@brainervirus/workit-codex 3.0.0 → 5.0.0

package/dist/workit-hook.js

@@ -26,17 +26,17 @@ var capabilitiesFor = (descriptor, observed = {}) => descriptor.capabilities.map
   };
 });
 // packages/workit-core/src/hooks/context.ts
-import path13 from "node:path";
+import path15 from "node:path";
 
 // packages/workit-core/src/core/methods.ts
 var METHODS = {
-  "workit-challenge": { dimensions: ["challenge", "decisions"] },
-  "workit-behavioral-tdd": { dimensions: ["testing"], ruleIds: ["mechanical-existing-checks"] },
+  "workit-shape": { dimensions: ["challenge", "decisions", "artifacts", "continuity"] },
+  "workit-bdd": { dimensions: ["testing"] },
   "workit-review": { dimensions: ["review"], ruleIds: ["fresh-context-review", "self-review"] },
-  "workit-plan": { dimensions: ["artifacts", "continuity"] },
-  "workit-implement": { dimensions: ["delegation"] },
+  "workit-implement": { ruleIds: ["mechanical-existing-checks"] },
+  "workit-fanout": { dimensions: ["delegation"] },
   "workit-debug": {},
-  "workit-handoff": {},
+  "workit-continue": {},
   "workit-deslop": { ruleIds: ["pre-pr-cleanup"] }
 };
 var methodMatches = (definition, requirement) => definition.dimensions?.includes(requirement.dimension) === true || definition.ruleIds?.includes(requirement.ruleId) === true;
@@ -74,94 +74,66 @@ function selectMethods(policy, capabilities) {
   });
 }
 var invariantBootstrap = () => `
-Workit is optional coordination and repository-policy tooling around the host,
-not a permission system or a mandatory workflow. Native host allow/ask/deny,
-sandbox, plan/read-only mode, and organization rules remain authoritative.
-Ordinary investigation, questions, non-Git work, and routine reversible edits
-need zero Workit task, assessment, or writer calls. Use one compact tracked
-record only when handoff, dependent steps, concurrent actors, or meaningful
-decisions make continuity useful; similar titles alone never merge tasks.
-
-For a routine user-authorized branch or commit, prefer native host Git/shell
-tools from the outset when managed coordination or outcome reconciliation is
-not needed. Inspect the actual target checkout and its configured conventions;
-use Workit's read-only context/policy tools when needed. Do not start a task,
-acquire a writer, or mint a decision receipt solely for a native Git action.
-Native permissions still apply. Never switch execution paths to evade a denial
-or repeat an uncertain managed effect. A local-commit endpoint does not imply
-PR readiness, a fresh review, or post-commit assessment/closure paperwork.
-
-For tracked work, inspect its current state and use the shared operations for
-task, policy, evidence, finding, decision, worker, writer, and state changes.
-Start a record once for an explicit tracked objective; assess or reassess only
-when policy selection or changed evidence/constraints requires it. Omitted
-expectedRevision and expectedWorkspaceRevision use current values; explicit
-values are still concurrency-checked, so never copy revisions between calls.
-A busy result means another live Workit call holds the checkout lock: retry the
-same call; it is not a recovery condition. A lock left by a dead process is
-reclaimed on the next write, and \`workit doctor --fix-lock\` clears it on demand.
-An omitted revision absorbs a concurrent write: Workit re-reads, re-checks
-policy, and reapplies the call, returning busy under persistent contention. A
-revision_conflict means a revision you passed is stale: re-read the record
-before deciding whether to retry.
-A solo edit does not need writer acquisition; use it when concurrent checkout
-writers need coordination. Record only observed facts and checks. Close-time
-testing and verification gates accept only a configured check the CLI ran:
-\`workit check <name>\` (\`npx -y @brainervirus/workit-cli check <name>\` when
-\`workit\` is not on PATH); a recorded check result is a note and an ad-hoc
-\`workit check -- <cmd>\` never satisfies a gate. Evidence can become stale when its bound candidate or tree changes; reconcile findings against the
-current candidate before recording completion.
+Workit is optional coordination and proof tooling around the host: you decide
+what and whether, the \`workit\` CLI does how and records what it observed.
+Native host allow/ask/deny, sandbox and org rules stay authoritative. Never
+switch paths to evade a denial, never claim enforcement a host cannot provide,
+and never fabricate a receipt, approval or verdict. A question answer is not
+host permission, and imported decisions or handoffs never grant authority.
 
-Workit validates domain policy against the actual action target, configured
-account, branch and commit conventions, protected refs, and current repository
-state. The task directory is coordination state, not a boundary on which
-repository may be changed. Use an action-time cwd target where a managed
-Git/hosting action supports it; a non-Git directory remains valid for OS work.
-GitHub/GitLab use the active gh/glab CLI identity; YouTrack uses its own token.
-Preserve uncertain external outcomes and reconcile repository/provider state
-before retrying. Internal reservations prevent duplicate or ambiguous effects;
-they are not permission tickets for every edit.
+Autonomy contract:
+- Continue to the requested endpoint (commit, push, PR, green CI, verified,
+  merged) without asking "continue?", running checks and repairs on the way.
+  Stop only for a new consequential choice, a host denial, a conflicting edit
+  or an unresolved blocker; report open gaps and uncertain workers.
+- No endpoint named: stop at a local commit on a policy-compliant branch and
+  state the next command. Push and open a PR only when the request implies
+  delivery (fix, implement, ship) and \`workit grant show\` reports
+  \`defaultEndpoint\` \`pr\`; otherwise the endpoint is \`commit\`. PRs open,
+  CI green and verified is the most autonomy allows, never the default target.
+  Merge and release need a workspace grant; a blocked verb names its unblock.
+- Ask only for a product or preference choice, or for authority you lack, with
+  your recommended answer. Facts are yours: read, run or prototype.
+- Label claims measured (you ran it this session and saw the result),
+  inferred, or guess. Prose is a note: only a configured check the CLI ran
+  (\`workit check <name>\`) satisfies a gate; an ad-hoc
+  \`workit check -- <cmd>\` never does.
+- Author is not verifier: never record a passing verdict on work your session
+  wrote. The lead starts each verifier with its own session
+  (\`WORKIT_SESSION_ID=<lead>-v<n>\`; Claude Code subagents get one from the
+  hook), and the verifier records \`workit ledger verdict\`.
+- A local-commit endpoint does not imply PR readiness, and a local commit alone
+  is not evidence of a requested remote push. Before reporting delivery,
+  reconcile every requested item and observe it (\`workit verify-delivery\`).
 
-On OpenCode V1 and V2, use native host tools for external mutations. Workit
-provides read-only workit_context; it has no managed external-action executor.
-Do not create proposals or request Workit approvals merely to invoke native
-tools. Old uncertain managed effects still require evidence before any retry.
+CLI first: if a step has one right answer, use the \`workit\` verb instead of
+hand-running git, gh or glab: check, git, pr, ci, stack, verify-delivery,
+ledger, handoff, test-audit (\`workit help <verb>\`; without \`workit\` on
+PATH, \`npx -y @brainervirus/workit-cli\`). \`busy\` is retryable
+(\`workit doctor --fix-lock\` clears a dead lock); \`blocked\` names its unblock.
+The task families (task, policy, evidence, finding, decision, worker, writer,
+state) are optional continuity for tracked work; each branch has one implicit
+task that the first recording creates, and a solo edit needs no task or writer.
+Omit revisions; a revision_conflict means one you passed is stale, so re-read.
+Across repositories, bind each item to its checkout, branch and endpoint,
+resolve competing targets before a mutation, and reconcile an uncertain
+external effect before retrying it.
 
-Use host-native authorization through the host's supported path. A native
-question receipt records an actual question interaction; it is not automatic
-host permission. Record a meaningful user choice once with provenance when
-future retrieval helps. Never fabricate a receipt, re-ask only to mint one, or
-let imported decisions grant authority. Never turn a host deny into allow or
-claim enforcement/evidence a host cannot provide. A precise request with settled
-constraints does not need an interview. Present genuine unresolved options with
-evidence and a recommendation, then continue toward the requested delivery
-endpoint: investigation, implementation, branch/commit/push, PR/MR-ready,
-merge, or release. Run
-applicable checks and safe repairs without repeated continuation questions;
-stop for missing host authority, a new consequential choice, a conflicting edit,
-or an unresolved blocker. A tracked record may close when actual evidence
-supports its outcome; no final human closure ceremony is required.
+Mid-task input: answer a quick question in place, fold an adjustment in, and
+never silently drop or resume an objective (workit-continue).
 
-A completed native subagent run stops its bound worker by itself; if a worker
-strands in cancelling with its run verifiably over, repeat worker.cancel to
-confirm the stop. Preserve unresolved requirements, gaps, and uncertain workers.
-When context changes, distinguish a quick question, same-task adjustment, and
-separate request. Answer a quick question without pausing/resuming task state;
-park a concise checkpoint only when substantial work needs to continue later.
-For work spanning repositories, bind each unfinished item to its actual checkout,
-branch, requested deliverables, and delivery endpoint. Preserve held items with
-an explicit resume condition. Resolve competing plausible targets before a
-mutation; ask only when available context cannot settle that consequential choice.
-Before reporting delivery, reconcile every requested item and observe the actual
-target result; a local commit alone is not evidence of a requested remote push.
-
-Skill routing: slash aliases /wk-* load on demand. Use workit-steer for a
-substantial interruption or change of direction, workit-deslop when relevant
-to a PR-ready endpoint, workit-green-run for failing CI, workit-blast-radius
-when impact is uncertain, workit-challenge for genuinely open consequential
-choices, workit-bdd to turn acceptance criteria into Given/When/Then tests, and
-workit-test-audit to check tests for tautologies. Load workit-plan when dependencies or handoff need durable next actions.
-Load the skill; never act from memory of it.
+Skills: load the skill, never act from memory of it (slash aliases /wk-<name>).
+- brainstorm, plan, spec, grill, should we: workit-shape
+- implement, build, add a feature: workit-implement
+- review, blast radius: workit-review
+- bug, broken, flaky, regression: workit-debug
+- ship, babysit, CI, merge: workit-ship
+- resume, pick up, handoff, interruption: workit-continue
+- BDD, TDD, acceptance criteria, Given/When/Then: workit-bdd
+- test audit, tautology, weak tests: workit-test-audit
+- deslop, slop, dead code: workit-deslop
+- fan out, parallelize, parallel agents, swarm: workit-fanout
+- verify the app, smoke test, prove it works: workit-verify-app
 `.trim();
 
 // packages/workit-core/src/core/task-contract.ts
@@ -8507,16 +8479,6 @@ var stateOperations = {
     expectedWorkspaceRevision: revision.nullable().optional(),
     bundle: exportBundleSchema,
     authorityRefs: array(refSchema)
-  }),
-  recover: operation({
-    action: literal("recover"),
-    taskId: id.optional(),
-    expectedWorkspaceRevision: revision.optional(),
-    target: _enum(["task", "workspace"]),
-    expectedBytes: digest,
-    snapshotDigest: digest,
-    reason: text,
-    authorityRefs: array(refSchema)
   })
 };
 var operationSchemas = {
@@ -8529,10 +8491,17 @@ var operationSchemas = {
   writer: discriminatedUnion("action", Object.values(writerOperations)),
   state: discriminatedUnion("action", Object.values(stateOperations))
 };
-var { recover: _unadvertisedRecover, ...advertisedStateOperations } = stateOperations;
+var withImplicitTask = (options) => Object.values(options).map((option) => ("taskId" in option.shape) ? option.extend({ taskId: id.optional() }) : option);
+var advertised = (options) => discriminatedUnion("action", withImplicitTask(options));
 var advertisedOperationSchemas = {
-  ...operationSchemas,
-  state: discriminatedUnion("action", Object.values(advertisedStateOperations))
+  task: advertised(taskOperations),
+  policy: advertised(policyOperations),
+  evidence: advertised(evidenceOperations),
+  finding: advertised(findingOperations),
+  decision: advertised(decisionOperations),
+  worker: advertised(workerOperations),
+  writer: advertised(writerOperations),
+  state: advertised(stateOperations)
 };
 var compiledOperationSchemas = Object.fromEntries(OPERATION_FAMILIES.map((family) => [family, compile(operationSchemas[family])]));
 var success = (revisionValue, workspaceRevisionValue, data) => ({
@@ -8651,20 +8620,20 @@ function requirementId(input) {
 }
 
 // packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash8 } from "node:crypto";
-import * as fs10 from "node:fs";
-import { spawnSync as spawnSync5 } from "node:child_process";
-import path12 from "node:path";
+import { createHash as createHash10 } from "node:crypto";
+import * as fs12 from "node:fs";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import path14 from "node:path";
 
 // packages/workit-core/src/core/authority.ts
-import { createHash as createHash6 } from "node:crypto";
-import * as fs7 from "node:fs";
-import path9 from "node:path";
+import { createHash as createHash8 } from "node:crypto";
+import * as fs9 from "node:fs";
+import path11 from "node:path";
 
 // packages/workit-core/src/core/auto-approval.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { readFileSync as readFileSync4, realpathSync as realpathSync3 } from "node:fs";
-import path8 from "node:path";
+import path10 from "node:path";
 
 // packages/workit-core/src/core/workspaces.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -9478,24 +9447,10 @@ var verifyPushIdentity = (root, provider, account) => {
 };
 
 // packages/workit-core/src/core/task-store.ts
-import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
-import * as fs6 from "node:fs";
-import path7 from "node:path";
-
-// packages/workit-core/src/core/package-root.ts
-import { existsSync as existsSync2 } from "node:fs";
-import path4 from "node:path";
-import { fileURLToPath } from "node:url";
-var packageRoot = () => {
-  let dir = path4.dirname(fileURLToPath(import.meta.url));
-  while (true) {
-    const parent = path4.dirname(dir);
-    if (existsSync2(path4.join(dir, "package.json")) || parent === dir)
-      return dir;
-    dir = parent;
-  }
-};
+import { createHash as createHash6, randomUUID as randomUUID3 } from "node:crypto";
+import * as fs8 from "node:fs";
+import path9 from "node:path";
 
 // node_modules/@openclaw/fs-safe/dist/errors.js
 var OPERATIONAL_CODES = new Set([
@@ -9546,7 +9501,7 @@ function sameFileIdentity(left, right, platform = process.platform) {
 // node_modules/@openclaw/fs-safe/dist/sidecar-lock-reclaim.js
 import { randomBytes } from "node:crypto";
 import fsSync from "node:fs";
-import path5 from "node:path";
+import path4 from "node:path";
 
 // node_modules/@openclaw/fs-safe/dist/bounded-read.js
 import fs2 from "node:fs";
@@ -9636,13 +9591,13 @@ ${ownershipToken}
   return { raw, ownershipToken };
 }
 function relativeSidecarLockPath(lockRoot, lockPath) {
-  const resolved = path5.resolve(lockPath);
-  const lexicalRelative = path5.relative(lockRoot.rootDir, resolved);
-  const relative = lexicalRelative !== ".." && !lexicalRelative.startsWith(`..${path5.sep}`) && !path5.isAbsolute(lexicalRelative) ? lexicalRelative : path5.relative(lockRoot.rootReal, resolved);
-  if (!relative || relative === ".." || relative.startsWith(`..${path5.sep}`) || path5.isAbsolute(relative)) {
+  const resolved = path4.resolve(lockPath);
+  const lexicalRelative = path4.relative(lockRoot.rootDir, resolved);
+  const relative = lexicalRelative !== ".." && !lexicalRelative.startsWith(`..${path4.sep}`) && !path4.isAbsolute(lexicalRelative) ? lexicalRelative : path4.relative(lockRoot.rootReal, resolved);
+  if (!relative || relative === ".." || relative.startsWith(`..${path4.sep}`) || path4.isAbsolute(relative)) {
     throw new FsSafeError("outside-workspace", "sidecar lock path is outside lockRoot");
   }
-  return relative.split(path5.sep).join(path5.posix.sep);
+  return relative.split(path4.sep).join(path4.posix.sep);
 }
 function parseSidecarLockPayload(raw, parser) {
   if (parser) {
@@ -9789,7 +9744,7 @@ function getFsSafeLockConfig() {
 
 // node_modules/@openclaw/fs-safe/dist/file-lock-sync.js
 import fs4 from "node:fs";
-import path6 from "node:path";
+import path5 from "node:path";
 
