECC.js");
         const steward = new StewardGate2();
         const gateDecision = await steward.checkAuthority(agent.agentId || "unknown", "close_task", task_id);
         if (!gateDecision.allowed && !callerIsAssignedReviewer) {
@@ -2697,6 +2842,7 @@ function registerCloseTask(server) {
         };
       }
       const taskStatus = String(row.status);
+      const isLegacyExecution = row.execution_mode !== "checklist";
       const assignee = row.assigned_to;
       const taskScope = row.session_scope;
       const createdAt = row.created_at;
@@ -2721,7 +2867,7 @@ function registerCloseTask(server) {
       }
       const preflightWarnings = [];
       const baseDir = process.cwd();
-      if (assignee) {
+      if (assignee && isLegacyExecution) {
         try {
           const { execSync } = await import("child_process");
           const baseName = assignee.replace(/\d+$/, "") || assignee;
@@ -2756,7 +2902,7 @@ function registerCloseTask(server) {
         } catch {
         }
       }
-      if (assignee && createdAt && status2 === "closed") {
+      if (assignee && createdAt && status2 === "closed" && isLegacyExecution) {
         try {
           const { execSync } = await import("child_process");
           const sinceDate = createdAt.split("T")[0] || createdAt;
@@ -2780,12 +2926,16 @@ function registerCloseTask(server) {
         }
       }
       let mergeNote = "";
-      if (assignee) {
+      let mergedPrNumber;
+      let mergedPrUrl;
+      const mergedOk = [];
+      let prAmbiguityNote = "";
+      if (assignee && isLegacyExecution) {
         try {
           const { execSync } = await import("child_process");
           try {
             const openPRs = execSync(
-              `gh pr list --state open --json number,title,headRefName 2>/dev/null`,
+              `gh pr list --state open --json number,title,headRefName,url 2>/dev/null`,
               { encoding: "utf8", timeout: 5e3 }
             ).trim();
             const allPrs = JSON.parse(openPRs || "[]");
@@ -2800,11 +2950,27 @@ function registerCloseTask(server) {
 \u2705 Auto-merged PR #${pr.number}: ${pr.title}`;
                 process.stderr.write(`[close-task] Auto-merged PR #${pr.number} (${pr.headRefName})
 `);
+                mergedOk.push(pr);
               } catch (mergeErr) {
                 mergeNote += `
 \u26A0\uFE0F Failed to merge PR #${pr.number}: ${mergeErr instanceof Error ? mergeErr.message : "unknown error"}`;
               }
             }
+            const attribution = resolveTaskPrAttribution({
+              matchedPrs: prs,
+              mergedPrs: mergedOk,
+              existingPrNumber: row.pr_number == null ? null : Number(row.pr_number),
+              assignee
+            });
+            mergedPrNumber = attribution.prNumber;
+            mergedPrUrl = attribution.prUrl;
+            prAmbiguityNote = attribution.note;
+            if (attribution.note) {
+              mergeNote += `
+${attribution.note}`;
+              process.stderr.write(`[close-task] PR traceability: ${attribution.note}
+`);
+            }
             if (prs.length > 0) {
               try {
                 execSync("git pull origin main 2>/dev/null", { timeout: 1e4 });
@@ -2827,13 +2993,24 @@ function registerCloseTask(server) {
       const task = await updateTask({
         taskId: task_id,
         status: status2,
-        result: result3,
+        // mergeNote is response-only and evaporates. When PR traceability was
+        // deliberately NOT stamped, the REASON has to live on the record next
+        // to the gap it explains, or the record is just silently missing a PR.
+        result: prAmbiguityNote ? `${result3}
+${prAmbiguityNote.trim()}` : result3,
+        // Only set when close_task merged exactly one unambiguously-attributable
+        // PR via `gh`. `undefined` never clobbers a pr_number/pr_url the
+        // employee already reported at update_task(needs_review) time (see
+        // resolvePrTraceabilityFields), and is what the ambiguity/clobber guards
+        // above reset it to.
+        prNumber: mergedPrNumber,
+        prUrl: mergedPrUrl,
         baseDir,
         skipReviewCreation: true
       });
-      try {
-        const { releaseClaim: releaseClaim2 } = await import("./work-claims-B73X5NE7.js");
-        const holderSession = sanitizeSessionScope(resolveExeSession() ?? "") || "";
+      if (isLegacyExecution) try {
+        const { releaseClaim: releaseClaim2 } = await import("./work-claims-PDQNLE5K.js");
+        const holderSession = sanitizeSessionScope(mySession ?? "") || "";
         if (holderSession) {
           await releaseClaim2({ holderSession, taskId: task.id });
         }
@@ -2852,10 +3029,10 @@ File: ${task.taskFile}`;
 ${preflightWarnings.join("\n")}`;
       }
       if (mergeNote) text5 += mergeNote;
-      if (status2 === "closed" && assignee) {
+      if (status2 === "closed" && assignee && isLegacyExecution) {
         try {
-          const { cleanupAgentWorktree } = await import("./worktree-sweep-BNBD4RFX.js");
-          const { getGitRoot } = await import("./worktree-W47CIMJ6.js");
+          const { cleanupAgentWorktree } = await import("./worktree-sweep-EV5YQ2OB.js");
+          const { getGitRoot } = await import("./worktree-Q25PZST6.js");
           const repoRoot = getGitRoot(baseDir);
           if (repoRoot) {
             const cleanupNotes = await cleanupAgentWorktree(repoRoot, assignee);
@@ -2872,13 +3049,13 @@ ${preflightWarnings.join("\n")}`;
         }
       }
       let respawnNote = "";
-      if (status2 === "closed") {
+      if (status2 === "closed" && isLegacyExecution) {
         try {
           const closedAssignee = assignee || task.assignedTo;
           if (closedAssignee) {
-            const respawnScope = sessionScopeFilter(resolveExeSession());
+            const respawnScope = sessionScopeFilter(mySession);
             const remaining = await client.execute({
-              sql: `SELECT COUNT(*) as cnt FROM tasks WHERE assigned_to = ? AND status IN ('open', 'in_progress') ${respawnScope.sql}`,
+              sql: `SELECT COUNT(*) as cnt FROM tasks WHERE assigned_to = ? AND status IN ('open', 'in_progress') AND execution_mode = 'durable_tmux' ${respawnScope.sql}`,
               args: [closedAssignee, ...respawnScope.args]
             });
             const count = Number(remaining.rows[0]?.cnt ?? 0);
@@ -2886,7 +3063,7 @@ ${preflightWarnings.join("\n")}`;
               let topOpenTaskId;
               try {
                 const topRes = await client.execute({
-                  sql: `SELECT id FROM tasks WHERE assigned_to = ? AND status = 'open' ${respawnScope.sql}
+                  sql: `SELECT id FROM tasks WHERE assigned_to = ? AND status = 'open' AND execution_mode = 'durable_tmux' ${respawnScope.sql}
                         ORDER BY CASE priority WHEN 'p0' THEN 0 WHEN 'p1' THEN 1 WHEN 'p2' THEN 2 ELSE 3 END, created_at ASC LIMIT 1`,
                   args: [closedAssignee, ...respawnScope.args]
                 });
@@ -2999,7 +3176,7 @@ function registerResumeEmployee(server) {
     async ({ agent_id, project_name }) => {
       let client;
       if (!isInitialized()) {
-        const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-L2RGKJWH.js");
+        const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-GWUZ746B.js");
         client = await fastDbInit2();
       } else {
         client = getClient();
@@ -3009,7 +3186,9 @@ function registerResumeEmployee(server) {
         sql: `SELECT id, title, priority, task_file, status, assigned_tmux,
               session_scope, project_name
               FROM tasks
-              WHERE assigned_to = ? AND status IN ('open', 'in_progress', 'blocked')${reScope.sql}
+              WHERE assigned_to = ?
