@askexenow/exe-os 0.9.396 → 0.9.398

package/dist/{chunk-B6CBN6EF.js → chunk-HWP3WCLC.js}

@@ -724,6 +724,14 @@ async function checkLiveArtifactMatchesManifest(composeFile, manifestPath, expec
     }
   }
   if (declared.length === 0) {
+    if (expected?.composeServices !== void 0) {
+      return {
+        check,
+        status: "fail",
+        message: "selected artifact comparison has no signed declaration \u2014 comparison did NOT run",
+        verdicts: { disagrees: 1 }
+      };
+    }
     return {
       check,
       status: "warn",
@@ -731,10 +739,23 @@ async function checkLiveArtifactMatchesManifest(composeFile, manifestPath, expec
     };
   }
   const names = [];
+  const selected = expected?.composeServices === void 0 ? null : new Set(expected.composeServices);
+  const scopedFailure = (message) => ({
+    check,
+    status: "fail",
+    message,
+    verdicts: { disagrees: 1 }
+  });
+  if (selected && (selected.size === 0 || selected.size !== expected.composeServices.length)) {
+    return scopedFailure("invalid selected compose service scope \u2014 comparison did NOT run");
+  }
+  const found = /* @__PURE__ */ new Set();
   try {
     const dir = path.dirname(composeFile);
     const file = path.basename(composeFile);
-    const raw = execSync(`docker compose -f "${file}" ps --format json`, {
+    const override = path.join(dir, "docker-compose.override.yml");
+    const composeFiles = selected && existsSync(override) ? `-f "${file}" -f "${path.basename(override)}"` : `-f "${file}"`;
+    const raw = execSync(`docker compose ${composeFiles} ps --format json`, {
       cwd: dir,
       timeout: CHECK_TIMEOUT_MS,
       encoding: "utf8",
@@ -743,18 +764,26 @@ async function checkLiveArtifactMatchesManifest(composeFile, manifestPath, expec
     for (const line of raw.trim().split("\n").filter(Boolean)) {
       try {
         const c = JSON.parse(line);
+        const service = c.Service || c.service;
+        if (selected && (!service || !selected.has(service))) continue;
         const name = c.Name || c.name;
+        if (selected && name) found.add(service);
         if (name) names.push(name);
       } catch {
       }
     }
   } catch (err) {
+    if (selected) return scopedFailure(`could not enumerate selected containers: ${err instanceof Error ? err.message : String(err)} \u2014 comparison did NOT run`);
     return {
       check,
       status: "warn",
       message: `could not enumerate containers: ${err instanceof Error ? err.message : String(err)} \u2014 comparison did NOT run`
     };
   }
+  if (selected) {
+    const missing = [...selected].filter((service) => !found.has(service));
+    if (missing.length > 0) return scopedFailure(`selected compose service(s) absent: ${missing.join(", ")} \u2014 comparison did NOT run`);
+  }
   if (names.length === 0) {
     return { check, status: "warn", message: "no containers enumerated \u2014 comparison did NOT run" };
   }
@@ -772,8 +801,14 @@ async function checkLiveArtifactMatchesManifest(composeFile, manifestPath, expec
   const observed = [];
   for (const name of names) {
     const configured = inspect([name, "--format", "{{ .Config.Image }}"]);
-    if (!configured) continue;
+    if (!configured) {
+      if (selected) return scopedFailure(`selected container ${name} has no inspectable image \u2014 comparison did NOT run`);
+      continue;
+    }
     const imageId = inspect([name, "--format", "{{ .Image }}"]);
+    if (selected && !imageId) {
+      return scopedFailure(`selected container ${name} has no inspectable running image ID \u2014 comparison did NOT run`);
+    }
     let ref = configured;
     if (imageId) {
       const digestsRaw = inspect([imageId, "--format", "{{ json .RepoDigests }}"]);
@@ -782,9 +817,15 @@ async function checkLiveArtifactMatchesManifest(composeFile, manifestPath, expec
         if (Array.isArray(parsed) && parsed.length > 0) {
           const repo = (configured.split("@")[0] ?? "").replace(/:[^/:]+$/, "");
           const list = parsed.filter((x) => typeof x === "string");
+          if (selected && list.length === 0) {
+            return scopedFailure(`selected container ${name} has no inspectable image digest \u2014 comparison did NOT run`);
+          }
           ref = list.find((d) => d.startsWith(`${repo}@`)) ?? list[0] ?? configured;
+        } else if (selected) {
+          return scopedFailure(`selected container ${name} has no inspectable image digest \u2014 comparison did NOT run`);
         }
       } catch {
+        if (selected) return scopedFailure(`selected container ${name} has no parseable image digest \u2014 comparison did NOT run`);
       }
     }
     observed.push({ container: name, ref });
@@ -810,7 +851,12 @@ async function checkLiveArtifactMatchesManifest(composeFile, manifestPath, expec
   return {
     check,
     status: "fail",
-    verdicts: { ...report.counts },
+    // In a signed retained update every inspected container was selected for
+    // delivery. An undeclared or provenance-unknown selected image is just as
+    // unsafe as a same-repo digest mismatch. The updater's fatal gate keys on
+    // `disagrees`, so normalize all selected non-agreement findings to that
+    // fatal count while preserving the detailed verdicts in the message.
+    verdicts: selected ? { ...report.counts, disagrees: Math.max(report.counts.disagrees, report.findings.length) } : { ...report.counts },
     message: `${report.findings.length} artifact(s) are not what ${source} pins: ` + report.findings.map((f) => `${f.service} [${f.verdict}]`).join(", ") + `. Running: ${report.findings.map((f) => `${f.service}=${f.running?.digest ?? f.running?.ref ?? "(nothing running)"}`).join(", ")}`
   };
 }
@@ -849,7 +895,8 @@ async function runVerifyStack(options) {
   if (Date.now() > deadline) return summarize(results);
   addResult(await checkLiveArtifactMatchesManifest(composeFile, void 0, {
     stackVersion: options?.stackVersion,
-    declared: options?.expectedArtifacts
+    declared: options?.expectedArtifacts,
+    composeServices: options?.artifactComposeServices
   }));
   if (Date.now() > deadline) return summarize(results);
   addResult(await checkSsoSessionContract(env, deployed));

