@cleocode/adapters 2026.10.27 → 2026.11.1-canary.3

package/dist/index.js

@@ -487,7 +487,9 @@ var init_acceptance_gate_schema = __esm({
       /** When true, failure is recorded as a warning rather than a block. */
       advisory: z.boolean().optional(),
       /** Per-gate timeout override in milliseconds. */
-      timeoutMs: z.number().int().positive().optional()
+      timeoutMs: z.number().int().positive().optional(),
+      /** Declared evidence repository the gate runs in (T14078). */
+      repo: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/).optional()
     });
     fileAssertionSchema = z.discriminatedUnion("type", [
       z.object({ type: z.literal("exists") }),
@@ -11245,6 +11247,12 @@ var init_operations_registry = __esm({
             type: "number",
             required: false,
             description: "Age threshold in days for the stale-drafts check (default 30)"
+          },
+          {
+            name: "only",
+            type: "string",
+            required: false,
+            description: "Comma-separated repair classes to scope the plan (and apply) to, e.g. publication-ledger-drift (T14174)"
           }
         ]
       },
@@ -11291,6 +11299,25 @@ var init_operations_registry = __esm({
         requiredParams: [],
         params: []
       },
+      // ── docs.rot (T14111 — Epic T14106) ──────────────────────────────────────
+      {
+        gateway: "query",
+        domain: "docs",
+        operation: "rot",
+        description: "docs.rot (query) \u2014 docs-rot report from git alone: docs whose covers: code changed after them (stale), duplicate docs, and orphaned docs (dead covers globs, unreferenced docs/ files). changed:<base>..<head> also lists the docs that merged change left stale. Read-only.",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "changed",
+            type: "string",
+            required: false,
+            description: "Git range <base>..<head> of a merged change to flag docs for"
+          }
+        ]
+      },
       {
         gateway: "mutate",
         domain: "docs",
@@ -11318,6 +11345,12 @@ var init_operations_registry = __esm({
             type: "number",
             required: false,
             description: "Age threshold in days for the stale-drafts check (default 30)"
+          },
+          {
+            name: "only",
+            type: "string",
+            required: false,
+            description: "Comma-separated repair classes to scope the plan (and apply) to, e.g. publication-ledger-drift (T14174)"
           }
         ]
       },
@@ -11333,6 +11366,91 @@ var init_operations_registry = __esm({
         requiredParams: [],
         params: []
       },
+      // ── docs.modernize (T14113 — Epic T14106) ─────────────────────────────────
+      {
+        gateway: "mutate",
+        domain: "docs",
+        operation: "modernize",
+        description: "docs.modernize (mutate) \u2014 turn a messy docs folder into clean, linked CleoDocs. Dry run by default: proposes per file a kind, a stable slug (no task, session or date tokens) and keep/rename/merge-into/delete with reasons and any System One judgment. --apply stores, merges, supersedes, moves files and writes wikilink edges with a receipt; --rollback <runId> reverses a run.",
+        tier: 1,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "path",
+            type: "string",
+            required: false,
+            description: "Folder to modernize (required unless --rollback)"
+          },
+          {
+            name: "apply",
+            type: "boolean",
+            required: false,
+            description: "Execute the plan (default: dry run, nothing written)"
+          },
+          {
+            name: "planFile",
+            type: "string",
+            required: false,
+            description: "Apply this saved plan JSON verbatim"
+          },
+          {
+            name: "out",
+            type: "string",
+            required: false,
+            description: "Save the plan JSON to this path"
+          },
+          {
+            name: "rollback",
+            type: "string",
+            required: false,
+            description: "Roll back the apply run with this id"
+          },
+          {
+            name: "exclude",
+            type: "string",
+            required: false,
+            description: "Extra folder names to skip, comma-separated"
+          },
+          {
+            name: "overrides",
+            type: "string",
+            required: false,
+            description: "Reviewer decisions JSON keyed by path (DocsModernizeOverrides)"
+          },
+          {
+            name: "kind",
+            type: "string",
+            required: false,
+            description: "Use this kind for every file instead of classifying"
+          },
+          {
+            name: "storeOnly",
+            type: "boolean",
+            required: false,
+            description: "Ingest every file into the store and leave the folder untouched"
+          },
+          {
+            name: "allowDirty",
+            type: "boolean",
+            required: false,
+            description: "Apply even when the root is not a clean git checkout"
+          },
+          {
+            name: "wikilinks",
+            type: "boolean",
+            required: false,
+            description: "Rewrite relative links to planned docs as [[slug]] wikilinks (default: keep markdown links, re-pointed at the new paths)"
+          },
+          {
+            name: "store",
+            type: "boolean",
+            required: false,
+            description: "Modernize the docs already in the store instead of a folder"
+          }
+        ]
+      },
       // ── docs.generate (T798) ─────────────────────────────────────────────────
       {
         gateway: "query",
@@ -12204,6 +12322,99 @@ var init_operations_registry = __esm({
           }
         ]
       },
+      // release mutate: cut (T14102 — one-command release from the newest green
+      // default-branch commit; replaces plan → open → bump-PR → hand tag).
+      {
+        gateway: "mutate",
+        domain: "release",
+        operation: "cut",
+        description: "release.cut (mutate) \u2014 tag the newest default-branch commit with green CI as v<version> once confirmed with --yes (D11211/D11212); release.yml writes the CHANGELOG from changesets and publishes. Without --yes it reports the commit, notes, packages and task status and prints the confirm command (T14102).",
+        tier: 1,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ["version"],
+        params: [
+          {
+            name: "version",
+            type: "string",
+            required: true,
+            description: "Release version (accepts v2026.10.28 or 2026.10.28)",
+            cli: { positional: true }
+          },
+          {
+            name: "sha",
+            type: "string",
+            required: false,
+            description: "Pin the commit instead of the newest green one; it must itself be green"
+          },
+          {
+            name: "lead",
+            type: "string",
+            required: false,
+            description: "Markdown file that leads the notes (Update now + Highlights)"
+          },
+          {
+            name: "dryRun",
+            type: "boolean",
+            required: false,
+            description: "Report the commit, notes, packages and tasks without creating the tag"
+          },
+          {
+            name: "yes",
+            type: "boolean",
+            required: false,
+            description: "Create the tag (D11212): the version typed on the controlling terminal (/dev/tty), or a standing release authorization (T14141), allows it. Without it the cut only reports and prints the confirm command"
+          }
+        ]
+      },
+      // release mutate: write-changelog (T14102 — CHANGELOG section from the
+      // changesets since the previous tag; run by release.yml on the tagged checkout).
+      {
+        gateway: "mutate",
+        domain: "release",
+        operation: "write-changelog",
+        description: "release.write-changelog (mutate) \u2014 write the ## [VERSION] CHANGELOG.md section from the changesets added since the previous release tag, led by the tag annotation; leaves an existing section untouched (T14102).",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["version"],
+        params: [
+          {
+            name: "version",
+            type: "string",
+            required: true,
+            description: "Release version (accepts v2026.10.28 or 2026.10.28)",
+            cli: { positional: true }
+          },
+          {
+            name: "ref",
+            type: "string",
+            required: false,
+            description: "Commit the release was cut from (default: tag v<version>, else HEAD)"
+          }
+        ]
+      },
+      // release query: verify-tag (T14102 — release.yml refuses to publish a tag
+      // that is not a green first-parent commit of the default branch).
+      {
+        gateway: "query",
+        domain: "release",
+        operation: "verify-tag",
+        description: "release.verify-tag (query) \u2014 refuse a release tag whose commit is not a first-parent commit of origin/main with every required check (release.prRequiredWorkflows, app-pinned) green on its push run. Run by release.yml before publishing (T14102).",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["version"],
+        params: [
+          {
+            name: "version",
+            type: "string",
+            required: true,
+            description: "Release version whose tag is checked (accepts v2026.10.28 or 2026.10.28)",
+            cli: { positional: true }
+          }
+        ]
+      },
       // release query: validate-changelog (T9937 / Saga T9862 — canonical CHANGELOG
       // header validator that replaces the brittle inline grep step in
       // .github/workflows/release.yml). Read-only — exposed only under the query
@@ -13597,8 +13808,121 @@ var init_operations_registry = __esm({
   }
 });
 
-// packages/contracts/src/docs/provenance.ts
+// packages/contracts/src/docs/modernize.ts
 import { z as z7 } from "zod";
+var DOCS_MODERNIZE_DISPOSITIONS, DOCS_MODERNIZE_OPS, judgmentSchema, relPath, docsModernizePlanSchema, docsModernizeOverridesSchema, receiptOpSchema, docsModernizeJournalLineSchema, docsModernizeReceiptSchema;
+var init_modernize = __esm({
+  "packages/contracts/src/docs/modernize.ts"() {
+    "use strict";
+    DOCS_MODERNIZE_DISPOSITIONS = ["keep", "rename", "merge-into", "delete"];
+    DOCS_MODERNIZE_OPS = [
+      "ingest",
+      "merge",
+      "fold",
+      "supersede",
+      "write-file",
+      "remove-file",
+      "link",
+      "rekind",
+      "reslug",
+      "link-task"
+    ];
+    judgmentSchema = z7.object({
+      question: z7.enum(["classify", "merge"]),
+      site: z7.string(),
+      mode: z7.enum(["off", "shadow", "on"]),
+      ruleAnswer: z7.string(),
+      decidedAnswer: z7.string().nullable(),
+      decidedConfidence: z7.number().nullable(),
+      source: z7.enum(["provider", "cache", "fallback"]),
+      acted: z7.string()
+    });
+    relPath = z7.string().min(1).max(1024);
+    docsModernizePlanSchema = z7.object({
+      root: z7.string().min(1),
+      generatedAt: z7.string(),
+      mode: z7.enum(["tree", "store-only"]),
+      counts: z7.record(z7.enum(DOCS_MODERNIZE_DISPOSITIONS), z7.number()),
+      rows: z7.array(
+        z7.object({
+          path: relPath,
+          sha256: z7.string().regex(/^[0-9a-f]{64}$/),
+          kind: z7.string().min(1),
+          slug: z7.string().regex(/^[a-z0-9][a-z0-9-]*$/),
+          title: z7.string(),
+          disposition: z7.enum(DOCS_MODERNIZE_DISPOSITIONS),
+          target: z7.string().min(1).max(1024).nullable(),
+          reasons: z7.array(z7.string()),
+          judgments: z7.array(judgmentSchema),
+          ownerTasks: z7.array(z7.string().regex(/^[TD]\d+$/)),
+          category: z7.string(),
+          refs: z7.array(z7.string()),
+          overridden: z7.boolean(),
+          covers: z7.array(z7.string()),
+          baselineRemove: z7.boolean()
+        })
+      ),
+      linkFixes: z7.array(
+        z7.object({
+          kind: z7.literal("link-fix"),
+          path: relPath,
+          href: z7.string().min(1).max(2048),
+          newHref: z7.string().min(1).max(2048)
+        })
+      ).optional()
+    });
+    docsModernizeOverridesSchema = z7.record(
+      relPath,
+      z7.object({
+        disposition: z7.enum(DOCS_MODERNIZE_DISPOSITIONS),
+        target: z7.string().min(1).max(1024).optional(),
+        reason: z7.string().min(1),
+        kind: z7.string().min(1).optional(),
+        slug: z7.string().regex(/^[a-z0-9][a-z0-9-]*$/).optional(),
+        covers: z7.array(z7.string()).optional()
+      })
+    );
+    receiptOpSchema = z7.object({
+      op: z7.enum(DOCS_MODERNIZE_OPS),
+      state: z7.enum(["pending", "done", "reversed"]),
+      slug: z7.string().nullable(),
+      path: relPath.nullable(),
+      target: z7.string().nullable(),
+      attachmentId: z7.string().nullable(),
+      ownerId: z7.string().nullable(),
+      beforeSha256: z7.string().regex(/^[0-9a-f]{64}$/).nullable(),
+      afterSha256: z7.string().regex(/^[0-9a-f]{64}$/).nullable(),
+      prior: z7.object({
+        lifecycleStatus: z7.string().nullable().optional(),
+        supersededBy: z7.string().nullable().optional(),
+        supersedes: z7.string().nullable().optional(),
+        previousAttachmentId: z7.string().nullable().optional(),
+        newAttachmentId: z7.string().nullable().optional(),
+        linkTargets: z7.array(z7.string()).optional(),
+        kind: z7.string().nullable().optional()
+      }).optional()
+    });
+    docsModernizeJournalLineSchema = receiptOpSchema.extend({
+      i: z7.number().int().min(0)
+    });
+    docsModernizeReceiptSchema = z7.object({
+      runId: z7.string().regex(/^dm-[\w-]+$/),
+      root: z7.string().min(1),
+      appliedAt: z7.string(),
+      planSha256: z7.string(),
+      edgeCount: z7.number(),
+      rolledBackAt: z7.string().nullable(),
+      blobs: z7.array(z7.object({ path: relPath, sha256: z7.string() })),
+      moves: z7.array(z7.object({ from: relPath, to: relPath })),
+      deleted: z7.array(relPath),
+      ops: z7.array(receiptOpSchema),
+      durationMs: z7.number().optional()
+    });
+  }
+});
+
+// packages/contracts/src/docs/provenance.ts
+import { z as z8 } from "zod";
 var PROVENANCE_NODE_KINDS, PROVENANCE_EDGE_RELATIONS, DOC_LIFECYCLE_STATUSES, provenanceNodeKindSchema, provenanceEdgeRelationSchema, docLifecycleStatusSchema, provenanceNodeBaseFields, provenanceDocNodeSchema, provenanceTaskNodeSchema, provenanceDecisionNodeSchema, provenanceSessionNodeSchema, provenanceMemoryNodeSchema, provenanceNodeSchema, provenanceEdgeSchema, docProvenanceResponseSchema;
 var init_provenance = __esm({
   "packages/contracts/src/docs/provenance.ts"() {
@@ -13625,102 +13949,102 @@ var init_provenance = __esm({
       "archived",
       "draft"
     ];
-    provenanceNodeKindSchema = z7.enum(PROVENANCE_NODE_KINDS);
-    provenanceEdgeRelationSchema = z7.enum(PROVENANCE_EDGE_RELATIONS);
-    docLifecycleStatusSchema = z7.enum(DOC_LIFECYCLE_STATUSES);
+    provenanceNodeKindSchema = z8.enum(PROVENANCE_NODE_KINDS);
+    provenanceEdgeRelationSchema = z8.enum(PROVENANCE_EDGE_RELATIONS);
+    docLifecycleStatusSchema = z8.enum(DOC_LIFECYCLE_STATUSES);
     provenanceNodeBaseFields = {
-      id: z7.string().min(1),
-      title: z7.string().min(1),
-      metadata: z7.record(z7.string(), z7.unknown()).optional()
+      id: z8.string().min(1),
+      title: z8.string().min(1),
+      metadata: z8.record(z8.string(), z8.unknown()).optional()
     };
-    provenanceDocNodeSchema = z7.object({
+    provenanceDocNodeSchema = z8.object({
       ...provenanceNodeBaseFields,
-      kind: z7.literal("doc"),
-      slug: z7.string().min(1),
-      docKind: z7.string().min(1),
+      kind: z8.literal("doc"),
+      slug: z8.string().min(1),
+      docKind: z8.string().min(1),
       lifecycleStatus: docLifecycleStatusSchema,
-      publishedAt: z7.string().min(1),
-      supersededAt: z7.string().min(1).optional(),
-      summary: z7.string().optional()
+      publishedAt: z8.string().min(1),
+      supersededAt: z8.string().min(1).optional(),
+      summary: z8.string().optional()
     });
-    provenanceTaskNodeSchema = z7.object({
+    provenanceTaskNodeSchema = z8.object({
       ...provenanceNodeBaseFields,
-      kind: z7.literal("task"),
-      taskType: z7.enum(["saga", "epic", "task", "subtask"]),
-      status: z7.enum(["pending", "in_progress", "done", "blocked", "cancelled", "archived"])
+      kind: z8.literal("task"),
+      taskType: z8.enum(["saga", "epic", "task", "subtask"]),
+      status: z8.enum(["pending", "in_progress", "done", "blocked", "cancelled", "archived"])
     });
-    provenanceDecisionNodeSchema = z7.object({
+    provenanceDecisionNodeSchema = z8.object({
       ...provenanceNodeBaseFields,
-      kind: z7.literal("decision"),
-      outcome: z7.enum(["proposed", "accepted", "rejected", "superseded"]),
-      decidedAt: z7.string().min(1)
+      kind: z8.literal("decision"),
+      outcome: z8.enum(["proposed", "accepted", "rejected", "superseded"]),
+      decidedAt: z8.string().min(1)
     });
-    provenanceSessionNodeSchema = z7.object({
+    provenanceSessionNodeSchema = z8.object({
       ...provenanceNodeBaseFields,
-      kind: z7.literal("session"),
-      startedAt: z7.string().min(1),
-      endedAt: z7.string().min(1).optional()
+      kind: z8.literal("session"),
+      startedAt: z8.string().min(1),
+      endedAt: z8.string().min(1).optional()
     });
-    provenanceMemoryNodeSchema = z7.object({
+    provenanceMemoryNodeSchema = z8.object({
       ...provenanceNodeBaseFields,
-      kind: z7.literal("memory"),
-      memoryType: z7.enum(["observation", "pattern", "decision", "diary"]),
-      recordedAt: z7.string().min(1)
+      kind: z8.literal("memory"),
+      memoryType: z8.enum(["observation", "pattern", "decision", "diary"]),
+      recordedAt: z8.string().min(1)
     });
-    provenanceNodeSchema = z7.discriminatedUnion("kind", [
+    provenanceNodeSchema = z8.discriminatedUnion("kind", [
       provenanceDocNodeSchema,
       provenanceTaskNodeSchema,
       provenanceDecisionNodeSchema,
       provenanceSessionNodeSchema,
       provenanceMemoryNodeSchema
     ]);
-    provenanceEdgeSchema = z7.object({
+    provenanceEdgeSchema = z8.object({
       relation: provenanceEdgeRelationSchema,
-      from: z7.string().min(1),
+      from: z8.string().min(1),
       fromKind: provenanceNodeKindSchema,
-      to: z7.string().min(1),
+      to: z8.string().min(1),
       toKind: provenanceNodeKindSchema,
-      addedAt: z7.string().min(1),
-      summary: z7.string().optional()
+      addedAt: z8.string().min(1),
+      summary: z8.string().optional()
     });
-    docProvenanceResponseSchema = z7.object({
-      nodes: z7.array(provenanceNodeSchema).readonly(),
-      edges: z7.array(provenanceEdgeSchema).readonly(),
-      totalNodes: z7.number().int().nonnegative(),
-      totalEdges: z7.number().int().nonnegative()
+    docProvenanceResponseSchema = z8.object({
+      nodes: z8.array(provenanceNodeSchema).readonly(),
+      edges: z8.array(provenanceEdgeSchema).readonly(),
+      totalNodes: z8.number().int().nonnegative(),
+      totalEdges: z8.number().int().nonnegative()
     });
   }
 });
 
 // packages/contracts/src/docs/read.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var docFrontmatterSchema, docBodySchema, docReadResponseSchema;
 var init_read = __esm({
   "packages/contracts/src/docs/read.ts"() {
     "use strict";
-    docFrontmatterSchema = z8.object({
-      slug: z8.string(),
-      kind: z8.string().nullable(),
-      title: z8.string().nullable(),
-      summary: z8.string().nullable(),
-      lifecycleStatus: z8.string(),
-      docVersion: z8.number().int(),
-      ownerVersion: z8.string().nullable(),
-      supersedes: z8.string().nullable(),
-      supersededBy: z8.string().nullable(),
-      topics: z8.array(z8.string()).readonly(),
-      relatedTasks: z8.array(z8.string()).readonly(),
-      sha256: z8.string(),
-      createdAt: z8.string()
-    });
-    docBodySchema = z8.object({
-      encoding: z8.enum(["utf-8", "base64"]),
-      text: z8.string().optional(),
-      base64: z8.string().optional(),
-      sizeBytes: z8.number().int().nonnegative(),
-      mimeType: z8.string().nullable()
-    });
-    docReadResponseSchema = z8.object({
+    docFrontmatterSchema = z9.object({
+      slug: z9.string(),
+      kind: z9.string().nullable(),
+      title: z9.string().nullable(),
+      summary: z9.string().nullable(),
+      lifecycleStatus: z9.string(),
+      docVersion: z9.number().int(),
+      ownerVersion: z9.string().nullable(),
+      supersedes: z9.string().nullable(),
+      supersededBy: z9.string().nullable(),
+      topics: z9.array(z9.string()).readonly(),
+      relatedTasks: z9.array(z9.string()).readonly(),
+      sha256: z9.string(),
+      createdAt: z9.string()
+    });
+    docBodySchema = z9.object({
+      encoding: z9.enum(["utf-8", "base64"]),
+      text: z9.string().optional(),
+      base64: z9.string().optional(),
+      sizeBytes: z9.number().int().nonnegative(),
+      mimeType: z9.string().nullable()
+    });
+    docReadResponseSchema = z9.object({
       frontmatter: docFrontmatterSchema,
       body: docBodySchema
     });
@@ -13768,7 +14092,8 @@ var init_docs_taxonomy = __esm({
         defaultOwnerKind: "session",
         publishDir: "docs/handoff",
         requiresEntityId: false,
-        requiredSections: ["Context", "State", "Next-Steps"]
+        requiredSections: ["Context", "State", "Next-Steps"],
+        storeOnly: true
       },
       {
         kind: "note",
@@ -13826,6 +14151,42 @@ var init_docs_taxonomy = __esm({
         requiresEntityId: true,
         entityIdPattern: /^t\d+(-.+)?$/,
         requiredSections: ["Root-Cause", "Action", "Schedule", "Detection"]
+      },
+      {
+        kind: "guide",
+        label: "Guide",
+        description: "How-to guide: the steps to get a task done (T14107)",
+        defaultOwnerKind: "project",
+        publishDir: "docs/guide",
+        requiresEntityId: false,
+        requiredSections: []
+      },
+      {
+        kind: "concept",
+        label: "Concept",
+        description: "Explanation of how and why the product works (T14107)",
+        defaultOwnerKind: "project",
+        publishDir: "docs/concept",
+        requiresEntityId: false,
+        requiredSections: []
+      },
+      {
+        kind: "reference",
+        label: "Reference",
+        description: "Reference: APIs, CLI, registries and formats (T14107)",
+        defaultOwnerKind: "project",
+        publishDir: "docs/reference",
+        requiresEntityId: false,
+        requiredSections: []
+      },
+      {
+        kind: "migration",
+        label: "Migration",
+        description: "Upgrade or data-migration guide (T14107)",
+        defaultOwnerKind: "project",
+        publishDir: "docs/migration",
+        requiresEntityId: false,
+        requiredSections: []
       }
     ];
     BUILTIN_DOC_KIND_VALUES = Object.freeze(
@@ -13887,8 +14248,8 @@ var init_errors = __esm({
 });
 
