@askexenow/exe-os 0.9.65 → 0.9.67

package/dist/bin/exe-launch-agent.js

@@ -214,6 +214,11 @@ function normalizeAutoUpdate(raw) {
   const userAU = raw.autoUpdate ?? {};
   raw.autoUpdate = { ...defaultAU, ...userAU };
 }
+function normalizeOrchestration(raw) {
+  const defaultOrg = DEFAULT_CONFIG.orchestration;
+  const userOrg = raw.orchestration ?? {};
+  raw.orchestration = { ...defaultOrg, ...userOrg };
+}
 async function loadConfig() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
   await ensurePrivateDir(dir);
@@ -238,10 +243,15 @@ async function loadConfig() {
     normalizeScalingRoadmap(migratedCfg);
     normalizeSessionLifecycle(migratedCfg);
     normalizeAutoUpdate(migratedCfg);
+    normalizeOrchestration(migratedCfg);
     const config = { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db"), ...migratedCfg };
     if (config.dbPath.startsWith("~")) {
       config.dbPath = config.dbPath.replace(/^~/, os.homedir());
     }
+    const envDbPath = path.join(dir, "memories.db");
+    if (process.env.EXE_OS_DIR && config.dbPath !== envDbPath && !existsSync2(config.dbPath) && existsSync2(envDbPath)) {
+      config.dbPath = envDbPath;
+    }
     return config;
   } catch {
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
@@ -261,7 +271,16 @@ function loadConfigSync() {
     normalizeScalingRoadmap(migratedCfg);
     normalizeSessionLifecycle(migratedCfg);
     normalizeAutoUpdate(migratedCfg);
-    return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db"), ...migratedCfg };
+    normalizeOrchestration(migratedCfg);
+    const config = { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db"), ...migratedCfg };
+    if (config.dbPath.startsWith("~")) {
+      config.dbPath = config.dbPath.replace(/^~/, os.homedir());
+    }
+    const envDbPath = path.join(dir, "memories.db");
+    if (process.env.EXE_OS_DIR && config.dbPath !== envDbPath && !existsSync2(config.dbPath) && existsSync2(envDbPath)) {
+      config.dbPath = envDbPath;
+    }
+    return config;
   } catch {
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
   }
@@ -282,6 +301,7 @@ async function loadConfigFrom(configPath) {
     normalizeScalingRoadmap(migratedCfg);
     normalizeSessionLifecycle(migratedCfg);
     normalizeAutoUpdate(migratedCfg);
+    normalizeOrchestration(migratedCfg);
     return { ...DEFAULT_CONFIG, ...migratedCfg };
   } catch {
     return { ...DEFAULT_CONFIG };
@@ -353,6 +373,10 @@ var init_config = __esm({
         checkOnBoot: true,
         autoInstall: false,
         checkIntervalMs: 24 * 60 * 60 * 1e3
+      },
+      orchestration: {
+        phase: "phase_1_coo",
+        phaseSetBy: "default"
       }
     };
     CONFIG_MIGRATIONS = [
@@ -1050,6 +1074,17 @@ var init_daemon_auth = __esm({
 });
 
 // src/lib/exe-daemon-client.ts
+var exe_daemon_client_exports = {};
+__export(exe_daemon_client_exports, {
+  connectEmbedDaemon: () => connectEmbedDaemon,
+  disconnectClient: () => disconnectClient,
+  embedBatchViaClient: () => embedBatchViaClient,
+  embedViaClient: () => embedViaClient,
+  isClientConnected: () => isClientConnected,
+  pingDaemon: () => pingDaemon,
+  sendDaemonRequest: () => sendDaemonRequest,
+  sendIngestRequest: () => sendIngestRequest
+});
 import net from "net";
 import os4 from "os";
 import { spawn } from "child_process";
@@ -1286,6 +1321,9 @@ async function connectEmbedDaemon() {
   }
   return false;
 }
+function sendRequest(texts, priority) {
+  return sendDaemonRequest({ texts, priority });
+}
 function sendDaemonRequest(payload, timeoutMs = REQUEST_TIMEOUT_MS) {
   return new Promise((resolve) => {
     if (!_socket || !_connected) {
@@ -1308,10 +1346,170 @@ function sendDaemonRequest(payload, timeoutMs = REQUEST_TIMEOUT_MS) {
     }
   });
 }
+async function pingDaemon() {
+  if (!_socket || !_connected) return null;
+  const response = await sendDaemonRequest({ type: "health" }, 5e3);
+  if (response.health) {
+    return response.health;
+  }
+  return null;
+}
+function killAndRespawnDaemon() {
+  if (!acquireSpawnLock()) {
+    process.stderr.write("[exed-client] Another process is already restarting daemon \u2014 skipping\n");
+    if (_socket) {
+      _socket.destroy();
+      _socket = null;
+    }
+    _connected = false;
+    _buffer = "";
+    return;
+  }
+  try {
+    process.stderr.write("[exed-client] Killing daemon for restart...\n");
+    if (existsSync5(PID_PATH)) {
+      try {
+        const pid = parseInt(readFileSync4(PID_PATH, "utf8").trim(), 10);
+        if (pid > 0) {
+          try {
+            process.kill(pid, "SIGKILL");
+          } catch {
+          }
+        }
+      } catch {
+      }
+    }
+    if (_socket) {
+      _socket.destroy();
+      _socket = null;
+    }
+    _connected = false;
+    _buffer = "";
+    try {
+      unlinkSync2(PID_PATH);
+    } catch {
+    }
+    try {
+      unlinkSync2(SOCKET_PATH);
+    } catch {
+    }
+    spawnDaemon();
+  } finally {
+    releaseSpawnLock();
+  }
+}
+function isDaemonTooYoung() {
+  try {
+    const stat = statSync(PID_PATH);
+    return Date.now() - stat.mtimeMs < MIN_DAEMON_AGE_MS;
+  } catch {
+    return false;
+  }
+}
+async function retryThenRestart(doRequest, label) {
+  const result = await doRequest();
+  if (!result.error) {
+    _consecutiveFailures = 0;
+    return result;
+  }
+  _consecutiveFailures++;
+  for (let i = 0; i < MAX_RETRIES_BEFORE_RESTART; i++) {
+    const delayMs = RETRY_DELAYS_MS[i] ?? 5e3;
+    process.stderr.write(`[exed-client] ${label} failed (${result.error}), retry ${i + 1}/${MAX_RETRIES_BEFORE_RESTART} in ${delayMs}ms
+`);
+    await new Promise((r) => setTimeout(r, delayMs));
+    if (!_connected) {
+      if (!await connectToSocket()) continue;
+    }
+    const retry = await doRequest();
+    if (!retry.error) {
+      _consecutiveFailures = 0;
+      return retry;
+    }
+    _consecutiveFailures++;
+  }
+  if (isDaemonTooYoung()) {
+    process.stderr.write(`[exed-client] ${label}: daemon too young (< ${MIN_DAEMON_AGE_MS / 1e3}s) \u2014 skipping restart
+`);
+    return { error: result.error };
+  }
+  process.stderr.write(`[exed-client] ${label}: ${_consecutiveFailures} consecutive failures \u2014 restarting daemon
+`);
+  killAndRespawnDaemon();
+  const start = Date.now();
+  let delay2 = 200;
+  while (Date.now() - start < CONNECT_TIMEOUT_MS) {
+    await new Promise((r) => setTimeout(r, delay2));
+    if (await connectToSocket()) break;
+    delay2 = Math.min(delay2 * 2, 3e3);
+  }
+  if (!_connected) return { error: "Daemon restart failed" };
+  const final = await doRequest();
+  if (!final.error) _consecutiveFailures = 0;
+  return final;
+}
+async function embedViaClient(text, priority = "high") {
+  if (!_connected && !await connectEmbedDaemon()) return null;
+  _requestCount++;
+  if (_requestCount % HEALTH_CHECK_INTERVAL === 0) {
+    const health = await pingDaemon();
+    if (!health && !isDaemonTooYoung()) {
+      process.stderr.write(`[exed-client] Periodic health check failed at request ${_requestCount} \u2014 restarting daemon
+`);
+      killAndRespawnDaemon();
+      const start = Date.now();
+      let d = 200;
+      while (Date.now() - start < CONNECT_TIMEOUT_MS) {
+        await new Promise((r) => setTimeout(r, d));
+        if (await connectToSocket()) break;
+        d = Math.min(d * 2, 3e3);
+      }
+      if (!_connected) return null;
+    }
+  }
+  const result = await retryThenRestart(
+    () => sendRequest([text], priority),
+    "Embed"
+  );
+  return !result.error && result.vectors?.[0] ? result.vectors[0] : null;
+}
+async function embedBatchViaClient(texts, priority = "high") {
+  if (!_connected && !await connectEmbedDaemon()) return null;
+  _requestCount++;
+  const result = await retryThenRestart(
+    () => sendRequest(texts, priority),
+    "Batch embed"
+  );
+  return !result.error && result.vectors ? result.vectors : null;
+}
+function disconnectClient() {
+  if (_socket) {
+    _socket.destroy();
+    _socket = null;
+  }
+  _connected = false;
+  _buffer = "";
+  for (const [id, entry] of _pending) {
+    clearTimeout(entry.timer);
+    _pending.delete(id);
+    entry.resolve({ error: "Client disconnected" });
+  }
+}
 function isClientConnected() {
   return _connected;
 }
-var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, DAEMON_TOKEN_ENV, _socket, _connected, _buffer, _pending, MAX_BUFFER;
+function sendIngestRequest(payload) {
+  if (!_socket || !_connected) return false;
+  try {
+    const id = randomUUID();
+    const token = process.env[DAEMON_TOKEN_ENV] ?? readDaemonToken();
+    _socket.write(JSON.stringify({ id, token, type: "ingest", ...payload }) + "\n");
+    return true;
+  } catch {
+    return false;
+  }
+}
+var SOCKET_PATH, PID_PATH, SPAWN_LOCK_PATH, SPAWN_LOCK_STALE_MS, CONNECT_TIMEOUT_MS, REQUEST_TIMEOUT_MS, DAEMON_TOKEN_ENV, _socket, _connected, _buffer, _requestCount, _consecutiveFailures, HEALTH_CHECK_INTERVAL, MAX_RETRIES_BEFORE_RESTART, RETRY_DELAYS_MS, MIN_DAEMON_AGE_MS, _pending, MAX_BUFFER;
 var init_exe_daemon_client = __esm({
   "src/lib/exe-daemon-client.ts"() {
     "use strict";
@@ -1327,12 +1525,27 @@ var init_exe_daemon_client = __esm({
     _socket = null;
     _connected = false;
     _buffer = "";
+    _requestCount = 0;
+    _consecutiveFailures = 0;
+    HEALTH_CHECK_INTERVAL = 100;
+    MAX_RETRIES_BEFORE_RESTART = 3;
+    RETRY_DELAYS_MS = [1e3, 3e3, 5e3];
+    MIN_DAEMON_AGE_MS = 3e4;
     _pending = /* @__PURE__ */ new Map();
     MAX_BUFFER = 1e7;
   }
 });
 
 // src/lib/daemon-protocol.ts
+var daemon_protocol_exports = {};
+__export(daemon_protocol_exports, {
+  deserializeArgs: () => deserializeArgs,
+  deserializeResultSet: () => deserializeResultSet,
+  deserializeValue: () => deserializeValue,
+  serializeArgs: () => serializeArgs,
+  serializeResultSet: () => serializeResultSet,
+  serializeValue: () => serializeValue
+});
 function serializeValue(v) {
   if (v === null || v === void 0) return null;
   if (typeof v === "bigint") return Number(v);
@@ -1357,6 +1570,32 @@ function deserializeValue(v) {
   }
   return v;
 }
+function serializeArgs(args) {
+  return args.map(serializeValue);
+}
+function deserializeArgs(args) {
+  return args.map(deserializeValue);
+}
+function serializeResultSet(rs) {
+  const rows = [];
+  for (const row of rs.rows) {
+    const obj = {};
+    for (let i = 0; i < rs.columns.length; i++) {
+      const col = rs.columns[i];
+      if (col !== void 0) {
+        obj[col] = serializeValue(row[i]);
+      }
+    }
+    rows.push(obj);
+  }
+  return {
+    columns: [...rs.columns],
+    columnTypes: [...rs.columnTypes ?? []],
+    rows,
+    rowsAffected: typeof rs.rowsAffected === "bigint" ? Number(rs.rowsAffected) : rs.rowsAffected ?? 0,
+    lastInsertRowid: rs.lastInsertRowid != null ? typeof rs.lastInsertRowid === "bigint" ? Number(rs.lastInsertRowid) : rs.lastInsertRowid : null
+  };
+}
 function deserializeResultSet(srs) {
   const rows = srs.rows.map((obj) => {
     const values = srs.columns.map(
@@ -1607,6 +1846,9 @@ function getClient() {
   if (_daemonClient && _daemonClient._isDaemonActive()) {
     return _daemonClient;
   }
+  if (!_resilientClient) {
+    return _adapterClient;
+  }
   return _resilientClient;
 }
 async function initDaemonClient() {
@@ -2639,6 +2881,127 @@ async function ensureSchema() {
       VALUES (new.rowid, new.content, new.subject, new.predicate, new.object);
     END;
   `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS agent_sessions (
+      id              TEXT PRIMARY KEY,
+      agent_id        TEXT NOT NULL,
+      project_name    TEXT,
+      started_at      TEXT NOT NULL,
+      last_event_at   TEXT NOT NULL,
+      event_count     INTEGER NOT NULL DEFAULT 0,
+      properties      TEXT DEFAULT '{}'
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_sessions_agent_time
+      ON agent_sessions(agent_id, started_at);
+
+    CREATE TABLE IF NOT EXISTS agent_goals (
+      id                TEXT PRIMARY KEY,
+      statement         TEXT NOT NULL,
+      owner_agent_id    TEXT,
+      project_name      TEXT,
+      status            TEXT NOT NULL DEFAULT 'open',
+      priority          INTEGER NOT NULL DEFAULT 5,
+      success_criteria  TEXT,
+      parent_goal_id    TEXT,
+      due_at            TEXT,
+      achieved_at       TEXT,
+      supersedes_id     TEXT,
+      created_at        TEXT NOT NULL,
+      updated_at        TEXT NOT NULL,
+      source_memory_id  TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_goals_project_status
+      ON agent_goals(project_name, status, priority);
+
+    CREATE TABLE IF NOT EXISTS agent_events (
+      id                  TEXT PRIMARY KEY,
+      event_type          TEXT NOT NULL,
+      occurred_at         TEXT NOT NULL,
+      sequence_index      INTEGER NOT NULL,
+      actor_agent_id      TEXT,
+      agent_role          TEXT,
+      project_name        TEXT,
+      session_id          TEXT,
+      task_id             TEXT,
+      goal_id             TEXT,
+      parent_event_id     TEXT,
+      intention           TEXT,
+      outcome             TEXT,
+      evidence_memory_id  TEXT,
+      impact              TEXT,
+      payload             TEXT DEFAULT '{}',
+      created_at          TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_events_time
+      ON agent_events(occurred_at, sequence_index);
+
+    CREATE INDEX IF NOT EXISTS idx_agent_events_session_seq
+      ON agent_events(session_id, sequence_index);
+
+    CREATE INDEX IF NOT EXISTS idx_agent_events_goal_time
+      ON agent_events(goal_id, occurred_at);
+
+    CREATE INDEX IF NOT EXISTS idx_agent_events_memory
+      ON agent_events(evidence_memory_id);
+
+    CREATE TABLE IF NOT EXISTS agent_goal_links (
+      id           TEXT PRIMARY KEY,
+      goal_id      TEXT NOT NULL,
+      link_type    TEXT NOT NULL,
+      target_id    TEXT NOT NULL,
+      target_type  TEXT NOT NULL,
+      created_at   TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_goal_links_goal
+      ON agent_goal_links(goal_id, target_type);
+
+    CREATE TABLE IF NOT EXISTS agent_semantic_labels (
+      id                TEXT PRIMARY KEY,
+      source_memory_id  TEXT NOT NULL,
+      event_id          TEXT,
+      labeler           TEXT NOT NULL,
+      schema_version    INTEGER NOT NULL DEFAULT 1,
+      confidence        REAL NOT NULL DEFAULT 0,
+      labels            TEXT NOT NULL,
+      created_at        TEXT NOT NULL,
+      updated_at        TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_memory
+      ON agent_semantic_labels(source_memory_id, labeler);
+
+    CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_event
+      ON agent_semantic_labels(event_id);
+
+    CREATE TABLE IF NOT EXISTS agent_reflection_checkpoints (
+      id                  TEXT PRIMARY KEY,
+      project_name        TEXT,
+      session_id          TEXT,
+      window_start_at     TEXT NOT NULL,
+      window_end_at       TEXT NOT NULL,
+      event_count         INTEGER NOT NULL DEFAULT 0,
+      goal_count          INTEGER NOT NULL DEFAULT 0,
+      success_count       INTEGER NOT NULL DEFAULT 0,
+      failure_count       INTEGER NOT NULL DEFAULT 0,
+      risk_count          INTEGER NOT NULL DEFAULT 0,
+      summary             TEXT NOT NULL,
+      learnings           TEXT NOT NULL DEFAULT '[]',
+      next_actions        TEXT NOT NULL DEFAULT '[]',
+      evidence_event_ids  TEXT NOT NULL DEFAULT '[]',
+      confidence          REAL NOT NULL DEFAULT 0,
+      created_at          TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_reflection_project_time
+      ON agent_reflection_checkpoints(project_name, window_end_at);
+
+    CREATE INDEX IF NOT EXISTS idx_agent_reflection_session_time
+      ON agent_reflection_checkpoints(session_id, window_end_at);
+  `);
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN tier INTEGER DEFAULT 3`,
@@ -2786,270 +3149,827 @@ var init_database = __esm({
   }
 });
 
-// src/lib/shard-manager.ts
-var shard_manager_exports = {};
-__export(shard_manager_exports, {
-  auditShardHealth: () => auditShardHealth,
-  disposeShards: () => disposeShards,
-  ensureShardSchema: () => ensureShardSchema,
-  getOpenShardCount: () => getOpenShardCount,
-  getReadyShardClient: () => getReadyShardClient,
-  getShardClient: () => getShardClient,