 // node_modules/@openclaw/fs-safe/dist/timing.js
 function sleepSync(ms) {
@@ -9880,26 +9835,26 @@ function canonicalLockParentSync(parent) {
   return process.platform === "win32" ? fs4.realpathSync.native(parent) : fs4.realpathSync(parent);
 }
 function normalizeTargetPath(targetPath) {
-  const resolved = path6.resolve(targetPath);
-  fs4.mkdirSync(path6.dirname(resolved), { recursive: true });
+  const resolved = path5.resolve(targetPath);
+  fs4.mkdirSync(path5.dirname(resolved), { recursive: true });
   try {
-    return path6.join(canonicalLockParentSync(path6.dirname(resolved)), path6.basename(resolved));
+    return path5.join(canonicalLockParentSync(path5.dirname(resolved)), path5.basename(resolved));
   } catch {
     return resolved;
   }
 }
 function boundedLockPath(lockPath, lockRoot) {
-  const resolved = path6.resolve(lockPath);
+  const resolved = path5.resolve(lockPath);
   if (!lockRoot)
     return resolved;
   relativeSidecarLockPath(lockRoot, resolved);
-  const parent = path6.dirname(resolved);
+  const parent = path5.dirname(resolved);
   const parentReal = canonicalLockParentSync(parent);
-  const parentRelative = path6.relative(lockRoot.rootReal, parentReal);
-  if (parentRelative === ".." || parentRelative.startsWith(`..${path6.sep}`) || path6.isAbsolute(parentRelative)) {
+  const parentRelative = path5.relative(lockRoot.rootReal, parentReal);
+  if (parentRelative === ".." || parentRelative.startsWith(`..${path5.sep}`) || path5.isAbsolute(parentRelative)) {
     throw new FsSafeError("outside-workspace", "sidecar lock parent is outside lockRoot");
   }
-  return path6.join(parentReal, path6.basename(resolved));
+  return path5.join(parentReal, path5.basename(resolved));
 }
 function defaultShouldReclaim(snapshot, staleMs, nowMs) {
   const createdAtMs = sidecarLockPayloadCreatedAtMs(snapshot.payload);
@@ -10098,10 +10053,306 @@ function acquireFileLockSync(targetPath, options) {
     }
   }
 }
+// packages/workit-core/src/core/package-root.ts
+import { existsSync as existsSync2 } from "node:fs";
+import path6 from "node:path";
+import { fileURLToPath } from "node:url";
+var packageRoot = () => {
+  let dir = path6.dirname(fileURLToPath(import.meta.url));
+  while (true) {
+    const parent = path6.dirname(dir);
+    if (existsSync2(path6.join(dir, "package.json")) || parent === dir)
+      return dir;
+    dir = parent;
+  }
+};
+
 // packages/workit-core/src/core/store-lock.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
+import fs6 from "node:fs";
+import { hostname } from "node:os";
+
+// packages/workit-core/src/store/paths.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
+import { createHash as createHash4 } from "node:crypto";
 import fs5 from "node:fs";
-import { hostname } from "node:os";
+import path7 from "node:path";
+var NOT_A_REPO = /not a git repository \(or any (of the parent directories|parent up to)/u;
+var gitRun = (cwd, args) => {
+  const run = spawnSync2("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: 20000,
+    killSignal: "SIGKILL",
+    windowsHide: true,
+    env: {
+      ...process.env,
+      GIT_TERMINAL_PROMPT: "0",
+      GIT_OPTIONAL_LOCKS: "0",
+      LC_ALL: "C",
+      LANGUAGE: "C"
+    }
+  });
+  const error = run.error;
+  return {
+    ok: run.status === 0,
+    stdout: run.stdout ?? "",
+    stderr: error ? String(error.message) : run.stderr ?? "",
+    missing: error?.code === "ENOENT"
+  };
+};
+var shortHash = (value) => createHash4("sha256").update(value).digest("hex").slice(0, 12);
+var real = (file) => {
+  try {
+    return fs5.realpathSync.native(file);
+  } catch {
+    return file;
+  }
+};
+var DISCOVERY_ENV = [
+  "GIT_DIR",
+  "GIT_COMMON_DIR",
+  "GIT_WORK_TREE",
+  "GIT_CEILING_DIRECTORIES",
+  "GIT_DISCOVERY_ACROSS_FILESYSTEM"
+];
+var isGitDir = (dir) => {
+  try {
+    return fs5.statSync(path7.join(dir, "HEAD")).isFile() && fs5.statSync(path7.join(dir, "objects")).isDirectory() && fs5.statSync(path7.join(dir, "refs")).isDirectory();
+  } catch {
+    return false;
+  }
+};
+var reftableRefs = (common) => {
+  try {
+    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs5.readFileSync(path7.join(common, "config"), "utf8"));
+  } catch {
+    return false;
+  }
+};
+function fastGit(root) {
+  if (DISCOVERY_ENV.some((name) => process.env[name]))
+    return null;
+  let dir = real(root);
+  let device = null;
+  for (;; ) {
+    let stat;
+    try {
+      stat = fs5.statSync(dir);
+    } catch {
+      return null;
+    }
+    if (device !== null && stat.dev !== device)
+      return { kind: "none" };
+    device = stat.dev;
+    const dotGit = path7.join(dir, ".git");
+    let entry = null;
+    try {
+      entry = fs5.statSync(dotGit);
+    } catch {}
+    let gitDir = null;
+    let top = null;
+    if (entry) {
+      top = dir;
+      if (entry.isDirectory())
+        gitDir = dotGit;
+      else if (entry.isFile()) {
+        let text = "";
+        try {
+          text = fs5.readFileSync(dotGit, "utf8");
+        } catch {
+          return null;
+        }
+        const match = /^gitdir: (.+)$/mu.exec(text);
+        if (!match)
+          return null;
+        gitDir = path7.resolve(dir, match[1].trim());
+      } else
+        return null;
+      if (!fs5.existsSync(path7.join(gitDir, "HEAD")))
+        return null;
+    } else if (isGitDir(dir))
+      gitDir = dir;
+    if (gitDir) {
+      let common = gitDir;
+      try {
+        common = path7.resolve(gitDir, fs5.readFileSync(path7.join(gitDir, "commondir"), "utf8").trim());
+      } catch {}
+      if (!fs5.existsSync(path7.join(common, "objects")))
+        return null;
+      return {
+        kind: "repo",
+        common: real(common),
+        gitDir: real(gitDir),
+        top: top === null ? null : real(top),
+        reftable: reftableRefs(common)
+      };
+    }
+    const parent = path7.dirname(dir);
+    if (parent === dir)
+      return { kind: "none" };
+    dir = parent;
+  }
+}
+function resolveStore(root) {
+  root = path7.resolve(root);
+  let directory = false;
+  try {
+    directory = fs5.statSync(root).isDirectory();
+  } catch {}
+  if (!directory)
+    return { dir: path7.join(root, ".workit"), shared: false, top: null };
+  const fast = fastGit(root);
+  if (fast?.kind === "none")
+    return { dir: path7.join(root, ".workit"), shared: false, top: null };
+  if (fast?.kind === "repo")
+    return {
+      dir: path7.join(fast.common, "workit"),
+      shared: true,
+      top: fast.top,
+      git: { gitDir: fast.gitDir, top: fast.top, reftable: fast.reftable }
+    };
+  const run = gitRun(root, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+  const common = run.stdout.trim();
+  if (run.ok && common) {
+    const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
+    return {
+      dir: path7.join(real(path7.resolve(root, common)), "workit"),
+      shared: true,
+      top: top.ok && top.stdout.trim() ? real(top.stdout.trim()) : null
+    };
+  }
+  if (run.missing || !run.ok && NOT_A_REPO.test(run.stderr))
+    return { dir: path7.join(root, ".workit"), shared: false, top: null };
+  return new Error(`cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
+`)[0] || "no output"}); fix the repository (git status should work here)`);
+}
+var rebasingBranch = (gitDir) => {
+  for (const state of ["rebase-merge", "rebase-apply"]) {
+    try {
+      const ref = fs5.readFileSync(path7.join(gitDir, state, "head-name"), "utf8").trim();
+      const match = /^refs\/heads\/(.+)$/u.exec(ref);
+      if (match)
+        return match[1];
+    } catch {}
+  }
+  return null;
+};
+function resolveTaskKey(root, location) {
+  if (!location.shared)
+    return { key: `dir-${shortHash(root)}`, kind: "dir", branch: null };
+  const branchKey = (name) => ({ key: name, kind: "branch", branch: name });
+  if (location.git && !location.git.reftable) {
+    let head = "";
+    try {
+      head = fs5.readFileSync(path7.join(location.git.gitDir, "HEAD"), "utf8").trim();
+    } catch {}
+    const ref = /^ref: refs\/heads\/(.+)$/u.exec(head);
+    if (ref && ref[1] !== ".invalid")
+      return branchKey(ref[1]);
+    if (/^[0-9a-f]{40,64}$/u.test(head)) {
+      const rebasing = rebasingBranch(location.git.gitDir);
+      if (rebasing)
+        return branchKey(rebasing);
+      return {
+        key: `detached-${shortHash(location.git.top ?? location.git.gitDir)}`,
+        kind: "detached",
+        branch: null
+      };
+    }
+  }
+  const branch = gitRun(root, ["symbolic-ref", "-q", "--short", "HEAD"]);
+  const name = branch.ok ? branch.stdout.trim() : "";
+  if (name && name !== ".invalid")
+    return branchKey(name);
+  const gitDir = gitRun(root, ["rev-parse", "--path-format=absolute", "--git-dir"]);
+  if (gitDir.ok && gitDir.stdout.trim()) {
+    const rebasing = rebasingBranch(gitDir.stdout.trim());
+    if (rebasing)
+      return branchKey(rebasing);
+  }
+  const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
+  const worktree = top.ok && top.stdout.trim() ? top.stdout.trim() : root;
+  return { key: `detached-${shortHash(real(worktree))}`, kind: "detached", branch: null };
+}
+function checkoutRootOf(root, location) {
+  const resolved = path7.resolve(root);
+  let canonical = resolved;
+  try {
+    canonical = fs5.realpathSync(resolved);
+  } catch {
+    return resolved;
+  }
+  const found = location ?? resolveStore(canonical);
+  if (found instanceof Error || !found.shared || !found.top)
+    return canonical;
+  if (real(canonical) === found.top)
+    return canonical;
+  try {
+    return fs5.realpathSync(found.top);
+  } catch {
+    return canonical;
+  }
+}
+function branchRenames(location) {
+  if (!location.shared)
+    return [];
+  const files = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = fs5.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries)
+      if (entry.isDirectory())
+        walk(path7.join(dir, entry.name));
+      else
+        files.push(path7.join(dir, entry.name));
+  };
+  walk(path7.join(path7.dirname(location.dir), "logs", "refs", "heads"));
+  if (location.git)
+    files.push(path7.join(location.git.gitDir, "logs", "HEAD"));
+  const seen = new Set;
+  const renames = [];
+  for (const file of files) {
+    let text = "";
+    try {
+      text = fs5.readFileSync(file, "utf8");
+    } catch {
+      continue;
+    }
+    for (const match of text.matchAll(/ (\d+) [+-]\d{4}\tBranch: renamed refs\/heads\/(\S+) to refs\/heads\/(\S+)/gu)) {
+      const rename = { from: match[2], to: match[3], at: Number(match[1]) };
+      const id = `${rename.at}\x00${rename.from}\x00${rename.to}`;
+      if (seen.has(id))
+        continue;
+      seen.add(id);
+      renames.push(rename);
+    }
+  }
+  return renames.toSorted((left, right) => left.at - right.at);
+}
+function followRenames(key, boundAt, renames) {
+  let current = key;
+  let since = Math.floor(Date.parse(boundAt) / 1000);
+  for (const rename of renames)
+    if (rename.from === current && rename.at >= since) {
+      current = rename.to;
+      since = rename.at;
+    }
+  return current;
+}
+var checkoutSlug = (root) => {
+  let canonical = real(root);
+  if (process.platform === "win32")
+    canonical = canonical.toLowerCase();
+  const base = path7.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
+  return `${base}-${shortHash(canonical)}`;
+};
+
+// packages/workit-core/src/core/store-lock.ts
 var metadataLockSchema = object({
   pid: number2().int().nonnegative().safe(),
   processStart: string2().nullable(),
@@ -10133,10 +10384,6 @@ var parseMetadataLockOrNull = (raw) => {
     return null;
   }
 };
-var sameMetadataLock = (left, right) => {
-  const parsed = metadataLockSchema.safeParse(left);
-  return parsed.success && canonicalJson(parsed.data) === canonicalJson(right);
-};
 var parseProcStatStart = (stat) => {
   const close = stat.lastIndexOf(")");
   if (close < 0)
@@ -10146,14 +10393,14 @@ var parseProcStatStart = (stat) => {
 var processStartOf = (pid) => {
   if (process.platform === "linux") {
     try {
-      return parseProcStatStart(fs5.readFileSync(`/proc/${pid}/stat`, "utf8"));
+      return parseProcStatStart(fs6.readFileSync(`/proc/${pid}/stat`, "utf8"));
     } catch {
       return null;
     }
   }
   if (process.platform === "darwin" || process.platform === "freebsd") {
     try {
-      const run = spawnSync2("ps", ["-o", "lstart=", "-p", String(pid)], {
+      const run = spawnSync3("ps", ["-o", "lstart=", "-p", String(pid)], {
         encoding: "utf8",
         timeout: 1000
       });
@@ -10167,7 +10414,7 @@ var processStartOf = (pid) => {
 };
 var readTrimmed = (file) => {
   try {
-    return fs5.readFileSync(file, "utf8").trim() || null;
+    return fs6.readFileSync(file, "utf8").trim() || null;
   } catch {
     return null;
   }
@@ -10178,7 +10425,7 @@ var localLockHost = () => {
     return cachedLockHost;
   let pidns = null;
   try {
-    pidns = /\[(\d+)\]/.exec(fs5.readlinkSync("/proc/self/ns/pid"))?.[1] ?? null;
+    pidns = /\[(\d+)\]/.exec(fs6.readlinkSync("/proc/self/ns/pid"))?.[1] ?? null;
   } catch {}
   const boot = readTrimmed("/proc/sys/kernel/random/boot_id");
   cachedLockHost = pidns || boot ? `${hostname()}#${pidns ?? "?"}:${boot ?? "?"}` : hostname();
@@ -10218,7 +10465,7 @@ var classifyLockOwner = (payload, ageMs, localHost = localLockHost()) => {
 };
 var ageOf = (file, nowMs) => {
   try {
-    return nowMs - fs5.lstatSync(file).mtimeMs;
+    return nowMs - fs6.lstatSync(file).mtimeMs;
   } catch {
     return null;
   }
@@ -10229,117 +10476,151 @@ var clearAbandonedReclaimGuard = (lockPath, nowMs = Date.now()) => {
   if (age === null || age <= RECLAIM_GUARD_TTL_MS)
     return false;
   try {
-    fs5.rmdirSync(guard);
+    fs6.rmdirSync(guard);
     return true;
   } catch {
     return false;
   }
 };
 
-// packages/workit-core/src/core/task-store.ts
-var RECOVERY_COPIES_PER_RECORD = 3;
-var STALE_TEMPORARY_MS = 60 * 60000;
-var RECOVERY_NAME = /^(task|workspace)\.([^.]+)\.([0-9a-f]{64})\.json$/;
-var processEvidenceSchema = object({
-  state: _enum(["stopped", "accounted_for"]),
-  pid: number2().int().nonnegative(),
-  processStart: string2().nullable(),
-  ownerDigest: string2().regex(/^[0-9a-f]{64}$/).nullable()
-}).strict();
-var INDEX_VERSION = 1;
-var hostSession = (value) => isObject2(value) && value.kind === "host" && typeof value.host === "string" && typeof value.handle === "string" ? { host: value.host, handle: value.handle } : null;
-var indexEntry = (task, file) => {
-  const sessions = [];
-  const intent = hostSession(task.intent.provenance.session);
-  if (intent)
-    sessions.push({ ...intent, workerId: null });
-  for (const worker of task.workers) {
-    const session = hostSession(worker.data.session);
-    if (session)
-      sessions.push({ ...session, workerId: worker.id });
+// packages/workit-core/src/store/event-log.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import fs7 from "node:fs";
+import path8 from "node:path";
+var EVENT_VERSION = 1;
+
+class LogDamage extends Error {
+  upgrade;
+  constructor(message, upgrade = false) {
+    super(message);
+    this.upgrade = upgrade;
   }
-  return {
-    id: task.id,
-    revision: task.revision,
-    status: task.status,
-    createdAt: task.createdAt,
-    updatedAt: task.updatedAt,
-    objective: task.intent.data.objective,
-    source: { host: task.intent.provenance.host, kind: task.intent.provenance.kind },
-    progress: { summary: task.progress.summary, nextAction: task.progress.nextAction },
-    sessions,
-    file
-  };
-};
-var fileSignature = (file) => {
+}
+var isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var parseEvent = (line, file, offset) => {
+  let value;
   try {
-    const stat = fs6.statSync(file, { bigint: true });
-    return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
+    value = JSON.parse(line);
   } catch {
-    return null;
-  }
-};
-var RACY_WINDOW_NS = 2000000000n;
-var racySignature = (signature) => {
-  const [mtime = 0n, ctime = 0n] = signature.split(":").slice(3, 5).map(BigInt);
-  const changed = mtime > ctime ? mtime : ctime;
-  return BigInt(Date.now()) * 1000000n - changed < RACY_WINDOW_NS;
+    throw new LogDamage(`${file}: unreadable event at byte ${offset}`);
+  }
+  if (!isObject2(value) || typeof value.v !== "number")
+    throw new LogDamage(`${file}: malformed event at byte ${offset}`);
+  if (value.v > EVENT_VERSION)
+    throw new LogDamage(`${file}: event format v${value.v} was written by a newer Workit; upgrade Workit to read this task`, true);
+  if (typeof value.seq !== "number" || !Number.isInteger(value.seq) || typeof value.type !== "string" || typeof value.id !== "string" || typeof value.task !== "string" || !isObject2(value.data))
+    throw new LogDamage(`${file}: malformed event at byte ${offset}`);
+  return value;
 };
-var now = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
-var cachedRuntimeVersion = null;
-var runtimeVersion = () => {
-  if (cachedRuntimeVersion === null) {
+function readLog(file, from = 0, expectSeq = null) {
+  let fd;
+  try {
+    fd = fs7.openSync(file, "r");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return null;
+    throw error;
+  }
+  let bytes;
+  let size;
+  try {
+    size = fs7.fstatSync(fd).size;
+    if (from > size)
+      throw new LogDamage(`${file}: shorter than its snapshot`);
+    bytes = Buffer.alloc(size - from);
+    let read = 0;
+    while (read < bytes.length) {
+      const got = fs7.readSync(fd, bytes, read, bytes.length - read, from + read);
+      if (got === 0)
+        break;
+      read += got;
+    }
+    bytes = bytes.subarray(0, read);
+    size = from + read;
+  } finally {
+    fs7.closeSync(fd);
+  }
+  const events = [];
+  let start = 0;
+  let lastStart = from;
+  let seq = expectSeq;
+  for (;; ) {
+    const newline = bytes.indexOf(10, start);
+    if (newline < 0)
+      break;
+    const line = bytes.subarray(start, newline).toString("utf8");
+    if (line.trim() !== "") {
+      const event = parseEvent(line, file, from + start);
+      if (seq !== null && event.seq !== seq)
+        throw new LogDamage(`${file}: event seq ${event.seq} where ${seq} was expected`);
+      seq = event.seq + 1;
+      events.push(event);
+      lastStart = from + start;
+    }
+    start = newline + 1;
+  }
+  return { events, end: from + start, lastStart, size };
+}
+var fsyncDirectory = (dir) => {
+  try {
+    const fd = fs7.openSync(dir, "r");
     try {
-      const pkg = JSON.parse(fs6.readFileSync(path7.join(packageRoot(), "package.json"), "utf8"));
-      cachedRuntimeVersion = typeof pkg.version === "string" && pkg.version ? pkg.version : "0.0.0";
-    } catch {
-      cachedRuntimeVersion = "0.0.0";
+      fs7.fsyncSync(fd);
+    } finally {
+      fs7.closeSync(fd);
     }
+  } catch (error) {
+    if (process.platform !== "win32")
+      throw error;
   }
-  return cachedRuntimeVersion;
 };
-var stampNew = (record) => ({
-  createdWith: record.runtime?.createdWith ?? null,
-  updatedWith: runtimeVersion()
-});
-var isNewerVersion = (candidate, current) => {
-  const parts = (value) => value.split("-")[0].split(".").map((item) => Number.parseInt(item, 10) || 0);
-  const [candidateParts, currentParts] = [parts(candidate), parts(current)];
-  for (let index = 0;index < 3; index += 1) {
-    const left = candidateParts[index] ?? 0;
-    const right = currentParts[index] ?? 0;
-    if (left !== right)
-      return left > right;
+function appendEvent(file, event, validEnd) {
+  const line = Buffer.from(`${JSON.stringify(event)}
+`, "utf8");
+  const created = !fs7.existsSync(file);
+  if (!created && fs7.statSync(file).size !== validEnd) {
+    const cut = fs7.openSync(file, "r+");
+    try {
+      fs7.ftruncateSync(cut, validEnd);
+      fs7.fsyncSync(cut);
+    } finally {
+      fs7.closeSync(cut);
+    }
   }
-  return false;
-};
-var jsonBytes = (value) => `${canonicalJson(value)}
-`;
-var digestBytes = (value) => createHash4("sha256").update(value).digest("hex");
-var isObject2 = (value) => typeof value === "object" && value !== null;
-var validId = (value) => /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(value);
-var validDigest = (value) => /^[0-9a-f]{64}$/.test(value);
-var sameDirectoryIdentity = (left, right) => {
-  if (!path7.isAbsolute(left) || !path7.isAbsolute(right))
-    return false;
-  const normalizedLeft = path7.resolve(left);
-  const normalizedRight = path7.resolve(right);
+  const fd = fs7.openSync(file, "a", 384);
   try {
-    const a = fs6.statSync(normalizedLeft, { bigint: true });
-    const b = fs6.statSync(normalizedRight, { bigint: true });
-    if (!a.isDirectory() || !b.isDirectory())
-      return false;
-    if (process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight)
-      return true;
-    const canonicalLeft = fs6.realpathSync(normalizedLeft);
-    const canonicalRight = fs6.realpathSync(normalizedRight);
-    if (process.platform === "win32" ? canonicalLeft.toLowerCase() === canonicalRight.toLowerCase() : canonicalLeft === canonicalRight)
-      return true;
-    return a.dev === b.dev && a.ino !== 0n && a.ino === b.ino;
-  } catch {
-    return false;
+    let written = 0;
+    while (written < line.length)
+      written += fs7.writeSync(fd, line, written, line.length - written);
+    fs7.fsyncSync(fd);
+  } finally {
+    fs7.closeSync(fd);
   }
-};
+  if (created)
+    fsyncDirectory(path8.dirname(file));
+  return validEnd;
+}
+function replaceFile(file, bytes, durable) {
+  const temporary = `${file}.${process.pid}.${randomUUID2()}.tmp`;
+  try {
+    const fd = fs7.openSync(temporary, "wx", 384);
+    try {
+      fs7.writeSync(fd, bytes);
+      if (durable)
+        fs7.fsyncSync(fd);
+    } finally {
+      fs7.closeSync(fd);
+    }
+    renameWithRetry(temporary, file);
+    if (durable)
+      fsyncDirectory(path8.dirname(file));
+  } catch (error) {
+    try {
+      fs7.unlinkSync(temporary);
+    } catch {}
+    throw error;
+  }
+}
 var TRANSIENT_WINDOWS_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
 var isTransientWindowsError = (error) => {
   if (process.platform !== "win32")
@@ -10360,138 +10641,596 @@ var retryTransient = (run) => {
     }
   }
 };
+var renameWithRetry = (from, to) => retryTransient(() => fs7.renameSync(from, to));
+
+// packages/workit-core/src/store/patch.ts
+var isPlainObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var equal = (left, right) => {
+  if (left === right)
+    return true;
+  if (typeof left !== "object" || typeof right !== "object" || left === null || right === null)
+    return false;
+  if (Array.isArray(left) !== Array.isArray(right))
+    return false;
+  if (Array.isArray(left)) {
+    const other = right;
+    return left.length === other.length && left.every((item, index) => equal(item, other[index]));
+  }
+  const leftKeys = Object.keys(left).filter((key) => left[key] !== undefined);
+  const rightKeys = Object.keys(right).filter((key) => right[key] !== undefined);
+  return leftKeys.length === rightKeys.length && leftKeys.every((key) => equal(left[key], right[key]));
+};
+function diff(before, after, path = []) {
+  if (equal(before, after))
+    return [];
+  if (isPlainObject2(before) && isPlainObject2(after)) {
+    const ops = [];
+    for (const key of Object.keys(before))
+      if (before[key] !== undefined && after[key] === undefined)
+        ops.push({ op: "del", path: [...path, key] });
+    for (const key of Object.keys(after)) {
+      if (after[key] === undefined)
+        continue;
+      if (before[key] === undefined)
+        ops.push({ op: "set", path: [...path, key], value: after[key] });
+      else
+        ops.push(...diff(before[key], after[key], [...path, key]));
+    }
+    return ops;
+  }
+  if (Array.isArray(before) && Array.isArray(after)) {
+    const ops = [];
+    if (after.length < before.length)
+      ops.push({ op: "cut", path, length: after.length });
+    const shared = Math.min(before.length, after.length);
+    let changed = 0;
+    for (let index = 0;index < shared; index += 1)
+      if (!equal(before[index], after[index]))
+        changed += 1;
+    if (shared > 0 && changed > shared / 2 && changed > 4)
+      return [{ op: "set", path, value: after }];
+    for (let index = 0;index < shared; index += 1)
+      ops.push(...diff(before[index], after[index], [...path, index]));
+    if (after.length > before.length)
+      ops.push({ op: "push", path, values: after.slice(before.length) });
+    return ops;
+  }
+  return [{ op: "set", path, value: after }];
+}
+var clone2 = (value) => structuredClone(value);
+function apply(target, ops) {
+  let root = target;
+  for (const op of ops) {
+    if (op.path.length === 0) {
+      if (op.op === "set")
+        root = clone2(op.value);
+      else if (op.op === "push" && Array.isArray(root))
+        root.push(...clone2(op.values));
+      else if (op.op === "cut" && Array.isArray(root))
+        root.length = op.length;
+      else
+        throw new Error(`patch: ${op.op} at the root is invalid`);
+      continue;
+    }
+    let parent = root;
+    for (const key of op.path.slice(0, -1)) {
+      if (typeof parent !== "object" || parent === null)
+        throw new Error(`patch: missing path ${op.path.join(".")}`);
+      parent = parent[key];
+    }
+    if (typeof parent !== "object" || parent === null)
+      throw new Error(`patch: missing path ${op.path.join(".")}`);
+    const key = op.path.at(-1);
+    const container = parent;
+    if (op.op === "set")
+      container[key] = clone2(op.value);
+    else if (op.op === "del")
+      delete container[key];
+    else {
+      const array = container[key];
+      if (!Array.isArray(array))
+        throw new Error(`patch: ${op.path.join(".")} is not an array`);
+      if (op.op === "push")
+        array.push(...clone2(op.values));
+      else
+        array.length = op.length;
+    }
+  }
+  return root;
+}
+var isPath = (value) => Array.isArray(value) && value.every((key) => typeof key === "string" || typeof key === "number" && Number.isInteger(key) && key >= 0);
+var isPatch = (value) => Array.isArray(value) && value.every((op) => {
+  if (!isPlainObject2(op) || !isPath(op.path))
+    return false;
+  if (op.op === "set")
+    return "value" in op;
+  if (op.op === "del")
+    return op.path.length > 0;
+  if (op.op === "push")
+    return Array.isArray(op.values);
+  if (op.op === "cut")
+    return typeof op.length === "number" && Number.isInteger(op.length) && op.length >= 0;
+  return false;
+});
+
+// packages/workit-core/src/store/reduce.ts
+import { createHash as createHash5 } from "node:crypto";
+var OPENING_TYPES = new Set([
+  "task.opened",
+  "task.imported",
+  "migrated.from_v2",
+  "task.checkpoint"
+]);
+var KNOWN_TYPES = new Set([
+  ...OPENING_TYPES,
+  "task.bound",
+  "task.noted",
+  "task.revised",
+  "task.judged",
+  "task.paused",
+  "task.resumed",
+  "task.closed",
+  "task.updated",
+  "check.ran",
+  "evidence.recorded",
+  "finding.recorded",
+  "finding.updated",
+  "decision.recorded",
+  "decision.updated",
+  "worker.updated"
+]);
+var isObject3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isKey = (value) => isObject3(value) && typeof value.key === "string" && (value.kind === "branch" || value.kind === "detached" || value.kind === "dir") && (value.branch === null || typeof value.branch === "string");
+var BLOB_REF = "$blob";
+var blobRef = (value) => isObject3(value) && Object.keys(value).length === 1 && typeof value[BLOB_REF] === "string" && /^[0-9a-f]{64}$/.test(value[BLOB_REF]) ? value[BLOB_REF] : null;
+var blobDigest = (value) => createHash5("sha256").update(JSON.stringify(value)).digest("hex");
+var toBlob = (value, blobs) => {
+  if (!isObject3(value))
+    return value;
+  const digest = blobDigest(value);
+  blobs.write(digest, value);
+  return { [BLOB_REF]: digest };
+};
+var encodeRecord = (record, blobs) => Array.isArray(record.candidates) ? { ...record, candidates: record.candidates.map((item) => toBlob(item, blobs)) } : record;
+var encodeOps = (ops, blobs) => ops.map((op) => {
+  if (op.path[0] !== "candidates")
+    return op;
+  if (op.op === "push" && op.path.length === 1)
+    return { ...op, values: op.values.map((item) => toBlob(item, blobs)) };
+  if (op.op === "set" && op.path.length === 1 && Array.isArray(op.value))
+    return { ...op, value: op.value.map((item) => toBlob(item, blobs)) };
+  if (op.op === "set" && op.path.length === 2)
+    return { ...op, value: toBlob(op.value, blobs) };
+  return op;
+});
+var decode2 = (value, blobs) => {
+  const digest = blobRef(value);
+  if (digest)
+    return blobs.read(digest);
+  if (Array.isArray(value))
+    return value.map((item) => decode2(item, blobs));
+  if (isObject3(value)) {
+    const out = {};
+    for (const [key, item] of Object.entries(value))
+      out[key] = decode2(item, blobs);
+    return out;
+  }
+  return value;
+};
+function reduce(state, event, blobs) {
+  const data = event.data;
+  const known = KNOWN_TYPES.has(event.type);
+  const carries = "record" in data || "ops" in data || "key" in data;
+  if (!known && !carries) {
+    if (event.critical === true)
+      throw new LogDamage(`event ${event.type} was written by a newer Workit and must be understood; upgrade Workit to read this task`, true);
+    return state;
+  }
+  let next = state;
+  if ("record" in data) {
+    if (!isObject3(data.record))
+      throw new LogDamage(`event ${event.seq} carries a malformed record`);
+    next = {
+      record: decode2(data.record, blobs),
+      key: null,
+      legacy: null
+    };
+  } else if (next === null) {
+    throw new LogDamage(`the log does not start with an opening event (found ${event.type})`);
+  } else
+    next = { ...next };
+  if ("ops" in data) {
+    if (!isPatch(data.ops))
+      throw new LogDamage(`event ${event.seq} carries a malformed patch`);
+    try {
+      next.record = apply(next.record, decode2(data.ops, blobs));
+    } catch (error) {
+      throw new LogDamage(`event ${event.seq} does not apply: ${String(error)}`);
+    }
+  }
+  if ("key" in data)
+    next.key = isKey(data.key) ? data.key : null;
+  if ("legacy" in data && isObject3(data.legacy))
+    next.legacy = {
+      path: String(data.legacy.path ?? ""),
+      digest: String(data.legacy.digest ?? "")
+    };
+  return next;
+}
+function eventType(before, after) {
+  const count = (value) => Array.isArray(value) ? value.length : 0;
+  if (before.status !== after.status)
+    return after.status === "closed" ? "task.closed" : after.status === "paused" ? "task.paused" : "task.resumed";
+  if (count(after.evidence) > count(before.evidence)) {
+    const last = after.evidence.at(-1);
+    return last?.data?.observation ? "check.ran" : "evidence.recorded";
+  }
+  if (count(after.findings) > count(before.findings))
+    return "finding.recorded";
+  if (count(after.decisions) > count(before.decisions))
+    return "decision.recorded";
+  if (JSON.stringify(before.findings) !== JSON.stringify(after.findings))
+    return "finding.updated";
+  if (JSON.stringify(before.decisions) !== JSON.stringify(after.decisions))
+    return "decision.updated";
+  if (JSON.stringify(before.workers) !== JSON.stringify(after.workers))
+    return "worker.updated";
+  if (JSON.stringify(before.intent) !== JSON.stringify(after.intent))
+    return "task.revised";
+  if (JSON.stringify(before.assessments) !== JSON.stringify(after.assessments) || JSON.stringify(before.policy) !== JSON.stringify(after.policy))
+    return "task.judged";
+  if (JSON.stringify(before.progress) !== JSON.stringify(after.progress))
+    return "task.noted";
+  return "task.updated";
+}
+
+// packages/workit-core/src/store/notes.ts
+var SLOT = Symbol.for("workit.migrationReporter");
+var reportMigration = (report) => {
+  try {
+    const reporter = globalThis[SLOT];
+    if (typeof reporter === "function")
+      reporter(report);
+  } catch {}
+};
+var migrationReporterInstalled = () => typeof globalThis[SLOT] === "function";
+
+// packages/workit-core/src/core/task-store.ts
+var MIGRATION_PENDING = "workit migration pending";
+var STORE_FORMAT = 3;
+var STORE_MIN_RUNTIME = "3.0.0";
+var SNAPSHOT_EVERY = 32;
+var COMPACT_ABOVE = 200;
+var COMPACT_KEEP = 50;
+var AUTO_COMPACT_BYTES = 2 * 1024 * 1024;
+var TOMBSTONE = Symbol("tombstone");
+var STALE_TEMPORARY_MS = 60 * 60000;
+var INDEX_VERSION = 3;
+var isObject4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var hostSession = (value) => isObject4(value) && value.kind === "host" && typeof value.host === "string" && typeof value.handle === "string" ? { host: value.host, handle: value.handle } : null;
+var indexEntry = (task, key, legacy, file) => {
+  const sessions = [];
+  const intent = hostSession(task.intent.provenance.session);
+  if (intent)
+    sessions.push({ ...intent, workerId: null });
+  for (const worker of task.workers) {
+    const session = hostSession(worker.data.session);
+    if (session)
+      sessions.push({ ...session, workerId: worker.id });
+  }
+  return {
+    id: task.id,
+    revision: task.revision,
+    status: task.status,
+    createdAt: task.createdAt,
+    updatedAt: task.updatedAt,
+    objective: task.intent.data.objective,
+    source: { host: task.intent.provenance.host, kind: task.intent.provenance.kind },
+    progress: { summary: task.progress.summary, nextAction: task.progress.nextAction },
+    sessions,
+    workspaceId: task.workspaceId,
+    key: key?.key ?? null,
+    branch: key?.branch ?? null,
+    boundAt: key?.boundAt ?? null,
+    legacy,
+    file
+  };
+};
+var fileSignature = (file) => {
+  try {
+    const stat = fs8.statSync(file, { bigint: true });
+    return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
+  } catch {
+    return null;
+  }
+};
+var RACY_WINDOW_NS = 2000000000n;
+var racySignature = (signature) => {
+  const [mtime = 0n, ctime = 0n] = signature.split(":").slice(3, 5).map(BigInt);
+  const changed = mtime > ctime ? mtime : ctime;
+  return BigInt(Date.now()) * 1000000n - changed < RACY_WINDOW_NS;
+};
+var now = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+var oldestFirst = (left, right) => left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id);
+var cachedRuntimeVersion = null;
+var runtimeVersion = () => {
+  if (cachedRuntimeVersion === null) {
+    try {
+      const pkg = JSON.parse(fs8.readFileSync(path9.join(packageRoot(), "package.json"), "utf8"));
+      cachedRuntimeVersion = typeof pkg.version === "string" && pkg.version ? pkg.version : "0.0.0";
+    } catch {
+      cachedRuntimeVersion = "0.0.0";
+    }
+  }
+  return cachedRuntimeVersion;
+};
+var stampNew = (record) => ({
+  createdWith: record.runtime?.createdWith ?? null,
+  updatedWith: runtimeVersion()
+});
+var isNewerVersion = (candidate, current) => {
+  const parts = (value) => value.split("-")[0].split(".").map((item) => Number.parseInt(item, 10) || 0);
+  const [candidateParts, currentParts] = [parts(candidate), parts(current)];
+  for (let index = 0;index < 3; index += 1) {
+    const left = candidateParts[index] ?? 0;
+    const right = currentParts[index] ?? 0;
+    if (left !== right)
+      return left > right;
+  }
+  return false;
+};
+var validId = (value) => /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(value);
+var sameDirectoryIdentity = (left, right) => {
+  if (!path9.isAbsolute(left) || !path9.isAbsolute(right))
+    return false;
+  const normalizedLeft = path9.resolve(left);
+  const normalizedRight = path9.resolve(right);
+  try {
+    const a = fs8.statSync(normalizedLeft, { bigint: true });
+    const b = fs8.statSync(normalizedRight, { bigint: true });
+    if (!a.isDirectory() || !b.isDirectory())
+      return false;
+    if (process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight)
+      return true;
+    const canonicalLeft = fs8.realpathSync(normalizedLeft);
+    const canonicalRight = fs8.realpathSync(normalizedRight);
+    if (process.platform === "win32" ? canonicalLeft.toLowerCase() === canonicalRight.toLowerCase() : canonicalLeft === canonicalRight)
+      return true;
+    return a.dev === b.dev && a.ino !== 0n && a.ino === b.ino;
+  } catch {
+    return false;
+  }
+};
 var externalActionLockRoots = new AsyncLocalStorage;
 var heldInProcess = new Map;
-var holdRoot = (root) => heldInProcess.set(root, (heldInProcess.get(root) ?? 0) + 1);
-var dropRoot = (root) => {
-  const count = (heldInProcess.get(root) ?? 1) - 1;
+var hold = (lock) => heldInProcess.set(lock, (heldInProcess.get(lock) ?? 0) + 1);
+var drop = (lock) => {
+  const count = (heldInProcess.get(lock) ?? 1) - 1;
   if (count > 0)
-    heldInProcess.set(root, count);
+    heldInProcess.set(lock, count);
   else
-    heldInProcess.delete(root);
+    heldInProcess.delete(lock);
 };
-var dedupeCandidates = (candidates) => {
-  const last = new Map(candidates.map((candidate, index) => [candidate.id, index]));
-  return candidates.filter((candidate, index) => last.get(candidate.id) === index);
+var envActor = () => {
+  const value = (key) => process.env[key]?.trim() || null;
+  return {
+    host: value("WORKIT_HOST") ?? "runtime",
+    session: value("WORKIT_SESSION_ID"),
+    agentId: value("WORKIT_AGENT_ID")
+  };
 };
 
