@askexenow/exe-os 0.9.374 → 0.9.376

package/dist/{chunk-EXDW3E2R.js → chunk-VPHJ2LUI.js}

@@ -1,6 +1,14 @@
 import {
   filterTimerWakeClusterArtifacts
 } from "./chunk-YQGMSXT5.js";
+import {
+  POST_AWAIT_ATTRIBUTION,
+  TIMER_HARM_BLOCKING_MS,
+  collectTimerHarmContext,
+  foldTimerHarm,
+  harmIndicator,
+  harmStateLabel
+} from "./chunk-3OX5S7KZ.js";
 
 // src/lib/daemon-restart-report.ts
 import { existsSync, readFileSync, statSync, openSync, readSync, closeSync } from "fs";
@@ -13,6 +21,13 @@ function logPaths(baseName) {
   const dir = logDir();
   return [path.join(dir, baseName), path.join(dir, `${baseName}.1`)];
 }
+var TIMER_BLOCKING_HARM_MS = TIMER_HARM_BLOCKING_MS;
+function timerHarmMs(sample) {
+  if (sample.attribution === POST_AWAIT_ATTRIBUTION) {
+    return Math.max(sample.syncExecMs, sample.peakLagMs);
+  }
+  return sample.syncExecMs;
+}
 function readRecords(files, maxBytes) {
   const records = [];
   for (const file of files) {
@@ -85,6 +100,24 @@ function parseTsMs(ts) {
   const parsed = Date.parse(ts);
   return Number.isFinite(parsed) ? parsed : null;
 }
+function parsePausedIntervals(raw, atMs, wallMs) {
+  if (!Array.isArray(raw) || raw.length === 0) return null;
+  if (atMs === null || wallMs === null || !Number.isFinite(wallMs)) return null;
+  const tickStartMs = atMs - Math.max(0, wallMs);
+  const intervals = [];
+  for (const entry of raw) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const startOffsetMs = entry.startOffsetMs;
+    const endOffsetMs = entry.endOffsetMs;
+    if (typeof startOffsetMs !== "number" || !Number.isFinite(startOffsetMs)) continue;
+    if (typeof endOffsetMs !== "number" || !Number.isFinite(endOffsetMs)) continue;
+    const startMs = tickStartMs + startOffsetMs;
+    const endMs = tickStartMs + endOffsetMs;
+    if (endMs < startMs) continue;
+    intervals.push({ startMs, endMs });
+  }
+  return intervals.length > 0 ? intervals : null;
+}
 function maxIso(a, b) {
   if (!b) return a;
   if (!a) return b;
@@ -124,34 +157,121 @@ function buildRestartReport(opts = {}) {
   const causes = [...causeMap.entries()].map(([cause, v]) => ({ cause, count: v.count, lastSeen: v.lastSeen })).sort((a, b) => b.count - a.count || a.cause.localeCompare(b.cause));
   const totalRestarts = causes.reduce((sum, c) => sum + c.count, 0);
   const rawTimerSamples = [];
+  const watchdogTripsByTimer = /* @__PURE__ */ new Map();
+  const responsiveAwaitLagByTimer = /* @__PURE__ */ new Map();
+  const responsiveAwaitAtByTimer = /* @__PURE__ */ new Map();
+  const harmContext = collectTimerHarmContext(healthRecords, parseTsMs);
   for (const rec of healthRecords) {
+    if (rec.event === "timer_timeout") {
+      const timer2 = typeof rec.data?.timer === "string" ? rec.data.timer : null;
+      if (!timer2) continue;
+      const trips = watchdogTripsByTimer.get(timer2) ?? [];
+      trips.push(parseTsMs(rec.ts));
+      watchdogTripsByTimer.set(timer2, trips);
+      continue;
+    }
     if (rec.event !== "process_stats") continue;
     const data = rec.data;
     if (!data) continue;
     const type = data.type;
+    if (type === "timer_long_await") {
+      const timer2 = typeof data.timer === "string" ? data.timer : null;
+      const lag = typeof data.maxEventLoopLagMs === "number" ? data.maxEventLoopLagMs : null;
+      if (timer2 !== null && lag !== null && Number.isFinite(lag)) {
+        const lags = responsiveAwaitLagByTimer.get(timer2) ?? [];
+        lags.push(lag);
+        responsiveAwaitLagByTimer.set(timer2, lags);
+        const ats = responsiveAwaitAtByTimer.get(timer2) ?? [];
+        ats.push(parseTsMs(rec.ts));
+        responsiveAwaitAtByTimer.set(timer2, ats);
+      }
+      continue;
