@cleocode/cleo 2026.10.1 → 2026.10.3

package/dist/cli/index.js

@@ -1425,6 +1425,10 @@ function extractIdempotencyKeyArg(argv) {
   let idempotencyKey;
   for (let i = 0; i < argv.length; i++) {
     const token = argv[i];
+    if (token === "--") {
+      sanitized.push(...argv.slice(i));
+      break;
+    }
     if (token === "--idempotency-key") {
       const next = argv[i + 1];
       if (next !== void 0 && !next.startsWith("--")) {
@@ -17759,6 +17763,326 @@ var init_adr_073_saga = __esm({
   }
 });
 
+// packages/contracts/src/invariants/sync-write-invariants.ts
+function checkPending(task) {
+  return { task, reason: "the post-apply check is not implemented yet (T12344 item)" };
+}
+function rulePending(task) {
+  return { task, reason: "the typed merge-rule registry does not define it yet (T12344 item)" };
+}
+function trigger(id, tables, triggers, inventory, reason) {
+  return { id, class: "trigger-covered", tables, sites: [], triggers, inventory, reason };
+}
+function pac(id, item, task, tables, footprint, reason) {
+  return {
+    id,
+    class: "post-apply-check",
+    tables,
+    sites: [],
+    check: { footprint },
+    inventory: [item],
+    pending: checkPending(task),
+    reason
+  };
+}
+function rule(id, task, table, columns, inventory, reason, tables = [table]) {
+  return {
+    id,
+    class: "monotonic-merge-rule",
+    tables,
+    sites: [],
+    mergeRule: { table, columns },
+    inventory,
+    pending: rulePending(task),
+    reason
+  };
+}
+var SYNC_WRITE_INVARIANTS;
+var init_sync_write_invariants = __esm({
+  "packages/contracts/src/invariants/sync-write-invariants.ts"() {
+    "use strict";
+    SYNC_WRITE_INVARIANTS = Object.freeze([
+      // §3.6.2: RAISE guards and UNIQUE indexes a migration creates on synced tables.
+      trigger(
+        "task.parent.no-cycle",
+        ["tasks_tasks"],
+        ["tasks_tasks_parent_cycle_guard_insert", "tasks_tasks_parent_cycle_guard_update"],
+        ["V10", "V11"],
+        "the parent chain is acyclic (the INSERT variant misses a self-parent, \xA73.6.3 item 2)"
+      ),
+      trigger(
+        "task.parent.type-matrix",
+        ["tasks_tasks"],
+        ["tasks_tasks_parent_type_matrix_insert", "tasks_tasks_parent_type_matrix_update"],
+        ["X1"],
+        "parent/child type matrix; weaker than TypeScript (\xA73.6.3 item 1), the rest is PAC-01"
+      ),
+      trigger(
+        "task.status.pipeline-consistency",
+        ["tasks_tasks"],
+        ["trg_tasks_tasks_status_pipeline_insert", "trg_tasks_tasks_status_pipeline_update"],
+        ["V19", "C21"],
+        "T877: status and pipeline_stage agree on one row"
+      ),
+      trigger(
+        "task.relation.non-containment",
+        ["tasks_task_relations"],
+        ["tasks_task_relations_non_containment_insert", "tasks_task_relations_non_containment_update"],
+        ["V31"],
+        "no relation between a parent and its child, on relation writes only (\xA73.6.3 item 4)"
+      ),
+      trigger(
+        "task.ac.child-target",
+        ["tasks_task_acceptance_criteria"],
+        ["tasks_task_acceptance_child_target_insert", "tasks_task_acceptance_child_target_update"],
+        ["C28"],
+        "a child_task AC targets a direct child, on AC writes only (\xA73.6.3 item 4)"
+      ),
+      trigger(
+        "session.handoff.append-only",
+        ["tasks_session_handoff_entries"],
+        ["trg_tasks_session_handoff_no_update"],
+        ["H2"],
+        "handoff entries are never updated"
+      ),
+      trigger(
+        "task.claim.lease-iso",
+        ["tasks_tasks"],
+        ["tasks_tasks_lease_iso_insert", "tasks_tasks_lease_iso_update"],
+        [],
+        "claim lease timestamps are ISO-8601 (t12736)"
+      ),
+      trigger(
+        "task.ac-binding.unique",
+        ["tasks_evidence_ac_bindings"],
+        ["uq_tasks_evidence_ac_bindings_atom_ac_type"],
+        ["C31"],
+        "one binding per (evidence atom, AC, binding type)"
+      ),
+      trigger(
+        "release.version.unique",
+        ["tasks_releases"],
+        ["uq_tasks_releases_version"],
+        ["REL-1"],
+        "one release row per version"
+      ),
+      trigger(
+        "selfimprove.dhq.one-open",
+        ["selfimprove_dhq"],
+        ["ux_selfimprove_dhq_open"],
+        ["D49"],
+        "at most one open DHQ entry per question_hash"
+      ),
+      trigger(
+        "account.one-active-per-provider",
+        ["accounts"],
+        ["ux_accounts_active_provider"],
+        ["A40"],
+        "at most one active account per provider (partial UNIQUE)"
+      ),
+      // §3.6.5: post-apply check families (T12344 items).
+      pac(
+        "task.tree.shape",
+        "PAC-01",
+        "T12922",
+        ["tasks_tasks"],
+        ["rows with a changed parent_id or type", "their direct children and ancestor chain"],
+        "saga\u2192epic\u2192task\u2192subtask matrix, non-saga has a parent, depth \u2264 3, no self-parent"
+      ),
+      pac(
+        "task.terminal-parent.live-children",
+        "PAC-02",
+        "T12923",
+        ["tasks_tasks"],
+        ["rows whose status, stage or parent changed", "their parent and siblings"],
+        "no terminal parent with a live child; epic stage \u2265 children; rollup re-evaluated"
+      ),
+      pac(
+        "task.dependency.graph",
+        "PAC-03",
+        "T12924",
+        ["tasks_task_dependencies", "tasks_tasks"],
+        ["dependency edges inserted in the page", "reachability from each depends_on"],
+        "dependencies are acyclic, with no self-edge"
+      ),
+      pac(
+        "task.done.evidence",
+        "PAC-04",
+        "T12925",
+        ["tasks_tasks", "tasks_task_acceptance_criteria", "tasks_evidence_ac_bindings"],
+        ["done rows in the page", "their AC rows, bindings, acceptance_json and verification_json"],
+        "a done task has passed verification and every AC bound or waived"
+      ),
+      pac(
+        "task.ac.integrity",
+        "PAC-05",
+        "T12926",
+        ["tasks_tasks", "tasks_task_acceptance_criteria", "tasks_evidence_ac_bindings"],
+        ["tasks whose AC rows, bindings, acceptance_json, parent_id or relations changed"],
+        "acceptance_json \u21D4 AC rows, child_task ACs match children, bindings resolve"
+      ),
+      pac(
+        "lifecycle.rows",
+        "PAC-06",
+        "T12927",
+        ["tasks_lifecycle_pipelines", "tasks_lifecycle_stages", "tasks_tasks"],
+        ["lifecycle pipeline, stage and gate rows in the page", "the owning task row"],
+        "one pipeline per task, one stage row per name, pipeline_stage \u2265 completed stages"
+      ),
+      pac(
+        "derived.mirrors",
+        "PAC-07",
+        "T12928",
+        ["tasks_task_labels", "brain_sticky_tags", "docs_wikilinks", "tasks_tasks"],
+        ["owning rows whose JSON or junction changed"],
+        "junction tables equal their JSON source"
+      ),
+      pac(
+        "session.goal.singletons",
+        "PAC-08",
+        "T12929",
+        ["tasks_sessions", "tasks_task_work_history", "tasks_goal"],
+        ["session rows whose status, scope or chain changed", "work-history rows per session"],
+        "one active session per scope, reciprocal chain, one open interval, one live goal"
+      ),
+      pac(
+        "audit.uniqueness",
+        "PAC-09",
+        "T12930",
+        ["tasks_audit_log"],
+        ["audit rows with a non-null idempotency key", "rollback audit rows"],
+        "idempotency keys are unique across replicas; at most one rollback per receipt"
+      ),
+      pac(
+        "identity.collisions",
+        "PAC-10",
+        "T12931",
+        ["tasks_tasks", "tasks_sessions", "brain_observations", "docs_attachments"],
+        ["inserted rows", "the natural key's index"],
+        "display-id and natural-key clashes become an alias or re-mint (T12341)"
+      ),
+      pac(
+        "dedupe.at-most-one",
+        "PAC-11",
+        "T12932",
+        ["brain_decisions", "brain_learnings", "tasks_external_task_links"],
+        ["inserted rows grouped by the natural key"],
+        "duplicates created on two devices are merged"
+      ),
+      pac(
+        "ref.soft-orphans",
+        "PAC-12",
+        "T12933",
+        ["brain_memory_links", "brain_page_edges", "docs_attachment_refs", "tasks_task_commits"],
+        ["reference columns of the rows in the page", "their targets"],
+        "cross-DB and polymorphic references resolve"
+      ),
+      pac(
+        "supersession.graph",
+        "PAC-13",
+        "T12934",
+        ["brain_decisions", "docs_attachments", "tasks_architecture_decisions"],
+        ["rows whose supersession columns changed", "a chain walk"],
+        "supersession chains are acyclic with at most one successor"
+      ),
+      pac(
+        "derived.counters",
+        "PAC-14",
+        "T12935",
+        ["docs_attachments", "conduit_attachments", "docs_pipeline_manifest"],
+        ["the owning rows"],
+        "derived counters and cross-column facts agree with their rows"
+      ),
+      pac(
+        "apply.preconditions",
+        "PAC-15",
+        "T12936",
+        ["tasks_tasks"],
+        ["the whole page"],
+        "no apply while the local twin collapse has failed; restore is a re-baseline"
+      ),
+      // §3.6.6: typed merge rules (T12344).
+      rule(
+        "task.status.absorbing",
+        "T12937",
+        "tasks_tasks",
+        ["status", "completed_at", "cancelled_at", "cancellation_reason", "pipeline_stage"],
+        ["V18", "V20", "C22", "P40", "P46", "P47"],
+        "done, cancelled and archived are absorbing; leaving them needs an explicit op"
+      ),
+      rule(
+        "task.pipeline-stage.max",
+        "T12938",
+        "tasks_tasks",
+        ["pipeline_stage"],
+        ["V21", "C20", "P01", "F3"],
+        "pipeline_stage is the maximum by STAGE_ORDER, except an explicit restore"
+      ),
+      rule(
+        "task.verification.frozen-on-done",
+        "T12939",
+        "tasks_tasks",
+        ["verification_json"],
+        ["C01", "C02", "C03", "C17"],
+        "verification is frozen once done; otherwise merged per gate"
+      ),
+      rule(
+        "session.status.terminal",
+        "T12940",
+        "tasks_sessions",
+        ["status", "ended_at"],
+        ["S7", "S8", "S9", "S10", "S11", "S17", "S18", "SC2", "N1", "SK5", "P32"],
+        "ended and orphaned are terminal except on an explicit resume"
+      ),
+      rule("audit.immutable", "T12941", "tasks_audit_log", ["*"], ["SA3"], "audit rows are immutable", [
+        "tasks_audit_log",
+        "audit_log"
+      ]),
+      rule(
+        "sticky.status.one-way",
+        "T12942",
+        "brain_sticky_notes",
+        ["status", "converted_to_json"],
+        ["SK2", "SK3", "B24"],
+        "active\u2192{converted, archived} is one-way; converted_to_json is write-once"
+      ),
+      rule(
+        "release.status.absorbing",
+        "T12943",
+        "tasks_releases",
+        ["status"],
+        ["REL-2", "REL-3", "REL-4", "REL-5", "REL-6", "REL-7", "REL-8"],
+        "shipped release statuses are absorbing"
+      ),
+      rule(
+        "playbook.approval.once",
+        "T12944",
+        "tasks_playbook_approvals",
+        ["status"],
+        ["PB-1", "PB-4", "PB-7", "P33"],
+        "an approval goes pending\u2192decided once"
+      ),
+      rule(
+        "docs.lifecycle.transitions",
+        "T12945",
+        "docs_attachments",
+        ["lifecycle_status"],
+        ["D04", "D05", "D31", "D32", "D39", "D50"],
+        "superseded is sticky; lifecycle transitions follow a matrix"
+      ),
+      // §3.6.0 identity-layer rows.
+      {
+        id: "identity.local-minting",
+        class: "identity-layer",
+        tables: ["tasks_tasks", "tasks_sessions"],
+        sites: [],
+        inventory: ["V12", "B07", "B12"],
+        reason: "ids minted from local state (display ids, integer PKs, device-derived ids) collide across replicas; T12341 uids and re-minting own it, no validator port can"
+      }
+    ]);
+  }
+});
+
 // packages/contracts/src/invariants/index.ts
 function buildKey(invariant) {
   return `${invariant.adr}.${invariant.code}`;
@@ -17802,6 +18126,7 @@ var init_invariants = __esm({
     init_adr_056_release();
     init_adr_070_orchestration();
     init_adr_073_saga();
+    init_sync_write_invariants();
     INVARIANTS_REGISTRY = buildRegistry();
   }
 });
@@ -20673,7 +20998,7 @@ var init_render2 = __esm({
 function isResourceGrant(r) {
   return r.deferred === false;
 }
-var RESOURCE_CLASSES, RESOURCE_DEFERRED_CODE, RESOURCE_BACKPRESSURE_CODE, DEFAULT_RESOURCE_RETRY_AFTER_MS;
+var RESOURCE_CLASSES, RESOURCE_DEFERRED_CODE, RUN_COMMAND_FAILED_CODE, RUN_DEFERRED_EXIT_CODE, RESOURCE_BACKPRESSURE_CODE, DEFAULT_RESOURCE_RETRY_AFTER_MS;
 var init_resource_governor = __esm({
   "packages/contracts/src/resource-governor.ts"() {
     "use strict";
@@ -20688,6 +21013,8 @@ var init_resource_governor = __esm({
       "background-autonomous"
     ]);
     RESOURCE_DEFERRED_CODE = "E_RESOURCE_DEFERRED";
+    RUN_COMMAND_FAILED_CODE = "E_COMMAND_FAILED";
+    RUN_DEFERRED_EXIT_CODE = 75;
     RESOURCE_BACKPRESSURE_CODE = "E_RESOURCE_BACKPRESSURE";
     DEFAULT_RESOURCE_RETRY_AFTER_MS = 2e3;
   }
@@ -21624,11 +21951,11 @@ var init_taxonomy = __esm({
        * @throws TaxonomyError when any tag is not canonical.
        */
       validateOrThrow(tags, context) {
-        const invalid = this.validate(tags);
-        if (invalid.length > 0) {
+        const invalid2 = this.validate(tags);
+        if (invalid2.length > 0) {
           throw new TaxonomyError(
-            `${context}: unknown tags [${invalid.join(", ")}]. Use canonical tags. Run 'cleo taxonomy list' to see all valid tags.`,
-            invalid
+            `${context}: unknown tags [${invalid2.join(", ")}]. Use canonical tags. Run 'cleo taxonomy list' to see all valid tags.`,
+            invalid2
           );
         }
       }
@@ -22762,7 +23089,39 @@ var init_nexus_account = __esm({
       /** An option that needs device credentials (`--read-only`) with `CLEO_NEXUS_DEVICE=0`. */
       "E_NEXUS_DEVICE_REQUIRED",
       /** `.cleo/nexus-link.json` is in a format this CLEO cannot update (written by a newer CLEO). */
-      "E_NEXUS_LINK_FILE_UNSUPPORTED"
+      "E_NEXUS_LINK_FILE_UNSUPPORTED",
+      // Cloud vault (encrypted snapshots, T12336 / T12337 / T12338).
