@askexenow/exe-os 0.9.384 → 0.9.387

package/dist/{update-support-BMJM4NG7.js → update-support-NSJLA64L.js}

@@ -1,24 +1,24 @@
 import {
   persistSupportArtifact
-} from "./chunk-FVLNNNH6.js";
+} from "./chunk-I4HK2DHC.js";
 import {
   queueSupportStatusUpdateSync
-} from "./chunk-VF3BZOZK.js";
+} from "./chunk-JY6IU2XF.js";
 import {
   supportIdSchema,
   supportVersionSchema
-} from "./chunk-3B6FLNLV.js";
+} from "./chunk-EZH2LGJX.js";
 import "./chunk-MMRUBN3I.js";
 import "./chunk-NKEFYE4R.js";
-import "./chunk-UOPCVFVR.js";
-import "./chunk-AWWDKF22.js";
+import "./chunk-ZAUHCQYK.js";
+import "./chunk-XK7JO45D.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-OTVEIJUQ.js";
-import "./chunk-VHHX4UCP.js";
+import "./chunk-2XCUUS4V.js";
 import {
   getActiveAgent
-} from "./chunk-F4BBMIPG.js";
-import "./chunk-MUCNYSJP.js";
+} from "./chunk-RBFPPNXS.js";
+import "./chunk-NRLJOV7M.js";
 import "./chunk-5MOYSU5A.js";
 import {
   describeUpstreamFailure,
@@ -27,7 +27,7 @@ import {
   sanitizeUpstreamId,
   sanitizeUpstreamPayload,
   sanitizeVersionField
-} from "./chunk-ELEGH4DX.js";
+} from "./chunk-ZUGQPYUY.js";
 import "./chunk-76CJBM36.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-MFAOAIUE.js";
@@ -41,11 +41,11 @@ import "./chunk-DRTJCG6B.js";
 import "./chunk-GJV3WDWM.js";
 import "./chunk-MP2AFCGL.js";
 import "./chunk-YRUZK2QA.js";
-import "./chunk-GL47M7NY.js";
+import "./chunk-2GUT5CWI.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-72V3S44T.js";
+import "./chunk-QSYY4R6R.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-QH5ZQ5SJ.js";
@@ -55,9 +55,9 @@ import "./chunk-5U2IJBFV.js";
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-TNS63ATU.js";
+} from "./chunk-5SPQBSKC.js";
 import "./chunk-A7XLR3K7.js";
-import "./chunk-DZN7SDY2.js";
+import "./chunk-YBD3O77S.js";
 import "./chunk-A7JYF4RG.js";
 import "./chunk-ARX6TAGN.js";
 import {

package/dist/{whatsapp-QQLDAHUX.js → whatsapp-LLGB5RMQ.js}

@@ -2,7 +2,7 @@ import {
   WhatsAppAdapter,
   calculateBackoff,
   hardenBaileysAuthState
-} from "./chunk-FHIFTSPL.js";
+} from "./chunk-YZ3I3PYP.js";
 import "./chunk-5U2IJBFV.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";

package/dist/{wiki-acl-W6WDCVCP.js → wiki-acl-PIYYQZZX.js}

@@ -6,7 +6,7 @@ import {
   listUserWikiAccess,
   listWorkspaceUsers,
   revokeWikiAccess
-} from "./chunk-M4XY4JRK.js";
+} from "./chunk-YKTJBFWH.js";
 import "./chunk-MLKGABMK.js";
 export {
   checkWikiAccess,

package/dist/{work-claims-6DM32MGO.js → work-claims-3YIDXG3Q.js}

@@ -15,15 +15,15 @@ import {
   normalizeWorkRef,
   releaseClaim,
   resolveHolderSession
-} from "./chunk-P3QQ52QK.js";
+} from "./chunk-CWWJEMJ5.js";
 import "./chunk-PHUHIVD5.js";
 import "./chunk-E23LNUWJ.js";
 import "./chunk-BTSWFMEH.js";
-import "./chunk-GL47M7NY.js";
+import "./chunk-2GUT5CWI.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-72V3S44T.js";
+import "./chunk-QSYY4R6R.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-QH5ZQ5SJ.js";

package/dist/{work-state-heartbeat-HG7D4AWJ.js → work-state-heartbeat-PFULN6VV.js}