package/dist/{chunk-OWPOJ6OG.js → chunk-HWZZNUJJ.js}

@@ -4,7 +4,7 @@ import {
 import {
   flushBatch,
   writeMemory
-} from "./chunk-V4JWFJZR.js";
+} from "./chunk-B7T7I5BK.js";
 import {
   SUPPORT_PRODUCTS,
   isWellFormedCommit,

package/dist/{chunk-55M4DF76.js → chunk-I3OXYKU7.js}

@@ -1,12 +1,12 @@
 import {
   sessionScopeFilter
-} from "./chunk-V4RIHICU.js";
+} from "./chunk-7QYXNSKT.js";
 import {
   leaseExpiryIso
 } from "./chunk-E23LNUWJ.js";
 import {
   getProjectName
-} from "./chunk-GHIMWZN4.js";
+} from "./chunk-SQE2PHXK.js";
 
 // src/lib/subagent-observability.ts
 var MAX_RESULT_DIGEST_CHARS = 200;

package/dist/{chunk-BX336WRX.js → chunk-IACMGMGW.js}

@@ -1,6 +1,6 @@
 import {
   isManagementRole
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/lib/transcript-sidechain.ts
 import { readFileSync } from "fs";

package/dist/{chunk-MGPEY7I2.js → chunk-ICAGVBZ4.js}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-T4IDLAZM.js";
 import {
   getProjectName
-} from "./chunk-GHIMWZN4.js";
+} from "./chunk-SQE2PHXK.js";
 