 // packages/contracts/src/evidence-atom-schema.ts
-import { z as z9 } from "zod";
-var EVIDENCE_ATOM_KINDS, PARSER_PREFIXES, KIND_BOUNDARY_REGEX, commitAtomSchema, filesAtomSchema, testRunAtomSchema, qaRunAtomSchema, toolAtomSchema, urlAtomSchema, noteAtomSchema, decisionAtomSchema, prAtomSchema, ciAtomSchema, locDropAtomSchema, callsiteCoverageAtomSchema, AC_UUID_REGEX, AC_ALIAS_REGEX, SATISFIES_TASK_ID_REGEX, SATISFIES_VERSION_PIN_REGEX, satisfiesAtomSchema, EvidenceAtomSchema, GATE_EVIDENCE_REQUIREMENTS, ATOM_EXAMPLES;
+import { z as z10 } from "zod";
+var EVIDENCE_ATOM_KINDS, PARSER_PREFIXES, KIND_BOUNDARY_REGEX, DEPLOY_PROVIDER_REGEX, DEPLOY_ID_REGEX, commitAtomSchema, filesAtomSchema, testRunAtomSchema, qaRunAtomSchema, toolAtomSchema, urlAtomSchema, noteAtomSchema, decisionAtomSchema, prAtomSchema, ciAtomSchema, ciRunAtomSchema, deployAtomSchema, locDropAtomSchema, callsiteCoverageAtomSchema, AC_UUID_REGEX, AC_ALIAS_REGEX, SATISFIES_TASK_ID_REGEX, SATISFIES_VERSION_PIN_REGEX, satisfiesAtomSchema, EvidenceAtomSchema, GATE_EVIDENCE_REQUIREMENTS, PROFILE_GATE_EVIDENCE, ATOM_EXAMPLES;
 var init_evidence_atom_schema = __esm({
   "packages/contracts/src/evidence-atom-schema.ts"() {
     "use strict";
@@ -13903,91 +14264,106 @@ var init_evidence_atom_schema = __esm({
       "decision",
       "pr",
       "ci",
+      "ci-run",
+      "deploy",
       "loc-drop",
       "callsite-coverage",
       "satisfies"
     ];
     PARSER_PREFIXES = [...EVIDENCE_ATOM_KINDS, "state"];
     KIND_BOUNDARY_REGEX = new RegExp(`;(?=\\s*(?:${PARSER_PREFIXES.join("|")})\\s*:)`, "g");
-    commitAtomSchema = z9.object({
-      kind: z9.literal("commit"),
-      sha: z9.string().regex(/^[0-9a-f]{7,40}$/i, "commit sha must be 7-40 hex characters")
-    });
-    filesAtomSchema = z9.object({
-      kind: z9.literal("files"),
-      paths: z9.array(z9.string().min(1)).min(1, "files atom requires at least one path")
-    });
-    testRunAtomSchema = z9.object({
-      kind: z9.literal("test-run"),
-      path: z9.string().min(1, "test-run atom requires a non-empty path")
-    });
-    qaRunAtomSchema = z9.object({
-      kind: z9.literal("qa-run"),
-      path: z9.string().min(1, "qa-run atom requires a non-empty path")
-    });
-    toolAtomSchema = z9.object({
-      kind: z9.literal("tool"),
-      tool: z9.string().min(1, "tool atom requires a non-empty tool name")
-    });
-    urlAtomSchema = z9.object({
-      kind: z9.literal("url"),
-      url: z9.string().min(1).regex(/^https?:\/\//, "url atom must start with http:// or https://")
-    });
-    noteAtomSchema = z9.object({
-      kind: z9.literal("note"),
-      note: z9.string().min(1, "note atom must be non-empty").max(512, "note atom is too long (max 512 chars)")
-    });
-    decisionAtomSchema = z9.object({
-      kind: z9.literal("decision"),
-      decisionId: z9.string().min(1, "decision atom requires a non-empty decision ID")
-    });
-    prAtomSchema = z9.object({
-      kind: z9.literal("pr"),
-      prNumber: z9.number().int().positive("pr atom requires a positive integer PR number"),
-      componentPrNumber: z9.number().int().positive().optional(),
+    DEPLOY_PROVIDER_REGEX = /^[a-z0-9][a-z0-9._-]*$/;
+    DEPLOY_ID_REGEX = /^[^\s@|]+$/;
+    commitAtomSchema = z10.object({
+      kind: z10.literal("commit"),
+      sha: z10.string().regex(/^[0-9a-f]{7,40}$/i, "commit sha must be 7-40 hex characters")
+    });
+    filesAtomSchema = z10.object({
+      kind: z10.literal("files"),
+      paths: z10.array(z10.string().min(1)).min(1, "files atom requires at least one path")
+    });
+    testRunAtomSchema = z10.object({
+      kind: z10.literal("test-run"),
+      path: z10.string().min(1, "test-run atom requires a non-empty path")
+    });
+    qaRunAtomSchema = z10.object({
+      kind: z10.literal("qa-run"),
+      path: z10.string().min(1, "qa-run atom requires a non-empty path")
+    });
+    toolAtomSchema = z10.object({
+      kind: z10.literal("tool"),
+      tool: z10.string().min(1, "tool atom requires a non-empty tool name")
+    });
+    urlAtomSchema = z10.object({
+      kind: z10.literal("url"),
+      url: z10.string().min(1).regex(/^https?:\/\//, "url atom must start with http:// or https://")
+    });
+    noteAtomSchema = z10.object({
+      kind: z10.literal("note"),
+      note: z10.string().min(1, "note atom must be non-empty").max(512, "note atom is too long (max 512 chars)")
+    });
+    decisionAtomSchema = z10.object({
+      kind: z10.literal("decision"),
+      decisionId: z10.string().min(1, "decision atom requires a non-empty decision ID")
+    });
+    prAtomSchema = z10.object({
+      kind: z10.literal("pr"),
+      prNumber: z10.number().int().positive("pr atom requires a positive integer PR number"),
+      componentPrNumber: z10.number().int().positive().optional(),
       /**
        * `pr:<owner>/<repo>#<n>` (T13912): the GitHub repository the PR number
        * belongs to, lowercased. Validated against the evidence git root's
        * `origin`, since PR numbers are only unique per repository.
        */
-      repo: z9.string().regex(/^[a-z0-9._-]+\/[a-z0-9._-]+$/).optional()
+      repo: z10.string().regex(/^[a-z0-9._-]+\/[a-z0-9._-]+$/).optional()
     });
-    ciAtomSchema = z9.object({
-      kind: z9.literal("ci"),
-      prNumber: z9.number().int().positive("ci atom requires a positive integer PR number"),
-      componentPrNumber: z9.number().int().positive().optional(),
+    ciAtomSchema = z10.object({
+      kind: z10.literal("ci"),
+      prNumber: z10.number().int().positive("ci atom requires a positive integer PR number"),
+      componentPrNumber: z10.number().int().positive().optional(),
       /** `ci:<owner>/<repo>#<n>`, as for `pr:` (T13912). */
-      repo: z9.string().regex(/^[a-z0-9._-]+\/[a-z0-9._-]+$/).optional()
+      repo: z10.string().regex(/^[a-z0-9._-]+\/[a-z0-9._-]+$/).optional()
+    });
+    ciRunAtomSchema = z10.object({
+      kind: z10.literal("ci-run"),
+      runId: z10.number().int().positive("ci-run atom requires a positive integer run id")
     });
-    locDropAtomSchema = z9.object({
-      kind: z9.literal("loc-drop"),
-      fromLines: z9.number().int().nonnegative("loc-drop fromLines must be \u2265 0"),
-      toLines: z9.number().int().nonnegative("loc-drop toLines must be \u2265 0")
+    deployAtomSchema = z10.object({
+      kind: z10.literal("deploy"),
+      provider: z10.string().regex(DEPLOY_PROVIDER_REGEX, "deploy atom provider must be a lowercase name"),
+      deploymentId: z10.string().regex(DEPLOY_ID_REGEX, "deploy atom requires a deployment id"),
+      sha: z10.string().regex(/^[0-9a-f]{7,40}$/, "deploy atom sha must be 7-40 lowercase hex chars"),
+      probeUrl: z10.string().regex(/^https?:\/\/\S+$/, "deploy atom probe url must start with http:// or https://")
     });
-    callsiteCoverageAtomSchema = z9.object({
-      kind: z9.literal("callsite-coverage"),
-      symbolName: z9.string().min(1, "callsite-coverage atom requires a non-empty symbolName"),
-      relativeSourcePath: z9.string().min(1, "callsite-coverage atom requires a non-empty relativeSourcePath")
+    locDropAtomSchema = z10.object({
+      kind: z10.literal("loc-drop"),
+      fromLines: z10.number().int().nonnegative("loc-drop fromLines must be \u2265 0"),
+      toLines: z10.number().int().nonnegative("loc-drop toLines must be \u2265 0")
+    });
+    callsiteCoverageAtomSchema = z10.object({
+      kind: z10.literal("callsite-coverage"),
+      symbolName: z10.string().min(1, "callsite-coverage atom requires a non-empty symbolName"),
+      relativeSourcePath: z10.string().min(1, "callsite-coverage atom requires a non-empty relativeSourcePath")
     });
     AC_UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[45][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
     AC_ALIAS_REGEX = /^AC[0-9]{1,4}$/;
     SATISFIES_TASK_ID_REGEX = /^T[0-9]{1,7}$/;
     SATISFIES_VERSION_PIN_REGEX = /^[0-9]{14}$/;
-    satisfiesAtomSchema = z9.object({
-      kind: z9.literal("satisfies"),
+    satisfiesAtomSchema = z10.object({
+      kind: z10.literal("satisfies"),
       /** Target task ID — `T<1-7 digits>` per ADR-079-r2 §2.1. */
-      targetTaskId: z9.string().regex(SATISFIES_TASK_ID_REGEX, "satisfies atom targetTaskId must match /^T[0-9]{1,7}$/"),
+      targetTaskId: z10.string().regex(SATISFIES_TASK_ID_REGEX, "satisfies atom targetTaskId must match /^T[0-9]{1,7}$/"),
       /** Lowercase UUIDv4/v5 — populated for the canonical form; undefined for alias form. */
-      targetAcId: z9.string().regex(AC_UUID_REGEX, "satisfies atom targetAcId must be a lowercase UUIDv4/v5").optional(),
+      targetAcId: z10.string().regex(AC_UUID_REGEX, "satisfies atom targetAcId must be a lowercase UUIDv4/v5").optional(),
       /** Positional alias `AC<1-4 digits>` — populated for alias form; undefined for UUID form. */
-      targetAcAlias: z9.string().regex(AC_ALIAS_REGEX, "satisfies atom targetAcAlias must match /^AC[0-9]{1,4}$/").optional(),
+      targetAcAlias: z10.string().regex(AC_ALIAS_REGEX, "satisfies atom targetAcAlias must match /^AC[0-9]{1,4}$/").optional(),
       /** Optional `@<14-digit YYYYMMDDhhmmss>` pin captured at mint time. */
-      versionPin: z9.string().regex(
+      versionPin: z10.string().regex(
         SATISFIES_VERSION_PIN_REGEX,
         "satisfies atom versionPin must be 14 digits (YYYYMMDDhhmmss)"
       ).optional()
     });
-    EvidenceAtomSchema = z9.discriminatedUnion("kind", [
+    EvidenceAtomSchema = z10.discriminatedUnion("kind", [
       commitAtomSchema,
       filesAtomSchema,
       testRunAtomSchema,
@@ -13998,6 +14374,8 @@ var init_evidence_atom_schema = __esm({
       decisionAtomSchema,
       prAtomSchema,
       ciAtomSchema,
+      ciRunAtomSchema,
+      deployAtomSchema,
       locDropAtomSchema,
       callsiteCoverageAtomSchema,
       satisfiesAtomSchema
@@ -14022,6 +14400,12 @@ var init_evidence_atom_schema = __esm({
       cleanupDone: { oneOf: [["note"]] },
       nexusImpact: { oneOf: [["tool"], ["note"]] }
     });
+    PROFILE_GATE_EVIDENCE = Object.freeze({
+      ops: { implemented: [["files", "note"]] },
+      decision: {},
+      census: { implemented: [["files", "note"]] },
+      audit: { implemented: [["files", "note"]] }
+    });
     ATOM_EXAMPLES = Object.freeze({
       commit: "commit:<sha>",
       files: "files:path/a.ts,path/b.ts",
@@ -14033,6 +14417,8 @@ var init_evidence_atom_schema = __esm({
       decision: "decision:D-arch-001",
       pr: "pr:357",
       ci: "ci:357",
+      "ci-run": "ci-run:<runId>",
+      deploy: "deploy:<provider>/<deploymentId>@<sha>|https://<host>/health",
       "loc-drop": "loc-drop:<fromLines>:<toLines>",
       "callsite-coverage": "callsite-coverage:<symbolName>:<relativeSourcePath>",
       satisfies: "satisfies:T1234#AC2"
@@ -14041,58 +14427,58 @@ var init_evidence_atom_schema = __esm({
 });
 
 // packages/contracts/src/evidence-record-schema.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var evidenceBaseSchema, implDiffRecordSchema, validateSpecCheckRecordSchema, testOutputRecordSchema, lintReportRecordSchema, commandOutputRecordSchema, evidenceRecordSchema;
 var init_evidence_record_schema = __esm({
   "packages/contracts/src/evidence-record-schema.ts"() {
     "use strict";
-    evidenceBaseSchema = z10.object({
+    evidenceBaseSchema = z11.object({
       /** Identity string of the agent that produced this record. */
-      agentIdentity: z10.string().min(1),
+      agentIdentity: z11.string().min(1),
       /** SHA-256 hex digest (64 chars) of the attached artifact. */
-      attachmentSha256: z10.string().length(64),
+      attachmentSha256: z11.string().length(64),
       /** ISO 8601 timestamp at which the action ran. */
-      ranAt: z10.string().datetime(),
+      ranAt: z11.string().datetime(),
       /** Wall-clock duration of the action in milliseconds. */
-      durationMs: z10.number().nonnegative()
+      durationMs: z11.number().nonnegative()
     });
     implDiffRecordSchema = evidenceBaseSchema.extend({
-      kind: z10.literal("impl-diff"),
-      phase: z10.literal("implement"),
-      filesChanged: z10.array(z10.string().min(1)).min(1),
-      linesAdded: z10.number().int().nonnegative(),
-      linesRemoved: z10.number().int().nonnegative()
+      kind: z11.literal("impl-diff"),
+      phase: z11.literal("implement"),
+      filesChanged: z11.array(z11.string().min(1)).min(1),
+      linesAdded: z11.number().int().nonnegative(),
+      linesRemoved: z11.number().int().nonnegative()
     });
     validateSpecCheckRecordSchema = evidenceBaseSchema.extend({
-      kind: z10.literal("validate-spec-check"),
-      phase: z10.literal("validate"),
-      reqIdsChecked: z10.array(z10.string().min(1)).min(1),
-      passed: z10.boolean(),
-      details: z10.string().min(1)
+      kind: z11.literal("validate-spec-check"),
+      phase: z11.literal("validate"),
+      reqIdsChecked: z11.array(z11.string().min(1)).min(1),
+      passed: z11.boolean(),
+      details: z11.string().min(1)
     });
     testOutputRecordSchema = evidenceBaseSchema.extend({
-      kind: z10.literal("test-output"),
-      phase: z10.literal("test"),
-      command: z10.string().min(1),
-      exitCode: z10.number().int(),
-      testsPassed: z10.number().int().nonnegative(),
-      testsFailed: z10.number().int().nonnegative()
+      kind: z11.literal("test-output"),
+      phase: z11.literal("test"),
+      command: z11.string().min(1),
+      exitCode: z11.number().int(),
+      testsPassed: z11.number().int().nonnegative(),
+      testsFailed: z11.number().int().nonnegative()
     });
     lintReportRecordSchema = evidenceBaseSchema.extend({
-      kind: z10.literal("lint-report"),
-      phase: z10.enum(["implement", "test"]),
-      tool: z10.string().min(1),
-      passed: z10.boolean(),
-      warnings: z10.number().int().nonnegative(),
-      errors: z10.number().int().nonnegative()
+      kind: z11.literal("lint-report"),
+      phase: z11.enum(["implement", "test"]),
+      tool: z11.string().min(1),
+      passed: z11.boolean(),
+      warnings: z11.number().int().nonnegative(),
+      errors: z11.number().int().nonnegative()
     });
     commandOutputRecordSchema = evidenceBaseSchema.extend({
-      kind: z10.literal("command-output"),
-      phase: z10.enum(["implement", "validate", "test"]),
-      cmd: z10.string().min(1),
-      exitCode: z10.number().int()
+      kind: z11.literal("command-output"),
+      phase: z11.enum(["implement", "validate", "test"]),
+      cmd: z11.string().min(1),
+      exitCode: z11.number().int()
     });
-    evidenceRecordSchema = z10.discriminatedUnion("kind", [
+    evidenceRecordSchema = z11.discriminatedUnion("kind", [
       implDiffRecordSchema,
       validateSpecCheckRecordSchema,
       testOutputRecordSchema,
@@ -14971,6 +15357,21 @@ var init_sync_write_invariants = __esm({
         sites: [],
         reason: "two devices adopting one legacy doc must mint one uid: the shell takes the legacy birth and sentinel facts, so (uid, birth_fp) converge and receive places the peer copy as a duplicate; a lost local write is refused loudly at the writer"
       },
+      // T14118 — a slug is an alias, not an identity: renaming one moves the
+      // live slug on the registry row and the conduit identity row together and
+      // records the old slug in the append-only alias table.
+      {
+        id: "docs.slug.rename-keeps-alias",
+        class: "identity-layer",
+        tables: [
+          "docs_attachments",
+          "conduit_attachments",
+          "docs_wikilinks",
+          "conduit_doc_slug_aliases"
+        ],
+        sites: [],
+        reason: "a rename moves the live slug on docs_attachments and conduit_attachments in one transaction and records the old slug as an alias of the immutable doc uid, so every replica resolves the old and the new slug to one doc"
+      },
       // T13359 (D11165) — decisions-vs-ADRs link table; the natural composite key
       // makes identical links merge to one row, and the revoke is a one-way latch.
       // T13597: enforced at merge, not just by the local accessor — 'revoked' is an
@@ -15085,111 +15486,111 @@ var init_lafs = __esm({
 });
 