 class TaskStore {
   root;
+  origin;
   lockTimeoutMs;
+  actor;
+  migrateOnRead;
+  located;
+  migrationChecked = false;
+  compactDue = new Set;
   constructor(root, options = {}) {
-    this.root = fs6.existsSync(root) ? fs6.realpathSync(root) : path7.resolve(root);
+    const resolved = path9.resolve(root);
+    this.origin = fs8.existsSync(resolved) ? fs8.realpathSync(resolved) : resolved;
+    this.located = resolveStore(this.origin);
+    this.root = checkoutRootOf(this.origin, this.located);
     this.lockTimeoutMs = options.lockTimeoutMs ?? defaultLockTimeout();
+    this.actor = options.actor ?? envActor();
+    this.migrateOnRead = options.migrateOnRead;
+  }
+  location() {
+    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs8.existsSync(path9.join(this.root, ".git"))) {
+      this.located = undefined;
+      this.migrationChecked = false;
+    }
+    if (this.located === undefined)
+      this.located = resolveStore(this.root);
+    return this.located instanceof Error ? failure2("storage_error", this.located.message, { path: this.root }) : success(null, null, this.located);
+  }
+  currentKey() {
+    const location = this.location();
+    if (!location.ok)
+      return location;
+    return success(null, null, resolveTaskKey(this.root, location.data));
   }
   readTask(taskId) {
     if (!validId(taskId))
       return failure2("invalid_input", "task ID is invalid", { taskId });
-    const result = this.readRecord(path7.join(this.tasksDir, `${taskId}.json`), taskRecordSchema);
-    if (!result.exists)
+    const ready = this.ready();
+    if (!ready.ok)
+      return ready;
+    const loaded = this.load(taskId);
+    if (!loaded.ok)
+      return loaded;
+    if (!loaded.data)
       return failure2("not_found", "task not found", { taskId });
-    if (result.result.ok && result.result.data.id !== taskId)
-      return failure2("recovery_required", "task filename and record ID differ", { taskId });
-    if (result.result.ok) {
-      const workspace = this.readWorkspace();
-      if (!workspace.ok)
-        return workspace;
-      if (!workspace.data || result.result.data.workspaceId !== workspace.data.id)
-        return failure2("recovery_required", "task workspace binding is invalid", { taskId });
-    }
-    return result.result;
-  }
-  listTasks() {
-    if (!fs6.existsSync(this.tasksDir))
-      return success(null, null, []);
-    let names;
-    try {
-      names = fs6.readdirSync(this.tasksDir).filter((name) => name.endsWith(".json"));
-    } catch (error) {
-      return failure2("storage_error", `unable to list tasks: ${String(error)}`, {
-        path: this.tasksDir
-      });
-    }
     const workspace = this.readWorkspace();
     if (!workspace.ok)
       return workspace;
-    if (!workspace.data)
-      return failure2("recovery_required", "task workspace binding is invalid", {
-        path: this.workspacePath
-      });
+    const bound = this.bindingError(loaded.data.record, workspace.data);
+    return bound ?? success(null, null, loaded.data.record);
+  }
+  listTasks() {
+    const listed = this.listTaskIndex();
+    if (!listed.ok)
+      return listed;
     const tasks = [];
-    for (const name of names.toSorted()) {
-      const item = this.readRecord(path7.join(this.tasksDir, name), taskRecordSchema);
-      if (!item.exists)
-        continue;
-      if (!item.result.ok)
-        return item.result;
-      if (!validId(name.slice(0, -5)) || item.result.data.id !== name.slice(0, -5))
-        return failure2("recovery_required", "task filename and record ID differ", { path: name });
-      if (item.result.data.workspaceId !== workspace.data.id)
-        return failure2("recovery_required", "task workspace binding is invalid", { path: name });
-      tasks.push(item.result.data);
+    for (const entry of listed.data.toSorted((left, right) => left.id.localeCompare(right.id))) {
+      const loaded = this.load(entry.id);
+      if (!loaded.ok)
+        return loaded;
+      if (loaded.data)
+        tasks.push(loaded.data.record);
     }
     return success(null, null, tasks);
   }
   listTaskIndex() {
-    if (!fs6.existsSync(this.tasksDir))
+    const all = this.listStoreIndex();
+    if (!all.ok)
+      return all;
+    const workspace = this.readWorkspace();
+    if (!workspace.ok)
+      return workspace;
+    if (!workspace.data)
       return success(null, null, []);
+    const id = workspace.data.id;
+    return success(null, null, all.data.filter((entry) => entry.workspaceId === id));
+  }
+  listStoreIndex() {
+    const ready = this.ready();
+    if (!ready.ok)
+      return ready;
+    const tasksDir = this.paths().tasks;
     let names;
     try {
-      names = fs6.readdirSync(this.tasksDir).filter((name) => name.endsWith(".json"));
+      names = fs8.existsSync(tasksDir) ? fs8.readdirSync(tasksDir).filter((name) => validId(name)) : [];
     } catch (error) {
       return failure2("storage_error", `unable to list tasks: ${String(error)}`, {
-        path: this.tasksDir
+        path: tasksDir
       });
     }
-    const workspace = this.readWorkspace();
-    if (!workspace.ok)
-      return workspace;
-    if (!workspace.data)
-      return failure2("recovery_required", "task workspace binding is invalid", {
-        path: this.workspacePath
-      });
-    const stored = this.readIndex(workspace.data.id);
+    const stored = this.readIndex();
     const entries = [];
     let changed = Object.keys(stored).length !== names.length;
     for (const name of names.toSorted()) {
-      const file = path7.join(this.tasksDir, name);
-      const signature = fileSignature(file);
+      const signature = fileSignature(this.eventsPath(name));
       if (signature === null) {
         changed = true;
         continue;
       }
-      const cached = stored[name.slice(0, -5)];
+      const cached = stored[name];
       if (cached && cached.file === signature && !racySignature(signature)) {
         entries.push(cached);
         continue;
       }
-      const item = this.readRecord(file, taskRecordSchema);
-      if (!item.exists)
+      const loaded = this.load(name);
+      if (!loaded.ok)
+        return loaded;
+      if (!loaded.data)
         continue;
-      if (!item.result.ok)
-        return item.result;
-      if (!validId(name.slice(0, -5)) || item.result.data.id !== name.slice(0, -5))
-        return failure2("recovery_required", "task filename and record ID differ", { path: name });
-      if (item.result.data.workspaceId !== workspace.data.id)
-        return failure2("recovery_required", "task workspace binding is invalid", { path: name });
-      const entry = indexEntry(item.result.data, signature);
+      const entry = indexEntry(loaded.data.record, loaded.data.key, loaded.data.legacy !== null, signature);
       if (!cached || canonicalJson(cached) !== canonicalJson(entry))
         changed = true;
       entries.push(entry);
     }
     if (changed)
-      this.writeIndex(workspace.data.id, entries);
+      this.writeIndex(entries);
     return success(null, null, entries);
   }
   readWorkspace() {
-    const item = this.readRecord(this.workspacePath, workspaceRecordSchema);
-    if (!item.exists)
-      return success(null, null, null);
-    if (item.result.ok && item.result.data.root !== this.root && !sameDirectoryIdentity(item.result.data.root, this.root))
-      return failure2("recovery_required", "workspace root binding is invalid", {
-        path: this.workspacePath
+    const ready = this.ready();
+    if (!ready.ok)
+      return ready;
+    const file = this.paths().workspace;
+    let bytes;
+    try {
+      bytes = retryTransient(() => fs8.readFileSync(file, "utf8"));
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return success(null, null, null);
+      return failure2("recovery_required", `workspace record cannot be read: ${String(error)}`, {
+        path: file
       });
-    return item.result;
+    }
+    const parsed = this.parseRecord(bytes, workspaceRecordSchema, "workspace");
+    if (!parsed.ok)
+      return parsed;
+    if (parsed.data.root !== this.root && !sameDirectoryIdentity(parsed.data.root, this.root))
+      return failure2("recovery_required", "workspace root binding is invalid", { path: file });
+    return parsed;
+  }
+  implicitTask(input) {
+    const ready = this.ready(input.create !== false);
+    if (!ready.ok)
+      return ready;
+    const key = this.currentKey();
+    if (!key.ok)
+      return key;
+    const found = this.openTaskForKey(key.data.key);
+    if (!found.ok)
+      return found;
+    const workspace = this.readWorkspace();
+    if (!workspace.ok)
+      return workspace;
+    if (found.data && workspace.data && found.data.workspaceId === workspace.data.id && (found.data.key === key.data.key || input.create === false)) {
+      const task = this.readTask(found.data.id);
+      return task.ok ? success(task.revision, null, { task: task.data, created: false, key: key.data }) : task;
+    }
+    if (input.create === false) {
+      if (!found.data)
+        return success(null, null, null);
+      const loaded = this.load(found.data.id);
+      if (!loaded.ok)
+        return loaded;
+      return loaded.data ? success(null, null, { task: loaded.data.record, created: false, key: key.data }) : success(null, null, null);
+    }
+    return this.withLock(this.paths().checkoutLock, () => this.withKeyLock(key.data.key, () => this.implicitLocked(input, key.data)));
+  }
+  implicitLocked(input, key) {
+    {
+      const again = this.openTaskForKey(key.key);
+      if (!again.ok)
+        return again;
+      if (again.data) {
+        const moved = this.bindLocked(again.data.id, key, input.now);
+        return moved.ok ? success(moved.data.revision, null, { task: moved.data, created: false, key }) : moved;
+      }
+      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path9.basename(this.root) || this.root;
+      const intent = {
+        objective: input.objective?.trim() || `Work on ${label}`,
+        scope: { description: `the checkout (${label})`, paths: ["."], exclusions: [] },
+        authorityRefs: []
+      };
+      const created = this.createLocked({ intent, provenance: input.provenance, expectedWorkspaceRevision: null, now: input.now }, false, key, false);
+      return created.ok ? success(created.data.revision, null, { task: created.data, created: true, key }) : created;
+    }
+  }
+  adoptTask(taskId) {
+    if (!validId(taskId))
+      return failure2("invalid_input", "task ID is invalid", { taskId });
+    const ready = this.ready(true);
+    if (!ready.ok)
+      return ready;
+    const key = this.currentKey();
+    if (!key.ok)
+      return key;
+    return this.withLock(this.paths().checkoutLock, () => this.withKeyLock(key.data.key, () => {
+      const holder = this.openTaskForKey(key.data.key);
+      if (!holder.ok)
+        return holder;
+      if (holder.data && holder.data.id !== taskId)
+        return failure2("invalid_transition", `${key.data.key} already has open task ${holder.data.id}; close it (\`workit task close\`) before adopting another`, { taskId: holder.data.id });
+      return this.bindLocked(taskId, key.data);
+    }));
+  }
+  keyReport() {
+    const key = this.currentKey();
+    if (!key.ok)
+      return key;
+    const bound = this.openTasksForKey(key.data.key);
+    if (!bound.ok)
+      return bound;
+    return success(null, null, { key: key.data, bound: bound.data });
   }
   create(input, provenance, expectedWorkspaceRevision) {
     const value = "intent" in input ? input : {
@@ -10499,82 +11238,16 @@ class TaskStore {
       provenance,
       expectedWorkspaceRevision: expectedWorkspaceRevision ?? null
     };
-    return this.withLock(() => {
-      const current = this.readWorkspace();
-      if (!current.ok)
-        return current;
-      if (current.data ? value.expectedWorkspaceRevision !== current.data.revision : value.expectedWorkspaceRevision !== null) {
-        return failure2("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", {
-          expectedWorkspaceRevision: value.expectedWorkspaceRevision,
-          actualWorkspaceRevision: current.data?.revision ?? null
-        });
-      }
-      if (!value.provenance)
-        return failure2("invalid_input", "provenance is required");
-      if (!intentSchema.safeParse(value.intent).success || !provenanceSchema.safeParse(value.provenance).success)
-        return failure2("invalid_input", "task intent or provenance is invalid");
-      const previousWorkspaceBytes = current.data ? this.snapshotBytes(this.workspacePath) : null;
-      if (current.data && !previousWorkspaceBytes)
-        return failure2("storage_error", "workspace snapshot disappeared during creation");
-      const workspace = current.data ? {
-        ...current.data,
-        revision: newRevision(),
-        root: this.root,
-        runtime: stampNew(current.data)
-      } : {
-        schemaVersion: SCHEMA_VERSION,
-        id: newId(),
-        revision: newRevision(),
-        root: this.root,
-        runtime: { createdWith: runtimeVersion(), updatedWith: runtimeVersion() },
-        writer: null
-      };
-      const timestamp = value.now ?? now();
-      const task = {
-        schemaVersion: SCHEMA_VERSION,
-        id: newId(),
-        workspaceId: workspace.id,
-        revision: newRevision(),
-        createdAt: timestamp,
-        updatedAt: timestamp,
-        origin: null,
-        intent: {
-          id: newId(),
-          recordedAt: timestamp,
-          provenance: value.provenance,
-          data: value.intent
-        },
-        constraints: [],
-        status: "active",
-        closure: null,
-        progress: { summary: "", nextAction: null, blockers: [] },
-        runtime: { createdWith: runtimeVersion(), updatedWith: runtimeVersion() },
-        assessments: [],
-        policy: null,
-        policyChanges: [],
-        candidates: [],
-        evidence: [],
-        decisions: [],
-        findings: [],
-        workers: []
-      };
-      const writtenWorkspace = this.replaceSnapshot(this.workspacePath, workspace, previousWorkspaceBytes);
-      if (!writtenWorkspace.ok)
-        return writtenWorkspace;
-      const writtenTask = this.replaceSnapshot(this.taskPath(task.id), task, null);
-      if (!writtenTask.ok) {
-        if (current.data && previousWorkspaceBytes) {
-          const restored = this.replaceSnapshot(this.workspacePath, current.data, this.snapshotBytes(this.workspacePath));
-          if (!restored.ok)
-            return failure2("external_outcome_unknown", "task creation failed and workspace restoration is uncertain", { operation: "create", outcome: "unknown" });
-        }
-        return failure2("external_outcome_unknown", "workspace created but task write is uncertain", { operation: "create", outcome: "unknown" });
-      }
-      return success(task.revision, workspace.revision, task);
-    });
+    const ready = this.ready(true);
+    if (!ready.ok)
+      return ready;
+    return this.withLock(this.paths().checkoutLock, () => this.createLocked(value, true, null));
   }
   importTask(input) {
-    return this.withLock(() => {
+    const ready = this.ready(true);
+    if (!ready.ok)
+      return ready;
+    return this.withLock(this.paths().checkoutLock, () => {
       const current = this.readWorkspace();
       if (!current.ok)
         return current;
@@ -10606,23 +11279,8 @@ class TaskStore {
           expectedWorkspaceRevision: input.expectedWorkspaceRevision,
           actualWorkspaceRevision: current.data?.revision ?? null
         });
-      const previousWorkspaceBytes = current.data ? this.snapshotBytes(this.workspacePath) : null;
-      if (current.data && !previousWorkspaceBytes)
-        return failure2("storage_error", "workspace snapshot disappeared during import");
       const timestamp = input.now ?? now();
-      const workspace = current.data ? {
-        ...current.data,
-        revision: newRevision(),
-        root: this.root,
-        runtime: stampNew(current.data)
-      } : {
-        schemaVersion: SCHEMA_VERSION,
-        id: input.workspaceId ?? newId(),
-        revision: newRevision(),
-        root: this.root,
-        runtime: { createdWith: runtimeVersion(), updatedWith: runtimeVersion() },
-        writer: null
-      };
+      const workspace = this.nextWorkspace(current.data, input.workspaceId);
       const task = {
         ...input.task,
         workspaceId: workspace.id,
@@ -10637,62 +11295,46 @@ class TaskStore {
       const validTask = taskRecordSchema.safeParse(task);
       if (!validTask.success)
         return failure2("invalid_input", "imported task does not satisfy its schema");
-      const writtenWorkspace = this.replaceSnapshot(this.workspacePath, workspace, previousWorkspaceBytes);
-      if (!writtenWorkspace.ok)
-        return writtenWorkspace;
-      const writtenTask = this.replaceSnapshot(this.taskPath(task.id), validTask.data, null);
-      if (!writtenTask.ok) {
-        if (current.data && previousWorkspaceBytes) {
-          const restored = this.replaceSnapshot(this.workspacePath, current.data, this.snapshotBytes(this.workspacePath));
-          if (!restored.ok)
-            return failure2("external_outcome_unknown", "import failed and workspace restoration is uncertain", { operation: "import", outcome: "unknown" });
-        }
-        return failure2("external_outcome_unknown", `workspace created but task import is uncertain: ${writtenTask.error}`, {
-          operation: "import",
-          outcome: "unknown",
-          path: writtenTask.details.path
-        });
-      }
-      return success(validTask.data.revision, workspace.revision, validTask.data);
+      return this.writeNewTask(current.data, workspace, validTask.data, "task.imported", null, {
+        operation: "import"
+      });
     });
   }
   mutateTask(taskId, expected, update, timestamp) {
-    return this.withLock(() => {
-      const current = this.readTask(taskId);
-      if (!current.ok)
-        return current;
-      if (current.data.revision !== expected)
-        return this.conflict(expected, current.data.revision);
-      const previousBytes = this.snapshotBytes(this.taskPath(taskId));
-      if (!previousBytes)
-        return failure2("storage_error", "task snapshot disappeared during mutation");
+    if (!validId(taskId))
+      return failure2("invalid_input", "task ID is invalid", { taskId });
+    const ready = this.ready(true);
+    if (!ready.ok)
+      return ready;
+    const result = this.withLock(this.taskLockPath(taskId), () => {
+      const loaded = this.loadBound(taskId);
+      if (!loaded.ok)
+        return loaded;
+      if (loaded.data.record.revision !== expected)
+        return this.conflict(expected, loaded.data.record.revision);
       const context = { now: timestamp ?? now(), revision: newRevision() };
       let changed;
       try {
-        changed = update(current.data, Object.freeze({ ...context }));
+        changed = update(structuredClone(loaded.data.record), Object.freeze({ ...context }));
       } catch (error) {
         return failure2("storage_error", `task mutation failed: ${String(error)}`);
       }
       if (!changed.ok)
         return changed;
-      const record = {
-        ...changed.data,
-        id: taskId,
-        workspaceId: current.data.workspaceId,
-        createdAt: current.data.createdAt,
-        revision: context.revision,
-        updatedAt: context.now,
-        runtime: stampNew(current.data)
-      };
-      const valid = taskRecordSchema.safeParse(record);
-      if (!valid.success)
+      const valid = this.nextTask(loaded.data.record, changed.data, context);
+      if (!valid)
         return failure2("invalid_input", "task mutation produced an invalid record");
-      const written = this.replaceSnapshot(this.taskPath(taskId), valid.data, previousBytes);
-      return written.ok ? success(valid.data.revision, null, valid.data) : written;
+      const written = this.appendPatch(loaded.data, valid);
+      return written.ok ? success(valid.revision, null, valid) : written;
     });
+    this.compactPending();
+    return result;
   }
   mutateWorkspace(expected, update) {
-    return this.withLock(() => {
+    const ready = this.ready(true);
+    if (!ready.ok)
+      return ready;
+    return this.withLock(this.paths().checkoutLock, () => {
       const current = this.readWorkspace();
       if (!current.ok)
         return current;
@@ -10700,9 +11342,6 @@ class TaskStore {
         return failure2("not_found", "workspace not found");
       if (current.data.revision !== expected)
         return this.workspaceConflict(expected, current.data.revision);
-      const previousBytes = this.snapshotBytes(this.workspacePath);
-      if (!previousBytes)
-        return failure2("storage_error", "workspace snapshot disappeared during mutation");
       const context = { now: now(), revision: newRevision() };
       let changed;
       try {
@@ -10712,23 +11351,27 @@ class TaskStore {
       }
       if (!changed.ok)
         return changed;
-      const record = {
+      const valid = workspaceRecordSchema.safeParse({
         ...changed.data,
         id: current.data.id,
         root: this.root,
         revision: context.revision,
         runtime: stampNew(current.data)
-      };
-      const valid = workspaceRecordSchema.safeParse(record);
+      });
       if (!valid.success)
         return failure2("invalid_input", "workspace mutation produced an invalid record");
-      const written = this.replaceSnapshot(this.workspacePath, valid.data, previousBytes);
+      const written = this.writeWorkspace(valid.data);
       return written.ok ? success(valid.data.revision, valid.data.revision, valid.data) : written;
     });
   }
   mutateTaskAndWorkspace(input) {
-    return this.withLock(() => {
-      const task = this.readTask(input.taskId);
+    if (!validId(input.taskId))
+      return failure2("invalid_input", "task ID is invalid", { taskId: input.taskId });
+    const ready = this.ready(true);
+    if (!ready.ok)
+      return ready;
+    const result = this.withLock(this.paths().checkoutLock, () => this.withLock(this.taskLockPath(input.taskId), () => {
+      const task = this.loadBound(input.taskId);
       if (!task.ok)
         return task;
       const workspace = this.readWorkspace();
@@ -10739,14 +11382,10 @@ class TaskStore {
       const expected = input.expectedRevision;
       if (!expected)
         return failure2("invalid_input", "task revision is required");
-      if (task.data.revision !== expected)
-        return this.conflict(expected, task.data.revision);
+      if (task.data.record.revision !== expected)
+        return this.conflict(expected, task.data.record.revision);
       if (workspace.data.revision !== input.expectedWorkspaceRevision)
         return this.workspaceConflict(input.expectedWorkspaceRevision, workspace.data.revision);
-      const previousWorkspaceBytes = this.snapshotBytes(this.workspacePath);
-      const previousTaskBytes = this.snapshotBytes(this.taskPath(input.taskId));
-      if (!previousWorkspaceBytes || !previousTaskBytes)
-        return failure2("storage_error", "snapshot disappeared during coupled mutation");
       const workspaceContext = { now: input.now ?? now(), revision: newRevision() };
       let changedWorkspace;
       try {
@@ -10765,286 +11404,69 @@ class TaskStore {
       });
       if (!nextWorkspace.success)
         return failure2("invalid_input", "workspace mutation produced an invalid record");
-      const reserved = this.replaceSnapshot(this.workspacePath, nextWorkspace.data, previousWorkspaceBytes);
+      const reserved = this.writeWorkspace(nextWorkspace.data);
       if (!reserved.ok)
         return reserved;
+      const uncertain = (message) => {
+        this.markUncertain(nextWorkspace.data);
+        return failure2("external_outcome_unknown", message, {
+          operation: "coupled_mutation",
+          outcome: "unknown"
+        });
+      };
       const taskContext = { now: input.now ?? now(), revision: newRevision() };
       let changedTask;
       try {
-        changedTask = input.task(task.data, Object.freeze({ ...taskContext }));
+        changedTask = input.task(structuredClone(task.data.record), Object.freeze({ ...taskContext }));
       } catch (error) {
-        this.markUncertain(nextWorkspace.data);
-        return failure2("external_outcome_unknown", `workspace reserved but task mutation threw: ${String(error)}`, { operation: "coupled_mutation", outcome: "unknown" });
-      }
-      if (!changedTask.ok) {
-        this.markUncertain(nextWorkspace.data);
-        return failure2("external_outcome_unknown", "workspace reserved but task update is uncertain", { operation: "coupled_mutation", outcome: "unknown" });
+        return uncertain(`workspace reserved but task mutation threw: ${String(error)}`);
       }
-      const nextTask = taskRecordSchema.safeParse({
-        ...changedTask.data,
-        id: input.taskId,
-        workspaceId: task.data.workspaceId,
-        createdAt: task.data.createdAt,
-        revision: taskContext.revision,
-        updatedAt: taskContext.now,
-        runtime: stampNew(task.data)
+      if (!changedTask.ok)
+        return uncertain("workspace reserved but task update is uncertain");
+      const nextTask = this.nextTask(task.data.record, changedTask.data, taskContext);
+      if (!nextTask)
+        return uncertain("workspace reserved but task update is uncertain");
+      const written = this.appendPatch(task.data, nextTask);
+      if (!written.ok)
+        return uncertain("workspace reserved but task append is uncertain");
+      return success(nextTask.revision, nextWorkspace.data.revision, {
+        task: nextTask,
+        workspace: nextWorkspace.data
       });
-      if (!nextTask.success) {
-        this.markUncertain(nextWorkspace.data);
-        return failure2("external_outcome_unknown", "workspace reserved but task update is uncertain", { operation: "coupled_mutation", outcome: "unknown" });
-      }
-      const written = this.replaceSnapshot(this.taskPath(input.taskId), nextTask.data, previousTaskBytes);
-      if (!written.ok) {
-        this.markUncertain(nextWorkspace.data);
-        return failure2("external_outcome_unknown", "workspace reserved but task replacement is uncertain", { operation: "coupled_mutation", outcome: "unknown" });
-      }
-      return success(nextTask.data.revision, nextWorkspace.data.revision, {
-        task: nextTask.data,
-        workspace: nextWorkspace.data
-      });
-    });
-  }
-  recoveryCandidates() {
-    if (!fs6.existsSync(this.recoveryDir))
-      return success(null, null, []);
-    try {
-      const candidates = [];
-      for (const name of fs6.readdirSync(this.recoveryDir)) {
-        const match = RECOVERY_NAME.exec(name);
-        if (match)
-          candidates.push({
-            target: match[1],
-            path: path7.join(this.recoveryDir, name),
-            digest: match[3]
-          });
-      }
-      return success(null, null, candidates);
-    } catch (error) {
-      return failure2("storage_error", `unable to list recovery: ${String(error)}`, {
-        path: this.recoveryDir
-      });
-    }
-  }
-  recoverTask(taskId, input) {
-    return this.recover("task", taskId, input);
-  }
-  recoverWorkspace(input) {
-    return this.recover("workspace", null, input);
-  }
-  recover(target, taskId, input) {
-    if (taskId !== null && !validId(taskId))
-      return failure2("invalid_input", "task ID is invalid", { taskId });
-    if (!input.reason || !Array.isArray(input.authorityRefs) || typeof input.processEvidence !== "function" || !validDigest(input.expectedBytes) || !validDigest(input.snapshotDigest))
-      return failure2("invalid_input", "recovery authority is invalid");
-    if (input.authorityRefs.some((ref) => !refSchema.safeParse(ref).success))
-      return failure2("invalid_input", "recovery references are invalid");
-    try {
-      const workspace = this.readWorkspace();
-      if (!workspace.ok && target === "task")
-        return workspace;
-      const workspaceValue = workspace.ok ? workspace.data : null;
-      if (workspaceValue && workspaceValue.revision !== input.expectedWorkspaceRevision)
-        return this.conflict(input.expectedWorkspaceRevision, workspaceValue.revision);
-      const file = target === "workspace" ? this.workspacePath : this.taskPath(taskId);
-      const currentBytes = this.snapshotBytes(file);
-      if (!currentBytes)
-        return failure2("not_found", "snapshot not found");
-      if (digestBytes(currentBytes) !== input.expectedBytes)
-        return failure2("revision_conflict", "snapshot bytes do not match expected bytes");
-      let selectedBytes = currentBytes;
-      if (digestBytes(currentBytes) !== input.snapshotDigest) {
-        const candidate = this.findRecovery(target, taskId, input.snapshotDigest, workspaceValue);
-        if (!candidate)
-          return failure2("recovery_required", "validated recovery snapshot not found");
-        selectedBytes = candidate;
-      }
-      const selectedRecord = target === "workspace" ? this.parseBytes(selectedBytes, workspaceRecordSchema, "rewrite") : this.parseBytes(selectedBytes, taskRecordSchema, "rewrite");
-      if (!selectedRecord.ok)
-        return selectedRecord;
-      if (target === "workspace") {
-        const parsed = selectedRecord;
-        if (!parsed.ok || parsed.data.root !== this.root)
-          return failure2("recovery_required", "workspace recovery binding is invalid");
-      } else {
-        const parsed = selectedRecord;
-        if (!parsed.ok || parsed.data.id !== taskId || !workspaceValue || parsed.data.workspaceId !== workspaceValue.id)
-          return failure2("recovery_required", "task recovery binding is invalid");
-      }
-      const lock = this.readLockSnapshot();
-      if (!lock.ok)
-        return lock;
-      const writer = target === "workspace" ? selectedRecord.data.writer : workspaceValue?.writer ?? null;
-      const evidence = this.processEvidence(input, lock.data?.data ?? null, writer);
-      if (!evidence.ok)
-        return evidence;
-      if (lock.data && (evidence.data.pid !== lock.data.data.pid || evidence.data.processStart !== lock.data.data.processStart))
-        return failure2("recovery_required", "process evidence does not match metadata lock");
-      if (writer && (evidence.data.state !== "accounted_for" || evidence.data.ownerDigest !== sha256(canonicalJson(writer))))
-        return failure2("recovery_required", "workspace writer is not accounted for");
-      const recoveryGate = { reclaimed: false };
-      const result = this.withLock((handle) => {
-        if (lock.data && !recoveryGate.reclaimed)
-          return failure2("recovery_required", "metadata lock changed during recovery", {
-            path: this.lockPath
-          });
-        if (!handle.verifyStillHeld())
-          return failure2("recovery_required", "metadata lock was compromised", {
-            path: this.lockPath
-          });
-        const reacquiredBytes = this.snapshotBytes(file);
-        if (!reacquiredBytes)
-          return failure2("recovery_required", "snapshot disappeared during recovery");
-        if (digestBytes(reacquiredBytes) !== input.expectedBytes)
-          return failure2("revision_conflict", "snapshot changed during recovery");
-        if (target === "task") {
-          const currentWorkspace = this.readWorkspace();
-          if (!currentWorkspace.ok || !currentWorkspace.data)
-            return failure2("recovery_required", "workspace changed during recovery");
-          if (currentWorkspace.data.revision !== input.expectedWorkspaceRevision)
-            return this.conflict(input.expectedWorkspaceRevision, currentWorkspace.data.revision);
-        }
-        if (target === "workspace") {
-          const parsed = this.parseBytes(selectedBytes, workspaceRecordSchema, "rewrite");
-          if (!parsed.ok)
-            return parsed;
-          const value = { ...parsed.data, revision: newRevision(), writer: null };
-          const replaced = this.replaceSnapshot(file, value, reacquiredBytes);
-          return replaced.ok ? success(value.revision, value.revision, value) : replaced;
-        }
-        const parsed = this.parseBytes(selectedBytes, taskRecordSchema, "rewrite");
-        if (!parsed.ok)
-          return parsed;
-        const value = {
-          ...parsed.data,
-          revision: newRevision(),
-          updatedAt: now(),
-          status: parsed.data.status === "active" ? "paused" : parsed.data.status
-        };
-        const replaced = this.replaceSnapshot(file, value, reacquiredBytes);
-        return replaced.ok ? success(value.revision, null, value) : replaced;
-      }, this.recoveryLockOptions(lock.data, evidence.data, recoveryGate), "recovery_required");
-      return result;
-    } catch (error) {
-      return failure2("recovery_required", `recovery protocol failed: ${String(error)}`);
-    }
-  }
-  processEvidence(input, lock, writer) {
-    const lockCopy = lock ? this.deepFreeze(structuredClone(lock)) : null;
-    const writerCopy = writer ? this.deepFreeze(structuredClone(writer)) : null;
-    const lockDigest = lockCopy ? sha256(canonicalJson(lockCopy)) : null;
-    const writerDigest = writerCopy ? sha256(canonicalJson(writerCopy)) : null;
-    try {
-      const result = input.processEvidence(lockCopy, writerCopy);
-      if (lockCopy && sha256(canonicalJson(lockCopy)) !== lockDigest)
-        return failure2("recovery_required", "process evidence mutated lock identity");
-      if (writerCopy && sha256(canonicalJson(writerCopy)) !== writerDigest)
-        return failure2("recovery_required", "process evidence mutated writer identity");
-      if (!result.ok)
-        return result;
-      const parsed = processEvidenceSchema.safeParse(result.data);
-      return parsed.success ? success(null, null, parsed.data) : failure2("recovery_required", "process evidence is invalid");
-    } catch (error) {
-      return failure2("recovery_required", `process evidence failed: ${String(error)}`);
-    }
-  }
-  deepFreeze(value) {
-    if (value && typeof value === "object") {
-      for (const child of Object.values(value))
-        this.deepFreeze(child);
-      Object.freeze(value);
-    }
-    return value;
-  }
-  readLockSnapshot() {
-    try {
-      const stat = fs6.lstatSync(this.lockPath);
-      if (!stat.isFile() || stat.isSymbolicLink())
-        return failure2("recovery_required", "metadata lock is not a regular file", {
-          path: this.lockPath
-        });
-      const raw = fs6.readFileSync(this.lockPath, "utf8");
-      return success(null, null, { raw, data: parseMetadataLock(raw) });
-    } catch (error) {
-      if (error?.code === "ENOENT")
-        return success(null, null, null);
-      return failure2("recovery_required", `metadata lock is invalid: ${String(error)}`, {
-        path: this.lockPath
-      });
-    }
-  }
-  metadataLockOptions() {
-    const inProcess = heldInProcess.has(this.root);
-    return {
-      lockPath: this.lockPath,
-      staleMs: Number.MAX_SAFE_INTEGER,
-      timeoutMs: inProcess ? 0 : this.lockTimeoutMs,
-      retry: inProcess ? { retries: 0 } : { minTimeout: 5, maxTimeout: 100, factor: 1.5, randomize: true },
-      staleRecovery: "remove-if-unchanged",
-      shouldReclaim: ({ payload, nowMs }) => {
-        let ageMs = null;
-        try {
-          ageMs = nowMs - fs6.lstatSync(this.lockPath).mtimeMs;
-        } catch {}
-        return classifyLockOwner(payload, ageMs).state === "stale";
-      },
-      shouldRemoveStaleLock: () => true,
-      parsePayload: parseMetadataLockOrNull,
-      payload: () => ({
-        pid: process.pid,
-        processStart: processStartOf(process.pid),
-        host: localLockHost(),
-        nonce: randomUUID2()
-      })
-    };
-  }
-  acquireMetadataLock(options) {
-    clearAbandonedReclaimGuard(this.lockPath);
-    const deadline = Date.now() + (options.timeoutMs ?? 0);
-    while (true) {
-      try {
-        return acquireFileLockSync(this.workspacePath, {
-          ...options,
-          timeoutMs: Math.max(0, deadline - Date.now())
-        });
-      } catch (error) {
-        const code = error?.code;
-        if (code !== "file_lock_stale" && !isTransientWindowsError(error) || Date.now() >= deadline)
-          throw error;
-        if (code !== "file_lock_stale" && !this.lockHolderPresent() && !this.lockDirWritable())
-          throw error;
-        if (code !== "file_lock_stale")
-          Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5);
-      }
-    }
-  }
-  externalActionLockOptions() {
-    const options = this.metadataLockOptions();
-    return { ...options, payload: () => ({ ...options.payload(), externalAction: true }) };
+    }));
+    this.compactPending();
+    return result;
   }
   async withExternalActionLock(operation, reentrant = false) {
     const activeRoots = externalActionLockRoots.getStore();
     if (activeRoots && [...activeRoots].some((root) => root === this.root || sameDirectoryIdentity(root, this.root)))
       return operation();
+    const ready = this.ready(true);
+    if (!ready.ok)
+      return ready;
+    const lockPath = this.paths().checkoutLock;
     try {
-      this.initializeMutationStorage();
+      this.initializeStorage();
     } catch (error) {
       return failure2("storage_error", `unable to initialize store: ${String(error)}`, {
-        path: this.workitDir
+        path: this.paths().dir
       });
     }
     let handle;
     try {
-      handle = this.acquireMetadataLock(this.externalActionLockOptions());
+      const options = this.lockOptions(lockPath);
+      handle = this.acquire(lockPath, {
+        ...options,
+        payload: () => ({ ...options.payload(), externalAction: true })
+      });
     } catch (error) {
-      return this.lockFailure(error);
+      return this.lockFailure(lockPath, error);
     }
-    holdRoot(this.root);
+    hold(lockPath);
     let result;
     try {
       if (!handle.verifyStillHeld())
-        result = failure2("recovery_required", "metadata lock was compromised", {
-          path: this.lockPath
-        });
+        result = failure2("recovery_required", "metadata lock was compromised", { path: lockPath });
       else {
         try {
           const run = () => operation();
@@ -11058,526 +11480,1144 @@ class TaskStore {
           if (!handle.verifyStillHeld())
             result = failure2("external_outcome_unknown", "metadata lock was compromised", {
               outcome: "unknown",
-              path: this.lockPath
+              path: lockPath
             });
         } catch {
           result = failure2("external_outcome_unknown", "metadata lock could not be verified", {
             outcome: "unknown",
-            path: this.lockPath
+            path: lockPath
           });
         }
       }
     } catch {
       result = failure2("external_outcome_unknown", "external action lock operation failed", {
         outcome: "unknown",
-        path: this.lockPath
+        path: lockPath
       });
     }
-    dropRoot(this.root);
+    drop(lockPath);
     try {
       retryTransient(() => handle.release());
     } catch (error) {
-      const released = this.lockFailure(error);
+      const released = this.lockFailure(lockPath, error);
       const releaseError = released.ok ? "metadata lock release failed" : released.error;
       return result.ok ? failure2("external_outcome_unknown", "external action metadata lock release is uncertain", {
         outcome: "unknown",
-        path: this.lockPath
+        path: lockPath
       }) : failure2("recovery_required", `${result.error}; ${releaseError}`, result.details);
     }
     return result;
   }
-  recoveryLockOptions(observed, evidence, gate) {
-    const options = this.metadataLockOptions();
-    options.timeoutMs = 0;
-    options.retry = { retries: 0 };
-    options.parsePayload = parseMetadataLock;
-    options.staleRecovery = "remove-if-unchanged";
-    options.shouldReclaim = ({ payload }) => Boolean(observed && sameMetadataLock(payload, observed.data) && (evidence.state === "stopped" || evidence.state === "accounted_for"));
-    options.shouldRemoveStaleLock = ({ raw, payload }) => {
-      if (!observed || raw !== observed.raw || !sameMetadataLock(payload, observed.data))
-        return false;
-      gate.reclaimed = true;
-      return true;
+  collectGarbage(options = {}) {
+    const dryRun = options.dryRun === true;
+    const compactAbove = options.compactAbove ?? COMPACT_ABOVE;
+    const report = {
+      dryRun,
+      compacted: { tasks: [], eventsFolded: 0, bytesBefore: 0, bytesAfter: 0 },
+      blobs: { removed: 0, removedBytes: 0, kept: 0 },
+      temporary: { removed: 0 },
+      legacyRecovery: null,
+      retried: [],
+      failed: []
+    };
+    const ready = this.ready(!dryRun);
+    if (!ready.ok)
+      return ready;
+    const dirs = this.paths();
+    const recovery = path9.join(this.root, ".workit", "recovery");
+    if (fs8.existsSync(recovery)) {
+      let files = 0;
+      let bytes = 0;
+      try {
+        for (const name of fs8.readdirSync(recovery)) {
+          const stat = fs8.lstatSync(path9.join(recovery, name));
+          if (!stat.isFile())
+            continue;
+          files += 1;
+          bytes += stat.size;
+        }
+      } catch {}
+      const remove = options.pruneRecovery === true && !dryRun;
+      if (remove)
+        fs8.rmSync(recovery, { recursive: true, force: true });
+      report.legacyRecovery = { path: recovery, files, bytes, removed: remove };
+    }
+    if (!fs8.existsSync(dirs.tasks))
+      return success(null, null, report);
+    const names = fs8.readdirSync(dirs.tasks).filter((name) => validId(name));
+    for (const name of names) {
+      const file = this.eventsPath(name);
+      let size = 0;
+      try {
+        size = fs8.statSync(file).size;
+      } catch {
+        continue;
+      }
+      const lines = this.countEvents(file);
+      if (lines > compactAbove) {
+        if (dryRun) {
+          report.compacted.tasks.push(name);
+          report.compacted.eventsFolded += lines - COMPACT_KEEP;
+          report.compacted.bytesBefore += size;
+        } else {
+          const compacted = this.compact(name);
+          if (!compacted.ok)
+            (compacted.code === "busy" ? report.retried : report.failed).push(name);
+          else {
+            report.compacted.tasks.push(name);
+            report.compacted.eventsFolded += compacted.data.folded;
+            report.compacted.bytesBefore += size;
+            report.compacted.bytesAfter += compacted.data.bytes;
+          }
+        }
+      }
+    }
+    const nowMs = Date.now();
+    const sweep = () => {
+      const references = new Set;
+      for (const name of names)
+        try {
+          for (const match of fs8.readFileSync(this.eventsPath(name), "utf8").matchAll(/"\$blob":"([0-9a-f]{64})"/g))
+            references.add(match[1]);
+        } catch {}
+      if (fs8.existsSync(dirs.blobs))
+        for (const name of fs8.readdirSync(dirs.blobs)) {
+          const digest = name.replace(/\.json$/, "");
+          const file = path9.join(dirs.blobs, name);
+          let stat;
+          try {
+            stat = fs8.lstatSync(file);
+          } catch {
+            continue;
+          }
+          if (references.has(digest) || nowMs - stat.mtimeMs <= STALE_TEMPORARY_MS) {
+            report.blobs.kept += 1;
+            continue;
+          }
+          report.blobs.removed += 1;
+          report.blobs.removedBytes += stat.size;
+          if (!dryRun)
+            fs8.rmSync(file, { force: true });
+        }
+      return success(null, null, null);
     };
-    return options;
+    const swept = dryRun ? sweep() : this.withLock(path9.join(dirs.dir, "gc.lock"), sweep);
+    if (!swept.ok)
+      return swept;
+    const temporaryDirs = [
+      dirs.dir,
+      dirs.tasks,
+      dirs.blobs,
+      dirs.checkout,
+      ...names.map((name) => path9.join(dirs.tasks, name))
+    ];
+    for (const directory of temporaryDirs) {
+      if (!fs8.existsSync(directory))
+        continue;
+      for (const name of fs8.readdirSync(directory)) {
+        if (!name.endsWith(".tmp") && !name.endsWith(".probe"))
+          continue;
+        const file = path9.join(directory, name);
+        try {
+          const stat = fs8.lstatSync(file);
+          if (!stat.isFile() || nowMs - stat.mtimeMs <= STALE_TEMPORARY_MS)
+            continue;
+        } catch {
+          continue;
+        }
+        report.temporary.removed += 1;
+        if (!dryRun)
+          fs8.rmSync(file, { force: true });
+      }
+    }
+    return success(null, null, report);
   }
-  markUncertain(workspace) {
-    if (!workspace.writer || workspace.writer.state === "uncertain")
-      return;
-    const value = {
-      ...workspace,
-      writer: { ...workspace.writer, state: "uncertain" },
-      revision: newRevision(),
-      runtime: stampNew(workspace)
+  paths() {
+    const location = this.location();
+    const dir = location.ok ? location.data.dir : path9.join(this.root, ".workit");
+    const checkout = path9.join(dir, "checkouts", checkoutSlug(this.root));
+    return {
+      dir,
+      shared: location.ok ? location.data.shared : false,
+      marker: path9.join(dir, "store.json"),
+      checkout,
+      workspace: path9.join(checkout, "workspace.json"),
+      checkoutLock: path9.join(checkout, "metadata.lock"),
+      tasks: path9.join(dir, "tasks"),
+      index: path9.join(dir, "task-index.json"),
+      blobs: path9.join(dir, "blobs", "candidates"),
+      legacy: path9.join(dir, "legacy", checkoutSlug(this.root), "v2"),
+      v2: path9.join(this.root, ".workit")
     };
-    this.replaceSnapshot(this.workspacePath, value, workspace);
   }
-  withLock(operation, options = this.metadataLockOptions(), contention = "busy") {
+  eventsPath(taskId) {
+    return path9.join(this.paths().tasks, taskId, "events.jsonl");
+  }
+  snapshotPath(taskId) {
+    return path9.join(this.paths().tasks, taskId, "snapshot.json");
+  }
+  taskLockPath(taskId) {
+    return path9.join(this.paths().tasks, taskId, "lock");
+  }
+  ready(write = false) {
+    const location = this.location();
+    if (!location.ok)
+      return location;
+    if (this.migrationChecked)
+      return success(null, null, null);
+    const dirs = this.paths();
     try {
-      this.initializeMutationStorage();
-    } catch (error) {
-      return failure2("storage_error", `unable to initialize store: ${String(error)}`, {
-        path: this.workitDir
-      });
+      const marker = JSON.parse(fs8.readFileSync(dirs.marker, "utf8"));
+      if (typeof marker.version === "number" && marker.version > STORE_FORMAT)
+        return failure2("recovery_required", `the workit store at ${dirs.dir} has format ${marker.version}; upgrade Workit to use it`, { path: dirs.marker });
+    } catch {}
+    this.migrationChecked = true;
+    const settled = this.settleMigrations(write);
+    if (!settled.ok)
+      this.migrationChecked = false;
+    return settled;
+  }
+  settleMigrations(write) {
+    const moved = this.adoptLocalStore();
+    if (!moved.ok)
+      return moved;
+    const pending = this.pendingMigrations();
+    if (pending.length > 0 && !write && !(this.migrateOnRead ?? migrationReporterInstalled()))
+      return failure2("needs_input", `${MIGRATION_PENDING}: the task store at ${pending[0]} has not been migrated yet; run \`workit task status\` to migrate it`, { path: pending[0], guidance: "workit task status" });
+    for (const v2 of this.v2Dirs()) {
+      const migrated = this.migrateV2(v2);
+      if (!migrated.ok)
+        return migrated;
     }
-    let handle;
-    let result = failure2("storage_error", "metadata lock operation did not produce a result");
+    return success(null, null, null);
+  }
+  blobStore() {
+    const dir = this.paths().blobs;
+    return {
+      read: (digest) => {
+        try {
+          return JSON.parse(fs8.readFileSync(path9.join(dir, `${digest}.json`), "utf8"));
+        } catch (error) {
+          throw new LogDamage(`stored candidate ${digest} is missing or unreadable: ${String(error)}`);
+        }
+      },
+      write: (digest, value) => {
+        const file = path9.join(dir, `${digest}.json`);
+        if (fs8.existsSync(file)) {
+          const stamp = new Date;
+          try {
+            fs8.utimesSync(file, stamp, stamp);
+            return;
+          } catch {}
+        }
+        fs8.mkdirSync(dir, { recursive: true });
+        replaceFile(file, JSON.stringify(value), true);
+      }
+    };
+  }
+  load(taskId) {
     try {
-      handle = this.acquireMetadataLock(options);
+      const loaded = this.loadOrThrow(taskId);
+      if (!loaded)
+        return success(null, null, null);
+      const parsed = this.parseTask(loaded.state.record, taskId);
+      if (!parsed.ok)
+        return parsed;
+      return success(null, null, {
+        record: parsed.data,
+        key: loaded.state.key,
+        legacy: loaded.state.legacy,
+        seq: loaded.seq,
+        lastId: loaded.lastId,
+        lastStart: loaded.lastStart,
+        end: loaded.end,
+        size: loaded.size,
+        snapshotSeq: loaded.snapshotSeq
+      });
     } catch (error) {
-      result = this.lockFailure(error, contention);
+      if (error instanceof LogDamage)
+        return failure2("recovery_required", error.upgrade ? error.message : `task ${taskId} log is damaged: ${error.message}`, { taskId, path: this.eventsPath(taskId) });
+      return failure2("recovery_required", `task ${taskId} cannot be read: ${String(error)}`, {
+        taskId
+      });
     }
-    if (handle)
-      holdRoot(this.root);
-    if (handle) {
+  }
+  loadOrThrow(taskId) {
+    const blobs = this.blobStore();
+    const file = this.eventsPath(taskId);
+    const snapshot = this.readSnapshot(taskId);
+    if (snapshot) {
       try {
-        if (!handle.verifyStillHeld())
-          result = failure2("recovery_required", "metadata lock was compromised", {
-            path: this.lockPath
-          });
-        else {
-          try {
-            result = operation(handle);
-          } catch (error) {
-            result = failure2("storage_error", `mutation failed: ${String(error)}`);
-          }
+        const tail = readLog(file, snapshot.lastStart, snapshot.seq);
+        const first = tail?.events[0];
+        if (tail && first && first.id === snapshot.lastId) {
+          let state = {
+            record: snapshot.record,
+            key: snapshot.key,
+            legacy: snapshot.legacy
+          };
+          for (const event of tail.events.slice(1))
+            state = reduce(state, event, blobs);
+          return this.loadedFrom(state, tail, snapshot.seq);
         }
       } catch (error) {
-        result = this.lockFailure(error);
+        if (error instanceof LogDamage && error.upgrade)
+          throw error;
       }
     }
-    if (handle) {
-      dropRoot(this.root);
-      try {
-        retryTransient(() => handle.release());
-      } catch (error) {
-        const releaseFailure = this.lockFailure(error);
-        const releaseError = releaseFailure.ok ? "metadata lock release failed" : releaseFailure.error;
-        result = result.ok ? releaseFailure : failure2("recovery_required", `${result.error}; ${releaseError}`, result.details);
-      }
+    const log = readLog(file, 0, null);
+    if (!log || log.events.length === 0) {
+      if (log && log.size > 0)
+        throw new LogDamage("the log holds no complete event");
+      return null;
     }
-    return result;
+    if (!OPENING_TYPES.has(log.events[0].type))
+      throw new LogDamage(`the log starts with ${log.events[0].type}, not an opening event`);
+    let state = null;
+    for (const event of log.events)
+      state = reduce(state, event, blobs);
+    return this.loadedFrom(state, log, 0);
+  }
+  loadedFrom(state, log, snapshotSeq) {
+    const last = log.events.at(-1);
+    return {
+      state,
+      seq: last.seq,
+      lastId: last.id,
+      lastStart: log.lastStart,
+      end: log.end,
+      size: log.size,
+      snapshotSeq
+    };
   }
-  lockDirWritable() {
-    const probe = `${this.lockPath}.${process.pid}.${randomUUID2()}.probe`;
+  readSnapshot(taskId) {
     try {
-      fs6.closeSync(fs6.openSync(probe, "wx", 384));
+      const value = JSON.parse(fs8.readFileSync(this.snapshotPath(taskId), "utf8"));
+      if (!isObject4(value) || value.v !== 1 || value.task !== taskId || typeof value.seq !== "number" || typeof value.lastId !== "string" || typeof value.lastStart !== "number" || typeof value.end !== "number" || !isObject4(value.record))
+        return null;
+      return value;
     } catch {
-      return false;
+      return null;
     }
+  }
+  writeSnapshot(taskId, loaded) {
+    const snapshot = {
+      v: 1,
+      task: taskId,
+      seq: loaded.seq,
+      lastId: loaded.lastId,
+      lastStart: loaded.lastStart,
+      end: loaded.end,
+      key: loaded.key,
+      legacy: loaded.legacy,
+      record: loaded.record
+    };
     try {
-      fs6.rmSync(probe, { force: true });
+      replaceFile(this.snapshotPath(taskId), JSON.stringify(snapshot), false);
     } catch {}
-    return true;
   }
-  lockHolderPresent() {
+  loadBound(taskId) {
+    const loaded = this.load(taskId);
+    if (!loaded.ok)
+      return loaded;
+    if (!loaded.data)
+      return failure2("not_found", "task not found", { taskId });
+    const workspace = this.readWorkspace();
+    if (!workspace.ok)
+      return workspace;
+    const bound = this.bindingError(loaded.data.record, workspace.data);
+    return bound ?? success(null, null, loaded.data);
+  }
+  bindingError(task, workspace) {
+    if (workspace && task.workspaceId === workspace.id)
+      return null;
+    return failure2("not_found", `task ${task.id} belongs to another checkout of this repository; run there, or move it here with \`workit task adopt ${task.id}\``, { taskId: task.id });
+  }
+  nextTask(current, changed, context) {
+    const valid = taskRecordSchema.safeParse({
+      ...changed,
+      id: current.id,
+      workspaceId: current.workspaceId,
+      createdAt: current.createdAt,
+      revision: context.revision,
+      updatedAt: context.now,
+      runtime: stampNew(current)
+    });
+    return valid.success ? valid.data : null;
+  }
+  event(taskId, seq, type, data) {
+    return {
+      v: EVENT_VERSION,
+      seq,
+      at: new Date().toISOString(),
+      id: newId(),
+      task: taskId,
+      actor: this.actor,
+      type,
+      data
+    };
+  }
+  appendPatch(loaded, next, extra = {}) {
+    const taskId = next.id;
     try {
-      fs6.lstatSync(this.lockPath);
-      return true;
+      const blobs = this.blobStore();
+      const before = loaded.record;
+      const after = next;
+      const ops = encodeOps(diff(before, after), blobs);
+      const { type, ...data } = extra;
+      if (data.key)
+        data.key = { ...data.key, boundAt: data.key.boundAt ?? new Date().toISOString() };
+      const event = this.event(taskId, loaded.seq + 1, type ?? ("key" in extra ? "task.bound" : eventType(before, after)), { ops, ...data });
+      const start = appendEvent(this.eventsPath(taskId), event, loaded.end);
+      const end = start + Buffer.byteLength(`${JSON.stringify(event)}
+`);
+      const key = "key" in data ? data.key ?? null : loaded.key;
+      const state = {
+        record: next,
+        key,
+        legacy: extra.legacy ?? loaded.legacy,
+        seq: event.seq,
+        lastId: event.id,
+        lastStart: start,
+        end
+      };
+      if (event.seq - loaded.snapshotSeq >= SNAPSHOT_EVERY || next.status !== loaded.record.status || loaded.snapshotSeq === 0)
+        this.writeSnapshot(taskId, state);
+      if (end > AUTO_COMPACT_BYTES)
+        this.compactDue.add(taskId);
+      this.indexTask(next, key, (extra.legacy ?? loaded.legacy) !== null);
+      return success(null, null, null);
     } catch (error) {
-      return error?.code !== "ENOENT";
+      return failure2("storage_error", `task append failed: ${String(error)}`, {
+        path: this.eventsPath(taskId)
+      });
     }
   }
-  lockFailure(error, contention = "busy") {
-    const value = error;
-    const code = typeof value?.code === "string" ? value.code : "";
-    if (isTransientWindowsError(error) && !this.lockHolderPresent() && !this.lockDirWritable())
-      return failure2("storage_error", `cannot create the workspace metadata lock (${code}); no other Workit call holds it`, {
-        path: this.lockPath,
-        guidance: `Check permissions and the read-only attribute on ${path7.dirname(this.lockPath)}.`
+  openTask(record, type, key, legacy = null) {
+    const dir = path9.join(this.paths().tasks, record.id);
+    fs8.mkdirSync(dir, { recursive: true });
+    const blobs = this.blobStore();
+    const bound = key ? { ...key, boundAt: key.boundAt ?? new Date().toISOString() } : null;
+    const event = this.event(record.id, 1, type, {
+      record: encodeRecord(record, blobs),
+      key: bound,
+      ...legacy ? { legacy } : {}
+    });
+    const file = this.eventsPath(record.id);
+    const existing = readLog(file, 0, null);
+    if (existing && existing.events.length > 0)
+      throw new Error(`task ${record.id} already has a log`);
+    appendEvent(file, event, 0);
+    this.indexTask(record, bound, legacy !== null);
+  }
+  compactPending() {
+    for (const taskId of this.compactDue) {
+      this.compactDue.delete(taskId);
+      this.compact(taskId);
+    }
+  }
+  compact(taskId) {
+    try {
+      const file = this.eventsPath(taskId);
+      const log = readLog(file, 0, null);
+      if (!log || log.events.length <= COMPACT_KEEP + 1)
+        return success(null, null, { folded: 0, bytes: log?.size ?? 0 });
+      const blobs = this.blobStore();
+      const cut = log.events.length - COMPACT_KEEP;
+      let state = null;
+      for (const event of log.events.slice(0, cut))
+        state = reduce(state, event, blobs);
+      const folded = log.events[cut - 1];
+      const checkpoint = {
+        ...this.event(taskId, folded.seq, "task.checkpoint", {
+          record: encodeRecord(state.record, blobs),
+          key: state.key,
+          ...state.legacy ? { legacy: state.legacy } : {},
+          folded: { from: log.events[0].seq, to: folded.seq }
+        })
+      };
+      const prefix = `${[checkpoint, ...log.events.slice(cut)].map((event) => JSON.stringify(event)).join(`
+`)}
+`;
+      const last = log.events.at(-1);
+      return this.withLock(this.taskLockPath(taskId), () => {
+        let latest = null;
+        try {
+          latest = readLog(file, log.lastStart, last.seq);
+        } catch {}
+        if (!latest || latest.events[0]?.id !== last.id)
+          return failure2("busy", "the task log changed during compaction; retry", { taskId });
+        const appended = fs8.readFileSync(file).subarray(log.end, latest.end);
+        const bytes = Buffer.concat([Buffer.from(prefix, "utf8"), appended]);
+        replaceFile(file, bytes.toString("utf8"), true);
+        try {
+          fs8.rmSync(this.snapshotPath(taskId), { force: true });
+        } catch {}
+        const reloaded = this.load(taskId);
+        if (reloaded.ok && reloaded.data)
+          this.writeSnapshot(taskId, reloaded.data);
+        return success(null, null, { folded: cut, bytes: bytes.length });
       });
-    if (code === "EEXIST" || code === "file_lock_timeout" || code === "file_lock_stale" || isTransientWindowsError(error)) {
-      let lock = null;
-      try {
-        lock = parseMetadataLockOrNull(fs6.readFileSync(this.lockPath, "utf8"));
-      } catch {}
-      if (lock?.externalAction)
-        return failure2("writer_conflict", "workspace is reserved by a managed external action", {
-          outcome: "not_started",
-          path: this.lockPath
-        });
-      if (contention === "busy")
-        return failure2("busy", `workspace metadata lock is held by another Workit call${lock ? ` (pid ${lock.pid} on ${lock.host})` : ""}; retry shortly`, {
-          outcome: "not_started",
-          path: this.lockPath,
-          guidance: "Retry the same call. If it stays busy, run `workit doctor --fix-lock` to clear a lock left by a dead process."
+    } catch (error) {
+      return failure2("storage_error", `compaction failed: ${String(error)}`, { taskId });
+    }
+  }
+  countEvents(file) {
+    try {
+      const bytes = fs8.readFileSync(file);
+      let count = 0;
+      for (let index = bytes.indexOf(10);index >= 0; index = bytes.indexOf(10, index + 1))
+        count += 1;
+      return count;
+    } catch {
+      return 0;
+    }
+  }
+  openTasksForKey(key) {
+    const all = this.listStoreIndex();
+    if (!all.ok)
+      return all;
+    const location = this.location();
+    const renames = location.ok ? branchRenames(location.data) : [];
+    return success(null, null, all.data.filter((entry) => entry.key !== null && entry.status !== "closed").filter((entry) => (renames.length ? followRenames(entry.key, entry.boundAt ?? entry.createdAt, renames) : entry.key) === key).toSorted(oldestFirst));
+  }
+  openTaskForKey(key) {
+    const bound = this.openTasksForKey(key);
+    return bound.ok ? success(null, null, bound.data[0] ?? null) : bound;
+  }
+  withKeyLock(key, operation) {
+    const digest = createHash6("sha256").update(key).digest("hex").slice(0, 32);
+    return this.withLock(path9.join(this.paths().dir, "keys", `${digest}.lock`), operation);
+  }
+  bindLocked(taskId, key, timestamp) {
+    const current = this.readWorkspace();
+    if (!current.ok)
+      return current;
+    let workspace = current.data;
+    if (!workspace) {
+      workspace = this.nextWorkspace(null);
+      const written = this.writeWorkspace(workspace);
+      if (!written.ok)
+        return written;
+    }
+    const target = workspace;
+    return this.withLock(this.taskLockPath(taskId), () => {
+      const loaded = this.load(taskId);
+      if (!loaded.ok)
+        return loaded;
+      if (!loaded.data)
+        return failure2("not_found", "task not found", { taskId });
+      if (loaded.data.record.status === "closed")
+        return failure2("invalid_transition", "a closed task cannot be adopted", { taskId });
+      if (loaded.data.record.workspaceId === target.id && loaded.data.key?.key === key.key)
+        return success(loaded.data.record.revision, null, loaded.data.record);
+      const next = taskRecordSchema.safeParse({
+        ...loaded.data.record,
+        workspaceId: target.id,
+        revision: newRevision(),
+        updatedAt: timestamp ?? now(),
+        runtime: stampNew(loaded.data.record)
+      });
+      if (!next.success)
+        return failure2("invalid_input", "rebound task is invalid");
+      const written = this.appendPatch(loaded.data, next.data, { key });
+      return written.ok ? success(next.data.revision, null, next.data) : written;
+    });
+  }
+  unbindLocked(taskId) {
+    return this.withLock(this.taskLockPath(taskId), () => {
+      const loaded = this.load(taskId);
+      if (!loaded.ok)
+        return loaded;
+      if (!loaded.data || loaded.data.key === null)
+        return success(null, null, null);
+      return this.appendPatch(loaded.data, loaded.data.record, { key: null });
+    });
+  }
+  createLocked(value, bindCurrent, key, checkRevision = true) {
+    const current = this.readWorkspace();
+    if (!current.ok)
+      return current;
+    if (checkRevision && (current.data ? value.expectedWorkspaceRevision !== current.data.revision : value.expectedWorkspaceRevision !== null))
+      return failure2("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", {
+        expectedWorkspaceRevision: value.expectedWorkspaceRevision,
+        actualWorkspaceRevision: current.data?.revision ?? null
+      });
+    if (!value.provenance)
+      return failure2("invalid_input", "provenance is required");
+    if (!intentSchema.safeParse(value.intent).success || !provenanceSchema.safeParse(value.provenance).success)
+      return failure2("invalid_input", "task intent or provenance is invalid");
+    if (bindCurrent) {
+      const currentKey = this.currentKey();
+      if (currentKey.ok)
+        return this.withKeyLock(currentKey.data.key, () => {
+          const holder = this.openTaskForKey(currentKey.data.key);
+          if (!holder.ok)
+            return holder;
+          if (holder.data) {
+            const released = this.unbindLocked(holder.data.id);
+            if (!released.ok)
+              return released;
+          }
+          return this.newTask(value, current.data, currentKey.data);
         });
     }
-    const recovery = code === "EEXIST" || code === "file_lock_timeout" || code === "file_lock_stale" || code === "metadata_lock_invalid" || code === "not-file" || /metadata lock|file lock|reclaim/i.test(String(value?.message ?? error));
-    return failure2(recovery ? "recovery_required" : "storage_error", `metadata lock operation failed: ${String(error)}`, { path: this.lockPath });
+    return this.newTask(value, current.data, key);
+  }
+  newTask(value, previous, binding) {
+    const current = { data: previous };
+    const workspace = this.nextWorkspace(current.data);
+    const timestamp = value.now ?? now();
+    const task = {
+      schemaVersion: SCHEMA_VERSION,
+      id: newId(),
+      workspaceId: workspace.id,
+      revision: newRevision(),
+      createdAt: timestamp,
+      updatedAt: timestamp,
+      origin: null,
+      intent: {
+        id: newId(),
+        recordedAt: timestamp,
+        provenance: value.provenance,
+        data: value.intent
+      },
+      constraints: [],
+      status: "active",
+      closure: null,
+      progress: { summary: "", nextAction: null, blockers: [] },
+      runtime: { createdWith: runtimeVersion(), updatedWith: runtimeVersion() },
+      assessments: [],
+      policy: null,
+      policyChanges: [],
+      candidates: [],
+      evidence: [],
+      decisions: [],
+      findings: [],
+      workers: []
+    };
+    return this.writeNewTask(current.data, workspace, task, "task.opened", binding, {
+      operation: "create"
+    });
+  }
+  nextWorkspace(current, id) {
+    return current ? { ...current, revision: newRevision(), root: this.root, runtime: stampNew(current) } : {
+      schemaVersion: SCHEMA_VERSION,
+      id: id ?? newId(),
+      revision: newRevision(),
+      root: this.root,
+      runtime: { createdWith: runtimeVersion(), updatedWith: runtimeVersion() },
+      writer: null
+    };
+  }
+  writeNewTask(previous, workspace, task, type, key, details) {
+    const written = this.writeWorkspace(workspace);
+    if (!written.ok)
+      return written;
+    try {
+      this.openTask(task, type, key);
+    } catch (error) {
+      if (previous) {
+        const restored = this.writeWorkspace(previous);
+        if (!restored.ok)
+          return failure2("external_outcome_unknown", `task ${details.operation} failed and workspace restoration is uncertain`, { ...details, outcome: "unknown" });
+      }
+      return failure2("external_outcome_unknown", `workspace written but the task log is uncertain: ${String(error)}`, { ...details, outcome: "unknown" });
+    }
+    return success(task.revision, workspace.revision, task);
+  }
+  writeWorkspace(record) {
+    const file = this.paths().workspace;
+    try {
+      fs8.mkdirSync(path9.dirname(file), { recursive: true });
+      replaceFile(file, `${canonicalJson(record)}
+`, true);
+      return success(null, null, null);
+    } catch (error) {
+      return failure2("storage_error", `workspace write failed: ${String(error)}`, { path: file });
+    }
+  }
+  markUncertain(workspace) {
+    if (!workspace.writer || workspace.writer.state === "uncertain")
+      return;
+    this.writeWorkspace({
+      ...workspace,
+      writer: { ...workspace.writer, state: "uncertain" },
+      revision: newRevision(),
+      runtime: stampNew(workspace)
+    });
+  }
+  readIndex() {
+    try {
+      const value = JSON.parse(fs8.readFileSync(this.paths().index, "utf8"));
+      if (!isObject4(value) || value.version !== INDEX_VERSION || !isObject4(value.tasks))
+        return {};
+      const tasks = {};
+      for (const [id, entry] of Object.entries(value.tasks))
+        if (isObject4(entry) && entry.id === id && typeof entry.file === "string" && typeof entry.status === "string" && typeof entry.updatedAt === "string" && typeof entry.workspaceId === "string" && Array.isArray(entry.sessions) && isObject4(entry.progress) && isObject4(entry.source))
+          tasks[id] = entry;
+      return tasks;
+    } catch {
+      return {};
+    }
   }
-  initializeMutationStorage() {
-    retryTransient(() => fs6.mkdirSync(this.tasksDir, { recursive: true }));
-    retryTransient(() => fs6.mkdirSync(this.recoveryDir, { recursive: true }));
-    let current = null;
+  writeIndex(entries) {
     try {
-      current = retryTransient(() => fs6.readFileSync(this.gitignorePath, "utf8"));
+      fs8.mkdirSync(this.paths().tasks, { recursive: true });
+      replaceFile(this.paths().index, JSON.stringify({
+        version: INDEX_VERSION,
+        tasks: Object.fromEntries(entries.map((entry) => [entry.id, entry]))
+      }), false);
+    } catch {}
+  }
+  indexTask(task, key, legacy) {
+    try {
+      const signature = fileSignature(this.eventsPath(task.id));
+      if (signature === null)
+        return;
+      const tasks = this.readIndex();
+      tasks[task.id] = indexEntry(task, key, legacy, signature);
+      this.writeIndex(Object.values(tasks));
     } catch {}
-    if (current !== `*
-`)
-      retryTransient(() => fs6.writeFileSync(this.gitignorePath, `*
-`));
   }
-  replaceSnapshot(file, value, previous) {
-    let temporary;
+  parseTask(record, taskId) {
+    const parsed = this.parseValue(record, taskRecordSchema, "task");
+    if (!parsed.ok)
+      return { ...parsed, details: { ...parsed.details, taskId } };
+    if (parsed.data.id !== taskId)
+      return failure2("recovery_required", "task log and record ID differ", { taskId });
+    return parsed;
+  }
+  parseRecord(bytes, schema, label) {
+    let value;
     try {
-      if (Buffer.isBuffer(previous))
-        this.saveRecovery(file, previous);
-      else if (previous !== null && typeof previous === "object")
-        this.saveRecovery(file, jsonBytes(previous));
-      else if (typeof previous === "string")
-        this.saveRecovery(file, previous);
-      temporary = `${file}.${process.pid}.${randomUUID2()}.tmp`;
-      const fd = fs6.openSync(temporary, "wx", 384);
+      value = JSON.parse(bytes);
+    } catch {
+      return failure2("recovery_required", `${label} record JSON is corrupt`);
+    }
+    return this.parseValue(value, schema, label);
+  }
+  parseValue(value, schema, label) {
+    if (isObject4(value) && "schemaVersion" in value && value.schemaVersion !== SCHEMA_VERSION)
+      return failure2("unsupported_version", `unsupported ${label} schema version`);
+    const parsed = parseStoredRecord(schema, value);
+    if (parsed.success)
+      return success(null, null, parsed.data);
+    const writerVersion = isObject4(value) && isObject4(value.runtime) ? value.runtime.updatedWith : null;
+    if (parsed.critical.length > 0)
+      return failure2("recovery_required", `${label} record requires fields this Workit cannot read (${parsed.critical.join(", ")}); upgrade Workit before mutating this checkout`);
+    if (typeof writerVersion === "string" && isNewerVersion(writerVersion, runtimeVersion()))
+      return failure2("recovery_required", `${label} record was written by workit ${writerVersion}; upgrade Workit before mutating this checkout`);
+    return failure2("recovery_required", `${label} record does not satisfy its schema`);
+  }
+  conflict(expected, actual) {
+    return failure2("revision_conflict", "snapshot revision does not match; omit expectedRevision to use the current record", { expectedRevision: expected, actualRevision: actual });
+  }
+  workspaceConflict(expected, actual) {
+    return failure2("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", { expectedWorkspaceRevision: expected, actualWorkspaceRevision: actual });
+  }
+  v2Dirs() {
+    return [...new Set([this.root, this.origin])].map((dir) => path9.join(dir, ".workit"));
+  }
+  pendingMigrations() {
+    return this.v2Dirs().filter((dir) => {
+      const raw = this.readV2Workspace(path9.join(dir, "workspace.json"));
+      return raw !== null && raw !== TOMBSTONE;
+    });
+  }
+  migrateV2(v2) {
+    const dirs = this.paths();
+    const v2Workspace = path9.join(v2, "workspace.json");
+    const v2Tasks = path9.join(v2, "tasks");
+    const legacy = path9.join(dirs.dir, "legacy", checkoutSlug(path9.dirname(v2)), "v2");
+    const raw = this.readV2Workspace(v2Workspace);
+    if (raw === null || raw === TOMBSTONE)
+      return success(null, null, null);
+    return this.withLock(dirs.checkoutLock, () => this.withLock(path9.join(v2, "metadata.lock"), () => {
+      const workspace = this.readV2Workspace(v2Workspace);
+      if (workspace === null || workspace === TOMBSTONE)
+        return success(null, null, null);
+      const parsedWorkspace = this.parseRecord(workspace.bytes, workspaceRecordSchema, "2.x workspace");
+      if (!parsedWorkspace.ok)
+        return failure2("recovery_required", `cannot migrate the 2.x store at ${v2}: ${parsedWorkspace.error}; move it aside to start fresh`, { path: v2Workspace });
+      let files = [];
+      try {
+        files = fs8.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path9.join(v2Tasks, name)));
+      } catch {}
+      const current = this.readWorkspace();
+      if (!current.ok)
+        return current;
+      let workspaceMoved = false;
+      let target = current.data;
+      if (!target) {
+        target = { ...parsedWorkspace.data, root: this.root };
+        const written = this.writeWorkspace(target);
+        if (!written.ok)
+          return written;
+        workspaceMoved = true;
+      }
+      let migrated = 0;
+      let skipped = 0;
+      const done = new Map;
+      try {
+        fs8.mkdirSync(path9.join(legacy, "tasks"), { recursive: true });
+        for (const name of ["workspace.json", "index.json"])
+          if (fs8.existsSync(path9.join(v2, name)))
+            fs8.copyFileSync(path9.join(v2, name), path9.join(legacy, name));
+        for (const name of files) {
+          const id = name.slice(0, -5);
+          const file = path9.join(v2Tasks, name);
+          const bytes = fs8.readFileSync(file, "utf8");
+          const digest = sha256(bytes);
+          fs8.writeFileSync(path9.join(legacy, "tasks", name), bytes);
+          const parsed = this.parseRecord(bytes, taskRecordSchema, "2.x task");
+          if (!parsed.ok || parsed.data.id !== id)
+            return failure2("recovery_required", `cannot migrate 2.x task ${id}: ${parsed.ok ? "file name and record ID differ" : parsed.error}; move ${file} aside to continue`, { path: file });
+          const record = { ...parsed.data, workspaceId: target.id };
+          const origin = { path: path9.join(legacy, "tasks", name), digest };
+          if (!fs8.existsSync(this.eventsPath(id))) {
+            this.openTask(record, "migrated.from_v2", null, origin);
+            migrated += 1;
+          } else {
+            const resynced = this.withLock(this.taskLockPath(id), () => {
+              const loaded = this.load(id);
+              if (!loaded.ok)
+                return loaded;
+              if (!loaded.data)
+                return failure2("not_found", "task not found", { taskId: id });
+              if (loaded.data.legacy?.digest === digest)
+                return success(null, null, false);
+              const appended = this.appendPatch(loaded.data, record, {
+                type: "migrated.from_v2",
+                legacy: origin
+              });
+              return appended.ok ? success(null, null, true) : appended;
+            });
+            if (!resynced.ok)
+              return resynced;
+            if (resynced.data)
+              migrated += 1;
+            else
+              skipped += 1;
+          }
+          done.set(name, digest);
+        }
+      } catch (error) {
+        return failure2("storage_error", `cannot migrate the 2.x store at ${v2}: ${String(error)}`, {
+          path: v2
+        });
+      }
+      try {
+        let complete = true;
+        for (const [name, digest] of done) {
+          const file = path9.join(v2Tasks, name);
+          if (sha256(fs8.readFileSync(file, "utf8")) !== digest) {
+            complete = false;
+            continue;
+          }
+          replaceFile(file, this.stubFor(name.slice(0, -5)), false);
+        }
+        if (!complete)
+          return failure2("busy", `the 2.x store at ${v2} changed during migration; retry`, {
+            path: v2
+          });
+        fs8.rmSync(path9.join(v2, "index.json"), { force: true });
+        this.writeTombstone(v2, target.id);
+      } catch (error) {
+        return failure2("storage_error", `cannot finish the 2.x migration: ${String(error)}`, {
+          path: v2
+        });
+      }
+      reportMigration({
+        from: v2,
+        to: dirs.dir,
+        backup: legacy,
+        tasks: migrated,
+        skipped,
+        workspace: workspaceMoved
+      });
+      return success(null, null, null);
+    }));
+  }
+  adoptLocalStore() {
+    const dirs = this.paths();
+    const marker = path9.join(dirs.v2, "store.json");
+    if (!dirs.shared || !fs8.existsSync(marker))
+      return success(null, null, null);
+    return this.withLock(dirs.checkoutLock, () => {
+      if (!fs8.existsSync(marker))
+        return success(null, null, null);
+      let tasks = 0;
       try {
-        fs6.writeSync(fd, jsonBytes(value));
-        fs6.fsyncSync(fd);
-      } finally {
-        fs6.closeSync(fd);
+        const merge = (from, to) => {
+          if (!fs8.existsSync(to)) {
+            fs8.mkdirSync(path9.dirname(to), { recursive: true });
+            try {
+              fs8.renameSync(from, to);
+            } catch {
+              fs8.cpSync(from, to, { recursive: true, errorOnExist: true, force: false });
+              fs8.rmSync(from, { recursive: true, force: true });
+            }
+            return;
+          }
+          if (fs8.lstatSync(from).isDirectory() && fs8.lstatSync(to).isDirectory())
+            for (const name of fs8.readdirSync(from))
+              merge(path9.join(from, name), path9.join(to, name));
+        };
+        for (const sub of ["tasks", "checkouts", "blobs", "legacy"]) {
+          const from = path9.join(dirs.v2, sub);
+          if (!fs8.existsSync(from))
+            continue;
+          if (sub === "tasks") {
+            for (const name of fs8.readdirSync(from))
+              if (validId(name) && !fs8.existsSync(path9.join(dirs.dir, sub, name)))
+                tasks += 1;
+          }
+          merge(from, path9.join(dirs.dir, sub));
+        }
+        const ledger = path9.join(dirs.v2, "ledger");
+        if (fs8.existsSync(ledger) && !fs8.existsSync(path9.join(dirs.dir, "ledger")))
+          merge(ledger, path9.join(dirs.dir, "ledger"));
+        fs8.rmSync(path9.join(dirs.v2, "task-index.json"), { force: true });
+        fs8.renameSync(marker, path9.join(dirs.v2, "store.moved.json"));
+      } catch (error) {
+        return failure2("storage_error", `cannot move ${dirs.v2} into ${dirs.dir}: ${String(error)}`, {
+          path: dirs.v2
+        });
       }
-      retryTransient(() => fs6.renameSync(temporary, file));
-      temporary = undefined;
-      this.fsyncDirectory(path7.dirname(file));
-      if (path7.dirname(file) === this.tasksDir)
-        this.indexTaskWrite(file, value);
-      return success(null, null, value);
-    } catch (error) {
-      return failure2("storage_error", `snapshot replacement failed: ${String(error)}`, {
-        path: file
+      reportMigration({
+        from: dirs.v2,
+        to: dirs.dir,
+        backup: dirs.v2,
+        tasks,
+        skipped: 0,
+        workspace: false
       });
-    } finally {
-      if (temporary)
-        try {
-          fs6.unlinkSync(temporary);
-        } catch {}
-    }
+      return success(null, null, null);
+    });
   }
-  readIndex(workspaceId) {
+  readV2Workspace(file) {
+    let bytes;
     try {
-      const value = JSON.parse(fs6.readFileSync(this.indexPath, "utf8"));
-      if (!isObject2(value) || value.version !== INDEX_VERSION || value.workspaceId !== workspaceId || !isObject2(value.tasks))
-        return {};
-      const tasks = {};
-      for (const [id, entry] of Object.entries(value.tasks))
-        if (isObject2(entry) && entry.id === id && typeof entry.file === "string" && typeof entry.status === "string" && typeof entry.updatedAt === "string" && Array.isArray(entry.sessions) && isObject2(entry.progress) && isObject2(entry.source))
-          tasks[id] = entry;
-      return tasks;
+      bytes = fs8.readFileSync(file, "utf8");
     } catch {
-      return {};
+      return null;
     }
+    try {
+      const value = JSON.parse(bytes);
+      if (isObject4(value) && isObject4(value.store) && value.store.format === "workit-store")
+        return TOMBSTONE;
+    } catch {}
+    return { bytes };
+  }
+  writeTombstone(v2, workspaceId) {
+    const dirs = this.paths();
+    const version = isNewerVersion(runtimeVersion(), STORE_MIN_RUNTIME) ? runtimeVersion() : STORE_MIN_RUNTIME;
+    const marker = {
+      schemaVersion: SCHEMA_VERSION,
+      id: workspaceId ?? newId(),
+      revision: newRevision(),
+      root: path9.dirname(v2),
+      runtime: { createdWith: version, updatedWith: version },
+      writer: null,
+      store: {
+        format: "workit-store",
+        version: STORE_FORMAT,
+        path: dirs.dir,
+        note: `workit ${STORE_MIN_RUNTIME}+ keeps task state in ${dirs.dir}; upgrade Workit`
+      },
+      critical: ["store"]
+    };
+    fs8.mkdirSync(v2, { recursive: true });
+    const ignore = path9.join(v2, ".gitignore");
+    if (!fs8.existsSync(ignore))
+      fs8.writeFileSync(ignore, `*
+`);
+    replaceFile(path9.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
+`, true);
+  }
+  stubFor(taskId) {
+    const version = isNewerVersion(runtimeVersion(), STORE_MIN_RUNTIME) ? runtimeVersion() : STORE_MIN_RUNTIME;
+    return `${JSON.stringify({
+      schemaVersion: SCHEMA_VERSION,
+      id: taskId,
+      runtime: { createdWith: version, updatedWith: version },
+      store: { format: "workit-store", version: STORE_FORMAT, path: this.paths().dir },
+      critical: ["store"]
+    })}
+`;
   }
-  writeIndex(workspaceId, entries) {
-    const temporary = `${this.indexPath}.${process.pid}.${randomUUID2()}.tmp`;
+  isStub(file) {
     try {
-      fs6.writeFileSync(temporary, JSON.stringify({
-        version: INDEX_VERSION,
-        workspaceId,
-        tasks: Object.fromEntries(entries.map((entry) => [entry.id, entry]))
-      }), { mode: 384, flag: "wx" });
-      retryTransient(() => fs6.renameSync(temporary, this.indexPath));
+      const value = JSON.parse(fs8.readFileSync(file, "utf8"));
+      return isObject4(value) && isObject4(value.store) && value.store.format === "workit-store";
     } catch {
-      try {
-        fs6.unlinkSync(temporary);
-      } catch {}
+      return false;
     }
   }
-  indexTaskWrite(file, task) {
+  writeTombstoneIfMissing() {
     try {
-      const signature = fileSignature(file);
-      if (signature === null)
+      const v2 = path9.join(this.root, ".workit");
+      if (fs8.existsSync(path9.join(v2, "workspace.json")))
         return;
-      const tasks = this.readIndex(task.workspaceId);
-      tasks[task.id] = indexEntry(task, signature);
-      this.writeIndex(task.workspaceId, Object.values(tasks));
-    } catch {}
-  }
-  saveRecovery(file, bytes) {
-    const target = path7.basename(file) === "workspace.json" ? "workspace" : "task";
-    const id = target === "task" ? path7.basename(file, ".json") : "workspace";
-    const destination = path7.join(this.recoveryDir, `${target}.${id}.${digestBytes(bytes)}.json`);
-    if (fs6.existsSync(destination)) {
-      if (digestBytes(retryTransient(() => fs6.readFileSync(destination))) !== digestBytes(bytes))
-        throw new Error("recovery copy already exists with different bytes");
-      const stamp = new Date;
-      retryTransient(() => fs6.utimesSync(destination, stamp, stamp));
-      this.pruneRecovery(`${target}.${id}.`, destination);
-      return;
-    }
-    let temporary;
-    try {
-      temporary = `${destination}.${process.pid}.${randomUUID2()}.tmp`;
-      const fd = fs6.openSync(temporary, "wx", 384);
+      let id = null;
       try {
-        fs6.writeSync(fd, bytes);
-        fs6.fsyncSync(fd);
-      } finally {
-        fs6.closeSync(fd);
-      }
-      retryTransient(() => fs6.renameSync(temporary, destination));
-      temporary = undefined;
-      this.fsyncDirectory(this.recoveryDir);
-      this.pruneRecovery(`${target}.${id}.`, destination);
-    } finally {
-      if (temporary)
-        try {
-          fs6.unlinkSync(temporary);
-        } catch {}
-    }
-  }
-  pruneRecovery(prefix, keep) {
-    try {
-      const copies = this.recoveryCopies(prefix);
-      const surplus = this.surplusCopies(copies, path7.basename(keep));
-      for (const copy of surplus)
-        fs6.rmSync(copy.path, { force: true });
+        id = JSON.parse(fs8.readFileSync(this.paths().workspace, "utf8")).id ?? null;
+      } catch {}
+      this.writeTombstone(v2, id);
     } catch {}
   }
-  recoveryCopies(prefix = "") {
-    if (!fs6.existsSync(this.recoveryDir))
-      return [];
-    const copies = [];
-    for (const name of fs6.readdirSync(this.recoveryDir)) {
-      if (!name.startsWith(prefix))
-        continue;
-      const match = RECOVERY_NAME.exec(name);
-      if (!match)
-        continue;
-      const file = path7.join(this.recoveryDir, name);
+  initializeStorage() {
+    const dirs = this.paths();
+    retryTransient(() => fs8.mkdirSync(dirs.checkout, { recursive: true }));
+    retryTransient(() => fs8.mkdirSync(dirs.tasks, { recursive: true }));
+    if (!fs8.existsSync(dirs.marker))
+      replaceFile(dirs.marker, `${JSON.stringify({ format: "workit-store", version: STORE_FORMAT, createdWith: runtimeVersion() })}
+`, false);
+    if (!dirs.shared) {
+      const ignore = path9.join(dirs.dir, ".gitignore");
+      let current = null;
       try {
-        const stat = fs6.lstatSync(file, { bigint: true });
-        if (!stat.isFile())
-          continue;
-        copies.push({ name, path: file, group: `${match[1]}.${match[2]}`, mtimeNs: stat.mtimeNs });
+        current = fs8.readFileSync(ignore, "utf8");
       } catch {}
+      if (current !== `*
+`)
+        retryTransient(() => fs8.writeFileSync(ignore, `*
+`));
     }
-    return copies;
-  }
-  surplusCopies(copies, keep) {
-    const ordered = copies.toSorted((left, right) => left.name === keep ? -1 : right.name === keep ? 1 : left.mtimeNs === right.mtimeNs ? left.name.localeCompare(right.name) : left.mtimeNs > right.mtimeNs ? -1 : 1);
-    return ordered.slice(RECOVERY_COPIES_PER_RECORD);
+    this.writeTombstoneIfMissing();
   }
-  collectGarbage(options = {}) {
-    const dryRun = options.dryRun === true;
-    const report = {
-      dryRun,
-      recovery: { removed: 0, removedBytes: 0, kept: 0 },
-      temporary: { removed: 0 },
-      candidates: { removed: 0, tasks: [], skippedActive: [], skippedClosed: [], failed: [] }
+  lockOptions(lockPath) {
+    const inProcess = heldInProcess.has(lockPath);
+    return {
+      lockPath,
+      staleMs: Number.MAX_SAFE_INTEGER,
+      timeoutMs: inProcess ? 0 : this.lockTimeoutMs,
+      retry: inProcess ? { retries: 0 } : { minTimeout: 5, maxTimeout: 100, factor: 1.5, randomize: true },
+      staleRecovery: "remove-if-unchanged",
+      shouldReclaim: ({ payload, nowMs }) => {
+        let ageMs = null;
+        try {
+          ageMs = nowMs - fs8.lstatSync(lockPath).mtimeMs;
+        } catch {}
+        return classifyLockOwner(payload, ageMs).state === "stale";
+      },
+      shouldRemoveStaleLock: () => true,
+      parsePayload: parseMetadataLockOrNull,
+      payload: () => ({
+        pid: process.pid,
+        processStart: processStartOf(process.pid),
+        host: localLockHost(),
+        nonce: randomUUID3()
+      })
     };
-    if (!fs6.existsSync(this.workitDir))
-      return success(null, null, report);
-    const sweep = () => {
+  }
+  acquire(lockPath, options) {
+    clearAbandonedReclaimGuard(lockPath);
+    const deadline = Date.now() + (options.timeoutMs ?? 0);
+    while (true) {
       try {
-        const groups = new Map;
-        for (const copy of this.recoveryCopies())
-          groups.set(copy.group, [...groups.get(copy.group) ?? [], copy]);
-        for (const copies of groups.values()) {
-          const surplus = this.surplusCopies(copies);
-          report.recovery.kept += copies.length - surplus.length;
-          for (const copy of surplus) {
-            report.recovery.removed += 1;
-            try {
-              report.recovery.removedBytes += fs6.statSync(copy.path).size;
-            } catch {}
-            if (!dryRun)
-              fs6.rmSync(copy.path, { force: true });
-          }
-        }
-        const nowMs = Date.now();
-        for (const directory of [this.recoveryDir, this.tasksDir, this.workitDir]) {
-          if (!fs6.existsSync(directory))
-            continue;
-          for (const name of fs6.readdirSync(directory)) {
-            if (!name.endsWith(".tmp") && !name.endsWith(".probe"))
-              continue;
-            const file = path7.join(directory, name);
-            const stat = fs6.lstatSync(file);
-            if (!stat.isFile() || nowMs - stat.mtimeMs <= STALE_TEMPORARY_MS)
-              continue;
-            report.temporary.removed += 1;
-            if (!dryRun)
-              fs6.rmSync(file, { force: true });
-          }
-        }
-        return success(null, null, null);
-      } catch (error) {
-        return failure2("storage_error", `garbage collection failed: ${String(error)}`, {
-          path: this.recoveryDir
+        return acquireFileLockSync(lockPath, {
+          ...options,
+          timeoutMs: Math.max(0, deadline - Date.now())
         });
+      } catch (error) {
+        const code = error?.code;
+        if (code !== "file_lock_stale" && !isTransientWindowsError(error) || Date.now() >= deadline)
+          throw error;
+        if (code !== "file_lock_stale" && !this.lockHolderPresent(lockPath) && !this.lockDirWritable(lockPath))
+          throw error;
+        if (code !== "file_lock_stale")
+          Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5);
       }
-    };
-    const pruned = dryRun ? sweep() : this.withLock(sweep);
-    if (!pruned.ok)
-      return pruned;
-    const tasks = this.listTasks();
-    if (!tasks.ok)
-      return tasks;
-    for (const task of tasks.data) {
-      const deduped = dedupeCandidates(task.candidates);
-      const removed = task.candidates.length - deduped.length;
-      if (removed === 0)
-        continue;
-      if (task.status === "active") {
-        report.candidates.skippedActive.push(task.id);
-        continue;
-      }
-      if (task.status === "closed") {
-        report.candidates.skippedClosed.push(task.id);
-        continue;
-      }
-      if (!dryRun) {
-        const written = this.mutateTask(task.id, task.revision, (current) => success(current.revision, null, {
-          ...current,
-          candidates: dedupeCandidates(current.candidates)
-        }));
-        if (!written.ok) {
-          report.candidates.failed.push(task.id);
-          continue;
-        }
-      }
-      report.candidates.removed += removed;
-      report.candidates.tasks.push(task.id);
     }
-    return success(null, null, report);
   }
-  findRecovery(target, taskId, digest, workspace) {
-    if (!fs6.existsSync(this.recoveryDir))
-      return null;
-    const workspaceId = workspace?.id ?? this.trustedWorkspaceId();
-    if (target === "workspace" && !workspaceId)
-      return null;
-    const candidates = this.recoveryCandidates();
-    if (!candidates.ok)
-      return null;
-    for (const candidate of candidates.data) {
-      if (candidate.target !== target || candidate.digest !== digest)
-        continue;
-      try {
-        if (!fs6.lstatSync(candidate.path).isFile())
-          continue;
-        const bytes = fs6.readFileSync(candidate.path);
-        if (digestBytes(bytes) !== digest)
-          continue;
-        if (target === "workspace") {
-          const parsed = this.parseBytes(bytes, workspaceRecordSchema);
-          if (parsed.ok && parsed.data.id === workspaceId && parsed.data.root === this.root)
-            return bytes;
-        } else {
-          const parsed = this.parseBytes(bytes, taskRecordSchema);
-          if (parsed.ok && parsed.data.id === taskId && parsed.data.workspaceId === workspace?.id)
-            return bytes;
-        }
-      } catch {}
+  withLock(lockPath, operation) {
+    try {
+      this.initializeStorage();
+      fs8.mkdirSync(path9.dirname(lockPath), { recursive: true });
+    } catch (error) {
+      return failure2("storage_error", `unable to initialize store: ${String(error)}`, {
+        path: this.paths().dir
+      });
     }
-    return null;
-  }
-  fsyncDirectory(directory) {
+    let handle;
     try {
-      const fd = fs6.openSync(directory, "r");
-      try {
-        fs6.fsyncSync(fd);
-      } finally {
-        fs6.closeSync(fd);
-      }
+      handle = this.acquire(lockPath, this.lockOptions(lockPath));
     } catch (error) {
-      if (process.platform !== "win32")
-        throw error;
+      return this.lockFailure(lockPath, error);
     }
-  }
-  trustedWorkspaceId() {
-    if (!fs6.existsSync(this.tasksDir))
-      return null;
-    const ids = new Set;
+    hold(lockPath);
+    let result;
     try {
-      for (const name of fs6.readdirSync(this.tasksDir)) {
-        if (!name.endsWith(".json") || !validId(name.slice(0, -5)))
-          return null;
-        const parsed = this.parseBytes(fs6.readFileSync(path7.join(this.tasksDir, name)), taskRecordSchema);
-        if (!parsed.ok || parsed.data.id !== name.slice(0, -5))
-          return null;
-        ids.add(parsed.data.workspaceId);
+      if (!handle.verifyStillHeld())
+        result = failure2("recovery_required", "metadata lock was compromised", { path: lockPath });
+      else {
+        try {
+          result = operation();
+        } catch (error) {
+          result = failure2("storage_error", `mutation failed: ${String(error)}`);
+        }
       }
-    } catch {
-      return null;
+    } catch (error) {
+      result = this.lockFailure(lockPath, error);
+    }
+    drop(lockPath);
+    try {
+      retryTransient(() => handle.release());
+    } catch (error) {
+      const released = this.lockFailure(lockPath, error);
+      const releaseError = released.ok ? "metadata lock release failed" : released.error;
+      result = result.ok ? released : failure2("recovery_required", `${result.error}; ${releaseError}`, result.details);
     }
-    return ids.size === 1 ? [...ids][0] : null;
+    return result;
   }
-  snapshotBytes(file) {
+  lockDirWritable(lockPath) {
+    const probe = `${lockPath}.${process.pid}.${randomUUID3()}.probe`;
     try {
-      return retryTransient(() => fs6.readFileSync(file));
+      fs8.closeSync(fs8.openSync(probe, "wx", 384));
     } catch {
-      return null;
+      return false;
     }
+    try {
+      fs8.rmSync(probe, { force: true });
+    } catch {}
+    return true;
   }
-  readRecord(file, schema) {
+  lockHolderPresent(lockPath) {
     try {
-      const bytes = retryTransient(() => fs6.readFileSync(file, "utf8"));
-      return { exists: true, result: this.parseBytes(bytes, schema) };
+      fs8.lstatSync(lockPath);
+      return true;
     } catch (error) {
-      if (error?.code === "ENOENT")
-        return { exists: false, result: success(null, null, null) };
-      return {
-        exists: true,
-        result: failure2("recovery_required", `snapshot cannot be read: ${String(error)}`, {
-          path: file
-        })
-      };
+      return error?.code !== "ENOENT";
     }
   }
-  parseBytes(bytes, schema, mode = "read") {
-    let value;
-    try {
-      value = JSON.parse(typeof bytes === "string" ? bytes : bytes.toString("utf8"));
-    } catch {
-      return failure2("recovery_required", "snapshot JSON is corrupt");
+  lockFailure(lockPath, error) {
+    const value = error;
+    const code = typeof value?.code === "string" ? value.code : "";
+    if (isTransientWindowsError(error) && !this.lockHolderPresent(lockPath) && !this.lockDirWritable(lockPath))
+      return failure2("storage_error", `cannot create the workit lock (${code}); no other Workit call holds it`, {
+        path: lockPath,
+        guidance: `Check permissions and the read-only attribute on ${path9.dirname(lockPath)}.`
+      });
+    if (code === "EEXIST" || code === "file_lock_timeout" || code === "file_lock_stale" || isTransientWindowsError(error)) {
+      let lock = null;
+      try {
+        lock = parseMetadataLockOrNull(fs8.readFileSync(lockPath, "utf8"));
+      } catch {}
+      if (lock?.externalAction)
+        return failure2("writer_conflict", "workspace is reserved by a managed external action", {
+          outcome: "not_started",
+          path: lockPath
+        });
+      return failure2("busy", `workit lock is held by another Workit call${lock ? ` (pid ${lock.pid} on ${lock.host})` : ""}; retry shortly`, {
+        outcome: "not_started",
+        path: lockPath,
+        guidance: "Retry the same call. If it stays busy, run `workit doctor --fix-lock` to clear a lock left by a dead process."
+      });
     }
-    if (isObject2(value) && "schemaVersion" in value && value.schemaVersion !== SCHEMA_VERSION)
-      return failure2("unsupported_version", "unsupported snapshot schema version");
-    const parsed = parseStoredRecord(schema, value);
-    if (parsed.success && (mode === "read" || parsed.stripped.length === 0))
-      return success(null, null, parsed.data);
-    const writerVersion = isObject2(value) && isObject2(value.runtime) ? value.runtime.updatedWith : null;
-    const upgrade = `upgrade Workit before ${parsed.success ? "recovering" : "mutating"} this checkout`;
-    if (parsed.success)
-      return failure2("recovery_required", `snapshot carries fields this Workit cannot preserve (${parsed.stripped.join(", ")}); ${upgrade}`);
-    if (parsed.critical.length > 0)
-      return failure2("recovery_required", `snapshot requires fields this Workit cannot read (${parsed.critical.join(", ")}); ${upgrade}`);
-    if (typeof writerVersion === "string" && isNewerVersion(writerVersion, runtimeVersion()))
-      return failure2("recovery_required", `snapshot was written by workit ${writerVersion}; upgrade Workit before mutating this checkout`);
-    return failure2("recovery_required", "snapshot does not satisfy its schema");
-  }
-  conflict(expected, actual) {
-    return failure2("revision_conflict", "snapshot revision does not match; omit expectedRevision to use the current record", {
-      expectedRevision: expected,
-      actualRevision: actual
-    });
-  }
-  workspaceConflict(expected, actual) {
-    return failure2("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", { expectedWorkspaceRevision: expected, actualWorkspaceRevision: actual });
-  }
-  taskPath(taskId) {
-    return path7.join(this.tasksDir, `${taskId}.json`);
-  }
-  get workitDir() {
-    return path7.join(this.root, ".workit");
-  }
-  get tasksDir() {
-    return path7.join(this.workitDir, "tasks");
-  }
-  get recoveryDir() {
-    return path7.join(this.workitDir, "recovery");
-  }
-  get workspacePath() {
-    return path7.join(this.workitDir, "workspace.json");
-  }
-  get indexPath() {
-    return path7.join(this.workitDir, "index.json");
-  }
-  get lockPath() {
-    return path7.join(this.workitDir, "metadata.lock");
-  }
-  get gitignorePath() {
-    return path7.join(this.workitDir, ".gitignore");
+    const recovery = code === "metadata_lock_invalid" || code === "not-file" || /metadata lock|file lock|reclaim/i.test(String(value?.message ?? error));
+    return failure2(recovery ? "recovery_required" : "storage_error", `lock operation failed: ${String(error)}`, { path: lockPath });
   }
 }
 