+    }
     if (type !== "timer_duration" && type !== "timer_slow") continue;
     const timer = typeof data.timer === "string" ? data.timer : null;
     const busyMs = typeof data.busyMs === "number" && Number.isFinite(data.busyMs) ? data.busyMs : null;
     const wallDurationMs = typeof data.durationMs === "number" ? data.durationMs : null;
-    const durationMs = busyMs ?? wallDurationMs;
+    const sweepPausedMs = typeof data.sweepPausedMs === "number" && Number.isFinite(data.sweepPausedMs) ? data.sweepPausedMs : 0;
+    let durationMs;
+    if (busyMs !== null) durationMs = busyMs;
+    else if (sweepPausedMs > 0) durationMs = Math.max(0, (wallDurationMs ?? 0) - sweepPausedMs);
+    else durationMs = wallDurationMs;
     if (timer === null || durationMs === null || !Number.isFinite(durationMs)) continue;
+    const syncExecMs = typeof data.syncExecMs === "number" && Number.isFinite(data.syncExecMs) ? data.syncExecMs : 0;
+    const peakLagMs = typeof data.peakLagMs === "number" && Number.isFinite(data.peakLagMs) ? data.peakLagMs : 0;
     const sleptMs = typeof data.sleptMs === "number" ? data.sleptMs : 0;
     if (data.clockJump === true || sleptMs > 1e3) continue;
-    rawTimerSamples.push({ timer, durationMs, atMs: parseTsMs(rec.ts) });
+    const attribution = typeof data.attribution === "string" ? data.attribution : null;
+    const atMs = parseTsMs(rec.ts);
+    rawTimerSamples.push({
+      timer,
+      durationMs,
+      atMs,
+      syncExecMs,
+      peakLagMs,
+      attribution,
+      tick: {
+        timer,
+        atMs,
+        wallMs: wallDurationMs,
+        busyMs,
+        // Distinguish "the field was absent" (legacy record) from "recorded 0".
+        sweepPausedMs: typeof data.sweepPausedMs === "number" && Number.isFinite(data.sweepPausedMs) ? data.sweepPausedMs : null,
+        syncExecMs: typeof data.syncExecMs === "number" && Number.isFinite(data.syncExecMs) ? data.syncExecMs : null,
+        peakLagMs: typeof data.peakLagMs === "number" && Number.isFinite(data.peakLagMs) ? data.peakLagMs : null,
+        attribution,
+        // Bug 7eaaf4f3: null (field absent) means the record predates this
+        // instrumentation — the harm model keeps the historical whole-tick
+        // disclaim for it. A present number (0 or more) is precise evidence.
+        peakLagOutsideParkMs: typeof data.peakLagOutsideParkMs === "number" && Number.isFinite(data.peakLagOutsideParkMs) ? data.peakLagOutsideParkMs : null,
+        // Bug set following 7eaaf4f3 (codex-review P1s on PR #962, findings
+        // #2/#4): convert the logged tick-relative offsets back to absolute
+        // epoch ms using this tick's own start (atMs - wallMs). Falls back to
+        // null (record predates the field, or the start could not be derived)
+        // so foldTimerHarm keeps using the historical whole-span heuristic.
+        pausedIntervals: parsePausedIntervals(data.pausedIntervals, atMs, wallDurationMs)
+      }
+    });
   }
   const clockCleanTimerSamples = rawTimerSamples.filter((sample) => sample.durationMs >= 0);
   const timerSamples = /* @__PURE__ */ new Map();
-  for (const { timer, durationMs } of filterTimerWakeClusterArtifacts(clockCleanTimerSamples)) {
-    const arr = timerSamples.get(timer) ?? [];
-    arr.push(durationMs);
-    timerSamples.set(timer, arr);
+  for (const sample of filterTimerWakeClusterArtifacts(clockCleanTimerSamples)) {
+    const cur = timerSamples.get(sample.timer) ?? { durations: [], ticks: [] };
+    cur.durations.push(sample.durationMs);
+    cur.ticks.push(sample.tick);
+    timerSamples.set(sample.timer, cur);
+  }
+  for (const timer of watchdogTripsByTimer.keys()) {