 // packages/contracts/src/lease-ipc/messages.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var LeaseScopeSchema, LeaseLaneSchema, LeaseAcquireRequestSchema, LeaseReleaseRequestSchema, LeaseRenewRequestSchema, RateCheckRequestSchema, ToolGrantRequestSchema, QueuePriorityClassSchema, QueueAdmitRequestSchema, WorkerHeartbeatRequestSchema, ResourceAdmitRequestSchema, ResourceReleaseRequestSchema, LeaseIpcRequestSchema, LeaseGrantedResponseSchema, LeaseQueuedResponseSchema, LeaseDeniedResponseSchema, RateResultResponseSchema, ToolGrantedResponseSchema, LeaseRevokedResponseSchema, ChildKilledUnresponsiveResponseSchema, QueueAdmitDispositionSchema, QueueAdmitResultResponseSchema, HeartbeatAckResponseSchema, ResourceAdmitDispositionSchema, ResourceAdmitResultResponseSchema, ResourceReleaseResultResponseSchema, LeaseErrorResponseSchema, LeaseIpcResponseSchema, LeaseIpcRequestEnvelopeSchema, LeaseIpcResponseEnvelopeSchema, LeaseIpcEnvelopeSchema, LEASE_IPC_REQUEST_KINDS, LEASE_IPC_RESPONSE_KINDS, LEASE_IPC_MESSAGE_KINDS;
 var init_messages2 = __esm({
   "packages/contracts/src/lease-ipc/messages.ts"() {
     "use strict";
-    LeaseScopeSchema = z11.enum(["project", "global"]);
-    LeaseLaneSchema = z11.enum(["tasks", "brain", "bulk"]);
-    LeaseAcquireRequestSchema = z11.object({
+    LeaseScopeSchema = z12.enum(["project", "global"]);
+    LeaseLaneSchema = z12.enum(["tasks", "brain", "bulk"]);
+    LeaseAcquireRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("lease_acquire"),
+      kind: z12.literal("lease_acquire"),
       /** The cleo.db scope being arbitrated. */
       scope: LeaseScopeSchema,
       /** The write lane within the scope. */
       lane: LeaseLaneSchema,
       /** Process+lane holder identity. */
-      holder_id: z11.string().min(1),
+      holder_id: z12.string().min(1),
       /** Advisory priority — lower acquires sooner. `0` = highest. */
-      priority: z11.number().int().min(0).max(255),
+      priority: z12.number().int().min(0).max(255),
       /** Lease time-to-live in milliseconds. */
-      ttl_ms: z11.number().int().nonnegative(),
+      ttl_ms: z12.number().int().nonnegative(),
       /** When true, a same-holder acquire re-enters (refcount++) rather than queuing. */
-      reentrant: z11.boolean()
+      reentrant: z12.boolean()
     }).strict();
-    LeaseReleaseRequestSchema = z11.object({
+    LeaseReleaseRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("lease_release"),
+      kind: z12.literal("lease_release"),
       /** The cleo.db scope being arbitrated. */
       scope: LeaseScopeSchema,
       /** The write lane within the scope. */
       lane: LeaseLaneSchema,
       /** Process+lane holder identity. */
-      holder_id: z11.string().min(1),
+      holder_id: z12.string().min(1),
       /** The epoch fence the holder acquired — a stale epoch no-ops. */
-      epoch: z11.number().int().nonnegative()
+      epoch: z12.number().int().nonnegative()
     }).strict();
-    LeaseRenewRequestSchema = z11.object({
+    LeaseRenewRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("lease_renew"),
+      kind: z12.literal("lease_renew"),
       /** The cleo.db scope being arbitrated. */
       scope: LeaseScopeSchema,
       /** The write lane within the scope. */
       lane: LeaseLaneSchema,
       /** Process+lane holder identity. */
-      holder_id: z11.string().min(1),
+      holder_id: z12.string().min(1),
       /** The epoch fence the holder acquired (epoch-guarded renew). */
-      epoch: z11.number().int().nonnegative()
+      epoch: z12.number().int().nonnegative()
     }).strict();
-    RateCheckRequestSchema = z11.object({
+    RateCheckRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("rate_check"),
+      kind: z12.literal("rate_check"),
       /** The cleo.db scope being checked. */
       scope: LeaseScopeSchema,
       /** The write lane within the scope. */
       lane: LeaseLaneSchema,
       /** Estimated bytes the caller intends to write. */
-      est_bytes: z11.number().int().nonnegative()
+      est_bytes: z12.number().int().nonnegative()
     }).strict();
-    ToolGrantRequestSchema = z11.object({
+    ToolGrantRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("tool_grant"),
+      kind: z12.literal("tool_grant"),
       /** The tool name being requested. */
-      tool: z11.string().min(1),
+      tool: z12.string().min(1),
       /** The requesting holder identity. */
-      holder_id: z11.string().min(1)
+      holder_id: z12.string().min(1)
     }).strict();
-    QueuePriorityClassSchema = z11.enum(["lead", "worker", "background"]);
-    QueueAdmitRequestSchema = z11.object({
+    QueuePriorityClassSchema = z12.enum(["lead", "worker", "background"]);
+    QueueAdmitRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("queue_admit"),
+      kind: z12.literal("queue_admit"),
       /** The LLM provider id the call targets (rate budget is per-provider). */
-      provider: z11.string().min(1),
+      provider: z12.string().min(1),
       /** The caller's priority class (lead > worker > background). */
       priority_class: QueuePriorityClassSchema,
       /** The caller's estimate of the request's token cost (debited on admit). */
-      est_tokens: z11.number().int().nonnegative(),
+      est_tokens: z12.number().int().nonnegative(),
       /** The child the call belongs to (in-flight tracking — the watchdog seam). */
-      child_id: z11.string().min(1)
+      child_id: z12.string().min(1)
     }).strict();
-    WorkerHeartbeatRequestSchema = z11.object({
+    WorkerHeartbeatRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("worker_heartbeat"),
+      kind: z12.literal("worker_heartbeat"),
       /** The logical id of the heartbeating child (matches the registry key). */
-      child_id: z11.string().min(1),
+      child_id: z12.string().min(1),
       /** The worker's own view of whether it is currently inside an LLM call. */
-      in_flight_llm: z11.boolean()
+      in_flight_llm: z12.boolean()
     }).strict();
-    ResourceAdmitRequestSchema = z11.object({
+    ResourceAdmitRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("resource_admit"),
+      kind: z12.literal("resource_admit"),
       /** The resource class (e.g. `"db-heavy"`, `"full-build"`, `"test-run"`). */
-      class: z11.string().min(1),
+      class: z12.string().min(1),
       /** The caller holding the slot — process/worktree-unique; the release key. */
-      holder_id: z11.string().min(1),
+      holder_id: z12.string().min(1),
       /** The client-computed budget: the max concurrent holders for this class. */
-      budget: z11.number().int().nonnegative()
+      budget: z12.number().int().nonnegative()
     }).strict();
-    ResourceReleaseRequestSchema = z11.object({
+    ResourceReleaseRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("resource_release"),
+      kind: z12.literal("resource_release"),
       /** The resource class the slot belongs to. */
-      class: z11.string().min(1),
+      class: z12.string().min(1),
       /** The holder that was admitted (matches the admit `holder_id`). */
-      holder_id: z11.string().min(1)
+      holder_id: z12.string().min(1)
     }).strict();
-    LeaseIpcRequestSchema = z11.discriminatedUnion("kind", [
+    LeaseIpcRequestSchema = z12.discriminatedUnion("kind", [
       LeaseAcquireRequestSchema,
       LeaseReleaseRequestSchema,
       LeaseRenewRequestSchema,
@@ -15200,133 +15601,133 @@ var init_messages2 = __esm({
       ResourceAdmitRequestSchema,
       ResourceReleaseRequestSchema
     ]);
-    LeaseGrantedResponseSchema = z11.object({
+    LeaseGrantedResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("lease_granted"),
+      kind: z12.literal("lease_granted"),
       /** The granted cleo.db scope. */
       scope: LeaseScopeSchema,
       /** The granted write lane. */
       lane: LeaseLaneSchema,
       /** The holder the lease was granted to. */
-      holder_id: z11.string().min(1),
+      holder_id: z12.string().min(1),
       /** The monotonic epoch fence assigned to this grant. */
-      epoch: z11.number().int().nonnegative(),
+      epoch: z12.number().int().nonnegative(),
       /** The lease TTL in milliseconds. */
-      ttl_ms: z11.number().int().nonnegative(),
+      ttl_ms: z12.number().int().nonnegative(),
       /** Absolute expiry timestamp (epoch ms) for this grant. */
-      expires_at_ms: z11.number().int().nonnegative()
+      expires_at_ms: z12.number().int().nonnegative()
     }).strict();
-    LeaseQueuedResponseSchema = z11.object({
+    LeaseQueuedResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("lease_queued"),
+      kind: z12.literal("lease_queued"),
       /** The queued cleo.db scope. */
       scope: LeaseScopeSchema,
       /** The queued write lane. */
       lane: LeaseLaneSchema,
       /** The monotonic ticket assigned for FIFO tiebreak. */
-      ticket: z11.number().int().nonnegative(),
+      ticket: z12.number().int().nonnegative(),
       /** Number of waiters ahead of this one. */
-      ahead: z11.number().int().nonnegative()
+      ahead: z12.number().int().nonnegative()
     }).strict();
-    LeaseDeniedResponseSchema = z11.object({
+    LeaseDeniedResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("lease_denied"),
+      kind: z12.literal("lease_denied"),
       /** The denied cleo.db scope. */
       scope: LeaseScopeSchema,
       /** Machine-readable denial code (e.g. `E_LEASE_UNAVAILABLE`). */
-      code: z11.string().min(1),
+      code: z12.string().min(1),
       /** Human-readable denial message. */
-      message: z11.string()
+      message: z12.string()
     }).strict();
-    RateResultResponseSchema = z11.object({
+    RateResultResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("rate_result"),
+      kind: z12.literal("rate_result"),
       /** The checked cleo.db scope. */
       scope: LeaseScopeSchema,
       /** Whether the write is within budget. */
-      ok: z11.boolean(),
+      ok: z12.boolean(),
       /** Suggested back-off in milliseconds when `ok` is false. */
-      retry_after_ms: z11.number().int().nonnegative(),
+      retry_after_ms: z12.number().int().nonnegative(),
       /** Remaining token budget for the scope. */
-      tokens_remaining: z11.number().int().nonnegative()
+      tokens_remaining: z12.number().int().nonnegative()
     }).strict();
-    ToolGrantedResponseSchema = z11.object({
+    ToolGrantedResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("tool_granted"),
+      kind: z12.literal("tool_granted"),
       /** The granted tool name. */
-      tool: z11.string().min(1),
+      tool: z12.string().min(1),
       /** The holder the tool grant was issued to. */
-      holder_id: z11.string().min(1)
+      holder_id: z12.string().min(1)
     }).strict();
-    LeaseRevokedResponseSchema = z11.object({
+    LeaseRevokedResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("lease_revoked"),
+      kind: z12.literal("lease_revoked"),
       /** The revoked cleo.db scope. */
       scope: LeaseScopeSchema,
       /** The revoked write lane. */
       lane: LeaseLaneSchema,
       /** The holder whose lease was revoked. */
-      holder_id: z11.string().min(1),
+      holder_id: z12.string().min(1),
       /** Human-readable reason for the revocation. */
-      reason: z11.string()
+      reason: z12.string()
     }).strict();
-    ChildKilledUnresponsiveResponseSchema = z11.object({
+    ChildKilledUnresponsiveResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("child_killed_unresponsive"),
+      kind: z12.literal("child_killed_unresponsive"),
       /** Logical id of the killed child. */
-      child_id: z11.string().min(1),
+      child_id: z12.string().min(1),
       /** The holder identity the killed child held the lease as. */
-      holder_id: z11.string().min(1),
+      holder_id: z12.string().min(1),
       /** The cleo.db scope the killed child held the lease in. */
       scope: LeaseScopeSchema,
       /** Human-readable reason for the kill. */
-      reason: z11.string()
+      reason: z12.string()
     }).strict();
-    QueueAdmitDispositionSchema = z11.enum(["admitted", "deferred"]);
-    QueueAdmitResultResponseSchema = z11.object({
+    QueueAdmitDispositionSchema = z12.enum(["admitted", "deferred"]);
+    QueueAdmitResultResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("queue_admit_result"),
+      kind: z12.literal("queue_admit_result"),
       /** Whether the LLM call was admitted or deferred. */
       disposition: QueueAdmitDispositionSchema,
       /** Back-off in ms before re-requesting (0 when admitted). */
-      retry_after_ms: z11.number().int().nonnegative(),
+      retry_after_ms: z12.number().int().nonnegative(),
       /** Remaining provider token budget after this decision. */
-      tokens_remaining: z11.number().int().nonnegative(),
+      tokens_remaining: z12.number().int().nonnegative(),
       /** Number of higher/equal-priority waiters ahead (0 when admitted). */
-      queue_position: z11.number().int().nonnegative()
+      queue_position: z12.number().int().nonnegative()
     }).strict();
-    HeartbeatAckResponseSchema = z11.object({
+    HeartbeatAckResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("heartbeat_ack")
+      kind: z12.literal("heartbeat_ack")
     }).strict();
-    ResourceAdmitDispositionSchema = z11.enum(["admitted", "deferred"]);
-    ResourceAdmitResultResponseSchema = z11.object({
+    ResourceAdmitDispositionSchema = z12.enum(["admitted", "deferred"]);
+    ResourceAdmitResultResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("resource_admit_result"),
+      kind: z12.literal("resource_admit_result"),
       /** Whether the heavy op was admitted or deferred. */
       disposition: ResourceAdmitDispositionSchema,
       /** Back-off in ms before re-requesting (0 when admitted). */
-      retry_after_ms: z11.number().int().nonnegative(),
+      retry_after_ms: z12.number().int().nonnegative(),
       /** Remaining slots for the class after this decision. */
-      slots_remaining: z11.number().int().nonnegative()
+      slots_remaining: z12.number().int().nonnegative()
     }).strict();
-    ResourceReleaseResultResponseSchema = z11.object({
+    ResourceReleaseResultResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("resource_release_result"),
+      kind: z12.literal("resource_release_result"),
       /** Whether a held slot was actually released (false = no such holder). */
-      released: z11.boolean(),
+      released: z12.boolean(),
       /** Remaining in-flight holders for the class after the release. */
-      slots_remaining: z11.number().int().nonnegative()
+      slots_remaining: z12.number().int().nonnegative()
     }).strict();
-    LeaseErrorResponseSchema = z11.object({
+    LeaseErrorResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("error"),
+      kind: z12.literal("error"),
       /** Machine-readable error code (e.g. `E_LEASE_BAD_VERSION`, `E_LEASE_UNIMPLEMENTED`). */
-      code: z11.string().min(1),
+      code: z12.string().min(1),
       /** Human-readable error message. */
-      message: z11.string()
+      message: z12.string()
     }).strict();
-    LeaseIpcResponseSchema = z11.discriminatedUnion("kind", [
+    LeaseIpcResponseSchema = z12.discriminatedUnion("kind", [
       LeaseGrantedResponseSchema,
       LeaseQueuedResponseSchema,
       LeaseDeniedResponseSchema,
@@ -15340,27 +15741,27 @@ var init_messages2 = __esm({
       ResourceReleaseResultResponseSchema,
       LeaseErrorResponseSchema
     ]);
-    LeaseIpcRequestEnvelopeSchema = z11.object({
+    LeaseIpcRequestEnvelopeSchema = z12.object({
       /** Parallel protocol version. */
-      protocol_version: z11.string(),
+      protocol_version: z12.string(),
       /** Correlation id echoed back on the matching response. */
-      id: z11.string().min(1),
+      id: z12.string().min(1),
       /** Direction discriminator. */
-      direction: z11.literal("request"),
+      direction: z12.literal("request"),
       /** The request body. */
       request: LeaseIpcRequestSchema
     }).strict();
-    LeaseIpcResponseEnvelopeSchema = z11.object({
+    LeaseIpcResponseEnvelopeSchema = z12.object({
       /** Parallel protocol version. */
-      protocol_version: z11.string(),
+      protocol_version: z12.string(),
       /** Correlation id echoed from the originating request (or a fresh id for events). */
-      id: z11.string().min(1),
+      id: z12.string().min(1),
       /** Direction discriminator. */
-      direction: z11.literal("response"),
+      direction: z12.literal("response"),
       /** The response body. */
       response: LeaseIpcResponseSchema
     }).strict();
-    LeaseIpcEnvelopeSchema = z11.discriminatedUnion("direction", [
+    LeaseIpcEnvelopeSchema = z12.discriminatedUnion("direction", [
       LeaseIpcRequestEnvelopeSchema,
       LeaseIpcResponseEnvelopeSchema
     ]);
@@ -15413,7 +15814,7 @@ var init_lease_ipc = __esm({
 });
 
 // packages/contracts/src/llm/catalog-schema.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var CATALOG_MODEL_STATUSES, CATALOG_AUTH_TYPES, isoDate, semver, catalogModalitiesSchema, catalogCostSchema, catalogLimitSchema, catalogModelProviderSchema, catalogModelEntrySchema, catalogProviderSchema, curatedCatalogSchema, modelsCatalogRowInsertSchema, modelsCatalogRowSelectSchema;
 var init_catalog_schema = __esm({
   "packages/contracts/src/llm/catalog-schema.ts"() {
@@ -15426,78 +15827,78 @@ var init_catalog_schema = __esm({
       "retired"
     ];
     CATALOG_AUTH_TYPES = ["api_key", "oauth", "bedrock", "vertex"];
-    isoDate = z12.string().regex(/^\d{4}-\d{2}-\d{2}$/, "must be an ISO date (YYYY-MM-DD)");
-    semver = z12.string().regex(/^\d+\.\d+\.\d+$/, "must be semver (MAJOR.MINOR.PATCH)");
-    catalogModalitiesSchema = z12.object({
-      input: z12.array(z12.string()),
-      output: z12.array(z12.string())
+    isoDate = z13.string().regex(/^\d{4}-\d{2}-\d{2}$/, "must be an ISO date (YYYY-MM-DD)");
+    semver = z13.string().regex(/^\d+\.\d+\.\d+$/, "must be semver (MAJOR.MINOR.PATCH)");
+    catalogModalitiesSchema = z13.object({
+      input: z13.array(z13.string()),
+      output: z13.array(z13.string())
     }).strict();
-    catalogCostSchema = z12.object({
-      input: z12.number().optional(),
-      output: z12.number().optional(),
-      cache_read: z12.number().optional(),
-      cache_write: z12.number().optional(),
-      context_over_200k: z12.number().optional()
+    catalogCostSchema = z13.object({
+      input: z13.number().optional(),
+      output: z13.number().optional(),
+      cache_read: z13.number().optional(),
+      cache_write: z13.number().optional(),
+      context_over_200k: z13.number().optional()
     }).strict();
-    catalogLimitSchema = z12.object({
-      context: z12.number(),
-      output: z12.number()
+    catalogLimitSchema = z13.object({
+      context: z13.number(),
+      output: z13.number()
     }).strict();
-    catalogModelProviderSchema = z12.object({
-      npm: z12.string(),
-      api: z12.string()
+    catalogModelProviderSchema = z13.object({
+      npm: z13.string(),
+      api: z13.string()
     }).strict();
-    catalogModelEntrySchema = z12.object({
-      id: z12.string(),
-      name: z12.string(),
-      family: z12.string(),
-      attachment: z12.boolean(),
-      reasoning: z12.boolean(),
-      temperature: z12.boolean(),
-      interleaved: z12.boolean(),
-      tool_call: z12.boolean(),
+    catalogModelEntrySchema = z13.object({
+      id: z13.string(),
+      name: z13.string(),
+      family: z13.string(),
+      attachment: z13.boolean(),
+      reasoning: z13.boolean(),
+      temperature: z13.boolean(),
+      interleaved: z13.boolean(),
+      tool_call: z13.boolean(),
       modalities: catalogModalitiesSchema,
       cost: catalogCostSchema,
       limit: catalogLimitSchema,
-      status: z12.enum(CATALOG_MODEL_STATUSES),
+      status: z13.enum(CATALOG_MODEL_STATUSES),
       release_date: isoDate,
       provider: catalogModelProviderSchema
     }).strict();
-    catalogProviderSchema = z12.object({
-      id: z12.string(),
-      endpoint: z12.string(),
-      authTypes: z12.array(z12.enum(CATALOG_AUTH_TYPES)).min(1),
-      npm: z12.string().optional()
+    catalogProviderSchema = z13.object({
+      id: z13.string(),
+      endpoint: z13.string(),
+      authTypes: z13.array(z13.enum(CATALOG_AUTH_TYPES)).min(1),
+      npm: z13.string().optional()
     }).strict();
-    curatedCatalogSchema = z12.object({
-      $schema: z12.string().optional(),
+    curatedCatalogSchema = z13.object({
+      $schema: z13.string().optional(),
       version: semver,
       lastUpdated: isoDate,
-      providers: z12.record(z12.string(), catalogProviderSchema),
-      models: z12.record(z12.string(), z12.record(z12.string(), catalogModelEntrySchema))
+      providers: z13.record(z13.string(), catalogProviderSchema),
+      models: z13.record(z13.string(), z13.record(z13.string(), catalogModelEntrySchema))
     }).strict();
-    modelsCatalogRowInsertSchema = z12.object({
-      id: z12.string(),
-      providerId: z12.string(),
-      name: z12.string(),
-      family: z12.string(),
-      attachment: z12.boolean(),
-      reasoning: z12.boolean(),
-      temperature: z12.boolean(),
-      interleaved: z12.boolean(),
-      toolCall: z12.boolean(),
-      modalities: z12.string(),
-      cost: z12.string(),
-      contextLimit: z12.number().nullable().optional(),
-      outputLimit: z12.number().nullable().optional(),
-      status: z12.enum(CATALOG_MODEL_STATUSES),
+    modelsCatalogRowInsertSchema = z13.object({
+      id: z13.string(),
+      providerId: z13.string(),
+      name: z13.string(),
+      family: z13.string(),
+      attachment: z13.boolean(),
+      reasoning: z13.boolean(),
+      temperature: z13.boolean(),
+      interleaved: z13.boolean(),
+      toolCall: z13.boolean(),
+      modalities: z13.string(),
+      cost: z13.string(),
+      contextLimit: z13.number().nullable().optional(),
+      outputLimit: z13.number().nullable().optional(),
+      status: z13.enum(CATALOG_MODEL_STATUSES),
       releaseDate: isoDate,
-      modelsDevId: z12.string(),
-      source: z12.string(),
-      seededAt: z12.string().optional()
+      modelsDevId: z13.string(),
+      source: z13.string(),
+      seededAt: z13.string().optional()
     }).strict();
     modelsCatalogRowSelectSchema = modelsCatalogRowInsertSchema.extend({
-      seededAt: z12.string()
+      seededAt: z13.string()
     });
   }
 });
@@ -15612,7 +16013,7 @@ var init_status_registry = __esm({
 });
 