+      /** Another device holds this stream's write lease (`--force` takes it and labels a fork). */
+      "E_NEXUS_VAULT_LEASE_HELD",
+      /** Another device pushed a newer snapshot than this machine last pushed or restored: pull first. */
+      "E_NEXUS_VAULT_BEHIND",
+      /** Local data changed since the last push or restore; pulling would overwrite it. */
+      "E_NEXUS_VAULT_LOCAL_CHANGES",
+      /** A snapshot's counts or hashes do not match its manifest; nothing was activated. */
+      "E_NEXUS_VAULT_VERIFY_FAILED",
+      /** The account encryption key could not be obtained for this device. */
+      "E_NEXUS_VAULT_KEY_UNAVAILABLE",
+      /** The project is not linked to Cleo Nexus (`cleo project link`). */
+      "E_NEXUS_VAULT_NOT_LINKED",
+      /** The cloud holds no snapshot to restore. */
+      "E_NEXUS_VAULT_EMPTY",
+      /**
+       * The Cleo Nexus server predates account key escrow (cleo-nexus T082), so it cannot hold a
+       * vault (T13049). Nothing was written.
+       */
+      "E_NEXUS_VAULT_UNSUPPORTED",
+      /** The server refused the snapshot (lineage or regression check). */
+      "E_NEXUS_VAULT_REFUSED",
+      /**
+       * The stream moved past what this CLEO's vault writes (T13034): it takes only checkpoint/v3
+       * snapshots (the server's `E_STREAM_VERSION`), or it holds data of a newer sync schema.
+       * Pull, restore and verify still work; nothing was written.
+       */
+      "E_NEXUS_VAULT_STREAM_UPGRADED",
+      /** Another CLEO process is writing to the store a restore would replace. */
+      "E_NEXUS_VAULT_STORE_BUSY",
+      /** A project restore target already holds a different project. */
+      "E_NEXUS_VAULT_TARGET_OCCUPIED"
     ];
     nexusAccountUserSchema = z25.object({
       id: z25.string(),
@@ -23009,7 +23368,9 @@ var init_nexus_cloud = __esm({
       "route-undeclared",
       "bearer-session-required",
       "session-not-fresh",
-      "device-limit"
+      "device-limit",
+      "device-flow-session-required",
+      "device-not-enrolled"
     ];
     NEXUS_REVOKED_REASONS = ["signed-out", "revoked", "rotated", "reenrolled"];
     LOGIN = "run `cleo login nexus`";
@@ -23100,6 +23461,16 @@ var init_nexus_cloud = __esm({
         code: "E_NEXUS_REQUEST_FAILED",
         message: "the account has reached its device limit",
         fix: "revoke unused devices on cleocode.dev, then retry"
+      },
+      "device-flow-session-required": {
+        code: "E_NEXUS_SESSION_EXPIRED",
+        message: "this session was not issued to the CLI by `cleo login nexus`, so it cannot enrol a device",
+        fix: SESSION_EXPIRED_LOGIN.fix
+      },
+      "device-not-enrolled": {
+        code: "E_NEXUS_NOT_SIGNED_IN",
+        message: "this device is not enrolled with Cleo Nexus",
+        fix: LOGIN
       }
     };
     NEXUS_CONFLICT_ERRORS = {
@@ -23118,6 +23489,69 @@ var init_nexus_cloud = __esm({
   }
 });
 
+// packages/contracts/src/nexus-vault.ts
+import { z as z27 } from "zod";
+var isoTime2, uuid, nexusUserKeysSchema, nexusProjectKeysSchema, NEXUS_VAULT_LEASE_ROLE, nexusLeaseSchema, nexusLeaseAcquireSchema, nexusStreamHeadSchema, nexusActivityEventSchema, nexusActivityPageSchema;
+var init_nexus_vault = __esm({
+  "packages/contracts/src/nexus-vault.ts"() {
+    "use strict";
+    isoTime2 = z27.iso.datetime({ offset: true });
+    uuid = z27.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
+    nexusUserKeysSchema = z27.looseObject({
+      keyVersion: z27.number().int().positive(),
+      masterKeyVerifier: z27.string()
+    });
+    nexusProjectKeysSchema = z27.looseObject({
+      keys: z27.array(
+        z27.looseObject({ wrappedProjectKey: z27.string(), keyVersion: z27.number().int().positive() })
+      )
+    });
+    NEXUS_VAULT_LEASE_ROLE = "writer";
+    nexusLeaseSchema = z27.looseObject({
+      streamId: z27.string(),
+      role: z27.string(),
+      replicaId: uuid,
+      expiresAt: isoTime2,
+      forkedFromReplicaId: uuid.nullable().optional()
+    });
+    nexusLeaseAcquireSchema = z27.looseObject({ lease: nexusLeaseSchema });
+    nexusStreamHeadSchema = z27.looseObject({
+      streamId: z27.string(),
+      kind: z27.string().optional(),
+      headSeq: z27.number().int().nonnegative(),
+      headCheckpointId: z27.string().nullable(),
+      /**
+       * The highest segment `schemaVersion` the stream holds (the server raises it on every append).
+       * Absent from an older server.
+       */
+      maxSchemaVersion: z27.number().int().nonnegative().optional()
+    });
+    nexusActivityEventSchema = z27.looseObject({
+      id: z27.union([z27.string(), z27.number()]),
+      at: isoTime2,
+      actorUserId: z27.string().nullable().optional(),
+      actorDeviceId: z27.string().nullable().optional(),
+      requestId: z27.string().nullable().optional(),
+      action: z27.string(),
+      target: z27.string().nullable().optional(),
+      detail: z27.unknown().optional()
+    });
+    nexusActivityPageSchema = z27.looseObject({
+      events: z27.array(nexusActivityEventSchema),
+      nextBefore: z27.union([z27.string(), z27.number()]).nullable().optional()
+    });
+  }
+});
+
+// packages/contracts/src/sync-schema.ts
+var SYNC_SCHEMA_VERSION;
+var init_sync_schema = __esm({
+  "packages/contracts/src/sync-schema.ts"() {
+    "use strict";
+    SYNC_SCHEMA_VERSION = 2;
+  }
+});
+
 // packages/contracts/src/task-id.ts
 function isTaskId(value) {
   return typeof value === "string" && TASK_ID_REGEX.test(value);
@@ -23321,6 +23755,7 @@ __export(src_exports, {
   NEXUS_UNAUTHENTICATED_ERRORS: () => NEXUS_UNAUTHENTICATED_ERRORS,
   NEXUS_UNAUTHENTICATED_REASONS: () => NEXUS_UNAUTHENTICATED_REASONS,
   NEXUS_UNREACHABLE_ERROR: () => NEXUS_UNREACHABLE_ERROR,
+  NEXUS_VAULT_LEASE_ROLE: () => NEXUS_VAULT_LEASE_ROLE,
   OPEN_SYSTEM_KEY_PREFIXES: () => OPEN_SYSTEM_KEY_PREFIXES,
   OPERATIONS: () => OPERATIONS,
   OPERATION_RESULT_SCHEMAS: () => OPERATION_RESULT_SCHEMAS,
@@ -23366,6 +23801,8 @@ __export(src_exports, {
   RESOURCE_CLASSES: () => RESOURCE_CLASSES,
   RESOURCE_DEFERRED_CODE: () => RESOURCE_DEFERRED_CODE,
   ROLE_SYSTEM_IDS: () => ROLE_SYSTEM_IDS,
+  RUN_COMMAND_FAILED_CODE: () => RUN_COMMAND_FAILED_CODE,
+  RUN_DEFERRED_EXIT_CODE: () => RUN_DEFERRED_EXIT_CODE,
   RateCheckRequestSchema: () => RateCheckRequestSchema,
   RateResultResponseSchema: () => RateResultResponseSchema,
   ReleaseChannelSchema: () => ReleaseChannelSchema,
@@ -23401,6 +23838,8 @@ __export(src_exports, {
   SUPERVISOR_IPC_PROTOCOL_VERSION: () => SUPERVISOR_IPC_PROTOCOL_VERSION,
   SUPERVISOR_IPC_REQUEST_KINDS: () => SUPERVISOR_IPC_REQUEST_KINDS,
   SUPERVISOR_IPC_RESPONSE_KINDS: () => SUPERVISOR_IPC_RESPONSE_KINDS,
+  SYNC_SCHEMA_VERSION: () => SYNC_SCHEMA_VERSION,
+  SYNC_WRITE_INVARIANTS: () => SYNC_WRITE_INVARIANTS,
   SYSTEM_ROLE_MAP: () => SYSTEM_ROLE_MAP,
   SessionView: () => SessionView,
   SpawnRequestSchema: () => SpawnRequestSchema,
@@ -23600,6 +24039,8 @@ __export(src_exports, {
   nexusAccountMeSchema: () => nexusAccountMeSchema,
   nexusAccountOrganizationSchema: () => nexusAccountOrganizationSchema,
   nexusAccountUserSchema: () => nexusAccountUserSchema,
+  nexusActivityEventSchema: () => nexusActivityEventSchema,
+  nexusActivityPageSchema: () => nexusActivityPageSchema,
   nexusCloudCredentialSchema: () => nexusCloudCredentialSchema,
   nexusCloudDeviceCountsSchema: () => nexusCloudDeviceCountsSchema,
   nexusCloudDevicePageSchema: () => nexusCloudDevicePageSchema,
@@ -23615,6 +24056,11 @@ __export(src_exports, {
   nexusCloudStatusSchema: () => nexusCloudStatusSchema,
   nexusCloudUserSchema: () => nexusCloudUserSchema,
   nexusCloudWhoamiSchema: () => nexusCloudWhoamiSchema,
+  nexusLeaseAcquireSchema: () => nexusLeaseAcquireSchema,
+  nexusLeaseSchema: () => nexusLeaseSchema,
+  nexusProjectKeysSchema: () => nexusProjectKeysSchema,
+  nexusStreamHeadSchema: () => nexusStreamHeadSchema,
+  nexusUserKeysSchema: () => nexusUserKeysSchema,
   normalizeError: () => normalizeError,
   noteAtomSchema: () => noteAtomSchema,
   noulDecisionAnswerSchema: () => noulDecisionAnswerSchema,
@@ -23796,6 +24242,8 @@ var init_src2 = __esm({
     init_decide_sites();
     init_nexus_account();
     init_nexus_cloud();
+    init_nexus_vault();
+    init_sync_schema();
     init_task_id();
   }
 });
@@ -24651,7 +25099,7 @@ function humanProgress(text) {
 function isHumanOutput() {
   return humanEnabled();
 }
-function cliError(message, code, details, meta) {
+function cliError(message, code, details, meta, options) {
   const ctx = getFormatContext();
   const outputMode = getOutputMode();
   if (outputMode === "silent") {
@@ -24693,6 +25141,11 @@ function cliError(message, code, details, meta) {
     error: errorObj,
     meta: errorMeta
   };
+  if (options?.stderr === true) {
+    process.stderr.write(`${JSON.stringify(envelope)}
+`);
+    return;
+  }
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
 var renderers;
@@ -37285,21 +37738,21 @@ var init_migrate_e4 = __esm({
 
 // packages/playbooks/src/policy.ts
 function evaluatePolicy(command, rules = DEFAULT_POLICY_RULES) {
-  for (const rule of rules) {
-    if (rule.action === "require-human" && rule.pattern.test(command)) {
+  for (const rule2 of rules) {
+    if (rule2.action === "require-human" && rule2.pattern.test(command)) {
       return {
         action: "require-human",
-        reason: rule.reason,
-        matchedPattern: rule.pattern.source
+        reason: rule2.reason,
+        matchedPattern: rule2.pattern.source
       };
     }
   }
-  for (const rule of rules) {
-    if (rule.action === "auto-approve" && rule.pattern.test(command)) {
+  for (const rule2 of rules) {
+    if (rule2.action === "auto-approve" && rule2.pattern.test(command)) {
       return {
         action: "auto-approve",
-        reason: rule.reason,
-        matchedPattern: rule.pattern.source
+        reason: rule2.reason,
+        matchedPattern: rule2.pattern.source
       };
     }
   }
@@ -37874,9 +38327,9 @@ function auditContractViolation(projectRoot, runId, nodeId, field, key, playbook
   } catch {
   }
 }
-function handleContractErrorHandler(playbook, trigger, _message) {
+function handleContractErrorHandler(playbook, trigger2, _message) {
   if (!playbook.error_handlers) return null;
-  const handler = playbook.error_handlers.find((h) => h.on === trigger);
+  const handler = playbook.error_handlers.find((h) => h.on === trigger2);
   return handler?.action ?? null;
 }
 function iterationCapFor(node, runtimeDefault) {
@@ -38399,8 +38852,8 @@ async function loadPlaybookByName(name) {
     return null;
   }
   try {
-    const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core/internal");
-    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot75();
+    const { getProjectRoot: getProjectRoot76 } = await import("@cleocode/core/internal");
+    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot76();
     const resolved = resolvePlaybook(name, {
       projectRoot,
       globalPlaybooksDir: __playbookRuntimeOverrides.globalPlaybooksDir,
@@ -38445,7 +38898,7 @@ async function buildDefaultDispatcher() {
   if (__playbookRuntimeOverrides.dispatcher) return __playbookRuntimeOverrides.dispatcher;
   const { orchestrateSpawnExecute: orchestrateSpawnExecute2 } = await import("@cleocode/runtime/gateway");
   const {
-    getProjectRoot: getProjectRoot75,
+    getProjectRoot: getProjectRoot76,
     createToolGuard,
     runSkillNodeOrSpawn,
     maybeCreatePiRunner,
@@ -38453,7 +38906,7 @@ async function buildDefaultDispatcher() {
     hasCantbookProfilePin,
     DEFAULT_DETERMINISTIC_DENIED_COMMANDS
   } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot75();
+  const projectRoot = getProjectRoot76();
   const tools = createToolGuard({
     allowedRoots: [projectRoot],
     deniedCommands: DEFAULT_DETERMINISTIC_DENIED_COMMANDS,
@@ -38546,12 +38999,12 @@ async function buildDefaultDeterministicRunner() {
     return void 0;
   }
   const {
-    getProjectRoot: getProjectRoot75,
+    getProjectRoot: getProjectRoot76,
     createToolGuard,
     createGuardedDeterministicRunner,
     DEFAULT_DETERMINISTIC_DENIED_COMMANDS
   } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot75();
+  const projectRoot = getProjectRoot76();
   const tools = createToolGuard({
     allowedRoots: [projectRoot],
     deniedCommands: DEFAULT_DETERMINISTIC_DENIED_COMMANDS,
@@ -38709,8 +39162,8 @@ var init_playbook2 = __esm({
             projectRoot = __playbookRuntimeOverrides.projectRoot;
           } else {
             try {
-              const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core/internal");
-              projectRoot = getProjectRoot75();
+              const { getProjectRoot: getProjectRoot76 } = await import("@cleocode/core/internal");
+              projectRoot = getProjectRoot76();
             } catch {
               projectRoot = void 0;
             }
@@ -38775,14 +39228,14 @@ var init_playbook2 = __esm({
         const deterministicRunner = await buildDefaultDeterministicRunner();
         let result;
         try {
-          const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core/internal");
+          const { getProjectRoot: getProjectRoot76 } = await import("@cleocode/core/internal");
           const opts = {
             db,
             playbook: parsed.definition,
             playbookHash: parsed.sourceHash,
             initialContext,
             dispatcher,
-            projectRoot: getProjectRoot75()
+            projectRoot: getProjectRoot76()
           };
           if (deterministicRunner !== void 0) opts.deterministicRunner = deterministicRunner;
           if (__playbookRuntimeOverrides.approvalSecret !== void 0) {
@@ -39241,16 +39694,16 @@ async function orchestrateClassify(request, context, projectRoot, taskId) {
   }
   try {
     const { getCleoCantWorkflowsDir } = await import("@cleocode/core/internal");
-    const { readFileSync: readFileSync22, readdirSync: readdirSync3, existsSync: existsSync22 } = await import("node:fs");
-    const { join: join40 } = await import("node:path");
+    const { readFileSync: readFileSync23, readdirSync: readdirSync4, existsSync: existsSync22 } = await import("node:fs");
+    const { join: join41 } = await import("node:path");
     const workflowsDir = getCleoCantWorkflowsDir();
     const combined = `${request} ${context ?? ""}`.toLowerCase();
     const matches = [];
     if (existsSync22(workflowsDir)) {
-      const files = readdirSync3(workflowsDir).filter((f) => f.endsWith(".cant"));
+      const files = readdirSync4(workflowsDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync22(join40(workflowsDir, file), "utf-8");
+          const src = readFileSync23(join41(workflowsDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -39265,12 +39718,12 @@ async function orchestrateClassify(request, context, projectRoot, taskId) {
         }
       }
     }
-    const localCantDir = join40(projectRoot, CLEO_DIR_NAME2, WORKFLOWS_SUBDIR);
+    const localCantDir = join41(projectRoot, CLEO_DIR_NAME2, WORKFLOWS_SUBDIR);
     if (existsSync22(localCantDir)) {
-      const files = readdirSync3(localCantDir).filter((f) => f.endsWith(".cant"));