 // src/lib/post-tool-memory.ts
 var NON_INGESTIBLE_TOOLS = /* @__PURE__ */ new Set([

package/dist/{chunk-V5KLIBUV.js → chunk-IDFOZ6YH.js}

@@ -15,7 +15,7 @@ import {
 import {
   getMasterKey,
   setMasterKey
-} from "./chunk-5AGOX2XD.js";
+} from "./chunk-ZFJ2KQNY.js";
 import {
   WINDOWS_UNSUPPORTED_EXIT,
   isWSL,

package/dist/{chunk-MOQBMEMW.js → chunk-J54BOM4G.js}

@@ -1,12 +1,12 @@
 import {
   sendMessage
-} from "./chunk-6FWHAROQ.js";
+} from "./chunk-OSLT3VAE.js";
 import {
   getActiveAgent
-} from "./chunk-RPOIKNJZ.js";
+} from "./chunk-LGP67CBT.js";
 import {
   resolveExeSession
-} from "./chunk-V4RIHICU.js";
+} from "./chunk-7QYXNSKT.js";
 import {
   getDispatcherSession
 } from "./chunk-PCV52RYM.js";
@@ -16,7 +16,7 @@ import {
 import {
   getCoordinatorName,
   isCoordinatorName
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/mcp/tools/send-message.ts
 import { z } from "zod";

package/dist/{chunk-SSGIMXA6.js → chunk-JDRIUUMY.js}

@@ -1,16 +1,16 @@
 import {
   extractMemoryGraph
-} from "./chunk-UALXBUDX.js";
+} from "./chunk-QJI5LPRJ.js";
 import {
   flushBatch,
   writeMemory
-} from "./chunk-V4JWFJZR.js";
+} from "./chunk-B7T7I5BK.js";
 import {
   extractKeywords
 } from "./chunk-CHCA3ZM2.js";
 import {
   getActiveAgent
-} from "./chunk-RPOIKNJZ.js";
+} from "./chunk-LGP67CBT.js";
 
 // src/mcp/tools/import-conversations.ts
 import { z } from "zod";

package/dist/{chunk-WUQSEZWR.js → chunk-JK5XB7Z5.js}

@@ -1,7 +1,7 @@
 import {
   checkLicense,
   loadLicense
-} from "./chunk-6VMVQ3G7.js";
+} from "./chunk-VX7I5XT6.js";
 
 // src/lib/license-gate.ts
 var _cachedLicense = null;