 // packages/contracts/src/workgraph.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 var E_WORKGRAPH_PARENT_TYPE_MATRIX, taskTypeSchema, taskPrioritySchema, taskStatusSchema, verificationGateSchema, workGraphRelationKindSchema, workGraphTraversalDirectionSchema, workGraphEdgeDirectionSchema, paginationParamsSchema, workGraphNodeSchema, workGraphEdgeSchema, workGraphHierarchyEdgeSchema, workGraphPageInfoSchema, workGraphRollupCountsSchema, workGraphSubtreePercentagesSchema, workGraphProjectionMismatchSchema, workGraphReadyFrontierTaskSchema, workGraphRelationEdgeSchema, workGraphDependencyEdgeSchema, workGraphOmissionReasonSchema, workGraphContextBudgetSchema, workGraphOmissionSchema, workGraphDirectEdgeSchema, workGraphContextPackParamsSchema, workGraphSliceParamsSchema, workGraphSliceSchema, workGraphReadinessParamsSchema, workGraphReadinessResultSchema, workGraphContextPackSchema, workGraphScaffoldValidateParamsSchema, workGraphScaffoldValidationIssueSchema, workGraphScaffoldValidateResultSchema, workGraphScaffoldApplyParamsSchema, workGraphScaffoldApplyResultSchema, workGraphPlanningDocParamsSchema, workGraphPlanningDocSchema, tasksTraverseParamsSchema, tasksTraverseResultSchema, tasksTreeParamsSchema, tasksTreeResultSchema, tasksRollupParamsSchema, tasksRollupResultSchema, tasksFrontierParamsSchema, tasksFrontierResultSchema, tasksWorkGraphAuditParamsSchema, tasksWorkGraphAuditResultSchema;
 var init_workgraph = __esm({
   "packages/contracts/src/workgraph.ts"() {
@@ -15620,10 +16021,10 @@ var init_workgraph = __esm({
     init_enums();
     init_status_registry();
     E_WORKGRAPH_PARENT_TYPE_MATRIX = "E_WORKGRAPH_PARENT_TYPE_MATRIX";
-    taskTypeSchema = z13.enum(["saga", "epic", "task", "subtask"]);
-    taskPrioritySchema = z13.enum(["critical", "high", "medium", "low"]);
-    taskStatusSchema = z13.enum(TASK_STATUSES);
-    verificationGateSchema = z13.enum([
+    taskTypeSchema = z14.enum(["saga", "epic", "task", "subtask"]);
+    taskPrioritySchema = z14.enum(["critical", "high", "medium", "low"]);
+    taskStatusSchema = z14.enum(TASK_STATUSES);
+    verificationGateSchema = z14.enum([
       "implemented",
       "testsPassed",
       "qaPassed",
@@ -15632,7 +16033,7 @@ var init_workgraph = __esm({
       "documented",
       "nexusImpact"
     ]);
-    workGraphRelationKindSchema = z13.enum([
+    workGraphRelationKindSchema = z14.enum([
       "contains",
       "depends_on",
       "blocks",
@@ -15640,317 +16041,317 @@ var init_workgraph = __esm({
       "groups",
       "satisfies"
     ]);
-    workGraphTraversalDirectionSchema = z13.enum([
+    workGraphTraversalDirectionSchema = z14.enum([
       "ancestors",
       "descendants",
       "upstream",
       "downstream"
     ]);
-    workGraphEdgeDirectionSchema = z13.enum(["out", "in", "both"]);
-    paginationParamsSchema = z13.object({
-      cursor: z13.string().min(1).optional(),
-      limit: z13.number().int().positive().max(500).optional()
+    workGraphEdgeDirectionSchema = z14.enum(["out", "in", "both"]);
+    paginationParamsSchema = z14.object({
+      cursor: z14.string().min(1).optional(),
+      limit: z14.number().int().positive().max(500).optional()
     });
-    workGraphNodeSchema = z13.object({
-      id: z13.string().min(1),
+    workGraphNodeSchema = z14.object({
+      id: z14.string().min(1),
       type: taskTypeSchema,
-      title: z13.string(),
+      title: z14.string(),
       status: taskStatusSchema,
       priority: taskPrioritySchema,
-      parentId: z13.string().min(1).optional()
+      parentId: z14.string().min(1).optional()
     });
-    workGraphEdgeSchema = z13.object({
-      fromId: z13.string().min(1),
-      toId: z13.string().min(1),
+    workGraphEdgeSchema = z14.object({
+      fromId: z14.string().min(1),
+      toId: z14.string().min(1),
       kind: workGraphRelationKindSchema
     });
-    workGraphHierarchyEdgeSchema = z13.object({
-      fromId: z13.string().min(1),
-      toId: z13.string().min(1),
-      kind: z13.literal("contains")
+    workGraphHierarchyEdgeSchema = z14.object({
+      fromId: z14.string().min(1),
+      toId: z14.string().min(1),
+      kind: z14.literal("contains")
     }).strict();
-    workGraphPageInfoSchema = z13.object({
-      nextCursor: z13.string().min(1).optional(),
-      hasMore: z13.boolean()
-    });
-    workGraphRollupCountsSchema = z13.object({
-      total: z13.number().int().nonnegative(),
-      byStatus: z13.partialRecord(taskStatusSchema, z13.number().int().nonnegative()),
-      byType: z13.partialRecord(taskTypeSchema, z13.number().int().nonnegative())
-    });
-    workGraphSubtreePercentagesSchema = z13.object({
-      done: z13.number().nonnegative(),
-      active: z13.number().nonnegative(),
-      blocked: z13.number().nonnegative(),
-      pending: z13.number().nonnegative(),
-      cancelled: z13.number().nonnegative()
-    });
-    workGraphProjectionMismatchSchema = z13.object({
-      field: z13.string().min(1),
-      expected: z13.number().int().nonnegative(),
-      actual: z13.number().int().nonnegative()
+    workGraphPageInfoSchema = z14.object({
+      nextCursor: z14.string().min(1).optional(),
+      hasMore: z14.boolean()
+    });
+    workGraphRollupCountsSchema = z14.object({
+      total: z14.number().int().nonnegative(),
+      byStatus: z14.partialRecord(taskStatusSchema, z14.number().int().nonnegative()),
+      byType: z14.partialRecord(taskTypeSchema, z14.number().int().nonnegative())
+    });
+    workGraphSubtreePercentagesSchema = z14.object({
+      done: z14.number().nonnegative(),
+      active: z14.number().nonnegative(),
+      blocked: z14.number().nonnegative(),
+      pending: z14.number().nonnegative(),
+      cancelled: z14.number().nonnegative()
+    });
+    workGraphProjectionMismatchSchema = z14.object({
+      field: z14.string().min(1),
+      expected: z14.number().int().nonnegative(),
+      actual: z14.number().int().nonnegative()
     });
     workGraphReadyFrontierTaskSchema = workGraphNodeSchema.extend({
-      role: z13.string().min(1).optional(),
-      dependencyBlockers: z13.array(z13.object({ taskId: z13.string().min(1), status: taskStatusSchema })),
-      gateBlockers: z13.array(z13.object({ gate: verificationGateSchema }))
+      role: z14.string().min(1).optional(),
+      dependencyBlockers: z14.array(z14.object({ taskId: z14.string().min(1), status: taskStatusSchema })),
+      gateBlockers: z14.array(z14.object({ gate: verificationGateSchema }))
     });
     workGraphRelationEdgeSchema = workGraphEdgeSchema.extend({
-      source: z13.literal("relation"),
-      relationType: z13.enum(TASK_RELATION_TYPES),
-      reason: z13.string().min(1).optional()
+      source: z14.literal("relation"),
+      relationType: z14.enum(TASK_RELATION_TYPES),
+      reason: z14.string().min(1).optional()
     });
     workGraphDependencyEdgeSchema = workGraphEdgeSchema.extend({
-      source: z13.literal("dependency"),
-      kind: z13.literal("depends_on")
+      source: z14.literal("dependency"),
+      kind: z14.literal("depends_on")
     });
-    workGraphOmissionReasonSchema = z13.enum([
+    workGraphOmissionReasonSchema = z14.enum([
       "budget_exceeded",
       "not_requested",
       "not_available",
       "redacted",
       "truncated"
     ]);
-    workGraphContextBudgetSchema = z13.object({
-      tokenBudget: z13.number().int().nonnegative(),
-      estimatedTokens: z13.number().int().nonnegative(),
-      remainingTokens: z13.number().int().nonnegative(),
-      truncated: z13.boolean()
-    });
-    workGraphOmissionSchema = z13.object({
-      path: z13.string().min(1),
+    workGraphContextBudgetSchema = z14.object({
+      tokenBudget: z14.number().int().nonnegative(),
+      estimatedTokens: z14.number().int().nonnegative(),
+      remainingTokens: z14.number().int().nonnegative(),
+      truncated: z14.boolean()
+    });
+    workGraphOmissionSchema = z14.object({
+      path: z14.string().min(1),
       reason: workGraphOmissionReasonSchema,
-      message: z13.string().min(1),
-      estimatedTokens: z13.number().int().nonnegative().optional()
+      message: z14.string().min(1),
+      estimatedTokens: z14.number().int().nonnegative().optional()
     });
-    workGraphDirectEdgeSchema = z13.discriminatedUnion("source", [
+    workGraphDirectEdgeSchema = z14.discriminatedUnion("source", [
       workGraphRelationEdgeSchema,
       workGraphDependencyEdgeSchema
     ]);
     workGraphContextPackParamsSchema = paginationParamsSchema.extend({
-      rootId: z13.string().min(1),
-      tokenBudget: z13.number().int().positive().optional(),
-      includeRelations: z13.boolean().optional(),
-      includeReadiness: z13.boolean().optional(),
-      includeRollup: z13.boolean().optional()
+      rootId: z14.string().min(1),
+      tokenBudget: z14.number().int().positive().optional(),
+      includeRelations: z14.boolean().optional(),
+      includeReadiness: z14.boolean().optional(),
+      includeRollup: z14.boolean().optional()
     });
     workGraphSliceParamsSchema = paginationParamsSchema.extend({
-      rootId: z13.string().min(1),
+      rootId: z14.string().min(1),
       direction: workGraphTraversalDirectionSchema.optional(),
-      maxDepth: z13.number().int().nonnegative().optional(),
-      includeRelations: z13.boolean().optional()
+      maxDepth: z14.number().int().nonnegative().optional(),
+      includeRelations: z14.boolean().optional()
     });
-    workGraphSliceSchema = z13.object({
-      rootId: z13.string().min(1),
+    workGraphSliceSchema = z14.object({
+      rootId: z14.string().min(1),
       direction: workGraphTraversalDirectionSchema,
-      nodes: z13.array(workGraphNodeSchema),
-      edges: z13.array(workGraphEdgeSchema),
+      nodes: z14.array(workGraphNodeSchema),
+      edges: z14.array(workGraphEdgeSchema),
       pageInfo: workGraphPageInfoSchema,
-      omissions: z13.array(workGraphOmissionSchema).optional()
-    });
-    workGraphReadinessParamsSchema = z13.object({
-      rootId: z13.string().min(1),
-      role: z13.string().min(1).optional(),
-      includeGateBlockers: z13.boolean().optional()
-    });
-    workGraphReadinessResultSchema = z13.object({
-      rootId: z13.string().min(1),
-      role: z13.string().min(1).optional(),
-      ready: z13.boolean(),
-      warnings: z13.array(z13.string()),
-      groups: z13.object({
-        ready: z13.array(workGraphReadyFrontierTaskSchema),
-        blocked: z13.array(workGraphReadyFrontierTaskSchema),
-        blockedBy: z13.array(
-          z13.discriminatedUnion("kind", [
-            z13.object({
-              kind: z13.literal("dependency"),
-              blockerId: z13.string().min(1),
-              blocks: z13.array(z13.string().min(1))
+      omissions: z14.array(workGraphOmissionSchema).optional()
+    });
+    workGraphReadinessParamsSchema = z14.object({
+      rootId: z14.string().min(1),
+      role: z14.string().min(1).optional(),
+      includeGateBlockers: z14.boolean().optional()
+    });
+    workGraphReadinessResultSchema = z14.object({
+      rootId: z14.string().min(1),
+      role: z14.string().min(1).optional(),
+      ready: z14.boolean(),
+      warnings: z14.array(z14.string()),
+      groups: z14.object({
+        ready: z14.array(workGraphReadyFrontierTaskSchema),
+        blocked: z14.array(workGraphReadyFrontierTaskSchema),
+        blockedBy: z14.array(
+          z14.discriminatedUnion("kind", [
+            z14.object({
+              kind: z14.literal("dependency"),
+              blockerId: z14.string().min(1),
+              blocks: z14.array(z14.string().min(1))
             }),
-            z13.object({
-              kind: z13.literal("gate"),
+            z14.object({
+              kind: z14.literal("gate"),
               gate: verificationGateSchema,
-              blocks: z13.array(z13.string().min(1))
+              blocks: z14.array(z14.string().min(1))
             })
           ])
         )
       })
     });
-    workGraphContextPackSchema = z13.object({
-      rootId: z13.string().min(1),
-      generatedAt: z13.string().min(1),
+    workGraphContextPackSchema = z14.object({
+      rootId: z14.string().min(1),
+      generatedAt: z14.string().min(1),
       budget: workGraphContextBudgetSchema,
       slice: workGraphSliceSchema,
-      relationEdges: z13.object({
-        rootId: z13.string().min(1),
+      relationEdges: z14.object({
+        rootId: z14.string().min(1),
         direction: workGraphEdgeDirectionSchema,
-        edges: z13.array(workGraphDirectEdgeSchema)
+        edges: z14.array(workGraphDirectEdgeSchema)
       }).optional(),
       readiness: workGraphReadinessResultSchema.optional(),
-      rollup: z13.lazy(() => tasksRollupResultSchema).optional(),
-      omissions: z13.array(workGraphOmissionSchema)
-    });
-    workGraphScaffoldValidateParamsSchema = z13.object({
-      rootId: z13.string().min(1),
-      nodes: z13.array(
-        z13.object({
-          id: z13.string().min(1),
+      rollup: z14.lazy(() => tasksRollupResultSchema).optional(),
+      omissions: z14.array(workGraphOmissionSchema)
+    });
+    workGraphScaffoldValidateParamsSchema = z14.object({
+      rootId: z14.string().min(1),
+      nodes: z14.array(
+        z14.object({
+          id: z14.string().min(1),
           type: taskTypeSchema,
-          parentId: z13.string().min(1).nullable().optional()
+          parentId: z14.string().min(1).nullable().optional()
         })
       ),
-      edges: z13.array(workGraphDirectEdgeSchema).optional(),
-      dryRun: z13.boolean().optional()
-    });
-    workGraphScaffoldValidationIssueSchema = z13.object({
-      code: z13.string().min(1),
-      message: z13.string().min(1),
-      taskId: z13.string().min(1).optional(),
-      severity: z13.enum(["error", "warning"])
-    });
-    workGraphScaffoldValidateResultSchema = z13.object({
-      rootId: z13.string().min(1),
-      valid: z13.boolean(),
-      dryRun: z13.boolean(),
-      issues: z13.array(workGraphScaffoldValidationIssueSchema),
-      hierarchy: z13.object({
-        valid: z13.boolean(),
-        violations: z13.array(
-          z13.object({
-            code: z13.literal(E_WORKGRAPH_PARENT_TYPE_MATRIX),
-            taskId: z13.string().min(1),
+      edges: z14.array(workGraphDirectEdgeSchema).optional(),
+      dryRun: z14.boolean().optional()
+    });
+    workGraphScaffoldValidationIssueSchema = z14.object({
+      code: z14.string().min(1),
+      message: z14.string().min(1),
+      taskId: z14.string().min(1).optional(),
+      severity: z14.enum(["error", "warning"])
+    });
+    workGraphScaffoldValidateResultSchema = z14.object({
+      rootId: z14.string().min(1),
+      valid: z14.boolean(),
+      dryRun: z14.boolean(),
+      issues: z14.array(workGraphScaffoldValidationIssueSchema),
+      hierarchy: z14.object({
+        valid: z14.boolean(),
+        violations: z14.array(
+          z14.object({
+            code: z14.literal(E_WORKGRAPH_PARENT_TYPE_MATRIX),
+            taskId: z14.string().min(1),
             taskType: taskTypeSchema,
-            parentId: z13.string().min(1).nullable(),
+            parentId: z14.string().min(1).nullable(),
             parentType: taskTypeSchema.optional(),
-            message: z13.string().min(1)
+            message: z14.string().min(1)
           })
         )
       })
     });
     workGraphScaffoldApplyParamsSchema = workGraphScaffoldValidateParamsSchema.extend({
-      apply: z13.boolean().optional()
+      apply: z14.boolean().optional()
     });
     workGraphScaffoldApplyResultSchema = workGraphScaffoldValidateResultSchema.extend({
-      applied: z13.boolean(),
-      nodesChanged: z13.number().int().nonnegative(),
-      edgesChanged: z13.number().int().nonnegative()
-    });
-    workGraphPlanningDocParamsSchema = z13.object({
-      rootId: z13.string().min(1),
-      audience: z13.enum(["agent", "maintainer"]),
-      tokenBudget: z13.number().int().positive().optional(),
-      includeRelations: z13.boolean().optional(),
-      includeReadiness: z13.boolean().optional(),
-      includeRollup: z13.boolean().optional()
-    });
-    workGraphPlanningDocSchema = z13.object({
-      rootId: z13.string().min(1),
-      generatedAt: z13.string().min(1),
-      audience: z13.enum(["agent", "maintainer"]),
-      title: z13.string().min(1),
-      content: z13.string(),
-      sections: z13.array(z13.string().min(1)),
-      estimatedTokens: z13.number().int().nonnegative(),
-      budget: z13.object({
-        tokenBudget: z13.number().int().positive(),
-        truncated: z13.boolean()
+      applied: z14.boolean(),
+      nodesChanged: z14.number().int().nonnegative(),
+      edgesChanged: z14.number().int().nonnegative()
+    });
+    workGraphPlanningDocParamsSchema = z14.object({
+      rootId: z14.string().min(1),
+      audience: z14.enum(["agent", "maintainer"]),
+      tokenBudget: z14.number().int().positive().optional(),
+      includeRelations: z14.boolean().optional(),
+      includeReadiness: z14.boolean().optional(),
+      includeRollup: z14.boolean().optional()
+    });
+    workGraphPlanningDocSchema = z14.object({
+      rootId: z14.string().min(1),
+      generatedAt: z14.string().min(1),
+      audience: z14.enum(["agent", "maintainer"]),
+      title: z14.string().min(1),
+      content: z14.string(),
+      sections: z14.array(z14.string().min(1)),
+      estimatedTokens: z14.number().int().nonnegative(),
+      budget: z14.object({
+        tokenBudget: z14.number().int().positive(),
+        truncated: z14.boolean()
       }).optional()
     });
     tasksTraverseParamsSchema = paginationParamsSchema.extend({
-      rootId: z13.string().min(1),
+      rootId: z14.string().min(1),
       direction: workGraphTraversalDirectionSchema,
-      maxDepth: z13.number().int().nonnegative().optional(),
-      includeRelations: z13.boolean().optional()
+      maxDepth: z14.number().int().nonnegative().optional(),
+      includeRelations: z14.boolean().optional()
     });
-    tasksTraverseResultSchema = z13.object({
-      rootId: z13.string().min(1),
+    tasksTraverseResultSchema = z14.object({
+      rootId: z14.string().min(1),
       direction: workGraphTraversalDirectionSchema,
-      nodes: z13.array(workGraphNodeSchema),
-      edges: z13.array(workGraphEdgeSchema),
+      nodes: z14.array(workGraphNodeSchema),
+      edges: z14.array(workGraphEdgeSchema),
       pageInfo: workGraphPageInfoSchema
     });
     tasksTreeParamsSchema = paginationParamsSchema.extend({
-      rootId: z13.string().min(1),
-      maxDepth: z13.number().int().nonnegative().optional()
+      rootId: z14.string().min(1),
+      maxDepth: z14.number().int().nonnegative().optional()
     });
-    tasksTreeResultSchema = z13.object({
-      rootId: z13.string().min(1),
-      nodes: z13.array(workGraphNodeSchema.extend({ depth: z13.number().int().positive() })),
-      edges: z13.array(workGraphHierarchyEdgeSchema),
+    tasksTreeResultSchema = z14.object({
+      rootId: z14.string().min(1),
+      nodes: z14.array(workGraphNodeSchema.extend({ depth: z14.number().int().positive() })),
+      edges: z14.array(workGraphHierarchyEdgeSchema),
       pageInfo: workGraphPageInfoSchema
     });
-    tasksRollupParamsSchema = z13.object({
-      rootId: z13.string().min(1),
+    tasksRollupParamsSchema = z14.object({
+      rootId: z14.string().min(1),
       expectedDirectRollup: workGraphRollupCountsSchema.optional()
     });
-    tasksRollupResultSchema = z13.object({
-      rootId: z13.string().min(1),
+    tasksRollupResultSchema = z14.object({
+      rootId: z14.string().min(1),
       direct: workGraphRollupCountsSchema,
       subtree: workGraphRollupCountsSchema,
-      percentDenominator: z13.object({
-        basis: z13.literal("subtree-total"),
-        total: z13.number().int().nonnegative(),
-        description: z13.string().min(1)
+      percentDenominator: z14.object({
+        basis: z14.literal("subtree-total"),
+        total: z14.number().int().nonnegative(),
+        description: z14.string().min(1)
       }),
       percentages: workGraphSubtreePercentagesSchema,
-      staleProjection: z13.boolean(),
-      projectionMismatches: z13.array(workGraphProjectionMismatchSchema)
-    });
-    tasksFrontierParamsSchema = z13.object({
-      rootId: z13.string().min(1),
-      role: z13.string().min(1).optional()
-    });
-    tasksFrontierResultSchema = z13.object({
-      rootId: z13.string().min(1),
-      role: z13.string().min(1).optional(),
-      groups: z13.object({
-        ready: z13.array(workGraphReadyFrontierTaskSchema),
-        blocked: z13.array(workGraphReadyFrontierTaskSchema),
-        blockedBy: z13.array(
-          z13.discriminatedUnion("kind", [
-            z13.object({
-              kind: z13.literal("dependency"),
-              blockerId: z13.string().min(1),
-              blocks: z13.array(z13.string().min(1))
+      staleProjection: z14.boolean(),
+      projectionMismatches: z14.array(workGraphProjectionMismatchSchema)
+    });
+    tasksFrontierParamsSchema = z14.object({
+      rootId: z14.string().min(1),
+      role: z14.string().min(1).optional()
+    });
+    tasksFrontierResultSchema = z14.object({
+      rootId: z14.string().min(1),
+      role: z14.string().min(1).optional(),
+      groups: z14.object({
+        ready: z14.array(workGraphReadyFrontierTaskSchema),
+        blocked: z14.array(workGraphReadyFrontierTaskSchema),
+        blockedBy: z14.array(
+          z14.discriminatedUnion("kind", [
+            z14.object({
+              kind: z14.literal("dependency"),
+              blockerId: z14.string().min(1),
+              blocks: z14.array(z14.string().min(1))
             }),
-            z13.object({
-              kind: z13.literal("gate"),
+            z14.object({
+              kind: z14.literal("gate"),
               gate: verificationGateSchema,
-              blocks: z13.array(z13.string().min(1))
+              blocks: z14.array(z14.string().min(1))
             })
           ])
         )
       })
     });
     tasksWorkGraphAuditParamsSchema = paginationParamsSchema.extend({
-      rootId: z13.string().min(1),
-      maxDepth: z13.number().int().nonnegative().optional(),
-      includeRelations: z13.boolean().optional()
-    });
-    tasksWorkGraphAuditResultSchema = z13.object({
-      rootId: z13.string().min(1),
-      hierarchy: z13.object({
-        valid: z13.boolean(),
-        violations: z13.array(
-          z13.object({
-            code: z13.literal(E_WORKGRAPH_PARENT_TYPE_MATRIX),
-            taskId: z13.string().min(1),
+      rootId: z14.string().min(1),
+      maxDepth: z14.number().int().nonnegative().optional(),
+      includeRelations: z14.boolean().optional()
+    });
+    tasksWorkGraphAuditResultSchema = z14.object({
+      rootId: z14.string().min(1),
+      hierarchy: z14.object({
+        valid: z14.boolean(),
+        violations: z14.array(
+          z14.object({
+            code: z14.literal(E_WORKGRAPH_PARENT_TYPE_MATRIX),
+            taskId: z14.string().min(1),
             taskType: taskTypeSchema,
-            parentId: z13.string().min(1).nullable(),
+            parentId: z14.string().min(1).nullable(),
             parentType: taskTypeSchema.optional(),
-            message: z13.string().min(1)
+            message: z14.string().min(1)
           })
         )
       }),
       traversal: tasksTraverseResultSchema,
       frontier: tasksFrontierResultSchema,
       rollup: tasksRollupResultSchema,
-      relationEdges: z13.object({
-        rootId: z13.string().min(1),
+      relationEdges: z14.object({
+        rootId: z14.string().min(1),
         direction: workGraphEdgeDirectionSchema,
-        edges: z13.array(
-          z13.discriminatedUnion("source", [
+        edges: z14.array(
+          z14.discriminatedUnion("source", [
             workGraphRelationEdgeSchema,
             workGraphDependencyEdgeSchema
           ])
@@ -15970,49 +16371,49 @@ var init_operation_envelope_validation = __esm({
 });
 
 // packages/contracts/src/operations/docs.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 var DOCS_PROJECTION_PROPOSAL_SCHEMA, DOCS_PROJECTION_RECEIPT_SCHEMA;
 var init_docs = __esm({
   "packages/contracts/src/operations/docs.ts"() {
     "use strict";
     init_docs_taxonomy();
     init_docs_lifecycle();
-    DOCS_PROJECTION_PROPOSAL_SCHEMA = z14.object({
-      version: z14.literal(1),
-      operation: z14.literal("docs.projection"),
-      identity: z14.object({
-        projectId: z14.string().min(1),
-        projectRoot: z14.string().min(1),
-        actor: z14.string().min(1),
-        operation: z14.literal("docs.projection"),
-        idempotencyKey: z14.string().min(1)
+    DOCS_PROJECTION_PROPOSAL_SCHEMA = z15.object({
+      version: z15.literal(1),
+      operation: z15.literal("docs.projection"),
+      identity: z15.object({
+        projectId: z15.string().min(1),
+        projectRoot: z15.string().min(1),
+        actor: z15.string().min(1),
+        operation: z15.literal("docs.projection"),
+        idempotencyKey: z15.string().min(1)
       }).strict(),
-      source: z14.object({
-        attachmentId: z14.string().min(1),
-        sha256: z14.string().regex(/^[a-f0-9]{64}$/),
-        ownerId: z14.string().min(1),
-        ownerType: z14.enum(["task", "session", "observation", "decision", "learning", "pattern"]),
-        label: z14.string().min(1)
+      source: z15.object({
+        attachmentId: z15.string().min(1),
+        sha256: z15.string().regex(/^[a-f0-9]{64}$/),
+        ownerId: z15.string().min(1),
+        ownerType: z15.enum(["task", "session", "observation", "decision", "learning", "pattern"]),
+        label: z15.string().min(1)
       }).strict(),
-      observation: z14.object({
-        kind: z14.literal("doc-attachment"),
-        attachmentId: z14.string().min(1),
-        ownerId: z14.string().min(1),
-        addedAt: z14.string().min(1),
-        slug: z14.string().optional(),
-        type: z14.string().optional()
+      observation: z15.object({
+        kind: z15.literal("doc-attachment"),
+        attachmentId: z15.string().min(1),
+        ownerId: z15.string().min(1),
+        addedAt: z15.string().min(1),
+        slug: z15.string().optional(),
+        type: z15.string().optional()
       }).strict()
     }).strict();
-    DOCS_PROJECTION_RECEIPT_SCHEMA = z14.object({
-      version: z14.literal(1),
-      sourceHash: z14.string().regex(/^[a-f0-9]{64}$/),
-      graph: z14.enum(["completed", "disabled"]),
+    DOCS_PROJECTION_RECEIPT_SCHEMA = z15.object({
+      version: z15.literal(1),
+      sourceHash: z15.string().regex(/^[a-f0-9]{64}$/),
+      graph: z15.enum(["completed", "disabled"]),
       /** Legacy receipts (before T13985): the "Doc attached" observation the projection wrote. */
-      observationId: z14.string().min(1).optional(),
+      observationId: z15.string().min(1).optional(),
       /** T13985 (D11180): the canonical `llmtxt --documents--> owner` edge was written. */
-      documents: z14.literal(true).optional(),
-      verifiedAt: z14.string().min(1),
-      actor: z14.string().min(1)
+      documents: z15.literal(true).optional(),
+      verifiedAt: z15.string().min(1),
+      actor: z15.string().min(1)
     }).strict().refine((receipt) => receipt.observationId !== void 0 || receipt.documents === true, {
       message: "A projection receipt records its documents edge or, for legacy jobs, its observation"
     });
@@ -16020,22 +16421,22 @@ var init_docs = __esm({
 });
 
 // packages/contracts/src/operations/ensures-schema-registry.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var taskTreeEntrySchema, taskTreeSchema, evidenceSchema, passthroughSchema, LEGACY_PASSTHROUGH_SCHEMA_NAMES, ENSURES_SCHEMA_REGISTRY;
 var init_ensures_schema_registry = __esm({
   "packages/contracts/src/operations/ensures-schema-registry.ts"() {
     "use strict";
-    taskTreeEntrySchema = z15.object({
-      title: z15.string({ message: "title must be a non-empty string" }).refine((s) => s.trim().length > 0, { message: "title must be a non-empty string" }),
-      acceptance: z15.array(z15.unknown(), { message: "must have a non-empty acceptance array" }).min(1, { message: "must have a non-empty acceptance array" }).refine((arr) => arr.some((s) => typeof s === "string" && s.trim().length > 0), {
+    taskTreeEntrySchema = z16.object({
+      title: z16.string({ message: "title must be a non-empty string" }).refine((s) => s.trim().length > 0, { message: "title must be a non-empty string" }),
+      acceptance: z16.array(z16.unknown(), { message: "must have a non-empty acceptance array" }).min(1, { message: "must have a non-empty acceptance array" }).refine((arr) => arr.some((s) => typeof s === "string" && s.trim().length > 0), {
         message: "acceptance array contains no non-empty strings"
       }),
-      id: z15.string().optional(),
-      parentId: z15.string().optional(),
-      depends: z15.array(z15.string()).optional()
+      id: z16.string().optional(),
+      parentId: z16.string().optional(),
+      depends: z16.array(z16.string()).optional()
     });
-    taskTreeSchema = z15.array(taskTreeEntrySchema, { message: "task_tree must be a non-empty array" }).min(1, { message: "task_tree is an empty array \u2014 decomposition produced no tasks" });
-    evidenceSchema = z15.unknown().superRefine((value, ctx) => {
+    taskTreeSchema = z16.array(taskTreeEntrySchema, { message: "task_tree must be a non-empty array" }).min(1, { message: "task_tree is an empty array \u2014 decomposition produced no tasks" });
+    evidenceSchema = z16.unknown().superRefine((value, ctx) => {
       if (value === null || value === void 0) {
         ctx.addIssue({
           code: "custom",
@@ -16069,7 +16470,7 @@ var init_ensures_schema_registry = __esm({
         message: `evidence must be a string, array, or object (got ${typeof value})`
       });
     });
-    passthroughSchema = z15.unknown();
+    passthroughSchema = z16.unknown();
     LEGACY_PASSTHROUGH_SCHEMA_NAMES = [
       // release.cantbook
       "version_bump_report",
@@ -16354,41 +16755,41 @@ var init_process_probe = __esm({
 });
 