@@ -9,7 +9,7 @@ import {
   runWorkStateTick,
   shouldWriteWorkState,
   upsertWorkState
-} from "./chunk-AWWDKF22.js";
+} from "./chunk-XK7JO45D.js";
 import "./chunk-CHCA3ZM2.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{workflow-engine-ZWC6CCXE.js → workflow-engine-XMMWRP4D.js}

@@ -11,8 +11,8 @@ import {
   persistWorkflows,
   runWorkflow,
   startWorkflow
-} from "./chunk-L3VUW5M4.js";
-import "./chunk-P2VVMGMI.js";
+} from "./chunk-RSDDZSEG.js";
+import "./chunk-H2N47OFR.js";
 import "./chunk-MLKGABMK.js";
 export {
   MAX_WORKFLOW_STEPS,

package/dist/{worktree-EMQCPGFE.js → worktree-WILU76HY.js}

@@ -19,13 +19,13 @@ import {
   resolveGitWithRetrySync,
   worktreeBranch,
   worktreePath
-} from "./chunk-JDDM6C57.js";
-import "./chunk-LSNBTGW4.js";
-import "./chunk-GL47M7NY.js";
+} from "./chunk-ORHX5E7L.js";
+import "./chunk-N5STNP44.js";
+import "./chunk-2GUT5CWI.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-72V3S44T.js";
+import "./chunk-QSYY4R6R.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-QH5ZQ5SJ.js";