+                AND status IN ('open', 'in_progress', 'blocked')
+                AND execution_mode = 'durable_tmux'${reScope.sql}
               ORDER BY
                 CASE priority WHEN 'p0' THEN 0 WHEN 'p1' THEN 1 WHEN 'p2' THEN 2 ELSE 3 END,
                 created_at ASC
@@ -3027,7 +3206,7 @@ function registerResumeEmployee(server) {
         };
       }
       try {
-        const { isTmuxSessionAlive } = await import("./tasks-crud-ZRQNJXQ2.js");
+        const { isTmuxSessionAlive } = await import("./tasks-crud-45WOIMIM.js");
         const now = (/* @__PURE__ */ new Date()).toISOString();
         for (const row of openTasks.rows) {
           const status2 = String(row.status);
@@ -3055,7 +3234,7 @@ function registerResumeEmployee(server) {
       }
       let checkpointInfo = "";
       try {
-        const { readLatestCheckpoint } = await import("./tasks-crud-ZRQNJXQ2.js");
+        const { readLatestCheckpoint } = await import("./tasks-crud-45WOIMIM.js");
         const checkpointSessionScope = openTasks.rows[0]?.session_scope != null ? String(openTasks.rows[0].session_scope) : reScope.args[0] != null ? String(reScope.args[0]) : "";
         const checkpoint = checkpointSessionScope ? await readLatestCheckpoint(agent_id, { sessionScope: checkpointSessionScope }) : null;
         if (checkpoint) {
@@ -3116,7 +3295,7 @@ function registerResumeEmployee(server) {
       }
       let dispatchStatus = "";
       try {
-        const { ensureEmployeeAsync, resolveExeSession: resolveExeSession2 } = await import("./lib/tmux-routing.js");
+        const { ensureEmployeeAsync, resolveExeSession } = await import("./lib/tmux-routing.js");
         let taskScope = null;
         if (taskId) {
           try {
@@ -3130,7 +3309,7 @@ function registerResumeEmployee(server) {
             taskScope = null;
           }
         }
-        const exeSession = taskScope ?? resolveExeSession2();
+        const exeSession = taskScope ?? resolveExeSession();
         if (!exeSession) throw new Error("No coordinator session found");
         if (!resumeProjectDir) {
           throw new Error(
@@ -3142,6 +3321,17 @@ function registerResumeEmployee(server) {
 `
         );
         const { shouldAutoInstance } = await import("./lib/employees.js");
+        if (taskId) {
+          const { liveSessionHoldingTask } = await import("./tasks-crud-45WOIMIM.js");
+          const holder = await liveSessionHoldingTask(taskId, taskScope);
+          if (holder) {
+            dispatchStatus = `
+Dispatched: suppressed -- task ${taskId} already in progress on live session ${holder}`;
+            process.stderr.write(`[resume_employee] SPAWN SUPPRESSED for ${agent_id} task ${taskId} -- live session ${holder} already working it
+`);
+            throw new Error("spawn suppressed -- session already live");
+          }
+        }
         const { tryAcquireDispatchClaim, releaseDispatchClaim } = await import("./dispatch-ack-AZL3WKCK.js");
         let claimedResume = false;
         if (taskId) {
@@ -3457,12 +3647,13 @@ function registerTask(server) {
     "task",
     {
       title: "Task",
-      description: "Consolidated task domain tool. Use action=create/list/get/update/close/checkpoint/resume/dependency_tree/verify_dispatch instead of separate task tools. verify_dispatch checks if a dispatched task was acknowledged by the agent. reminder_create/reminder_list/reminder_complete manage founder reminders shown in boot brief. Legacy task tools remain available during migration.",
+      description: "Consolidated task domain tool. action=create persists a session-scoped checklist item with no execution side effects by default; use execution_mode='durable_tmux' only for explicit legacy dispatch. Use action=create/list/get/update/close/checkpoint/resume/dependency_tree/verify_dispatch instead of separate task tools. verify_dispatch checks if a dispatched task was acknowledged by the agent. reminder_create/reminder_list/reminder_complete manage founder reminders shown in boot brief. Legacy task tools remain available during migration.",
       inputSchema: {
         action: z19.enum(["create", "list", "get", "update", "close", "checkpoint", "resume", "dependency_tree", "verify_dispatch", "create_group", "group_status", "group_results", "reminder_create", "reminder_list", "reminder_complete"]).describe("Task operation to perform"),
+        execution_mode: z19.enum(["checklist", "durable_tmux"]).optional().describe("For action=create or create_group. Default 'checklist' only persists plan state for native-subagent execution in this coordinator context. 'durable_tmux' explicitly opts into legacy project resolution and tmux dispatch."),
         task_id: z19.string().optional().describe("Task identifier \u2014 UUID, slug, filename fragment, or title substring"),
         title: z19.string().optional().describe("Task title for action=create"),
-        assigned_to: z19.string().optional().describe("Employee name for action=create/list filter"),
+        assigned_to: z19.string().optional().describe("Checklist owner/assignee label for action=create, or assignee filter for action=list. Roster validation happens only in execution_mode='durable_tmux'."),
         project_name: z19.string().optional().describe("Project name. Use project_name='all' for action=list across projects."),
         priority: z19.enum(["p0", "p1", "p2"]).optional().describe("Priority for create or list filter"),
         complexity: z19.enum(["routine", "standard", "complex", "critical"]).optional().describe("Task complexity for action=create"),
@@ -3571,14 +3762,17 @@ function registerTask(server) {
         const missing2 = missingRequiredFields2(args, REQUIRED_FIELDS2.create_group);
         if (missing2.length > 0) return errorResult2(`task action "create_group" missing required field(s): ${missing2.join(", ")}`);
         try {
-          const { createTaskGroup } = await import("./tasks-crud-ZRQNJXQ2.js");
+          const requestScope = resolveTaskRequestScope(args.session_scope);
+          if (!requestScope) return errorResult2("create_group requires a concrete session_scope from X-Exe-Session, the launch environment, or session_scope");
+          const { createTaskGroup } = await import("./tasks-crud-45WOIMIM.js");
           const group = await createTaskGroup({
             title: args.title,
             coordinator: args.coordinator,
-            sessionScope: args.session_scope ?? void 0,
+            sessionScope: requestScope.scope,
             projectName: args.project_name ?? void 0,
             timeoutMinutes: args.timeout_minutes ?? void 0,
-            onPartialFailure: args.on_partial_failure ?? void 0
+            onPartialFailure: args.on_partial_failure ?? void 0,
+            executionMode: args.execution_mode ?? "checklist"
           });
           return { content: [{ type: "text", text: JSON.stringify(group, null, 2) }] };
         } catch (err) {
@@ -3590,8 +3784,10 @@ function registerTask(server) {
         const missing2 = missingRequiredFields2(args, REQUIRED_FIELDS2.group_status);
         if (missing2.length > 0) return errorResult2(`task action "group_status" missing required field(s): ${missing2.join(", ")}`);
         try {
-          const { getGroupStatus } = await import("./tasks-crud-ZRQNJXQ2.js");
-          const status2 = await getGroupStatus(args.group_id);
+          const requestScope = resolveTaskRequestScope(args.session_scope);
+          if (!requestScope) return errorResult2("group_status requires a concrete caller session_scope");
+          const { getGroupStatus } = await import("./tasks-crud-45WOIMIM.js");
+          const status2 = await getGroupStatus(args.group_id, requestScope.scope);
           return { content: [{ type: "text", text: JSON.stringify(status2, null, 2) }] };
         } catch (err) {
           return errorResult2(`group_status failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -3602,8 +3798,10 @@ function registerTask(server) {
         const missing2 = missingRequiredFields2(args, REQUIRED_FIELDS2.group_results);
         if (missing2.length > 0) return errorResult2(`task action "group_results" missing required field(s): ${missing2.join(", ")}`);
         try {
-          const { getGroupResults } = await import("./tasks-crud-ZRQNJXQ2.js");
-          const results = await getGroupResults(args.group_id);
+          const requestScope = resolveTaskRequestScope(args.session_scope);
+          if (!requestScope) return errorResult2("group_results requires a concrete caller session_scope");
+          const { getGroupResults } = await import("./tasks-crud-45WOIMIM.js");
+          const results = await getGroupResults(args.group_id, requestScope.scope);
           return { content: [{ type: "text", text: JSON.stringify(results, null, 2) }] };
         } catch (err) {
           return errorResult2(`group_results failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -3621,6 +3819,7 @@ function registerTask(server) {
       if (action === "create") {
         legacyArgs.priority ??= "p1";
         legacyArgs.complexity ??= "standard";
+        legacyArgs.execution_mode ??= "checklist";
       }
       if (action === "close") {
         legacyArgs.status ??= "closed";
@@ -3634,26 +3833,6 @@ function registerTask(server) {
         return errorResult2(`Legacy task handler not found for action "${action}" (${legacyToolName})`);
       }
       const result3 = await legacyTool.handler(legacyArgs, extra);
-      if (action === "create" && legacyArgs.group_id && !result3.isError) {
-        try {
-          const resultText = result3.content?.[0]?.text ?? "";
-          const parsed = JSON.parse(resultText);