package/dist/{chunk-ZEYBEJBX.js → chunk-JWA3Y6PE.js}

@@ -7,10 +7,10 @@ import {
 } from "./chunk-S2YTU74T.js";
 import {
   createTask
-} from "./chunk-L2AUCHHJ.js";
+} from "./chunk-4VD4CIHX.js";
 import {
   getActiveAgent
-} from "./chunk-RPOIKNJZ.js";
+} from "./chunk-LGP67CBT.js";
 import {
   deriveTaskIdempotencyKey,
   ensureEmployeeAsync,
@@ -18,13 +18,13 @@ import {
   isExeSession,
   logTaskDispatch,
   resolveExeSession
-} from "./chunk-V4RIHICU.js";
+} from "./chunk-7QYXNSKT.js";
 import {
   getPaneCwdAsync
 } from "./chunk-6L4VIYLZ.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-OGJCUMSM.js";
+} from "./chunk-C3CRGIS4.js";
 import {
   releaseDispatchClaim,
   tryAcquireDispatchClaim,
@@ -37,7 +37,7 @@ import {
 } from "./chunk-GWAN2BDB.js";
 import {
   getLicenseSync
-} from "./chunk-KM7M4LKN.js";
+} from "./chunk-3HV3TRBB.js";
 import {
   isValidSessionScope
 } from "./chunk-BTSWFMEH.js";
@@ -46,7 +46,7 @@ import {
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-UYU25KCR.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";
@@ -891,7 +891,7 @@ Idempotent no-op (existing task unchanged; no execution side effects)`
       let claimWarning = "";
       const claimRefRaw = (work_ref ?? "").trim();
       try {
-        const { findConflicts, findConflictsInText, describeConflict, normalizeTarget } = await import("./work-claims-BB6S6QU5.js");
+        const { findConflicts, findConflictsInText, describeConflict, normalizeTarget } = await import("./work-claims-AURJKQOJ.js");
         const conflicts = claimRefRaw ? await findConflicts(
           [normalizeTarget({ kind: "work_ref", value: claimRefRaw })],
           callerRoot
@@ -958,7 +958,7 @@ Nothing was created or dispatched. Either pick different work, or \u2014 if that
         });
         if (claimRefRaw) {
           try {
-            const { acquireClaim } = await import("./work-claims-BB6S6QU5.js");
+            const { acquireClaim } = await import("./work-claims-AURJKQOJ.js");
             const acquired = await acquireClaim({
               targets: [{ kind: "work_ref", value: claimRefRaw }],
               holderSession: callerRoot,
@@ -1154,7 +1154,7 @@ Note: ${spawnOverrideNoopNotice(ignoredSpawnOverrides)}`;
       }
       if (claimRefRaw) {
         try {
-          const { acquireClaim } = await import("./work-claims-BB6S6QU5.js");
+          const { acquireClaim } = await import("./work-claims-AURJKQOJ.js");
           const acquired = await acquireClaim({
             targets: [{ kind: "work_ref", value: claimRefRaw }],
             holderSession: callerRoot,
@@ -1207,7 +1207,7 @@ Claimed ${claimRefRaw} for session ${callerRoot} (claim_group ${acquired.claimGr
           session_scope: sessionScope,
           created_at: (/* @__PURE__ */ new Date()).toISOString()
         }), "utf-8");
-        const { recordOrchestrationEventBestEffort: recordOE } = await import("./orchestration-events-ABHTWWN4.js");
+        const { recordOrchestrationEventBestEffort: recordOE } = await import("./orchestration-events-J6MGN7BL.js");
         recordOE({
           eventType: "signal.created",
           source: "create-task.mcp",
@@ -1240,7 +1240,7 @@ Claimed ${claimRefRaw} for session ${callerRoot} (claim_group ${acquired.claimGr
             let projectConflictOpts = {};
             try {
               const { getClient } = await import("./lib/database.js");
-              const { sessionScopeFilter } = await import("./task-scope-YHXKRO2Y.js");
+              const { sessionScopeFilter } = await import("./task-scope-Q4GALTXQ.js");
               const client = getClient();
               const scope = sessionScopeFilter(task.sessionScope || callerRoot || exeSession || null);
               const existing = await client.execute({

package/dist/{chunk-7UCCSSJO.js → chunk-KUJODN4N.js}

@@ -4,7 +4,7 @@ import {
 import {
   isValidX25519Recipient,
   pubKeyHash
-} from "./chunk-I4DBM5ME.js";
+} from "./chunk-NQG5CD3V.js";
 
 // src/lib/monitor-grants.ts
 import crypto from "crypto";

package/dist/{chunk-EHDAWQ5P.js → chunk-L5TOPOTW.js}

@@ -265,7 +265,7 @@ async function persistMemoryBatch(client, rows) {
   }
   const hygieneIds = inserted.filter((row) => row.supersedes_id).map((row) => row.id);
   if (hygieneIds.length > 0) {
-    const { scheduleSupersessionHygiene } = await import("./memory-maintenance-CD2PUBDK.js");
+    const { scheduleSupersessionHygiene } = await import("./memory-maintenance-BF6DEY23.js");
     scheduleSupersessionHygiene(hygieneIds);
   }
   return { outcomes, inserted };

package/dist/{chunk-RPOIKNJZ.js → chunk-LGP67CBT.js}

@@ -14,7 +14,7 @@ import {
   getEmployee,
   isCoordinatorRole,
   loadEmployeesSync
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-UYU25KCR.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";