+    if (!timerSamples.has(timer)) timerSamples.set(timer, { durations: [], ticks: [] });
   }
-  const slowTimers = [...timerSamples.entries()].map(([timer, samples]) => ({
-    timer,
-    maxMs: Math.max(...samples),
-    p95Ms: p95(samples),
-    samples: samples.length
-  })).sort((a, b) => b.maxMs - a.maxMs || b.p95Ms - a.p95Ms).slice(0, topTimers);
+  const slowTimers = [...timerSamples.entries()].map(([timer, { durations, ticks }]) => {
+    const harm = foldTimerHarm({
+      timer,
+      ticks,
+      watchdogTripAtMs: watchdogTripsByTimer.get(timer) ?? [],
+      respondedAwaitLagMs: responsiveAwaitLagByTimer.get(timer) ?? [],
+      respondedAwaitAtMs: responsiveAwaitAtByTimer.get(timer) ?? [],
+      stalls: harmContext.stalls,
+      hostStarvationAtMs: harmContext.hostStarvationAtMs,
+      globalBlockAtMs: harmContext.globalBlockAtMs
+    });
+    return {
+      timer,
+      maxMs: durations.length > 0 ? Math.max(...durations) : 0,
+      p95Ms: p95(durations),
+      samples: durations.length,
+      maxSyncExecMs: harm.maxSyncExecMs,
+      maxPeakLagMs: harm.maxPeakLagMs,
+      maxHarmMs: harm.maxHarmMs,
+      blocking: harm.state === "blocking",
+      harmState: harm.state,
+      disclaimedLagMs: harm.disclaimedLagMs,
+      disclaimReason: harm.disclaimReason,
+      chargedTrips: harm.chargedTrips,
+      disclaimedTrips: harm.disclaimedTrips,
+      parkedMs: harm.parkedMs
+    };
+  }).sort((a, b) => b.maxHarmMs - a.maxHarmMs || b.maxMs - a.maxMs || b.p95Ms - a.p95Ms).slice(0, topTimers);
   let totalBlocks = 0;
   let maxLagMs = 0;
   let lagSum = 0;
@@ -249,13 +369,41 @@ function formatRestartReport(report) {
   if (report.slowTimers.length === 0) {
     lines.push("\u{1F7E2} No timer durations recorded (no slow ticks observed).");
   } else {
-    lines.push(`   ${"timer".padEnd(24)} ${"max".padStart(8)} ${"p95".padStart(8)}  samples`);
+    lines.push(
+      `   ${"timer".padEnd(24)} ${"active".padStart(8)} ${"p95".padStart(8)} ${"harm".padStart(8)}  samples  status`
+    );
     for (const t of report.slowTimers) {
-      const indicator = t.maxMs >= 5e3 ? "\u{1F534}" : t.maxMs >= 500 ? "\u{1F7E0}" : "\u{1F7E2}";
+      const indicator = harmIndicator({
+        state: t.harmState,
+        maxHarmMs: t.maxHarmMs,
+        maxActiveMs: t.maxMs
+      });
+      const label = harmStateLabel(t.harmState);
       lines.push(
-        `${indicator} ${t.timer.padEnd(24)} ${ms(t.maxMs).padStart(8)} ${ms(t.p95Ms).padStart(8)}  ${t.samples}`
+        `${indicator} ${t.timer.padEnd(24)} ${ms(t.maxMs).padStart(8)} ${ms(t.p95Ms).padStart(8)} ${ms(t.maxHarmMs).padStart(8)}  ${t.samples}  ${label}`
       );
     }
+    const disclaimed = report.slowTimers.filter(
+      (t) => t.disclaimedLagMs > 0 || t.disclaimedTrips > 0
+    );
+    if (disclaimed.length > 0) {
+      lines.push("");
+      lines.push("   Not charged as harm (the log explains these away):");
+      for (const t of disclaimed) {
+        const bits = [];
+        if (t.disclaimedLagMs > 0) bits.push(`peak lag ${ms(t.disclaimedLagMs)}`);
+        if (t.disclaimedTrips > 0) bits.push(`${t.disclaimedTrips} watchdog trip(s)`);
+        if (t.parkedMs > 0) bits.push(`parked ${ms(t.parkedMs)} (loop free)`);
+        lines.push(`   \u2022 ${t.timer}: ${bits.join(", ")}${t.disclaimReason ? ` \u2014 ${t.disclaimReason}` : ""}`);
+      }
+    }
+    lines.push("");
+    lines.push(
+      `   active = time the tick was RUNNING (deliberate pauses excluded). harm = event-loop`
+    );
+    lines.push(
+      `   hold this timer can be BLAMED for. Rank/colour follow harm, never elapsed time.`
+    );
   }
   lines.push("");
   const el = report.eventLoop;
@@ -273,6 +421,8 @@ function formatRestartReport(report) {
 }
 