-  getShardsDir: () => getShardsDir,
-  initShardManager: () => initShardManager,
-  isShardingEnabled: () => isShardingEnabled,
-  listShards: () => listShards,
-  shardExists: () => shardExists
-});
-import path7 from "path";
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync3, statSync as statSync2 } from "fs";
-import { createClient as createClient2 } from "@libsql/client";
-function initShardManager(encryptionKey) {
-  _encryptionKey = encryptionKey;
-  if (!existsSync7(SHARDS_DIR)) {
-    mkdirSync2(SHARDS_DIR, { recursive: true });
-  }
-  _shardingEnabled = true;
-  if (_evictionTimer) clearInterval(_evictionTimer);
-  _evictionTimer = setInterval(evictIdleShards, EVICTION_INTERVAL_MS);
-  _evictionTimer.unref();
+// src/lib/keychain.ts
+import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
+import { existsSync as existsSync6, statSync as statSync2 } from "fs";
+import { execSync as execSync2 } from "child_process";
+import path6 from "path";
+import os5 from "os";
+function getKeyDir() {
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path6.join(os5.homedir(), ".exe-os");
 }
-function isShardingEnabled() {
-  return _shardingEnabled;
+function getKeyPath() {
+  return path6.join(getKeyDir(), "master.key");
 }
-function getShardsDir() {
-  return SHARDS_DIR;
+function nativeKeychainAllowed() {
+  return process.env.EXE_OS_DISABLE_NATIVE_KEYCHAIN !== "1";
 }
-function getShardClient(projectName) {
-  if (!_encryptionKey) {
-    throw new Error("Shard manager not initialized. Call initShardManager() first.");
+function linuxSecretAvailable() {
+  if (!nativeKeychainAllowed()) return false;
+  if (process.platform !== "linux") return false;
+  if (linuxSecretAvailability !== null) return linuxSecretAvailability;
+  try {
+    execSync2("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
+  } catch {
+    linuxSecretAvailability = false;
+    return false;
   }
-  const safeName = safeShardName(projectName);
-  if (!safeName || safeName === "unknown") {
-    throw new Error(`Invalid project name for shard: "${projectName}" (resolved to "${safeName}")`);
+  try {
+    execSync2("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
+    linuxSecretAvailability = true;
+  } catch {
+    linuxSecretAvailability = false;
   }
-  const cached = _shards.get(safeName);
-  if (cached) {
-    _shardLastAccess.set(safeName, Date.now());
-    return cached;
+  return linuxSecretAvailability;
+}
+function isRootOnlyTrustedServerKeyFile(keyPath) {
+  if (process.platform !== "linux") return false;
+  try {
+    const uid = typeof os5.userInfo().uid === "number" ? os5.userInfo().uid : -1;
+    const st = statSync2(keyPath);
+    if (!st.isFile() || (st.mode & 63) !== 0) return false;
+    if (uid === 0) return true;
+    const exeOsDir = process.env.EXE_OS_DIR;
+    return Boolean(exeOsDir && path6.resolve(keyPath).startsWith(path6.resolve(exeOsDir) + path6.sep));
+  } catch {
+    return false;
   }
-  while (_shards.size >= MAX_OPEN_SHARDS) {
-    evictLRU();
+}
+function macKeychainGet(service = SERVICE) {
+  if (!nativeKeychainAllowed()) return null;
+  if (process.platform !== "darwin") return null;
+  try {
+    return execSync2(
+      `security find-generic-password -s "${service}" -a "${ACCOUNT}" -w 2>/dev/null`,
+      { encoding: "utf-8", timeout: 5e3 }
+    ).trim();
+  } catch {
+    return null;
   }
-  const dbPath = path7.join(SHARDS_DIR, `${safeName}.db`);
-  const client = createClient2({
-    url: `file:${dbPath}`,
-    encryptionKey: _encryptionKey
-  });
-  _shards.set(safeName, client);
-  _shardLastAccess.set(safeName, Date.now());
-  return client;
 }
-function shardExists(projectName) {
-  const safeName = safeShardName(projectName);
-  return existsSync7(path7.join(SHARDS_DIR, `${safeName}.db`));
+function macKeychainSet(value, service = SERVICE) {
+  if (!nativeKeychainAllowed()) return false;
+  if (process.platform !== "darwin") return false;
+  try {
+    try {
+      execSync2(
+        `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
+        { timeout: 5e3 }
+      );
+    } catch {
+    }
+    execSync2(
+      `security add-generic-password -s "${service}" -a "${ACCOUNT}" -w "${value}"`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
 }
-function safeShardName(projectName) {
-  return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+function macKeychainDelete(service = SERVICE) {
+  if (!nativeKeychainAllowed()) return false;
+  if (process.platform !== "darwin") return false;
+  try {
+    execSync2(
+      `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
 }
-function listShards() {
-  if (!existsSync7(SHARDS_DIR)) return [];
-  return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
+function linuxSecretGet(service = SERVICE) {
+  if (!linuxSecretAvailable()) return null;
+  try {
+    return execSync2(
+      `secret-tool lookup service "${service}" account "${ACCOUNT}" 2>/dev/null`,
+      { encoding: "utf-8", timeout: 5e3 }
+    ).trim();
+  } catch {
+    return null;
+  }
 }
-async function auditShardHealth(options = {}) {
-  if (!_encryptionKey) {
-    throw new Error("Shard manager not initialized. Call initShardManager() first.");
+function linuxSecretSet(value, service = SERVICE) {
+  if (!linuxSecretAvailable()) return false;
+  try {
+    execSync2(
+      `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${service}" account "${ACCOUNT}" 2>/dev/null`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
   }
-  const repair = options.repair === true;
-  const dryRun = options.dryRun === true;
-  const names = listShards();
-  const shards = [];
-  for (const name of names) {
-    const dbPath = path7.join(SHARDS_DIR, `${name}.db`);
-    const stat = statSync2(dbPath);
-    const item = {
-      name,
-      path: dbPath,
-      ok: false,
-      unreadable: false,
-      error: null,
-      size: stat.size,
-      mtime: stat.mtime.toISOString(),
-      memoryCount: null
-    };
-    const client = createClient2({
-      url: `file:${dbPath}`,
-      encryptionKey: _encryptionKey
-    });
-    try {
-      await client.execute("SELECT COUNT(*) as cnt FROM sqlite_schema");
-      const hasMemories = await client.execute(
-        "SELECT COUNT(*) as cnt FROM sqlite_schema WHERE type = 'table' AND name = 'memories'"
-      );
-      if (Number(hasMemories.rows[0]?.cnt ?? 0) > 0) {
-        const mem = await client.execute("SELECT COUNT(*) as cnt FROM memories");
-        item.memoryCount = Number(mem.rows[0]?.cnt ?? 0);
-      }
-      item.ok = true;
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      item.error = message;
-      item.unreadable = /SQLITE_NOTADB|file is not a database/i.test(message);
-      if (item.unreadable && repair && !dryRun) {
-        client.close();
-        _shards.delete(name);
-        _shardLastAccess.delete(name);
-        const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-        const archivedPath = path7.join(SHARDS_DIR, `${name}.db.broken-${stamp}`);
-        renameSync3(dbPath, archivedPath);
-        item.archivedPath = archivedPath;
-      }
-    } finally {
-      try {
-        client.close();
-      } catch {
-      }
-    }
-    shards.push(item);
+}
+function linuxSecretDelete(service = SERVICE) {
+  if (!nativeKeychainAllowed()) return false;
+  if (process.platform !== "linux") return false;
+  try {
+    execSync2(
+      `secret-tool clear service "${service}" account "${ACCOUNT}" 2>/dev/null`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
   }
-  return {
-    total: shards.length,
-    ok: shards.filter((s) => s.ok).length,
-    unreadable: shards.filter((s) => s.unreadable).length,
-    archived: shards.filter((s) => Boolean(s.archivedPath)).length,
-    shards
-  };
 }
-async function ensureShardSchema(client) {
-  await client.execute("PRAGMA journal_mode = WAL");
-  await client.execute("PRAGMA busy_timeout = 30000");
+async function tryKeytar() {
+  if (!nativeKeychainAllowed()) return null;
   try {
-    await client.execute("PRAGMA libsql_vector_search_ef = 128");
+    return await import("keytar");
   } catch {
+    return null;
   }
-  await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS memories (
-      id            TEXT PRIMARY KEY,
-      agent_id      TEXT NOT NULL,
-      agent_role    TEXT NOT NULL,
-      session_id    TEXT NOT NULL,
-      timestamp     TEXT NOT NULL,
-      tool_name     TEXT NOT NULL,
-      project_name  TEXT NOT NULL,
-      has_error     INTEGER NOT NULL DEFAULT 0,
-      raw_text      TEXT NOT NULL,
-      vector        F32_BLOB(1024),
-      version       INTEGER NOT NULL DEFAULT 0
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_memories_agent ON memories(agent_id);
-    CREATE INDEX IF NOT EXISTS idx_memories_timestamp ON memories(timestamp);
-    CREATE INDEX IF NOT EXISTS idx_memories_agent_project ON memories(agent_id, project_name);
-  `);
-  await client.executeMultiple(`
-    CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(
-      raw_text,
-      content='memories',
-      content_rowid='rowid'
-    );
-
-    CREATE TRIGGER IF NOT EXISTS memories_fts_ai AFTER INSERT ON memories BEGIN
-      INSERT INTO memories_fts(rowid, raw_text) VALUES (new.rowid, new.raw_text);
-    END;
-
-    CREATE TRIGGER IF NOT EXISTS memories_fts_ad AFTER DELETE ON memories BEGIN
-      INSERT INTO memories_fts(memories_fts, rowid, raw_text) VALUES('delete', old.rowid, old.raw_text);
-    END;
-
-    CREATE TRIGGER IF NOT EXISTS memories_fts_au AFTER UPDATE ON memories BEGIN
-      INSERT INTO memories_fts(memories_fts, rowid, raw_text) VALUES('delete', old.rowid, old.raw_text);
-      INSERT INTO memories_fts(rowid, raw_text) VALUES (new.rowid, new.raw_text);
-    END;
-  `);
-  for (const col of [
-    "ALTER TABLE memories ADD COLUMN task_id TEXT",
-    "ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0",
-    "ALTER TABLE memories ADD COLUMN author_device_id TEXT",
-    "ALTER TABLE memories ADD COLUMN scope TEXT NOT NULL DEFAULT 'business'",
-    "ALTER TABLE memories ADD COLUMN importance INTEGER DEFAULT 5",
-    "ALTER TABLE memories ADD COLUMN status TEXT DEFAULT 'active'",
-    "ALTER TABLE memories ADD COLUMN wiki_synced INTEGER DEFAULT 0",
-    "ALTER TABLE memories ADD COLUMN graph_extracted INTEGER DEFAULT 0",
-    "ALTER TABLE memories ADD COLUMN content_hash TEXT",
-    "ALTER TABLE memories ADD COLUMN graph_extracted_hash TEXT",
-    "ALTER TABLE memories ADD COLUMN confidence REAL DEFAULT 0.7",
-    "ALTER TABLE memories ADD COLUMN last_accessed TEXT",
-    // Wiki linkage columns (must match database.ts)
-    "ALTER TABLE memories ADD COLUMN workspace_id TEXT",
-    "ALTER TABLE memories ADD COLUMN document_id TEXT",
-    "ALTER TABLE memories ADD COLUMN user_id TEXT",
-    "ALTER TABLE memories ADD COLUMN char_offset INTEGER",
-    "ALTER TABLE memories ADD COLUMN page_number INTEGER",
-    // Source provenance columns (must match database.ts)
-    "ALTER TABLE memories ADD COLUMN source_path TEXT",
-    "ALTER TABLE memories ADD COLUMN source_type TEXT DEFAULT 'text'",
-    "ALTER TABLE memories ADD COLUMN tier INTEGER DEFAULT 3",
-    "ALTER TABLE memories ADD COLUMN supersedes_id TEXT",
-    // MS-11: draft staging, MS-6a: memory_type, MS-7: trajectory
-    "ALTER TABLE memories ADD COLUMN draft INTEGER DEFAULT 0",
-    "ALTER TABLE memories ADD COLUMN memory_type TEXT DEFAULT 'raw'",
-    "ALTER TABLE memories ADD COLUMN trajectory TEXT",
-    // Metadata enrichment columns (must match database.ts)
-    "ALTER TABLE memories ADD COLUMN intent TEXT",
-    "ALTER TABLE memories ADD COLUMN outcome TEXT",
-    "ALTER TABLE memories ADD COLUMN domain TEXT",
-    "ALTER TABLE memories ADD COLUMN referenced_entities TEXT",
-    "ALTER TABLE memories ADD COLUMN retrieval_count INTEGER DEFAULT 0",
-    "ALTER TABLE memories ADD COLUMN chain_position TEXT",
-    "ALTER TABLE memories ADD COLUMN review_status TEXT",
-    "ALTER TABLE memories ADD COLUMN context_window_pct INTEGER",
-    "ALTER TABLE memories ADD COLUMN file_paths TEXT",
-    "ALTER TABLE memories ADD COLUMN commit_hash TEXT",
-    "ALTER TABLE memories ADD COLUMN duration_ms INTEGER",
-    "ALTER TABLE memories ADD COLUMN token_cost REAL",
-    "ALTER TABLE memories ADD COLUMN audience TEXT",
-    "ALTER TABLE memories ADD COLUMN language_type TEXT",
-    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
-    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
-  ]) {
-    try {
-      await client.execute(col);
-    } catch {
-    }
+}
+function deriveMachineKey() {
+  try {
+    const crypto3 = __require("crypto");
+    const material = [
+      os5.hostname(),
+      os5.userInfo().username,
+      os5.arch(),
+      os5.platform(),
+      // Machine ID on Linux (stable across reboots)
+      process.platform === "linux" ? readMachineId() : ""
+    ].join("|");
+    return crypto3.createHash("sha256").update(material).digest();
+  } catch {
+    return null;
   }
-  for (const idx of [
-    "CREATE INDEX IF NOT EXISTS idx_memories_tier ON memories(tier)",
-    "CREATE INDEX IF NOT EXISTS idx_memories_supersedes ON memories(supersedes_id) WHERE supersedes_id IS NOT NULL",
-    "CREATE INDEX IF NOT EXISTS idx_memories_scoped_content_hash ON memories(content_hash, agent_id, project_name, memory_type) WHERE content_hash IS NOT NULL"
-  ]) {
-    try {
-      await client.execute(idx);
-    } catch {
-    }
+}
+function readMachineId() {
+  try {
+    const { readFileSync: readFileSync7 } = __require("fs");
+    return readFileSync7("/etc/machine-id", "utf-8").trim();
+  } catch {
+    return "";
   }
+}
+function encryptWithMachineKey(plaintext, machineKey) {
+  const crypto3 = __require("crypto");
+  const iv = crypto3.randomBytes(12);
+  const cipher = crypto3.createCipheriv("aes-256-gcm", machineKey, iv);
+  let encrypted = cipher.update(plaintext, "utf-8", "base64");
+  encrypted += cipher.final("base64");
+  const authTag = cipher.getAuthTag().toString("base64");
+  return `${ENCRYPTED_PREFIX}${iv.toString("base64")}:${authTag}:${encrypted}`;
+}
+function decryptWithMachineKey(encrypted, machineKey) {
+  if (!encrypted.startsWith(ENCRYPTED_PREFIX)) return null;
   try {
-    await client.execute("CREATE INDEX IF NOT EXISTS idx_memories_status ON memories(status)");
+    const crypto3 = __require("crypto");
+    const parts = encrypted.slice(ENCRYPTED_PREFIX.length).split(":");
+    if (parts.length !== 3) return null;
+    const [ivB64, tagB64, cipherB64] = parts;
+    const iv = Buffer.from(ivB64, "base64");
+    const authTag = Buffer.from(tagB64, "base64");
+    const decipher = crypto3.createDecipheriv("aes-256-gcm", machineKey, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(cipherB64, "base64", "utf-8");
+    decrypted += decipher.final("utf-8");
+    return decrypted;
   } catch {
+    return null;
   }
-  for (const idx of [
-    "CREATE INDEX IF NOT EXISTS idx_memories_workspace ON memories(workspace_id)",
-    "CREATE INDEX IF NOT EXISTS idx_memories_document ON memories(document_id)",
-    "CREATE INDEX IF NOT EXISTS idx_memories_user ON memories(user_id)"
-  ]) {
+}
+async function writeMachineBoundFileFallback(b64) {
+  const dir = getKeyDir();
+  await mkdir3(dir, { recursive: true });
+  const keyPath = getKeyPath();
+  const machineKey = deriveMachineKey();
+  if (machineKey) {
+    const encrypted = encryptWithMachineKey(b64, machineKey);
+    await writeFile3(keyPath, encrypted + "\n", "utf-8");
+    await chmod2(keyPath, 384);
+    return "encrypted";
+  }
+  await writeFile3(keyPath, b64 + "\n", "utf-8");
+  await chmod2(keyPath, 384);
+  return "plaintext";
+}
+async function getMasterKey() {
+  let nativeValue = macKeychainGet() ?? linuxSecretGet();
+  if (!nativeValue) {
+    const legacyValue = macKeychainGet(LEGACY_SERVICE) ?? linuxSecretGet(LEGACY_SERVICE);
+    if (legacyValue) {
+      const migrated = macKeychainSet(legacyValue) || linuxSecretSet(legacyValue);
+      if (migrated) {
+        macKeychainDelete(LEGACY_SERVICE);
+        linuxSecretDelete(LEGACY_SERVICE);
+        process.stderr.write("[keychain] Migrated keychain service from exe-mem to exe-os.\n");
+      }
+      nativeValue = legacyValue;
+    }
+  }
+  if (nativeValue) {
+    return Buffer.from(nativeValue, "base64");
+  }
+  const keytar = await tryKeytar();
+  if (keytar) {
     try {