+      const files = readdirSync4(localCantDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync22(join40(localCantDir, file), "utf-8");
+          const src = readFileSync23(join41(localCantDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -46121,11 +46574,11 @@ var init_security = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/sanitizer.ts
-function createSanitizer(getProjectRoot75) {
+function createSanitizer(getProjectRoot76) {
   return async (req, next) => {
     if (req.params) {
       try {
-        const root = getProjectRoot75 ? getProjectRoot75() : void 0;
+        const root = getProjectRoot76 ? getProjectRoot76() : void 0;
         req.params = sanitizeParams(req.params, root, {
           domain: req.domain,
           operation: req.operation
@@ -46227,14 +46680,14 @@ var init_session_resolver = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/store-write-guard.ts
-function createStoreWriteGuard(getProjectRoot75) {
+function createStoreWriteGuard(getProjectRoot76) {
   return async (req, next) => {
     if (req.gateway !== "mutate" || ALLOWED_WHILE_READ_ONLY.has(`${req.domain}.${req.operation}`)) {
       return next();
     }
     let projectRoot;
     try {
-      projectRoot = getProjectRoot75();
+      projectRoot = getProjectRoot76();
     } catch {
       return next();
     }
@@ -48084,9 +48537,9 @@ var init_agent = __esm({
             isActive: true
           });
           const { existsSync: existsSync22, mkdirSync: mkdirSync7, writeFileSync: writeFileSync8 } = await import("node:fs");
-          const { join: join40 } = await import("node:path");
-          const cantDir = join40(CLEO_DIR_NAME3, AGENTS_SUBDIR);
-          const cantPath = join40(cantDir, `${agentId}.cant`);
+          const { join: join41 } = await import("node:path");
+          const cantDir = join41(CLEO_DIR_NAME3, AGENTS_SUBDIR);
+          const cantPath = join41(cantDir, `${agentId}.cant`);
           let cantScaffolded = false;
           if (!existsSync22(cantPath)) {
             mkdirSync7(cantDir, { recursive: true });
@@ -48267,8 +48720,8 @@ agent ${agentId}:
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync22, readFileSync: readFileSync22 } = await import("node:fs");
-          const { join: join40 } = await import("node:path");
+          const { existsSync: existsSync22, readFileSync: readFileSync23 } = await import("node:fs");
+          const { join: join41 } = await import("node:path");
           await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot25());
           const credential = await registry.get(args.agentId);
@@ -48288,9 +48741,9 @@ agent ${agentId}:
           }
           let profile2 = null;
           let cantValidation = null;
-          const cantPath = args.cant ?? join40(CLEO_DIR_NAME3, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          const cantPath = args.cant ?? join41(CLEO_DIR_NAME3, AGENTS_SUBDIR, `${args.agentId}.cant`);
           if (existsSync22(cantPath)) {
-            profile2 = readFileSync22(cantPath, "utf-8");
+            profile2 = readFileSync23(cantPath, "utf-8");
             try {
               const cantModule = await import("@cleocode/cant");
               const validate = "validate" in cantModule ? cantModule.validate : null;
@@ -48814,7 +49267,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { createRuntime } = await import("@cleocode/runtime");
           const { existsSync: existsSync22 } = await import("node:fs");
-          const { join: join40 } = await import("node:path");
+          const { join: join41 } = await import("node:path");
           await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot25());
           const credential = await registry.get(args.agentId);
@@ -48831,7 +49284,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           await registry.update(args.agentId, { isActive: true });
           await registry.markUsed(args.agentId);
-          const cantPath = join40(CLEO_DIR_NAME3, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          const cantPath = join41(CLEO_DIR_NAME3, AGENTS_SUBDIR, `${args.agentId}.cant`);
           const hasProfile = existsSync22(cantPath);
           const runtime = await createRuntime(registry, {
             agentId: args.agentId,
@@ -49782,8 +50235,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             process.exitCode = 4;
             return;
           }
-          const { join: join40 } = await import("node:path");
-          const personaPath = join40(resolvedDir, "persona.cant");
+          const { join: join41 } = await import("node:path");
+          const personaPath = join41(resolvedDir, "persona.cant");
           if (!existsSync22(personaPath)) {
             cliOutput(
               {
@@ -49823,15 +50276,15 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             return;
           }
           const archiveStats = statSync3(archivePath);
-          const { readdirSync: readdirSync3 } = await import("node:fs");
+          const { readdirSync: readdirSync4 } = await import("node:fs");
           let fileCount = 0;
           const countFiles = (dirPath) => {
-            const entries = readdirSync3(dirPath, { withFileTypes: true });
+            const entries = readdirSync4(dirPath, { withFileTypes: true });
             for (const entry of entries) {
               if (entry.isFile()) {
                 fileCount++;
               } else if (entry.isDirectory()) {
-                countFiles(join40(dirPath, entry.name));
+                countFiles(join41(dirPath, entry.name));
               }
             }
           };
@@ -50079,17 +50532,17 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync22, readFileSync: readFileSync22, mkdirSync: mkdirSync7 } = await import("node:fs");
-          const { resolve: resolve13, join: join40 } = await import("node:path");
+          const { existsSync: existsSync22, readFileSync: readFileSync23, mkdirSync: mkdirSync7 } = await import("node:fs");
+          const { resolve: resolve13, join: join41 } = await import("node:path");
           const specPath = resolve13(args.spec);
           if (!existsSync22(specPath)) {
             cliError(`spec file not found: ${specPath}`, 4, { name: "E_NOT_FOUND" });
             process.exitCode = 4;
             return;
           }
-          const specContent = readFileSync22(specPath, "utf-8");
+          const specContent = readFileSync23(specPath, "utf-8");
           const projectRoot = getProjectRoot25();
-          const outputDir = args["output-dir"] ? resolve13(args["output-dir"]) : join40(projectRoot, ".cleo", "cant", "agents");
+          const outputDir = args["output-dir"] ? resolve13(args["output-dir"]) : join41(projectRoot, ".cleo", "cant", "agents");
           mkdirSync7(outputDir, { recursive: true });
           if (args["dry-run"]) {
             cliOutput(
@@ -51017,7 +51470,7 @@ function nexusApiUrlArg(args) {
 function failNexus(err, operation) {
   const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : void 0;
   const fix = err instanceof Error && "fix" in err && typeof err.fix === "string" ? err.fix : void 0;
-  const exitCode = code === "E_NEXUS_INVALID_API_URL" || code === "E_NEXUS_INVALID_LABEL" || code === "E_NEXUS_DEVICE_REQUIRED" || code === "E_VALIDATION" ? 6 : 1;
+  const exitCode = code === "E_NEXUS_INVALID_API_URL" || code === "E_NEXUS_INVALID_LABEL" || code === "E_NEXUS_DEVICE_REQUIRED" || code === "E_VALIDATION" ? 6 : VAULT_REFUSAL_EXIT_CODES[code ?? ""] ?? 1;
   const details = err instanceof Error && "publicDetails" in err && typeof err.publicDetails === "object" && err.publicDetails ? err.publicDetails : void 0;
   cliError(
     err instanceof Error ? err.message : String(err),
@@ -51084,6 +51537,24 @@ async function runNexusLogin(args, openBrowser2) {
         readOnly,
         ...name !== void 0 ? { name } : {}
       });
+      if (!readOnly) {
+        const { attachNexusGlobalStore } = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/cloud/nexus-home.js"
+        );
+        try {
+          const global = await attachNexusGlobalStore({ apiUrl: hooks2.apiUrl });
+          result = { ...result, warnings: [...result.warnings, ...global.warnings] };
+        } catch (err) {
+          result = {
+            ...result,
+            warnings: [
+              ...result.warnings,
+              `signed in, but attaching this device's global store failed (${err instanceof Error ? err.message : String(err)}); run \`cleo login nexus\` again`
+            ]
+          };
+        }
+      }
     } else {
       if (name !== void 0) {
         process.stderr.write(
@@ -51112,10 +51583,10 @@ async function runNexusLogin(args, openBrowser2) {
   }
 }
 function nexusLoginSummary(r) {
-  const who = r.user?.email ?? "your account";
+  const who2 = r.user?.email ?? "your account";
   const org = r.organization ? ` (${r.organization.name})` : "";
   const device = r.device ? ` This machine is device ${r.device.deviceId}${r.device.name ? ` (${r.device.name})` : ""}, profile ${r.device.profile ?? "unknown"}.` : "";
-  return `Signed in to ${r.apiUrl} as ${who}${org}.${device}`;
+  return `Signed in to ${r.apiUrl} as ${who2}${org}.${device}`;
 }
 function nexusDeviceLogoutSummary(r) {
   const count = (o) => r.devices.filter((d) => d.outcome === o).length;
@@ -51152,10 +51623,11 @@ async function runNexusDeviceLogout(args) {
 `);
   emitNexusResult(result, nexusDeviceLogoutSummary(result), "logout", "logout.run");
 }
-var SERVICE_NAME, NEXUS_API_URL_ARG;
+var SERVICE_NAME, NEXUS_API_URL_ARG, VAULT_REFUSAL_EXIT_CODES;
 var init_nexus_account_cli = __esm({
   "packages/cleo/src/cli/lib/nexus-account-cli.ts"() {
     "use strict";
+    init_src2();
     init_renderers();
     init_device_code_prompt();
     init_negated_flag();
@@ -51164,6 +51636,14 @@ var init_nexus_account_cli = __esm({
       type: "string",
       description: "Cleo Nexus API URL (default: $CLEO_NEXUS_API_URL, else https://api.cleocode.dev; staging: https://api.staging.cleocode.dev)."
     };
+    VAULT_REFUSAL_EXIT_CODES = {
+      E_NEXUS_VAULT_LEASE_HELD: 7 /* LOCK_TIMEOUT */,
+      E_NEXUS_VAULT_STORE_BUSY: 7 /* LOCK_TIMEOUT */,
+      E_NEXUS_VAULT_BEHIND: 23 /* VERSION_CONFLICT */,
+      E_NEXUS_VAULT_LOCAL_CHANGES: 21 /* CONCURRENT_MODIFICATION */,
+      E_NEXUS_VAULT_VERIFY_FAILED: 20 /* CHECKSUM_MISMATCH */,
+      E_NEXUS_VAULT_TARGET_OCCUPIED: 22 /* ID_COLLISION */
+    };
   }
 });
 
@@ -53351,14 +53831,14 @@ var init_backup = __esm({
           return;
         }
         const { exportPortableBundle, PortableBundleError } = await import("@cleocode/core/store/portable-bundle.js");
-        const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot76 } = await import("@cleocode/core");
         const passphrase = args.encrypt === true ? await resolvePassphrase() : void 0;
         if (args.encrypt === true && passphrase === void 0) return;
         const encSuffix = args.encrypt === true ? "enc." : "";
         try {
           const result = await exportPortableBundle({
             scope,
-            projectRoot: scope === "project" || scope === "all" ? getProjectRoot75() : void 0,
+            projectRoot: scope === "project" || scope === "all" ? getProjectRoot76() : void 0,
             outputPath: args.out ?? `./${args.name}.${encSuffix}cleobundle.tar.gz`,
             encrypt: args.encrypt === true,
             passphrase,
@@ -53415,12 +53895,12 @@ var init_backup = __esm({
           );
           return;
         }
-        const { getProjectRoot: getProjectRoot75, getCleoHome: getCleoHome8, getCleoVersion } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot76, getCleoHome: getCleoHome8, getCleoVersion } = await import("@cleocode/core");
         const { BundleError, cleanupStaging, unpackBundle } = await import("@cleocode/core/store/backup-unpack.js");
         const { regenerateConfigJson, regenerateProjectContextJson, regenerateProjectInfoJson } = await import("@cleocode/core/store/regenerators.js");
         const { regenerateAndCompare } = await import("@cleocode/core/store/restore-json-merge.js");
         const { buildConflictReport, writeConflictReport } = await import("@cleocode/core/store/restore-conflict-report.js");
-        const projectRoot = getProjectRoot75();
+        const projectRoot = getProjectRoot76();
         const { assertOwnerStoreRewriteConfirmed } = await import("@cleocode/core/store/worktree-isolation-guard.js");
         try {
           assertOwnerStoreRewriteConfirmed("backup import", path2.join(projectRoot, ".cleo"), {
@@ -55313,7 +55793,7 @@ var init_check3 = __esm({
       async run({ args }) {
         const { spawnSync: spawnSync2 } = await import("node:child_process");
         const { existsSync: existsSync22 } = await import("node:fs");
-        const { join: join40, resolve: resolve13 } = await import("node:path");
+        const { join: join41, resolve: resolve13 } = await import("node:path");
         const strict = Boolean(args.strict);
         const jsonOnly = Boolean(args.json);
         const repoRoot = resolve13(process.cwd());
@@ -55621,13 +56101,48 @@ var init_check3 = __esm({
             task: "T12663",
             script: "scripts/lint-model-call-sites.mjs",
             description: "Every model call site is a registered decision site (ratchet)"
+          },
+          {
+            // T12819 / T12827 (journal spec §2.3a, §3.5 Rule 4): nothing drops
+            // cleo_trigger_suspend; only dropSyncMachinery drops _sync_* tables;
+            // migrations never mention capture triggers; forward-only migration
+            // rules (owned triggers carry the suspension clause, deterministic
+            // DML, no parent DELETE in a rebuild file); released migration files
+            // are byte-identical to the base ref (#1719).
+            id: "gate-36",
+            task: "T12819",
+            script: "scripts/lint-sync-schema.mjs",
+            description: "Change-journal schema rules (suspend table, migrations)"
+          },
+          {
+            // T12897: every syncing cleo.db table is declared in ROW_IDENTITY or
+            // exempt with a reason and a task in ROW_IDENTITY_EXEMPT; a stale
+            // exemption (table gone, no longer syncing, or declared) fails too.
+            // The fresh-store check is store/__tests__/row-identity-gate.test.ts.
+            id: "gate-37",
+            task: "T12897",
+            script: "scripts/lint-row-identity-coverage.mjs",
+            description: "Every syncing cleo.db table has declared row identity or an exemption"
+          },
+          {
+            // T12881: the raw sync applier never runs TypeScript write paths, so
+            // every rejection site on a synced write path is tagged
+            // `// @sync-invariant <id>` (contracts sync-write-invariants
+            // registry) or an escape with a reason. Untagged sites are baselined
+            // per (file, symbol, code); the baseline only shrinks. Registry
+            // closure: tables classified, triggers created by migrations, no
+            // dead gates (spec t12859 §3.6.7).