-          const taskId = parsed?.id;
-          if (taskId) {
-            const { getClient: getClient2 } = await import("./lib/database.js");
-            const client = getClient2();
-            await client.execute({
-              sql: "UPDATE tasks SET group_id = ? WHERE id = ?",
-              args: [String(legacyArgs.group_id), taskId]
-            });
-            parsed.group_id = String(legacyArgs.group_id);
-            return {
-              content: [{ type: "text", text: JSON.stringify(parsed, null, 2) }]
-            };
-          }
-        } catch {
-        }
-      }
       return result3;
     }
   );
@@ -4015,8 +4194,8 @@ function registerStoreBehavior(server) {
       });
       let responseText = `Behavior stored for ${resolvedAgent}. ID: ${id}`;
       try {
-        const { countActiveBehaviors } = await import("./behaviors-ZJ45TFBJ.js");
-        const { formatOverCapWarning } = await import("./behavior-injection-M6UYZCMW.js");
+        const { countActiveBehaviors } = await import("./behaviors-GPI4BLTC.js");
+        const { formatOverCapWarning } = await import("./behavior-injection-GMZKZ3BT.js");
         const counts = await countActiveBehaviors(resolvedAgent, resolvedProject);
         const warning = formatOverCapWarning(resolvedAgent, counts);
         if (warning) responseText += `
@@ -4133,13 +4312,16 @@ function registerMessage(server) {
     const action = input.action;
     const { action: _action, ...args } = input;
     if (action === "send") {
-      if (!args.target_agent) return errorResult4('message action "send" requires target_agent');
+      const target = resolveMessageTarget(args.target_agent);
+      if (!target) {
+        return errorResult4('message action "send" requires target_agent when no dispatcher session is available');
+      }
       const msgType = args.type;
       const msgPayload = args.payload;
       if (msgType && msgPayload) {
         try {
-          const { buildTypedMessage, serializeMessage } = await import("./typed-messages-RCMPEKJN.js");
-          const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-ONPPEWQV.js");
+          const { buildTypedMessage, serializeMessage } = await import("./typed-messages-P2HLLA62.js");
+          const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-BOBBUJ74.js");
           const { sendMessage } = await import("./lib/messaging.js");
           const { agentId } = getActiveAgent2();
           const envelope = buildTypedMessage({
@@ -4149,9 +4331,10 @@ function registerMessage(server) {
           });
           const msg = await sendMessage({
             fromAgent: agentId,
-            targetAgent: args.target_agent,
+            targetAgent: target.targetAgent,
             targetProject: args.target_project,
             targetDevice: args.target_device,
+            sessionScope: target.sessionScope,
             content: serializeMessage(envelope),
             priority: args.priority ?? "normal"
           });
@@ -4159,7 +4342,7 @@ function registerMessage(server) {
           return {
             content: [{
               type: "text",
-              text: `Typed message [${msgType}] sent to ${args.target_agent}: ${statusText}
+              text: `Typed message [${msgType}] sent to ${target.targetAgent}: ${statusText}
 ID: ${msg.id}`
             }]
           };
@@ -4173,10 +4356,10 @@ ID: ${msg.id}`
     if (action === "read") {
       try {
         const { getPendingMessages } = await import("./lib/messaging.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-ONPPEWQV.js");
-        const { resolveExeSession: resolveExeSession2 } = await import("./lib/tmux-routing.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-BOBBUJ74.js");
+        const { resolveExeSession } = await import("./lib/tmux-routing.js");
         const { agentId } = getActiveAgent2();
-        const callerScope = resolveExeSession2() ?? void 0;
+        const callerScope = resolveExeSession() ?? void 0;
         const messages = await getPendingMessages(agentId, callerScope);
         if (messages.length === 0) {
           return {
@@ -4370,6 +4553,45 @@ ${identity.body}`
 
 // src/mcp/tools/update-identity.ts
 import { z as z25 } from "zod";
+
+// src/lib/identity-contradiction-lint.ts
+var DELEGATION_VERB = /\b(route|routing|assign|assigning|delegat\w*|dispatch\w*|hand\s*off|handing\s*off)\b/i;
+var LEGACY_MECHANISM = /\b(create_task|tmux)\b/i;
+var CAVEAT = /\b(subagent|rung|legacy|Agent\(subagent_type)\b/i;
+var CONTEXT_WINDOW = 220;
+function lintIdentityContradictions(content) {
+  const findings = [];
+  const lines = content.split("\n");
+  let offset = 0;
+  const lineOffsets = [];
+  for (const line of lines) {
+    lineOffsets.push(offset);
+    offset += line.length + 1;
+  }
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!DELEGATION_VERB.test(line) || !LEGACY_MECHANISM.test(line)) continue;
+    const start = Math.max(0, lineOffsets[i] - CONTEXT_WINDOW);
+    const end = Math.min(content.length, lineOffsets[i] + line.length + CONTEXT_WINDOW);
+    const context = content.slice(start, end);
+    if (CAVEAT.test(context)) continue;
+    findings.push({
+      rule: "create_task-as-default-delegation",
+      reason: "Reads as if create_task/tmux is the default way to route/assign/delegate work, with no nearby mention of subagent, rung, legacy, or Agent(subagent_type. Per the platform Dispatch Ladder, subagents are the default for delegation and create_task/tmux is a legacy rung-3 exception (work that must outlive the session or cross sessions/projects). Uncaveated wording like this caused a real mis-dispatch incident.",
+      excerpt: line.trim()
+    });
+  }
+  return findings;
+}
+function formatIdentityContradictionWarning(agentId, findings) {
+  if (findings.length === 0) return null;
+  const lines = findings.map((f) => `  - "${f.excerpt}"`).join("\n");
+  return `\u26A0\uFE0F Possible policy contradiction in ${agentId}'s new identity content (${findings.length} line${findings.length === 1 ? "" : "s"} flagged, write still applied):
+${lines}
+${findings[0].reason} This is a lint, not a block \u2014 review the flagged line(s) and caveat them (mention subagent/rung/legacy) if the concern applies.`;
+}
+
+// src/mcp/tools/update-identity.ts
 function registerUpdateIdentity(server) {
   server.registerTool(
     "update_identity",
@@ -4380,10 +4602,17 @@ function registerUpdateIdentity(server) {
         agent_id: z25.string().describe("Target agent whose identity to write"),
         content: z25.string().describe(
           "Full markdown content with YAML frontmatter. Must include ---\\nrole: ...\\ntitle: ...\\n---\\n and body sections."
+        ),
+        // OPTIONAL, so every existing caller keeps working unchanged.
+        expected_content_hash: z25.string().optional().describe(
+          "The `contentHash` of the identity you READ before editing. Supply it to make this a compare-and-swap: the write is refused if anyone changed the identity in between, instead of silently overwriting their change. Strongly recommended for any edit derived from a previous read."
+        ),
+        confirmShrink: z25.boolean().optional().describe(
+          "Required (set true) to replace an existing identity with a substantially smaller one (a >50% shrink). Default false: a large shrink is refused to prevent accidental data loss. Blanking or near-total truncation is refused even when this is true."
         )
       }
     },
-    async ({ agent_id, content }) => {
+    async ({ agent_id, content, expected_content_hash, confirmShrink }) => {
       const caller = getActiveAgent();
       const allowed = canCoordinate(caller.agentId, caller.agentRole);
       if (!allowed) {
@@ -4404,13 +4633,59 @@ function registerUpdateIdentity(server) {
           isError: true
         };
       }
-      const existing = getIdentity(agent_id);
-      await updateIdentity(agent_id, content, caller.agentId);
-      const action = existing ? "Updated" : "Created";
+      let existed = false;
+      let refusal = null;
+      try {
+        await mutateIdentity(
+          agent_id,
+          (current) => {
+            existed = current !== null;
+            if (expected_content_hash !== void 0 && (current?.contentHash ?? "") !== expected_content_hash) {
+              refusal = `REFUSED: "${agent_id}"'s identity changed after you read it (you expected ${expected_content_hash || "no file"}, it is now ${current?.contentHash ?? "no file"}). Your write was NOT applied. Re-read the identity, re-apply your edit on top of the current content, and retry.`;
+              return null;
+            }
+            const dropped = current ? promotedRulesDropped(current.raw, content) : [];
+            if (dropped.length > 0) {
+              refusal = `REFUSED: this write would delete ${dropped.length} promoted lesson(s) from "${agent_id}"'s identity: ${dropped.join(", ")}. Their source behaviours are already deactivated, so the identity file holds the ONLY remaining copy \u2014 dropping them would leave those rules enforced nowhere. Your write was NOT applied. Re-read the identity, keep the promoted lessons you did not intend to remove, and retry. To remove one deliberately, delete its line in a write that keeps the others.`;
+              return null;
+            }
+            return content;
+          },
+          caller.agentId,
+          // The shrink guard is opt-out per call, never blanket-disabled: only
+          // an explicit confirmShrink relaxes it, and the catastrophic floor
+          // (blank body / frontmatter drop / near-total truncation) holds even
+          // then.