@@ -11654,7 +12694,7 @@ var operationAutoClass = (operation) => typeof operation === "string" ? OPERATIO
 var digestOf = (configDirPath) => {
   try {
     const raw = readFileSync4(`${configDirPath}/workspaces.json`, "utf8");
-    return createHash5("sha256").update(raw).digest("hex");
+    return createHash7("sha256").update(raw).digest("hex");
   } catch {
     return null;
   }
@@ -11698,7 +12738,7 @@ var targetOf = (root, descriptor) => {
     const cwd = parsed?.payload?.cwd;
     if (cwd === undefined)
       return root;
-    if (typeof cwd !== "string" || !path8.isAbsolute(cwd))
+    if (typeof cwd !== "string" || !path10.isAbsolute(cwd))
       return null;
     return realpathSync3(cwd);
   } catch {
@@ -11923,11 +12963,11 @@ function applicableDecision(task, purpose, binding, checkoutRoot) {
     return [];
   return task.decisions.filter((entry) => entry.provenance.kind !== "imported" && decisionMatches(entry, purpose, binding) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, entry.data.binding).ok : entry.data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map((entry) => entry.data);
 }
-var digestBytes2 = (bytes) => createHash6("sha256").update(bytes).digest("hex");
+var digestBytes = (bytes) => createHash8("sha256").update(bytes).digest("hex");
 var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
   let root;
   try {
-    root = fs7.realpathSync(checkoutRoot);
+    root = fs9.realpathSync(checkoutRoot);
   } catch {
     return failure2("permission_denied", "checkout root is unavailable");
   }
@@ -11936,23 +12976,23 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
       continue;
     if (!reference.digest)
       return failure2("invalid_input", "document references require a byte digest");
-    const target = path9.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path9.sep}`))
+    const target = path11.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path11.sep}`))
       return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const relative = path9.relative(root, target);
+      const relative = path11.relative(root, target);
       let current = root;
-      for (const segment of relative.split(path9.sep)) {
+      for (const segment of relative.split(path11.sep)) {
         if (!segment)
           continue;
-        current = path9.join(current, segment);
-        const stat = fs7.lstatSync(current);
-        const real = fs7.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path9.sep}`))
+        current = path11.join(current, segment);
+        const stat = fs9.lstatSync(current);
+        const real = fs9.realpathSync(current);
+        if (real !== root && !real.startsWith(`${root}${path11.sep}`))
           return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -11968,7 +13008,7 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
         if (current !== target && !stat.isDirectory())
           return failure2("invalid_input", "document reference ancestor is not a directory");
       }
-      if (digestBytes2(fs7.readFileSync(target)) !== reference.digest)
+      if (digestBytes(fs9.readFileSync(target)) !== reference.digest)
         return failure2("permission_denied", "approved document bytes have changed");
     } catch {
       return failure2("invalid_input", "approved document is unavailable");
@@ -12332,9 +13372,9 @@ var bindingCovers = scopeCovers;
 var verifyDecisionContent = verifyContentRefs;
 