+            id: "gate-38",
+            task: "T12881",
+            script: "scripts/lint-sync-write-invariants.mjs",
+            description: "Every synced-write rejection site is classified (ratchet)"
           }
         ];
         const scriptArgs = strict ? ["--strict"] : ["--check"];
         const results = [];
         let anyFailed = false;
         for (const gate of gates) {
-          const scriptPath = join40(repoRoot, gate.script);
+          const scriptPath = join41(repoRoot, gate.script);
           if (!existsSync22(scriptPath)) {
             results.push({
               id: gate.id,
@@ -56214,12 +56729,163 @@ var init_nexus_cloud_cli = __esm({
   }
 });
 
+// packages/cleo/src/cli/lib/nexus-vault-cli.ts
+function scopeArg(args, operation) {
+  const raw = stringArg(args, "scope") ?? "project";
+  if (raw === "project" || raw === "global") return raw;
+  failNexus(
+    Object.assign(new Error(`unknown scope '${raw}'`), {
+      code: "E_VALIDATION",
+      fix: "use --scope project (default) or --scope global"
+    }),
+    operation
+  );
+}
+function common2(args, operation) {
+  return { apiUrl: nexusApiUrlArg(args), scope: scopeArg(args, operation) };
+}
+function activityLimitArg(args) {
+  const raw = stringArg(args, "limit");
+  if (raw === void 0) return void 0;
+  const limit = Number(raw);
+  if (/^\d+$/.test(raw) && Number.isSafeInteger(limit) && limit >= 1 && limit <= 200) return limit;
+  throw Object.assign(new Error(`--limit must be a whole number from 1 to 200, got '${raw}'`), {
+    code: "E_VALIDATION",
+    fix: "pass --limit 1..200 (default 50)"
+  });
+}
+async function runCloudPush(args) {
+  await runCloudRead(
+    "cloud.push",
+    async () => (await vaultModule()).pushNexusVault({
+      ...common2(args, "cloud.push"),
+      force: args["force"] === true,
+      hold: args["hold"] === true
+    }),
+    (r) => r.status === "up-to-date" ? `Up to date: ${r.streamId} already holds this ${r.scope} store (snapshot ${r.snapshot?.checkpointId ?? "none"}).` : `Pushed ${r.scope} snapshot ${r.snapshot?.checkpointId} to ${r.streamId} (${r.snapshot?.rows ?? 0} rows${r.parentCheckpointId ? `, parent ${r.parentCheckpointId}` : ", first snapshot"}${r.forked ? ", FORK: lease taken by force" : ""}).`
+  );
+}
+async function runCloudPull(args) {
+  await runCloudRestoreLike(args, "cloud.pull", "pull");
+}
+async function runCloudRestore(args) {
+  await runCloudRestoreLike(args, "cloud.restore", "restore");
+}
+async function runCloudRestoreLike(args, operation, mode) {
+  await runCloudRead(
+    operation,
+    async () => {
+      const checkpointId = stringArg(args, "checkpoint");
+      const projectId = stringArg(args, "project");
+      const into = stringArg(args, "into");
+      return (await vaultModule()).restoreNexusVault({
+        ...common2(args, operation),
+        mode,
+        force: args["force"] === true,
+        ...mode === "restore" && checkpointId !== void 0 ? { checkpointId } : {},
+        ...mode === "restore" && projectId !== void 0 ? { projectId } : {},
+        ...mode === "restore" && into !== void 0 ? { into } : {},
+        relink: async (projectRoot) => {
+          const { linkProjectToNexus } = await import(
+            /* webpackIgnore: true */
+            "@cleocode/core/cloud/nexus-link.js"
+          );
+          try {
+            const linked = await linkProjectToNexus({ apiUrl: nexusApiUrlArg(args), projectRoot });
+            return linked.warnings;
+          } catch (err) {
+            return [
+              `restored, but attaching this copy failed (${err instanceof Error ? err.message : String(err)}); run \`cleo project link\``
+            ];
+          }
+        }
+      });
+    },
+    (r) => r.status === "up-to-date" ? `Up to date: this ${r.scope} store already holds snapshot ${r.snapshot?.checkpointId ?? "none"}.` : `Restored ${r.scope} snapshot ${r.snapshot?.checkpointId} into ${r.target}: ${r.tables} table(s) verified by count and hash${r.safetyBackup ? `; previous state saved to ${r.safetyBackup}` : ""}.`
+  );
+}
+async function runCloudVerify(args) {
+  await runCloudRead(
+    "cloud.verify",
+    async () => (await vaultModule()).verifyNexusVault(common2(args, "cloud.verify")),
+    (r) => {
+      const bad = r.tables.filter((t) => !t.match).map((t) => t.table);
+      const devices = r.devices.map(
+        (d) => `${who(d.deviceName, d.deviceId)} ${d.matchesHead ? "matches" : "differs from"} head`
+      ).join("; ");
+      return `Verify ${r.scope}: ${r.verdict}${bad.length ? ` (${bad.length} table(s) differ: ${bad.slice(0, 8).join(", ")}${bad.length > 8 ? ", \u2026" : ""})` : ""}; local integrity ${r.localIntegrity ? "ok" : "FAILED"}${devices ? `; ${devices}` : ""}.`;
+    }
+  );
+}
+async function runCloudVault(args) {
+  await runCloudRead(
+    "cloud.vault",
+    async () => (await vaultModule()).nexusVaultStatus(common2(args, "cloud.vault")),
+    (r) => `Vault ${r.scope} ${r.streamId}: ${r.lineage.length} snapshot(s), head ${r.head?.checkpointId ?? "none"}${r.head ? ` by ${who(r.head.deviceName, r.head.deviceId)}` : ""}; this store last synced ${r.lastSynced ?? "never"}; ${r.pendingChanges.length} table(s) changed since; leases: ${r.leases.map((l) => `${l.role} ${who(l.deviceName, l.deviceId ?? l.replicaId)} until ${l.expiresAt}${l.mine ? " (this machine)" : ""}${l.forkedFromReplicaId ? " (forked)" : ""}`).join("; ") || "none"}.`
+  );
+}
+async function runCloudLease(args) {
+  const action = stringArg(args, "action") ?? "release";
+  if (action !== "release") {
+    failNexus(
+      Object.assign(new Error(`unknown action '${action}'`), {
+        code: "E_VALIDATION",
+        fix: "use `cleo cloud lease release` (see `cleo cloud vault` for holders)"
+      }),
+      "cloud.lease.release"
+    );
+  }
+  await runCloudRead(
+    "cloud.lease.release",
+    async () => (await vaultModule()).releaseNexusVaultLease(common2(args, "cloud.lease.release")),
+    (r) => r.released ? `Released the write lease on ${r.streamId}: another device may push now.` : `This machine held no write lease on ${r.streamId}.`
+  );
+}
+async function runCloudActivity(args) {
+  await runCloudRead(
+    "cloud.activity",
+    async () => {
+      const { nexusCloudActivity } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-cloud-activity.js"
+      );
+      const limit = activityLimitArg(args);
+      const before = stringArg(args, "before");
+      const projectId = stringArg(args, "project");
+      const deviceId = stringArg(args, "device");
+      return nexusCloudActivity({
+        ...deviceId !== void 0 ? { deviceId } : {},
+        apiUrl: nexusApiUrlArg(args),
+        ...limit !== void 0 ? { limit } : {},
+        ...before !== void 0 ? { before } : {},
+        ...projectId !== void 0 ? { projectId } : {}
+      });
+    },
+    (r) => `${r.items.length} event(s)${r.projectId ? ` for project ${r.projectId}` : ""}: ${r.items.slice(0, 10).map(
+      (i) => `${i.at} ${who(i.deviceName, i.deviceId ?? "account")}${i.thisDevice ? " (this machine)" : ""} ${i.action}${i.target ? ` ${i.target}` : ""}`
+    ).join("; ")}${r.items.length > 10 ? "; \u2026" : ""}`
+  );
+}
+var vaultModule, who;
+var init_nexus_vault_cli = __esm({
+  "packages/cleo/src/cli/lib/nexus-vault-cli.ts"() {
+    "use strict";
+    init_nexus_account_cli();
+    init_nexus_cloud_cli();
+    vaultModule = () => import(
+      /* webpackIgnore: true */
+      "@cleocode/core/cloud/nexus-vault.js"
+    );
+    who = (name, id) => name ?? id;
+  }
+});
+
 // packages/cleo/src/cli/commands/cloud.ts
 var cloud_exports = {};
 __export(cloud_exports, {
   cloudCommand: () => cloudCommand
 });
-var JSON_ARG, statusSubCommand, whoamiSubCommand, devicesSubCommand, projectsSubCommand, cloudCommand;
+var JSON_ARG, SCOPE_ARG, statusSubCommand, whoamiSubCommand, devicesSubCommand, projectsSubCommand, pushSubCommand, pullSubCommand, restoreSubCommand, verifyVaultSubCommand, vaultSubCommand, leaseSubCommand, activitySubCommand, cloudCommand;
 var init_cloud = __esm({
   "packages/cleo/src/cli/commands/cloud.ts"() {
     "use strict";
@@ -56227,7 +56893,12 @@ var init_cloud = __esm({
     init_define_cli_command();
     init_nexus_account_cli();
     init_nexus_cloud_cli();
+    init_nexus_vault_cli();
     JSON_ARG = { type: "boolean", description: "Output as JSON envelope" };
+    SCOPE_ARG = {
+      type: "string",
+      description: "Which store: 'project' (the current project, default) or 'global' (this account's global store: the main brain)."
+    };
     statusSubCommand = defineCommand({
       meta: {
         name: "status",
@@ -56296,16 +56967,139 @@ var init_cloud = __esm({
         await runCloudProjects(args);
       }
     });
+    pushSubCommand = defineCommand({
+      meta: {
+        name: "push",
+        description: "Back up this store to Cleo Nexus as an encrypted snapshot; the key is escrowed on Cleo Nexus (released only to your approved devices), so this is encrypted at rest, not zero-knowledge. The server also stores per-table row counts and keyed hashes in plaintext. Refused when another device holds the write lease or pushed since this machine last synced (pull first); --force takes the lease and pushes anyway as a labelled fork. The lease is released when the push ends unless --hold."
+      },
+      args: {
+        scope: SCOPE_ARG,
+        force: {
+          type: "boolean",
+          description: "Take the lease from another device / push over a newer snapshot (a labelled fork)."
+        },
+        hold: {
+          type: "boolean",
+          description: "Keep the write lease after the push (another device cannot push until it expires or `cleo cloud lease release`)."
+        },
+        "api-url": NEXUS_API_URL_ARG,
+        json: JSON_ARG
+      },
+      async run({ args }) {
+        await runCloudPush(args);
+      }
+    });
+    pullSubCommand = defineCommand({
+      meta: {
+        name: "pull",
+        description: "Bring this store to the cloud's newest snapshot, verified by per-table count and hash before anything is replaced; this machine's local-only state is kept. Refuses to overwrite local changes made since the last sync unless --force (a safety backup is taken first)."
+      },
+      args: {
+        scope: SCOPE_ARG,
+        force: { type: "boolean", description: "Overwrite local changes (after a safety backup)." },
+        "api-url": NEXUS_API_URL_ARG,
+        json: JSON_ARG
+      },
+      async run({ args }) {
+        await runCloudPull(args);
+      }
+    });
+    restoreSubCommand = defineCommand({
+      meta: {
+        name: "restore",
+        description: "Restore a snapshot: the newest, or --checkpoint <id> (point in time); or a project this machine does not have yet with --project <id> [--into <dir>] (then it is linked to this device). Verified by count and hash before activation; a safety backup of existing data is taken first."
+      },
+      args: {
+        scope: SCOPE_ARG,
+        checkpoint: { type: "string", description: "Snapshot id to restore (see `cleo cloud vault`)." },
+        project: {
+          type: "string",
+          description: "Server project id to restore onto this machine (see `cleo cloud projects`)."
+        },
+        into: {
+          type: "string",
+          description: "Directory for --project (default: the current directory)."
+        },
+        force: { type: "boolean", description: "Overwrite local changes (after a safety backup)." },
+        "api-url": NEXUS_API_URL_ARG,
+        json: JSON_ARG
+      },
+      async run({ args }) {
+        await runCloudRestore(args);
+      }
+    });
+    verifyVaultSubCommand = defineCommand({
+      meta: {
+        name: "verify",
+        description: "Integrity check across machines: SQLite integrity of this store, its per-table counts and keyed hashes against the cloud's newest snapshot, and every device's newest snapshot against it. Verdict: match, ahead, behind, diverged, empty, or untrusted (the newest snapshot's signature does not verify)."
+      },
+      args: { scope: SCOPE_ARG, "api-url": NEXUS_API_URL_ARG, json: JSON_ARG },
+      async run({ args }) {
+        await runCloudVerify(args);
+      }
+    });
+    vaultSubCommand = defineCommand({
+      meta: {
+        name: "vault",
+        description: "The store's cloud vault: snapshot lineage (newest first), the last push of each device, tables changed since this machine's last sync, and who holds the write lease until when."
+      },
+      args: { scope: SCOPE_ARG, "api-url": NEXUS_API_URL_ARG, json: JSON_ARG },
+      async run({ args }) {
+        await runCloudVault(args);
+      }
+    });
+    leaseSubCommand = defineCommand({
+      meta: {
+        name: "lease",
+        description: "Hand the write lease back so another device can push: cleo cloud lease release."
+      },
+      args: {
+        action: { type: "positional", description: "'release'.", required: false },
+        scope: SCOPE_ARG,
+        "api-url": NEXUS_API_URL_ARG,
+        json: JSON_ARG
+      },
+      async run({ args }) {
+        await runCloudLease(args);
+      }
+    });
+    activitySubCommand = defineCommand({
+      meta: {
+        name: "activity",
+        description: "What this account's devices did on Cleo Nexus and when (snapshots pushed or refused, leases taken, forced or released, projects linked, devices enrolled), newest first."
+      },
+      args: {
+        limit: { type: "string", description: "Events to show (1-200, default 50)." },
+        before: { type: "string", description: "Older page: the nextBefore of a previous call." },
+        project: { type: "string", description: "Only events about this server project id." },
+        device: {
+          type: "string",
+          description: "Only events by this device id (see `cleo cloud devices`)."
+        },
+        "api-url": NEXUS_API_URL_ARG,
+        json: JSON_ARG
+      },
+      async run({ args }) {
+        await runCloudActivity(args);
+      }
+    });
     cloudCommand = defineCommand({
       meta: {
         name: "cloud",
-        description: "Cleo Nexus reads with the device credential (GET only; getting the credential may upgrade a 9.24 session or retry unsettled logouts): status (one-call verification), whoami, devices, projects [show]."
+        description: "Cleo Nexus with the device credential: status (one-call verification), whoami, devices, projects [show], activity; the encrypted vault: push, pull, restore, verify, vault, lease release."
       },
       subCommands: {
         status: statusSubCommand,
         whoami: whoamiSubCommand,
         devices: devicesSubCommand,
-        projects: projectsSubCommand
+        projects: projectsSubCommand,
+        activity: activitySubCommand,
+        push: pushSubCommand,
+        pull: pullSubCommand,
+        restore: restoreSubCommand,
+        verify: verifyVaultSubCommand,
+        vault: vaultSubCommand,
+        lease: leaseSubCommand
       }
     });
   }
@@ -56358,9 +57152,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartOutline } = await import("@cleocode/core/internal");
-            const { join: join40 } = await import("node:path");
+            const { join: join41 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join40(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join41(root, args.file);
             const result = smartOutline(absPath, root);
             if (result.errors.length > 0 && result.symbols.length === 0) {
               cliError(result.errors.join(", "), 1, { name: "E_OUTLINE_FAILED" });
@@ -56451,9 +57245,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartUnfold } = await import("@cleocode/core/internal");
-            const { join: join40 } = await import("node:path");
+            const { join: join41 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join40(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join41(root, args.file);
             const result = smartUnfold(absPath, args.symbol, root);
             if (!result.found) {
               const errs = result.errors.length > 0 ? `: ${result.errors.join(", ")}` : "";
@@ -64442,15 +65236,15 @@ var init_doctor_fk_check = __esm({
         }
       },
       async run({ args }) {
-        const scopeArg = args.scope;
-        if (scopeArg !== void 0 && scopeArg !== "project" && scopeArg !== "global") {
-          cliError(`--scope must be 'project' or 'global' (received: ${scopeArg})`, "E_INVALID_INPUT", {
+        const scopeArg2 = args.scope;
+        if (scopeArg2 !== void 0 && scopeArg2 !== "project" && scopeArg2 !== "global") {
+          cliError(`--scope must be 'project' or 'global' (received: ${scopeArg2})`, "E_INVALID_INPUT", {
             fix: "Run 'cleo doctor fk-check --scope project' or omit --scope to check both."