-      await client.execute(idx);
+      const keytarValue = await keytar.getPassword(SERVICE, ACCOUNT);
+      const legacyKeytarValue = keytarValue ?? await keytar.getPassword(LEGACY_SERVICE, ACCOUNT);
+      if (legacyKeytarValue) {
+        const migrated = macKeychainSet(legacyKeytarValue) || linuxSecretSet(legacyKeytarValue);
+        if (migrated) {
+          process.stderr.write("[keychain] Migrated key from keytar to native keychain.\n");
+          try {
+            await keytar.deletePassword(LEGACY_SERVICE, ACCOUNT);
+          } catch {
+          }
+        }
+        return Buffer.from(legacyKeytarValue, "base64");
+      }
     } catch {
     }
   }
-  await client.executeMultiple(`
-    CREATE TABLE IF NOT EXISTS entities (
-      id TEXT PRIMARY KEY,
-      name TEXT NOT NULL,
-      type TEXT NOT NULL,
-      first_seen TEXT NOT NULL,
-      last_seen TEXT NOT NULL,
-      properties TEXT DEFAULT '{}',
-      UNIQUE(name, type)
+  const keyPath = getKeyPath();
+  if (!existsSync6(keyPath)) {
+    process.stderr.write(
+      `[keychain] Key not found at ${keyPath} (HOME=${os5.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
+`
+    );
+    return null;
+  }
+  try {
+    const content = (await readFile3(keyPath, "utf-8")).trim();
+    let b64Value;
+    if (content.startsWith(ENCRYPTED_PREFIX)) {
+      const machineKey = deriveMachineKey();
+      if (!machineKey) {
+        process.stderr.write("[keychain] Cannot derive machine key to decrypt stored key.\n");
+        return null;
+      }
+      const decrypted = decryptWithMachineKey(content, machineKey);
+      if (!decrypted) {
+        process.stderr.write(
+          "[keychain] Key decryption failed \u2014 machine may have changed.\n  Use your 24-word recovery phrase during setup: exe-os setup\n"
+        );
+        return null;
+      }
+      b64Value = decrypted;
+    } else {
+      b64Value = content;
+    }
+    const key = Buffer.from(b64Value, "base64");
+    if (!content.startsWith(ENCRYPTED_PREFIX) && isRootOnlyTrustedServerKeyFile(keyPath)) {
+      return key;
+    }
+    const migrated = macKeychainSet(b64Value) || linuxSecretSet(b64Value);
+    if (migrated) {
+      process.stderr.write("[keychain] Migrated key from file to native keychain.\n");
+      try {
+        await unlink(keyPath);
+        process.stderr.write("[keychain] Removed legacy master.key file after native keychain migration.\n");
+      } catch {
+      }
+    } else if (!content.startsWith(ENCRYPTED_PREFIX)) {
+      const fallback = await writeMachineBoundFileFallback(b64Value);
+      if (fallback === "encrypted") {
+        process.stderr.write("[keychain] Upgraded legacy plaintext master.key to machine-bound encrypted fallback.\n");
+      } else {
+        process.stderr.write(
+          "[keychain] WARNING: Could not encrypt legacy master.key \u2014 plaintext fallback remains.\n"
+        );
+      }
+    }
+    return key;
+  } catch (err) {
+    process.stderr.write(
+      `[keychain] Key read failed at ${keyPath}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return null;
+  }
+}
+var SERVICE, LEGACY_SERVICE, ACCOUNT, linuxSecretAvailability, ENCRYPTED_PREFIX;
+var init_keychain = __esm({
+  "src/lib/keychain.ts"() {
+    "use strict";
+    SERVICE = "exe-os";
+    LEGACY_SERVICE = "exe-mem";
+    ACCOUNT = "master-key";
+    linuxSecretAvailability = null;
+    ENCRYPTED_PREFIX = "enc:";
+  }
+});
+
+// src/lib/state-bus.ts
+var StateBus, orgBus;
+var init_state_bus = __esm({
+  "src/lib/state-bus.ts"() {
+    "use strict";
+    StateBus = class {
+      handlers = /* @__PURE__ */ new Map();
+      globalHandlers = /* @__PURE__ */ new Set();
+      /** Emit an event to all subscribers */
+      emit(event) {
+        const typeHandlers = this.handlers.get(event.type);
+        if (typeHandlers) {
+          for (const handler of typeHandlers) {
+            try {
+              handler(event);
+            } catch {
+            }
+          }
+        }
+        for (const handler of this.globalHandlers) {
+          try {
+            handler(event);
+          } catch {
+          }
+        }
+      }
+      /** Subscribe to a specific event type */
+      on(type, handler) {
+        if (!this.handlers.has(type)) {
+          this.handlers.set(type, /* @__PURE__ */ new Set());
+        }
+        this.handlers.get(type).add(handler);
+      }
+      /** Subscribe to ALL events */
+      onAny(handler) {
+        this.globalHandlers.add(handler);
+      }
+      /** Unsubscribe from a specific event type */
+      off(type, handler) {
+        this.handlers.get(type)?.delete(handler);
+      }
+      /** Unsubscribe from ALL events */
+      offAny(handler) {
+        this.globalHandlers.delete(handler);
+      }
+      /** Remove all listeners */
+      clear() {
+        this.handlers.clear();
+        this.globalHandlers.clear();
+      }
+    };
+    orgBus = new StateBus();
+  }
+});
+
+// src/lib/memory-write-governor.ts
+import { createHash } from "crypto";
+function normalizeMemoryText(text) {
+  return text.replace(/\r\n/g, "\n").replace(/[ \t]+$/gm, "").replace(/\n{4,}/g, "\n\n\n").trim();
+}
+function classifyMemoryType(input) {
+  if (input.memory_type && input.memory_type.trim()) return input.memory_type.trim();
+  const tool = input.tool_name.toLowerCase();
+  const text = input.raw_text.toLowerCase();
+  if (tool.includes("store_decision") || tool.includes("decision")) return "decision";
+  if (tool.includes("commit") || text.includes("adr-") || text.includes("architectural decision")) return "adr";
+  if (tool.includes("store_behavior") || tool.includes("behavior")) return "behavior";
+  if (tool.includes("global_procedure") || text.includes("organization-wide procedures")) return "procedure";
+  if (tool.includes("checkpoint") || text.startsWith("context checkpoint")) return "checkpoint";
+  if (tool.includes("sessionsummary") || tool.includes("session-summary")) return "summary";
+  if (tool.includes("sessionend") || text.startsWith("session ended")) return "summary";
+  if (tool.includes("send_whatsapp") || tool.includes("conversation")) return "conversation";
+  if (tool === "store_memory" || tool === "manual") return "observation";
+  return "raw";
+}
+function shouldDropMemory(text) {
+  const normalized = normalizeMemoryText(text);
+  if (normalized.length < 10) return { drop: true, reason: "too_short" };
+  if (NOISE_DROP_PATTERNS.some((pattern) => pattern.test(normalized))) {
+    return { drop: true, reason: "known_boilerplate_noise" };
+  }
+  return { drop: false };
+}
+function shouldSkipEmbedding(input) {
+  const type = classifyMemoryType(input);
+  if (HIGH_VALUE_SUPERSESSION_TYPES.has(type)) return false;
+  if (type === "raw" && input.raw_text.length > 2e4) return true;
+  if (SKIP_EMBED_PATTERNS.some((pattern) => pattern.test(input.raw_text))) return true;
+  return false;
+}
+function hashMemoryContent(text) {
+  return createHash("sha256").update(normalizeMemoryText(text)).digest("hex");
+}
+function scopedDedupArgs(input) {
+  return [input.contentHash, input.agentId, input.projectName, input.memoryType];
+}
+function governMemoryRecord(record) {
+  const normalized = normalizeMemoryText(record.raw_text);
+  const memoryType = classifyMemoryType({
+    raw_text: normalized,
+    agent_id: record.agent_id,
+    project_name: record.project_name,
+    tool_name: record.tool_name,
+    memory_type: record.memory_type
+  });
+  const drop = shouldDropMemory(normalized);
+  const skipEmbedding = shouldSkipEmbedding({
+    raw_text: normalized,
+    agent_id: record.agent_id,
+    project_name: record.project_name,
+    tool_name: record.tool_name,
+    memory_type: memoryType
+  });
+  return {
+    record: {
+      ...record,
+      raw_text: normalized,
+      memory_type: memoryType,
+      vector: skipEmbedding ? null : record.vector
+    },
+    contentHash: hashMemoryContent(normalized),
+    shouldDrop: drop.drop,
+    dropReason: drop.reason,
+    skipEmbedding,
+    hygiene: {
+      dedup: true,
+      supersession: HIGH_VALUE_SUPERSESSION_TYPES.has(memoryType)
+    }
+  };
+}
+async function findScopedDuplicate(input) {
+  const { getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+  const client = getClient2();
+  const args = scopedDedupArgs(input);
+  let sql = `SELECT id FROM memories
+             WHERE content_hash = ?
+               AND agent_id = ?
+               AND project_name = ?
+               AND COALESCE(memory_type, 'raw') = ?
+               AND COALESCE(status, 'active') != 'deleted'`;
+  if (input.excludeId) {
+    sql += " AND id != ?";
+    args.push(input.excludeId);
+  }
+  sql += " ORDER BY timestamp DESC LIMIT 1";
+  const result = await client.execute({ sql, args });
+  return result.rows[0]?.id ? String(result.rows[0].id) : null;
+}
+async function runPostWriteMemoryHygiene(memoryId) {
+  try {
+    const { getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+    const client = getClient2();
+    const current = await client.execute({
+      sql: `SELECT id, agent_id, project_name, memory_type, content_hash, supersedes_id,
+                   importance, timestamp
+            FROM memories
+            WHERE id = ?
+            LIMIT 1`,
+      args: [memoryId]
+    });
+    const row = current.rows[0];
+    if (!row) return;
+    const memoryType = String(row.memory_type ?? "raw");
+    const contentHash = row.content_hash ? String(row.content_hash) : null;
+    const agentId = String(row.agent_id);
+    const projectName = String(row.project_name);
+    if (contentHash) {
+      await client.execute({
+        sql: `UPDATE memories
+              SET status = 'deleted',
+                  outcome = COALESCE(outcome, 'superseded')
+              WHERE id != ?
+                AND content_hash = ?
+                AND agent_id = ?
+                AND project_name = ?
+                AND COALESCE(memory_type, 'raw') = ?
+                AND COALESCE(status, 'active') = 'active'`,
+        args: [memoryId, contentHash, agentId, projectName, memoryType]
+      });
+    }
+    const supersedesId = row.supersedes_id ? String(row.supersedes_id) : null;
+    if (supersedesId && HIGH_VALUE_SUPERSESSION_TYPES.has(memoryType)) {
+      const old = await client.execute({
+        sql: `SELECT importance FROM memories WHERE id = ? LIMIT 1`,
+        args: [supersedesId]
+      });
+      const oldImportance = Number(old.rows[0]?.importance ?? 0);
+      const newImportance = Number(row.importance ?? 0);
+      await client.batch([
+        {
+          sql: `UPDATE memories
+                SET status = 'archived',
+                    outcome = COALESCE(outcome, 'superseded')
+                WHERE id = ?`,
+          args: [supersedesId]
+        },
+        {
+          sql: `UPDATE memories
+                SET importance = MAX(COALESCE(importance, 5), ?),
+                    parent_memory_id = COALESCE(parent_memory_id, ?)
+                WHERE id = ?`,
+          args: [Math.max(oldImportance, newImportance), supersedesId, memoryId]
+        }
+      ], "write");
+    }
+  } catch (err) {
+    process.stderr.write(
+      `[memory-governor] post-write hygiene failed for ${memoryId}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+}
+function schedulePostWriteMemoryHygiene(memoryIds) {
+  if (process.env.EXE_SKIP_MEMORY_HYGIENE === "1") return;
+  if (memoryIds.length === 0) return;
+  const run = () => {
+    void Promise.all(memoryIds.map((id) => runPostWriteMemoryHygiene(id)));
+  };
+  if (typeof setImmediate === "function") setImmediate(run);
+  else setTimeout(run, 0);
+}
+var HIGH_VALUE_SUPERSESSION_TYPES, NOISE_DROP_PATTERNS, SKIP_EMBED_PATTERNS;
+var init_memory_write_governor = __esm({
+  "src/lib/memory-write-governor.ts"() {
+    "use strict";
+    HIGH_VALUE_SUPERSESSION_TYPES = /* @__PURE__ */ new Set([
+      "decision",
+      "adr",
+      "behavior",
+      "procedure"
+    ]);
+    NOISE_DROP_PATTERNS = [
+      /^\s*\[📋\s+\d+\s+reviews?\s+pending\b/im,
+      /^\s*<system-reminder>[\s\S]*?<\/system-reminder>\s*$/im,
+      /^\s*The UserPromptSubmit hook checks the DB for new tasks/im,
+      /^\s*Intercom is a speedup, not delivery/im,
+      /^\s*Context bar reads as USAGE not remaining/im
+    ];
+    SKIP_EMBED_PATTERNS = [
+      /tmux capture-pane\b/i,
+      /docker ps\b/i,
+      /docker images\b/i,
+      /git status\b/i,
+      /grep .*node_modules/i,
+      /npm (install|ci)\b[\s\S]*(added \d+ packages|audited \d+ packages)/i
+    ];
+  }
+});
+
+// src/lib/shard-manager.ts
+var shard_manager_exports = {};
+__export(shard_manager_exports, {
+  auditShardHealth: () => auditShardHealth,
+  disposeShards: () => disposeShards,
+  ensureShardSchema: () => ensureShardSchema,
+  getOpenShardCount: () => getOpenShardCount,
+  getReadyShardClient: () => getReadyShardClient,
+  getShardClient: () => getShardClient,
+  getShardsDir: () => getShardsDir,
+  initShardManager: () => initShardManager,
+  isShardingEnabled: () => isShardingEnabled,
+  listShards: () => listShards,
+  shardExists: () => shardExists
+});
+import path7 from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync3, statSync as statSync3 } from "fs";
+import { createClient as createClient2 } from "@libsql/client";
+function initShardManager(encryptionKey) {
+  _encryptionKey = encryptionKey;
+  if (!existsSync7(SHARDS_DIR)) {
+    mkdirSync2(SHARDS_DIR, { recursive: true });
+  }
+  _shardingEnabled = true;
+  if (_evictionTimer) clearInterval(_evictionTimer);
+  _evictionTimer = setInterval(evictIdleShards, EVICTION_INTERVAL_MS);
+  _evictionTimer.unref();
+}
+function isShardingEnabled() {
+  return _shardingEnabled;
+}
+function getShardsDir() {
+  return SHARDS_DIR;
+}
+function getShardClient(projectName) {
+  if (!_encryptionKey) {
+    throw new Error("Shard manager not initialized. Call initShardManager() first.");
+  }
+  const safeName = safeShardName(projectName);
+  if (!safeName || safeName === "unknown") {
+    throw new Error(`Invalid project name for shard: "${projectName}" (resolved to "${safeName}")`);
+  }
+  const cached = _shards.get(safeName);
+  if (cached) {
+    _shardLastAccess.set(safeName, Date.now());
+    return cached;
+  }
+  while (_shards.size >= MAX_OPEN_SHARDS) {
+    evictLRU();
+  }
+  const dbPath = path7.join(SHARDS_DIR, `${safeName}.db`);
+  const client = createClient2({
+    url: `file:${dbPath}`,
+    encryptionKey: _encryptionKey
+  });
+  _shards.set(safeName, client);
+  _shardLastAccess.set(safeName, Date.now());
+  return client;
+}
+function shardExists(projectName) {
+  const safeName = safeShardName(projectName);
+  return existsSync7(path7.join(SHARDS_DIR, `${safeName}.db`));
+}
+function safeShardName(projectName) {
+  return projectName.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
+function listShards() {
+  if (!existsSync7(SHARDS_DIR)) return [];
+  return readdirSync(SHARDS_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(".db", ""));
+}
+async function auditShardHealth(options = {}) {
+  if (!_encryptionKey) {
+    throw new Error("Shard manager not initialized. Call initShardManager() first.");
+  }
+  const repair = options.repair === true;
+  const dryRun = options.dryRun === true;
+  const names = listShards();
+  const shards = [];
+  for (const name of names) {
+    const dbPath = path7.join(SHARDS_DIR, `${name}.db`);
+    const stat = statSync3(dbPath);
+    const item = {
+      name,
+      path: dbPath,
+      ok: false,
+      unreadable: false,
+      error: null,
+      size: stat.size,
+      mtime: stat.mtime.toISOString(),
+      memoryCount: null
+    };
+    const client = createClient2({
+      url: `file:${dbPath}`,
+      encryptionKey: _encryptionKey
+    });
+    try {
+      await client.execute("SELECT COUNT(*) as cnt FROM sqlite_schema");
+      const hasMemories = await client.execute(
+        "SELECT COUNT(*) as cnt FROM sqlite_schema WHERE type = 'table' AND name = 'memories'"
+      );
+      if (Number(hasMemories.rows[0]?.cnt ?? 0) > 0) {
+        const mem = await client.execute("SELECT COUNT(*) as cnt FROM memories");
+        item.memoryCount = Number(mem.rows[0]?.cnt ?? 0);
+      }
+      item.ok = true;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      item.error = message;