 export {
+  TIMER_BLOCKING_HARM_MS,
+  timerHarmMs,
   buildRestartReport,
   formatRestartReport
 };

package/dist/{chunk-GOMQ7PVQ.js → chunk-WJC6AAJN.js}

@@ -4,7 +4,7 @@ import {
 import {
   isClientConnected,
   sendDaemonRequest
-} from "./chunk-NUK7EEN5.js";
+} from "./chunk-ZKJ5S23O.js";
 
 // src/lib/memory-queue-client.ts
 async function writeMemoryViaDaemon(entry) {

package/dist/{chunk-GJI77VDO.js → chunk-WVBVUVZB.js}

@@ -1,16 +1,16 @@
 import {
   extractMemoryGraph
-} from "./chunk-LGS2V2XD.js";
+} from "./chunk-FUKVP54K.js";
 import {
   flushBatch,
   writeMemory
-} from "./chunk-MXPNVSXI.js";
+} from "./chunk-CIEVY5TD.js";
 import {
   extractKeywords
 } from "./chunk-CHCA3ZM2.js";
 import {
   getActiveAgent
-} from "./chunk-55BEFF4V.js";
+} from "./chunk-5DF4Y6EC.js";
 
 // src/mcp/tools/import-conversations.ts
 import { z } from "zod";
@@ -308,9 +308,10 @@ function registerImportConversations(server) {
         try {
           const keywords = extractKeywords(memory.text);
           const keywordsStr = keywords.length > 0 ? keywords.join(" ") : null;
+          const sessionId = process.env.SESSION_ID ?? "import";
           let entities = null;
           try {
-            const graph = extractMemoryGraph(memory.text, agentId, projectName, "import_conversations");
+            const graph = extractMemoryGraph(memory.text, agentId, projectName, "import_conversations", sessionId);
             if (graph.entities.length > 0) {
               entities = JSON.stringify(graph.entities.map((e) => e.name));
             }
@@ -321,7 +322,7 @@ function registerImportConversations(server) {
             id,
             agent_id: agentId,
             agent_role: agentRole,
-            session_id: process.env.SESSION_ID ?? "import",
+            session_id: sessionId,
             timestamp: memory.metadata.original_timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
             tool_name: "import_conversations",
             project_name: projectName,

package/dist/{chunk-A6PDF4BO.js → chunk-XTQ7R2PA.js}

@@ -1,6 +1,6 @@
 import {
   queueMailboxDeposit
-} from "./chunk-4LWBC7CM.js";
+} from "./chunk-NY6SBR4O.js";
 