           });
           process.exitCode = 6;
           return;
         }
-        const scopeOpt = scopeArg ? { scopes: [scopeArg] } : {};
+        const scopeOpt = scopeArg2 ? { scopes: [scopeArg2] } : {};
         if (args.fix === true) {
           const fixReport = await repairForeignKeyViolations({ cwd: process.cwd(), ...scopeOpt });
           humanInfo(
@@ -64867,12 +65661,44 @@ var init_doctor_memory_guard = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/doctor-migrations.ts
+var doctor_migrations_exports = {};
+__export(doctor_migrations_exports, {
+  doctorMigrationsCommand: () => doctorMigrationsCommand
+});
+import { getProjectRoot as getProjectRoot49 } from "@cleocode/core";
+import { inspectMigrations } from "@cleocode/core/doctor/migrations.js";
+var doctorMigrationsCommand;
+var init_doctor_migrations = __esm({
+  "packages/cleo/src/cli/commands/doctor-migrations.ts"() {
+    "use strict";
+    init_define_cli_command();
+    init_renderers();
+    doctorMigrationsCommand = defineCommand({
+      meta: {
+        name: "migrations",
+        description: "Report the migration journal of the project and global stores: row count, head, applied and pending files per lineage, and hash drift. Read-only."
+      },
+      args: {
+        json: { type: "boolean", description: "Output as JSON" },
+        human: { type: "boolean", description: "Force human-readable output" },
+        quiet: { type: "boolean", description: "Suppress non-essential output" }
+      },
+      async run() {
+        const report = inspectMigrations(getProjectRoot49());
+        cliOutput(report, { command: "doctor", operation: "doctor.migrations.run" });
+        if (report.scopes.some((s) => s.drift.length > 0)) process.exitCode = 1;
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/doctor-nexus-residency.ts
 var doctor_nexus_residency_exports = {};
 __export(doctor_nexus_residency_exports, {
   doctorNexusResidencyCommand: () => doctorNexusResidencyCommand
 });
-import { getCleoHome as getCleoHome6, getProjectRoot as getProjectRoot49 } from "@cleocode/core";
+import { getCleoHome as getCleoHome6, getProjectRoot as getProjectRoot50 } from "@cleocode/core";
 import { scanNexusSchemaResidency } from "@cleocode/core/doctor/nexus-schema-residency.js";
 var doctorNexusResidencyCommand;
 var init_doctor_nexus_residency = __esm({
@@ -64891,7 +65717,7 @@ var init_doctor_nexus_residency = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run() {
-        const result = scanNexusSchemaResidency(getProjectRoot49(), getCleoHome6());
+        const result = scanNexusSchemaResidency(getProjectRoot50(), getCleoHome6());
         cliOutput(result, {
           command: "doctor",
           operation: "doctor.nexus-residency.run"
@@ -64909,7 +65735,7 @@ var doctor_project_identity_exports = {};
 __export(doctor_project_identity_exports, {
   doctorProjectIdentityCommand: () => doctorProjectIdentityCommand
 });
-import { getProjectRoot as getProjectRoot50 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot51 } from "@cleocode/core";
 import {
   inspectProjectIdentity,
   inspectProjectNameDrift,
@@ -64934,7 +65760,7 @@ var init_doctor_project_identity = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot50();
+        const projectRoot = getProjectRoot51();
         if (!args.resolve) {
           const report = inspectProjectIdentity(projectRoot);
           const nameDrift = await inspectProjectNameDrift(projectRoot);
@@ -65473,7 +66299,7 @@ var doctor_repair_exports = {};
 __export(doctor_repair_exports, {
   doctorRepairCommand: () => doctorRepairCommand
 });
-import { getLogger as getLogger21, getProjectRoot as getProjectRoot51 } from "@cleocode/core";
+import { getLogger as getLogger21, getProjectRoot as getProjectRoot52 } from "@cleocode/core";
 import { repairMalformedDbs } from "@cleocode/core/store/repair-malformed-dbs.js";
 var doctorRepairCommand;
 var init_doctor_repair = __esm({
@@ -65522,7 +66348,7 @@ var init_doctor_repair = __esm({
           return;
         }
         const result = repairMalformedDbs({
-          projectRoot: getProjectRoot51(),
+          projectRoot: getProjectRoot52(),
           roles: roleArg.length > 0 ? [roleArg] : void 0,
           dryRun,
           logger: getLogger21("doctor-repair"),
@@ -65724,7 +66550,7 @@ var doctor_superseded_store_exports = {};
 __export(doctor_superseded_store_exports, {
   doctorSupersededStoreCommand: () => doctorSupersededStoreCommand
 });
-import { getProjectRoot as getProjectRoot52 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot53 } from "@cleocode/core";
 import { scanSupersededStores } from "@cleocode/core/doctor/superseded-store.js";
 import { reconcileSupersededStores } from "@cleocode/core/store/exodus/index.js";
 var doctorSupersededStoreCommand;
@@ -65757,7 +66583,7 @@ var init_doctor_superseded_store = __esm({
       },
       async run({ args }) {
         if (args.reconcile === true) {
-          const receipt = await reconcileSupersededStores(getProjectRoot52(), {
+          const receipt = await reconcileSupersededStores(getProjectRoot53(), {
             dryRun: args["dry-run"] === true,
             additive: args.additive === true
           });
@@ -65779,7 +66605,7 @@ var init_doctor_superseded_store = __esm({
           );
           return;
         }
-        const result = scanSupersededStores(getProjectRoot52());
+        const result = scanSupersededStores(getProjectRoot53());
         cliOutput(result, {
           command: "doctor",
           operation: "doctor.superseded-store.run"
@@ -65880,7 +66706,7 @@ import {
   rollbackTwinCollapse
 } from "@cleocode/core/doctor/twin-collapse.js";
 import { CleoError as CleoError8 } from "@cleocode/core/errors";
-import { getProjectRoot as getProjectRoot53 } from "@cleocode/core/paths.js";
+import { getProjectRoot as getProjectRoot54 } from "@cleocode/core/paths.js";
 function reportTwinCollapseError(error, retry) {
   if (retry && !(error instanceof CleoError8)) throw error;
   const message = error instanceof Error ? error.message : String(error);
@@ -65951,7 +66777,7 @@ var init_doctor_twin_collapse = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot53();
+        const projectRoot = getProjectRoot54();
         const guard = { cwd: process.cwd(), confirmOwnerStore: args["confirm-owner-store"] === true };
         const actions = twinCollapseActions(args);
         if (actions.length > 1) {
@@ -66029,7 +66855,7 @@ __export(doctor_worktree_stores_exports, {
   doctorWorktreeStoresCommand: () => doctorWorktreeStoresCommand
 });
 import { scanWorktreeStores } from "@cleocode/core/doctor/worktree-stores.js";
-import { getProjectRoot as getProjectRoot54, resolveStoreOwnerRoot } from "@cleocode/core/paths.js";
+import { getProjectRoot as getProjectRoot55, resolveStoreOwnerRoot } from "@cleocode/core/paths.js";
 var doctorWorktreeStoresCommand;
 var init_doctor_worktree_stores = __esm({
   "packages/cleo/src/cli/commands/doctor-worktree-stores.ts"() {
@@ -66051,7 +66877,7 @@ var init_doctor_worktree_stores = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const projectRoot = resolveStoreOwnerRoot(getProjectRoot54());
+        const projectRoot = resolveStoreOwnerRoot(getProjectRoot55());
         const result = scanWorktreeStores(projectRoot, { skipCompare: args["skip-compare"] === true });
         cliOutput(result, {
           command: "doctor",
@@ -66203,7 +67029,7 @@ import {
   resumePreparedKnowledgeRepair,
   runKnowledgeDoctor as runKnowledgeDoctor2
 } from "@cleocode/core/doctor/knowledge.js";
-import { getProjectRoot as getProjectRoot55 } from "@cleocode/core/paths.js";
+import { getProjectRoot as getProjectRoot56 } from "@cleocode/core/paths.js";
 var doctorKnowledgeSubcommand;
 var init_doctor_knowledge = __esm({
   "packages/cleo/src/cli/commands/doctor-knowledge.ts"() {
@@ -66278,7 +67104,7 @@ var init_doctor_knowledge = __esm({
       },
       async run({ args }) {
         const startedAt = Date.now();
-        const root = getProjectRoot55();
+        const root = getProjectRoot56();
         let context;
         let pending;
         try {
@@ -66446,7 +67272,7 @@ import { join as join24 } from "node:path";
 import {
   ensureGlobalAgentRegistryDb,
   getGlobalAgentRegistryNativeDb,
-  getProjectRoot as getProjectRoot56,
+  getProjectRoot as getProjectRoot57,
   installAgentFromCant
 } from "@cleocode/core/internal";
 function sha256Hex(bytes) {
@@ -66634,7 +67460,7 @@ var init_migrate_agents_v2 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot56();
+        const projectRoot = getProjectRoot57();
         const verbose = args.quiet !== true;
         if (verbose) {
           humanInfo("Scanning .cleo/cant/agents/ and .cleo/agents/ for unregistered agents...");
@@ -66678,7 +67504,7 @@ __export(doctor_exports, {
 });
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join25 } from "node:path";
-import { getProjectRoot as getProjectRoot57, pushWarning as pushWarning5 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot58, pushWarning as pushWarning5 } from "@cleocode/core";
 import { renderInvariantAuditLines } from "@cleocode/core/doctor/invariant-audit-render.js";
 import {
   quarantineRogueCleoDir,
@@ -66809,6 +67635,7 @@ var init_doctor = __esm({
     init_doctor_malformed_ids();
     init_doctor_manifest_rows();
     init_doctor_memory_guard();
+    init_doctor_migrations();
     init_doctor_nexus_residency();
     init_doctor_project_identity();
     init_doctor_projects();
@@ -66841,6 +67668,8 @@ var init_doctor = __esm({
         "legacy-reaper": doctorLegacyReaperCommand,
         // T12128 — task ids that fail the write-path validator
         "malformed-ids": doctorMalformedIdsCommand,
+        // T12796 — the migration journal of each store (read-only; the live journal count)
+        migrations: doctorMigrationsCommand,
         // T12686 — manifest rows whose metadata violates the stored field contract (+ --repair/--rollback)
         "manifest-rows": doctorManifestRowsCommand,
         // T12095 — pre-dual-scope store files still on disk under their old LIVE names
@@ -67085,7 +67914,7 @@ var init_doctor = __esm({
             const { join: pathJoin } = await import("node:path");
             const { existsSync: existsSync22 } = await import("node:fs");
             const { detectAndHealCoreWorktreeLeak } = await import("@cleocode/worktree");
-            const projectRoot = getProjectRoot57();
+            const projectRoot = getProjectRoot58();
             let gitRoot = projectRoot;
             try {
               gitRoot = execFile2("git", ["rev-parse", "--show-toplevel"], {
@@ -67137,7 +67966,7 @@ var init_doctor = __esm({
           }
           if (args.brain) {
             const { computeBrainHealthDashboard } = await import("@cleocode/core/memory/brain-health-dashboard.js");
-            const projectRoot = getProjectRoot57();
+            const projectRoot = getProjectRoot58();
             const dashboard = await computeBrainHealthDashboard(projectRoot);
             cliOutput(dashboard, { command: "doctor", operation: "doctor.brain" });
             if (dashboard.hasP0Failure) {
@@ -67146,7 +67975,7 @@ var init_doctor = __esm({
             return;
           }
           if (args["scan-test-fixtures-in-prod"]) {
-            const projectRoot = getProjectRoot57();
+            const projectRoot = getProjectRoot58();
             const matches = await scanTestFixturesInProd(projectRoot);
             const dryRun = args["dry-run"] !== false && args.quarantine !== true;
             const quarantined = !dryRun && matches.length > 0 ? await quarantineTestFixtures(projectRoot, matches) : void 0;
@@ -67234,7 +68063,7 @@ var init_doctor = __esm({
             progress.complete("Comprehensive diagnostics complete");
           } else if (args["scan-rogue-cleo-dirs"]) {
             progress.step(0, "Scanning for rogue .cleo/ directories");
-            const projectRoot = getProjectRoot57();
+            const projectRoot = getProjectRoot58();
             const reports = scanRogueCleoDirs(projectRoot);
             progress.complete(
               `Found ${reports.length} rogue .cleo/ director${reports.length === 1 ? "y" : "ies"}`
@@ -67243,7 +68072,7 @@ var init_doctor = __esm({
           } else if (args["quarantine-rogue-cleo-dirs"]) {
             const isDryRun = args["dry-run"] === true;
             progress.step(0, `${isDryRun ? "[DRY RUN] " : ""}Scanning for rogue .cleo/ directories`);
-            const projectRoot = getProjectRoot57();
+            const projectRoot = getProjectRoot58();
             const reports = scanRogueCleoDirs(projectRoot);
             if (reports.length === 0) {
               progress.complete("No rogue .cleo/ directories found \u2014 nothing to quarantine");
@@ -67297,7 +68126,7 @@ var init_doctor = __esm({
             const { detectAndRemoveLegacyGlobalFiles, detectAndRemoveStrayProjectNexus } = await import("@cleocode/core/store/cleanup-legacy.js");
             const { getCleoHome: getCleoHome8 } = await import("@cleocode/core");
             const cleoHome = getCleoHome8();
-            const projectRoot = getProjectRoot57();
+            const projectRoot = getProjectRoot58();
             const legacyResult = detectAndRemoveLegacyGlobalFiles(cleoHome);
             const strayResult = detectAndRemoveStrayProjectNexus(projectRoot);
             const isDryRun = args["dry-run"] === true;
@@ -67330,7 +68159,7 @@ var init_doctor = __esm({
           } else if (args["audit-worktree-orphans"]) {
             progress.step(0, "Comprehensive worktree anomaly audit (T9808 / council D009)");
             const { auditWorktreeOrphansComprehensive, scanWorktreeOrphansBudgeted } = await import("@cleocode/core/doctor/worktree-orphans.js");
-            const projectRoot = getProjectRoot57();
+            const projectRoot = getProjectRoot58();
             const timeoutSecs = args["timeout"] !== void 0 ? Number.parseInt(String(args["timeout"]), 10) : 30;
             const timeoutMs = Number.isFinite(timeoutSecs) && timeoutSecs > 0 ? timeoutSecs * 1e3 : 3e4;
             const maxEntriesPerLevel = args["max-entries-per-level"] !== void 0 ? Number.parseInt(String(args["max-entries-per-level"]), 10) : 500;
@@ -67387,7 +68216,7 @@ var init_doctor = __esm({
               `${isDryRun ? "[DRY RUN] " : ""}Scanning + pruning worktree-orphan .cleo/ directories`
             );
             const { pruneWorktreeOrphans, scanWorktreeOrphansBudgeted } = await import("@cleocode/core/doctor/worktree-orphans.js");
-            const projectRoot = getProjectRoot57();
+            const projectRoot = getProjectRoot58();
             const timeoutSecs = args["timeout"] !== void 0 ? Number.parseInt(String(args["timeout"]), 10) : 30;
             const timeoutMs = Number.isFinite(timeoutSecs) && timeoutSecs > 0 ? timeoutSecs * 1e3 : 3e4;
             const maxEntriesPerLevel = args["max-entries-per-level"] !== void 0 ? Number.parseInt(String(args["max-entries-per-level"]), 10) : 500;
@@ -67466,7 +68295,7 @@ var init_doctor = __esm({
               `${isDryRun ? "[DRY RUN] " : ""}Migrating .cleo/worktree-include \u2192 .worktreeinclude`
             );
             const { migrateWorktreeIncludeFile } = await import("@cleocode/core");
-            const projectRoot = getProjectRoot57();
+            const projectRoot = getProjectRoot58();
             const result = await migrateWorktreeIncludeFile(projectRoot, { dryRun: isDryRun });
             progress.complete(`Migration ${result.action}`);
             cliOutput(result, { command: "doctor", operation: "doctor.migrate-worktree-include" });
@@ -67485,7 +68314,7 @@ var init_doctor = __esm({
             const stepLabel = isFocusedAlias ? "Auditing Saga hierarchy for ADR-073 invariants" : "Walking central INVARIANTS_REGISTRY";
             progress.step(0, stepLabel);
             const { auditInvariantRegistry } = await import("@cleocode/core/doctor/invariant-audit.js");
-            const projectRoot = getProjectRoot57();