+          confirmShrink ? { allowShrink: true } : {}
+        );
+      } catch (err) {
+        if (err instanceof IdentityWriteError) {
+          return {
+            content: [{
+              type: "text",
+              text: `Identity write refused: ${err.message}` + (confirmShrink ? "" : `
+
+If this substantial shrink is intentional, re-send with confirmShrink: true. (Blanking, dropping the YAML frontmatter, or near-total truncation is refused even with confirmShrink.)`)
+            }],
+            isError: true
+          };
+        }
+        throw err;
+      }
+      if (refusal !== null) {
+        return { content: [{ type: "text", text: refusal }], isError: true };
+      }
+      const action = existed ? "Updated" : "Created";
+      let responseText = `${action} identity for "${agent_id}". File: ~/.exe-os/identity/${agent_id}.md`;
+      const findings = lintIdentityContradictions(content);
+      const warning = formatIdentityContradictionWarning(agent_id, findings);
+      if (warning) responseText += `
+
+${warning}`;
       return {
         content: [{
           type: "text",
-          text: `${action} identity for "${agent_id}". File: ~/.exe-os/identity/${agent_id}.md`
+          text: responseText
         }]
       };
     }
@@ -4543,8 +4818,8 @@ function registerIngestDocument(server) {
     },
     async (input) => {
       try {
-        const { assertFeature: assertFeature2 } = await import("./plan-limits-FUN76LYY.js");
-        const { assertMemoryLimit: assertMemoryLimit2 } = await import("./plan-limits-FUN76LYY.js");
+        const { assertFeature: assertFeature2 } = await import("./plan-limits-ISRRGF23.js");
+        const { assertMemoryLimit: assertMemoryLimit2 } = await import("./plan-limits-ISRRGF23.js");
         await assertFeature2("wiki");
         await assertMemoryLimit2();
         const result3 = await ingestDocument(input);
@@ -4615,8 +4890,8 @@ function registerPurgeDocument(server) {
     },
     async ({ document_id }) => {
       try {
-        const { StewardGate: StewardGate2 } = await import("./steward-gate-BFCCMCSW.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-ONPPEWQV.js");
+        const { StewardGate: StewardGate2 } = await import("./steward-gate-KMLS5ECC.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-BOBBUJ74.js");
         const steward = new StewardGate2();
         const agent = getActiveAgent2();
         const gateDecision = await steward.checkAuthority(agent.agentId || "unknown", "purge_document", document_id);
@@ -4786,7 +5061,7 @@ function registerDocument(server) {
       const { action: _action, ...legacyArgs } = input;
       if (action === "list" && (legacyArgs.workspace_id === void 0 || legacyArgs.workspace_id === null || legacyArgs.workspace_id === "")) {
         try {
-          const { resolveDefaultWorkspaceId, listWorkspaces } = await import("./documents-C4SSPJMC.js");
+          const { resolveDefaultWorkspaceId, listWorkspaces } = await import("./documents-HWEJMONR.js");
           const defaultId = await resolveDefaultWorkspaceId();
           if (defaultId) {
             legacyArgs.workspace_id = defaultId;
@@ -5786,7 +6061,7 @@ async function handleStatus() {
     detail: wikiUrl ? `API at ${wikiUrl}` : "EXE_WIKI_API_URL not set"
   };
   try {
-    await import("./graph-rag-Z2KCJTPK.js");
+    await import("./graph-rag-JA7XN7NO.js");
     sinks.entity_extraction = { configured: true, detail: "GraphRAG available" };
   } catch {
     sinks.entity_extraction = { configured: false, detail: "graph-rag module unavailable" };
@@ -5813,7 +6088,7 @@ async function handleTrigger(limit) {
     if (rows.rows.length === 0) {
       return text3("No conversations found to re-process.");
     }
-    const { ingest } = await import("./pipeline-router-6GGT2ZW3.js");
+    const { ingest } = await import("./pipeline-router-NKYAUR3Y.js");
     const results = [];
     for (const row of rows.rows) {
       const r = row;
@@ -6278,34 +6553,36 @@ function registerGetHotEntities(server) {
       description: "Get trending entities \u2014 those with the most new relationships in a time period. Surfaces what's most active in the knowledge graph.",
       inputSchema: {
         period: z43.enum(["24h", "7d", "30d"]).default("7d").describe("Time period to look back"),
-        limit: z43.number().int().min(1).max(50).default(10).describe("Max entities to return")
+        limit: z43.number().int().min(1).max(50).default(10).describe("Max entities to return"),
+        project_name: z43.string().optional().describe("Scope results to a single project")
       }
     },
-    async ({ period, limit, since: sinceInput }) => {
+    async ({ period, limit, since: sinceInput, project_name: projectName }) => {
       try {
         const client = getClient();
         let since;
         if (sinceInput) {
           since = new Date(sinceInput);
         } else {
-          since = new Date(Date.now() - (PERIOD_MS[period] ?? PERIOD_MS["7d"]));
+          since = new Date(Date.now() - (PERIOD_MS[period ?? "7d"] ?? PERIOD_MS["7d"]));
         }
         if (isNaN(since.getTime())) {
           since = new Date(Date.now() - PERIOD_MS["7d"]);
         }
-        const hotEntities = await getHotEntities(client, since, limit);
+        const periodLabel = period ?? (sinceInput ? `since ${sinceInput}` : "7d");
+        const hotEntities = await getHotEntities(client, since, limit, projectName);
         if (hotEntities.length === 0) {
           return {
             content: [
               {
                 type: "text",
-                text: `No entity activity found in the last ${period}.`
+                text: `No entity activity found in the last ${periodLabel}${projectName ? ` for project "${projectName}"` : ""}.`
               }
             ]
           };
         }
         const lines = [];
-        lines.push(`## Hot Entities (${period})
+        lines.push(`## Hot Entities (${periodLabel}${projectName ? ` \u2014 ${projectName}` : ""})
 `);
         lines.push("| Rank | Entity | Type | New Relationships |");
         lines.push("|------|--------|------|-------------------|");
@@ -6341,15 +6618,16 @@ function registerGetGraphStats(server) {
       title: "Get Graph Stats",
       description: "Get knowledge graph summary statistics: entity count, relationship count, and entity type breakdown.",
       inputSchema: {
-        _dummy: z44.string().optional().describe("Unused \u2014 no input required")
+        project_name: z44.string().optional().describe("Scope stats to a single project")
       }
     },
-    async () => {
+    async ({ project_name: projectName }) => {
       try {
         const client = getClient();
-        const stats = await getGraphStats(client);
+        const stats = await getGraphStats(client, projectName);
         const lines = [];
-        lines.push("## Knowledge Graph Stats\n");
+        lines.push(`## Knowledge Graph Stats${projectName ? ` \u2014 ${projectName}` : ""}
+`);
         lines.push(`- **Entities:** ${stats.entities.toLocaleString()}`);
         lines.push(`- **Relationships:** ${stats.relationships.toLocaleString()}`);
         const density = stats.entities > 1 ? (2 * stats.relationships / (stats.entities * (stats.entities - 1))).toFixed(4) : "N/A";
@@ -6469,8 +6747,8 @@ function registerMergeEntities(server) {
         };
       }
       try {
-        const { StewardGate: StewardGate2 } = await import("./steward-gate-BFCCMCSW.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-ONPPEWQV.js");
+        const { StewardGate: StewardGate2 } = await import("./steward-gate-KMLS5ECC.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-BOBBUJ74.js");
         const steward = new StewardGate2();
         const agent = getActiveAgent2();
         const sourceLabel2 = source_name ?? source_id;
@@ -6684,7 +6962,7 @@ async function handleExtractFromDocument(args) {
     return errorResult8('graph action "extract_from_document" requires document_id');
   }
   try {
-    const { extractGraphFromExistingDocument } = await import("./doc-graph-extractor-PQHDHQPQ.js");
+    const { extractGraphFromExistingDocument } = await import("./doc-graph-extractor-HOKOV7BE.js");
     const result3 = await extractGraphFromExistingDocument(documentId);
     const lines = [
       `## Graph Extraction for Document ${documentId}`,
@@ -6711,7 +6989,7 @@ async function handleCleanupGarbage(args) {
   const doMerge = !garbageOnly;
   let mod;
   try {
-    mod = await import("./cleanup-graph-garbage-DPJGO52H.js");
+    mod = await import("./cleanup-graph-garbage-LAPIZGFX.js");
   } catch (err) {
     return errorResult8(`cleanup_garbage: failed to load cleanup module \u2014 ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -7492,7 +7770,8 @@ function registerGetAutoWakeStatus(server) {
         const taskResult = await client.execute({
           sql: `SELECT assigned_to, COUNT(*) as cnt
            FROM tasks
-           WHERE status IN ('open', 'in_progress')${awScope.sql}
+           WHERE status IN ('open', 'in_progress')
+             AND execution_mode = 'durable_tmux'${awScope.sql}
            GROUP BY assigned_to
            ORDER BY cnt DESC`,
           args: [...awScope.args]
@@ -7501,7 +7780,8 @@ function registerGetAutoWakeStatus(server) {
         const blockedResult = await client.execute({
           sql: `SELECT assigned_to, title, result
            FROM tasks
-           WHERE status = 'blocked'${blScope.sql}
+           WHERE status = 'blocked'
+             AND execution_mode = 'durable_tmux'${blScope.sql}
            ORDER BY updated_at DESC
            LIMIT 10`,
           args: [...blScope.args]
@@ -7608,7 +7888,7 @@ async function getAgentSessionLoad() {
       return { sessions: [], totalLive: 0, busySessions: 0, idleSessions: 0 };
     }
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { sessionScopeFilter: sessionScopeFilter2 } = await import("./task-scope-ERVEUEYU.js");
+    const { sessionScopeFilter: sessionScopeFilter2 } = await import("./task-scope-QANJJXXB.js");
     const client = getClient2();
     const scope = sessionScopeFilter2();
     for (const s of liveAgentSessions) {
@@ -8015,7 +8295,7 @@ async function cloudStatusText() {
   if (lastReuploadedAt) lines.push(`- Last re-upload: ${lastReuploadedAt}`);
   lines.push("");
   try {
-    const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-5D7O6VH6.js");
+    const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-FCEDWN2P.js");
     const h = await getRetrievalHealth2();
     lines.push(formatDegradations2(h.degradations, "Health / Degradations"));
     lines.push("");
@@ -8044,7 +8324,7 @@ function registerCloudSync(server) {
         confirm_local_db_source_of_truth: z60.string().optional().describe('Required for action=reupload. Must exactly equal "LOCAL DB IS SOURCE OF TRUTH".')