package/dist/{worktree-sweep-XVUJZBXV.js → worktree-sweep-6ZGHXF3A.js}

@@ -4,14 +4,14 @@ import {
   discoverRepoPathsAsync,
   isWorktreePathOccupiedByCwd,
   sweepWorktrees
-} from "./chunk-LFBLQE2P.js";
-import "./chunk-JDDM6C57.js";
-import "./chunk-LSNBTGW4.js";
-import "./chunk-GL47M7NY.js";
+} from "./chunk-Y42HGHXW.js";
+import "./chunk-ORHX5E7L.js";
+import "./chunk-N5STNP44.js";
+import "./chunk-2GUT5CWI.js";
 import "./chunk-BBMTVAE3.js";
 import "./chunk-TKDITWDN.js";
 import "./chunk-5YEUPUV4.js";
-import "./chunk-72V3S44T.js";
+import "./chunk-QSYY4R6R.js";
 import "./chunk-YYB5PMTK.js";
 import "./chunk-L5CGXEZC.js";
 import "./chunk-QH5ZQ5SJ.js";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.384",
-  "description": "AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.",
+  "version": "0.9.387",
+  "description": "AI employee operating system \u2014 persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "repository": {
@@ -126,7 +126,7 @@
     "deploy": "node dist/bin/pre-build-guard.js && EXE_DIST_OP_RESTARTS_DAEMON=1 EXE_DIST_CLEAN=1 npm run build && node scripts/dist-integrity.mjs --verify && (node dist/bin/prune-orphan-chunks.js || true) && npm install -g . && node dist/bin/install.js --global && echo '[exe-os] Deploy complete. Run /mcp in active sessions to reconnect.'",
     "postinstall": "node postinstall.mjs",
     "prepublishOnly": "npm run typecheck && EXE_DIST_OP_RESTARTS_DAEMON=1 EXE_DIST_CLEAN=1 npm run build && node dist/bin/prune-orphan-chunks.js --force && node scripts/dist-integrity.mjs --prune && npm run guard:esm-require && npm run guard:defect-classes && npm run guard:ref-provenance && npm run guard:upstream-content && npm run guard:handler-reachability && npm run check:schema-version && node dist/bin/customer-readiness.js && node dist/bin/pre-publish.js",
-    "test:publish": "npx vitest run --maxWorkers=4 --exclude 'tests/tui/**' --exclude 'tests/lib/tmux-routing.test.ts' --exclude 'tests/lib/intercom-routing.test.ts' --exclude 'tests/gateway/**' --exclude 'tests/mcp/ingest-document.test.ts' --exclude 'tests/lib/hybrid-search.test.ts' --exclude 'tests/lib/worker-gate.test.ts' --exclude 'tests/daemon-perf-stress.test.ts' --exclude 'tests/lib/gateway-client.test.ts' --exclude 'tests/lib/ws-client.test.ts' --exclude 'tests/lib/ws-auth.test.ts' --exclude 'tests/integration/clean-stack-projection.test.ts' --exclude 'tests/orchestration/dispatch-chain.test.ts' --exclude 'tests/orchestration/e2e-flow.test.ts' && echo '::warning::clean-stack-projection and stack-update quarantined (need Docker + live DB; environmental, fail in CI runner — container unhealthy / DB not initialized); ws-client/ws-auth quarantined (30-120s timeouts flaky on Node 20 CI runner — passes locally). Quarantined to match build-and-test (required gate): dispatch-chain/e2e-flow (timing-sensitive, flaky under parallel load — bug dfb25bf1). device-id-split-brain/reaper-deps-async/find-free-instance/db-backup-recovery de-flaked and promoted to the required gate (chore/deflake-required-ci). See cicd-audit-2026-06-18.md.' && npx vitest run --maxWorkers=1 tests/daemon-perf-stress.test.ts tests/lib/gateway-client.test.ts",
+    "test:publish": "npx vitest run --maxWorkers=4 --exclude 'tests/tui/**' --exclude 'tests/lib/tmux-routing.test.ts' --exclude 'tests/lib/intercom-routing.test.ts' --exclude 'tests/gateway/**' --exclude 'tests/mcp/ingest-document.test.ts' --exclude 'tests/lib/hybrid-search.test.ts' --exclude 'tests/lib/worker-gate.test.ts' --exclude 'tests/daemon-perf-stress.test.ts' --exclude 'tests/lib/gateway-client.test.ts' --exclude 'tests/lib/ws-client.test.ts' --exclude 'tests/lib/ws-auth.test.ts' --exclude 'tests/integration/clean-stack-projection.test.ts' --exclude 'tests/orchestration/dispatch-chain.test.ts' --exclude 'tests/orchestration/e2e-flow.test.ts' && echo '::warning::clean-stack-projection and stack-update quarantined (need Docker + live DB; environmental, fail in CI runner \u2014 container unhealthy / DB not initialized); ws-client/ws-auth quarantined (30-120s timeouts flaky on Node 20 CI runner \u2014 passes locally). Quarantined to match build-and-test (required gate): dispatch-chain/e2e-flow (timing-sensitive, flaky under parallel load \u2014 bug dfb25bf1). device-id-split-brain/reaper-deps-async/find-free-instance/db-backup-recovery de-flaked and promoted to the required gate (chore/deflake-required-ci). See cicd-audit-2026-06-18.md.' && npx vitest run --maxWorkers=1 tests/daemon-perf-stress.test.ts tests/lib/gateway-client.test.ts",