 // packages/workit-core/src/check-config.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
-import fs8 from "node:fs";
-import path10 from "node:path";
+import { spawnSync as spawnSync4 } from "node:child_process";
+import fs10 from "node:fs";
+import path12 from "node:path";
 var SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
 var CHECKS_FILE = "workit.checks.json";
 var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -12376,7 +13416,7 @@ function splitCommand(command) {
   return argv.length ? argv : new Error("empty command");
 }
 var git = (cwd, args) => {
-  const run = spawnSync3("git", args, {
+  const run = spawnSync4("git", args, {
     cwd,
     encoding: "utf8",
     timeout: 20000,
@@ -12387,10 +13427,10 @@ var git = (cwd, args) => {
   return value || null;
 };
 function checkRoot(cwd) {
-  return path10.resolve(git(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
+  return path12.resolve(git(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
 }
 var packageManager = (root) => {
-  const has = (file) => fs8.existsSync(path10.join(root, file));
+  const has = (file) => fs10.existsSync(path12.join(root, file));
   if (has("bun.lock") || has("bun.lockb"))
     return "bun";
   if (has("pnpm-lock.yaml"))
@@ -12410,7 +13450,7 @@ var CHECK_NAME = /^[a-z0-9][a-z0-9:._-]{0,63}$/u;
 function detectedChecks(root) {
   const read = (file) => {
     try {
-      return fs8.readFileSync(path10.join(root, file), "utf8");
+      return fs10.readFileSync(path12.join(root, file), "utf8");
     } catch {
       return null;
     }
@@ -12449,7 +13489,7 @@ function detectedChecks(root) {
 var GATES = ["testing", "verification"];
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
-  const file = path10.join(root, CHECKS_FILE);
+  const file = path12.join(root, CHECKS_FILE);
   const none = (error = null) => ({
     source: error ? CHECKS_FILE : "none",
     root,
@@ -12459,7 +13499,7 @@ function loadCheckConfig(cwd) {
   });
   let text = null;
   try {
-    text = fs8.readFileSync(file, "utf8");
+    text = fs10.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
       return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
@@ -12522,10 +13562,10 @@ function workitAvailable(env = process.env) {
     return workitOnPath;
   const windows = process.platform === "win32";
   const exts = windows ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
-  const dirs = (env.PATH ?? env.Path ?? "").split(path10.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path12.delimiter).filter(Boolean);
   workitOnPath = dirs.some((dir) => exts.some((ext) => {
     try {
-      return fs8.statSync(path10.join(dir, `workit${ext}`)).isFile();
+      return fs10.statSync(path12.join(dir, `workit${ext}`)).isFile();
     } catch {
       return false;
     }
@@ -12537,15 +13577,15 @@ function checkCommand(args, version, onPath = workitAvailable()) {
 }
 