package/dist/{chunk-LEA7VKPU.js → chunk-LHNMKY7N.js}

@@ -4,18 +4,18 @@ import {
 } from "./chunk-NEHOQ3P2.js";
 import {
   isCrdtSyncEnabled
-} from "./chunk-DSZM7OHM.js";
+} from "./chunk-CTMEIRJQ.js";
 import {
   orgMembershipsPath,
   orgModeActive
-} from "./chunk-INLY2LLN.js";
+} from "./chunk-XMQE5IBD.js";
 import {
   activeRecipientPubKeys,
   grantsPath,
   isGrantsMacPrimed,
   primeGrantsMacKey,
   warnActiveMonitoringOnce
-} from "./chunk-7UCCSSJO.js";
+} from "./chunk-KUJODN4N.js";
 import {
   assertGateAndGrantsColocated
 } from "./chunk-NPXIS2RY.js";
@@ -25,7 +25,7 @@ import {
 import {
   GHOST_BEHAVIOR_SQL,
   isGhostBehaviorRow
-} from "./chunk-LNCTMU7Y.js";
+} from "./chunk-Q7YT7RGZ.js";
 import {
   isTransientDaemonTransportError,
   retryOnDaemonTransportError
@@ -36,17 +36,17 @@ import {
   encryptSyncBlob,
   initSyncCrypto,
   isSyncCryptoInitialized
-} from "./chunk-G3KSUXEA.js";
+} from "./chunk-B4OZKTIS.js";
 import {
   getClient,
   isGenuineCorruptionError,
   loadEmployees,
   registerBinSymlinks,
   saveEmployees
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-UYU25KCR.js";
 import {
   loadDeviceId
-} from "./chunk-6VMVQ3G7.js";
+} from "./chunk-VX7I5XT6.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";
@@ -72,7 +72,7 @@ var _lastSealOrgMode = null;
 async function getSyncCipher() {
   if (_resolved) return _resolved;
   if (!orgModeActive()) {
-    const mod = await import("./founder-monitor-envelope-RBSOSB6K.js");
+    const mod = await import("./founder-monitor-envelope-KZCFNWMB.js");
     _monitoredWriter = mod.encryptMonitoredSyncBlob;
     _founderModuleLinked = true;
   }
@@ -1283,7 +1283,7 @@ async function cloudSync(config, options) {
           })
         };
         if (shouldUseCrdtMergeForCloudSync()) {
-          const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-RPCGSGIE.js");
+          const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-MKLAGQ44.js");
           initCrdtDoc();
           importExistingMemories(
             pullResult.records.map((rec) => ({
@@ -1844,7 +1844,7 @@ async function cloudSync(config, options) {
     const artifactResult = { pushed: 0, frozen: false, remaining: 0 };
     if (!shouldSkip("artifacts")) {
       try {
-        const { flushArtifactBackups } = await import("./artifact-backup-Q7T3GQFO.js");
+        const { flushArtifactBackups } = await import("./artifact-backup-VWQ6EYNO.js");
         const flushed = await flushArtifactBackups(cloudArtifactTransport(config));
         artifactResult.pushed = flushed.pushed;
         artifactResult.frozen = flushed.frozen;

package/dist/{chunk-Y5ZD4CTB.js → chunk-MBF7NXKP.js}

@@ -2,7 +2,7 @@ import {
   getClient,
   isCoordinatorName,
   loadEmployeesSync
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/lib/steward-gate.ts
 import crypto from "crypto";

package/dist/{chunk-ONYDMXRV.js → chunk-MT3P3B2L.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-WCGNCH3Q.js";
 import {
   registerAllTools
-} from "./chunk-M7DI6JWD.js";
+} from "./chunk-33D76SCE.js";
 
 // src/mcp/mcp-surface-hash.ts
 function computeMcpSurfaceHash() {

package/dist/{chunk-EHFPSOLD.js → chunk-MYGXI2UC.js}

@@ -1,13 +1,13 @@
 import {
   deactivateBehavior
-} from "./chunk-LNCTMU7Y.js";
+} from "./chunk-Q7YT7RGZ.js";
 import {
   getActiveAgent
-} from "./chunk-RPOIKNJZ.js";
+} from "./chunk-LGP67CBT.js";
 import {
   canCoordinate,
   getClient
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/mcp/tools/deactivate-behavior.ts
 import { z } from "zod";
@@ -24,7 +24,7 @@ function registerDeactivateBehavior(server) {
     async ({ behavior_id }) => {
       const caller = getActiveAgent();
       try {
-        const { StewardGate } = await import("./steward-gate-T2XM2NE4.js");
+        const { StewardGate } = await import("./steward-gate-BY7R6PJI.js");
         const steward = new StewardGate();
         const gateDecision = await steward.checkAuthority(caller.agentId || "unknown", "deactivate_behavior", behavior_id);
         if (!gateDecision.allowed) {

package/dist/{chunk-5YAXBLZR.js → chunk-NCKHGVDK.js}

@@ -1,7 +1,7 @@
 import {
   clean,
   stableId
-} from "./chunk-KY5XPFMA.js";
+} from "./chunk-OJG6S5OI.js";
 