     "benchmark:longmemeval": "npx tsx tests/benchmarks/longmemeval.ts",
     "guard:esm-require": "node scripts/check-no-runtime-require.mjs",
     "guard:defect-classes": "node scripts/check-defect-gates.mjs",
@@ -135,6 +135,7 @@
     "guard:handler-reachability": "node scripts/check-handler-reachability.mjs",
     "guard:required-checks": "node scripts/check-required-checks-evaluable.mjs",
     "guard:branch-protection": "node scripts/sync-branch-protection.mjs --check",
+    "guard:required-check-redundancy": "node scripts/check-required-check-redundancy.mjs",
     "guard:policy-contexts": "node scripts/check-policy-contexts-producible.mjs",
     "branch-protection:plan": "node scripts/sync-branch-protection.mjs --dry-run",
     "branch-protection:apply": "node scripts/sync-branch-protection.mjs --apply",
@@ -163,8 +164,9 @@
     "test:daemon-smoke": "vitest run --maxWorkers=1 tests/smoke/daemon-smoke-gate.test.ts",
     "test:smoke": "vitest run --maxWorkers=1 tests/smoke/",
     "smoke:runtime": "node --import tsx src/bin/runtime-smoke.ts",
-    "check:release-conformance": "node scripts/check-release-conformance.mjs",
-    "check:manifest-pin-freshness": "node scripts/assert-manifest-pin-matches-release.mjs --allow-unverified \"monitorAgent=exe-monitor's release workflow has not run since 2026-05-12 (release-contract-services.mjs); its stack.release.json version is a stale hand-built artifact, less trustworthy than the manifest's own CI-built pin.\" --allow-unverified \"monitorHub=same as monitorAgent — shared exe-monitor repo, same broken release process.\" --allow-unverified \"erp=exe-erp carries two live, unreconciled tag schemes (date-stamped stack build vs 0.3.x Frappe-style semver); status: pending in release-contract-services.mjs, no standard release lane yet.\" --allow-unverified \"gateway=exe-gateway migrated to semver tagging on 2026-08-20 (repo is at 0.9.31), but stack 0.9.37 (#1093) cut exe-os/CRM/ERP/dashboard only and carried gateway forward on its pre-migration v2026.08.07-<sha>-stamped pin. The two schemes cannot be ordered. Repinning a PUBLISHED stack entry is a release decision, not a lint fix — it needs its own stack cut, tracked separately.\" --allow-unverified \"dashboard=AskExe/exe-dashboard has no stack.release.json at its repo root, so there is no released version to compare against. Its release lane has never completed a run (see stack.release.json imageDigestTodo) — the pin is a known phantom, tracked separately under bug 81ca8903.\"",
+    "check:release-conformance": "node scripts/check-release-conformance.mjs && npm run check:health-contract",
+    "check:health-contract": "node scripts/check-health-contract.mjs --self-check",
+    "check:manifest-pin-freshness": "node scripts/assert-manifest-pin-matches-release.mjs --allow-unverified \"monitorAgent=exe-monitor's release workflow has not run since 2026-05-12 (release-contract-services.mjs); its stack.release.json version is a stale hand-built artifact, less trustworthy than the manifest's own CI-built pin.\" --allow-unverified \"monitorHub=same as monitorAgent \u2014 shared exe-monitor repo, same broken release process.\" --allow-unverified \"erp=exe-erp carries two live, unreconciled tag schemes (date-stamped stack build vs 0.3.x Frappe-style semver); status: pending in release-contract-services.mjs, no standard release lane yet.\" --allow-unverified \"gateway=exe-gateway migrated to semver tagging on 2026-08-20 (repo is at 0.9.31), but stack 0.9.37 (#1093) cut exe-os/CRM/ERP/dashboard only and carried gateway forward on its pre-migration v2026.08.07-<sha>-stamped pin. The two schemes cannot be ordered. Repinning a PUBLISHED stack entry is a release decision, not a lint fix \u2014 it needs its own stack cut, tracked separately.\" --allow-unverified \"dashboard=AskExe/exe-dashboard has no stack.release.json at its repo root, so there is no released version to compare against. Its release lane has never completed a run (see stack.release.json imageDigestTodo) \u2014 the pin is a known phantom, tracked separately under bug 81ca8903.\"",
     "test:e2e:sso-stack": "tests/e2e/stack/bin/run.sh",
     "gen:delivery-schemas": "node --import tsx scripts/generate-delivery-schemas.mjs",
     "check:delivery-catalog": "node --import tsx scripts/check-delivery-catalog.mjs",