 // packages/workit-core/src/git/rev.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
-import { createHash as createHash7 } from "node:crypto";
-import fs9 from "node:fs";
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { createHash as createHash9 } from "node:crypto";
+import fs11 from "node:fs";
 import os2 from "node:os";
-import path11 from "node:path";
+import path13 from "node:path";
 var MAX_BUFFER = 256 * 1024 * 1024;
 var GIT_TIMEOUTS = { local: 20000, worktree: 120000, network: 15000 };
 var git2 = (cwd, args, options = {}) => {
-  const result = spawnSync4("git", args, {
+  const result = spawnSync5("git", args, {
     cwd,
     encoding: "utf8",
     env: options.env ?? process.env,
@@ -12575,10 +13615,10 @@ function headSha(cwd) {
 var emptyTree = (cwd) => line(git2(cwd, ["mktree"], { input: "" }));
 var MAX_UNTRACKED_BYTES = 5 * 1024 * 1024;
 var seedIndex = (from, to) => {
-  fs9.copyFileSync(from, to);
-  const { atimeNs, mtimeNs } = fs9.statSync(from, { bigint: true });
+  fs11.copyFileSync(from, to);
+  const { atimeNs, mtimeNs } = fs11.statSync(from, { bigint: true });
   const seconds = (ns) => (Number(ns / 1000n) - 1) / 1e6;
-  fs9.utimesSync(to, seconds(atimeNs), seconds(mtimeNs));
+  fs11.utimesSync(to, seconds(atimeNs), seconds(mtimeNs));
 };
 function worktreeTree(cwd, options = {}) {
   const top = line(git2(cwd, ["rev-parse", "--show-toplevel"]));
@@ -12587,10 +13627,10 @@ function worktreeTree(cwd, options = {}) {
     return null;
   const cap = options.maxUntrackedBytes ?? MAX_UNTRACKED_BYTES;
   const timeoutMs = options.timeoutMs ?? GIT_TIMEOUTS.worktree;
-  const scratch = fs9.mkdtempSync(path11.join(os2.tmpdir(), "workit-tree-"));
+  const scratch = fs11.mkdtempSync(path13.join(os2.tmpdir(), "workit-tree-"));
   try {
-    const tempIndex = path11.join(scratch, "index");
-    if (fs9.existsSync(indexPath))
+    const tempIndex = path13.join(scratch, "index");
+    if (fs11.existsSync(indexPath))
       seedIndex(indexPath, tempIndex);
     const env = { ...process.env, GIT_INDEX_FILE: tempIndex };
     const untracked = git2(top, ["ls-files", "--others", "--exclude-standard", "-z"], {
@@ -12602,7 +13642,7 @@ function worktreeTree(cwd, options = {}) {
     const skipped = [];
     for (const file of untracked.stdout.split("\x00").filter(Boolean)) {
       try {
-        const stat = fs9.statSync(path11.join(top, file));
+        const stat = fs11.statSync(path13.join(top, file));
         if (stat.isFile() && stat.size > cap)
           skipped.push({ path: file, size: stat.size, mtimeMs: Math.trunc(stat.mtimeMs) });
       } catch {}
@@ -12619,10 +13659,10 @@ function worktreeTree(cwd, options = {}) {
     if (!tree)
       return null;
     const base = line(git2(top, ["rev-parse", "--verify", "-q", "HEAD^{tree}"])) ?? emptyTree(top);
-    const key = skipped.length ? `sha256:${createHash7("sha256").update(JSON.stringify({ tree, skipped })).digest("hex")}` : tree;
+    const key = skipped.length ? `sha256:${createHash9("sha256").update(JSON.stringify({ tree, skipped })).digest("hex")}` : tree;
     return { tree, key, dirty: tree !== base || skipped.length > 0, skipped };
   } finally {
-    fs9.rmSync(scratch, { recursive: true, force: true });
+    fs11.rmSync(scratch, { recursive: true, force: true });
   }
 }
 function worktreeSignal(cwd, options = {}) {
@@ -12642,16 +13682,16 @@ function worktreeSignal(cwd, options = {}) {
   });
   if (!status.ok)
     return null;
-  const hash = createHash7("sha256");
+  const hash = createHash9("sha256");
   hash.update(`${headSha(top) ?? "unborn"}\x00`);
   for (const entry of status.stdout.split("\x00")) {
     if (entry.length < 4)
       continue;
     const file = entry.slice(3);
-    const absolute = path11.join(top, file);
+    const absolute = path13.join(top, file);
     let stat = "-";
     try {
-      const info = fs9.lstatSync(absolute, { bigint: true });
+      const info = fs11.lstatSync(absolute, { bigint: true });
       stat = `${info.mode.toString(8)}:${info.size}:${info.mtimeNs}`;
       if (info.isDirectory())
         stat += `:${headSha(absolute) ?? "-"}`;
@@ -12662,15 +13702,15 @@ function worktreeSignal(cwd, options = {}) {
 }
 