 // src/lib/mailbox-inbox.ts
 import { mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -41,7 +41,7 @@ function getMailboxInboxState(orgId, mailboxId) {
 async function loadAuth(opts) {
   if (opts.authHeader !== void 0) return opts.authHeader;
   try {
-    const { getAuthHeader } = await import("./gotrue-session-ODZ2ERJX.js");
+    const { getAuthHeader } = await import("./gotrue-session-U4H3UGHL.js");
     return await getAuthHeader();
   } catch {
     return null;

package/dist/{chunk-L6RXG36J.js → chunk-Y2HD2YB7.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-A7XLR3K7.js";
 import {
   getDeviceInfo
-} from "./chunk-GQOEWNVM.js";
+} from "./chunk-4EG4DT4F.js";
 import {
   EXE_AI_DIR
 } from "./chunk-ZIG7VPJV.js";

package/dist/{chunk-KTU3EAWK.js → chunk-YAACLBZ7.js}

@@ -1,13 +1,13 @@
 import {
   embed
-} from "./chunk-MOGA4Q7F.js";
+} from "./chunk-CKOJP7JI.js";
 import {
   reserveVersions,
   vectorToBlob
-} from "./chunk-MXPNVSXI.js";
+} from "./chunk-CIEVY5TD.js";
 import {
   getClient
-} from "./chunk-TAMDAOCU.js";
+} from "./chunk-66CGXQUA.js";
 
 // src/lib/documents.ts
 import crypto from "crypto";
@@ -92,7 +92,7 @@ async function resolveDefaultWorkspaceId(cwd) {
   const client = getClient();
   let projectName;
   try {
-    const { getProjectName } = await import("./project-name-LJVFMYTQ.js");
+    const { getProjectName } = await import("./project-name-WKSNNKXK.js");
     projectName = getProjectName(cwd);
   } catch {
     return null;
@@ -270,7 +270,7 @@ async function ingestDocument(input) {
   await client.batch([documentStmt, ...chunkStmts], "write");
   const embedded = vectors.filter((v) => v !== null).length;
   const originalTexts = input.chunks.map((c) => c.text);
-  import("./doc-graph-extractor-PQHDHQPQ.js").then(
+  import("./doc-graph-extractor-HOKOV7BE.js").then(
     ({ extractAndStoreDocumentGraph }) => extractAndStoreDocumentGraph(documentId, originalTexts)
   ).catch((err) => {
     process.stderr.write(

package/dist/{chunk-7GE2EQ23.js → chunk-YGVAKKGJ.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-TAMDAOCU.js";
+} from "./chunk-66CGXQUA.js";
 
 // src/lib/skill-refinement.ts
 import crypto from "crypto";
@@ -101,14 +101,19 @@ async function runSkillRefinement() {
     } else if (row.use_count >= MIN_USES_FOR_PROMOTION && successRate > HIGH_SUCCESS_RATE) {
       result.promotedToIdentity++;
       try {
-        const { getIdentity, updateIdentity } = await import("./lib/identity.js");
-        const identity = await getIdentity(row.agent_id);
-        if (identity) {
-          const promotionBlock = `
+        const { mutateIdentity } = await import("./lib/identity.js");
+        const promotionBlock = `
 