package/release-notes.json

@@ -1,48 +1,26 @@
 {
-  "current": "0.9.384",
+  "current": "0.9.387",
   "notes": {
-    "0.9.384": {
-      "version": "0.9.384",
-      "date": "2026-09-10",
+    "0.9.387": {
+      "version": "0.9.387",
+      "date": "2026-09-14",
       "features": [
-        "give the release watchdog a consumer — detection without one is not a control (#1246)",
-        "extract Christian->Liam assignment path onto a clean branch (supersedes #1200) (#1241)",
-        "a merge gate that can actually answer \"is this PR green\" (#1192)",
-        "worker deploy-drift monitor (IN_SYNC / DRIFT / UNVERIFIED) (#1237)",
-        "config-only delivery, part 1 — the read-only planner (#1219)",
-        "delivery/catalog.json — one canonical inventory, three legacy lists derived (ARC-1 Track B) (#1180)",
-        "org_admin MCP tool — a caller for 13 unreachable control-plane routes (#1189)"
+        "verify remediation records for red PR reviews (bug 20e1c9fa) (#1401)"
       ],
       "fixes": [
-        "close a prototype-key gap in exe_perms.orgs lookup (bug d6c1a0c8) (#1262)",
-        "eliminate prototype-inheritance exposure in seat-heartbeat (bug d6c1a0c8) (#1261)",
-        "halve the per-PR model spend, and name quota as quota (#1252)",
-        "a 404 from ghcr is not proof the bytes were never built (bug 600fd3db) (#1263)",
-        "stop pr-conflict-detector suite tracking host uptime (bug f1d113c4) (#1260)",
-        "bound the wait in the PR conflict detector instead of timing out (#1247)",
-        "store-busy-retry must surface rejection reasons on zero-success flake (#1250)",
-        "stop rebuilding the SQLCipher store per test in the delegation-gate suite (#1249)",
-        "guard the orchestration fixture schema against drift (bug a342c354) (#1244)",
-        "the residue scan reads the log directories where credentials actually land (bug e605e945) (#1243)",
-        "an exhausted account is not a misconfiguration — name the real cause (#1248)",
-        "verify PR-only required contexts on the PR lane (bug 4e44df1e) (#1178)",
-        "complete the tmux-status mock that drifted in with #1234 (#1242)",
-        "resolveProjectDir must not read a failed lookup as an empty result (bug 2284e3b6) (#1234)",
-        "complete two mocks that had silently drifted from their modules (#1240)",
-        "drop the hand-added api_key_hash column now that the schema declares it (main is red) (#1238)",
-        "wire member-key bind/status client path (bug d35e555a) (#1235)",
-        "a NULL-domain row is prunable by the label the tool displays (bug 7701c375) (#1228)",
-        "declare users.api_key_hash and guard the class of undeclared columns (bug ce6d7797) (#1226)",
-        "make the dispatch paths testable instead of skipping them under vitest (bug f1445bd0) (#1236)",
-        "three suites were passing while their code threw (bug 3940ac4e) (#1233)",
-        "npm install retries filesystem races, not just network errors (bug c4ed172b) (#1232)",
-        "list-behaviors filters match the labels it displays (bug 78e1d98f) (#1231)",
-        "merge gates for the eight unguarded repos — policy and dry run (bug b3c22678) (#1222)",
-        "the GoTrue bridge is actually written, and cannot silently re-key a live seat (#1182)"
+        "retry expired sessions through host refresh (#1400)",
+        "give the main full-suite lane a gate consumer; refuse unacknowledged stacked PR bases (#1391)",
+        "measure rendered env drift against the CONTAINER, not a second disk render (bugs 6ae7331f, 1f1436d8, 761b12f8) (#1363)",
+        "prevent demo content flash before license check (#1398)",
+        "one truth for needs_review + cleanable RESUME phantoms (bug 81c63b67) (#1390)",
+        "pin codex-review reasoning effort to low — gpt-6-astra rejects the runner-inherited 'minimal' (bug 5dbe3cef) (#1385)",
+        "delegate shared logout to native app session cleanup (#1397)",
+        "lock authority is the holder, not the clock (bug 33ea5381; bug 2b6a0460 not reproducible upstream) (#1362)"
       ],
       "security": [],
       "other": [
-        "v0.9.384 — Christian->Liam assignments and reports over MCP (#1264)"
+        "stage standalone repository handoff (#1399)",
+        "Make GoTrue authoritative for license checks and grants (#1395)"
       ],
       "migration_notes": []
     },