+      item.unreadable = /SQLITE_NOTADB|file is not a database/i.test(message);
+      if (item.unreadable && repair && !dryRun) {
+        client.close();
+        _shards.delete(name);
+        _shardLastAccess.delete(name);
+        const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+        const archivedPath = path7.join(SHARDS_DIR, `${name}.db.broken-${stamp}`);
+        renameSync3(dbPath, archivedPath);
+        item.archivedPath = archivedPath;
+      }
+    } finally {
+      try {
+        client.close();
+      } catch {
+      }
+    }
+    shards.push(item);
+  }
+  return {
+    total: shards.length,
+    ok: shards.filter((s) => s.ok).length,
+    unreadable: shards.filter((s) => s.unreadable).length,
+    archived: shards.filter((s) => Boolean(s.archivedPath)).length,
+    shards
+  };
+}
+async function ensureShardSchema(client) {
+  await client.execute("PRAGMA journal_mode = WAL");
+  await client.execute("PRAGMA busy_timeout = 30000");
+  try {
+    await client.execute("PRAGMA libsql_vector_search_ef = 128");
+  } catch {
+  }
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS memories (
+      id            TEXT PRIMARY KEY,
+      agent_id      TEXT NOT NULL,
+      agent_role    TEXT NOT NULL,
+      session_id    TEXT NOT NULL,
+      timestamp     TEXT NOT NULL,
+      tool_name     TEXT NOT NULL,
+      project_name  TEXT NOT NULL,
+      has_error     INTEGER NOT NULL DEFAULT 0,
+      raw_text      TEXT NOT NULL,
+      vector        F32_BLOB(1024),
+      version       INTEGER NOT NULL DEFAULT 0
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_memories_agent ON memories(agent_id);
+    CREATE INDEX IF NOT EXISTS idx_memories_timestamp ON memories(timestamp);
+    CREATE INDEX IF NOT EXISTS idx_memories_agent_project ON memories(agent_id, project_name);
+  `);
+  await client.executeMultiple(`
+    CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(
+      raw_text,
+      content='memories',
+      content_rowid='rowid'
+    );
+
+    CREATE TRIGGER IF NOT EXISTS memories_fts_ai AFTER INSERT ON memories BEGIN
+      INSERT INTO memories_fts(rowid, raw_text) VALUES (new.rowid, new.raw_text);
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS memories_fts_ad AFTER DELETE ON memories BEGIN
+      INSERT INTO memories_fts(memories_fts, rowid, raw_text) VALUES('delete', old.rowid, old.raw_text);
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS memories_fts_au AFTER UPDATE ON memories BEGIN
+      INSERT INTO memories_fts(memories_fts, rowid, raw_text) VALUES('delete', old.rowid, old.raw_text);
+      INSERT INTO memories_fts(rowid, raw_text) VALUES (new.rowid, new.raw_text);
+    END;
+  `);
+  for (const col of [
+    "ALTER TABLE memories ADD COLUMN task_id TEXT",
+    "ALTER TABLE memories ADD COLUMN consolidated INTEGER NOT NULL DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN author_device_id TEXT",
+    "ALTER TABLE memories ADD COLUMN scope TEXT NOT NULL DEFAULT 'business'",
+    "ALTER TABLE memories ADD COLUMN importance INTEGER DEFAULT 5",
+    "ALTER TABLE memories ADD COLUMN status TEXT DEFAULT 'active'",
+    "ALTER TABLE memories ADD COLUMN wiki_synced INTEGER DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN graph_extracted INTEGER DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN content_hash TEXT",
+    "ALTER TABLE memories ADD COLUMN graph_extracted_hash TEXT",
+    "ALTER TABLE memories ADD COLUMN confidence REAL DEFAULT 0.7",
+    "ALTER TABLE memories ADD COLUMN last_accessed TEXT",
+    // Wiki linkage columns (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN workspace_id TEXT",
+    "ALTER TABLE memories ADD COLUMN document_id TEXT",
+    "ALTER TABLE memories ADD COLUMN user_id TEXT",
+    "ALTER TABLE memories ADD COLUMN char_offset INTEGER",
+    "ALTER TABLE memories ADD COLUMN page_number INTEGER",
+    // Source provenance columns (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN source_path TEXT",
+    "ALTER TABLE memories ADD COLUMN source_type TEXT DEFAULT 'text'",
+    "ALTER TABLE memories ADD COLUMN tier INTEGER DEFAULT 3",
+    "ALTER TABLE memories ADD COLUMN supersedes_id TEXT",
+    // MS-11: draft staging, MS-6a: memory_type, MS-7: trajectory
+    "ALTER TABLE memories ADD COLUMN draft INTEGER DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN memory_type TEXT DEFAULT 'raw'",
+    "ALTER TABLE memories ADD COLUMN trajectory TEXT",
+    // Metadata enrichment columns (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN intent TEXT",
+    "ALTER TABLE memories ADD COLUMN outcome TEXT",
+    "ALTER TABLE memories ADD COLUMN domain TEXT",
+    "ALTER TABLE memories ADD COLUMN referenced_entities TEXT",
+    "ALTER TABLE memories ADD COLUMN retrieval_count INTEGER DEFAULT 0",
+    "ALTER TABLE memories ADD COLUMN chain_position TEXT",
+    "ALTER TABLE memories ADD COLUMN review_status TEXT",
+    "ALTER TABLE memories ADD COLUMN context_window_pct INTEGER",
+    "ALTER TABLE memories ADD COLUMN file_paths TEXT",
+    "ALTER TABLE memories ADD COLUMN commit_hash TEXT",
+    "ALTER TABLE memories ADD COLUMN duration_ms INTEGER",
+    "ALTER TABLE memories ADD COLUMN token_cost REAL",
+    "ALTER TABLE memories ADD COLUMN audience TEXT",
+    "ALTER TABLE memories ADD COLUMN language_type TEXT",
+    "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
+  ]) {
+    try {
+      await client.execute(col);
+    } catch {
+    }
+  }
+  for (const idx of [
+    "CREATE INDEX IF NOT EXISTS idx_memories_tier ON memories(tier)",
+    "CREATE INDEX IF NOT EXISTS idx_memories_supersedes ON memories(supersedes_id) WHERE supersedes_id IS NOT NULL",
+    "CREATE INDEX IF NOT EXISTS idx_memories_scoped_content_hash ON memories(content_hash, agent_id, project_name, memory_type) WHERE content_hash IS NOT NULL"
+  ]) {
+    try {
+      await client.execute(idx);
+    } catch {
+    }
+  }
+  try {
+    await client.execute("CREATE INDEX IF NOT EXISTS idx_memories_status ON memories(status)");
+  } catch {
+  }
+  for (const idx of [
+    "CREATE INDEX IF NOT EXISTS idx_memories_workspace ON memories(workspace_id)",
+    "CREATE INDEX IF NOT EXISTS idx_memories_document ON memories(document_id)",
+    "CREATE INDEX IF NOT EXISTS idx_memories_user ON memories(user_id)"
+  ]) {
+    try {
+      await client.execute(idx);
+    } catch {
+    }
+  }
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS entities (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      type TEXT NOT NULL,
+      first_seen TEXT NOT NULL,
+      last_seen TEXT NOT NULL,
+      properties TEXT DEFAULT '{}',
+      UNIQUE(name, type)
     );
 
     CREATE TABLE IF NOT EXISTS relationships (
@@ -3119,7 +4039,7 @@ async function getReadyShardClient(projectName) {
     _shardLastAccess.delete(safeName);
     const dbPath = path7.join(SHARDS_DIR, `${safeName}.db`);
     if (existsSync7(dbPath)) {
-      const stat = statSync2(dbPath);
+      const stat = statSync3(dbPath);
       const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
       const archivedPath = path7.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
       renameSync3(dbPath, archivedPath);
@@ -3239,6 +4159,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Founder -> coordinator (the executive agent, internally routed as 'COO') -> CTO/CMO. CTO -> engineers. CMO -> content production. Never skip levels: the coordinator does not bypass managers for specialist work. Specialists report to their manager. If you need cross-team info, use ask_team_memory \u2014 don't read other agents' task folders. Each level owns dispatch downward and review upward."
       },
+      {
+        title: "Customer orchestration maturity \u2014 recommend, never trap",
+        domain: "workflow",
+        priority: "p1",
+        content: "New customers start best in Phase 1: founder \u2194 coordinator/Chief of Staff, building company context. Suggest Phase 2 executives when domain work repeats; suggest Phase 3 parallel execution only when review/permission gates are ready. This is guidance, not a blocker: users may jump phases anytime. Never overwrite their phase, role titles, identities, or custom org design."
+      },
       {
         title: "Single dispatch path \u2014 create_task only",
         domain: "workflow",
@@ -3297,6 +4223,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Commit discipline \u2014 never leave verified work floating",
+        domain: "workflow",
+        priority: "p1",
+        content: "After any code-change batch passes typecheck/tests/build, run git status, summarize changed files, and commit with a clear message before ending the session. If work must remain uncommitted for review/dogfood, explicitly say so, list the files, and state the blocker. Never imply work is complete while verified changes are still floating locally."
+      },
       {
         title: "Desktop and TUI are the same product",
         domain: "architecture",
@@ -3570,933 +4502,1268 @@ async function searchMemoryCards(queryText, agentId, options) {
   let sql = `SELECT c.id, c.memory_id, c.agent_id, c.session_id, c.project_name,
                     c.timestamp, c.card_type, c.content, c.source_ref, c.confidence
              FROM memory_cards c
-             JOIN memory_cards_fts fts ON c.rowid = fts.rowid
-             WHERE memory_cards_fts MATCH ?
-               AND c.agent_id = ?
-               AND COALESCE(c.active, 1) = 1`;
-  const args = [matchExpr, agentId];
-  if (options?.projectName) {
-    sql += ` AND c.project_name = ?`;
-    args.push(options.projectName);
-  }
-  if (options?.since) {
-    sql += ` AND c.timestamp >= ?`;
-    args.push(options.since);
-  }
-  sql += ` ORDER BY rank LIMIT ?`;
-  args.push(limit);
-  const result = await getClient().execute({ sql, args });
-  return result.rows.map((row) => ({
-    id: `card:${String(row.id)}`,
-    agent_id: String(row.agent_id),
-    agent_role: "memory_card",
-    session_id: String(row.session_id),
-    timestamp: String(row.timestamp),
-    tool_name: `memory_card:${String(row.card_type)}`,
-    project_name: row.project_name == null ? "" : String(row.project_name),
-    has_error: false,
-    raw_text: `[${String(row.card_type)}] ${String(row.content)}
-Source memory: ${String(row.source_ref ?? row.memory_id)}`,
-    vector: [],
-    importance: 6,
-    status: "active",
-    confidence: Number(row.confidence ?? 0.6),
-    last_accessed: String(row.timestamp)
-  }));
-}
-var MAX_CARDS_PER_MEMORY, MAX_SENTENCE_CHARS;
-var init_memory_cards = __esm({
-  "src/lib/memory-cards.ts"() {
-    "use strict";
-    init_database();
-    MAX_CARDS_PER_MEMORY = 6;
-    MAX_SENTENCE_CHARS = 360;
-  }
-});
-
-// src/lib/session-key.ts
-import { execSync as execSync4 } from "child_process";
-function normalizeCommand(command) {
-  const trimmed = command.trim().toLowerCase();
-  const parts = trimmed.split(/[\\/]/);
-  return parts[parts.length - 1] ?? trimmed;
-}
-function detectRuntimeFromCommand(command) {
-  const normalized = normalizeCommand(command);
-  for (const [runtime, commands] of Object.entries(RUNTIME_COMMANDS)) {
-    if (commands.includes(normalized)) {
-      return runtime;
-    }
-  }
-  return null;
-}
-function resolveRuntimeProcess() {
-  let pid = process.ppid;
-  for (let i = 0; i < 10; i++) {
-    try {
-      const info = execSync4(`ps -p ${pid} -o ppid=,comm=`, {
-        encoding: "utf8",
-        timeout: 2e3
-      }).trim();
-      const match = info.match(/^\s*(\d+)\s+(.+)$/);
-      if (!match) break;
-      const [, ppid, cmd] = match;
-      const runtime = detectRuntimeFromCommand(cmd ?? "");
-      if (runtime) {
-        return { pid: String(pid), runtime };
-      }
-      pid = parseInt(ppid, 10);
-      if (pid <= 1) break;
-    } catch {
-      break;
-    }
-  }
-  return null;
-}
-function getSessionKey() {
-  if (_cached) return _cached;
-  if (process.env.EXE_SESSION_KEY) {
-    _cached = process.env.EXE_SESSION_KEY;
-    return _cached;
-  }
-  const resolved = resolveRuntimeProcess();
-  if (resolved) {
-    _cachedRuntime = resolved.runtime;
-    _cached = resolved.pid;
-    return _cached;
+             JOIN memory_cards_fts fts ON c.rowid = fts.rowid
+             WHERE memory_cards_fts MATCH ?
+               AND c.agent_id = ?
+               AND COALESCE(c.active, 1) = 1`;
+  const args = [matchExpr, agentId];
+  if (options?.projectName) {
+    sql += ` AND c.project_name = ?`;
+    args.push(options.projectName);
   }
-  _cached = process.env.CLAUDE_CODE_SSE_PORT ?? String(process.ppid);
-  return _cached;
-}
-var _cached, _cachedRuntime, RUNTIME_COMMANDS;
-var init_session_key = __esm({
-  "src/lib/session-key.ts"() {
-    "use strict";
-    _cached = null;
-    _cachedRuntime = null;
-    RUNTIME_COMMANDS = {
-      claude: ["claude", "claude.exe", "claude-native"],
-      codex: ["codex"],
-      opencode: ["opencode"]
-    };
+  if (options?.since) {
+    sql += ` AND c.timestamp >= ?`;
+    args.push(options.since);
   }
-});
-
-// src/mcp/agent-context.ts
-import { AsyncLocalStorage } from "async_hooks";
-function getAgentContext() {
-  return agentStore.getStore();
+  sql += ` ORDER BY rank LIMIT ?`;
+  args.push(limit);
+  const result = await getClient().execute({ sql, args });
+  return result.rows.map((row) => ({
+    id: `card:${String(row.id)}`,
+    agent_id: String(row.agent_id),
+    agent_role: "memory_card",
+    session_id: String(row.session_id),
+    timestamp: String(row.timestamp),
+    tool_name: `memory_card:${String(row.card_type)}`,
+    project_name: row.project_name == null ? "" : String(row.project_name),
+    has_error: false,
+    raw_text: `[${String(row.card_type)}] ${String(row.content)}
+Source memory: ${String(row.source_ref ?? row.memory_id)}`,
+    vector: [],
+    importance: 6,
+    status: "active",
+    confidence: Number(row.confidence ?? 0.6),
+    last_accessed: String(row.timestamp)
+  }));
 }
-var agentStore;
-var init_agent_context = __esm({
-  "src/mcp/agent-context.ts"() {
+var MAX_CARDS_PER_MEMORY, MAX_SENTENCE_CHARS;
+var init_memory_cards = __esm({
+  "src/lib/memory-cards.ts"() {
     "use strict";
-    agentStore = new AsyncLocalStorage();
+    init_database();
+    MAX_CARDS_PER_MEMORY = 6;
+    MAX_SENTENCE_CHARS = 360;
   }
 });
 
-// src/lib/active-agent.ts
-var active_agent_exports = {};
-__export(active_agent_exports, {
-  cleanupSessionMarkers: () => cleanupSessionMarkers,
-  clearActiveAgent: () => clearActiveAgent,
-  getActiveAgent: () => getActiveAgent,
-  getAllActiveAgents: () => getAllActiveAgents,
-  resolveActiveAgentFromTmuxSession: () => resolveActiveAgentFromTmuxSession,
-  writeActiveAgent: () => writeActiveAgent
+// src/lib/agentic-ontology.ts
+var agentic_ontology_exports = {};
+__export(agentic_ontology_exports, {
+  clean: () => clean,
+  extractGoalCandidates: () => extractGoalCandidates,
+  inferIntention: () => inferIntention,
+  inferOntologyEventType: () => inferOntologyEventType,
+  inferOutcome: () => inferOutcome,
+  inferSemanticLabel: () => inferSemanticLabel,
+  insertOntologyForBatch: () => insertOntologyForBatch,
+  insertOntologyForMemory: () => insertOntologyForMemory,
+  ontologyPayload: () => ontologyPayload,
+  stableId: () => stableId2
 });
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, unlinkSync as unlinkSync4, readdirSync as readdirSync3 } from "fs";
-import { execSync as execSync5 } from "child_process";
-import path9 from "path";
-function isNameWithOptionalInstance(candidate, baseName) {
-  if (candidate === baseName) return true;
-  if (!candidate.startsWith(baseName)) return false;
-  return /^\d+$/.test(candidate.slice(baseName.length));
-}
-function resolveEmployeeFromSessionPrefix(prefix, employees) {
-  const sorted = [...employees].sort((a, b) => b.name.length - a.name.length);
-  for (const employee of sorted) {
-    if (isNameWithOptionalInstance(prefix, employee.name)) {
-      return { agentId: employee.name, agentRole: employee.role };
-    }
+import { createHash as createHash3 } from "crypto";
+function stableId2(...parts) {
+  return createHash3("sha256").update(parts.map((p) => String(p ?? "")).join("::")).digest("hex").slice(0, 32);
+}
+function clean(text, max = 240) {
+  return text.replace(/\u0000/g, "").replace(/```[\s\S]*?```/g, " ").replace(/\s+/g, " ").trim().slice(0, max);
+}