 // packages/contracts/src/release/evidence-atoms.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var parsedPrEvidenceAtomSchema, prEvidenceStateModifierSchema, ghPrViewSchema, PR_REQUIRED_WORKFLOWS;
 var init_evidence_atoms = __esm({
   "packages/contracts/src/release/evidence-atoms.ts"() {
     "use strict";
-    parsedPrEvidenceAtomSchema = z16.object({
-      kind: z16.literal("pr"),
-      prNumber: z16.number().int().positive()
-    });
-    prEvidenceStateModifierSchema = z16.object({
-      kind: z16.literal("state"),
-      value: z16.literal("MERGED")
-    });
-    ghPrViewSchema = z16.object({
-      state: z16.enum(["OPEN", "CLOSED", "MERGED"]),
-      mergedAt: z16.string().nullable(),
-      headRefOid: z16.string().optional(),
-      mergeCommit: z16.object({ oid: z16.string() }).nullable().optional(),
-      title: z16.string().optional(),
-      body: z16.string().optional(),
-      headRefName: z16.string().optional(),
-      files: z16.array(z16.object({ path: z16.string() })).optional(),
-      changedFiles: z16.number().int().nonnegative().optional(),
-      mergeable: z16.string().optional(),
-      statusCheckRollup: z16.array(
-        z16.object({
-          __typename: z16.string().optional(),
-          name: z16.string().optional(),
-          workflowName: z16.string().optional(),
-          conclusion: z16.string().nullable().optional(),
-          status: z16.string().optional(),
+    parsedPrEvidenceAtomSchema = z17.object({
+      kind: z17.literal("pr"),
+      prNumber: z17.number().int().positive()
+    });
+    prEvidenceStateModifierSchema = z17.object({
+      kind: z17.literal("state"),
+      value: z17.literal("MERGED")
+    });
+    ghPrViewSchema = z17.object({
+      state: z17.enum(["OPEN", "CLOSED", "MERGED"]),
+      mergedAt: z17.string().nullable(),
+      headRefOid: z17.string().optional(),
+      mergeCommit: z17.object({ oid: z17.string() }).nullable().optional(),
+      title: z17.string().optional(),
+      body: z17.string().optional(),
+      headRefName: z17.string().optional(),
+      files: z17.array(z17.object({ path: z17.string() })).optional(),
+      changedFiles: z17.number().int().nonnegative().optional(),
+      mergeable: z17.string().optional(),
+      statusCheckRollup: z17.array(
+        z17.object({
+          __typename: z17.string().optional(),
+          name: z17.string().optional(),
+          workflowName: z17.string().optional(),
+          conclusion: z17.string().nullable().optional(),
+          status: z17.string().optional(),
           /** ISO start time of a CheckRun; orders re-runs of one check (T13506). */
-          startedAt: z16.string().nullable().optional(),
+          startedAt: z17.string().nullable().optional(),
           /** ISO completion time of a CheckRun; orders re-runs of one check (T13506). */
-          completedAt: z16.string().nullable().optional()
+          completedAt: z17.string().nullable().optional()
         }).passthrough()
       ).optional().default([])
     }).passthrough();
@@ -16397,7 +16798,7 @@ var init_evidence_atoms = __esm({
 });
 
 // packages/contracts/src/release/plan.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 var RELEASE_CHANNEL, RELEASE_SCHEME, RELEASE_KIND, RELEASE_STATUS, GATE_STATUS, GATE_NAME, PLATFORM_TUPLE, PUBLISHER, TASK_KIND, IMPACT, RESOLVED_SOURCE, ReleaseChannelSchema, ReleaseSchemeSchema, ReleaseKindSchema, ReleaseStatusSchema, GateStatusSchema, GateNameSchema, PlatformTupleSchema, PublisherSchema, TaskKindSchema, ImpactSchema, ResolvedSourceSchema, Iso8601, NonEmptyString, ReleasePlanTaskSchema, ReleaseGateSchema, ReleasePlatformMatrixEntrySchema, ReleasePreflightSummarySchema, ReleasePlanChangelogSchema, ReleasePlanMetaSchema, ReleasePlanSchema;
 var init_plan = __esm({
   "packages/contracts/src/release/plan.ts"() {
@@ -16445,20 +16846,20 @@ var init_plan = __esm({
       "language-default",
       "legacy-alias"
     ];
-    ReleaseChannelSchema = z17.enum(RELEASE_CHANNEL);
-    ReleaseSchemeSchema = z17.enum(RELEASE_SCHEME);
-    ReleaseKindSchema = z17.enum(RELEASE_KIND);
-    ReleaseStatusSchema = z17.enum(RELEASE_STATUS);
-    GateStatusSchema = z17.enum(GATE_STATUS);
-    GateNameSchema = z17.enum(GATE_NAME);
-    PlatformTupleSchema = z17.enum(PLATFORM_TUPLE);
-    PublisherSchema = z17.enum(PUBLISHER);
-    TaskKindSchema = z17.enum(TASK_KIND);
-    ImpactSchema = z17.enum(IMPACT);
-    ResolvedSourceSchema = z17.enum(RESOLVED_SOURCE);
-    Iso8601 = z17.iso.datetime({ offset: true });
-    NonEmptyString = z17.string().min(1);
-    ReleasePlanTaskSchema = z17.object({
+    ReleaseChannelSchema = z18.enum(RELEASE_CHANNEL);
+    ReleaseSchemeSchema = z18.enum(RELEASE_SCHEME);
+    ReleaseKindSchema = z18.enum(RELEASE_KIND);
+    ReleaseStatusSchema = z18.enum(RELEASE_STATUS);
+    GateStatusSchema = z18.enum(GATE_STATUS);
+    GateNameSchema = z18.enum(GATE_NAME);
+    PlatformTupleSchema = z18.enum(PLATFORM_TUPLE);
+    PublisherSchema = z18.enum(PUBLISHER);
+    TaskKindSchema = z18.enum(TASK_KIND);
+    ImpactSchema = z18.enum(IMPACT);
+    ResolvedSourceSchema = z18.enum(RESOLVED_SOURCE);
+    Iso8601 = z18.iso.datetime({ offset: true });
+    NonEmptyString = z18.string().min(1);
+    ReleasePlanTaskSchema = z18.object({
       /** Task ID (e.g. "T10001"). Format intentionally loose so historical IDs validate. */
       id: NonEmptyString,
       /** Conventional-commit-aligned task classification. */
@@ -16466,20 +16867,20 @@ var init_plan = __esm({
       /** SemVer impact classification. */
       impact: ImpactSchema,
       /** Human-readable changelog line for this task. */
-      userFacingSummary: z17.string(),
+      userFacingSummary: z18.string(),
       /**
        * ADR-051 evidence atoms attesting the task's gate results. Format is
        * `kind:value` (e.g. `commit:abc123`, `test-run:vitest.json`). The contract
        * accepts empty arrays so legacy plans validate; `cleo release plan`
        * enforces non-empty via R-301.
        */
-      evidenceAtoms: z17.array(NonEmptyString),
+      evidenceAtoms: z18.array(NonEmptyString),
       /** IVTR phase at plan time — informational only per R-316. */
-      ivtrPhaseAtPlan: z17.string().optional(),
+      ivtrPhaseAtPlan: z18.string().optional(),
       /** Epic this task rolls up to, locked at plan time per R-303. */
       epicAncestor: NonEmptyString
     });
-    ReleaseGateSchema = z17.object({
+    ReleaseGateSchema = z18.object({
       /** Canonical gate name. */
       name: GateNameSchema,
       /** ADR-051 atom string identifying the resolved tool (e.g. `tool:test`). */
@@ -16489,11 +16890,11 @@ var init_plan = __esm({
       /** ISO-8601 timestamp the gate was last verified. */
       lastVerifiedAt: Iso8601,
       /** Resolved shell command (e.g. `pnpm run test`). Optional for unresolved gates. */
-      resolvedCommand: z17.string().optional(),
+      resolvedCommand: z18.string().optional(),
       /** Provenance of the resolved command. Optional for unresolved gates. */
       resolvedSource: ResolvedSourceSchema.optional()
     });
-    ReleasePlatformMatrixEntrySchema = z17.object({
+    ReleasePlatformMatrixEntrySchema = z18.object({
       /** Target platform tuple. */
       platform: PlatformTupleSchema,
       /** Distribution backend. */
@@ -16501,47 +16902,47 @@ var init_plan = __esm({
       /** Package identifier on the target backend (e.g. `@cleocode/cleo`). */
       package: NonEmptyString,
       /** Whether to run the GHA smoke job for this matrix entry. */
-      smoke: z17.boolean().default(true).optional()
+      smoke: z18.boolean().default(true).optional()
     });
-    ReleasePreflightSummarySchema = z17.object({
+    ReleasePreflightSummarySchema = z18.object({
       /** True if esbuild externals are out of sync with package.json. */
-      esbuildExternalsDrift: z17.boolean(),
+      esbuildExternalsDrift: z18.boolean(),
       /** True if `pnpm-lock.yaml` diverges from the workspace manifest. */
-      lockfileDrift: z17.boolean(),
+      lockfileDrift: z18.boolean(),
       /** True if all epic children are in terminal lifecycle states. */
-      epicCompletenessClean: z17.boolean(),
+      epicCompletenessClean: z18.boolean(),
       /** True if no task appears in multiple in-flight release plans. */
-      doubleListingClean: z17.boolean(),
+      doubleListingClean: z18.boolean(),
       /** Non-fatal preflight warnings (e.g. unresolved tools per R-024). */
-      preflightWarnings: z17.array(z17.string()).default([]).optional()
+      preflightWarnings: z18.array(z18.string()).default([]).optional()
     });
-    ReleasePlanChangelogSchema = z17.object({
+    ReleasePlanChangelogSchema = z18.object({
       /** `kind=feat` tasks. */
-      features: z17.array(NonEmptyString).default([]),
+      features: z18.array(NonEmptyString).default([]),
       /** `kind=fix` or `kind=hotfix` tasks. */
-      fixes: z17.array(NonEmptyString).default([]),
+      fixes: z18.array(NonEmptyString).default([]),
       /** `kind=chore`, `docs`, `refactor`, `test`, `perf` tasks. */
-      chores: z17.array(NonEmptyString).default([]),
+      chores: z18.array(NonEmptyString).default([]),
       /** `kind=breaking` or `kind=revert` tasks. */
-      breaking: z17.array(NonEmptyString).default([])
+      breaking: z18.array(NonEmptyString).default([])
     });
-    ReleasePlanMetaSchema = z17.object({
+    ReleasePlanMetaSchema = z18.object({
       /** True if this is the project's first ever release. */
-      firstEverRelease: z17.boolean().optional(),
+      firstEverRelease: z18.boolean().optional(),
       /** Canonical tool names that could not be resolved at plan time. */
-      unresolvedTools: z17.array(z17.string()).optional(),
+      unresolvedTools: z18.array(z18.string()).optional(),
       /** Project archetype detected at plan time. */
-      archetype: z17.string().optional()
-    }).catchall(z17.unknown());
-    ReleasePlanSchema = z17.object({
+      archetype: z18.string().optional()
+    }).catchall(z18.unknown());
+    ReleasePlanSchema = z18.object({
       /** Schema URL for this plan version. */
-      $schema: z17.string().optional(),
+      $schema: z18.string().optional(),
       /** Requested version string (e.g. "v2026.6.0"). Includes the leading `v`. */
       version: NonEmptyString,
       /** Resolved version string after suffix application (e.g. "v2026.6.0.2"). */
       resolvedVersion: NonEmptyString,
       /** True if a `calver-suffix` was applied to disambiguate a same-day hotfix. */
-      suffixApplied: z17.boolean(),
+      suffixApplied: z18.boolean(),
       /** Versioning scheme governing `version` / `resolvedVersion`. */
       scheme: ReleaseSchemeSchema,
       /** npm dist-tag channel for this release. */
@@ -16555,7 +16956,7 @@ var init_plan = __esm({
       /** Release-kind classification. */
       releaseKind: ReleaseKindSchema,
       /** Explicit hooks-v1 stable promotion; ordinary and hotfix releases are exempt. */
-      hooksV1Promotion: z17.boolean().optional(),
+      hooksV1Promotion: z18.boolean().optional(),
       /** Audited reason for shipping a source change that opens the hooks-v1 gate without the promotion (T13555). */
       hooksV1Waiver: NonEmptyString.optional(),
       /** ISO-8601 timestamp the plan was written. */
@@ -16566,27 +16967,27 @@ var init_plan = __esm({
        * Version of the previous release on the same channel. MUST be `null` only
        * for first-ever releases (R-300, enforced at the verb layer).
        */
-      previousVersion: z17.string().nullable(),
+      previousVersion: z18.string().nullable(),
       /** Git tag of the previous release (typically `previousVersion` prefixed). */
-      previousTag: z17.string().nullable(),
+      previousTag: z18.string().nullable(),
       /** ISO-8601 timestamp the previous release was published. */
       previousShippedAt: Iso8601.nullable(),
       /** Tasks rolled into this release. */
-      tasks: z17.array(ReleasePlanTaskSchema),
+      tasks: z18.array(ReleasePlanTaskSchema),
       /** Bucketed changelog. */
       changelog: ReleasePlanChangelogSchema,
       /** Per-gate verification status. */
-      gates: z17.array(ReleaseGateSchema),
+      gates: z18.array(ReleaseGateSchema),
       /** Platform / publisher matrix. */
-      platformMatrix: z17.array(ReleasePlatformMatrixEntrySchema),
+      platformMatrix: z18.array(ReleasePlatformMatrixEntrySchema),
       /** Preflight summary from `cleo release plan`. */
       preflightSummary: ReleasePreflightSummarySchema,
       /** URL of the GHA workflow run (populated by `release-prepare.yml`). */
-      workflowRunUrl: z17.string().nullable(),
+      workflowRunUrl: z18.string().nullable(),
       /** URL of the bump PR (populated by `cleo release open`). */
-      prUrl: z17.string().nullable(),
+      prUrl: z18.string().nullable(),
       /** Merge commit SHA on `main` (populated by `release-publish.yml`). */
-      mergeCommitSha: z17.string().nullable(),
+      mergeCommitSha: z18.string().nullable(),
       /** Current FSM state per R-302. */
       status: ReleaseStatusSchema,
       /** Informational / forward-compat metadata. */
@@ -16670,61 +17071,67 @@ var init_session2 = __esm({
 });
 
 // packages/contracts/src/session-journal.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 var SESSION_JOURNAL_SCHEMA_VERSION, sessionJournalDoctorSummarySchema, sessionJournalDebriefSummarySchema, sessionJournalEntrySchema;
 var init_session_journal = __esm({
   "packages/contracts/src/session-journal.ts"() {
     "use strict";
     SESSION_JOURNAL_SCHEMA_VERSION = "1.0";
-    sessionJournalDoctorSummarySchema = z18.object({
+    sessionJournalDoctorSummarySchema = z19.object({
       /** `true` when zero noise patterns were detected. */
-      isClean: z18.boolean(),
+      isClean: z19.boolean(),
       /** Total number of noise findings across all patterns. */
-      findingsCount: z18.number().int().nonnegative(),
+      findingsCount: z19.number().int().nonnegative(),
       /** Pattern names that were detected (empty when isClean). */
-      patterns: z18.array(z18.string()),
+      patterns: z19.array(z19.string()),
       /** Total brain entries scanned. `0` = empty or unavailable. */
-      totalScanned: z18.number().int().nonnegative()
+      totalScanned: z19.number().int().nonnegative()
     });
-    sessionJournalDebriefSummarySchema = z18.object({
+    sessionJournalDebriefSummarySchema = z19.object({
       /** First 200 characters of the session end note (if provided). */
-      noteExcerpt: z18.string().max(200).optional(),
+      noteExcerpt: z19.string().max(200).optional(),
       /** Number of tasks completed during the session. */
-      tasksCompletedCount: z18.number().int().nonnegative(),
+      tasksCompletedCount: z19.number().int().nonnegative(),
       /** Up to 5 task IDs (not titles) that were the focus of the session. */
-      tasksFocused: z18.array(z18.string()).max(5).optional()
+      tasksFocused: z19.array(z19.string()).max(5).optional()
     });
-    sessionJournalEntrySchema = z18.object({
+    sessionJournalEntrySchema = z19.object({
       // Identity
       /** Schema version for forward-compatibility. Always `'1.0'` in this release. */
-      schemaVersion: z18.literal(SESSION_JOURNAL_SCHEMA_VERSION),
+      schemaVersion: z19.literal(SESSION_JOURNAL_SCHEMA_VERSION),
       /** ISO 8601 timestamp when the entry was written. */
-      timestamp: z18.string(),
+      timestamp: z19.string(),
       /** CLEO session ID (e.g. `ses_20260424055456_ede571`). */
-      sessionId: z18.string(),
+      sessionId: z19.string(),
       /** Event type that triggered this journal entry. */
-      eventType: z18.enum(["session_start", "session_end", "observation", "decision", "error"]),
+      eventType: z19.enum(["session_start", "session_end", "observation", "decision", "error"]),
       // Session metadata (set on session_start / session_end)
       /** Agent identifier (e.g. `cleo-prime`, `claude-code`). */
-      agentIdentifier: z18.string().optional(),
+      agentIdentifier: z19.string().optional(),
       /** Provider adapter ID active for this session. */
-      providerId: z18.string().optional(),
+      providerId: z19.string().optional(),
       /** Session scope string (e.g. `'global'` or `'epic:T1263'`). */
-      scope: z18.string().optional(),
+      scope: z19.string().optional(),
       // Session-end fields
       /** Duration of the session in seconds (session_end only). */
-      duration: z18.number().int().nonnegative().optional(),
+      duration: z19.number().int().nonnegative().optional(),
       /** Task IDs (not titles) completed during the session. */
-      tasksCompleted: z18.array(z18.string()).optional(),
+      tasksCompleted: z19.array(z19.string()).optional(),
       // Doctor summary (T1262 absorbed)
-      /** Compact result of `scanBrainNoise` run at session-end. */
+      /**
+       * Compact result of `scanBrainNoise` run at session-end.
+       *
+       * @deprecated T14120: no longer written. Session end stopped running the
+       * brain scan (it held `cleo session end` for ~120 s on a large store); kept
+       * so older journal entries still parse. Use `cleo memory doctor`.
+       */
       doctorSummary: sessionJournalDoctorSummarySchema.optional(),
       // Debrief summary
       /** Compact excerpt from session debrief data. */
       debriefSummary: sessionJournalDebriefSummarySchema.optional(),
       // Optional hash chain
       /** SHA-256 hex of the previous entry's raw JSON string (for integrity chain). */
-      prevEntryHash: z18.string().optional()
+      prevEntryHash: z19.string().optional()
     });
   }
 });
@@ -16737,52 +17144,52 @@ var init_task = __esm({
 });
 
 // packages/contracts/src/task-evidence.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 var fileEvidenceSchema, logEvidenceSchema, screenshotEvidenceSchema, testOutputEvidenceSchema, commandOutputEvidenceSchema, taskEvidenceSchema;
 var init_task_evidence = __esm({
   "packages/contracts/src/task-evidence.ts"() {
     "use strict";
-    fileEvidenceSchema = z19.object({
-      kind: z19.literal("file"),
-      sha256: z19.string().length(64),
-      timestamp: z19.string().datetime(),
-      path: z19.string().min(1),
-      mime: z19.string().optional(),
-      description: z19.string().optional()
-    });
-    logEvidenceSchema = z19.object({
-      kind: z19.literal("log"),
-      sha256: z19.string().length(64),
-      timestamp: z19.string().datetime(),
-      source: z19.string().min(1),
-      description: z19.string().optional()
-    });
-    screenshotEvidenceSchema = z19.object({
-      kind: z19.literal("screenshot"),
-      sha256: z19.string().length(64),
-      timestamp: z19.string().datetime(),
-      mime: z19.enum(["image/png", "image/jpeg", "image/webp"]).optional(),
-      description: z19.string().optional()
-    });
-    testOutputEvidenceSchema = z19.object({
-      kind: z19.literal("test-output"),
-      sha256: z19.string().length(64),
-      timestamp: z19.string().datetime(),
-      passed: z19.number().int().nonnegative(),
-      failed: z19.number().int().nonnegative(),
-      skipped: z19.number().int().nonnegative(),
-      exitCode: z19.number().int(),
-      description: z19.string().optional()
-    });
-    commandOutputEvidenceSchema = z19.object({
-      kind: z19.literal("command-output"),
-      sha256: z19.string().length(64),
-      timestamp: z19.string().datetime(),
-      cmd: z19.string().min(1),
-      exitCode: z19.number().int(),
-      description: z19.string().optional()
-    });
-    taskEvidenceSchema = z19.discriminatedUnion("kind", [
+    fileEvidenceSchema = z20.object({
+      kind: z20.literal("file"),
+      sha256: z20.string().length(64),
+      timestamp: z20.string().datetime(),
+      path: z20.string().min(1),
+      mime: z20.string().optional(),
+      description: z20.string().optional()
+    });
+    logEvidenceSchema = z20.object({
+      kind: z20.literal("log"),
+      sha256: z20.string().length(64),
+      timestamp: z20.string().datetime(),
+      source: z20.string().min(1),
+      description: z20.string().optional()
+    });
+    screenshotEvidenceSchema = z20.object({
+      kind: z20.literal("screenshot"),
+      sha256: z20.string().length(64),
+      timestamp: z20.string().datetime(),
+      mime: z20.enum(["image/png", "image/jpeg", "image/webp"]).optional(),
+      description: z20.string().optional()
+    });
+    testOutputEvidenceSchema = z20.object({
+      kind: z20.literal("test-output"),
+      sha256: z20.string().length(64),
+      timestamp: z20.string().datetime(),
+      passed: z20.number().int().nonnegative(),
+      failed: z20.number().int().nonnegative(),
+      skipped: z20.number().int().nonnegative(),
+      exitCode: z20.number().int(),
+      description: z20.string().optional()
+    });
+    commandOutputEvidenceSchema = z20.object({
+      kind: z20.literal("command-output"),
+      sha256: z20.string().length(64),
+      timestamp: z20.string().datetime(),
+      cmd: z20.string().min(1),
+      exitCode: z20.number().int(),
+      description: z20.string().optional()
+    });
+    taskEvidenceSchema = z20.discriminatedUnion("kind", [
       fileEvidenceSchema,
       logEvidenceSchema,
       screenshotEvidenceSchema,
@@ -16793,12 +17200,12 @@ var init_task_evidence = __esm({
 });
 
 // packages/contracts/src/tasks/archive.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var ArchiveReason, ARCHIVE_REASON_VALUES;
 var init_archive = __esm({
   "packages/contracts/src/tasks/archive.ts"() {
     "use strict";
-    ArchiveReason = z20.enum([
+    ArchiveReason = z21.enum([
       "verified",
       "reconciled",
       "superseded",
@@ -16811,47 +17218,47 @@ var init_archive = __esm({
 });
 