package/stack.release.json

@@ -4,23 +4,23 @@
   "repo": "AskExe/exe-os",
   "service": "exe-os",
   "packageName": "@askexenow/exe-os",
-  "version": "0.9.383",
-  "image": "ghcr.io/askexe/exe-os:v0.9.383",
+  "version": "0.9.387",
+  "image": "ghcr.io/askexe/exe-os:v0.9.387",
   "imageEnv": "EXE_OS_IMAGE_TAG",
-  "imageDigestTodo": "TODO(bug 32d6e02f), NARROWED by bug 81ca8903. The top-level `image` is tag-only BY CONSTRUCTION and that is correct: it names the tag the release run is about to build, whose digest does not exist until the push (see the 'Cross-check built digest against the manifest pin' step in .github/workflows/release-stack-image.yml). Demanding a digest here is unsatisfiable, which is why this TODO kept surviving. The one genuinely resolvable case it also covered — components.erp, built in a DIFFERENT repo and therefore already sitting in the registry — is now resolved and digest-pinned below. What remains open is ONLY components.dashboard, and not for the reason this TODO claimed: ghcr.io/askexe/exe-dashboard:v0.9.372 DOES NOT EXIST. .github/workflows/release-dashboard-image.yml has produced exactly one run in its lifetime (id 32405074431, 2026-08-20, tag v0.9.374) and that run FAILED, so the dashboard release lane has never emitted a single v* tag — the only refs in ghcr.io/askexe/exe-dashboard are the floating :main and :sha-<sha> dev refs from dashboard-image.yml. The dashboard pin is therefore a PHANTOM, not an unresolved digest, and it is deliberately left tag-only here rather than silently repointed at a :main digest, because choosing which dashboard bytes constitute a release is a release decision, not a lint fix. FAIL-CLOSED still holds and is enforced where it bites: scripts/publish-stack-release.mjs verifyServicePin() refuses to publish any tag-only app image into the customer manifest.",
+  "imageDigestTodo": "The top-level image names the forthcoming exe-os build and receives its digest after publication. Independently released components, including dashboard, retain verified digest pins; stack publication validates every service pin.",
   "components": {
     "erp": {
       "image": "ghcr.io/askexe/exe-erp:v0.3.4@sha256:7e21680fdb2bf488010edbbd5cc09dcc15fa677f466326c35e1439b1c5f8a820",
       "env": "ERP_IMAGE_TAG",
       "composeService": "exe-erp",
-      "note": "Bug 81ca8903: was `ghcr.io/askexe/exe-erp:v0.9.312` — a tag that has never existed. ERP is versioned on its own 0.x line; v0.9.312 is an EXE-OS version number that bumpVersions() stamped onto this component because rebaseImageTag() rebased every tag-only component image to the exe-os release version regardless of which repo built it. That rebase is now scoped (same commit) so it can no longer forge tags for independently-versioned components. Repinned to the real, current ERP release v0.3.4, digest resolved live from ghcr.io/askexe/exe-erp on 2026-09-01. Digest-pinning is also what makes this entry self-defending: rebaseImageTag() returns any `@sha256:`-bearing ref untouched. Prior intent for the record (bug 790794e8) was v0.2.0-final8, the first ERP image shipping the realtime/socketio entrypoint (exe-erp PR #15); final3/final7 crash-looped exe-erp-websocket on a missing socketio.js. v0.3.4 supersedes it."
+      "note": "Bug 81ca8903: was `ghcr.io/askexe/exe-erp:v0.9.312` \u2014 a tag that has never existed. ERP is versioned on its own 0.x line; v0.9.312 is an EXE-OS version number that bumpVersions() stamped onto this component because rebaseImageTag() rebased every tag-only component image to the exe-os release version regardless of which repo built it. That rebase is now scoped (same commit) so it can no longer forge tags for independently-versioned components. Repinned to the real, current ERP release v0.3.4, digest resolved live from ghcr.io/askexe/exe-erp on 2026-09-01. Digest-pinning is also what makes this entry self-defending: rebaseImageTag() returns any `@sha256:`-bearing ref untouched. Prior intent for the record (bug 790794e8) was v0.2.0-final8, the first ERP image shipping the realtime/socketio entrypoint (exe-erp PR #15); final3/final7 crash-looped exe-erp-websocket on a missing socketio.js. v0.3.4 supersedes it."
     },
     "dashboard": {
-      "image": "ghcr.io/askexe/exe-dashboard:v0.9.383",
+      "image": "ghcr.io/askexe/exe-dashboard:v0.9.382@sha256:43c4eb52d89d977021d29df73bcfa6f9d769ab4debf90e81240b59a4c165bab0",
       "env": "DASHBOARD_IMAGE_TAG",
       "composeService": "exe-dashboard",
-      "versionLockstep": true,
-      "note": "The customer dashboard served at dashboard.<apex> (credits, usage, API keys, billing). Built from THIS repo — context dashboard-page/, a static nginx image — by .github/workflows/release-dashboard-image.yml on a release tag, so it ships in lockstep with exe-os. `versionLockstep: true` is what now authorises bumpVersions() to rebase this tag: after bug 81ca8903 the rebase is opt-in per component instead of applying to everything. Before 2026-08-20 it was outside the release lane entirely: only .github/workflows/dashboard-image.yml built it, publishing floating :main / :sha-<sha> refs with no org.opencontainers.image.version, and no descriptor pinned it. Production consequently ran sha256:950699473914… from commit 1d5b69cffa8d (#703, 2026-08-13) — three builds stale — with nothing able to detect or correct it. OPEN (bug 81ca8903): that is STILL the situation. This tag is a phantom — see imageDigestTodo. The release lane exists but has never completed a run, so no v* dashboard image exists to pin. Fixing the lane is tracked separately; do not paper over it by pinning a :main digest here."
+      "versionLockstep": false,
+      "note": "Dashboard is independently versioned after the standalone repository handoff. Preserve the verified image already pinned by the customer stack until the first AskExe/exe-dashboard release passes provenance checks. Update this digest and current-image source mappings together at cutover; exe-os version bumps must not rewrite this tag."
     },
     "exe-db": {
       "image": "pgvector/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
@@ -47,13 +47,13 @@
       "image": "cloudflare/cloudflared@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
       "composeService": "cloudflared",
       "category": "infra",
-      "note": "Bug 4948fc48: digest-pinned tunnel — no env override, managed in compose."
+      "note": "Bug 4948fc48: digest-pinned tunnel \u2014 no env override, managed in compose."
     },
     "exe-sso-edge": {
       "image": "nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
       "composeService": "exe-sso-edge",
       "category": "infra",
-      "note": "Bug 4948fc48: SSO reverse proxy for CRM/wiki/ERP — uses stock nginx:alpine."
+      "note": "Bug 4948fc48: SSO reverse proxy for CRM/wiki/ERP \u2014 uses stock nginx:alpine."
     },
     "exe-otel-collector": {
       "image": "otel/opentelemetry-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
@@ -66,7 +66,7 @@
       "image": "supabase/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
       "composeService": "gotrue",
       "category": "infra",
-      "note": "Bug 4948fc48: GoTrue auth backend — digest-pinned in compose."
+      "note": "Bug 4948fc48: GoTrue auth backend \u2014 digest-pinned in compose."
     }
   },
   "stackParticipation": {
@@ -110,5 +110,5 @@
   },
   "deploymentScope": "customer",
   "highGhostStack": "0.9.9",
-  "sourceVersion": "0.9.383"
+  "sourceVersion": "0.9.387"
 }