+function inferOntologyEventType(row) {
+  const lower = row.raw_text.toLowerCase();
+  if (row.has_error) return "error";
+  if (/\b(done|complete|completed|fixed|resolved|shipped|deployed|pushed|published)\b/.test(lower)) return "milestone";
+  if (/\b(blocked|failed|error|bug|regression|broken)\b/.test(lower)) return "problem";
+  if (/\b(decided|decision|adr|we chose|approved|rejected)\b/.test(lower)) return "decision";
+  if (/\b(goal|need to|we need|want to|trying to|objective)\b/.test(lower)) return "goal_signal";
+  if (["Bash", "Read", "Edit", "Write", "Grep", "Glob"].includes(row.tool_name)) return "tool_action";
+  if (row.tool_name.startsWith("memory_card")) return "memory_card";
+  return "memory_observation";
+}
+function inferIntention(row) {
+  if (row.intent) return clean(row.intent, 220);
+  const text = clean(row.raw_text, 1e3);
+  const patterns = [
+    /(?:we need to|need to|let'?s|i want to|we should|goal is to|objective is to|trying to)\s+([^.!?\n]{8,220})/i,
+    /(?:so that|in order to)\s+([^.!?\n]{8,220})/i,
+    /(?:task|plan):\s*([^.!?\n]{8,220})/i
+  ];
+  for (const p of patterns) {
+    const m = text.match(p);
+    if (m?.[1]) return clean(m[1], 220);
+  }
+  if (["Bash", "Read", "Edit", "Write", "Grep", "Glob"].includes(row.tool_name)) {
+    return `${row.tool_name} during ${row.project_name}`;
   }
   return null;
 }
-function resolveActiveAgentFromTmuxSession(sessionName) {
-  const employees = loadEmployeesSync();
-  const coordinator = getCoordinatorEmployee(employees);
-  const coordinatorName = coordinator?.name ?? DEFAULT_COORDINATOR_TEMPLATE_NAME;
-  if (isNameWithOptionalInstance(sessionName, coordinatorName)) {
-    return {
-      agentId: coordinatorName,
-      agentRole: coordinator?.role ?? "COO"
-    };
+function inferOutcome(row) {
+  if (row.outcome) return clean(row.outcome, 220);
+  if (row.has_error) return "error";
+  const lower = row.raw_text.toLowerCase();
+  if (/\b(done|complete|completed|fixed|resolved|shipped|deployed|pushed|published|passed)\b/.test(lower)) return "success_signal";
+  if (/\b(blocked|failed|error|regression|broken|not working|could not)\b/.test(lower)) return "failure_signal";
+  if (/\b(warning|risk|concern|caveat)\b/.test(lower)) return "risk_signal";
+  return null;
+}
+function extractGoalCandidates(row) {
+  const text = clean(row.raw_text, 1600);
+  const patterns = [
+    /(?:we need to|need to|i want to|we should|goal is to|objective is to|trying to|let'?s)\s+([^.!?\n]{12,220})/gi,
+    /(?:success means|success criteria|so that)\s+([^.!?\n]{12,220})/gi
+  ];
+  const out = [];
+  for (const pattern of patterns) {
+    for (const m of text.matchAll(pattern)) {
+      const candidate = clean(m[1] ?? "", 220);
+      if (candidate.length >= 12 && !out.some((x) => x.toLowerCase() === candidate.toLowerCase())) out.push(candidate);
+      if (out.length >= 3) return out;
+    }
   }
-  if (isNameWithOptionalInstance(sessionName, DEFAULT_COORDINATOR_TEMPLATE_NAME)) {
-    return {
-      agentId: coordinator?.name ?? DEFAULT_COORDINATOR_TEMPLATE_NAME,
-      agentRole: coordinator?.role ?? "COO"
-    };
+  return out;
+}
+function uniq(values, max = 6) {
+  const out = [];
+  for (const value of values.map((v) => clean(v, 220)).filter(Boolean)) {
+    if (!out.some((x) => x.toLowerCase() === value.toLowerCase())) out.push(value);
+    if (out.length >= max) break;
   }
-  if (sessionName.includes("-")) {
-    const prefix = sessionName.split("-")[0] ?? "";
-    const employee = resolveEmployeeFromSessionPrefix(prefix, employees);
-    if (employee) return employee;
-    const legacy = prefix.match(/^([a-zA-Z]+)\d*$/);
-    if (legacy?.[1] && legacy[1] !== DEFAULT_COORDINATOR_TEMPLATE_NAME) {
-      const emp = getEmployee(employees, legacy[1]);
-      return { agentId: emp?.name ?? legacy[1], agentRole: emp?.role ?? "employee" };
+  return out;
+}
+function extractMatches(text, patterns, max = 5) {
+  const out = [];
+  for (const pattern of patterns) {
+    for (const match of text.matchAll(pattern)) {
+      const value = match[1] ?? match[0];
+      if (value) out.push(value);
+      if (out.length >= max) return uniq(out, max);
     }
   }
-  return null;
+  return uniq(out, max);
+}
+function inferSemanticLabel(row) {
+  const text = clean(row.raw_text, 2400);
+  const eventType = inferOntologyEventType(row);
+  const intention = inferIntention(row);
+  const outcome = inferOutcome(row);
+  const goals = extractGoalCandidates(row);
+  const milestones = extractMatches(text, [
+    /\b(?:completed|finished|fixed|resolved|shipped|deployed|published|pushed|passed)\b([^.!?\n]{0,180})/gi,
+    /(?:milestone|done):\s*([^.!?\n]{8,220})/gi
+  ]);
+  const problems = extractMatches(text, [
+    /\b(?:blocked by|failed because|bug|regression|broken|not working|error)\b([^.!?\n]{0,180})/gi,
+    /(?:problem|issue|risk):\s*([^.!?\n]{8,220})/gi
+  ]);
+  const decisions = extractMatches(text, [
+    /(?:decided|decision|adr|we chose|approved|rejected)\s+([^.!?\n]{8,220})/gi
+  ]);
+  const temporalAnchors = extractMatches(text, [
+    /\b(\d{4}-\d{2}-\d{2}(?:[T ][0-9:.+-Z]+)?)\b/g,
+    /\b(today|yesterday|tomorrow|this week|next week|last week|morning|afternoon|tonight)\b/gi
+  ], 8);
+  const nextActions = extractMatches(text, [
+    /(?:next|todo|follow[- ]?up|remaining|need to)\s*:?\s*([^.!?\n]{8,220})/gi
+  ]);
+  const actors = uniq([
+    row.agent_id,
+    ...extractMatches(text, [/\b(?:agent|employee|owner|assignee)[:= ]+([a-zA-Z][a-zA-Z0-9_-]{1,40})/gi], 5)
+  ], 6);
+  const successSignals = milestones.length ? milestones : outcome === "success_signal" ? [clean(text, 180)] : [];
+  const failureSignals = problems.length ? problems : outcome === "failure_signal" || row.has_error ? [clean(text, 180)] : [];
+  const impact = successSignals.length && failureSignals.length ? "mixed" : failureSignals.length ? "negative" : successSignals.length ? "positive" : "neutral";
+  const signalCount = goals.length + milestones.length + problems.length + decisions.length + nextActions.length;
+  return {
+    labeler: "deterministic",
+    schemaVersion: 1,
+    eventType,
+    intention,
+    outcome,
+    impact,
+    confidence: Math.min(0.95, 0.45 + signalCount * 0.08 + (intention ? 0.1 : 0) + (outcome ? 0.1 : 0)),
+    goals,
+    milestones,
+    problems,
+    decisions,
+    actors,
+    temporalAnchors,
+    successSignals,
+    failureSignals,
+    nextActions,
+    summary: clean(text, 280)
+  };
 }
-function getMarkerPath() {
-  return path9.join(CACHE_DIR, `active-agent-${getSessionKey()}.json`);
+function ontologyPayload(row) {
+  const semantic = inferSemanticLabel(row);
+  return {
+    tool_name: row.tool_name,
+    memory_version: row.version ?? null,
+    domain: row.domain ?? null,
+    trajectory: row.trajectory ? safeJson(row.trajectory) : null,
+    semantic
+  };
 }
-function writeActiveAgent(agentId, agentRole) {
+function safeJson(value) {
   try {
-    mkdirSync4(CACHE_DIR, { recursive: true });
-    writeFileSync4(
-      getMarkerPath(),
-      JSON.stringify({ agentId, agentRole, startedAt: (/* @__PURE__ */ new Date()).toISOString() })
-    );
+    return JSON.parse(value);
   } catch {
+    return value.slice(0, 1e3);
+  }
+}
+async function resolveClient(client) {
+  if (client) return client;
+  const { getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+  return getClient2();
+}
+async function insertOntologyForMemory(row, client) {
+  const db = await resolveClient(client);
+  const occurredAt = row.timestamp;
+  const sequence = Number(row.version ?? 0) || Math.floor(new Date(occurredAt).getTime() / 1e3);
+  const eventType = inferOntologyEventType(row);
+  const intention = inferIntention(row);
+  const outcome = inferOutcome(row);
+  const eventId = stableId2("event", row.id);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  await db.execute({
+    sql: `INSERT INTO agent_sessions (id, agent_id, project_name, started_at, last_event_at, event_count, properties)
+          VALUES (?, ?, ?, ?, ?, 1, ?)
+          ON CONFLICT(id) DO UPDATE SET last_event_at = MAX(last_event_at, excluded.last_event_at),
+            event_count = event_count + 1`,
+    args: [row.session_id, row.agent_id, row.project_name, occurredAt, occurredAt, JSON.stringify({ agent_role: row.agent_role })]
+  });
+  await db.execute({
+    sql: `INSERT OR IGNORE INTO agent_events
+          (id, event_type, occurred_at, sequence_index, actor_agent_id, agent_role, project_name,
+           session_id, task_id, goal_id, parent_event_id, intention, outcome, evidence_memory_id,
+           impact, payload, created_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?, ?, ?, ?, ?, ?)`,
+    args: [
+      eventId,
+      eventType,
+      occurredAt,
+      sequence,
+      row.agent_id,
+      row.agent_role,
+      row.project_name,
+      row.session_id,
+      row.task_id ?? null,
+      intention,
+      outcome,
+      row.id,
+      row.has_error ? "negative" : outcome === "success_signal" ? "positive" : "neutral",
+      JSON.stringify(ontologyPayload(row)),
+      now
+    ]
+  });
+  const semantic = inferSemanticLabel(row);
+  await db.execute({
+    sql: `INSERT INTO agent_semantic_labels
+          (id, source_memory_id, event_id, labeler, schema_version, confidence, labels, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+          ON CONFLICT(id) DO UPDATE SET confidence = excluded.confidence,
+            labels = excluded.labels, updated_at = excluded.updated_at`,
+    args: [
+      stableId2("semantic", row.id, semantic.labeler, semantic.schemaVersion),
+      row.id,
+      eventId,
+      semantic.labeler,
+      semantic.schemaVersion,
+      semantic.confidence,
+      JSON.stringify(semantic),
+      now,
+      now
+    ]
+  });
+  for (const statement of extractGoalCandidates(row)) {
+    const goalId = stableId2("goal", row.project_name, statement.toLowerCase());
+    await db.execute({
+      sql: `INSERT INTO agent_goals
+            (id, statement, owner_agent_id, project_name, status, priority, success_criteria,
+             parent_goal_id, due_at, achieved_at, supersedes_id, created_at, updated_at, source_memory_id)
+            VALUES (?, ?, ?, ?, 'open', 5, NULL, NULL, NULL, NULL, NULL, ?, ?, ?)
+            ON CONFLICT(id) DO UPDATE SET updated_at = excluded.updated_at`,
+      args: [goalId, statement, row.agent_id, row.project_name, now, now, row.id]
+    });
+    await db.execute({
+      sql: `INSERT OR IGNORE INTO agent_goal_links
+            (id, goal_id, link_type, target_id, target_type, created_at)
+            VALUES (?, ?, 'evidence', ?, 'memory', ?)`,
+      args: [stableId2("goal_link", goalId, row.id, "memory"), goalId, row.id, now]
+    });
+    await db.execute({
+      sql: `INSERT OR IGNORE INTO agent_goal_links
+            (id, goal_id, link_type, target_id, target_type, created_at)
+            VALUES (?, ?, 'event', ?, 'event', ?)`,
+      args: [stableId2("goal_link", goalId, eventId, "event"), goalId, eventId, now]
+    });
   }
 }
-function clearActiveAgent() {
-  try {
-    unlinkSync4(getMarkerPath());
-  } catch {
+async function insertOntologyForBatch(rows, client) {
+  const db = await resolveClient(client);
+  let count = 0;
+  for (const row of rows) {
+    try {
+      await insertOntologyForMemory(row, db);
+      count++;
+    } catch {
+    }
   }
+  return count;
 }
-function getActiveAgent() {
-  const httpCtx = getAgentContext();
-  if (httpCtx) return httpCtx;
-  try {
-    const markerPath = getMarkerPath();
-    const raw = readFileSync5(markerPath, "utf8");
-    const data = JSON.parse(raw);
-    if (data.agentId) {
-      if (data.startedAt) {
-        const age = Date.now() - new Date(data.startedAt).getTime();
-        if (age > STALE_MS) {
-          try {
-            unlinkSync4(markerPath);
-          } catch {
-          }
-        } else {
-          return {
-            agentId: data.agentId,
-            agentRole: data.agentRole || "employee"
-          };
-        }
-      } else {
-        return {
-          agentId: data.agentId,
-          agentRole: data.agentRole || "employee"
-        };
-      }
-    }
-  } catch {
+var init_agentic_ontology = __esm({
+  "src/lib/agentic-ontology.ts"() {
+    "use strict";
   }
-  try {
-    const sessionName = execSync5(
-      "tmux display-message -p '#{session_name}' 2>/dev/null",
-      { encoding: "utf8", timeout: 2e3 }
-    ).trim();
-    const resolved = resolveActiveAgentFromTmuxSession(sessionName);
-    if (resolved) return resolved;
-  } catch {
+});
+
+// src/lib/store.ts
+var store_exports = {};
+__export(store_exports, {
+  attachDocumentMetadata: () => attachDocumentMetadata,
+  buildRawVisibilityFilter: () => buildRawVisibilityFilter,
+  buildWikiScopeFilter: () => buildWikiScopeFilter,
+  classifyTier: () => classifyTier,
+  disposeStore: () => disposeStore,
+  flushBatch: () => flushBatch,
+  flushTier3: () => flushTier3,
+  getMemoryCardinality: () => getMemoryCardinality,
+  initStore: () => initStore,
+  reserveVersions: () => reserveVersions,
+  searchMemories: () => searchMemories,
+  updateMemoryStatus: () => updateMemoryStatus,
+  vectorToBlob: () => vectorToBlob,
+  writeMemory: () => writeMemory
+});
+function isBusyError2(err) {
+  if (err instanceof Error) {
+    const msg = err.message.toLowerCase();
+    return msg.includes("sqlite_busy") || msg.includes("database is locked");
   }
-  return {
-    agentId: process.env.AGENT_ID || "default",
-    agentRole: process.env.AGENT_ROLE || "employee"
-  };
+  return false;
 }
-function getAllActiveAgents() {
-  try {
-    const files = readdirSync3(CACHE_DIR);
-    const sessions = [];
-    for (const file of files) {
-      if (!file.startsWith("active-agent-") || !file.endsWith(".json")) continue;
-      const key = file.slice("active-agent-".length, -".json".length);
-      if (key === "undefined") continue;
-      try {
-        const raw = readFileSync5(path9.join(CACHE_DIR, file), "utf8");
-        const data = JSON.parse(raw);
-        if (!data.agentId) continue;
-        if (data.startedAt) {
-          const age = Date.now() - new Date(data.startedAt).getTime();
-          if (age > STALE_MS) {
-            try {
-              unlinkSync4(path9.join(CACHE_DIR, file));
-            } catch {
-            }
-            continue;
-          }
-        }
-        sessions.push({
-          agentId: data.agentId,
-          agentRole: data.agentRole || "employee",
-          startedAt: data.startedAt || (/* @__PURE__ */ new Date()).toISOString(),
-          sessionKey: key
-        });
-      } catch {
-      }
+async function retryOnBusy2(fn, label) {
+  for (let attempt = 0; attempt <= INIT_MAX_RETRIES; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      if (!isBusyError2(err) || attempt === INIT_MAX_RETRIES) throw err;
+      process.stderr.write(
+        `[store] SQLITE_BUSY during ${label}, retry ${attempt + 1}/${INIT_MAX_RETRIES}
+`
+      );
+      await new Promise((r) => setTimeout(r, INIT_RETRY_DELAY_MS * (attempt + 1)));
     }
-    return sessions;
-  } catch {
-    return [];
   }
+  throw new Error("unreachable");
 }
-function cleanupSessionMarkers() {
-  const key = getSessionKey();
-  try {
-    unlinkSync4(path9.join(CACHE_DIR, `active-agent-${key}.json`));
-  } catch {
+async function initStore(options) {
+  if (_flushTimer !== null) {
+    clearInterval(_flushTimer);
+    _flushTimer = null;
   }
-  try {
-    unlinkSync4(path9.join(CACHE_DIR, "active-agent-undefined.json"));
-  } catch {
+  _pendingRecords = [];
+  _flushing = false;
+  _batchSize = options?.batchSize ?? 20;
+  _flushIntervalMs = options?.flushIntervalMs ?? 1e4;
+  let dbPath = options?.dbPath;
+  if (!dbPath) {
+    const config = await loadConfig();
+    dbPath = config.dbPath;
   }
-}
-var CACHE_DIR, STALE_MS;
-var init_active_agent = __esm({
-  "src/lib/active-agent.ts"() {
-    "use strict";
-    init_config();
-    init_session_key();
-    init_agent_context();
-    init_employees();
-    CACHE_DIR = path9.join(EXE_AI_DIR, "session-cache");
-    STALE_MS = 24 * 60 * 60 * 1e3;
+  let masterKey = options?.masterKey ?? null;
+  if (!masterKey) {
+    masterKey = await getMasterKey();
+    if (!masterKey) {
+      throw new Error(
+        "No encryption key found. Run /exe-setup to generate one."