 ## Promoted Skill (auto-promoted ${now.split("T")[0]})
 ${row.content}`;
-          await updateIdentity(row.agent_id, identity + promotionBlock, "skill-refinement");
+        const { changed } = await mutateIdentity(
+          row.agent_id,
+          (current) => current ? current.raw + promotionBlock : null,
+          "skill-refinement"
+        );
+        if (!changed) {
+          result.promotedToIdentity--;
+          continue;
         }
         await client.execute({
           sql: `UPDATE behaviors SET active = 0, last_refined_at = ?, updated_at = ? WHERE id = ?`,

package/dist/chunk-YLHACCCB.js

@@ -0,0 +1,166 @@
+import {
+  deactivateBehavior,
+  listBehaviors
+} from "./chunk-6FG34V6D.js";
+import {
+  IdentityConflictError,
+  IdentityLockError,
+  getIdentity,
+  mutateIdentity,
+  withIdentityLock
+} from "./chunk-66CGXQUA.js";
+
+// src/lib/behavior-promotion.ts
+var PROMOTED_SECTION_HEADING = "## Promoted lessons (permanent \u2014 promoted from behaviours)";
+var DEFAULT_MIN_STABLE_DAYS = 30;
+function isPromotionEligible(behavior, opts = {}) {
+  const minStableDays = opts.minStableDays ?? DEFAULT_MIN_STABLE_DAYS;
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  if (!behavior.active) {
+    return { eligible: false, stableDays: 0, reason: "behaviour is not active" };
+  }
+  const updated = Date.parse(behavior.updated_at || behavior.created_at);
+  if (!Number.isFinite(updated)) {
+    return { eligible: false, stableDays: 0, reason: "behaviour has no readable timestamp" };
+  }
+  const stableDays = Math.floor((now.getTime() - updated) / 864e5);
+  if (stableDays < minStableDays) {
+    return {
+      eligible: false,
+      stableDays,
+      reason: `unchanged for ${stableDays}d, needs ${minStableDays}d`
+    };
+  }
+  return {
+    eligible: true,
+    stableDays,
+    reason: `active and unchanged for ${stableDays}d (>= ${minStableDays}d). NOTE: this is stability, not measured adherence.`
+  };
+}
+async function listPromotionCandidates(agentId, opts = {}) {
+  const behaviors = await listBehaviors(agentId, opts.projectName, opts.limit ?? 100);
+  return behaviors.map((behavior) => ({ behavior, eligibility: isPromotionEligible(behavior, opts) })).filter((c) => c.eligibility.eligible);
+}
+function formatPromotedLine(behavior, promotedBy, promotedAt) {
+  const content = behavior.content.trim().replace(/\s*\n\s*/g, " ");
+  return `- ${content}
+  - _promoted from behaviour ${behavior.id} on ${promotedAt.slice(0, 10)} by ${promotedBy}; first learned ${(behavior.created_at || "unknown").slice(0, 10)}_`;
+}
+function isAlreadyPromoted(identityRaw, behaviorId) {
+  return identityRaw.includes(`promoted from behaviour ${behaviorId}`);
+}
+function listPromotedBehaviorIds(identityRaw) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const m of identityRaw.matchAll(/promoted from behaviour ([A-Za-z0-9-]+)/g)) {
+    ids.add(m[1]);
+  }
+  return [...ids];
+}
+function promotedRulesDropped(before, after) {
+  const stillThere = new Set(listPromotedBehaviorIds(after));
+  return listPromotedBehaviorIds(before).filter((id) => !stillThere.has(id));
+}
+function applyPromotionToIdentity(identityRaw, behavior, promotedBy, promotedAt) {
+  if (isAlreadyPromoted(identityRaw, behavior.id)) return identityRaw;
+  const line = formatPromotedLine(behavior, promotedBy, promotedAt);
+  if (identityRaw.includes(PROMOTED_SECTION_HEADING)) {
+    const start = identityRaw.indexOf(PROMOTED_SECTION_HEADING);
+    const afterHeading = start + PROMOTED_SECTION_HEADING.length;
+    const nextHeading = identityRaw.slice(afterHeading).search(/\n## /);