       }
     },
-    async ({ action = "sync", confirm_local_db_source_of_truth }) => {
+    async ({ action = "sync", force = false, confirm_local_db_source_of_truth }) => {
       try {
         if (action === "status") {
           return result(await cloudStatusText());
@@ -8067,18 +8347,32 @@ function registerCloudSync(server) {
               true
             );
           }
-          await clearCloudReuploadRequired(client);
+          const isRetry = await getCloudReuploadInProgress(client) && !force;
+          if (!isRetry) {
+            await cloudResetMemoryBlobs({ apiKey: cloud.apiKey, endpoint: cloud.endpoint });
+            await beginCloudReupload(client);
+          }
           let syncResult2;
           try {
-            syncResult2 = await cloudSync({ apiKey: cloud.apiKey, endpoint: cloud.endpoint });
+            syncResult2 = await cloudSync(
+              { apiKey: cloud.apiKey, endpoint: cloud.endpoint },
+              { allowKeyRotationReupload: true }
+            );
           } catch (err) {
-            await markCloudReuploadRequired(client);
+            await markCloudReuploadIncomplete(client);
             throw err;
           }
+          const reuploadMemoryPushFailed = (syncResult2.memoryPushErrors ?? 0) > 0;
+          const reuploadPendingMemories = syncResult2.pendingMemories ?? 0;
+          if (syncResult2.deferred || reuploadMemoryPushFailed) {
+            await markCloudReuploadIncomplete(client);
+          } else {
+            await clearCloudReuploadRequired(client);
+          }
           return result([
-            "## Cloud Re-upload Complete",
+            syncResult2.deferred ? "## Cloud Re-upload Paused" : reuploadMemoryPushFailed ? "## Cloud Re-upload Incomplete" : "## Cloud Re-upload Complete",
             "",
-            "Normal cloud sync is safe again. Other devices must reconnect using the current 24-word recovery phrase.",
+            syncResult2.deferred ? "Memories are still queued \u2014 the re-upload stopped after a bounded slice. Run it again until it reports complete." : reuploadMemoryPushFailed ? `Re-upload did NOT complete \u2014 ${reuploadPendingMemories.toLocaleString()} memor${reuploadPendingMemories === 1 ? "y" : "ies"} could not be pushed and remain queued locally. The memory push failed (network error or version conflict). Run it again until it reports complete.` : "Normal cloud sync is safe again. Other devices must reconnect using the current 24-word recovery phrase.",
             "",
             `- Active memories: ${syncResult2.totalMemories.toLocaleString()} (\u2191 ${syncResult2.pushed.toLocaleString()} syncable rows pushed, \u2193 ${syncResult2.pulled.toLocaleString()} pulled)`,
             `- Behaviors: \u2191 ${syncResult2.behaviors.pushed.toLocaleString()}, \u2193 ${syncResult2.behaviors.pulled.toLocaleString()}`,
@@ -8092,7 +8386,11 @@ function registerCloudSync(server) {
           endpoint: cloud.endpoint
         });
         const lines = [];
-        lines.push("## Cloud Sync Complete\n");
+        const memoryPushFailed = (syncResult.memoryPushErrors ?? 0) > 0;
+        const pendingMemories = syncResult.pendingMemories ?? 0;
+        lines.push(
+          syncResult.deferred ? "## Cloud Sync Paused\n" : memoryPushFailed ? "## Cloud Sync Incomplete\n" : "## Cloud Sync Complete\n"
+        );
         lines.push("| Category | Pushed | Pulled |");
         lines.push("|----------|--------|--------|");
         lines.push(`| Memories | ${syncResult.pushed.toLocaleString()} | ${syncResult.pulled.toLocaleString()} |`);
@@ -8104,6 +8402,17 @@ function registerCloudSync(server) {
         lines.push("");
         lines.push(`**Active memories:** ${syncResult.totalMemories.toLocaleString()}`);
         lines.push(`**Roster:** ${syncResult.roster.employees} employees, ${syncResult.roster.identities} identities`);
+        if (syncResult.deferred) {
+          lines.push("");
+          lines.push(
+            "Sync paused after a bounded memory slice \u2014 memories are still queued and the later stages did not run. Run it again (or let the background sync continue) until it reports complete."