package/dist/conversations-retention-C4BLKFEL.js

@@ -1,54 +0,0 @@
-import "./chunk-MLKGABMK.js";
-
-// src/lib/conversations-retention.ts
-var DEFAULT_CONVERSATIONS_RETENTION_DAYS = 90;
-async function sweepExpiredConversations(client, retentionDays = DEFAULT_CONVERSATIONS_RETENTION_DAYS) {
-  const days = Number.isFinite(retentionDays) && retentionDays > 0 ? Math.floor(retentionDays) : DEFAULT_CONVERSATIONS_RETENTION_DAYS;
-  const cutoff = `-${days} days`;
-  const BATCH_SIZE = 500;
-  const MAX_BATCHES = 200;
-  let total = 0;
-  for (let i = 0; i < MAX_BATCHES; i++) {
-    const batch = await client.execute({
-      sql: `SELECT id FROM conversations
-            WHERE ingested_at < datetime('now', ?)
-            ORDER BY ingested_at
-            LIMIT ?`,
-      args: [cutoff, BATCH_SIZE]
-    });
-    const batchIds = batch.rows.map((r) => String(r.id));
-    if (batchIds.length === 0) break;
-    const placeholders = batchIds.map(() => "?").join(",");
-    await client.batch(
-      [
-        {
-          sql: `INSERT OR IGNORE INTO conversation_deletions (id, deleted_at)
-                SELECT id, datetime('now') FROM conversations WHERE id IN (${placeholders})`,
-          args: batchIds
-        },
-        {
-          sql: `DELETE FROM conversations WHERE id IN (${placeholders})`,
-          args: batchIds
-        }
-      ],
-      "write"
-    );
-    total += batchIds.length;
-    if (batchIds.length < BATCH_SIZE) break;
-    await new Promise((resolve) => setImmediate(resolve));
-  }
-  if (total > 0) {
-    try {
-      await client.execute({
-        sql: "DELETE FROM sync_meta WHERE key = 'last_conversations_push_version'",
-        args: []
-      });
-    } catch {
-    }
-  }
-  return total;
-}
-export {
-  DEFAULT_CONVERSATIONS_RETENTION_DAYS,
-  sweepExpiredConversations
-};