 // src/lib/reflection-checkpoints.ts
 function parsePayload(payload) {

package/dist/{chunk-SUZWRZE5.js → chunk-NITCVCRV.js}

@@ -1,6 +1,6 @@
 import {
   isCoordinatorRole
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/lib/task-router.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-DXIMITSY.js → chunk-NJG3YVZI.js}

@@ -1,9 +1,9 @@
 import {
   listBehaviors
-} from "./chunk-LNCTMU7Y.js";
+} from "./chunk-Q7YT7RGZ.js";
 import {
   incrementSkillUsage
-} from "./chunk-JKUCAMV4.js";
+} from "./chunk-UQDCXE5D.js";
 
 // src/lib/behavior-injection.ts
 import { appendFile } from "fs/promises";
@@ -349,7 +349,7 @@ async function injectBehaviors(opts) {
       `[behavior-injection] ${opts.assignedTo} <- ${selected.length}/${behaviors.length} behaviour(s) for "${opts.title.slice(0, 60)}": ` + selected.map((s) => `${s.behavior.id.slice(0, 8)}(${s.score.toFixed(2)})`).join(" ") + "\n"
     );
     await incrementSkillUsage(selected.map((s) => s.behavior));
-    const { recordBehaviorsConsulted } = await import("./skill-usage-DO6M6W5E.js");
+    const { recordBehaviorsConsulted } = await import("./skill-usage-7HHQGIMF.js");
     await recordBehaviorsConsulted(selected.map((s) => s.behavior.id));
     return selected;
   } catch (err) {

package/dist/{chunk-I4DBM5ME.js → chunk-NQG5CD3V.js}

@@ -1,6 +1,6 @@
 import {
   getMasterKey
-} from "./chunk-5AGOX2XD.js";
+} from "./chunk-ZFJ2KQNY.js";
 
 // src/lib/monitor-identity.ts
 import crypto from "crypto";

package/dist/{chunk-3OG5LZRK.js → chunk-NUHCZF6C.js}

@@ -132,7 +132,7 @@ async function verifyOrBlock(hookPath) {
     process.stderr.write(`[SECURITY] Hook tamper detected: ${filename} \u2014 ${result.reason}
 `);
     try {
-      const { pushNotifyAsync } = await import("./push-notifications-UZQLJGEY.js");
+      const { pushNotifyAsync } = await import("./push-notifications-XXJDSJA6.js");
       pushNotifyAsync({
         event: "security_alert",
         title: "Hook tamper detected",