 // packages/contracts/src/tasks.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 var taskMutationWarningSeveritySchema, taskMutationWarningSchema, taskMutationDryRunSummarySchema, taskMutationTaskRecordSchema, taskMutationEnvelopeSchema, completionTaskStatusSchema, completionCriterionKindSchema, completionCriterionStatusSchema, completionBlockerReasonSchema, completionStaleReasonSchema, completionProjectionRepairErrorCodeSchema, completionCriterionWaiverSchema, completionCriterionReplacementSchema, completionCriterionEvaluationSchema, unsatisfiedCompletionCriterionSchema, completionTotalsSchema, completionContextPackSchema, completionEvaluationSchema, completionExplanationSchema, completionListParamsSchema, completionListResultSchema, completionEvaluateParamsSchema, completionProjectionRepairErrorSchema, completionProjectionRepairParamsSchema, completionProjectionRepairResultSchema;
 var init_tasks2 = __esm({
   "packages/contracts/src/tasks.ts"() {
     "use strict";
     init_status_registry();
-    taskMutationWarningSeveritySchema = z21.enum(["info", "warning"]);
-    taskMutationWarningSchema = z21.object({
-      code: z21.string().min(1),
-      message: z21.string().min(1),
+    taskMutationWarningSeveritySchema = z22.enum(["info", "warning"]);
+    taskMutationWarningSchema = z22.object({
+      code: z22.string().min(1),
+      message: z22.string().min(1),
       severity: taskMutationWarningSeveritySchema.optional(),
-      taskId: z21.string().min(1).optional(),
-      field: z21.string().min(1).optional(),
-      index: z21.number().int().nonnegative().optional()
-    });
-    taskMutationDryRunSummarySchema = z21.object({
-      dryRun: z21.literal(true),
-      wouldCreate: z21.number().int().nonnegative(),
-      wouldUpdate: z21.number().int().nonnegative(),
-      wouldDelete: z21.number().int().nonnegative(),
-      wouldAffect: z21.number().int().nonnegative(),
-      validatedCount: z21.number().int().nonnegative(),
-      insertedCount: z21.literal(0),
-      updatedCount: z21.literal(0),
-      deletedCount: z21.literal(0),
-      warnings: z21.array(taskMutationWarningSchema)
-    });
-    taskMutationTaskRecordSchema = z21.object({ id: z21.string().min(1) }).passthrough();
-    taskMutationEnvelopeSchema = z21.object({
-      dryRun: z21.boolean().optional(),
-      created: z21.array(taskMutationTaskRecordSchema),
-      updated: z21.array(taskMutationTaskRecordSchema),
-      deleted: z21.array(taskMutationTaskRecordSchema),
-      affectedCount: z21.number().int().nonnegative(),
-      mutationWarnings: z21.array(taskMutationWarningSchema),
+      taskId: z22.string().min(1).optional(),
+      field: z22.string().min(1).optional(),
+      index: z22.number().int().nonnegative().optional()
+    });
+    taskMutationDryRunSummarySchema = z22.object({
+      dryRun: z22.literal(true),
+      wouldCreate: z22.number().int().nonnegative(),
+      wouldUpdate: z22.number().int().nonnegative(),
+      wouldDelete: z22.number().int().nonnegative(),
+      wouldAffect: z22.number().int().nonnegative(),
+      validatedCount: z22.number().int().nonnegative(),
+      insertedCount: z22.literal(0),
+      updatedCount: z22.literal(0),
+      deletedCount: z22.literal(0),
+      warnings: z22.array(taskMutationWarningSchema)
+    });
+    taskMutationTaskRecordSchema = z22.object({ id: z22.string().min(1) }).passthrough();
+    taskMutationEnvelopeSchema = z22.object({
+      dryRun: z22.boolean().optional(),
+      created: z22.array(taskMutationTaskRecordSchema),
+      updated: z22.array(taskMutationTaskRecordSchema),
+      deleted: z22.array(taskMutationTaskRecordSchema),
+      affectedCount: z22.number().int().nonnegative(),
+      mutationWarnings: z22.array(taskMutationWarningSchema),
       dryRunSummary: taskMutationDryRunSummarySchema.optional()
     });
-    completionTaskStatusSchema = z21.enum(TASK_STATUSES);
-    completionCriterionKindSchema = z21.enum(["text", "evidence_bound", "child_task"]);
-    completionCriterionStatusSchema = z21.enum(["satisfied", "unsatisfied", "waived", "replaced"]);
-    completionBlockerReasonSchema = z21.enum([
+    completionTaskStatusSchema = z22.enum(TASK_STATUSES);
+    completionCriterionKindSchema = z22.enum(["text", "evidence_bound", "child_task"]);
+    completionCriterionStatusSchema = z22.enum(["satisfied", "unsatisfied", "waived", "replaced"]);
+    completionBlockerReasonSchema = z22.enum([
       "missing_evidence_binding",
       "child_not_done",
       "child_cancelled_requires_waiver",
@@ -16859,68 +17266,68 @@ var init_tasks2 = __esm({
       "child_missing",
       "done_parent_stale"
     ]);
-    completionStaleReasonSchema = z21.enum(["done_parent_has_unsatisfied_criteria"]);
-    completionProjectionRepairErrorCodeSchema = z21.enum([
+    completionStaleReasonSchema = z22.enum(["done_parent_has_unsatisfied_criteria"]);
+    completionProjectionRepairErrorCodeSchema = z22.enum([
       "projection_not_stale",
       "criteria_missing",
       "binding_target_missing",
       "repair_conflict"
     ]);
-    completionCriterionWaiverSchema = z21.object({
-      criterionAcId: z21.string().min(1),
-      childTaskId: z21.string().min(1),
-      reason: z21.string().min(1),
-      actor: z21.string().min(1),
-      waivedAt: z21.string().min(1)
-    });
-    completionCriterionReplacementSchema = z21.object({
-      criterionAcId: z21.string().min(1),
-      originalChildTaskId: z21.string().min(1),
-      replacementChildTaskId: z21.string().min(1),
-      reason: z21.string().min(1),
-      actor: z21.string().min(1),
-      replacedAt: z21.string().min(1)
-    });
-    completionCriterionEvaluationSchema = z21.object({
-      acId: z21.string().min(1),
-      alias: z21.string().min(1),
-      text: z21.string(),
+    completionCriterionWaiverSchema = z22.object({
+      criterionAcId: z22.string().min(1),
+      childTaskId: z22.string().min(1),
+      reason: z22.string().min(1),
+      actor: z22.string().min(1),
+      waivedAt: z22.string().min(1)
+    });
+    completionCriterionReplacementSchema = z22.object({
+      criterionAcId: z22.string().min(1),
+      originalChildTaskId: z22.string().min(1),
+      replacementChildTaskId: z22.string().min(1),
+      reason: z22.string().min(1),
+      actor: z22.string().min(1),
+      replacedAt: z22.string().min(1)
+    });
+    completionCriterionEvaluationSchema = z22.object({
+      acId: z22.string().min(1),
+      alias: z22.string().min(1),
+      text: z22.string(),
       kind: completionCriterionKindSchema,
       status: completionCriterionStatusSchema,
       reason: completionBlockerReasonSchema.optional(),
-      targetTaskId: z21.string().min(1).optional(),
+      targetTaskId: z22.string().min(1).optional(),
       targetTaskStatus: completionTaskStatusSchema.optional(),
       waiver: completionCriterionWaiverSchema.optional(),
       replacement: completionCriterionReplacementSchema.optional(),
       replacementTaskStatus: completionTaskStatusSchema.optional(),
-      evidenceBindings: z21.number().int().nonnegative()
+      evidenceBindings: z22.number().int().nonnegative()
     });
     unsatisfiedCompletionCriterionSchema = completionCriterionEvaluationSchema.extend({
-      status: z21.literal("unsatisfied"),
+      status: z22.literal("unsatisfied"),
       reason: completionBlockerReasonSchema
     });
-    completionTotalsSchema = z21.object({
-      criteria: z21.number().int().nonnegative(),
-      satisfied: z21.number().int().nonnegative(),
-      unsatisfied: z21.number().int().nonnegative(),
-      waived: z21.number().int().nonnegative(),
-      replaced: z21.number().int().nonnegative()
-    });
-    completionContextPackSchema = z21.object({
-      taskId: z21.string().min(1),
-      generatedAt: z21.string().min(1),
-      source: z21.literal("audit_log"),
-      window: z21.object({
-        limit: z21.number().int().positive(),
-        since: z21.string().min(1).optional(),
-        relationDepth: z21.number().int().nonnegative(),
-        relatedTaskIds: z21.array(z21.string().min(1))
+    completionTotalsSchema = z22.object({
+      criteria: z22.number().int().nonnegative(),
+      satisfied: z22.number().int().nonnegative(),
+      unsatisfied: z22.number().int().nonnegative(),
+      waived: z22.number().int().nonnegative(),
+      replaced: z22.number().int().nonnegative()
+    });
+    completionContextPackSchema = z22.object({
+      taskId: z22.string().min(1),
+      generatedAt: z22.string().min(1),
+      source: z22.literal("audit_log"),
+      window: z22.object({
+        limit: z22.number().int().positive(),
+        since: z22.string().min(1).optional(),
+        relationDepth: z22.number().int().nonnegative(),
+        relatedTaskIds: z22.array(z22.string().min(1))
       }),
-      events: z21.array(
-        z21.object({
-          id: z21.string().min(1),
-          timestamp: z21.string().min(1),
-          action: z21.enum([
+      events: z22.array(
+        z22.object({
+          id: z22.string().min(1),
+          timestamp: z22.string().min(1),
+          action: z22.enum([
             "task_completed",
             "task_reopened",
             "task_cancelled",
@@ -16928,77 +17335,77 @@ var init_tasks2 = __esm({
             "task_reparented",
             "ac_projection_rebuilt"
           ]),
-          taskId: z21.string().min(1),
-          relation: z21.enum(["self", "parent", "child", "sibling", "related"]),
-          actor: z21.string().min(1),
-          details: z21.record(z21.string(), z21.unknown()).optional(),
-          before: z21.record(z21.string(), z21.unknown()).optional(),
-          after: z21.record(z21.string(), z21.unknown()).optional()
+          taskId: z22.string().min(1),
+          relation: z22.enum(["self", "parent", "child", "sibling", "related"]),
+          actor: z22.string().min(1),
+          details: z22.record(z22.string(), z22.unknown()).optional(),
+          before: z22.record(z22.string(), z22.unknown()).optional(),
+          after: z22.record(z22.string(), z22.unknown()).optional()
         })
       ),
-      summary: z21.object({
-        totalEvents: z21.number().int().nonnegative(),
-        byAction: z21.record(z21.string(), z21.number().int().nonnegative()),
-        byRelation: z21.record(z21.string(), z21.number().int().nonnegative()),
-        latestEventAt: z21.string().nullable()
+      summary: z22.object({
+        totalEvents: z22.number().int().nonnegative(),
+        byAction: z22.record(z22.string(), z22.number().int().nonnegative()),
+        byRelation: z22.record(z22.string(), z22.number().int().nonnegative()),
+        latestEventAt: z22.string().nullable()
       })
     });
-    completionEvaluationSchema = z21.object({
-      taskId: z21.string().min(1),
+    completionEvaluationSchema = z22.object({
+      taskId: z22.string().min(1),
       taskStatus: completionTaskStatusSchema,
-      ready: z21.boolean(),
-      stale: z21.boolean(),
-      staleReasons: z21.array(completionStaleReasonSchema),
+      ready: z22.boolean(),
+      stale: z22.boolean(),
+      staleReasons: z22.array(completionStaleReasonSchema),
       contextPack: completionContextPackSchema.optional(),
-      satisfied: z21.array(completionCriterionEvaluationSchema),
-      unsatisfied: z21.array(unsatisfiedCompletionCriterionSchema),
-      waived: z21.array(completionCriterionEvaluationSchema),
-      replaced: z21.array(completionCriterionEvaluationSchema),
+      satisfied: z22.array(completionCriterionEvaluationSchema),
+      unsatisfied: z22.array(unsatisfiedCompletionCriterionSchema),
+      waived: z22.array(completionCriterionEvaluationSchema),
+      replaced: z22.array(completionCriterionEvaluationSchema),
       totals: completionTotalsSchema
     });
-    completionExplanationSchema = z21.object({
-      taskId: z21.string().min(1),
-      ready: z21.boolean(),
-      stale: z21.boolean(),
-      summary: z21.string(),
+    completionExplanationSchema = z22.object({
+      taskId: z22.string().min(1),
+      ready: z22.boolean(),
+      stale: z22.boolean(),
+      summary: z22.string(),
       contextPack: completionContextPackSchema.optional(),
-      blockers: z21.array(completionCriterionEvaluationSchema)
+      blockers: z22.array(completionCriterionEvaluationSchema)
     });
-    completionListParamsSchema = z21.object({
-      taskId: z21.string().min(1),
+    completionListParamsSchema = z22.object({
+      taskId: z22.string().min(1),
       status: completionCriterionStatusSchema.optional(),
       kind: completionCriterionKindSchema.optional()
     });
-    completionListResultSchema = z21.object({
-      taskId: z21.string().min(1),
-      criteria: z21.array(completionCriterionEvaluationSchema),
+    completionListResultSchema = z22.object({
+      taskId: z22.string().min(1),
+      criteria: z22.array(completionCriterionEvaluationSchema),
       totals: completionTotalsSchema
     });
-    completionEvaluateParamsSchema = z21.object({
-      taskId: z21.string().min(1),
-      includeContext: z21.boolean().optional(),
-      limit: z21.number().int().positive().optional(),
-      since: z21.string().min(1).optional(),
-      relationDepth: z21.number().int().nonnegative().optional()
+    completionEvaluateParamsSchema = z22.object({
+      taskId: z22.string().min(1),
+      includeContext: z22.boolean().optional(),
+      limit: z22.number().int().positive().optional(),
+      since: z22.string().min(1).optional(),
+      relationDepth: z22.number().int().nonnegative().optional()
     });
-    completionProjectionRepairErrorSchema = z21.object({
+    completionProjectionRepairErrorSchema = z22.object({
       code: completionProjectionRepairErrorCodeSchema,
-      message: z21.string().min(1),
-      taskId: z21.string().min(1),
-      acId: z21.string().min(1).optional(),
-      evidenceAtomId: z21.string().min(1).optional()
+      message: z22.string().min(1),
+      taskId: z22.string().min(1),
+      acId: z22.string().min(1).optional(),
+      evidenceAtomId: z22.string().min(1).optional()
     });
-    completionProjectionRepairParamsSchema = z21.object({
-      taskId: z21.string().min(1),
-      dryRun: z21.boolean().optional()
+    completionProjectionRepairParamsSchema = z22.object({
+      taskId: z22.string().min(1),
+      dryRun: z22.boolean().optional()
     });
-    completionProjectionRepairResultSchema = z21.object({
-      taskId: z21.string().min(1),
-      repaired: z21.boolean(),
-      dryRun: z21.boolean(),
-      staleBefore: z21.boolean(),
-      staleAfter: z21.boolean(),
-      errors: z21.array(completionProjectionRepairErrorSchema)
+    completionProjectionRepairResultSchema = z22.object({
+      taskId: z22.string().min(1),
+      repaired: z22.boolean(),
+      dryRun: z22.boolean(),
+      staleBefore: z22.boolean(),
+      staleAfter: z22.boolean(),
+      errors: z22.array(completionProjectionRepairErrorSchema)
     });
   }
 });
@@ -17509,7 +17916,7 @@ var init_taxonomy = __esm({
 });
 
 // packages/contracts/src/templates/manifest.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 var TEMPLATE_KINDS, TEMPLATE_SUBSTITUTIONS, TEMPLATE_UPDATE_STRATEGIES, PLACEHOLDER_SOURCES, PlaceholderSpecSchema, TemplateManifestEntrySchema;
 var init_manifest2 = __esm({
   "packages/contracts/src/templates/manifest.ts"() {
@@ -17530,85 +17937,85 @@ var init_manifest2 = __esm({
       "tool-resolver",
       "literal"
     ];
-    PlaceholderSpecSchema = z22.object({
+    PlaceholderSpecSchema = z23.object({
       /**
        * Placeholder identifier as it appears in the template body
        * (e.g. `NODE_VERSION` matches `{{NODE_VERSION}}`).
        */
-      name: z22.string().min(1, "placeholder name must be non-empty"),
+      name: z23.string().min(1, "placeholder name must be non-empty"),
       /** Resolver source the installer consults for this placeholder. */
-      source: z22.enum(PLACEHOLDER_SOURCES),
+      source: z23.enum(PLACEHOLDER_SOURCES),
       /**
        * Path expression evaluated against `source` (e.g. `engines.node` against
        * `project-context`, `defaults.branchModel` against `.cleo/config`).
        * For `literal` source, this MAY be the literal value's identifier.
        */
-      sourcePath: z22.string().min(1, "placeholder sourcePath must be non-empty"),
+      sourcePath: z23.string().min(1, "placeholder sourcePath must be non-empty"),
       /**
        * Fallback value used when `source[sourcePath]` resolves to `undefined`.
        * `null` is permitted to explicitly mark "no default — failure required".
        */
-      defaultValue: z22.union([z22.string(), z22.number(), z22.boolean(), z22.null()]).optional()
+      defaultValue: z23.union([z23.string(), z23.number(), z23.boolean(), z23.null()]).optional()
     });
-    TemplateManifestEntrySchema = z22.object({
+    TemplateManifestEntrySchema = z23.object({
       /** Stable identifier for this template entry. */
-      id: z22.string().min(1, "id must be non-empty"),
+      id: z23.string().min(1, "id must be non-empty"),
       /** Category of file this template represents. */
-      kind: z22.enum(TEMPLATE_KINDS),
+      kind: z23.enum(TEMPLATE_KINDS),
       /** Repo-relative path of the template source file. */
-      sourcePath: z22.string().min(1, "sourcePath must be non-empty"),
+      sourcePath: z23.string().min(1, "sourcePath must be non-empty"),
       /** Project-relative path where the rendered template installs. */
-      installPath: z22.string().min(1, "installPath must be non-empty"),
+      installPath: z23.string().min(1, "installPath must be non-empty"),
       /** Substitution strategy the installer applies to `sourcePath`. */
-      substitution: z22.enum(TEMPLATE_SUBSTITUTIONS),
+      substitution: z23.enum(TEMPLATE_SUBSTITUTIONS),
       /** Declared placeholders this template requires. May be empty. */
-      placeholders: z22.array(PlaceholderSpecSchema),
+      placeholders: z23.array(PlaceholderSpecSchema),
       /** Reconciliation policy on upgrade. */
-      updateStrategy: z22.enum(TEMPLATE_UPDATE_STRATEGIES)
+      updateStrategy: z23.enum(TEMPLATE_UPDATE_STRATEGIES)
     });
   }
 });
 
 // packages/contracts/src/validator/index.ts
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 var VALIDATOR_ID_REGEX, validatorFindingSchema, validatorAttestationSchema, validatorRejectionSchema, validatorVerdictSchema;
 var init_validator = __esm({
   "packages/contracts/src/validator/index.ts"() {
     "use strict";
     VALIDATOR_ID_REGEX = /^validator-[a-z0-9][a-z0-9-]*$/;
-    validatorFindingSchema = z23.object({
-      acId: z23.string().min(1, "acId must be non-empty"),
-      status: z23.enum(["pass", "fail", "inconclusive"]),
-      reasoning: z23.string().min(1, "reasoning must be non-empty"),
-      evidenceRefs: z23.array(z23.string()).optional(),
-      checkedAt: z23.string().min(1, "checkedAt must be a non-empty ISO-8601 string")
-    });
-    validatorAttestationSchema = z23.object({
-      verdict: z23.literal("attest"),
-      taskId: z23.string().min(1),
-      validatorId: z23.string().regex(VALIDATOR_ID_REGEX, "validatorId must match the pattern validator-<discriminator>"),
-      findings: z23.array(validatorFindingSchema).min(1, "attestation must contain at least one finding").refine(
+    validatorFindingSchema = z24.object({
+      acId: z24.string().min(1, "acId must be non-empty"),
+      status: z24.enum(["pass", "fail", "inconclusive"]),
+      reasoning: z24.string().min(1, "reasoning must be non-empty"),
+      evidenceRefs: z24.array(z24.string()).optional(),
+      checkedAt: z24.string().min(1, "checkedAt must be a non-empty ISO-8601 string")
+    });
+    validatorAttestationSchema = z24.object({
+      verdict: z24.literal("attest"),
+      taskId: z24.string().min(1),
+      validatorId: z24.string().regex(VALIDATOR_ID_REGEX, "validatorId must match the pattern validator-<discriminator>"),
+      findings: z24.array(validatorFindingSchema).min(1, "attestation must contain at least one finding").refine(
         (findings) => findings.every((f) => f.status === "pass"),
         'attestation requires every finding to have status="pass"'
       ),
-      summary: z23.string().optional(),
-      attestedAt: z23.string().min(1),
-      schemaVersion: z23.literal("1")
-    });
-    validatorRejectionSchema = z23.object({
-      verdict: z23.literal("reject"),
-      taskId: z23.string().min(1),
-      validatorId: z23.string().regex(VALIDATOR_ID_REGEX, "validatorId must match the pattern validator-<discriminator>"),
-      findings: z23.array(validatorFindingSchema).min(1, "rejection must contain at least one finding").refine(
+      summary: z24.string().optional(),
+      attestedAt: z24.string().min(1),
+      schemaVersion: z24.literal("1")
+    });
+    validatorRejectionSchema = z24.object({
+      verdict: z24.literal("reject"),
+      taskId: z24.string().min(1),
+      validatorId: z24.string().regex(VALIDATOR_ID_REGEX, "validatorId must match the pattern validator-<discriminator>"),
+      findings: z24.array(validatorFindingSchema).min(1, "rejection must contain at least one finding").refine(
         (findings) => findings.some((f) => f.status !== "pass"),
         'rejection requires at least one finding with status "fail" or "inconclusive"'
       ),
-      summary: z23.string().min(1, "rejection summary must be non-empty"),
-      remediationHints: z23.array(z23.string()).optional(),
-      rejectedAt: z23.string().min(1),
-      schemaVersion: z23.literal("1")
+      summary: z24.string().min(1, "rejection summary must be non-empty"),
+      remediationHints: z24.array(z24.string()).optional(),
+      rejectedAt: z24.string().min(1),
+      schemaVersion: z24.literal("1")
     });
-    validatorVerdictSchema = z23.discriminatedUnion("verdict", [
+    validatorVerdictSchema = z24.discriminatedUnion("verdict", [
       validatorAttestationSchema,
       validatorRejectionSchema
     ]);
@@ -18379,7 +18786,7 @@ var init_collection_keys = __esm({
 });
 