+      );
+    }
   }
-});
-
-// src/bin/exe-launch-agent.ts
-import os7 from "os";
-import path10 from "path";
-import { existsSync as existsSync9, readFileSync as readFileSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5, readdirSync as readdirSync4 } from "fs";
-import { spawnSync } from "child_process";
-
-// src/lib/store.ts
-init_memory();
-init_database();
-
-// src/lib/keychain.ts
-import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
-import { existsSync as existsSync6 } from "fs";
-import { execSync as execSync2 } from "child_process";
-import path6 from "path";
-import os5 from "os";
-var SERVICE = "exe-mem";
-var ACCOUNT = "master-key";
-function getKeyDir() {
-  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path6.join(os5.homedir(), ".exe-os");
-}
-function getKeyPath() {
-  return path6.join(getKeyDir(), "master.key");
-}
-function macKeychainGet() {
-  if (process.platform !== "darwin") return null;
+  const hexKey = masterKey.toString("hex");
+  await initTurso({
+    dbPath,
+    encryptionKey: hexKey
+  });
+  await retryOnBusy2(() => ensureSchema(), "ensureSchema");
   try {
-    return execSync2(
-      `security find-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w 2>/dev/null`,
-      { encoding: "utf-8", timeout: 5e3 }
-    ).trim();
+    const { initDaemonClient: initDaemonClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+    await initDaemonClient2();
   } catch {
-    return null;
   }
-}
-function macKeychainSet(value) {
-  if (process.platform !== "darwin") return false;
-  try {
+  if (!options?.lightweight) {
     try {
-      execSync2(
-        `security delete-generic-password -s "${SERVICE}" -a "${ACCOUNT}" 2>/dev/null`,
-        { timeout: 5e3 }
-      );
+      const { initShardManager: initShardManager2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
+      initShardManager2(hexKey);
     } catch {
     }
-    execSync2(
-      `security add-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w "${value}"`,
-      { timeout: 5e3 }
+    const client = getClient();
+    const vResult = await retryOnBusy2(
+      () => client.execute("SELECT MAX(version) as max_v FROM memories"),
+      "version-query"
     );
-    return true;
-  } catch {
-    return false;
+    _nextVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
+    try {
+      const { loadGlobalProcedures: loadGlobalProcedures2 } = await Promise.resolve().then(() => (init_global_procedures(), global_procedures_exports));
+      await loadGlobalProcedures2();
+    } catch {
+    }
   }
 }
-function linuxSecretGet() {
-  if (process.platform !== "linux") return null;
+function classifyTier(record) {
+  if (record.tool_name === "commit_to_long_term_memory" && (record.importance ?? 0) >= 8) return 1;
+  if (["store_memory", "manual"].includes(record.tool_name ?? "") && (record.importance ?? 0) >= 5) return 2;
+  return 3;
+}
+function inferFilePaths(record) {
+  if (!["Read", "Write", "Edit"].includes(record.tool_name)) return null;
+  const firstLine = record.raw_text.split("\n")[0] ?? "";
+  const match = firstLine.match(/(\/[\w./-]+\.\w+)/);
+  return match ? JSON.stringify([match[1]]) : null;
+}
+function inferCommitHash(record) {
+  if (record.tool_name !== "Bash") return null;
+  const match = record.raw_text.match(/\b([a-f0-9]{7,40})\b/);
+  return match ? match[1] : null;
+}
+function inferLanguageType(record) {
+  const text = record.raw_text;
+  if (!text || text.length < 10) return null;
+  const trimmed = text.trimStart();
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) return "json";
+  if (/\b(SELECT|INSERT|UPDATE|DELETE|CREATE TABLE|ALTER TABLE)\b/i.test(text)) return "sql";
+  if (/\b(function |const |import |export |class |def |async |=>)\b/.test(text)) return "code";
+  if (trimmed.startsWith("#") || trimmed.startsWith("*")) return "prose";
+  return "mixed";
+}
+function inferDomain(record) {
+  const proj = (record.project_name ?? "").toLowerCase();
+  if (proj.includes("marketing") || proj.includes("content")) return "marketing";
+  if (proj.includes("crm") || proj.includes("customer")) return "customer";
+  return null;
+}
+async function writeMemory(record) {
+  if (record.vector !== null && record.vector.length !== EMBEDDING_DIM) {
+    throw new Error(
+      `Expected ${EMBEDDING_DIM}-dim vector, got ${record.vector.length}`
+    );
+  }
+  const governed = governMemoryRecord(record);
+  if (governed.shouldDrop) return;
+  record = governed.record;
+  const contentHash = governed.contentHash;
+  const memoryType = record.memory_type ?? "raw";
+  if (_pendingRecords.some(
+    (r) => r.content_hash === contentHash && r.agent_id === record.agent_id && r.project_name === record.project_name && (r.memory_type ?? "raw") === memoryType
+  )) {
+    return;
+  }
   try {
-    return execSync2(
-      `secret-tool lookup service "${SERVICE}" account "${ACCOUNT}" 2>/dev/null`,
-      { encoding: "utf-8", timeout: 5e3 }
-    ).trim();
+    const existing = await findScopedDuplicate({
+      contentHash,
+      agentId: record.agent_id,
+      projectName: record.project_name,
+      memoryType
+    });
+    if (existing) return;
   } catch {
-    return null;
+  }
+  const dbRow = {
+    id: record.id,
+    agent_id: record.agent_id,
+    agent_role: record.agent_role,
+    session_id: record.session_id,
+    timestamp: record.timestamp,
+    tool_name: record.tool_name,
+    project_name: record.project_name,
+    has_error: record.has_error ? 1 : 0,
+    raw_text: record.raw_text,
+    vector: record.vector,
+    version: 0,
+    // Placeholder — assigned atomically at flush time
+    task_id: record.task_id ?? null,
+    importance: record.importance ?? 5,
+    status: record.status ?? "active",
+    confidence: record.confidence ?? 0.7,
+    last_accessed: record.last_accessed ?? record.timestamp,
+    workspace_id: record.workspace_id ?? null,
+    document_id: record.document_id ?? null,
+    user_id: record.user_id ?? null,
+    char_offset: record.char_offset ?? null,
+    page_number: record.page_number ?? null,
+    source_path: record.source_path ?? null,
+    source_type: record.source_type ?? null,
+    tier: record.tier ?? classifyTier(record),
+    supersedes_id: record.supersedes_id ?? null,
+    draft: record.draft ? 1 : 0,
+    memory_type: memoryType,
+    trajectory: record.trajectory ? JSON.stringify(record.trajectory) : null,
+    content_hash: contentHash,
+    intent: record.intent ?? null,
+    outcome: record.outcome ?? null,
+    domain: record.domain ?? inferDomain(record),
+    referenced_entities: record.referenced_entities ?? null,
+    retrieval_count: record.retrieval_count ?? 0,
+    chain_position: record.chain_position ?? null,
+    review_status: record.review_status ?? null,
+    context_window_pct: record.context_window_pct ?? null,
+    file_paths: record.file_paths ?? inferFilePaths(record),
+    commit_hash: record.commit_hash ?? inferCommitHash(record),
+    duration_ms: record.duration_ms ?? null,
+    token_cost: record.token_cost ?? null,
+    audience: record.audience ?? null,
+    language_type: record.language_type ?? inferLanguageType(record),
+    parent_memory_id: record.parent_memory_id ?? null
+  };
+  _pendingRecords.push(dbRow);
+  orgBus.emit({
+    type: "memory_stored",
+    agentId: record.agent_id,
+    project: record.project_name,
+    timestamp: record.timestamp
+  });
+  const MAX_PENDING = 1e3;
+  if (_pendingRecords.length > MAX_PENDING) {
+    const dropped = _pendingRecords.length - MAX_PENDING;
+    _pendingRecords = _pendingRecords.slice(-MAX_PENDING);
+    console.warn(`[store] Dropped ${dropped} oldest pending records (overflow)`);
+  }
+  if (_flushTimer === null) {
+    _flushTimer = setInterval(() => {
+      void flushBatch();
+    }, _flushIntervalMs);
+    if (_flushTimer && typeof _flushTimer === "object" && "unref" in _flushTimer) {
+      _flushTimer.unref();
+    }
+  }
+  if (_pendingRecords.length >= _batchSize) {
+    await flushBatch();
   }
 }
-function linuxSecretSet(value) {
-  if (process.platform !== "linux") return false;
+async function flushBatch() {
+  if (_flushing || _pendingRecords.length === 0) return 0;
+  _flushing = true;
   try {
-    execSync2(
-      `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${SERVICE}" account "${ACCOUNT}"`,
-      { timeout: 5e3 }
-    );
-    return true;
-  } catch {
-    return false;
+    const batch = _pendingRecords.slice(0);
+    const client = getClient();
+    const vResult = await client.execute("SELECT MAX(version) as max_v FROM memories");
+    let baseVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
+    for (const row of batch) {
+      row.version = baseVersion++;
+    }
+    _nextVersion = baseVersion;
+    const buildStmt = (row) => {
+      const hasVector = row.vector !== null;
+      const taskId = row.task_id ?? null;
+      const importance = row.importance ?? 5;
+      const status = row.status ?? "active";
+      const confidence = row.confidence ?? 0.7;
+      const lastAccessed = row.last_accessed ?? row.timestamp;
+      const workspaceId = row.workspace_id ?? null;
+      const documentId = row.document_id ?? null;
+      const userId = row.user_id ?? null;
+      const charOffset = row.char_offset ?? null;
+      const pageNumber = row.page_number ?? null;
+      const sourcePath = row.source_path ?? null;
+      const sourceType = row.source_type ?? null;
+      const tier = row.tier ?? 3;
+      const supersedesId = row.supersedes_id ?? null;
+      const draft = row.draft ? 1 : 0;
+      const memoryType = row.memory_type ?? "raw";
+      const trajectory = row.trajectory ?? null;
+      const contentHash = row.content_hash ?? null;
+      const intent = row.intent ?? null;
+      const outcome = row.outcome ?? null;
+      const domain = row.domain ?? null;
+      const referencedEntities = row.referenced_entities ?? null;
+      const retrievalCount = row.retrieval_count ?? 0;
+      const chainPosition = row.chain_position ?? null;
+      const reviewStatus = row.review_status ?? null;
+      const contextWindowPct = row.context_window_pct ?? null;
+      const filePaths = row.file_paths ?? null;
+      const commitHash = row.commit_hash ?? null;
+      const durationMs = row.duration_ms ?? null;
+      const tokenCost = row.token_cost ?? null;
+      const audience = row.audience ?? null;
+      const languageType = row.language_type ?? null;
+      const parentMemoryId = row.parent_memory_id ?? null;
+      const cols = `id, agent_id, agent_role, session_id, timestamp,
+               tool_name, project_name,
+               has_error, raw_text, vector, version, task_id, importance, status,
+               confidence, last_accessed,
+               workspace_id, document_id, user_id, char_offset, page_number,
+               source_path, source_type, tier, supersedes_id, draft, memory_type, trajectory, content_hash,
+               intent, outcome, domain, referenced_entities, retrieval_count,
+               chain_position, review_status, context_window_pct, file_paths, commit_hash,
+               duration_ms, token_cost, audience, language_type, parent_memory_id`;
+      const metaArgs = [
+        intent,
+        outcome,
+        domain,
+        referencedEntities,
+        retrievalCount,
+        chainPosition,
+        reviewStatus,
+        contextWindowPct,
+        filePaths,
+        commitHash,
+        durationMs,
+        tokenCost,
+        audience,
+        languageType,
+        parentMemoryId
+      ];
+      const baseArgs = [
+        row.id,
+        row.agent_id,
+        row.agent_role,
+        row.session_id,
+        row.timestamp,
+        row.tool_name,
+        row.project_name,
+        row.has_error,
+        row.raw_text
+      ];
+      const sharedArgs = [
+        row.version,
+        taskId,
+        importance,
+        status,
+        confidence,
+        lastAccessed,
+        workspaceId,
+        documentId,
+        userId,
+        charOffset,
+        pageNumber,
+        sourcePath,
+        sourceType,
+        tier,
+        supersedesId,
+        draft,
+        memoryType,
+        trajectory,
+        contentHash
+      ];
+      return {
+        sql: hasVector ? `INSERT OR IGNORE INTO memories (${cols})
+              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, vector32(?), ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)` : `INSERT OR IGNORE INTO memories (${cols})
+              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        args: hasVector ? [...baseArgs, vectorToBlob(row.vector), ...sharedArgs, ...metaArgs] : [...baseArgs, ...sharedArgs, ...metaArgs]
+      };
+    };
+    const globalClient = getClient();
+    const globalStmts = batch.map(buildStmt);
+    await globalClient.batch(globalStmts, "write");
+    try {
+      const { insertMemoryCardsForBatch: insertMemoryCardsForBatch2 } = await Promise.resolve().then(() => (init_memory_cards(), memory_cards_exports));
+      await insertMemoryCardsForBatch2(batch);
+    } catch {
+    }
+    try {
+      const { insertOntologyForBatch: insertOntologyForBatch2 } = await Promise.resolve().then(() => (init_agentic_ontology(), agentic_ontology_exports));
+      await insertOntologyForBatch2(batch);
+    } catch {
+    }
+    schedulePostWriteMemoryHygiene(batch.map((row) => row.id));
+    _pendingRecords.splice(0, batch.length);
+    try {
+      const { isShardingEnabled: isShardingEnabled2, getReadyShardClient: getReadyShardClient2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
+      if (isShardingEnabled2()) {
+        const byProject = /* @__PURE__ */ new Map();
+        let skippedUnknown = 0;
+        for (const row of batch) {
+          const proj = row.project_name?.trim();
+          if (!proj) {
+            skippedUnknown++;
+            continue;
+          }
+          if (!byProject.has(proj)) byProject.set(proj, []);
+          byProject.get(proj).push(row);
+        }
+        if (skippedUnknown > 0) {
+          process.stderr.write(
+            `[store] Shard skip: ${skippedUnknown} record(s) with empty project_name (kept in main DB only)
+`
+          );
+        }
+        for (const [project, rows] of byProject) {
+          try {
+            const shardClient = await getReadyShardClient2(project);
+            const shardStmts = rows.map(buildStmt);
+            await shardClient.batch(shardStmts, "write");
+          } catch (err) {
+            const fullError = err instanceof Error ? `${err.name}: ${err.message}${err.stack ? `
+${err.stack.split("\n").slice(1, 3).join("\n")}` : ""}` : String(err);
+            process.stderr.write(
+              `[store] Shard write failed for ${project} (${rows.length} records): ${fullError}
+`
+            );
+          }
+        }
+      }
+    } catch {
+    }
+    return batch.length;
+  } finally {
+    _flushing = false;
   }
 }
-async function tryKeytar() {
-  try {
-    return await import("keytar");
-  } catch {
-    return null;
+function buildWikiScopeFilter(options, columnPrefix) {
+  const args = [];
+  let clause = "";
+  if (options?.workspaceId !== void 0) {
+    clause += ` AND ${columnPrefix}workspace_id = ?`;
+    args.push(options.workspaceId);
   }
-}
-var ENCRYPTED_PREFIX = "enc:";
-function deriveMachineKey() {
-  try {
-    const crypto3 = __require("crypto");
-    const material = [
-      os5.hostname(),
-      os5.userInfo().username,
-      os5.arch(),
-      os5.platform(),
-      // Machine ID on Linux (stable across reboots)
-      process.platform === "linux" ? readMachineId() : ""
-    ].join("|");
-    return crypto3.createHash("sha256").update(material).digest();
-  } catch {
-    return null;
+  if (options?.userId === void 0) {
+    clause += ` AND ${columnPrefix}user_id IS NULL`;
+  } else if (options.userId === null) {
+    clause += ` AND ${columnPrefix}user_id IS NULL`;
+  } else {
+    clause += ` AND (${columnPrefix}user_id = ? OR ${columnPrefix}user_id IS NULL)`;
+    args.push(options.userId);
   }
+  return { clause, args };
 }
-function readMachineId() {
-  try {
-    const { readFileSync: readFileSync7 } = __require("fs");
-    return readFileSync7("/etc/machine-id", "utf-8").trim();
-  } catch {
-    return "";
+function buildRawVisibilityFilter(options, columnPrefix) {
+  if (options?.includeRaw === false) {
+    return {
+      clause: ` AND COALESCE(${columnPrefix}memory_type, 'raw') != 'raw'`,
+      args: []
+    };
   }
+  return { clause: "", args: [] };
 }
-function encryptWithMachineKey(plaintext, machineKey) {
-  const crypto3 = __require("crypto");
-  const iv = crypto3.randomBytes(12);
-  const cipher = crypto3.createCipheriv("aes-256-gcm", machineKey, iv);
-  let encrypted = cipher.update(plaintext, "utf-8", "base64");
-  encrypted += cipher.final("base64");
-  const authTag = cipher.getAuthTag().toString("base64");
-  return `${ENCRYPTED_PREFIX}${iv.toString("base64")}:${authTag}:${encrypted}`;
-}
-function decryptWithMachineKey(encrypted, machineKey) {
-  if (!encrypted.startsWith(ENCRYPTED_PREFIX)) return null;
+async function searchMemories(queryVector, agentId, options) {
+  let client;
   try {
-    const crypto3 = __require("crypto");
-    const parts = encrypted.slice(ENCRYPTED_PREFIX.length).split(":");
-    if (parts.length !== 3) return null;
-    const [ivB64, tagB64, cipherB64] = parts;
-    const iv = Buffer.from(ivB64, "base64");
-    const authTag = Buffer.from(tagB64, "base64");
-    const decipher = crypto3.createDecipheriv("aes-256-gcm", machineKey, iv);
-    decipher.setAuthTag(authTag);
-    let decrypted = decipher.update(cipherB64, "base64", "utf-8");
-    decrypted += decipher.final("utf-8");
-    return decrypted;
+    const { isShardingEnabled: isShardingEnabled2, shardExists: shardExists2, getReadyShardClient: getReadyShardClient2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
+    if (isShardingEnabled2() && options?.projectName && shardExists2(options.projectName)) {
+      client = await getReadyShardClient2(options.projectName);
+    } else {
+      client = getClient();
+    }
   } catch {
-    return null;
+    client = getClient();
   }
-}
-async function writeMachineBoundFileFallback(b64) {
-  const dir = getKeyDir();
-  await mkdir3(dir, { recursive: true });
-  const keyPath = getKeyPath();
-  const machineKey = deriveMachineKey();
-  if (machineKey) {
-    const encrypted = encryptWithMachineKey(b64, machineKey);
-    await writeFile3(keyPath, encrypted + "\n", "utf-8");
-    await chmod2(keyPath, 384);
-    return "encrypted";
+  const limit = options?.limit ?? 10;
+  const statusFilter = options?.includeArchived ? "" : `
+               AND COALESCE(status, 'active') = 'active'`;
+  const draftFilter = options?.includeDrafts ? "" : `
+               AND (draft = 0 OR draft IS NULL)`;
+  let sql = `SELECT id, agent_id, agent_role, session_id, timestamp,
+                    tool_name, project_name,
+                    has_error, raw_text, vector, importance, status,
+                    confidence, last_accessed,
+                    workspace_id, document_id, user_id,
+                    char_offset, page_number,
+                    source_path, source_type
+             FROM memories
+             WHERE agent_id = ?