+          );
+        } else if (memoryPushFailed) {
+          lines.push("");
+          lines.push(
+            `Sync did NOT complete \u2014 ${pendingMemories.toLocaleString()} memor${pendingMemories === 1 ? "y" : "ies"} could not be pushed and remain queued locally. The memory push failed (network error or version conflict) and the cursor did not advance, so the cloud copy is missing these rows. Run it again until it reports complete.`
+          );
+        }
         return result(lines.join("\n"));
       } catch (err) {
         return result(`Cloud operation failed: ${err instanceof Error ? err.message : String(err)}`, true);
@@ -9522,7 +9831,7 @@ function registerCreateTrigger(server) {
         };
       }
       const normalizedConditions = conditions == null ? [] : conditions;
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-FUN76LYY.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-ISRRGF23.js");
       const gatedActions = {
         send_whatsapp: "external_agents",
         update_wiki: "wiki"
@@ -10590,8 +10899,8 @@ function buildHandlers5() {
 }
 async function handleDreaming(action, args) {
   try {
-    const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-XAO3FCBV.js");
-    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-ONPPEWQV.js");
+    const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-FMNDODG2.js");
+    const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-BOBBUJ74.js");
     const { getClient: getClient2 } = await import("./lib/database.js");
     const agentId = args.agent_id ?? getActiveAgent2().agentId;
     if (action === "dreaming_run") {
@@ -10795,11 +11104,11 @@ function registerConfig(server) {
     }
     if (action === "closeout") {
       try {
-        const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-XAO3FCBV.js");
-        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-ONPPEWQV.js");
+        const { DreamingEngine: DreamingEngine2 } = await import("./dreaming-FMNDODG2.js");
+        const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-BOBBUJ74.js");
         const { writeMemory: writeMemory2, flushBatch: flushBatch2 } = await import("./lib/store.js");
         const { randomUUID: randomUUID2 } = await import("crypto");
-        const { getProjectName: getProjectName2 } = await import("./project-name-LJVFMYTQ.js");
+        const { getProjectName: getProjectName2 } = await import("./project-name-WKSNNKXK.js");
         const { retryOnDaemonTransportError } = await import("./lib/db-daemon-client.js");
         const agentId = args.agent_id ?? getActiveAgent2().agentId;
         const hours = args.hours ?? 24;
@@ -10877,7 +11186,7 @@ function registerConfig(server) {
     }
     if (action === "capability_cards") {
       try {
-        const { getAllCapabilityCards, findAgentForTask } = await import("./capability-cards-5IMJT6J7.js");
+        const { getAllCapabilityCards, findAgentForTask } = await import("./capability-cards-EDZ62HKG.js");
         const cards = getAllCapabilityCards();
         const taskQuery = args.query;
         if (taskQuery) {
@@ -10928,7 +11237,7 @@ function registerConfig(server) {
         const existing = loadEmployeesSync2();
         if (existing.some((e) => e.name === employeeName)) return errorResult9(`Employee "${employeeName}" already exists.`);
         try {
-          const { assertEmployeeLimit: assertEmployeeLimit2 } = await import("./plan-limits-FUN76LYY.js");
+          const { assertEmployeeLimit: assertEmployeeLimit2 } = await import("./plan-limits-ISRRGF23.js");
           await assertEmployeeLimit2();
         } catch (e) {
           return errorResult9(e instanceof Error ? e.message : "Employee limit reached.");
@@ -10969,7 +11278,7 @@ You are ${employeeName}. Role: ${role}.`, "utf-8");
         }
         try {
           const { generateSessionWrappers } = await import("./lib/session-wrappers.js");
-          const { resolvePackageRoot } = await import("./installer-LLWKZI2S.js");
+          const { resolvePackageRoot } = await import("./installer-S624ZOMB.js");
           generateSessionWrappers(resolvePackageRoot());
         } catch {
         }
@@ -10982,7 +11291,7 @@ You are ${employeeName}. Role: ${role}.`, "utf-8");
     }
     if (action === "restart_telemetry") {
       try {
-        const { buildRestartReport, formatRestartReport } = await import("./daemon-restart-report-EIVD6WDJ.js");
+        const { buildRestartReport, formatRestartReport } = await import("./daemon-restart-report-FIO5HZTJ.js");
         const report = buildRestartReport();
         const humanReadable = formatRestartReport(report);
         return {
@@ -11066,7 +11375,7 @@ function registerListWikiPages(server) {
       }
     },
     async ({ workspace, folder }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-FUN76LYY.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-ISRRGF23.js");
       await assertFeature2("wiki");
       const apiUrl = process.env.EXE_WIKI_API_URL;
       const apiKey = process.env.EXE_WIKI_API_KEY;
@@ -11166,7 +11475,7 @@ function registerGetWikiPage(server) {
       }
     },
     async ({ workspace, document_id, title }) => {
-      const { assertFeature: assertFeature2 } = await import("./plan-limits-FUN76LYY.js");
+      const { assertFeature: assertFeature2 } = await import("./plan-limits-ISRRGF23.js");
       await assertFeature2("wiki");
       const apiUrl = process.env.EXE_WIKI_API_URL;
       const apiKey = process.env.EXE_WIKI_API_KEY;
@@ -11360,10 +11669,10 @@ async function handleWikiSearch(input) {
   const userId = input.user_id;
   if (!workspace) return errorResult10('wiki action "search" requires workspace');
   if (!query) return errorResult10('wiki action "search" requires query');
-  const { assertFeature: assertFeature2 } = await import("./plan-limits-FUN76LYY.js");
+  const { assertFeature: assertFeature2 } = await import("./plan-limits-ISRRGF23.js");
   await assertFeature2("wiki");
   if (userId) {
-    const { checkWikiAccess } = await import("./wiki-acl-IBQLLBTS.js");
+    const { checkWikiAccess } = await import("./wiki-acl-MFOYK5F4.js");
     const { allowed } = await checkWikiAccess(String(userId), String(workspace), "read");
     if (!allowed) {
       return errorResult10(`Access denied: user "${userId}" does not have read access to workspace "${workspace}"`);
@@ -11466,7 +11775,7 @@ function registerWiki(server) {
         return errorResult10('wiki action "document_rerank" requires at least one candidate');
       }
       if (user_id && legacyArgs.workspace) {
-        const { checkWikiAccess } = await import("./wiki-acl-IBQLLBTS.js");
+        const { checkWikiAccess } = await import("./wiki-acl-MFOYK5F4.js");
         const { allowed } = await checkWikiAccess(
           String(user_id),
           String(legacyArgs.workspace),
@@ -11518,9 +11827,9 @@ function registerBehavior(server) {
     "behavior",
     {
       title: "Behavior",
-      description: "Manage behavioral patterns, corrections, and reusable procedures for employees. Actions: store (create new), list (query existing), audit (creation context), deactivate (soft-delete, restricted), reactivate (re-enable deactivated, restricted), purge (hard-delete inactive, or purge_ghosts=true to delete corrupt empty/null-id rows; restricted).",
+      description: "Manage behavioral patterns, corrections, and reusable procedures for employees. Actions: store (create new), list (query existing), audit (creation context), deactivate (soft-delete, restricted), reactivate (re-enable deactivated, restricted), purge (hard-delete inactive, or purge_ghosts=true to delete corrupt empty/null-id rows; restricted), promote (move a long-stable behavior into the agent's identity file and free its injection slot; restricted), promotable (list behaviors that clear the stability filter).",
       inputSchema: {
-        action: z83.enum(["store", "list", "deactivate", "reactivate", "audit", "purge"]).describe("Action to perform"),
+        action: z83.enum(["store", "list", "deactivate", "reactivate", "audit", "purge", "promote", "promotable"]).describe("Action to perform"),
         content: z83.string().superRefine((val, ctx) => {
           if (val.length > BEHAVIOR_CONTENT_MAX_LENGTH) {
             ctx.addIssue({
@@ -11547,10 +11856,12 @@ function registerBehavior(server) {
         older_than_days: z83.coerce.number().int().min(0).optional().describe("For purge: only hard-delete inactive behaviors older than this many days. Default 30."),
         dry_run: z83.boolean().optional().default(true).describe("For purge: preview by default; set false to permanently delete matching inactive behaviors."),
         purge_ghosts: z83.boolean().optional().describe("For purge: target ghost rows (empty content or NULL id) regardless of active status / age, instead of aged inactive behaviors. Use to clean up corrupt rows that flood behavior list. (purge)"),
+        min_stable_days: z83.coerce.number().int().min(0).optional().describe("For promote/promotable: how many days a behavior must have been active and unchanged. Default 30. NOTE: this measures stability, not measured adherence \u2014 there is no violation telemetry on behaviors."),
+        force: z83.boolean().optional().describe("For promote: skip the stability filter for a deliberate, human-directed promotion."),
         bulk: z83.boolean().optional().describe("For purge with purge_ghosts=true: drain ALL ghost rows in bounded batches in a single call (handles millions of rows safely) and VACUUM. Use when the ghost table is too large to clear 1000-at-a-time. (purge)")
       }
     },
-    async ({ action, content, domain, priority, trigger, trigger_action, agent_id, project_name, behavior_id, shared_skills, device_scoped, limit, offset, older_than_days, dry_run, purge_ghosts, bulk }) => {
+    async ({ action, content, domain, priority, trigger, trigger_action, agent_id, project_name, behavior_id, shared_skills, device_scoped, limit, offset, older_than_days, dry_run, purge_ghosts, bulk, min_stable_days, force }) => {
       if (action === "list") {
         if (shared_skills) {
           const currentAgent = agent_id ?? getActiveAgent().agentId;
@@ -11733,8 +12044,8 @@ Trigger: ${trigger}
 Action: ${trigger_action}
 Priority: p0 (always injected). The agent decides whether to act.` : `Behavior stored for ${resolvedAgent}. ID: ${id}`;
         try {
-          const { countActiveBehaviors } = await import("./behaviors-ZJ45TFBJ.js");
-          const { formatOverCapWarning } = await import("./behavior-injection-M6UYZCMW.js");
+          const { countActiveBehaviors } = await import("./behaviors-GPI4BLTC.js");
+          const { formatOverCapWarning } = await import("./behavior-injection-GMZKZ3BT.js");
           const counts = await countActiveBehaviors(resolvedAgent, resolvedProject);
           const warning = formatOverCapWarning(resolvedAgent, counts);
           if (warning) responseText += `
@@ -11822,7 +12133,7 @@ Use /exe-forget to remove any that this supersedes.`;
                 }]
               };
             }
-            const { bulkPurgeGhostBehaviors } = await import("./behaviors-ZJ45TFBJ.js");
+            const { bulkPurgeGhostBehaviors } = await import("./behaviors-GPI4BLTC.js");
             const res = await bulkPurgeGhostBehaviors({ batchSize: 5e3, vacuum: true });
             return {
               content: [{
@@ -11919,6 +12230,63 @@ Use /exe-forget to remove any that this supersedes.`;
           content: [{ type: "text", text: `Purged ${ids.length} inactive behavior(s).` }]
         };
       }
+      if (action === "promotable") {
+        const targetAgent = agent_id ?? getActiveAgent().agentId;
+        const { listPromotionCandidates, DEFAULT_MIN_STABLE_DAYS } = await import("./behavior-promotion-QPC4AQ24.js");
+        const candidates = await listPromotionCandidates(targetAgent, {
+          projectName: project_name,
+          minStableDays: min_stable_days,
+          limit: limit ?? 100
+        });
+        if (candidates.length === 0) {
+          return { content: [{ type: "text", text: `No behaviors for ${targetAgent} have been active and unchanged for ${min_stable_days ?? DEFAULT_MIN_STABLE_DAYS} days.` }] };
+        }
+        const lines = candidates.map(
+          (c) => `- [${c.behavior.priority}] ${c.behavior.content.slice(0, 160)}
+  ID: ${c.behavior.id} \u2014 stable ${c.eligibility.stableDays}d`
+        );
+        return {
+          content: [{
+            type: "text",
+            text: `${candidates.length} promotable behavior(s) for ${targetAgent}.