 // packages/contracts/src/decide.ts
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 var DECISION_QUESTION_TYPES, DECISION_OUTCOME_SOURCES, DECISION_REQUEST_LIMITS, DECISION_PROVIDER_KINDS, decisionQuestionTypeSchema, decisionOutcomeSourceSchema, decisionInstructionsSchema, unitIntervalSchema, decisionStateSchema, noulDecisionQuestionSchema, choiceDecisionQuestionSchema, scoreDecisionQuestionSchema, decisionQuestionSchema, decisionRequestSchema, noulDecisionAnswerSchema, choiceDecisionAnswerSchema, scoreDecisionAnswerSchema, decisionAnswerSchema, decisionOutcomeSchema, decisionProviderKindSchema, decisionProviderConfigSchema;
 var init_decide = __esm({
   "packages/contracts/src/decide.ts"() {
@@ -18405,11 +18812,11 @@ var init_decide = __esm({
       maxScoreLevels: 10
     };
     DECISION_PROVIDER_KINDS = ["layahost", "jev"];
-    decisionQuestionTypeSchema = z24.enum(DECISION_QUESTION_TYPES);
-    decisionOutcomeSourceSchema = z24.enum(DECISION_OUTCOME_SOURCES);
-    decisionInstructionsSchema = z24.union([z24.string(), z24.record(z24.string(), z24.json())]);
-    unitIntervalSchema = z24.number().min(0).max(1);
-    decisionStateSchema = z24.union([z24.string(), z24.array(z24.json()), z24.record(z24.string(), z24.json())]).superRefine((state, context) => {
+    decisionQuestionTypeSchema = z25.enum(DECISION_QUESTION_TYPES);
+    decisionOutcomeSourceSchema = z25.enum(DECISION_OUTCOME_SOURCES);
+    decisionInstructionsSchema = z25.union([z25.string(), z25.record(z25.string(), z25.json())]);
+    unitIntervalSchema = z25.number().min(0).max(1);
+    decisionStateSchema = z25.union([z25.string(), z25.array(z25.json()), z25.record(z25.string(), z25.json())]).superRefine((state, context) => {
       const size = typeof state === "string" ? state.length : JSON.stringify(state).length;
       if (size > DECISION_REQUEST_LIMITS.maxStateChars) {
         context.addIssue({
@@ -18418,34 +18825,34 @@ var init_decide = __esm({
         });
       }
     });
-    noulDecisionQuestionSchema = z24.object({
-      type: z24.literal("noul"),
+    noulDecisionQuestionSchema = z25.object({
+      type: z25.literal("noul"),
       instructions: decisionInstructionsSchema.optional(),
-      criteria: z24.string().min(1)
+      criteria: z25.string().min(1)
     });
-    choiceDecisionQuestionSchema = z24.object({
-      type: z24.literal("choice"),
+    choiceDecisionQuestionSchema = z25.object({
+      type: z25.literal("choice"),
       instructions: decisionInstructionsSchema.optional(),
-      criteria: z24.record(z24.string().min(1), z24.string()).refine((options) => Object.keys(options).length >= DECISION_REQUEST_LIMITS.minChoiceOptions, {
+      criteria: z25.record(z25.string().min(1), z25.string()).refine((options) => Object.keys(options).length >= DECISION_REQUEST_LIMITS.minChoiceOptions, {
         message: `a choice question needs at least ${DECISION_REQUEST_LIMITS.minChoiceOptions} options`
       })
     });
-    scoreDecisionQuestionSchema = z24.object({
-      type: z24.literal("score"),
+    scoreDecisionQuestionSchema = z25.object({
+      type: z25.literal("score"),
       instructions: decisionInstructionsSchema.optional(),
-      criteria: z24.array(z24.string()).min(DECISION_REQUEST_LIMITS.minScoreLevels).max(DECISION_REQUEST_LIMITS.maxScoreLevels)
+      criteria: z25.array(z25.string()).min(DECISION_REQUEST_LIMITS.minScoreLevels).max(DECISION_REQUEST_LIMITS.maxScoreLevels)
     });
-    decisionQuestionSchema = z24.discriminatedUnion("type", [
+    decisionQuestionSchema = z25.discriminatedUnion("type", [
       noulDecisionQuestionSchema,
       choiceDecisionQuestionSchema,
       scoreDecisionQuestionSchema
     ]);
-    decisionRequestSchema = z24.object({
-      model: z24.string().min(1).optional(),
-      lang: z24.string().regex(/^[a-z]{2,3}(-[A-Za-z0-9]{2,8})?$/).optional(),
-      cache: z24.boolean().optional(),
+    decisionRequestSchema = z25.object({
+      model: z25.string().min(1).optional(),
+      lang: z25.string().regex(/^[a-z]{2,3}(-[A-Za-z0-9]{2,8})?$/).optional(),
+      cache: z25.boolean().optional(),
       state: decisionStateSchema,
-      questions: z24.record(z24.string().min(1), decisionQuestionSchema).refine(
+      questions: z25.record(z25.string().min(1), decisionQuestionSchema).refine(
         (questions) => {
           const count = Object.keys(questions).length;
           return count >= DECISION_REQUEST_LIMITS.minQuestions && count <= DECISION_REQUEST_LIMITS.maxQuestions;
@@ -18455,43 +18862,43 @@ var init_decide = __esm({
         }
       )
     });
-    noulDecisionAnswerSchema = z24.object({
-      type: z24.literal("noul"),
-      value: z24.boolean(),
+    noulDecisionAnswerSchema = z25.object({
+      type: z25.literal("noul"),
+      value: z25.boolean(),
       probability: unitIntervalSchema,
       confidence: unitIntervalSchema
     });
-    choiceDecisionAnswerSchema = z24.object({
-      type: z24.literal("choice"),
-      value: z24.string().min(1),
-      probabilities: z24.record(z24.string().min(1), unitIntervalSchema),
+    choiceDecisionAnswerSchema = z25.object({
+      type: z25.literal("choice"),
+      value: z25.string().min(1),
+      probabilities: z25.record(z25.string().min(1), unitIntervalSchema),
       confidence: unitIntervalSchema
     });
-    scoreDecisionAnswerSchema = z24.object({
-      type: z24.literal("score"),
-      value: z24.number().int().nonnegative(),
-      probabilities: z24.array(unitIntervalSchema).min(DECISION_REQUEST_LIMITS.minScoreLevels).max(DECISION_REQUEST_LIMITS.maxScoreLevels),
+    scoreDecisionAnswerSchema = z25.object({
+      type: z25.literal("score"),
+      value: z25.number().int().nonnegative(),
+      probabilities: z25.array(unitIntervalSchema).min(DECISION_REQUEST_LIMITS.minScoreLevels).max(DECISION_REQUEST_LIMITS.maxScoreLevels),
       confidence: unitIntervalSchema
     });
-    decisionAnswerSchema = z24.discriminatedUnion("type", [
+    decisionAnswerSchema = z25.discriminatedUnion("type", [
       noulDecisionAnswerSchema,
       choiceDecisionAnswerSchema,
       scoreDecisionAnswerSchema
     ]);
-    decisionOutcomeSchema = z24.object({
-      answers: z24.record(z24.string().min(1), decisionAnswerSchema),
+    decisionOutcomeSchema = z25.object({
+      answers: z25.record(z25.string().min(1), decisionAnswerSchema),
       source: decisionOutcomeSourceSchema,
-      requestId: z24.string().min(1).optional(),
-      latencyMs: z24.number().nonnegative(),
-      costUsd: z24.number().nonnegative().optional(),
-      costMicros: z24.number().int().nonnegative().optional(),
-      balanceMicros: z24.number().int().optional(),
-      checkpoint: z24.string().min(1).optional(),
-      inputTokens: z24.number().int().nonnegative().optional()
-    });
-    decisionProviderKindSchema = z24.enum(DECISION_PROVIDER_KINDS);
-    decisionProviderConfigSchema = z24.object({
-      baseUrl: z24.url(),
+      requestId: z25.string().min(1).optional(),
+      latencyMs: z25.number().nonnegative(),
+      costUsd: z25.number().nonnegative().optional(),
+      costMicros: z25.number().int().nonnegative().optional(),
+      balanceMicros: z25.number().int().optional(),
+      checkpoint: z25.string().min(1).optional(),
+      inputTokens: z25.number().int().nonnegative().optional()
+    });
+    decisionProviderKindSchema = z25.enum(DECISION_PROVIDER_KINDS);
+    decisionProviderConfigSchema = z25.object({
+      baseUrl: z25.url(),
       provider: decisionProviderKindSchema.optional()
     });
   }
@@ -18505,33 +18912,33 @@ var init_decide_sites = __esm({
 });
 
 // packages/contracts/src/nexus-account.ts
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 var nexusAccountUserSchema, nexusAccountOrganizationSchema, nexusAccountMeSchema;
 var init_nexus_account = __esm({
   "packages/contracts/src/nexus-account.ts"() {
     "use strict";
-    nexusAccountUserSchema = z25.object({
-      id: z25.string(),
-      email: z25.string(),
-      name: z25.string().nullable().optional()
-    });
-    nexusAccountOrganizationSchema = z25.object({
-      id: z25.string(),
-      name: z25.string(),
-      slug: z25.string().nullable().optional(),
-      role: z25.string().optional(),
+    nexusAccountUserSchema = z26.object({
+      id: z26.string(),
+      email: z26.string(),
+      name: z26.string().nullable().optional()
+    });
+    nexusAccountOrganizationSchema = z26.object({
+      id: z26.string(),
+      name: z26.string(),
+      slug: z26.string().nullable().optional(),
+      role: z26.string().optional(),
       /** `true` for the personal organization created at sign-up. */
-      personal: z25.boolean().optional()
+      personal: z26.boolean().optional()
     });
-    nexusAccountMeSchema = z25.object({
+    nexusAccountMeSchema = z26.object({
       user: nexusAccountUserSchema,
-      organizations: z25.array(nexusAccountOrganizationSchema).default([])
+      organizations: z26.array(nexusAccountOrganizationSchema).default([])
     });
   }
 });
 
 // packages/contracts/src/nexus-cloud.ts
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 var NEXUS_DEVICE_STATES, NEXUS_CLOUD_PROFILES, NEXUS_DEVICE_STATE_UNKNOWN, isoTime, profile, deviceState, nexusCloudCredentialSchema, nexusCloudDeviceSchema, nexusCloudOrganizationSchema, nexusCloudUserSchema, nexusCloudWhoamiSchema, nexusCloudDevicePageSchema, nexusCloudPresenceSchema, nexusCloudReplicaSchema, nexusCloudDeviceCountsSchema, projectFields, nexusCloudProjectListItemSchema, nexusCloudProjectPageSchema, nexusCloudProjectDetailSchema, nexusCloudReplicaPageSchema, NEXUS_STATUS_CHECK_IDS, NEXUS_STATUS_VERDICTS, CLOUD_STATUS_VERDICTS, knownCheckId, nexusCloudStatusCheckSchema, nexusCloudStatusSchema, LOGIN, SESSION_EXPIRED_LOGIN, SERVER_REFUSED, NEXUS_FORBIDDEN_ERRORS;
 var init_nexus_cloud = __esm({
   "packages/contracts/src/nexus-cloud.ts"() {
@@ -18539,74 +18946,74 @@ var init_nexus_cloud = __esm({
     NEXUS_DEVICE_STATES = ["active", "signed-out", "revoked"];
     NEXUS_CLOUD_PROFILES = ["device", "read-only"];
     NEXUS_DEVICE_STATE_UNKNOWN = "unknown";
-    isoTime = z26.iso.datetime({ offset: true });
-    profile = z26.enum(NEXUS_CLOUD_PROFILES).nullable().catch(null);
-    deviceState = z26.enum([...NEXUS_DEVICE_STATES, NEXUS_DEVICE_STATE_UNKNOWN]).catch(NEXUS_DEVICE_STATE_UNKNOWN);
-    nexusCloudCredentialSchema = z26.object({
-      kind: z26.enum(["device", "session"]),
-      credentialId: z26.string().nullable().optional(),
+    isoTime = z27.iso.datetime({ offset: true });
+    profile = z27.enum(NEXUS_CLOUD_PROFILES).nullable().catch(null);
+    deviceState = z27.enum([...NEXUS_DEVICE_STATES, NEXUS_DEVICE_STATE_UNKNOWN]).catch(NEXUS_DEVICE_STATE_UNKNOWN);
+    nexusCloudCredentialSchema = z27.object({
+      kind: z27.enum(["device", "session"]),
+      credentialId: z27.string().nullable().optional(),
       profile: profile.optional(),
-      scopes: z26.array(z26.string()).default([]),
+      scopes: z27.array(z27.string()).default([]),
       createdAt: isoTime.nullable().optional(),
       lastUsedAt: isoTime.nullable().optional(),
       /** When the credential expires if it is not used again; null for sessions. */
       idleExpiresAt: isoTime.nullable().optional()
     });
-    nexusCloudDeviceSchema = z26.object({
-      deviceId: z26.string(),
-      name: z26.string(),
-      platform: z26.string().optional(),
-      arch: z26.string().nullable().optional(),
-      cliVersion: z26.string().nullable().optional(),
+    nexusCloudDeviceSchema = z27.object({
+      deviceId: z27.string(),
+      name: z27.string(),
+      platform: z27.string().optional(),
+      arch: z27.string().nullable().optional(),
+      cliVersion: z27.string().nullable().optional(),
       createdAt: isoTime.optional(),
       lastSeenAt: isoTime.nullable().optional(),
       state: deviceState,
       signedOutAt: isoTime.nullable().optional(),
       /** Base64 device certificate; null until the device holds a key grant. */
-      certificate: z26.string().nullable().optional(),
+      certificate: z27.string().nullable().optional(),
       /** The current credential's profile, or null with none (signed out or revoked). */
       profile: profile.optional(),
       /** True for the device whose credential made this request. */
-      current: z26.boolean().default(false),
-      projects: z26.number().int().nonnegative().optional(),
-      replicas: z26.number().int().nonnegative().optional(),
+      current: z27.boolean().default(false),
+      projects: z27.number().int().nonnegative().optional(),
+      replicas: z27.number().int().nonnegative().optional(),
       lastSyncAt: isoTime.nullable().optional(),
       lastPresenceAt: isoTime.nullable().optional()
     });
-    nexusCloudOrganizationSchema = z26.object({
-      id: z26.string(),
-      name: z26.string(),
-      slug: z26.string().nullable().optional(),
-      role: z26.string().optional(),
-      personal: z26.boolean().optional()
+    nexusCloudOrganizationSchema = z27.object({
+      id: z27.string(),
+      name: z27.string(),
+      slug: z27.string().nullable().optional(),
+      role: z27.string().optional(),
+      personal: z27.boolean().optional()
     });
-    nexusCloudUserSchema = z26.object({
-      id: z26.string(),
-      email: z26.string(),
-      name: z26.string().nullable().optional()
+    nexusCloudUserSchema = z27.object({
+      id: z27.string(),
+      email: z27.string(),
+      name: z27.string().nullable().optional()
     });
-    nexusCloudWhoamiSchema = z26.object({
+    nexusCloudWhoamiSchema = z27.object({
       serverTime: isoTime.optional(),
       user: nexusCloudUserSchema,
-      organizations: z26.array(nexusCloudOrganizationSchema).default([]),
+      organizations: z27.array(nexusCloudOrganizationSchema).default([]),
       credential: nexusCloudCredentialSchema,
       /** The calling device; null for a session caller. */
       device: nexusCloudDeviceSchema.nullable()
     });
-    nexusCloudDevicePageSchema = z26.object({
-      devices: z26.array(nexusCloudDeviceSchema),
-      nextCursor: z26.string().max(512).nullable().default(null),
-      truncated: z26.boolean().default(false)
+    nexusCloudDevicePageSchema = z27.object({
+      devices: z27.array(nexusCloudDeviceSchema),
+      nextCursor: z27.string().max(512).nullable().default(null),
+      truncated: z27.boolean().default(false)
     });
-    nexusCloudPresenceSchema = z26.looseObject({
+    nexusCloudPresenceSchema = z27.looseObject({
       observedAt: isoTime.optional(),
-      sync: z26.object({ enabled: z26.boolean() }).optional()
+      sync: z27.object({ enabled: z27.boolean() }).optional()
     });
-    nexusCloudReplicaSchema = z26.object({
-      projectId: z26.string(),
-      replicaId: z26.string(),
-      deviceId: z26.string(),
-      deviceName: z26.string(),
+    nexusCloudReplicaSchema = z27.object({
+      projectId: z27.string(),
+      replicaId: z27.string(),
+      deviceId: z27.string(),
+      deviceName: z27.string(),
       deviceState: deviceState.optional(),
       attachedAt: isoTime.optional(),
       lastSyncAt: isoTime.nullable(),
@@ -18615,72 +19022,72 @@ var init_nexus_cloud = __esm({
       /** When the replica was retired (cleo-nexus T123), else null. Absent from servers older than retirement. */
       retiredAt: isoTime.nullable().optional(),
       /** The retired replica's named successor, else null (not retired, or retired with none). */
-      successor: z26.string().nullable().optional()
+      successor: z27.string().nullable().optional()
     });
-    nexusCloudDeviceCountsSchema = z26.object({
-      active: z26.number().int().nonnegative(),
-      total: z26.number().int().nonnegative()
+    nexusCloudDeviceCountsSchema = z27.object({
+      active: z27.number().int().nonnegative(),
+      total: z27.number().int().nonnegative()
     });
     projectFields = {
-      projectId: z26.string(),
-      label: z26.string().nullable(),
-      organizationId: z26.string(),
-      organizationName: z26.string().optional(),
-      remoteUrl: z26.string().nullable().optional(),
+      projectId: z27.string(),
+      label: z27.string().nullable(),
+      organizationId: z27.string(),
+      organizationName: z27.string().optional(),
+      remoteUrl: z27.string().nullable().optional(),
       createdAt: isoTime.optional()
     };
-    nexusCloudProjectListItemSchema = z26.object({
+    nexusCloudProjectListItemSchema = z27.object({
       ...projectFields,
-      role: z26.string(),
+      role: z27.string(),
       /**
        * The project name sealed with the project data key (`Project.encryptedName`), base64;
        * only a holder of the account key can open it (T13102).
        */
-      encryptedName: z26.string().nullable().optional(),
-      streamId: z26.string().optional(),
-      headSeq: z26.number().int().nonnegative().nullable().optional(),
+      encryptedName: z27.string().nullable().optional(),
+      streamId: z27.string().optional(),
+      headSeq: z27.number().int().nonnegative().nullable().optional(),
       /** The stream's head snapshot; null when nothing was ever pushed (T13102: restorable or not). */
-      headCheckpointId: z26.string().nullable().optional(),
-      openConflicts: z26.number().int().nonnegative().optional(),
-      replicas: z26.array(nexusCloudReplicaSchema).default([]),
+      headCheckpointId: z27.string().nullable().optional(),
+      openConflicts: z27.number().int().nonnegative().optional(),
+      replicas: z27.array(nexusCloudReplicaSchema).default([]),
       devices: nexusCloudDeviceCountsSchema.optional(),
-      replicaCount: z26.number().int().nonnegative().optional(),
+      replicaCount: z27.number().int().nonnegative().optional(),
       lastSyncAt: isoTime.nullable().optional(),
       lastPresenceAt: isoTime.nullable().optional(),
       /** This project's replica list was cut at 50 (T12858). */
-      replicasTruncated: z26.boolean().default(false)
+      replicasTruncated: z27.boolean().default(false)
     });
-    nexusCloudProjectPageSchema = z26.object({
-      projects: z26.array(nexusCloudProjectListItemSchema),
-      nextCursor: z26.string().max(512).nullable().default(null),
+    nexusCloudProjectPageSchema = z27.object({
+      projects: z27.array(nexusCloudProjectListItemSchema),
+      nextCursor: z27.string().max(512).nullable().default(null),
       /** Anything in the page was cut (the project list or a replica list). */
-      truncated: z26.boolean().default(false),
+      truncated: z27.boolean().default(false),
       /** The project list itself was cut at 1000 (T12858). */
-      projectsTruncated: z26.boolean().default(false)
+      projectsTruncated: z27.boolean().default(false)
     });
-    nexusCloudProjectDetailSchema = z26.object({
-      project: z26.object({ ...projectFields, deletedAt: isoTime.nullable().optional() }),
-      role: z26.string(),
-      canTrash: z26.boolean().optional(),
-      openConflicts: z26.number().int().nonnegative(),
+    nexusCloudProjectDetailSchema = z27.object({
+      project: z27.object({ ...projectFields, deletedAt: isoTime.nullable().optional() }),
+      role: z27.string(),
+      canTrash: z27.boolean().optional(),
+      openConflicts: z27.number().int().nonnegative(),
       /** At most 50, oldest attachment first. */
-      replicas: z26.array(nexusCloudReplicaSchema),
+      replicas: z27.array(nexusCloudReplicaSchema),
       devices: nexusCloudDeviceCountsSchema,
-      replicaCount: z26.number().int().nonnegative().optional(),
+      replicaCount: z27.number().int().nonnegative().optional(),
       lastSyncAt: isoTime.nullable().optional(),
       /** `replicas` was cut at 50. */
-      truncated: z26.boolean().default(false),
-      stream: z26.object({
-        streamId: z26.string(),
-        headSeq: z26.number().int().nonnegative(),
-        headCheckpointId: z26.string().nullable()
+      truncated: z27.boolean().default(false),
+      stream: z27.object({
+        streamId: z27.string(),
+        headSeq: z27.number().int().nonnegative(),
+        headCheckpointId: z27.string().nullable()
       }).nullable()
     });
-    nexusCloudReplicaPageSchema = z26.object({
-      replicas: z26.array(nexusCloudReplicaSchema),
+    nexusCloudReplicaPageSchema = z27.object({
+      replicas: z27.array(nexusCloudReplicaSchema),
       devices: nexusCloudDeviceCountsSchema.optional(),
-      nextCursor: z26.string().max(512).nullable().default(null),
-      truncated: z26.boolean().default(false)
+      nextCursor: z27.string().max(512).nullable().default(null),
+      truncated: z27.boolean().default(false)
     });
     NEXUS_STATUS_CHECK_IDS = [
       "credential.valid",
@@ -18696,56 +19103,56 @@ var init_nexus_cloud = __esm({
     ];
     NEXUS_STATUS_VERDICTS = ["ok", "attention", "not-linked", "not-registered"];
     CLOUD_STATUS_VERDICTS = [...NEXUS_STATUS_VERDICTS, "not-signed-in"];
-    knownCheckId = z26.enum(NEXUS_STATUS_CHECK_IDS);
-    nexusCloudStatusCheckSchema = z26.object({
-      id: z26.enum(NEXUS_STATUS_CHECK_IDS),
-      ok: z26.boolean(),
-      required: z26.boolean(),
-      detail: z26.string()
-    });
-    nexusCloudStatusSchema = z26.object({
+    knownCheckId = z27.enum(NEXUS_STATUS_CHECK_IDS);
+    nexusCloudStatusCheckSchema = z27.object({
+      id: z27.enum(NEXUS_STATUS_CHECK_IDS),
+      ok: z27.boolean(),
+      required: z27.boolean(),
+      detail: z27.string()
+    });
+    nexusCloudStatusSchema = z27.object({
       serverTime: isoTime.optional(),
-      apiVersion: z26.string().optional(),
+      apiVersion: z27.string().optional(),
       /**
        * Optional server features (e.g. {@link NEXUS_FEATURE_PROJECT_INITIAL_KEY}). Absent from servers older
        * than the list, which therefore support none of them.
        */
-      features: z26.array(z26.string()).optional(),
+      features: z27.array(z27.string()).optional(),
       user: nexusCloudUserSchema,
       credential: nexusCloudCredentialSchema,
       device: nexusCloudDeviceSchema.nullable(),
-      project: z26.object({
-        projectId: z26.string(),
-        registered: z26.boolean(),
-        organizationId: z26.string().nullable(),
-        organizationName: z26.string().nullable(),
-        role: z26.string().nullable()
+      project: z27.object({
+        projectId: z27.string(),
+        registered: z27.boolean(),
+        organizationId: z27.string().nullable(),
+        organizationName: z27.string().nullable(),
+        role: z27.string().nullable()
       }).nullable(),
-      replica: z26.object({
-        replicaId: z26.string(),
-        attached: z26.boolean(),
-        attachedElsewhere: z26.boolean(),
+      replica: z27.object({
+        replicaId: z27.string(),
+        attached: z27.boolean(),
+        attachedElsewhere: z27.boolean(),
         attachedAt: isoTime.nullable(),
         lastSyncAt: isoTime.nullable(),
         presenceAt: isoTime.nullable(),
-        lastReplicaSeq: z26.number().int().nonnegative().nullable().optional()
+        lastReplicaSeq: z27.number().int().nonnegative().nullable().optional()
       }).nullable(),
-      stream: z26.object({
-        streamId: z26.string(),
-        headSeq: z26.number().int().nonnegative(),
-        headCheckpointId: z26.string().nullable(),
-        openConflicts: z26.number().int().nonnegative(),
+      stream: z27.object({
+        streamId: z27.string(),
+        headSeq: z27.number().int().nonnegative(),
+        headCheckpointId: z27.string().nullable(),
+        openConflicts: z27.number().int().nonnegative(),
         devices: nexusCloudDeviceCountsSchema
       }).nullable(),
       /** Check ids added by a newer server are dropped, never a parse failure. */
-      checks: z26.array(nexusCloudStatusCheckSchema.extend({ id: z26.string() })).transform(
+      checks: z27.array(nexusCloudStatusCheckSchema.extend({ id: z27.string() })).transform(
         (list) => list.flatMap((c) => {
           const id = knownCheckId.safeParse(c.id);
           return id.success ? [{ ...c, id: id.data }] : [];
         })
       ),
       /** A verdict added by a newer server reads as `attention`: never `ok` by accident. */
-      verdict: z26.enum(NEXUS_STATUS_VERDICTS).catch("attention")
+      verdict: z27.enum(NEXUS_STATUS_VERDICTS).catch("attention")
     });
     LOGIN = "run `cleo login nexus`";
     SESSION_EXPIRED_LOGIN = {
@@ -18799,54 +19206,54 @@ var init_nexus_first_run = __esm({
 });
 