+               AND vector IS NOT NULL${statusFilter}${draftFilter}
+               AND COALESCE(confidence, 0.7) >= 0.3`;
+  const args = [agentId];
+  const scope = buildWikiScopeFilter(options, "");
+  sql += scope.clause;
+  args.push(...scope.args);
+  const rawVisibility = buildRawVisibilityFilter(options, "");
+  sql += rawVisibility.clause;
+  args.push(...rawVisibility.args);
+  if (options?.projectName) {
+    sql += ` AND project_name = ?`;
+    args.push(options.projectName);
   }
-  await writeFile3(keyPath, b64 + "\n", "utf-8");
-  await chmod2(keyPath, 384);
-  return "plaintext";
-}
-async function getMasterKey() {
-  const nativeValue = macKeychainGet() ?? linuxSecretGet();
-  if (nativeValue) {
-    return Buffer.from(nativeValue, "base64");
+  if (options?.toolName) {
+    sql += ` AND tool_name = ?`;
+    args.push(options.toolName);
   }
-  const keytar = await tryKeytar();
-  if (keytar) {
-    try {
-      const keytarValue = await keytar.getPassword(SERVICE, ACCOUNT);
-      if (keytarValue) {
-        const migrated = macKeychainSet(keytarValue) || linuxSecretSet(keytarValue);
-        if (migrated) {
-          process.stderr.write("[keychain] Migrated key from keytar to native keychain.\n");
-        }
-        return Buffer.from(keytarValue, "base64");
-      }
-    } catch {
-    }
+  if (options?.hasError !== void 0) {
+    sql += ` AND has_error = ?`;
+    args.push(options.hasError ? 1 : 0);
   }
-  const keyPath = getKeyPath();
-  if (!existsSync6(keyPath)) {
-    process.stderr.write(
-      `[keychain] Key not found at ${keyPath} (HOME=${os5.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
-`
-    );
-    return null;
+  if (options?.since) {
+    sql += ` AND timestamp >= ?`;
+    args.push(options.since);
   }
+  if (options?.memoryTypes && options.memoryTypes.length > 0) {
+    const uniqueTypes = [...new Set(options.memoryTypes)];
+    sql += ` AND memory_type IN (${uniqueTypes.map(() => "?").join(",")})`;
+    args.push(...uniqueTypes);
+  } else if (options?.memoryType) {
+    sql += ` AND memory_type = ?`;
+    args.push(options.memoryType);
+  }
+  sql += ` ORDER BY vector_distance_cos(vector, vector32(?))`;
+  args.push(vectorToBlob(queryVector));
+  sql += ` LIMIT ?`;
+  args.push(limit);
+  const result = await client.execute({ sql, args });
+  return result.rows.map((row) => ({
+    id: row.id,
+    agent_id: row.agent_id,
+    agent_role: row.agent_role,
+    session_id: row.session_id,
+    timestamp: row.timestamp,
+    tool_name: row.tool_name,
+    project_name: row.project_name,
+    has_error: row.has_error === 1,
+    raw_text: row.raw_text,
+    vector: row.vector == null ? [] : Array.isArray(row.vector) ? row.vector : Array.from(row.vector),
+    importance: row.importance ?? 5,
+    status: row.status ?? "active",
+    confidence: row.confidence ?? 0.7,
+    last_accessed: row.last_accessed ?? row.timestamp,
+    workspace_id: row.workspace_id ?? null,
+    document_id: row.document_id ?? null,
+    user_id: row.user_id ?? null,
+    char_offset: row.char_offset ?? null,
+    page_number: row.page_number ?? null,
+    source_path: row.source_path ?? null,
+    source_type: row.source_type ?? null
+  }));
+}
+async function attachDocumentMetadata(records) {
+  const docIds = [
+    ...new Set(
+      records.map((r) => r.document_id).filter((id) => typeof id === "string" && id.length > 0)
+    )
+  ];
+  if (docIds.length === 0) return records;
   try {
-    const content = (await readFile3(keyPath, "utf-8")).trim();
-    let b64Value;
-    if (content.startsWith(ENCRYPTED_PREFIX)) {
-      const machineKey = deriveMachineKey();
-      if (!machineKey) {
-        process.stderr.write("[keychain] Cannot derive machine key to decrypt stored key.\n");
-        return null;
-      }
-      const decrypted = decryptWithMachineKey(content, machineKey);
-      if (!decrypted) {
-        process.stderr.write(
-          "[keychain] Key decryption failed \u2014 machine may have changed.\n  Use your 24-word recovery phrase: exe-os link import\n"
-        );
-        return null;
-      }
-      b64Value = decrypted;
-    } else {
-      b64Value = content;
+    const client = getClient();
+    const placeholders = docIds.map(() => "?").join(",");
+    const result = await client.execute({
+      sql: `SELECT id, filename, mime, source_type, uploaded_at
+            FROM documents
+            WHERE id IN (${placeholders})`,
+      args: docIds
+    });
+    const byId = /* @__PURE__ */ new Map();
+    for (const row of result.rows) {
+      const id = row.id;
+      byId.set(id, {
+        document_id: id,
+        filename: row.filename,
+        mime: row.mime ?? null,
+        source_type: row.source_type ?? null,
+        uploaded_at: row.uploaded_at
+      });
     }
-    const key = Buffer.from(b64Value, "base64");
-    const migrated = macKeychainSet(b64Value) || linuxSecretSet(b64Value);
-    if (migrated) {
-      process.stderr.write("[keychain] Migrated key from file to native keychain.\n");
-      try {
-        await unlink(keyPath);
-        process.stderr.write("[keychain] Removed legacy master.key file after native keychain migration.\n");
-      } catch {
-      }
-    } else if (!content.startsWith(ENCRYPTED_PREFIX)) {
-      const fallback = await writeMachineBoundFileFallback(b64Value);
-      if (fallback === "encrypted") {
-        process.stderr.write("[keychain] Upgraded legacy plaintext master.key to machine-bound encrypted fallback.\n");
-      } else {
-        process.stderr.write(
-          "[keychain] WARNING: Could not encrypt legacy master.key \u2014 plaintext fallback remains.\n"
-        );
-      }
+    for (const record of records) {
+      if (!record.document_id) continue;
+      record.document_metadata = byId.get(record.document_id) ?? null;
     }
-    return key;
-  } catch (err) {
-    process.stderr.write(
-      `[keychain] Key read failed at ${keyPath}: ${err instanceof Error ? err.message : String(err)}
-`
-    );
-    return null;
+  } catch {
   }
+  return records;
 }
-
-// src/lib/store.ts
-init_config();
-
-// src/lib/state-bus.ts
-var StateBus = class {
-  handlers = /* @__PURE__ */ new Map();
-  globalHandlers = /* @__PURE__ */ new Set();
-  /** Emit an event to all subscribers */
-  emit(event) {
-    const typeHandlers = this.handlers.get(event.type);
-    if (typeHandlers) {
-      for (const handler of typeHandlers) {
-        try {
-          handler(event);
-        } catch {
-        }
-      }
-    }
-    for (const handler of this.globalHandlers) {
-      try {
-        handler(event);
-      } catch {
-      }
-    }
+async function flushTier3(agentId, options) {
+  const client = getClient();
+  const maxAge = options?.maxAgeHours ?? 72;
+  const cutoff = new Date(Date.now() - maxAge * 36e5).toISOString();
+  if (options?.dryRun) {
+    const result2 = await client.execute({
+      sql: `SELECT COUNT(*) as cnt FROM memories
+            WHERE agent_id = ? AND tier = 3 AND status = 'active' AND timestamp < ?`,
+      args: [agentId, cutoff]
+    });
+    return { archived: Number(result2.rows[0]?.cnt ?? 0) };
   }
-  /** Subscribe to a specific event type */
-  on(type, handler) {
-    if (!this.handlers.has(type)) {
-      this.handlers.set(type, /* @__PURE__ */ new Set());
-    }
-    this.handlers.get(type).add(handler);
+  const result = await client.execute({
+    sql: `UPDATE memories SET status = 'archived'
+          WHERE agent_id = ? AND tier = 3 AND status = 'active' AND timestamp < ?`,
+    args: [agentId, cutoff]
+  });
+  return { archived: result.rowsAffected };
+}
+async function disposeStore() {
+  if (_flushTimer !== null) {
+    clearInterval(_flushTimer);
+    _flushTimer = null;
   }
-  /** Subscribe to ALL events */
-  onAny(handler) {
-    this.globalHandlers.add(handler);
+  if (_pendingRecords.length > 0) {
+    await flushBatch();
   }
-  /** Unsubscribe from a specific event type */
-  off(type, handler) {
-    this.handlers.get(type)?.delete(handler);
+  await disposeTurso();
+  _pendingRecords = [];
+  _nextVersion = 1;
+}
+function vectorToBlob(vector) {
+  const f32 = vector instanceof Float32Array ? vector : new Float32Array(vector);
+  return JSON.stringify(Array.from(f32));
+}
+async function updateMemoryStatus(id, status) {
+  const client = getClient();
+  await client.execute({
+    sql: `UPDATE memories SET status = ? WHERE id = ?`,
+    args: [status, id]
+  });
+}
+function reserveVersions(count) {
+  const reserved = [];
+  for (let i = 0; i < count; i++) {
+    reserved.push(_nextVersion++);
   }
-  /** Unsubscribe from ALL events */
-  offAny(handler) {
-    this.globalHandlers.delete(handler);
+  return reserved;
+}
+async function getMemoryCardinality(agentId) {
+  try {
+    const client = getClient();
+    const result = await client.execute({
+      sql: `SELECT COUNT(*) as cnt FROM memories WHERE agent_id = ? AND COALESCE(status, 'active') = 'active'`,
+      args: [agentId]
+    });
+    return Number(result.rows[0]?.cnt) || 0;
+  } catch {
+    return 0;
   }
-  /** Remove all listeners */
-  clear() {
-    this.handlers.clear();
-    this.globalHandlers.clear();
+}
+var INIT_MAX_RETRIES, INIT_RETRY_DELAY_MS, _pendingRecords, _batchSize, _flushIntervalMs, _flushTimer, _flushing, _nextVersion;
+var init_store = __esm({
+  "src/lib/store.ts"() {
+    "use strict";
+    init_memory();
+    init_database();
+    init_keychain();
+    init_config();
+    init_state_bus();
+    init_memory_write_governor();
+    INIT_MAX_RETRIES = 3;
+    INIT_RETRY_DELAY_MS = 1e3;
+    _pendingRecords = [];
+    _batchSize = 20;
+    _flushIntervalMs = 1e4;
+    _flushTimer = null;
+    _flushing = false;
+    _nextVersion = 1;
   }
-};
-var orgBus = new StateBus();
+});
 
-// src/lib/memory-write-governor.ts
-import { createHash } from "crypto";
-var HIGH_VALUE_SUPERSESSION_TYPES = /* @__PURE__ */ new Set([
-  "decision",
-  "adr",
-  "behavior",
-  "procedure"
-]);
-async function runPostWriteMemoryHygiene(memoryId) {
-  try {
-    const { getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
-    const client = getClient2();
-    const current = await client.execute({
-      sql: `SELECT id, agent_id, project_name, memory_type, content_hash, supersedes_id,
-                   importance, timestamp
-            FROM memories
-            WHERE id = ?
-            LIMIT 1`,
-      args: [memoryId]
-    });
-    const row = current.rows[0];
-    if (!row) return;
-    const memoryType = String(row.memory_type ?? "raw");
-    const contentHash = row.content_hash ? String(row.content_hash) : null;
-    const agentId = String(row.agent_id);
-    const projectName = String(row.project_name);
-    if (contentHash) {
-      await client.execute({
-        sql: `UPDATE memories
-              SET status = 'deleted',
-                  outcome = COALESCE(outcome, 'superseded')
-              WHERE id != ?
-                AND content_hash = ?
-                AND agent_id = ?
-                AND project_name = ?
-                AND COALESCE(memory_type, 'raw') = ?
-                AND COALESCE(status, 'active') = 'active'`,
-        args: [memoryId, contentHash, agentId, projectName, memoryType]
-      });
+// src/lib/session-key.ts
+import { execSync as execSync4 } from "child_process";
+function normalizeCommand(command) {
+  const trimmed = command.trim().toLowerCase();
+  const parts = trimmed.split(/[\\/]/);
+  return parts[parts.length - 1] ?? trimmed;
+}
+function detectRuntimeFromCommand(command) {
+  const normalized = normalizeCommand(command);
+  for (const [runtime, commands] of Object.entries(RUNTIME_COMMANDS)) {
+    if (commands.includes(normalized)) {
+      return runtime;
     }
-    const supersedesId = row.supersedes_id ? String(row.supersedes_id) : null;
-    if (supersedesId && HIGH_VALUE_SUPERSESSION_TYPES.has(memoryType)) {
-      const old = await client.execute({
-        sql: `SELECT importance FROM memories WHERE id = ? LIMIT 1`,
-        args: [supersedesId]
-      });
-      const oldImportance = Number(old.rows[0]?.importance ?? 0);
-      const newImportance = Number(row.importance ?? 0);
-      await client.batch([
-        {
-          sql: `UPDATE memories
-                SET status = 'archived',
-                    outcome = COALESCE(outcome, 'superseded')
-                WHERE id = ?`,
-          args: [supersedesId]
-        },
-        {
-          sql: `UPDATE memories
-                SET importance = MAX(COALESCE(importance, 5), ?),
-                    parent_memory_id = COALESCE(parent_memory_id, ?)
-                WHERE id = ?`,
-          args: [Math.max(oldImportance, newImportance), supersedesId, memoryId]
-        }
-      ], "write");
+  }
+  return null;
+}
+function resolveRuntimeProcess() {
+  let pid = process.ppid;
+  for (let i = 0; i < 10; i++) {
+    try {
+      const info = execSync4(`ps -p ${pid} -o ppid=,comm=`, {
+        encoding: "utf8",
+        timeout: 2e3
+      }).trim();
+      const match = info.match(/^\s*(\d+)\s+(.+)$/);
+      if (!match) break;
+      const [, ppid, cmd] = match;
+      const runtime = detectRuntimeFromCommand(cmd ?? "");
+      if (runtime) {
+        return { pid: String(pid), runtime };
+      }
+      pid = parseInt(ppid, 10);
+      if (pid <= 1) break;
+    } catch {
+      break;
     }
-  } catch (err) {
-    process.stderr.write(
-      `[memory-governor] post-write hygiene failed for ${memoryId}: ${err instanceof Error ? err.message : String(err)}
-`
-    );
   }
+  return null;
 }
-function schedulePostWriteMemoryHygiene(memoryIds) {
-  if (process.env.EXE_SKIP_MEMORY_HYGIENE === "1") return;
-  if (memoryIds.length === 0) return;
-  const run = () => {
-    void Promise.all(memoryIds.map((id) => runPostWriteMemoryHygiene(id)));
-  };
-  if (typeof setImmediate === "function") setImmediate(run);
-  else setTimeout(run, 0);
+function getSessionKey() {
+  if (_cached) return _cached;
+  if (process.env.EXE_SESSION_KEY) {
+    _cached = process.env.EXE_SESSION_KEY;
+    return _cached;
+  }
+  const resolved = resolveRuntimeProcess();
+  if (resolved) {
+    _cachedRuntime = resolved.runtime;
+    _cached = resolved.pid;
+    return _cached;
+  }
+  _cached = process.env.CLAUDE_CODE_SSE_PORT ?? String(process.ppid);
+  return _cached;
 }
+var _cached, _cachedRuntime, RUNTIME_COMMANDS;
+var init_session_key = __esm({
+  "src/lib/session-key.ts"() {
+    "use strict";
+    _cached = null;
+    _cachedRuntime = null;
+    RUNTIME_COMMANDS = {
+      claude: ["claude", "claude.exe", "claude-native"],
+      codex: ["codex"],
+      opencode: ["opencode"]
+    };
+  }
+});
 
-// src/lib/store.ts
-var INIT_MAX_RETRIES = 3;
-var INIT_RETRY_DELAY_MS = 1e3;
-function isBusyError2(err) {
-  if (err instanceof Error) {
-    const msg = err.message.toLowerCase();
-    return msg.includes("sqlite_busy") || msg.includes("database is locked");
+// src/mcp/agent-context.ts
+import { AsyncLocalStorage } from "async_hooks";
+function getAgentContext() {
+  return agentStore.getStore();
+}
+var agentStore;
+var init_agent_context = __esm({
+  "src/mcp/agent-context.ts"() {
+    "use strict";
+    agentStore = new AsyncLocalStorage();
   }
-  return false;
+});
+
+// src/lib/active-agent.ts
+var active_agent_exports = {};
+__export(active_agent_exports, {
+  cleanupSessionMarkers: () => cleanupSessionMarkers,
+  clearActiveAgent: () => clearActiveAgent,
+  getActiveAgent: () => getActiveAgent,
+  getAllActiveAgents: () => getAllActiveAgents,
+  resolveActiveAgentFromTmuxSession: () => resolveActiveAgentFromTmuxSession,
+  writeActiveAgent: () => writeActiveAgent
+});
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, unlinkSync as unlinkSync4, readdirSync as readdirSync3 } from "fs";
+import { execSync as execSync5 } from "child_process";
+import path9 from "path";
+function isNameWithOptionalInstance(candidate, baseName) {
+  if (candidate === baseName) return true;
+  if (!candidate.startsWith(baseName)) return false;
+  return /^\d+$/.test(candidate.slice(baseName.length));
 }
-async function retryOnBusy2(fn, label) {
-  for (let attempt = 0; attempt <= INIT_MAX_RETRIES; attempt++) {
-    try {
-      return await fn();
-    } catch (err) {
-      if (!isBusyError2(err) || attempt === INIT_MAX_RETRIES) throw err;
-      process.stderr.write(
-        `[store] SQLITE_BUSY during ${label}, retry ${attempt + 1}/${INIT_MAX_RETRIES}
-`
-      );
-      await new Promise((r) => setTimeout(r, INIT_RETRY_DELAY_MS * (attempt + 1)));
+function resolveEmployeeFromSessionPrefix(prefix, employees) {
+  const sorted = [...employees].sort((a, b) => b.name.length - a.name.length);
+  for (const employee of sorted) {
+    if (isNameWithOptionalInstance(prefix, employee.name)) {
+      return { agentId: employee.name, agentRole: employee.role };
     }
   }
-  throw new Error("unreachable");
+  return null;
 }
-var _pendingRecords = [];
-var _batchSize = 20;
-var _flushIntervalMs = 1e4;
-var _flushTimer = null;
-var _flushing = false;
-var _nextVersion = 1;
-async function initStore(options) {
-  if (_flushTimer !== null) {
-    clearInterval(_flushTimer);
-    _flushTimer = null;
+function resolveActiveAgentFromTmuxSession(sessionName) {
+  const employees = loadEmployeesSync();
+  const coordinator = getCoordinatorEmployee(employees);
+  const coordinatorName = coordinator?.name ?? DEFAULT_COORDINATOR_TEMPLATE_NAME;
+  if (isNameWithOptionalInstance(sessionName, coordinatorName)) {
+    return {
+      agentId: coordinatorName,
+      agentRole: coordinator?.role ?? "COO"
+    };
   }
-  _pendingRecords = [];
-  _flushing = false;
-  _batchSize = options?.batchSize ?? 20;
-  _flushIntervalMs = options?.flushIntervalMs ?? 1e4;
-  let dbPath = options?.dbPath;
-  if (!dbPath) {
-    const config = await loadConfig();
-    dbPath = config.dbPath;
+  if (isNameWithOptionalInstance(sessionName, DEFAULT_COORDINATOR_TEMPLATE_NAME)) {
+    return {
+      agentId: coordinator?.name ?? DEFAULT_COORDINATOR_TEMPLATE_NAME,
+      agentRole: coordinator?.role ?? "COO"
+    };
   }
-  let masterKey = options?.masterKey ?? null;
-  if (!masterKey) {
-    masterKey = await getMasterKey();
-    if (!masterKey) {
-      throw new Error(
-        "No encryption key found. Run /exe-setup to generate one."