+
+Promotion moves a rule into the identity file, which is injected on a SEPARATE path from behaviors \u2014 so each promotion frees one behavior injection slot. "Stable" here means active and unchanged, NOT measured adherence: there is no violation telemetry on behaviors, and a check that implied otherwise would be reporting on nothing.
+
+` + lines.join("\n")
+          }]
+        };
+      }
+      if (action === "promote") {
+        const caller2 = getActiveAgent();
+        if (!canCoordinate(caller2.agentId, caller2.agentRole)) {
+          return { content: [{ type: "text", text: `Permission denied. Only coordinator or founder can promote behaviors. You are "${caller2.agentId}".` }], isError: true };
+        }
+        if (!behavior_id) {
+          return { content: [{ type: "text", text: "Missing required field: behavior_id is required for promote action." }], isError: true };
+        }
+        const targetAgent = agent_id ?? caller2.agentId;
+        const { promoteBehaviorToIdentity } = await import("./behavior-promotion-QPC4AQ24.js");
+        const result4 = await promoteBehaviorToIdentity({
+          behaviorId: behavior_id,
+          agentId: targetAgent,
+          promotedBy: caller2.agentId,
+          projectName: project_name,
+          minStableDays: min_stable_days,
+          force
+        });
+        if (!result4.promoted) {
+          return { content: [{ type: "text", text: `Not promoted: ${result4.reason}` }], isError: true };
+        }
+        const r = result4.record;
+        return {
+          content: [{
+            type: "text",
+            text: `Promoted behavior ${r.behaviorId} into ${r.agentId}'s identity.
+Stable for ${r.stableDays} days; promoted by ${r.promotedBy}.
+` + (r.slotFreed ? `Source behavior deactivated \u2014 ONE behavior injection slot freed.` : `WARNING: the source behavior could NOT be deactivated, so this rule is now live in BOTH the identity file and the behavior set. Deactivate it manually: behavior(action='deactivate', behavior_id='${r.behaviorId}').`)
+          }]
+        };
+      }
       if (action === "reactivate") {
         const caller2 = getActiveAgent();
         if (!canCoordinate(caller2.agentId, caller2.agentRole)) {
@@ -11933,7 +12301,7 @@ Use /exe-forget to remove any that this supersedes.`;
           return { content: [{ type: "text", text: `Behavior not found: ${behavior_id}` }], isError: true };
         }
         const row2 = result4.rows[0];
-        const { reactivateBehavior: reactivateBehavior2 } = await import("./behaviors-ZJ45TFBJ.js");
+        const { reactivateBehavior: reactivateBehavior2 } = await import("./behaviors-GPI4BLTC.js");
         const wasReactivated = await reactivateBehavior2(behavior_id);
         if (!wasReactivated) {
           return { content: [{ type: "text", text: `Behavior ${behavior_id} is already active.` }] };
@@ -12476,7 +12844,7 @@ function registerWorkflowTool(server) {
         getWorkflowInstance,
         listWorkflowInstances,
         approveWorkflowStep
-      } = await import("./workflow-engine-5X46PFCW.js");
+      } = await import("./workflow-engine-RZ7QEI3Z.js");
       try {
         switch (input.action) {
           case "create_workflow": {
@@ -12694,7 +13062,7 @@ async function maybeSendUpstream(payload) {
       body,
       signal: AbortSignal.timeout(1e4)
     });
-    if (!response.ok) return `failed: HTTP ${response.status}`;
+    if (!response.ok) return `failed: ${await describeUpstreamFailure(response)}`;
     if (encrypted) return "sent (encrypted)";
     const parts = ["sanitized"];
     if (redactedCount > 0) parts.push(`${redactedCount} secret${redactedCount === 1 ? "" : "s"} redacted`);
@@ -12781,7 +13149,7 @@ function registerCreateBugReport(server) {
       const version = sanitizeVersionField(package_version) ?? "unknown";
       let metricsSnapshot = "";
       try {
-        const { getOrchestrationMetrics, formatOrchestrationMetrics } = await import("./orchestration-events-N7LYMUGA.js");
+        const { getOrchestrationMetrics, formatOrchestrationMetrics } = await import("./orchestration-events-JPHB6NPY.js");
         const sinceIso = new Date(Date.now() - 60 * 60 * 1e3).toISOString();
         const metrics = await getOrchestrationMetrics({ sinceIso });
         if (metrics.totalEvents > 0) {
@@ -13001,7 +13369,7 @@ async function maybeSendUpstream2(payload) {
       body: outboundBody,
       signal: AbortSignal.timeout(1e4)
     });
-    if (!response.ok) return `failed: HTTP ${response.status}`;
+    if (!response.ok) return `failed: ${await describeUpstreamFailure(response)}`;
     const parts = ["sanitized"];
     if (redactedCount > 0) parts.push(`${redactedCount} secret${redactedCount === 1 ? "" : "s"} redacted`);
     if (truncatedCount > 0) parts.push(`${truncatedCount} field${truncatedCount === 1 ? "" : "s"} truncated`);
@@ -13285,6 +13653,39 @@ async function buildUpdateSection(filePath, opts) {
   const titleMatch = existing.match(/^# Bug Report — (.+)$/m);
   return { title: titleMatch?.[1] ?? "Unknown bug", updateBlock };
 }
+async function collectBugAuthorIdentities(id) {
+  const identities = [];
+  try {
+    const resolved = await findReportFile(id);
+    if (resolved) {
+      const content = await readFile2(resolved.filePath, "utf-8");
+      const filedBy = content.match(/^filed_by:\s*(.+)$/m)?.[1]?.trim();
+      if (filedBy) identities.push(filedBy);
+    }
+  } catch {
+  }
+  try {
+    const config = await loadConfig();
+    const adminToken = resolveSupportAdminToken(config);
+    if (adminToken) {
+      const support = config.support;
+      const base = (process.env.ASKEXE_SUPPORT_ADMIN_ENDPOINT || support?.adminEndpoint || support?.admin_endpoint || "https://api.askexe.com/admin/support/bug-reports").replace(/\/+$/, "");
+      const parsed = new URL(`${base}/${encodeURIComponent(sanitizeUpstreamId(id))}`);
+      if (parsed.protocol === "https:" || ["localhost", "127.0.0.1", "::1"].includes(parsed.hostname)) {
+        const resp = await fetch(parsed, {
+          headers: { authorization: `Bearer ${adminToken}` },
+          signal: AbortSignal.timeout(5e3)
+        });
+        if (resp.ok) {
+          const row = await resp.json();
+          identities.push(row?.agent_id, row?.license_email);
+        }
+      }
+    }
+  } catch {
+  }
+  return identities;
+}
 async function sendUpstream(payload, isAdmin) {
   const config = await loadConfig();
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
@@ -13318,7 +13719,7 @@ async function sendUpstream(payload, isAdmin) {
       body: sanitizedUpstreamBody(payload, "update-bug-report"),
       signal: AbortSignal.timeout(1e4)
     });
-    if (!response.ok) return `failed: HTTP ${response.status}`;
+    if (!response.ok) return `failed: ${await describeUpstreamFailure(response)}`;
     return "sent";
   } catch (err) {
     return `failed: ${err instanceof Error ? err.message : String(err)}`;
@@ -13382,7 +13783,18 @@ function registerUpdateBugReport(server) {
           content: [{ type: "text", text: describeOversizeRefusal(oversize) }]
         };
       }
-      const resolvedVerification = resolveVerificationArtifact(gatedStatus, verification);
+      const attestsByIdentity = verification.verification_kind === "manual" || verification.verification_kind === "ops_transcript" || verification.disposition !== void 0 && verification.disposition !== "fixed";
+      let resolvedVerification = resolveVerificationArtifact(gatedStatus, verification);
+      if (resolvedVerification.ok && isVerifiedStatus(gatedStatus) && attestsByIdentity) {
+        const authorIdentities = await collectBugAuthorIdentities(id);
+        resolvedVerification = resolveVerificationArtifact(gatedStatus, verification, { authorIdentities });
+        if (!resolvedVerification.ok) {
+          const namedAuthors = authorIdentities.filter((a) => typeof a === "string" && a.trim().length > 0).map((a) => a.trim());