+            const projectRoot = getProjectRoot58();
             const result = await auditInvariantRegistry(projectRoot, { adrFilter });
             const operation = isFocusedAlias ? "doctor.audit-sagas" : "doctor.audit-invariants";
             const summary = `Invariant audit complete \u2014 ${result.totalCount} entries walked, ${result.errorCount} error / ${result.warningCount} warning / ${result.infoCount} info violation(s), ${result.notApplicableCount} not-applicable, ${result.documentedCount} documented`;
@@ -67507,7 +68336,7 @@ var init_doctor = __esm({
               { command: "doctor", operation: "admin.health" }
             );
             try {
-              const projectRoot = getProjectRoot57();
+              const projectRoot = getProjectRoot58();
               const conflicts = readMigrationConflicts(projectRoot);
               if (conflicts.length > 0) {
                 progress.complete(
@@ -67538,7 +68367,7 @@ var init_doctor = __esm({
               progress.complete("Health check complete");
             }
             try {
-              const projectRoot = getProjectRoot57();
+              const projectRoot = getProjectRoot58();
               const { auditSagaHierarchy } = await import("@cleocode/core/doctor/saga-audit.js");
               const sagaAudit = await auditSagaHierarchy(projectRoot);
               if (sagaAudit.sagas.length === 0) {
@@ -67567,7 +68396,7 @@ Saga Hierarchy: audit skipped (${msg})`);
             }
             try {
               const { scanDependencyCycles: scanDependencyCycles2 } = await import("@cleocode/core/doctor/dependency-cycles.js");
-              const cycles = await scanDependencyCycles2(getProjectRoot57());
+              const cycles = await scanDependencyCycles2(getProjectRoot58());
               humanLine(
                 `
 Dependency cycles: ${cycles.cycleCount} (${cycles.edgeCount} edge(s) checked)`
@@ -67678,14 +68507,14 @@ var init_done = __esm({
           process.exitCode = 2;
           return;
         }
-        const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core/paths.js");
-        const options = { projectRoot: getProjectRoot75(), ...parsed.options };
+        const { getProjectRoot: getProjectRoot76 } = await import("@cleocode/core/paths.js");
+        const options = { projectRoot: getProjectRoot76(), ...parsed.options };
         const requested = [
           ...new Set([args.taskId, ...args._ ?? []].map(String))
         ];
-        const invalid = requested.filter((id) => !/^T\d+$/.test(id));
-        if (invalid.length > 0) {
-          cliError(`Not task ids: ${invalid.join(", ")} (expected T<digits>)`, "E_INVALID_INPUT");
+        const invalid2 = requested.filter((id) => !/^T\d+$/.test(id));
+        if (invalid2.length > 0) {
+          cliError(`Not task ids: ${invalid2.join(", ")} (expected T<digits>)`, "E_INVALID_INPUT");
           process.exitCode = 2;
           return;
         }
@@ -67949,8 +68778,8 @@ var init_event = __esm({
           }
           for (const file of filesToTail) {
             const agentId = file.replace(".jsonl", "");
-            const { readFileSync: readFileSync22 } = await import("node:fs");
-            const content = readFileSync22(join26(eventsDir, file), "utf-8");
+            const { readFileSync: readFileSync23 } = await import("node:fs");
+            const content = readFileSync23(join26(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -68045,8 +68874,8 @@ var init_event = __esm({
         const printAgentLog = async (file) => {
           const agentId = file.replace(".jsonl", "");
           try {
-            const { readFileSync: readFileSync22 } = await import("node:fs");
-            const content = readFileSync22(join26(eventsDir, file), "utf-8");
+            const { readFileSync: readFileSync23 } = await import("node:fs");
+            const content = readFileSync23(join26(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -69041,7 +69870,7 @@ __export(gateway_exports, {
   gatewayOpenapiSubCommand: () => gatewayOpenapiSubCommand
 });
 import { resolve as resolve8 } from "node:path";
-import { generateOpenApi, getProjectRoot as getProjectRoot58 } from "@cleocode/core";
+import { generateOpenApi, getProjectRoot as getProjectRoot59 } from "@cleocode/core";
 var gatewayOpenapiSubCommand, gatewayCommand;
 var init_gateway = __esm({
   "packages/cleo/src/cli/commands/gateway.ts"() {
@@ -69073,7 +69902,7 @@ var init_gateway = __esm({
         const pathCount = Object.keys(doc.paths).length;
         if (typeof args.out === "string" && args.out.length > 0) {
           const { writeFileSync: writeFileSync8 } = await import("node:fs");
-          const target = resolve8(getProjectRoot58(), args.out);
+          const target = resolve8(getProjectRoot59(), args.out);
           writeFileSync8(target, json2, "utf8");
           cliOutput(
             { out: target, pathCount, version: doc.info.version, openapi: doc.openapi },
@@ -69534,7 +70363,7 @@ var go_exports = {};
 __export(go_exports, {
   goCommand: () => goCommand
 });
-import { getProjectRoot as getProjectRoot59, go } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot60, go } from "@cleocode/core";
 var goCommand;
 var init_go = __esm({
   "packages/cleo/src/cli/commands/go.ts"() {
@@ -69560,7 +70389,7 @@ var init_go = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot59();
+        const projectRoot = getProjectRoot60();
         const { getCurrentSessionId, resolveBoundSessionId } = await import("@cleocode/core/internal");
         let sessionId = getCurrentSessionId(projectRoot) ?? void 0;
         if (sessionId === void 0) {
@@ -69588,7 +70417,7 @@ var goal_exports = {};
 __export(goal_exports, {
   goalCommand: () => goalCommand
 });
-import { getProjectRoot as getProjectRoot60, goal } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot61, goal } from "@cleocode/core";
 function resolveGoalKind(task) {
   if (typeof task === "string" && task.length > 0) {
     if (!isValidGoalTargetTaskId(task)) {
@@ -69635,7 +70464,7 @@ var init_goal2 = __esm({
         }
         const record = await goal.createGoal(
           { goalKind: kindResult.kind, intent, turnBudget: resolveTurnBudget(args.turns) },
-          getProjectRoot60()
+          getProjectRoot61()
         );
         cliOutput(record, { command: "goal set", operation: "goal.set" });
       }
@@ -69646,7 +70475,7 @@ var init_goal2 = __esm({
         description: "Show the current agent's active goal (per-agent scoped)."
       },
       async run() {
-        const record = await goal.getActiveGoal(getProjectRoot60());
+        const record = await goal.getActiveGoal(getProjectRoot61());
         cliOutput(record ?? { active: null }, { command: "goal status", operation: "goal.status" });
       }
     });
@@ -69668,7 +70497,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot60();
+        const cwd = getProjectRoot61();
         const parent = await goal.getActiveGoal(cwd);
         if (!parent) {
           cliError(
@@ -69716,7 +70545,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot60();
+        const cwd = getProjectRoot61();
         const result = await goal.advanceGoalWithPersist(goalId, { cwd });
         if (!result) {
           cliError(`Goal '${goalId}' not found.`, 4 /* NOT_FOUND */, { name: "E_NOT_FOUND" });
@@ -69741,7 +70570,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot60();
+        const cwd = getProjectRoot61();
         const active = await goal.getActiveGoal(cwd);
         if (!active) {
           cliError(
@@ -70783,12 +71612,422 @@ var init_history = __esm({
   }
 });
 
+// packages/cleo/src/cli/hook-entry.ts
+var hook_entry_exports = {};
+__export(hook_entry_exports, {
+  HEAVY_HOOK_PROVIDERS: () => HEAVY_HOOK_PROVIDERS,
+  claudeGuardedBashRules: () => claudeGuardedBashRules,
+  claudeRuleFiles: () => claudeRuleFiles,
+  codexGuardedWords: () => codexGuardedWords,
+  guardedHeavyCommand: () => guardedHeavyCommand,
+  heavyCommandHook: () => heavyCommandHook,
+  heavyHookContext: () => heavyHookContext,
+  heavyHookWaitBudget: () => heavyHookWaitBudget,
+  heavyRuleWords: () => heavyRuleWords,
+  parseHookInput: () => parseHookInput,
+  processHookIo: () => processHookIo,
+  renderHeavyHookAnswer: () => renderHeavyHookAnswer,
+  runHookCli: () => runHookCli
+});
+import { readdirSync as readdirSync3, readFileSync as readFileSync12 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join28 } from "node:path";
+async function readProcessStdin() {
+  if (process.stdin.isTTY) return "";
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of process.stdin) {
+    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+    size += buf.length;
+    if (size > MAX_STDIN_BYTES) return "";
+    chunks.push(buf);
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+function processHookIo() {
+  return {
+    readStdin: readProcessStdin,
+    writeStdout: (text) => process.stdout.write(text),
+    // stdout-discipline-allowed: PreToolUse hook protocol, the harness parses this JSON (not LAFS, not rendered output) // stdout-write-allowed: PreToolUse hook protocol output read raw by the harness
+    writeStderr: (text) => process.stderr.write(text),
+    env: process.env,
+    cwd: process.cwd()
+  };
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseHookInput(text) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (!isRecord4(raw)) return null;
+  const toolInput = raw.tool_input;
+  if (!isRecord4(toolInput) || typeof toolInput.command !== "string") return null;
+  const toolName = typeof raw.tool_name === "string" ? raw.tool_name : void 0;
+  if (toolName !== void 0 && !/^(bash|shell|exec_command)$/i.test(toolName)) return null;
+  const str3 = (v) => typeof v === "string" ? v : void 0;
+  return {
+    ...toolName === void 0 ? {} : { tool_name: toolName },
+    tool_input: { ...toolInput, command: toolInput.command },
+    ...str3(raw.cwd) === void 0 ? {} : { cwd: str3(raw.cwd) },
+    ...str3(raw.permission_mode) === void 0 ? {} : { permission_mode: str3(raw.permission_mode) }
+  };
+}
+function positiveMs(value) {
+  const n = value === void 0 ? Number.NaN : Number(value);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : void 0;
+}
+function heavyHookWaitBudget(provider, toolInput, env = {}) {
+  if (toolInput.run_in_background === true) return {};
+  if (provider !== "claude-code" && provider !== "opencode") {
+    return { waitTimeoutSec: DEFAULT_WAIT_SEC };
+  }
+  const fromEnv = provider === "claude-code";
+  const def = (fromEnv ? positiveMs(env.BASH_DEFAULT_TIMEOUT_MS) : void 0) ?? BASH_DEFAULT_MS;
+  const max = Math.max(
+    (fromEnv ? positiveMs(env.BASH_MAX_TIMEOUT_MS) : void 0) ?? BASH_MAX_MS,
+    def
+  );
+  const asked = typeof toolInput.timeout === "number" && toolInput.timeout > 0 ? toolInput.timeout : def;
+  const effective = Math.min(asked, max);
+  const room = Math.floor((max - effective) / 1e3);
+  const waitTimeoutSec = Math.max(
+    MIN_WAIT_SEC,
+    Math.min(MAX_WAIT_SEC, Math.round(effective / 1e3), room)
+  );
+  return { waitTimeoutSec, timeoutMs: Math.min(max, effective + waitTimeoutSec * 1e3) };
+}
+function heavyHookContext(plan, pressure, provider = "claude-code") {
+  const lines = [];
+  const governed = plan.action === "none" ? "" : plan.segments.map((s) => s.governed).join(" ; ");
+  if (plan.action === "rewrite" && provider === "kimi") {
+    lines.push(
+      `[cleo] Not run: heavy commands share the machine-wide resource budget. Re-run it as: ${plan.command}`
+    );
+  } else if (plan.action === "rewrite") {
+    lines.push(
+      `[cleo] Routed heavy work through the machine-wide budget: ${governed}. cleo run passes the command its stdin, stdout, stderr and exit code; exit 75 means it was not admitted before the wait ran out (E_RESOURCE_DEFERRED on stderr lists holders and ways forward).`
+    );
+  } else if (plan.action === "warn") {
+    lines.push(
+      `[cleo] Heavy command not rewritten because ${plan.reason}. Run it governed so it shares the machine-wide budget: ${governed}`
+    );
+  }
+  if (pressure !== null) lines.push(pressure);
+  return lines.join("\n");
+}
+function demote(plan, reason) {
+  return plan.action === "rewrite" ? { action: "warn", reason, segments: plan.segments } : plan;
+}
+function renderHeavyHookAnswer(provider, toolInput, plan, context, timeoutMs) {
+  if (plan.action === "none" && context === "") return "";
+  const rewrite = plan.action === "rewrite";
+  if (provider === "opencode") {
+    const answer = {
+      ...rewrite ? { command: plan.command } : {},
+      ...rewrite && timeoutMs !== void 0 ? { timeout: timeoutMs } : {},
+      ...context === "" ? {} : { context }
+    };
+    return `${JSON.stringify(answer)}
+`;
+  }
+  if (provider === "kimi") {
+    if (!rewrite) return `${context}
+`;
+    const deny = {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: context
+      }
+    };
+    return `${JSON.stringify(deny)}
+`;
+  }
+  const updatedInput = rewrite ? {
+    ...toolInput,
+    command: plan.command,
+    ...provider === "claude-code" && timeoutMs !== void 0 ? { timeout: timeoutMs } : {}
+  } : void 0;
+  const output2 = {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      ...rewrite && provider === "codex" ? { permissionDecision: "allow" } : {},
+      ...updatedInput === void 0 ? {} : { updatedInput },
+      ...context === "" ? {} : { additionalContext: context }
+    }
+  };
+  return `${JSON.stringify(output2)}
+`;
+}
+function wordBase(word) {
+  return word.split("/").pop() ?? word;
+}
+function heavyRuleWords(argv) {
+  const out = [];
+  for (const w of argv) {
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w) || w.startsWith("-") || /^\d+$/.test(w)) continue;
+    out.push(wordBase(w));
+    if (out.length === 4) break;
+  }
+  return out;
+}
+function ruleWords(pattern) {
+  return pattern.split(/[\s:*()]+/).filter((w) => w !== "" && !w.startsWith("-")).map(wordBase);
+}
+function claudeRuleFiles(projectDir, env) {
+  const managed = process.platform === "darwin" ? "/Library/Application Support/ClaudeCode/managed-settings.json" : process.platform === "win32" ? "C:\\Program Files\\ClaudeCode\\managed-settings.json" : "/etc/claude-code/managed-settings.json";
+  const configDir = env.CLAUDE_CONFIG_DIR || join28(env.HOME || homedir3(), ".claude");
+  return [
+    managed,
+    join28(configDir, "settings.json"),
+    join28(projectDir, ".claude", "settings.json"),
+    join28(projectDir, ".claude", "settings.local.json")
+  ];
+}
+function claudeGuardedBashRules(files) {
+  const patterns = [];
+  let unreadable = null;
+  for (const file of files) {
+    let raw;
+    try {
+      raw = JSON.parse(readFileSync12(file, "utf-8"));
+    } catch (err) {
+      const code = err.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") unreadable ??= file;
+      continue;
+    }
+    const permissions = isRecord4(raw) ? raw.permissions : void 0;
+    if (!isRecord4(permissions)) continue;
+    for (const key of ["deny", "ask"]) {
+      const rules = permissions[key];
+      if (!Array.isArray(rules)) continue;
+      for (const rule2 of rules) {
+        if (typeof rule2 !== "string") continue;
+        const trimmed = rule2.trim();
+        if (trimmed === "Bash") {
+          patterns.push("*");
+          continue;
+        }
+        const match = /^Bash\((.*)\)$/s.exec(trimmed);
+        if (match?.[1] !== void 0) patterns.push(match[1]);
+      }
+    }
+  }
+  return { patterns, unreadable };
+}
+function codexGuardedWords(projectDir, env) {
+  const home = env.CODEX_HOME || join28(env.HOME || homedir3(), ".codex");
+  const out = [];
+  for (const dir of [join28(home, "rules"), join28(projectDir, ".codex", "rules")]) {
+    let names;
+    try {
+      names = readdirSync3(dir).filter((n) => n.endsWith(".rules"));
+    } catch {
+      continue;
+    }
+    for (const name of names) {
+      let text;
+      try {
+        text = readFileSync12(join28(dir, name), "utf-8");
+      } catch {
+        continue;
+      }
+      if (!/decision\s*=\s*["'](forbidden|prompt)["']/.test(text)) continue;