-      );
+  if (sessionName.includes("-")) {
+    const prefix = sessionName.split("-")[0] ?? "";
+    const employee = resolveEmployeeFromSessionPrefix(prefix, employees);
+    if (employee) return employee;
+    const legacy = prefix.match(/^([a-zA-Z]+)\d*$/);
+    if (legacy?.[1] && legacy[1] !== DEFAULT_COORDINATOR_TEMPLATE_NAME) {
+      const emp = getEmployee(employees, legacy[1]);
+      return { agentId: emp?.name ?? legacy[1], agentRole: emp?.role ?? "employee" };
     }
   }
-  const hexKey = masterKey.toString("hex");
-  await initTurso({
-    dbPath,
-    encryptionKey: hexKey
-  });
-  await retryOnBusy2(() => ensureSchema(), "ensureSchema");
+  return null;
+}
+function getMarkerPath() {
+  return path9.join(CACHE_DIR, `active-agent-${getSessionKey()}.json`);
+}
+function writeActiveAgent(agentId, agentRole) {
   try {
-    const { initDaemonClient: initDaemonClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
-    await initDaemonClient2();
+    mkdirSync4(CACHE_DIR, { recursive: true });
+    writeFileSync4(
+      getMarkerPath(),
+      JSON.stringify({ agentId, agentRole, startedAt: (/* @__PURE__ */ new Date()).toISOString() })
+    );
   } catch {
   }
-  if (!options?.lightweight) {
-    try {
-      const { initShardManager: initShardManager2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
-      initShardManager2(hexKey);
-    } catch {
-    }
-    const client = getClient();
-    const vResult = await retryOnBusy2(
-      () => client.execute("SELECT MAX(version) as max_v FROM memories"),
-      "version-query"
-    );
-    _nextVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
-    try {
-      const { loadGlobalProcedures: loadGlobalProcedures2 } = await Promise.resolve().then(() => (init_global_procedures(), global_procedures_exports));
-      await loadGlobalProcedures2();
-    } catch {
+}
+function clearActiveAgent() {
+  try {
+    unlinkSync4(getMarkerPath());
+  } catch {
+  }
+}
+function getActiveAgent() {
+  const httpCtx = getAgentContext();
+  if (httpCtx) return httpCtx;
+  try {
+    const markerPath = getMarkerPath();
+    const raw = readFileSync5(markerPath, "utf8");
+    const data = JSON.parse(raw);
+    if (data.agentId) {
+      if (data.startedAt) {
+        const age = Date.now() - new Date(data.startedAt).getTime();
+        if (age > STALE_MS) {
+          try {
+            unlinkSync4(markerPath);
+          } catch {
+          }
+        } else {
+          return {
+            agentId: data.agentId,
+            agentRole: data.agentRole || "employee"
+          };
+        }
+      } else {
+        return {
+          agentId: data.agentId,
+          agentRole: data.agentRole || "employee"
+        };
+      }
     }
+  } catch {
+  }
+  try {
+    const sessionName = execSync5(
+      "tmux display-message -p '#{session_name}' 2>/dev/null",
+      { encoding: "utf8", timeout: 2e3 }
+    ).trim();
+    const resolved = resolveActiveAgentFromTmuxSession(sessionName);
+    if (resolved) return resolved;
+  } catch {
   }
+  return {
+    agentId: process.env.AGENT_ID || "default",
+    agentRole: process.env.AGENT_ROLE || "employee"
+  };
 }
-async function flushBatch() {
-  if (_flushing || _pendingRecords.length === 0) return 0;
-  _flushing = true;
+function getAllActiveAgents() {
   try {
-    const batch = _pendingRecords.slice(0);
-    const client = getClient();
-    const vResult = await client.execute("SELECT MAX(version) as max_v FROM memories");
-    let baseVersion = (Number(vResult.rows[0]?.max_v) || 0) + 1;
-    for (const row of batch) {
-      row.version = baseVersion++;
-    }
-    _nextVersion = baseVersion;
-    const buildStmt = (row) => {
-      const hasVector = row.vector !== null;
-      const taskId = row.task_id ?? null;
-      const importance = row.importance ?? 5;
-      const status = row.status ?? "active";
-      const confidence = row.confidence ?? 0.7;
-      const lastAccessed = row.last_accessed ?? row.timestamp;
-      const workspaceId = row.workspace_id ?? null;
-      const documentId = row.document_id ?? null;
-      const userId = row.user_id ?? null;
-      const charOffset = row.char_offset ?? null;
-      const pageNumber = row.page_number ?? null;
-      const sourcePath = row.source_path ?? null;
-      const sourceType = row.source_type ?? null;
-      const tier = row.tier ?? 3;
-      const supersedesId = row.supersedes_id ?? null;
-      const draft = row.draft ? 1 : 0;
-      const memoryType = row.memory_type ?? "raw";
-      const trajectory = row.trajectory ?? null;
-      const contentHash = row.content_hash ?? null;
-      const intent = row.intent ?? null;
-      const outcome = row.outcome ?? null;
-      const domain = row.domain ?? null;
-      const referencedEntities = row.referenced_entities ?? null;
-      const retrievalCount = row.retrieval_count ?? 0;
-      const chainPosition = row.chain_position ?? null;
-      const reviewStatus = row.review_status ?? null;
-      const contextWindowPct = row.context_window_pct ?? null;
-      const filePaths = row.file_paths ?? null;
-      const commitHash = row.commit_hash ?? null;
-      const durationMs = row.duration_ms ?? null;
-      const tokenCost = row.token_cost ?? null;
-      const audience = row.audience ?? null;
-      const languageType = row.language_type ?? null;
-      const parentMemoryId = row.parent_memory_id ?? null;
-      const cols = `id, agent_id, agent_role, session_id, timestamp,
-               tool_name, project_name,
-               has_error, raw_text, vector, version, task_id, importance, status,
-               confidence, last_accessed,
-               workspace_id, document_id, user_id, char_offset, page_number,
-               source_path, source_type, tier, supersedes_id, draft, memory_type, trajectory, content_hash,
-               intent, outcome, domain, referenced_entities, retrieval_count,
-               chain_position, review_status, context_window_pct, file_paths, commit_hash,
-               duration_ms, token_cost, audience, language_type, parent_memory_id`;
-      const metaArgs = [
-        intent,
-        outcome,
-        domain,
-        referencedEntities,
-        retrievalCount,
-        chainPosition,
-        reviewStatus,
-        contextWindowPct,
-        filePaths,
-        commitHash,
-        durationMs,
-        tokenCost,
-        audience,
-        languageType,
-        parentMemoryId
-      ];
-      const baseArgs = [
-        row.id,
-        row.agent_id,
-        row.agent_role,
-        row.session_id,
-        row.timestamp,
-        row.tool_name,
-        row.project_name,
-        row.has_error,
-        row.raw_text
-      ];
-      const sharedArgs = [
-        row.version,
-        taskId,
-        importance,
-        status,
-        confidence,
-        lastAccessed,
-        workspaceId,
-        documentId,
-        userId,
-        charOffset,
-        pageNumber,
-        sourcePath,
-        sourceType,
-        tier,
-        supersedesId,
-        draft,
-        memoryType,
-        trajectory,
-        contentHash
-      ];
-      return {
-        sql: hasVector ? `INSERT OR IGNORE INTO memories (${cols})
-              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, vector32(?), ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)` : `INSERT OR IGNORE INTO memories (${cols})
-              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        args: hasVector ? [...baseArgs, vectorToBlob(row.vector), ...sharedArgs, ...metaArgs] : [...baseArgs, ...sharedArgs, ...metaArgs]
-      };
-    };
-    const globalClient = getClient();
-    const globalStmts = batch.map(buildStmt);
-    await globalClient.batch(globalStmts, "write");
-    try {
-      const { insertMemoryCardsForBatch: insertMemoryCardsForBatch2 } = await Promise.resolve().then(() => (init_memory_cards(), memory_cards_exports));
-      await insertMemoryCardsForBatch2(batch);
-    } catch {
-    }
-    schedulePostWriteMemoryHygiene(batch.map((row) => row.id));
-    _pendingRecords.splice(0, batch.length);
-    try {
-      const { isShardingEnabled: isShardingEnabled2, getReadyShardClient: getReadyShardClient2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
-      if (isShardingEnabled2()) {
-        const byProject = /* @__PURE__ */ new Map();
-        let skippedUnknown = 0;
-        for (const row of batch) {
-          const proj = row.project_name?.trim();
-          if (!proj) {
-            skippedUnknown++;
+    const files = readdirSync3(CACHE_DIR);
+    const sessions = [];
+    for (const file of files) {
+      if (!file.startsWith("active-agent-") || !file.endsWith(".json")) continue;
+      const key = file.slice("active-agent-".length, -".json".length);
+      if (key === "undefined") continue;
+      try {
+        const raw = readFileSync5(path9.join(CACHE_DIR, file), "utf8");
+        const data = JSON.parse(raw);
+        if (!data.agentId) continue;
+        if (data.startedAt) {
+          const age = Date.now() - new Date(data.startedAt).getTime();
+          if (age > STALE_MS) {
+            try {
+              unlinkSync4(path9.join(CACHE_DIR, file));
+            } catch {
+            }
             continue;
           }
-          if (!byProject.has(proj)) byProject.set(proj, []);
-          byProject.get(proj).push(row);
-        }
-        if (skippedUnknown > 0) {
-          process.stderr.write(
-            `[store] Shard skip: ${skippedUnknown} record(s) with empty project_name (kept in main DB only)
-`
-          );
-        }
-        for (const [project, rows] of byProject) {
-          try {
-            const shardClient = await getReadyShardClient2(project);
-            const shardStmts = rows.map(buildStmt);
-            await shardClient.batch(shardStmts, "write");
-          } catch (err) {
-            const fullError = err instanceof Error ? `${err.name}: ${err.message}${err.stack ? `
-${err.stack.split("\n").slice(1, 3).join("\n")}` : ""}` : String(err);
-            process.stderr.write(
-              `[store] Shard write failed for ${project} (${rows.length} records): ${fullError}
-`
-            );
-          }
         }
+        sessions.push({
+          agentId: data.agentId,
+          agentRole: data.agentRole || "employee",
+          startedAt: data.startedAt || (/* @__PURE__ */ new Date()).toISOString(),
+          sessionKey: key
+        });
+      } catch {
       }
-    } catch {
     }
-    return batch.length;
-  } finally {
-    _flushing = false;
+    return sessions;
+  } catch {
+    return [];
   }
 }
-async function disposeStore() {
-  if (_flushTimer !== null) {
-    clearInterval(_flushTimer);
-    _flushTimer = null;
+function cleanupSessionMarkers() {
+  const key = getSessionKey();
+  try {
+    unlinkSync4(path9.join(CACHE_DIR, `active-agent-${key}.json`));
+  } catch {
   }
-  if (_pendingRecords.length > 0) {
-    await flushBatch();
+  try {
+    unlinkSync4(path9.join(CACHE_DIR, "active-agent-undefined.json"));
+  } catch {
   }
-  await disposeTurso();
-  _pendingRecords = [];
-  _nextVersion = 1;
 }
-function vectorToBlob(vector) {
-  const f32 = vector instanceof Float32Array ? vector : new Float32Array(vector);
-  return JSON.stringify(Array.from(f32));
+var CACHE_DIR, STALE_MS;
+var init_active_agent = __esm({
+  "src/lib/active-agent.ts"() {
+    "use strict";
+    init_config();
+    init_session_key();
+    init_agent_context();
+    init_employees();
+    CACHE_DIR = path9.join(EXE_AI_DIR, "session-cache");
+    STALE_MS = 24 * 60 * 60 * 1e3;
+  }
+});
+
+// src/bin/exe-launch-agent.ts
+init_store();
+import os7 from "os";
+import path10 from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5, readdirSync as readdirSync4 } from "fs";
+import { spawnSync } from "child_process";
+
+// src/bin/fast-db-init.ts
+async function fastDbInit() {
+  const { isInitialized: isInitialized2, getClient: getClient2, setExternalClient: setExternalClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+  if (isInitialized2()) {
+    return getClient2();
+  }
+  try {
+    const { connectEmbedDaemon: connectEmbedDaemon2, sendDaemonRequest: sendDaemonRequest2, isClientConnected: isClientConnected2 } = await Promise.resolve().then(() => (init_exe_daemon_client(), exe_daemon_client_exports));
+    const { deserializeResultSet: deserializeResultSet2 } = await Promise.resolve().then(() => (init_daemon_protocol(), daemon_protocol_exports));
+    await connectEmbedDaemon2();
+    if (isClientConnected2()) {
+      const daemonClient = {
+        async execute(stmt) {
+          const sql = typeof stmt === "string" ? stmt : stmt.sql;
+          const args = typeof stmt === "string" ? [] : Array.isArray(stmt.args) ? stmt.args : [];
+          const resp = await sendDaemonRequest2({ type: "db-execute", sql, args });
+          if (resp.error) throw new Error(String(resp.error));
+          if (resp.db) return deserializeResultSet2(resp.db);
+          throw new Error("Unexpected daemon response");
+        },
+        async batch(stmts, mode) {
+          const statements = stmts.map((s) => {
+            const sql = typeof s === "string" ? s : s.sql;
+            const args = typeof s === "string" ? [] : Array.isArray(s.args) ? s.args : [];
+            return { sql, args };
+          });
+          const resp = await sendDaemonRequest2({ type: "db-batch", statements, mode: mode ?? "deferred" });
+          if (resp.error) throw new Error(String(resp.error));
+          const batchResults = resp["db-batch"];
+          if (batchResults) return batchResults.map(deserializeResultSet2);
+          throw new Error("Unexpected daemon batch response");
+        },
+        async transaction(_mode) {
+          throw new Error("Transactions not supported via daemon socket");
+        },
+        async executeMultiple(_sql) {
+          throw new Error("executeMultiple not supported via daemon socket");
+        },
+        async migrate(_stmts) {
+          throw new Error("migrate not supported via daemon socket");
+        },
+        sync() {
+          return Promise.resolve(void 0);
+        },
+        close() {
+        },
+        get closed() {
+          return false;
+        },
+        get protocol() {
+          return "file";
+        }
+      };
+      setExternalClient2(daemonClient);
+      return daemonClient;
+    }
+  } catch {
+  }
+  const { initStore: initStore2 } = await Promise.resolve().then(() => (init_store(), store_exports));
+  await initStore2({ lightweight: true });
+  return getClient2();
 }
 
 // src/lib/behaviors-export.ts
@@ -4506,7 +5773,7 @@ import {
   existsSync as existsSync8,
   mkdirSync as mkdirSync3,
   readdirSync as readdirSync2,
-  statSync as statSync3,
+  statSync as statSync4,
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync3
 } from "fs";
@@ -4578,7 +5845,7 @@ function sweepStaleBehaviorExports(now = Date.now()) {
   for (const entry of entries) {
     const filePath = path8.join(BEHAVIORS_EXPORT_DIR, entry);
     try {
-      const stat = statSync3(filePath);
+      const stat = statSync4(filePath);
       if (now - stat.mtimeMs > STALE_EXPORT_AGE_MS) {
         unlinkSync3(filePath);
       }
@@ -5121,7 +6388,7 @@ async function main() {
   }
   let behaviorsPath = null;
   try {
-    await initStore();
+    await fastDbInit();
     behaviorsPath = await exportBehaviorsForAgent(agent, "");
   } catch (err) {
     process.stderr.write(