 // packages/workit-core/src/core/task-evaluation.ts
-var digestBytes3 = (value) => createHash8("sha256").update(value).digest("hex");
-var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path12.sep}`);
-var relative = (root, candidate) => path12.relative(root, candidate).split(path12.sep).join("/") || ".";
+var digestBytes2 = (value) => createHash10("sha256").update(value).digest("hex");
+var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path14.sep}`);
+var relative = (root, candidate) => path14.relative(root, candidate).split(path14.sep).join("/") || ".";
 var canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path12.posix.normalize(value);
+  const normalized = path14.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -12706,7 +13746,7 @@ var compareCodeUnits2 = (left, right) => {
   return left.length - right.length;
 };
 var gitPaths = (root) => {
-  const result = spawnSync5("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const result = spawnSync6("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd: root,
     encoding: "buffer"
   });
@@ -12718,21 +13758,21 @@ var gitPaths = (root) => {
       git: !/not a git repository/i.test(stderr)
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path12.sep).join("/")) : [];
-  const stagedDeleted = spawnSync5("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path14.sep).join("/")) : [];
+  const stagedDeleted = spawnSync6("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path12.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path14.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 };
 var walk = (root, directory, output) => {
   let names;
   try {
-    names = fs10.readdirSync(directory);
+    names = fs12.readdirSync(directory);
   } catch {
     return true;
   }
@@ -12740,10 +13780,10 @@ var walk = (root, directory, output) => {
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path12.join(directory, name);
+    const target = path14.join(directory, name);
     let stat;
     try {
-      stat = fs10.lstatSync(target);
+      stat = fs12.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -12758,14 +13798,14 @@ var walk = (root, directory, output) => {
 var scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path12.resolve(root, item);
+    const target = path14.resolve(root, item);
     if (!inside(root, target))
       return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
-    while (!fs10.existsSync(ancestor) && ancestor !== root)
-      ancestor = path12.dirname(ancestor);
+    while (!fs12.existsSync(ancestor) && ancestor !== root)
+      ancestor = path14.dirname(ancestor);
     try {
-      if (!inside(root, fs10.realpathSync(ancestor)))
+      if (!inside(root, fs12.realpathSync(ancestor)))
         return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
     } catch {
       return failure2("invalid_input", `candidate scope cannot be inspected: ${item}`);
@@ -12777,7 +13817,7 @@ var scopeRoots = (root, scope) => {
 function captureCandidate(root, scope, environment = []) {
   let checkout;
   try {
-    checkout = fs10.realpathSync(root);
+    checkout = fs12.realpathSync(root);
   } catch {
     return failure2("invalid_input", "candidate root does not exist");
   }
@@ -12795,11 +13835,11 @@ function captureCandidate(root, scope, environment = []) {
     if (item === ".git" || item === ".workit")
       continue;
     names.add(item);
-    if (!fs10.existsSync(target))
+    if (!fs12.existsSync(target))
       continue;
     let stat;
     try {
-      stat = fs10.lstatSync(target);
+      stat = fs12.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -12815,17 +13855,17 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].toSorted()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path12.join(checkout, item);
+    const target = path14.join(checkout, item);
     try {
-      const stat = fs10.lstatSync(target);
+      const stat = fs12.lstatSync(target);
       if (stat.isSymbolicLink()) {
-        const link = fs10.readlinkSync(target);
-        files.push({ path: item, kind: "symlink", digest: digestBytes3(link), executable: null });
+        const link = fs12.readlinkSync(target);
+        files.push({ path: item, kind: "symlink", digest: digestBytes2(link), executable: null });
       } else if (stat.isFile()) {
         files.push({
           path: item,
           kind: "file",
-          digest: digestBytes3(fs10.readFileSync(target)),
+          digest: digestBytes2(fs12.readFileSync(target)),
           executable: (stat.mode & 73) !== 0
         });
       } else if (!stat.isDirectory()) {
@@ -12850,7 +13890,7 @@ function captureCandidate(root, scope, environment = []) {
   const values = supplied.toSorted((left, right) => compareCodeUnits2(left.name, right.name)).map(({ name, value }) => ({ name, value, refs: [] }));
   if (values.some(({ value }) => value === null))
     completeness = "uncertain";
-  const headResult = spawnSync5("git", ["rev-parse", "HEAD"], { cwd: checkout, encoding: "utf8" });
+  const headResult = spawnSync6("git", ["rev-parse", "HEAD"], { cwd: checkout, encoding: "utf8" });
   if (headResult.status !== 0 && !/not a git repository/i.test(headResult.stderr ?? ""))
     completeness = "uncertain";
   const head = headResult.status === 0 ? headResult.stdout.trim() : null;
@@ -13863,6 +14903,38 @@ var applyWorkerLifecycle = (input) => {
   return updated ? success(changed.data.task.revision, changed.data.workspace.revision, updated) : failure2("recovery_required", "worker disappeared during lifecycle observation");
 };
 var refsWithinScope = (refs, scope) => refs.every((ref) => ref.kind !== "file" || bindingCovers(scope, { description: "", paths: [ref.path], exclusions: [] }));
+var TASK_SCOPED_ACTIONS = new Set([
+  "task.inspect",
+  "task.revise",
+  "task.progress",
+  "task.pause",
+  "task.resume",
+  "task.close",
+  "policy.assess",
+  "policy.preview",
+  "policy.explain",
+  "evidence.record",
+  "finding.record",
+  "finding.resolve",
+  "decision.record",
+  "decision.revoke",
+  "worker.assign",
+  "worker.report",
+  "worker.cancel",
+  "writer.acquire",
+  "writer.release",
+  "state.export"
+]);
+var CREATING_ACTIONS = new Set([
+  "task.revise",
+  "task.progress",
+  "policy.assess",
+  "evidence.record",
+  "finding.record",
+  "decision.record",
+  "worker.assign",
+  "writer.acquire"
+]);
 var REVISION_RETRY_ATTEMPTS = 8;
 var retryPause = new Int32Array(new SharedArrayBuffer(4));
 var filledRevisions = (request) => {
@@ -14114,7 +15186,9 @@ class WorkitCore {
   }
   contextRootError() {
     try {
-      if (realpathSync6(this.context.root) !== this.store.root)
+      realpathSync6(this.context.root);
+      const root = checkoutRootOf(this.context.root);
+      if (root !== this.store.root && !sameDirectoryIdentity(root, this.store.root))
         return failure2("invalid_input", "operation context root does not match the task store root");
     } catch {
       return failure2("invalid_input", "operation context root cannot be resolved");
@@ -14136,6 +15210,30 @@ class WorkitCore {
   retryOmittedRevisions(request, run) {
     return retryFilledRevisions(filledRevisions(request), run);
   }
+  implicitTask(family, request) {
+    if (typeof request !== "object" || request === null || Array.isArray(request))
+      return success(null, null, request);
+    const value = request;
+    if (value.taskId !== undefined || typeof value.action !== "string")
+      return success(null, null, request);
+    const action = `${family}.${value.action}`;
+    if (!TASK_SCOPED_ACTIONS.has(action))
+      return success(null, null, request);
+    const root = this.contextRootError();
+    if (!root.ok)
+      return root;
+    const create = CREATING_ACTIONS.has(action) && (this.context.workerId ?? null) === null;
+    const found = this.store.implicitTask({
+      provenance: provenance(this.context),
+      create,
+      now: trustedNow(this.context)
+    });
+    if (!found.ok)
+      return found;
+    if (!found.data)
+      return failure2("not_found", 'no task for this branch yet; pass taskId, or record something first (`workit task start "<objective>"`, a note, a check) to create it');
+    return success(null, null, { ...request, taskId: found.data.task.id });
+  }
   helperEntry(task, requireSession = false, requireActive = false) {
     const workerId = this.context.workerId ?? null;
     if (workerId === null)
@@ -14167,7 +15265,11 @@ class WorkitCore {
     return null;
   }
   state(request) {
-    return request?.action === "import" ? this.retryOmittedRevisions(request, () => this.stateOnce(request)) : this.stateOnce(request);
+    const resolved = this.implicitTask("state", request);
+    if (!resolved.ok)
+      return resolved;
+    const value = resolved.data;
+    return value?.action === "import" ? this.retryOmittedRevisions(value, () => this.stateOnce(value)) : this.stateOnce(value);
   }
   stateOnce(request) {
     const root = this.contextRootError();
@@ -14234,44 +15336,14 @@ class WorkitCore {
         return imported;
       return this.summary(imported.data);
     }
-    if (!this.context.nativeRecovery)
-      return failure2("permission_denied", "native recovery authority is unavailable");
-    const processEvidence = (lock, writer) => this.context.nativeRecovery({
-      lock,
-      writer,
-      reason: input.reason,
-      authorityRefs: input.authorityRefs
-    });
-    if (input.target === "workspace")
-      return this.store.recoverWorkspace({
-        expectedBytes: input.expectedBytes,
-        snapshotDigest: input.snapshotDigest,
-        reason: input.reason,
-        authorityRefs: input.authorityRefs,
-        expectedWorkspaceRevision: input.expectedWorkspaceRevision,
-        processEvidence
-      });
-    const workspace = this.store.readWorkspace();
-    if (!workspace.ok)
-      return workspace;
-    if (!workspace.data)
-      return failure2("not_found", "workspace not found");
-    this.fillRevisions(input, undefined, workspace.data);
-    if (input.target === "workspace" && input.taskId !== undefined)
-      return failure2("invalid_input", "workspace recovery takes no task ID");
-    if (input.target === "task" && input.taskId === undefined)
-      return failure2("invalid_input", "task recovery requires a task ID");
-    return this.store.recoverTask(input.taskId, {
-      expectedBytes: input.expectedBytes,
-      snapshotDigest: input.snapshotDigest,
-      reason: input.reason,
-      authorityRefs: input.authorityRefs,
-      expectedWorkspaceRevision: input.expectedWorkspaceRevision,
-      processEvidence
-    });
+    return failure2("invalid_input", "unknown state action");
   }
   task(request) {
-    return this.retryOmittedRevisions(request, () => this.taskOnce(request));
+    const resolved = this.implicitTask("task", request);
+    if (!resolved.ok)
+      return resolved;
+    const value = resolved.data;
+    return this.retryOmittedRevisions(value, () => this.taskOnce(value));
   }
   taskOnce(request) {
     const root = this.contextRootError();
@@ -14373,7 +15445,11 @@ class WorkitCore {
     }
   }
   policy(request) {
-    return this.retryOmittedRevisions(request, () => this.policyOnce(request));
+    const resolved = this.implicitTask("policy", request);
+    if (!resolved.ok)
+      return resolved;
+    const value = resolved.data;
+    return this.retryOmittedRevisions(value, () => this.policyOnce(value));
   }
   policyOnce(request) {
     const root = this.contextRootError();
@@ -14422,7 +15498,11 @@ class WorkitCore {
     return success(changed.data.revision, null, changed.data.policy);
   }
   evidence(request) {
-    return this.retryOmittedRevisions(request, () => this.evidenceOnce(request));
+    const resolved = this.implicitTask("evidence", request);
+    if (!resolved.ok)
+      return resolved;
+    const value = resolved.data;
+    return this.retryOmittedRevisions(value, () => this.evidenceOnce(value));
   }
   evidenceOnce(request) {
     const root = this.contextRootError();
@@ -14563,13 +15643,16 @@ class WorkitCore {
     return success(changed.data.revision, null, changed.data.evidence.at(-1));
   }
   decision(request) {
-    return this.recordDecision(request);
+    const resolved = this.implicitTask("decision", request);
+    return resolved.ok ? this.recordDecision(resolved.data) : resolved;
   }
   observeDecision(request, observation) {
-    return this.recordDecision(request, observation, true);
+    const resolved = this.implicitTask("decision", request);
+    return resolved.ok ? this.recordDecision(resolved.data, observation, true) : resolved;
   }
   observeStandingDecision(request) {
-    return this.recordDecision(request, undefined, true, true);
+    const resolved = this.implicitTask("decision", request);
+    return resolved.ok ? this.recordDecision(resolved.data, undefined, true, true) : resolved;
   }
   commitTask(taskId, expected, filled, recheck, update) {
     let revision = expected;
@@ -14731,7 +15814,11 @@ class WorkitCore {
     return entry ? success(changed.data.revision, null, entry) : failure2("recovery_required", "decision disappeared");
   }
   finding(request) {
-    return this.retryOmittedRevisions(request, () => this.findingOnce(request));
+    const resolved = this.implicitTask("finding", request);
+    if (!resolved.ok)
+      return resolved;
+    const value = resolved.data;
+    return this.retryOmittedRevisions(value, () => this.findingOnce(value));
   }
   findingOnce(request) {
     const root = this.contextRootError();
@@ -14857,7 +15944,11 @@ class WorkitCore {
     return entry ? success(changed.data.revision, null, entry) : failure2("recovery_required", "finding disappeared");
   }
   worker(request) {
-    return this.retryOmittedRevisions(request, () => this.workerOnce(request));
+    const resolved = this.implicitTask("worker", request);
+    if (!resolved.ok)
+      return resolved;
+    const value = resolved.data;
+    return this.retryOmittedRevisions(value, () => this.workerOnce(value));
   }
   workerOnce(request) {
     const root = this.contextRootError();
@@ -15207,7 +16298,11 @@ class WorkitCore {
     return applied;
   }
   writer(request) {
-    return this.retryOmittedRevisions(request, () => this.writerOnce(request));
+    const resolved = this.implicitTask("writer", request);
+    if (!resolved.ok)
+      return resolved;
+    const value = resolved.data;
+    return this.retryOmittedRevisions(value, () => this.writerOnce(value));
   }
   writerOnce(request) {
     const root = this.contextRootError();
@@ -15817,6 +16912,8 @@ class WorkitCore {
 }
 