+    const insertAt = nextHeading === -1 ? identityRaw.length : afterHeading + nextHeading;
+    const head = identityRaw.slice(0, insertAt).replace(/\s+$/, "");
+    return `${head}
+${line}
+${identityRaw.slice(insertAt)}`;
+  }
+  const body = identityRaw.replace(/\s+$/, "");
+  return `${body}
+
+${PROMOTED_SECTION_HEADING}
+
+These were behaviours that stayed stable long enough to become part of who this agent is. Identity is injected on a separate path from behaviours, so these no longer consume a behaviour injection slot. Each line records where it came from.
+
+${line}
+`;
+}
+async function promoteBehaviorToIdentity(opts) {
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const promotedAt = now.toISOString();
+  const behaviors = await listBehaviors(opts.agentId, opts.projectName, 200);
+  const behavior = behaviors.find((b) => b.id === opts.behaviorId);
+  if (!behavior) {
+    return { promoted: false, reason: `no active behaviour ${opts.behaviorId} for ${opts.agentId}` };
+  }
+  const eligibility = isPromotionEligible(behavior, { minStableDays: opts.minStableDays, now });
+  if (!eligibility.eligible && !opts.force) {
+    return { promoted: false, reason: `not eligible: ${eligibility.reason}` };
+  }
+  let slotFreed = false;
+  try {
+    return await withIdentityLock(opts.agentId, async () => {
+      const identity = getIdentity(opts.agentId);
+      if (!identity) {
+        return { promoted: false, reason: `${opts.agentId} has no identity file to promote into` };
+      }
+      if (isAlreadyPromoted(identity.raw, behavior.id)) {
+        return { promoted: false, reason: `behaviour ${behavior.id} is already in the identity file` };
+      }
+      await mutateIdentity(
+        opts.agentId,
+        (current) => {
+          if (!current) return null;
+          if (isAlreadyPromoted(current.raw, behavior.id)) return null;
+          return applyPromotionToIdentity(current.raw, behavior, opts.promotedBy, promotedAt);
+        },
+        opts.promotedBy
+      );
+      const written = getIdentity(opts.agentId);
+      if (!written || !isAlreadyPromoted(written.raw, behavior.id)) {
+        return {
+          promoted: false,
+          reason: `the promoted line for ${behavior.id} is not present in ${opts.agentId}'s identity after the write \u2014 NOT deactivating the behaviour, so the rule stays enforced.`
+        };
+      }
+      try {
+        slotFreed = await deactivateBehavior(behavior.id);
+      } catch (err) {
+        process.stderr.write(
+          `[behavior-promotion] identity updated but deactivation of ${behavior.id} FAILED \u2014 the rule is now live in BOTH places: ${err instanceof Error ? err.message : String(err)}
+`
+        );
+      }
+      return {
+        promoted: true,
+        record: {
+          behaviorId: behavior.id,
+          agentId: opts.agentId,
+          promotedBy: opts.promotedBy,
+          promotedAt,
+          stableDays: eligibility.stableDays,
+          slotFreed
+        }
+      };
+    });
+  } catch (err) {
+    if (err instanceof IdentityConflictError || err instanceof IdentityLockError) {
+      return {
+        promoted: false,
+        reason: `could not safely write ${opts.agentId}'s identity while promoting ${behavior.id} \u2014 the behaviour is left active. ${err.message}`
+      };
+    }
+    throw err;
+  }
+}
+
+export {
+  PROMOTED_SECTION_HEADING,
+  DEFAULT_MIN_STABLE_DAYS,
+  isPromotionEligible,
+  listPromotionCandidates,
+  formatPromotedLine,
+  isAlreadyPromoted,
+  listPromotedBehaviorIds,
+  promotedRulesDropped,
+  applyPromotionToIdentity,
+  promoteBehaviorToIdentity
+};