+      for (const m of text.matchAll(/"([^"\\]*)"|'([^'\\]*)'/g)) {
+        for (const w of ruleWords(m[1] ?? m[2] ?? "")) out.push(w);
+      }
+    }
+  }
+  return out;
+}
+function guardedHeavyCommand(provider, segments, projectDir, env, files = claudeRuleFiles(projectDir, env)) {
+  let rules;
+  if (provider === "claude-code") {
+    const found = claudeGuardedBashRules(files);
+    if (found.unreadable !== null) return { kind: "unreadable", file: found.unreadable };
+    rules = found.patterns.map(ruleWords);
+    if (rules.some((words) => words.length === 0)) return { kind: "all" };
+  } else if (provider === "codex") {
+    const words = codexGuardedWords(projectDir, env);
+    rules = words.length === 0 ? [] : [words];
+  } else {
+    return null;
+  }
+  for (const segment of segments) {
+    const words = heavyRuleWords(segment.argv);
+    const first = words[0];
+    if (first === void 0) continue;
+    for (const rule2 of rules) {
+      if (provider === "codex") {
+        const hit = words.slice(0, 3).find((w) => rule2.includes(w));
+        if (hit !== void 0) return { kind: "word", word: hit };
+        continue;
+      }
+      const lead = rule2[0];
+      if (lead !== void 0 && words.includes(lead)) return { kind: "word", word: lead };
+      if (rule2.includes(first)) return { kind: "word", word: first };
+    }
+  }
+  return null;
+}
+function providerProjectDir(provider, env) {
+  return provider === "claude-code" ? env.CLAUDE_PROJECT_DIR || void 0 : void 0;
+}
+async function heavyCommandHook(provider, stdin2, io) {
+  const envMode = io.env.CLEO_HEAVY_COMMAND_HOOK?.trim().toLowerCase();
+  if (envMode === "off") return "";
+  const input2 = parseHookInput(stdin2);
+  if (input2?.tool_input === void 0) return "";
+  const core2 = await import("@cleocode/core/resources/heavy-command.js");
+  const cwd = input2.cwd ?? io.cwd;
+  const budget = heavyHookWaitBudget(provider, input2.tool_input, io.env);
+  let plan = core2.planHeavyCommand(input2.tool_input.command, {
+    cwd,
+    ...budget.waitTimeoutSec === void 0 ? {} : { waitTimeoutSec: budget.waitTimeoutSec }
+  });
+  if (plan.action === "none") return "";
+  const projectRoot = providerProjectDir(provider, io.env) ?? core2.heavyHookProjectRoot(cwd);
+  const mode = core2.resolveHeavyHookMode(
+    envMode,
+    core2.isHeavyCommandHookMode(envMode) ? void 0 : await core2.configuredHeavyHookMode(projectRoot)
+  );
+  if (mode === "off") return "";
+  if (mode === "warn") {
+    plan = demote(
+      plan,
+      "the hook is in warn mode (CLEO_HEAVY_COMMAND_HOOK or resources.heavyCommandHook)"
+    );
+  }
+  if (!core2.executableOnPath("cleo", io.env.PATH)) plan = demote(plan, "`cleo` is not on PATH");
+  if (provider !== "kimi" && !REWRITE_MODES.has(input2.permission_mode ?? "")) {
+    plan = demote(
+      plan,
+      `rewriting it would change which permission rules match it, so the hook rewrites only in bypassPermissions or auto mode (this session: ${input2.permission_mode ?? "unknown"})`
+    );
+  }
+  if (plan.action === "rewrite") {
+    const hit = guardedHeavyCommand(provider, plan.segments, projectRoot, io.env);
+    const where = provider === "codex" ? "Codex rules" : "Claude Code settings";
+    if (hit?.kind === "word") {
+      plan = demote(
+        plan,
+        `a deny or ask rule in your ${where} names \`${hit.word}\`, and a rewrite would hide the command from it`
+      );
+    } else if (hit?.kind === "all") {
+      plan = demote(
+        plan,
+        `a deny or ask rule in your ${where} covers every Bash command, and a rewrite would hide the command from it`
+      );
+    } else if (hit?.kind === "unreadable") {
+      plan = demote(
+        plan,
+        `${hit.file} could not be read or parsed, so the hook cannot tell whether a deny or ask rule names the command`
+      );
+    }
+  }
+  const context = heavyHookContext(plan, await core2.heavyPressureNotice(), provider);
+  return renderHeavyHookAnswer(provider, input2.tool_input, plan, context, budget.timeoutMs);
+}
+async function runHookCli(argv, io = processHookIo()) {
+  const [name, ...rest] = argv;
+  if (name !== "heavy-command") {
+    io.writeStderr(USAGE);
+    return 1;
+  }
+  const flag = rest.findIndex((a) => a === "--provider" || a.startsWith("--provider="));
+  const value = flag === -1 ? "claude-code" : rest[flag]?.split("=")[1] ?? rest[flag + 1];
+  const provider = HEAVY_HOOK_PROVIDERS.find((p) => p === value);
+  if (provider === void 0) {
+    io.writeStderr(USAGE);
+    return 1;
+  }
+  try {
+    const answer = await heavyCommandHook(provider, await io.readStdin(), io);
+    if (answer !== "") io.writeStdout(answer);
+  } catch (err) {
+    io.writeStderr(
+      `[cleo hook] heavy-command skipped: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+  return 0;
+}
+var HEAVY_HOOK_PROVIDERS, BASH_DEFAULT_MS, BASH_MAX_MS, MIN_WAIT_SEC, MAX_WAIT_SEC, DEFAULT_WAIT_SEC, REWRITE_MODES, MAX_STDIN_BYTES, USAGE;
+var init_hook_entry = __esm({
+  "packages/cleo/src/cli/hook-entry.ts"() {
+    "use strict";
+    HEAVY_HOOK_PROVIDERS = [
+      "claude-code",
+      "codex",
+      "kimi",
+      "opencode"
+    ];
+    BASH_DEFAULT_MS = 12e4;
+    BASH_MAX_MS = 6e5;
+    MIN_WAIT_SEC = 30;
+    MAX_WAIT_SEC = 300;
+    DEFAULT_WAIT_SEC = 60;
+    REWRITE_MODES = /* @__PURE__ */ new Set(["bypassPermissions", "auto"]);
+    MAX_STDIN_BYTES = 1024 * 1024;
+    USAGE = "usage: cleo hook heavy-command [--provider claude-code|codex|kimi|opencode] < hook-input.json\n";
+  }
+});
+
+// packages/cleo/src/cli/commands/hook.ts
+var hook_exports = {};
+__export(hook_exports, {
+  hookCommand: () => hookCommand
+});
+var heavyCommandSubcommand, hookCommand;
+var init_hook = __esm({
+  "packages/cleo/src/cli/commands/hook.ts"() {
+    "use strict";
+    init_define_cli_command();
+    heavyCommandSubcommand = defineCommand({
+      meta: {
+        name: "heavy-command",
+        description: "PreToolUse hook: route heavy shell commands (tests, builds, typechecks, installs) through cleo run. Reads the hook JSON on stdin; prints the harness answer."
+      },
+      args: {
+        provider: {
+          type: "string",
+          description: "Harness protocol to answer in: claude-code (default), codex, kimi, opencode"
+        }
+      },
+      async run({ args }) {
+        const { runHookCli: runHookCli2 } = await Promise.resolve().then(() => (init_hook_entry(), hook_entry_exports));
+        const provider = typeof args.provider === "string" ? args.provider : "claude-code";
+        process.exitCode = await runHookCli2(["heavy-command", "--provider", provider]);
+      }
+    });
+    hookCommand = defineCommand({
+      meta: {
+        name: "hook",
+        description: "Agent-harness hooks installed by cleo init/upgrade; stdout is the harness hook protocol, not LAFS: cleo hook heavy-command --provider claude-code|codex|kimi|opencode"
+      },
+      subCommands: {
+        "heavy-command": heavyCommandSubcommand
+      },
+      async run({ cmd, rawArgs }) {
+        const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
+        if (firstArg && cmd.subCommands && firstArg in cmd.subCommands) return;
+        await showUsage(cmd);
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/hygiene.ts
 var hygiene_exports = {};
 __export(hygiene_exports, {
   hygieneCommand: () => hygieneCommand
 });
-import { getProjectRoot as getProjectRoot61 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot62 } from "@cleocode/core";
 import { runSpawnReadinessHygieneCli } from "@cleocode/core/hygiene/validate-spawn-readiness.js";
 var hygieneCommand;
 var init_hygiene = __esm({
@@ -70817,7 +72056,7 @@ var init_hygiene = __esm({
             }
           },
           async run({ args }) {
-            const projectRoot = args["project-root"] || getProjectRoot61() || process.cwd();
+            const projectRoot = args["project-root"] || getProjectRoot62() || process.cwd();
             const worktreePath = args["worktree-path"];
             await runSpawnReadinessHygieneCli(projectRoot, worktreePath);
           }
@@ -70992,8 +72231,8 @@ __export(init_exports, {
   isCredentialPoolEmpty: () => isCredentialPoolEmpty,
   maybeNudgeFirstRunLogin: () => maybeNudgeFirstRunLogin
 });
-import { existsSync as existsSync16, readFileSync as readFileSync12 } from "node:fs";
-import { join as join28 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync13 } from "node:fs";
+import { join as join29 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import {
   CleoError as CleoError9,
@@ -71008,12 +72247,12 @@ import { getTemplatesByKind } from "@cleocode/core/templates/registry";
 function getGitignoreTemplate() {
   try {
     const thisFile = fileURLToPath5(import.meta.url);
-    const packageRoot = join28(thisFile, "..", "..", "..", "..");
-    const localTemplatePath = join28(packageRoot, "templates", "cleo-gitignore");
-    const monorepoTemplatePath = join28(packageRoot, "..", "..", "templates", "cleo-gitignore");
+    const packageRoot = join29(thisFile, "..", "..", "..", "..");
+    const localTemplatePath = join29(packageRoot, "templates", "cleo-gitignore");
+    const monorepoTemplatePath = join29(packageRoot, "..", "..", "templates", "cleo-gitignore");
     const templatePath = existsSync16(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
     if (existsSync16(templatePath)) {
-      return readFileSync12(templatePath, "utf-8");
+      return readFileSync13(templatePath, "utf-8");
     }
   } catch {
   }
@@ -72160,7 +73399,7 @@ var llm_cost_exports = {};
 __export(llm_cost_exports, {
   costCommand: () => costCommand
 });
-import { getProjectRoot as getProjectRoot62 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot63 } from "@cleocode/core/internal";
 import { computeCost } from "@cleocode/core/llm/usage-pricing";
 function resolveSessionId(raw) {
   if (raw === "current") {
@@ -72233,7 +73472,7 @@ var init_llm_cost = __esm({
           process.exit(6);
         }
         const sessionId = resolveSessionId(rawSessionId);
-        const projectRoot = getProjectRoot62(process.cwd());
+        const projectRoot = getProjectRoot63(process.cwd());
         let breakdown;
         try {
           breakdown = await loadSessionCostBreakdown(projectRoot, sessionId);
@@ -73610,7 +74849,7 @@ var memory_exports = {};
 __export(memory_exports, {
   memoryCommand: () => memoryCommand
 });
-import { getProjectRoot as getProjectRoot63 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot64 } from "@cleocode/core";
 import {
   getBrainDb as getBrainDb2,
   getDreamStatus,
@@ -74568,7 +75807,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot63();
+        const root = getProjectRoot64();
         try {
           const result = await runConsolidation(root);
           cliOutput(result, { command: "memory-consolidate", operation: "memory.consolidate" });
@@ -74592,7 +75831,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot63();
+        const root = getProjectRoot64();
         if (args.status) {
           try {
             const status = await getDreamStatus(root);
@@ -74629,7 +75868,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot63();
+        const root = getProjectRoot64();
         try {
           const { runObserver, runReflector } = await import("@cleocode/core/memory");
           const observerResult = await runObserver(root, args.session, {
@@ -74669,7 +75908,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot63();
+        const root = getProjectRoot64();
         await getBrainDb2(root);
         const { getBrainNativeDb: getBrainNativeDb3 } = await import("@cleocode/core/internal");
         const nativeDb = getBrainNativeDb3();
@@ -74707,7 +75946,7 @@ var init_memory3 = __esm({
       },
       async run({ args }) {
         const core2 = await import("@cleocode/core/internal");
-        const nexusDb = await core2.getNexusDb(getProjectRoot63());
+        const nexusDb = await core2.getNexusDb(getProjectRoot64());
         const result = args.restore ? await core2.restorePrunedTraits(
           nexusDb,
           String(args.restore),
@@ -74737,7 +75976,7 @@ var init_memory3 = __esm({
           return;
         }
         const core2 = await import("@cleocode/core/internal");
-        const nexusDb = await core2.getNexusDb(getProjectRoot63());
+        const nexusDb = await core2.getNexusDb(getProjectRoot64());
         const previous = await core2.setUserProfileTraitScope(nexusDb, String(args.key), scope);
         if (previous === null) {
           cliError(`No user-profile trait "${args.key}"`, "E_NOT_FOUND", { name: "E_NOT_FOUND" });
@@ -74761,7 +76000,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot63();
+        const root = getProjectRoot64();
         try {
           await getBrainDb2(root);
           const { totalDuplicateRows, groups } = await scanDuplicateEntries();
@@ -74807,7 +76046,7 @@ var init_memory3 = __esm({
       async run({ args }) {
         const sourceDir = args.from;
         const isDryRun = !!args["dry-run"];
-        const projectRoot = getProjectRoot63();
+        const projectRoot = getProjectRoot64();
         try {
           const result = await importMemoryFiles({
             sourceDir,
@@ -74958,7 +76197,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot63();
+        const root = getProjectRoot64();
         try {
           await getBrainDb2(root);
           const result = await getTierStats(root);
@@ -75001,7 +76240,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot63();
+        const root = getProjectRoot64();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["medium", "long"];
@@ -75067,7 +76306,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot63();
+        const root = getProjectRoot64();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["short", "medium"];
@@ -75540,7 +76779,7 @@ var migrate_claude_mem_exports = {};
 __export(migrate_claude_mem_exports, {
   migrateClaudeMemCommand: () => migrateClaudeMemCommand
 });
-import { getProjectRoot as getProjectRoot64, migrateClaudeMem } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot65, migrateClaudeMem } from "@cleocode/core/internal";
 import { ingestLooseAgentOutputs, ingestRcasdDirectories } from "@cleocode/core/memory";
 import { getDb as getDb2 } from "@cleocode/core/store/sqlite";
 var storageCommand, claudeMemCommand, manifestIngestCommand, migrateClaudeMemCommand;
@@ -75603,7 +76842,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot64();
+        const root = getProjectRoot65();
         try {
           const result = await migrateClaudeMem(root, {
             sourcePath: args.source,
@@ -75652,7 +76891,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot64();
+        const projectRoot = getProjectRoot65();
         try {
           const db = await getDb2(projectRoot);
           const rcasdFlag = Boolean(args.rcasd);
@@ -75770,7 +77009,7 @@ __export(nexus_exports, {
 import { statSync as statSync2 } from "node:fs";
 import { appendFile as appendFile2, mkdir as mkdir5 } from "node:fs/promises";
 import path4 from "node:path";
-import { getProjectRoot as getProjectRoot65 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot66 } from "@cleocode/core";
 import { getSymbolImpact } from "@cleocode/core/nexus";
 import { runNexusAnalysis } from "@cleocode/core/nexus/analyze-orchestrator.js";
 import {
@@ -75941,7 +77180,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot66();
         const startTime = Date.now();
         if (args.path) {
           let isDir = false;
@@ -76001,7 +77240,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648), so the coun
           process.exitCode = 2 /* INVALID_INPUT */;
           return;
         }
-        const currentRoot = getProjectRoot65();
+        const currentRoot = getProjectRoot66();
         if (args.path && path4.resolve(repoPath) !== path4.resolve(currentRoot)) {
           cliError(
             `nexus status cannot report on '${repoPath}' from this project.