 // packages/contracts/src/nexus-vault.ts
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 var isoTime2, uuid, nexusUserKeysSchema, nexusProjectKeysSchema, nexusLeaseSchema, nexusLeaseAcquireSchema, nexusStreamHeadSchema, nexusActivityEventSchema, nexusActivityPageSchema;
 var init_nexus_vault = __esm({
   "packages/contracts/src/nexus-vault.ts"() {
     "use strict";
-    isoTime2 = z27.iso.datetime({ offset: true });
-    uuid = z27.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
-    nexusUserKeysSchema = z27.looseObject({
-      keyVersion: z27.number().int().positive(),
-      masterKeyVerifier: z27.string()
-    });
-    nexusProjectKeysSchema = z27.looseObject({
-      keys: z27.array(
-        z27.looseObject({ wrappedProjectKey: z27.string(), keyVersion: z27.number().int().positive() })
+    isoTime2 = z28.iso.datetime({ offset: true });
+    uuid = z28.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
+    nexusUserKeysSchema = z28.looseObject({
+      keyVersion: z28.number().int().positive(),
+      masterKeyVerifier: z28.string()
+    });
+    nexusProjectKeysSchema = z28.looseObject({
+      keys: z28.array(
+        z28.looseObject({ wrappedProjectKey: z28.string(), keyVersion: z28.number().int().positive() })
       )
     });
-    nexusLeaseSchema = z27.looseObject({
-      streamId: z27.string(),
-      role: z27.string(),
+    nexusLeaseSchema = z28.looseObject({
+      streamId: z28.string(),
+      role: z28.string(),
       replicaId: uuid,
       expiresAt: isoTime2,
       forkedFromReplicaId: uuid.nullable().optional()
     });
-    nexusLeaseAcquireSchema = z27.looseObject({ lease: nexusLeaseSchema });
-    nexusStreamHeadSchema = z27.looseObject({
-      streamId: z27.string(),
-      kind: z27.string().optional(),
-      headSeq: z27.number().int().nonnegative(),
-      headCheckpointId: z27.string().nullable(),
+    nexusLeaseAcquireSchema = z28.looseObject({ lease: nexusLeaseSchema });
+    nexusStreamHeadSchema = z28.looseObject({
+      streamId: z28.string(),
+      kind: z28.string().optional(),
+      headSeq: z28.number().int().nonnegative(),
+      headCheckpointId: z28.string().nullable(),
       /**
        * The highest segment `schemaVersion` the stream holds (the server raises it on every append).
        * Absent from an older server.
        */
-      maxSchemaVersion: z27.number().int().nonnegative().optional()
+      maxSchemaVersion: z28.number().int().nonnegative().optional()
     });
-    nexusActivityEventSchema = z27.looseObject({
-      id: z27.union([z27.string(), z27.number()]),
+    nexusActivityEventSchema = z28.looseObject({
+      id: z28.union([z28.string(), z28.number()]),
       at: isoTime2,
-      actorUserId: z27.string().nullable().optional(),
-      actorDeviceId: z27.string().nullable().optional(),
-      requestId: z27.string().nullable().optional(),
-      action: z27.string(),
-      target: z27.string().nullable().optional(),
-      detail: z27.unknown().optional()
+      actorUserId: z28.string().nullable().optional(),
+      actorDeviceId: z28.string().nullable().optional(),
+      requestId: z28.string().nullable().optional(),
+      action: z28.string(),
+      target: z28.string().nullable().optional(),
+      detail: z28.unknown().optional()
     });
-    nexusActivityPageSchema = z27.looseObject({
-      events: z27.array(nexusActivityEventSchema),
-      nextBefore: z27.union([z27.string(), z27.number()]).nullable().optional()
+    nexusActivityPageSchema = z28.looseObject({
+      events: z28.array(nexusActivityEventSchema),
+      nextBefore: z28.union([z28.string(), z28.number()]).nullable().optional()
     });
   }
 });
@@ -18882,6 +19289,7 @@ var init_src = __esm({
     init_db_inventory2();
     init_identity();
     init_operations_registry();
+    init_modernize();
     init_provenance();
     init_read();
     init_docs_taxonomy();
@@ -32968,7 +33376,7 @@ function resolveRef(ref, ctx) {
 function convertBaseSchema(schema, ctx) {
   if (schema.not !== void 0) {
     if (typeof schema.not === "object" && Object.keys(schema.not).length === 0) {
-      return z28.never();
+      return z29.never();
     }
     throw new Error("not is not supported in Zod (except { not: {} } for never)");
   }
@@ -32990,7 +33398,7 @@ function convertBaseSchema(schema, ctx) {
       return ctx.refs.get(refPath);
     }
     if (ctx.processing.has(refPath)) {
-      return z28.lazy(() => {
+      return z29.lazy(() => {
         if (!ctx.refs.has(refPath)) {
           throw new Error(`Circular reference not resolved: ${refPath}`);
         }
@@ -33007,25 +33415,25 @@ function convertBaseSchema(schema, ctx) {
   if (schema.enum !== void 0) {
     const enumValues = schema.enum;
     if (ctx.version === "openapi-3.0" && schema.nullable === true && enumValues.length === 1 && enumValues[0] === null) {
-      return z28.null();
+      return z29.null();
     }
     if (enumValues.length === 0) {
-      return z28.never();
+      return z29.never();
     }
     if (enumValues.length === 1) {
-      return z28.literal(enumValues[0]);
+      return z29.literal(enumValues[0]);
     }
     if (enumValues.every((v) => typeof v === "string")) {
-      return z28.enum(enumValues);
+      return z29.enum(enumValues);
     }
-    const literalSchemas = enumValues.map((v) => z28.literal(v));
+    const literalSchemas = enumValues.map((v) => z29.literal(v));
     if (literalSchemas.length < 2) {
       return literalSchemas[0];
     }
-    return z28.union([literalSchemas[0], literalSchemas[1], ...literalSchemas.slice(2)]);
+    return z29.union([literalSchemas[0], literalSchemas[1], ...literalSchemas.slice(2)]);
   }
   if (schema.const !== void 0) {
-    return z28.literal(schema.const);
+    return z29.literal(schema.const);
   }
   const type = schema.type;
   if (Array.isArray(type)) {
@@ -33034,68 +33442,68 @@ function convertBaseSchema(schema, ctx) {
       return convertBaseSchema(typeSchema, ctx);
     });
     if (typeSchemas.length === 0) {
-      return z28.never();
+      return z29.never();
     }
     if (typeSchemas.length === 1) {
       return typeSchemas[0];
     }
-    return z28.union(typeSchemas);
+    return z29.union(typeSchemas);
   }
   if (!type) {
-    return z28.any();
+    return z29.any();
   }
   let zodSchema2;
   switch (type) {
     case "string": {
-      let stringSchema = z28.string();
+      let stringSchema = z29.string();
       if (schema.format) {
         const format = schema.format;
         if (format === "email") {
-          stringSchema = stringSchema.check(z28.email());
+          stringSchema = stringSchema.check(z29.email());
         } else if (format === "uri" || format === "uri-reference") {
-          stringSchema = stringSchema.check(z28.url());
+          stringSchema = stringSchema.check(z29.url());
         } else if (format === "uuid" || format === "guid") {
-          stringSchema = stringSchema.check(z28.uuid());
+          stringSchema = stringSchema.check(z29.uuid());
         } else if (format === "date-time") {
-          stringSchema = stringSchema.check(z28.iso.datetime());
+          stringSchema = stringSchema.check(z29.iso.datetime());
         } else if (format === "date") {
-          stringSchema = stringSchema.check(z28.iso.date());
+          stringSchema = stringSchema.check(z29.iso.date());
         } else if (format === "time") {
-          stringSchema = stringSchema.check(z28.iso.time());
+          stringSchema = stringSchema.check(z29.iso.time());
         } else if (format === "duration") {
-          stringSchema = stringSchema.check(z28.iso.duration());
+          stringSchema = stringSchema.check(z29.iso.duration());
         } else if (format === "ipv4") {
-          stringSchema = stringSchema.check(z28.ipv4());
+          stringSchema = stringSchema.check(z29.ipv4());
         } else if (format === "ipv6") {
-          stringSchema = stringSchema.check(z28.ipv6());
+          stringSchema = stringSchema.check(z29.ipv6());
         } else if (format === "mac") {
-          stringSchema = stringSchema.check(z28.mac());
+          stringSchema = stringSchema.check(z29.mac());
         } else if (format === "cidr") {
-          stringSchema = stringSchema.check(z28.cidrv4());
+          stringSchema = stringSchema.check(z29.cidrv4());
         } else if (format === "cidr-v6") {
-          stringSchema = stringSchema.check(z28.cidrv6());
+          stringSchema = stringSchema.check(z29.cidrv6());
         } else if (format === "base64") {
-          stringSchema = stringSchema.check(z28.base64());
+          stringSchema = stringSchema.check(z29.base64());
         } else if (format === "base64url") {
-          stringSchema = stringSchema.check(z28.base64url());
+          stringSchema = stringSchema.check(z29.base64url());
         } else if (format === "e164") {
-          stringSchema = stringSchema.check(z28.e164());
+          stringSchema = stringSchema.check(z29.e164());
         } else if (format === "jwt") {
-          stringSchema = stringSchema.check(z28.jwt());
+          stringSchema = stringSchema.check(z29.jwt());
         } else if (format === "emoji") {
-          stringSchema = stringSchema.check(z28.emoji());
+          stringSchema = stringSchema.check(z29.emoji());
         } else if (format === "nanoid") {
-          stringSchema = stringSchema.check(z28.nanoid());
+          stringSchema = stringSchema.check(z29.nanoid());
         } else if (format === "cuid") {
-          stringSchema = stringSchema.check(z28.cuid());
+          stringSchema = stringSchema.check(z29.cuid());
         } else if (format === "cuid2") {
-          stringSchema = stringSchema.check(z28.cuid2());
+          stringSchema = stringSchema.check(z29.cuid2());
         } else if (format === "ulid") {
-          stringSchema = stringSchema.check(z28.ulid());
+          stringSchema = stringSchema.check(z29.ulid());
         } else if (format === "xid") {
-          stringSchema = stringSchema.check(z28.xid());
+          stringSchema = stringSchema.check(z29.xid());
         } else if (format === "ksuid") {
-          stringSchema = stringSchema.check(z28.ksuid());
+          stringSchema = stringSchema.check(z29.ksuid());
         }
       }
       if (typeof schema.minLength === "number") {
@@ -33112,7 +33520,7 @@ function convertBaseSchema(schema, ctx) {
     }
     case "number":
     case "integer": {
-      let numberSchema = type === "integer" ? z28.number().int() : z28.number();
+      let numberSchema = type === "integer" ? z29.number().int() : z29.number();
       if (typeof schema.minimum === "number") {
         numberSchema = numberSchema.min(schema.minimum);
       }
@@ -33136,11 +33544,11 @@ function convertBaseSchema(schema, ctx) {
       break;
     }
     case "boolean": {
-      zodSchema2 = z28.boolean();
+      zodSchema2 = z29.boolean();
       break;
     }
     case "null": {
-      zodSchema2 = z28.null();
+      zodSchema2 = z29.null();
       break;
     }
     case "object": {
@@ -33153,14 +33561,14 @@ function convertBaseSchema(schema, ctx) {
       }
       if (schema.propertyNames) {
         const keySchema = convertSchema(schema.propertyNames, ctx);
-        const valueSchema = schema.additionalProperties && typeof schema.additionalProperties === "object" ? convertSchema(schema.additionalProperties, ctx) : z28.any();
+        const valueSchema = schema.additionalProperties && typeof schema.additionalProperties === "object" ? convertSchema(schema.additionalProperties, ctx) : z29.any();
         if (Object.keys(shape).length === 0) {
-          zodSchema2 = z28.record(keySchema, valueSchema);
+          zodSchema2 = z29.record(keySchema, valueSchema);
           break;
         }
-        const objectSchema2 = z28.object(shape).passthrough();
-        const recordSchema = z28.looseRecord(keySchema, valueSchema);
-        zodSchema2 = z28.intersection(objectSchema2, recordSchema);
+        const objectSchema2 = z29.object(shape).passthrough();
+        const recordSchema = z29.looseRecord(keySchema, valueSchema);
+        zodSchema2 = z29.intersection(objectSchema2, recordSchema);
         break;
       }
       if (schema.patternProperties) {
@@ -33169,28 +33577,28 @@ function convertBaseSchema(schema, ctx) {
         const looseRecords = [];
         for (const pattern of patternKeys) {
           const patternValue = convertSchema(patternProps[pattern], ctx);
-          const keySchema = z28.string().regex(new RegExp(pattern));
-          looseRecords.push(z28.looseRecord(keySchema, patternValue));
+          const keySchema = z29.string().regex(new RegExp(pattern));
+          looseRecords.push(z29.looseRecord(keySchema, patternValue));
         }
         const schemasToIntersect = [];
         if (Object.keys(shape).length > 0) {
-          schemasToIntersect.push(z28.object(shape).passthrough());
+          schemasToIntersect.push(z29.object(shape).passthrough());
         }
         schemasToIntersect.push(...looseRecords);
         if (schemasToIntersect.length === 0) {
-          zodSchema2 = z28.object({}).passthrough();
+          zodSchema2 = z29.object({}).passthrough();
         } else if (schemasToIntersect.length === 1) {
           zodSchema2 = schemasToIntersect[0];
         } else {
-          let result = z28.intersection(schemasToIntersect[0], schemasToIntersect[1]);
+          let result = z29.intersection(schemasToIntersect[0], schemasToIntersect[1]);
           for (let i = 2; i < schemasToIntersect.length; i++) {
-            result = z28.intersection(result, schemasToIntersect[i]);
+            result = z29.intersection(result, schemasToIntersect[i]);
           }
           zodSchema2 = result;
         }
         break;
       }
-      const objectSchema = z28.object(shape);
+      const objectSchema = z29.object(shape);
       if (schema.additionalProperties === false) {
         zodSchema2 = objectSchema.strict();
       } else if (typeof schema.additionalProperties === "object") {
@@ -33207,33 +33615,33 @@ function convertBaseSchema(schema, ctx) {
         const tupleItems = prefixItems.map((item) => convertSchema(item, ctx));
         const rest = items && typeof items === "object" && !Array.isArray(items) ? convertSchema(items, ctx) : void 0;
         if (rest) {
-          zodSchema2 = z28.tuple(tupleItems).rest(rest);
+          zodSchema2 = z29.tuple(tupleItems).rest(rest);
         } else {
-          zodSchema2 = z28.tuple(tupleItems);
+          zodSchema2 = z29.tuple(tupleItems);
         }
         if (typeof schema.minItems === "number") {
-          zodSchema2 = zodSchema2.check(z28.minLength(schema.minItems));
+          zodSchema2 = zodSchema2.check(z29.minLength(schema.minItems));
         }
         if (typeof schema.maxItems === "number") {
-          zodSchema2 = zodSchema2.check(z28.maxLength(schema.maxItems));
+          zodSchema2 = zodSchema2.check(z29.maxLength(schema.maxItems));
         }
       } else if (Array.isArray(items)) {
         const tupleItems = items.map((item) => convertSchema(item, ctx));
         const rest = schema.additionalItems && typeof schema.additionalItems === "object" ? convertSchema(schema.additionalItems, ctx) : void 0;
         if (rest) {
-          zodSchema2 = z28.tuple(tupleItems).rest(rest);
+          zodSchema2 = z29.tuple(tupleItems).rest(rest);
         } else {
-          zodSchema2 = z28.tuple(tupleItems);
+          zodSchema2 = z29.tuple(tupleItems);
         }
         if (typeof schema.minItems === "number") {
-          zodSchema2 = zodSchema2.check(z28.minLength(schema.minItems));
+          zodSchema2 = zodSchema2.check(z29.minLength(schema.minItems));
         }
         if (typeof schema.maxItems === "number") {
-          zodSchema2 = zodSchema2.check(z28.maxLength(schema.maxItems));
+          zodSchema2 = zodSchema2.check(z29.maxLength(schema.maxItems));
         }
       } else if (items !== void 0) {
         const element = convertSchema(items, ctx);
-        let arraySchema = z28.array(element);
+        let arraySchema = z29.array(element);
         if (typeof schema.minItems === "number") {
           arraySchema = arraySchema.min(schema.minItems);
         }
@@ -33242,7 +33650,7 @@ function convertBaseSchema(schema, ctx) {
         }
         zodSchema2 = arraySchema;
       } else {
-        zodSchema2 = z28.array(z28.any());
+        zodSchema2 = z29.array(z29.any());
       }
       break;
     }
@@ -33259,37 +33667,37 @@ function convertBaseSchema(schema, ctx) {
 }
 function convertSchema(schema, ctx) {
   if (typeof schema === "boolean") {
-    return schema ? z28.any() : z28.never();
+    return schema ? z29.any() : z29.never();
   }
   let baseSchema = convertBaseSchema(schema, ctx);
   const hasExplicitType = schema.type || schema.enum !== void 0 || schema.const !== void 0;
   if (schema.anyOf && Array.isArray(schema.anyOf)) {
     const options = schema.anyOf.map((s) => convertSchema(s, ctx));
-    const anyOfUnion = z28.union(options);
-    baseSchema = hasExplicitType ? z28.intersection(baseSchema, anyOfUnion) : anyOfUnion;
+    const anyOfUnion = z29.union(options);
+    baseSchema = hasExplicitType ? z29.intersection(baseSchema, anyOfUnion) : anyOfUnion;
   }
   if (schema.oneOf && Array.isArray(schema.oneOf)) {
     const options = schema.oneOf.map((s) => convertSchema(s, ctx));
-    const oneOfUnion = z28.xor(options);
-    baseSchema = hasExplicitType ? z28.intersection(baseSchema, oneOfUnion) : oneOfUnion;
+    const oneOfUnion = z29.xor(options);
+    baseSchema = hasExplicitType ? z29.intersection(baseSchema, oneOfUnion) : oneOfUnion;
   }
   if (schema.allOf && Array.isArray(schema.allOf)) {
     if (schema.allOf.length === 0) {
-      baseSchema = hasExplicitType ? baseSchema : z28.any();
+      baseSchema = hasExplicitType ? baseSchema : z29.any();
     } else {
       let result = hasExplicitType ? baseSchema : convertSchema(schema.allOf[0], ctx);
       const startIdx = hasExplicitType ? 0 : 1;
       for (let i = startIdx; i < schema.allOf.length; i++) {
-        result = z28.intersection(result, convertSchema(schema.allOf[i], ctx));
+        result = z29.intersection(result, convertSchema(schema.allOf[i], ctx));
       }
       baseSchema = result;
     }
   }
   if (schema.nullable === true && ctx.version === "openapi-3.0") {
-    baseSchema = z28.nullable(baseSchema);
+    baseSchema = z29.nullable(baseSchema);
   }
   if (schema.readOnly === true) {
-    baseSchema = z28.readonly(baseSchema);
+    baseSchema = z29.readonly(baseSchema);
   }
   const extraMeta = {};
   const coreMetadataKeys = ["$id", "id", "$comment", "$anchor", "$vocabulary", "$dynamicRef", "$dynamicAnchor"];
@@ -33316,7 +33724,7 @@ function convertSchema(schema, ctx) {
 }
 function fromJSONSchema(schema, params) {
   if (typeof schema === "boolean") {
-    return schema ? z28.any() : z28.never();
+    return schema ? z29.any() : z29.never();
   }
   const version2 = detectVersion(schema, params?.defaultTarget);
   const defs = schema.$defs || schema.definitions || {};
@@ -33330,14 +33738,14 @@ function fromJSONSchema(schema, params) {
   };
   return convertSchema(schema, ctx);
 }
-var z28, RECOGNIZED_KEYS;
+var z29, RECOGNIZED_KEYS;
 var init_from_json_schema = __esm({
   "node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/from-json-schema.js"() {
     init_registries();
     init_checks2();
     init_iso();
     init_schemas2();
-    z28 = {
+    z29 = {
       ...schemas_exports2,
       ...checks_exports2,
       iso: iso_exports
@@ -45313,16 +45721,16 @@ function excludeFile(projectDir, env = process.env) {
   if (path === null || path === "") return null;
   return isAbsolute(path) ? path : join3(projectDir, path);
 }
-function excludeLine(projectDir, relPath, env = process.env) {
+function excludeLine(projectDir, relPath2, env = process.env) {
   const prefix = gitOutput(projectDir, ["rev-parse", "--show-prefix"], env) ?? "";
-  return `/${prefix}${relPath}`;
+  return `/${prefix}${relPath2}`;
 }
-function excludeHookFileFromGit(projectDir, relPath, marker16 = HOOK_FILE_EXCLUDE_MARKER, env = process.env) {
+function excludeHookFileFromGit(projectDir, relPath2, marker16 = HOOK_FILE_EXCLUDE_MARKER, env = process.env) {
   const exclude = excludeFile(projectDir, env);
   if (exclude === null) return false;
-  if (gitOutput(projectDir, ["check-ignore", relPath], env) !== null) return false;
-  if (gitOutput(projectDir, ["ls-files", "--error-unmatch", relPath], env) !== null) return false;
-  const line = excludeLine(projectDir, relPath, env);
+  if (gitOutput(projectDir, ["check-ignore", relPath2], env) !== null) return false;
+  if (gitOutput(projectDir, ["ls-files", "--error-unmatch", relPath2], env) !== null) return false;
+  const line = excludeLine(projectDir, relPath2, env);
   const text = existsSync3(exclude) ? readFileSync3(exclude, "utf-8") : "";
   if (text.split("\n").includes(line)) return false;
   const block = `${marker16}
@@ -45333,11 +45741,11 @@ ${line}
 ${block}`);
   return true;
 }
-function unexcludeHookFileFromGit(projectDir, relPath) {
+function unexcludeHookFileFromGit(projectDir, relPath2) {
   const exclude = excludeFile(projectDir);
   if (exclude === null || !existsSync3(exclude)) return false;
   const lines = readFileSync3(exclude, "utf-8").split("\n");
-  const at = lines.indexOf(excludeLine(projectDir, relPath));
+  const at = lines.indexOf(excludeLine(projectDir, relPath2));
   const above = lines[at - 1];
   if (at < 1 || above !== LOCAL_SETTINGS_EXCLUDE_MARKER && above !== HOOK_FILE_EXCLUDE_MARKER) {
     return false;
@@ -45346,10 +45754,10 @@ function unexcludeHookFileFromGit(projectDir, relPath) {
   writeFileSync(exclude, lines.join("\n"));
   return true;
 }
-function hookFileVisibleToGit(projectDir, relPath) {
+function hookFileVisibleToGit(projectDir, relPath2) {
   if (gitOutput(projectDir, ["rev-parse", "--is-inside-work-tree"]) !== "true") return false;
-  if (gitOutput(projectDir, ["check-ignore", relPath]) !== null) return false;
-  return gitOutput(projectDir, ["ls-files", "--error-unmatch", relPath]) === null;
+  if (gitOutput(projectDir, ["check-ignore", relPath2]) !== null) return false;
+  return gitOutput(projectDir, ["ls-files", "--error-unmatch", relPath2]) === null;
 }
 function excludeLocalSettingsFromGit(projectDir) {
   return excludeHookFileFromGit(projectDir, CLAUDE_LOCAL_SETTINGS, LOCAL_SETTINGS_EXCLUDE_MARKER);
@@ -45440,20 +45848,20 @@ function restoreCommittedCodexHooks(projectDir) {
   writeFileSync(file2, committed);
   return true;
 }
-function excludedByCleo(projectDir, relPath) {
+function excludedByCleo(projectDir, relPath2) {
   const exclude = excludeFile(projectDir);
   if (exclude === null || !existsSync3(exclude)) return false;
   const lines = readFileSync3(exclude, "utf-8").split("\n");
-  const at = lines.indexOf(excludeLine(projectDir, relPath));
+  const at = lines.indexOf(excludeLine(projectDir, relPath2));
   const above = lines[at - 1];
   return at >= 1 && (above === LOCAL_SETTINGS_EXCLUDE_MARKER || above === HOOK_FILE_EXCLUDE_MARKER);
 }
 function codexHookSnippet() {
   return JSON.stringify(heavyCommandHookEntry("codex"));
 }
-function trackedFileModified(projectDir, relPath) {
-  if (gitOutput(projectDir, ["ls-files", "--error-unmatch", relPath]) === null) return false;
-  return (gitOutput(projectDir, ["diff", "--name-only", "HEAD", "--", relPath]) ?? "") !== "";
+function trackedFileModified(projectDir, relPath2) {
+  if (gitOutput(projectDir, ["ls-files", "--error-unmatch", relPath2]) === null) return false;
+  return (gitOutput(projectDir, ["diff", "--name-only", "HEAD", "--", relPath2]) ?? "") !== "";
 }
 async function syncCodexHeavyCommandHook(projectDir, mode) {
   const file2 = join3(projectDir, CODEX_HOOKS_FILE);