 // packages/workit-core/src/hooks/context.ts
+var MIGRATION_PENDING_NOTE = "workit migration pending — run `workit task status`";
+var migrationPending = (result) => !result.ok && result.code === "needs_input" && (result.error ?? "").startsWith(MIGRATION_PENDING);
 var boundTo = (entry, session) => entry.sessions.some((item) => item.host === session.host && item.handle === session.handle);
 var newestFirst = (left, right) => right.updatedAt.localeCompare(left.updatedAt);
 var sessionTaskEntry = (entries, session) => entries.filter((entry) => entry.status !== "closed" && boundTo(entry, session)).toSorted(newestFirst)[0] ?? null;
@@ -15827,6 +16924,15 @@ var currentTaskEntry = (entries, session, selection) => {
   const active = entries.filter((entry) => entry.status === "active");
   return active.length === 1 ? active[0] : null;
 };
+var implicitTaskEntry = (store, entries, session) => {
+  const open = entries.filter((entry) => entry.key !== null && entry.status !== "closed" && !entry.sessions.some((item) => item.host !== "workit_cli" && !(item.host === session.host && item.handle === session.handle)));
+  if (open.length === 0)
+    return null;
+  const key = store.currentKey();
+  if (!key.ok)
+    return null;
+  return open.filter((entry) => entry.key === key.data.key).toSorted(newestFirst)[0] ?? null;
+};
 var unfinishedTaskOffer = (entries, session, excludeTaskId = null) => {
   const tasks = unboundOpenTaskEntries(entries.filter((entry) => entry.id !== excludeTaskId), session);
   if (tasks.length === 0)
@@ -15858,8 +16964,8 @@ var cache = new Map;
 function sessionCompactContext(store, session, context, selection = "session-bound") {
   const listed = store.listTaskIndex();
   if (!listed.ok)
-    return null;
-  const entry = currentTaskEntry(listed.data, session, selection);
+    return migrationPending(listed) ? MIGRATION_PENDING_NOTE : null;
+  const entry = currentTaskEntry(listed.data, session, selection) ?? implicitTaskEntry(store, listed.data, session);
   return entry ? entryCompactContext(store, entry, session, context) : null;
 }
 function entryCompactContext(store, entry, session, context) {
@@ -15884,7 +16990,7 @@ function entryCompactContext(store, entry, session, context) {
     return null;
   const freshness = { mode: "signal", current: () => recentSignal(store.root) };
   const observed = task.data.evidence.some(isObservedCheck);
-  const files = task.data.decisions.flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path13.resolve(store.root, ref.path)] : []));
+  const files = task.data.decisions.flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path15.resolve(store.root, ref.path)] : []));
   const observedFiles = filesKey(files);
   const compact = new WorkitCore(store, context).compactContext(entry.id, freshness);
   if (!compact.ok)
@@ -15917,9 +17023,15 @@ var sessionContextText = (input, descriptor, options) => {
   try {
     const store = new TaskStore(input.cwd);
     const listed = store.listTaskIndex();
+    if (migrationPending(listed))
+      return `<workit-contract>
+${invariantBootstrap()}
+${MIGRATION_PENDING_NOTE}${options.addendum ? `
+${options.addendum}` : ""}
+</workit-contract>`;
     if (!listed.ok)
       throw new Error(listed.error);
-    const entry = currentTaskEntry(listed.data, session, descriptor.context.task);
+    const entry = currentTaskEntry(listed.data, session, descriptor.context.task) ?? implicitTaskEntry(store, listed.data, session);
     const text = entry ? entryCompactContext(store, entry, session, hookOperationContext(input, descriptor)) : null;
     if (text)
       compact = `
@@ -15939,6 +17051,8 @@ ${options.addendum}` : ""}
 var turnContextText = (input, descriptor) => {
   try {
     const text = sessionCompactContext(new TaskStore(input.cwd), { host: input.host, handle: input.session.id }, hookOperationContext(input, descriptor), descriptor.context.task);
+    if (text === MIGRATION_PENDING_NOTE)
+      return text;
     return text ? `<workit-task-context>${text}</workit-task-context>` : null;
   } catch {
     return null;
@@ -15970,7 +17084,16 @@ var usable2 = (value) => value === "native" || value === "partial";
 var NONE2 = { kind: "none" };
 var offered = new Set;
 var CLAUDE_WORKTREE_IMPLEMENTER = "workit:implementer";
-var subagentStartText = (host, descriptor, event) => host === "claude_code" && event.agentType === CLAUDE_WORKTREE_IMPLEMENTER ? `Workit observed ${descriptor.label} subagent ${event.agentId} (${event.agentType}) working in its own git worktree: it may edit and commit there, within its brief's scope. Before the first commit, switch to a policy-compliant branch (\`git switch -c <type>/<slug>\`, e.g. feature/<slug>); branch policy hooks still deny protected or non-compliant branches. Never push, open a PR, or merge unless the brief asks for it.` : `Workit observed ${descriptor.label} subagent ${event.agentId} (${event.agentType}) as read-only/agent-guided; writer delegation is unavailable.`;
+var CLAUDE_JUDGES = new Set(["workit:verifier", "workit:reviewer"]);
+var subagentSession = (session, agentId) => [session, agentId].filter((part) => Boolean(part)).join(":").replace(/[^A-Za-z0-9_.:@/+-]/g, "-").slice(0, 128);
+var subagentStartText = (host, session, descriptor, event) => {
+  if (host === "claude_code" && event.agentType === CLAUDE_WORKTREE_IMPLEMENTER)
+    return `Workit observed ${descriptor.label} subagent ${event.agentId} (${event.agentType}) working in its own git worktree: it may edit and commit there, within its brief's scope. Before the first commit, switch to a policy-compliant branch with \`workit git branch <branch> --base <base>\` (e.g. feature/<slug>); branch policy hooks still deny protected or non-compliant branches. Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
+  const readOnly = `Workit observed ${descriptor.label} subagent ${event.agentId} (${event.agentType}) as read-only/agent-guided; writer delegation is unavailable.`;
+  if (host === "claude_code" && event.agentType && CLAUDE_JUDGES.has(event.agentType) && event.agentId)
+    return `${readOnly} Its own Workit session is ${subagentSession(session, event.agentId)}: record verdicts with \`workit ledger verdict <result> --session ${subagentSession(session, event.agentId)} ...\` so the ledger tells it apart from the author.`;
+  return readOnly;
+};
 function handleHook(input, deps) {
   const { descriptor } = deps;
   const event = input.event;
@@ -15996,7 +17119,10 @@ function handleHook(input, deps) {
     case "shell.pre":
       return usable2(descriptor.shellPolicy.deny) ? shellPolicy(input.cwd, event.command) : NONE2;
     case "subagent.start":
-      return { kind: "context", text: subagentStartText(input.host, descriptor, event) };
+      return {
+        kind: "context",
+        text: subagentStartText(input.host, input.session.id ?? null, descriptor, event)
+      };
     case "compact.pre":
       return {
         kind: "notice",
@@ -16041,12 +17167,12 @@ var dispatchHook = (adapter, raw, env = process.env) => {
 };
 // packages/workit-core/src/hooks/hosts/fields.ts
 import { existsSync as existsSync5, realpathSync as realpathSync7, statSync as statSync2 } from "node:fs";
-import path14 from "node:path";
+import path16 from "node:path";
 var isRecord3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var nonEmpty2 = (value) => typeof value === "string" && value.trim() !== "";
 var optionalText = (value) => typeof value === "string" ? value : null;
 var existingDirectory = (value) => {
-  if (!nonEmpty2(value) || !path14.isAbsolute(value) || !existsSync5(value))
+  if (!nonEmpty2(value) || !path16.isAbsolute(value) || !existsSync5(value))
     return null;
   try {
     return statSync2(value).isDirectory() ? realpathSync7(value) : null;
@@ -16550,11 +17676,11 @@ var codexAdapter = {
     };
   },
   render: render2,
-  addendum: (input) => `<workit-codex-mutations>Codex MCP is read-only: unattested callers cannot mutate. Run the workit CLI for task mutations: node_modules/.bin/workit <family> <action> --json --confirm${input.session.id ? `; bind the writer to this session with node_modules/.bin/workit writer acquire --task <id> --revision <rev> --actor ${input.session.id} --confirm` : ""}. Binding decisions and external actions need a human.</workit-codex-mutations>`
+  addendum: (input) => `<workit-codex-mutations>Codex MCP is read-only: unattested callers cannot mutate. Run workit verbs with the workit CLI on the shell (node_modules/.bin/workit, or npx -y @brainervirus/workit-cli): check, git branch|commit|push, pr, ci, stack, ledger, handoff; task-family mutations take --json --confirm${input.session.id ? `; bind the writer to this session with node_modules/.bin/workit writer acquire --task <id> --revision <rev> --actor ${input.session.id} --confirm` : ""}. A verifier or reviewer records workit ledger verdict under a session the lead assigns (WORKIT_SESSION_ID=<lead>-v<n>), never the author's. Merge and release need a workspace grant; a question answer is not host permission.</workit-codex-mutations>`
 };
 
 // packages/workit-core/src/hooks/hosts/cursor.ts
-import path15 from "node:path";
+import path17 from "node:path";
 var undocumented2 = { support: "undocumented", native: null };
 var none = { support: "none", native: null };
 var CURSOR_DESCRIPTOR = {
@@ -16737,7 +17863,7 @@ var protocolEvent2 = (input) => {
       return { kind: "compact.pre", trigger: "auto" };
   }
 };
-var within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path15.sep) ? root : `${root}${path15.sep}`);
+var within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path17.sep) ? root : `${root}${path17.sep}`);
 var hookCwd = (input) => {
   const cwd = existingDirectory(input.cwd);
   if (cwd && input.hook_event_name === "beforeShellExecution")