package/dist/{chunk-4CGMGUDL.js → chunk-OLRMWNOW.js}

@@ -1,6 +1,6 @@
 import {
   NO_DB_INTEGRITY_EVENTS
-} from "./chunk-U4GMOT4M.js";
+} from "./chunk-5TAJDCZY.js";
 import {
   resolveAnthropicAuth
 } from "./chunk-VGMACSEV.js";
@@ -85,7 +85,7 @@ async function getRetrievalHealth() {
     totalMemories = Number(totalRes.rows[0]?.cnt ?? 0);
     memoriesWithVectors = Number(vectorRes.rows[0]?.cnt ?? 0);
     try {
-      const { getGraphStats } = await import("./graph-query-4F4D4NDH.js");
+      const { getGraphStats } = await import("./graph-query-6HLVU6K6.js");
       const stats = await getGraphStats(client);
       entities = stats.entities;
       relationships = stats.relationships;
@@ -95,17 +95,28 @@ async function getRetrievalHealth() {
   }
   const staleCount = totalMemories - memoriesWithVectors;
   const coveragePct = totalMemories > 0 ? Math.round(memoriesWithVectors / totalMemories * 100) : null;
-  let dbRestore = { hasEvents: false, count: 0, last: null, quarantineFiles: 0 };
+  const ledgerReadFailures = {};
+  let dbRestore = {
+    hasEvents: false,
+    count: 0,
+    last: null,
+    quarantineFiles: 0,
+    readFailure: null
+  };
   try {
-    const { getDbRestoreHealth } = await import("./db-restore-events-XYL6CGPC.js");
+    const { getDbRestoreHealth } = await import("./db-restore-events-R5S7XTHX.js");
     dbRestore = getDbRestoreHealth();
-  } catch {
+    if (dbRestore.readFailure) ledgerReadFailures["db-restore"] = dbRestore.readFailure;
+  } catch (err) {
+    ledgerReadFailures["db-restore"] = err instanceof Error ? err.message : String(err);
   }
   let dbIntegrity = NO_INTEGRITY_EVENTS;
   try {
-    const { getDbIntegrityHealth } = await import("./db-integrity-events-7NKWS5MT.js");
+    const { getDbIntegrityHealth } = await import("./db-integrity-events-6363LLDT.js");
     dbIntegrity = getDbIntegrityHealth();
-  } catch {
+    if (dbIntegrity.readFailure) ledgerReadFailures["db-integrity"] = dbIntegrity.readFailure;
+  } catch (err) {
+    ledgerReadFailures["db-integrity"] = err instanceof Error ? err.message : String(err);
   }
   const summary = {
     embedDaemon,
@@ -126,7 +137,8 @@ async function getRetrievalHealth() {
       relationships
     },
     dbRestore,
-    dbIntegrity
+    dbIntegrity,
+    ledgerReadFailures
   };
   return {
     ...summary,
@@ -136,6 +148,14 @@ async function getRetrievalHealth() {
 var NO_INTEGRITY_EVENTS = NO_DB_INTEGRITY_EVENTS;
 function computeDegradations(h) {
   const out = [];
+  for (const [ledger, reason] of Object.entries(h.ledgerReadFailures ?? {})) {
+    out.push({
+      code: "db_event_ledger_unreadable",
+      severity: "critical",
+      message: `The ${ledger} event ledger could not be read (${reason}). Every figure derived from it below is a placeholder zero, NOT a finding: prior corruption, restore and backup-verification events may exist and are not visible.`,
+      remediation: "Check the permissions and contents of the ledger under ~/.exe-os/. Until it reads, treat DB integrity and restore history as UNKNOWN rather than clean."
+    });
+  }
   const isEmbeddingsDisabledByChoice = h.embedDaemon === "disabled" || h.searchMode.actual.includes("disabled by choice");
   const isRuntimeDowngrade = h.searchMode.actual.includes("degraded");
   const noVectorRetrieval = h.embedDaemon === "disabled" || h.searchMode.configured === "fts";

package/dist/{chunk-6FWHAROQ.js → chunk-OSLT3VAE.js}

@@ -8,14 +8,14 @@ import {
   resolveExeSession,
   sendIntercom,
   strictSessionScopeFilter
-} from "./chunk-V4RIHICU.js";
+} from "./chunk-7QYXNSKT.js";
 import {
   parseMessage,
   serializeMessage
 } from "./chunk-TDF2XKLK.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-OGJCUMSM.js";
+} from "./chunk-C3CRGIS4.js";
 import {
   getSessionKey
 } from "./chunk-CVYC6DUW.js";
@@ -24,7 +24,7 @@ import {
 } from "./chunk-BTSWFMEH.js";
 import {
   getClient
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-UYU25KCR.js";
 
 // src/lib/messaging.ts
 import crypto from "crypto";

package/dist/{chunk-EG4ZUF4A.js → chunk-OURGAT7A.js}

@@ -2,10 +2,10 @@ import {
   listWorkflowDefinitions,
   runWorkflow,
   startWorkflow
-} from "./chunk-JC3LUYW6.js";
+} from "./chunk-YUMZXMKO.js";
 import {
   ingest
-} from "./chunk-LVFD2DVI.js";
+} from "./chunk-7ECQZXUE.js";
 import {
   initCRMBridge
 } from "./chunk-ML4S5SHZ.js";