+          const authorNote = resolvedVerification.message.includes("manual_verifier_is_author") && namedAuthors.length > 0 ? `
+This record's author/assignee identities: ${namedAuthors.join(", ")}. Name a DIFFERENT person or employee as the verifier \u2014 a manual close attested by its own author is exactly what the gate exists to refuse, locally and server-side.` : "";
+          return { isError: true, content: [{ type: "text", text: resolvedVerification.message + authorNote }] };
+        }
+      }
       if (!resolvedVerification.ok) {
         return { isError: true, content: [{ type: "text", text: resolvedVerification.message }] };
       }
@@ -13640,7 +14052,7 @@ async function sendUpstream2(payload) {
       body: sanitizedUpstreamBody(payload, "update-feature-request"),
       signal: AbortSignal.timeout(1e4)
     });
-    if (!response.ok) return `failed: HTTP ${response.status}`;
+    if (!response.ok) return `failed: ${await describeUpstreamFailure(response)}`;
     return "sent";
   } catch (err) {
     return `failed: ${err instanceof Error ? err.message : String(err)}`;
@@ -14273,7 +14685,7 @@ function registerCliParityTools(server) {
     const out = await runCommand("exe-os", ["cloud", "status"], 45e3);
     let healthSection = "";
     try {
-      const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-5D7O6VH6.js");
+      const { getRetrievalHealth: getRetrievalHealth2, formatDegradations: formatDegradations2 } = await import("./retrieval-health-FCEDWN2P.js");
       const h = await getRetrievalHealth2();
       const lines = [
         "",
@@ -14317,7 +14729,7 @@ function jsonResult2(value) {
 }
 async function ensureCodeContextWatcher(projectRoot) {
   try {
-    const { startCodeContextWatcher } = await import("./code-context-watcher-VZNZU3BO.js");
+    const { startCodeContextWatcher } = await import("./code-context-watcher-4F7K2N3U.js");
     startCodeContextWatcher(resolveCodeContextProjectRoot(projectRoot));
   } catch {
   }
@@ -14348,7 +14760,7 @@ function registerCodeContext(server) {
       const index = await buildCodeContextIndexAsync(opts);
       let graphExtract;
       try {
-        const { autoExtractGraphEntities } = await import("./graph-auto-extract-3YR3TYRW.js");
+        const { autoExtractGraphEntities } = await import("./graph-auto-extract-7POGAKHM.js");
         graphExtract = await autoExtractGraphEntities(index.projectRoot);
       } catch {
       }
@@ -14813,7 +15225,7 @@ async function maybeSendUpstream3(payload) {
       body: sanitizedUpstreamBody(payload, "create-review"),
       signal: AbortSignal.timeout(1e4)
     });
-    if (!response.ok) return `failed: HTTP ${response.status}`;
+    if (!response.ok) return `failed: ${await describeUpstreamFailure(response)}`;
     return "sent";
   } catch (err) {
     return `failed: ${err instanceof Error ? err.message : String(err)}`;
@@ -15214,7 +15626,7 @@ function registerDiagnostics(server) {
       }
       if (action === "daemon_restarts") {
         try {
-          const { buildRestartReport, formatRestartReport } = await import("./daemon-restart-report-EIVD6WDJ.js");
+          const { buildRestartReport, formatRestartReport } = await import("./daemon-restart-report-FIO5HZTJ.js");
           const verbose = input.format === "verbose";
           const report = buildRestartReport({ topTimers: verbose ? 25 : 10 });
           return { content: [{ type: "text", text: formatRestartReport(report) }] };
@@ -15224,7 +15636,7 @@ function registerDiagnostics(server) {
       }
       if (action === "timers") {
         try {
-          const { buildLiveTimerReport, formatTimerReport } = await import("./daemon-timer-report-TNJH5SFY.js");
+          const { buildLiveTimerReport, formatTimerReport } = await import("./daemon-timer-report-6UK5PSDP.js");
           const report = await buildLiveTimerReport();
           const asJson = input.format === "json";
           return {
@@ -15391,7 +15803,7 @@ async function handleReprojectWorktreeMemories(input) {
   const sessionScope = rawScope;
   try {
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { runReprojectWorktreeMemories, formatReprojectReport } = await import("./reproject-worktree-memories-PWYKPB2U.js");
+    const { runReprojectWorktreeMemories, formatReprojectReport } = await import("./reproject-worktree-memories-DAA5GWMH.js");
     const client = await getClient2();
     const result3 = await runReprojectWorktreeMemories(
       client,
@@ -15410,7 +15822,7 @@ async function handleReprojectWorktreeMemories(input) {
 }
 async function handleMemoryIsolation(input) {
   try {
-    const { queryMemoryIsolation, formatMemoryIsolationReport } = await import("./memory-isolation-2TUZ7Z4K.js");
+    const { queryMemoryIsolation, formatMemoryIsolationReport } = await import("./memory-isolation-3GJ6WLYX.js");
     const agentId = typeof input.agent_id === "string" ? input.agent_id : void 0;
     const allScopes = input.all_scopes === true;
     const sessionScope = typeof input.session_scope === "string" ? input.session_scope : void 0;
@@ -15430,7 +15842,7 @@ async function handleMemoryIsolation(input) {
 }
 async function handleSpawnFailures() {
   try {
-    const { getOrchestrationMetrics } = await import("./orchestration-events-N7LYMUGA.js");
+    const { getOrchestrationMetrics } = await import("./orchestration-events-JPHB6NPY.js");
     const metrics = await getOrchestrationMetrics();
     const c = metrics.counts;
     const attempted = c.tmuxSpawnAttempted;
@@ -15532,7 +15944,7 @@ async function handleOrchestrationHealth() {
 async function handleWorkMap() {
   try {
     const { getAgentLivenessReport } = await import("./agent-heartbeat-CQPGJIFF.js");
-    const { classifyRole } = await import("./session-kill-telemetry-QSPVJGBF.js");
+    const { classifyRole } = await import("./session-kill-telemetry-OHNJMIVT.js");
     const { buildSessionDeathSummary } = await import("./orchestration-health-read-EJWVUARG.js");
     const { getPaneCwd } = await import("./lib/tmux-status.js");
     const live = getAgentLivenessReport();
@@ -15602,7 +16014,7 @@ async function handleWorkMap() {
 async function handleWorkState(input) {
   try {
     const { getClient: getClient2 } = await import("./lib/database.js");
-    const { readWorkState, listWorkStates } = await import("./work-state-heartbeat-P4YX6E2R.js");
+    const { readWorkState, listWorkStates } = await import("./work-state-heartbeat-CH6BLQKV.js");
     const client = await getClient2();
     const sessionScope = typeof input.session_scope === "string" ? input.session_scope.trim() : "";
     if (sessionScope) {
@@ -15704,7 +16116,7 @@ async function handleDrift(input) {
 }
 async function handleSteward(action, input) {
   const gate = new StewardGate();
-  const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-ONPPEWQV.js");
+  const { getActiveAgent: getActiveAgent2 } = await import("./active-agent-BOBBUJ74.js");
   const inputAgent = input.agent_id;
   const operation = input.operation;
   const target = input.target;
@@ -16002,7 +16414,7 @@ function registerResonance(server) {
     }
   }, async ({ action, memory_id, entity_id, limit }) => {
     try {
-      const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-CMNSWS6B.js");
+      const { getHotPairs, getCoActivationNeighbors } = await import("./co-activation-523TKQPZ.js");
       if (action === "hot_pairs") {
         const pairs = await getHotPairs(limit ?? 20);
         if (pairs.length === 0) return text4("No co-activation data yet. Pairs are recorded as memories are accessed together in searches.");
@@ -16331,7 +16743,7 @@ function resolveEndpoint(opts) {
 async function resolveAuth(opts) {
   if (opts.authHeader !== void 0) return opts.authHeader ?? {};
   try {
-    const { getAuthHeader } = await import("./gotrue-session-ODZ2ERJX.js");
+    const { getAuthHeader } = await import("./gotrue-session-U4H3UGHL.js");
     return await getAuthHeader() ?? {};
   } catch {
     return {};