package/dist/{chunk-PLZSZOZN.js → chunk-YP6UGVEY.js}

@@ -1,6 +1,6 @@
 import {
   withScopedReadWindow
-} from "./chunk-DJOIMFKV.js";
+} from "./chunk-REZIGNA6.js";
 import {
   requireOrgPartnerBinding,
   resolvePartnerIdentities
@@ -22,10 +22,10 @@ import {
   sealMailboxEnvelope,
   unrecordedText,
   verifyManifest
-} from "./chunk-IN6CAM4F.js";
+} from "./chunk-EHAN752X.js";
 import {
   queueMailboxDeposit
-} from "./chunk-4LWBC7CM.js";
+} from "./chunk-NY6SBR4O.js";
 
 // src/lib/up-brief.ts
 import { appendFileSync, mkdirSync, readFileSync } from "fs";

package/dist/{chunk-ULIBLJ6W.js → chunk-YYC553FO.js}

@@ -1,19 +1,19 @@
-import {
-  resolveType
-} from "./chunk-GUMRIUI5.js";
 import {
   chunkSourceFile,
   languageForFile
 } from "./chunk-Z6BZQHP5.js";
+import {
+  resolveType
+} from "./chunk-GUMRIUI5.js";
 import {
   resolveAnthropicAuth
 } from "./chunk-VGMACSEV.js";
 import {
   WORK_STATE_HEARTBEAT_TOOL
-} from "./chunk-VZAFWPAY.js";
+} from "./chunk-IK4344V5.js";
 import {
   hashMemoryContent
-} from "./chunk-DN4YVV4Z.js";
+} from "./chunk-RSABKW6B.js";
 
 // src/lib/graph-rag.ts
 import crypto from "crypto";

package/dist/{chunk-T35RCQFE.js → chunk-YZPEQW7H.js}

@@ -1,15 +1,15 @@
 import {
   resolvePartnerIdentities
 } from "./chunk-4YLBKEL5.js";
+import {
+  asOrgBillablePlan
+} from "./chunk-X2X3IGZU.js";
 import {
   OrgKeyPinConflictError,
   orgKeyPinConfirmation,
   pinOrgKey,
   readOrgKeyPin
 } from "./chunk-UBMZ3YQU.js";
-import {
-  asOrgBillablePlan
-} from "./chunk-X2X3IGZU.js";
 import {
   displayFingerprint,
   ed25519PrivateKeyFromSeed,
@@ -32,7 +32,7 @@ function resolveEndpoint(opts) {
 async function resolveAuth(opts) {
   if (opts.authHeader !== void 0) return opts.authHeader ?? {};
   try {
-    const { getAuthHeader } = await import("./gotrue-session-ODZ2ERJX.js");
+    const { getAuthHeader } = await import("./gotrue-session-U4H3UGHL.js");
     return await getAuthHeader() ?? {};
   } catch {
     return {};
@@ -47,14 +47,14 @@ async function resolveUserId(opts, headers) {
   const token = bearer.replace(/^Bearer\s+/i, "").trim();
   if (!token) {
     throw new InviteError(
-      "Not signed in \u2014 redeeming an invite requires an account. Run `exe-os login` and try again."
+      "Not signed in \u2014 redeeming an invite requires an account session. exe-os has no\nemail/password sign-in: ask support for a token and run `exe-os login --token <jwt>`."
     );
   }
-  const { decodeJwt } = await import("./gotrue-session-ODZ2ERJX.js");
+  const { decodeJwt } = await import("./gotrue-session-U4H3UGHL.js");
   const sub = decodeJwt(token)?.sub;
   if (!sub) {
     throw new InviteError(
-      "The stored session token carries no account id (`sub`). Run `exe-os login` to refresh it."
+      "The stored session token carries no account id (`sub`). Ask support for a replacement\ntoken and store it with `exe-os login --token <jwt>`."
     );
   }
   return sub;
@@ -149,7 +149,8 @@ async function readJson(resp, what) {
   if (resp.status === 404) throw new InviteError(`${what}: no such invite code (or it has already been used).`);
   if (resp.status === 401 || resp.status === 403) {
     throw new InviteError(
-      `${what}: the server refused this invite for this account (HTTP ${resp.status}). Run \`exe-os login\` if you have not, and check the code was issued to you.`
+      `${what}: the server refused this invite for this account (HTTP ${resp.status}). Check the code was issued to this account; if the session is stale, store a fresh
+support-issued token with \`exe-os login --token <jwt>\`.`
     );
   }
   if (resp.status === 410) throw new InviteError(`${what}: this invite has expired.`);