@@ -76179,9 +77418,9 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       args: {},
       async run() {
         try {
-          const { homedir: homedir4 } = await import("node:os");
+          const { homedir: homedir5 } = await import("node:os");
           const { installNexusAugmentHook } = await import("@cleocode/core/internal");
-          const homeDir = homedir4();
+          const homeDir = homedir5();
           installNexusAugmentHook(homeDir);
           cliOutput({ homeDir }, { command: "nexus-setup", operation: "nexus.setup" });
         } catch (err) {
@@ -76555,7 +77794,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot66();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "clusters", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -76599,7 +77838,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot66();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "flows", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -76642,7 +77881,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         void appendDeprecationTelemetry("nexus.context", "cleo graph context");
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot65();
+        const repoPath = getProjectRoot66();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const limit = parseInt(args.limit, 10);
         const symbolName = args.symbol;
@@ -76705,7 +77944,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const startTime = Date.now();
         const whyFlag = !!args.why;
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot65();
+        const repoPath = getProjectRoot66();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const maxDepth = Math.min(parseInt(args.depth, 10), 5);
         const symbolName = args.symbol;
@@ -76809,7 +78048,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const projectIdOverride = args["project-id"];
         const full = !!args.full;
         const ctx = getFormatContext();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot66();
         if (args.incremental)
           humanWarn(
             "[nexus] --incremental is deprecated and has no effect: incremental is the default."
@@ -76939,7 +78178,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot66();
         const name = args.name;
         const response = await dispatchRaw("mutate", "nexus", "projects.register", {
           path: repoPath,
@@ -77458,7 +78697,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot66();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "refresh-bridge", {
           repoPath,
@@ -77564,7 +78803,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot66();
         const projectIdOverride = args["project-id"];
         const beforeRef = args.before ?? "HEAD~1";
         const afterRef = args.after ?? "HEAD";
@@ -77682,7 +78921,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot66();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "route-map", { projectId });
         const durationMs = Date.now() - startTime;
@@ -77738,7 +78977,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const startTime = Date.now();
         const routeSymbol = args.routeSymbol;
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot66();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "shape-check", { routeSymbol, projectId });
         const durationMs = Date.now() - startTime;
@@ -78134,7 +79373,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot66();
         const projectIdOverride = args["project-id"];
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-sync", {
@@ -78244,7 +79483,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot66();
         const projectId = Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-link-tasks", {
           projectId,
@@ -78328,7 +79567,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const isIncremental = !!args.incremental;
         try {
           const result = await runNexusWiki({
-            projectRoot: getProjectRoot65(),
+            projectRoot: getProjectRoot66(),
             outputDir,
             communityFilter,
             incremental: isIncremental
@@ -78678,7 +79917,7 @@ __export(orchestrate_exports, {
 });
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { orchestration } from "@cleocode/core";
-import { BUILD_CONFIG as BUILD_CONFIG2, getProjectRoot as getProjectRoot66 } from "@cleocode/core/internal";
+import { BUILD_CONFIG as BUILD_CONFIG2, getProjectRoot as getProjectRoot67 } from "@cleocode/core/internal";
 function formatRollupTable(rollup) {
   const waves = "waves" in rollup ? rollup.waves : [rollup];
   const lines = [];
@@ -78821,7 +80060,7 @@ var init_orchestrate3 = __esm({
       },
       async run({ args }) {
         const rateWindowHours = args.window !== void 0 ? Number.parseFloat(String(args.window)) : void 0;
-        const metrics = await orchestration.collectOrchestrateDashboard(getProjectRoot66(), {
+        const metrics = await orchestration.collectOrchestrateDashboard(getProjectRoot67(), {
           ...rateWindowHours !== void 0 && Number.isFinite(rateWindowHours) && rateWindowHours > 0 ? { rateWindowHours } : {}
         });
         cliOutput(metrics, {
@@ -80281,7 +81520,7 @@ __export(project_exports, {
 import { resolve as resolve9 } from "node:path";
 import {
   CleoError as CleoError11,
-  getProjectRoot as getProjectRoot67,
+  getProjectRoot as getProjectRoot68,
   moveProject,
   projectLifecycle,
   renameProject,
@@ -80303,7 +81542,7 @@ function emitEngineFailure(error, operation) {
 }
 function resolveRootOrFail(operation) {
   try {
-    return getProjectRoot67();
+    return getProjectRoot68();
   } catch (err) {
     const code = err instanceof CleoError11 && typeof err.details?.["code"] === "string" ? err.details["code"] : "E_NOT_CLEO_PROJECT";
     emitEngineFailure(
@@ -81138,7 +82377,7 @@ var refresh_memory_exports = {};
 __export(refresh_memory_exports, {
   refreshMemoryCommand: () => refreshMemoryCommand
 });
-import { getProjectRoot as getProjectRoot68 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot69 } from "@cleocode/core";
 var refreshMemoryCommand;
 var init_refresh_memory = __esm({
   "packages/cleo/src/cli/commands/refresh-memory.ts"() {
@@ -81151,7 +82390,7 @@ var init_refresh_memory = __esm({
         description: "Regenerate .cleo/memory-bridge.md from brain.db"
       },
       async run() {
-        const projectDir = getProjectRoot68();
+        const projectDir = getProjectRoot69();
         const { writeMemoryBridge } = await import("@cleocode/core/internal");
         const result = await writeMemoryBridge(projectDir);
         if (result.written) {
@@ -82737,7 +83976,7 @@ import fs3 from "node:fs";
 import path5 from "node:path";
 import {
   CleoError as CleoError13,
-  getProjectRoot as getProjectRoot69,
+  getProjectRoot as getProjectRoot70,
   getTaskAccessor as getTaskAccessor3,
   parseConflictReport,
   setAtPath
@@ -82758,7 +83997,7 @@ var init_restore = __esm({
         description: "Apply manually-resolved conflicts from .cleo/restore-conflicts.md"
       },
       async run() {
-        const projectRoot = getProjectRoot69();
+        const projectRoot = getProjectRoot70();
         const reportPath = path5.join(projectRoot, CLEO_DIR_NAME3, RESTORE_CONFLICTS_MD);
         if (!fs3.existsSync(reportPath)) {
           humanLine("No pending restore conflicts. Nothing to finalize.");
@@ -83130,7 +84369,7 @@ __export(revert_exports, {
   revertCommand: () => revertCommand2
 });
 import { readFile as readFile8 } from "node:fs/promises";
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 import { cwd as processCwd2 } from "node:process";
 import { E_RECEIPT_NOT_FOUND } from "@cleocode/core/sentient/chain-walker.js";
 import { SENTIENT_STATE_FILE } from "@cleocode/core/sentient/daemon.js";
@@ -83183,7 +84422,7 @@ async function loadOwnerAttestation(attestationFilePath) {
   return obj;
 }
 async function loadOwnerPubkeys(projectRoot) {
-  const path6 = join29(projectRoot, OWNER_PUBKEYS_FILE);
+  const path6 = join30(projectRoot, OWNER_PUBKEYS_FILE);
   try {
     const raw = await readFile8(path6, "utf-8");
     const parsed = JSON.parse(raw);
@@ -83267,7 +84506,7 @@ var init_revert = __esm({
         if (attestation && allowedPubkeys.size > 0 && !allowedPubkeys.has(attestation.ownerPubkey)) {
           emitFailure2(
             E_OWNER_ATTESTATION_REQUIRED,
-            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join29(projectRoot, OWNER_PUBKEYS_FILE)}`,
+            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join30(projectRoot, OWNER_PUBKEYS_FILE)}`,
             jsonMode
           );
         }
@@ -83320,7 +84559,7 @@ ${lines}`
             identity,
             includeHuman
           });
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE);
           const state = await readSentientState(statePath);
           emitSuccess(
             {
@@ -83391,6 +84630,185 @@ var init_roadmap = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/run.ts
+var run_exports = {};
+__export(run_exports, {
+  runCommand: () => runCommand6,
+  runExitCode: () => runExitCode
+});
+import { constants } from "node:os";
+import {
+  canonicalForClass,
+  isWatchCommand,
+  resolveRunClass
+} from "@cleocode/core/resources/run-admission.js";
+import { runGoverned } from "@cleocode/core/resources/run-governed.js";
+import { heavyToolEnv } from "@cleocode/core/tasks/heavy-tool-env.js";
+function commandAfterDashes(rawArgs) {
+  const idx = rawArgs.indexOf("--");
+  return idx === -1 ? [] : rawArgs.slice(idx + 1);
+}
+function invalid(message, fix, stderr2) {
+  cliError(
+    message,
+    "E_VALIDATION",
+    { name: "E_VALIDATION", fix },
+    { operation: "resources.run" },
+    { stderr: stderr2 }
+  );
+  process.exit(6);
+}
+function runExitCode(r) {
+  if (r.spawnError !== null) return 127;
+  if (r.signal !== null) return 128 + (constants.signals[r.signal] ?? 0);
+  return r.exitCode ?? 1;
+}
+function exitFailed(result, code, passthrough) {
+  const { kind: _kind, ...data } = result;
+  const message = result.spawnError !== null ? `could not start command: ${result.spawnError}` : `command ${result.signal !== null ? `killed by ${result.signal}` : `exited with ${result.exitCode}`}`;
+  if (passthrough && result.spawnError === null) {
+    process.stderr.write(`[cleo run] ${RUN_COMMAND_FAILED_CODE}: ${message}
+`);
+  } else {
+    cliError(
+      message,
+      RUN_COMMAND_FAILED_CODE,
+      { name: RUN_COMMAND_FAILED_CODE, details: data },
+      { operation: "resources.run" },
+      { stderr: passthrough }
+    );
+  }
+  process.exit(code);
+}
+var runCommand6;
+var init_run = __esm({
+  "packages/cleo/src/cli/commands/run.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_renderers();
+    runCommand6 = defineCommand({
+      meta: {
+        name: "run",
+        description: "Run a heavy command (tests, builds, installs) under the machine-wide resource budget: cleo run [--class test|build|full-build] [--wait] [--passthrough] -- <command...>"
+      },
+      args: {
+        class: {
+          type: "string",
+          description: "Resource class: test, build, typecheck, install, scan, full-build, db (default: inferred from the command)"
+        },
+        wait: {
+          type: "boolean",
+          description: "Join the FIFO queue for the class instead of returning E_RESOURCE_DEFERRED",
+          default: false
+        },
+        timeout: {
+          type: "string",
+          description: "With --wait: give up after this many seconds (default 1800)"
+        },
+        passthrough: {
+          type: "boolean",
+          description: "Give the command this process's stdin, stdout and stderr and exit with its code. cleo run then writes nothing to stdout (an explicit ADR-086 exception, like docs fetch --content): its own envelopes go to stderr, and it prints only a deferral (exit 75), an ungoverned run, a pause or a failure",
+          default: false
+        }
+      },
+      async run({ args, rawArgs }) {
+        const passthrough = args.passthrough === true;
+        const argv = commandAfterDashes(rawArgs ?? []);
+        if (argv.length === 0) {
+          invalid(
+            "cleo run needs a command after --",
+            "cleo run --class test -- npx vitest run path/to/file.test.ts",
+            passthrough
+          );
+        }
+        if (args.class === void 0 && isWatchCommand(argv)) {
+          invalid(
+            `cleo run refuses watch/dev/serve commands, which never exit and would hold a resource slot forever: ${argv.join(" ")}`,
+            "Run the watcher directly, without cleo run. If it is a bounded job, say so with --class (cleo run --class test -- <cmd>)",
+            passthrough
+          );
+        }
+        let timeoutMs = 18e5;
+        if (args.timeout !== void 0) {
+          if (!args.wait)
+            invalid("--timeout requires --wait", "cleo run --wait --timeout 600 -- <cmd>", passthrough);
+          const seconds = Number(args.timeout);
+          if (!Number.isFinite(seconds) || seconds <= 0) {
+            invalid(
+              `--timeout must be a positive number of seconds (got '${args.timeout}')`,
+              "--timeout 600",
+              passthrough
+            );
+          }
+          timeoutMs = seconds * 1e3;
+        }
+        let cls;
+        try {
+          cls = resolveRunClass(args.class, argv, process.cwd());
+        } catch (err) {
+          invalid(
+            err instanceof Error ? err.message : String(err),
+            "cleo run --class test -- <cmd>",
+            passthrough
+          );
+        }
+        let result;
+        try {
+          result = await runGoverned({
+            argv,
+            cls,
+            cwd: process.cwd(),
+            env: { ...process.env, ...heavyToolEnv(canonicalForClass(cls)) },
+            sessionId: process.env.CLEO_SESSION_ID ?? process.env.CLAUDE_CODE_SESSION_ID ?? null,
+            wait: Boolean(args.wait),
+            timeoutMs,
+            passthrough,
+            // A terminal on stdin: keep the child in its foreground group.
+            foreground: passthrough && process.stdin.isTTY === true,
+            // Notices go to stderr; stdout carries only the final LAFS envelope, or
+            // with --passthrough only the child's output (and then only warnings).
+            notice: (line, level) => {
+              if (passthrough && level === "info") return;
+              process.stderr.write(`[cleo run] ${line}
+`);
+            }
+          });
+        } catch (err) {
+          cliError(
+            `cleo run failed: ${err instanceof Error ? err.message : String(err)}`,
+            1,
+            { name: "E_GENERAL" },
+            { operation: "resources.run" },
+            { stderr: passthrough }
+          );
+          process.exit(1);
+        }
+        if (result.kind === "deferred") {
+          cliError(
+            `not started: ${result.reason}`,
+            RESOURCE_DEFERRED_CODE,
+            {
+              name: RESOURCE_DEFERRED_CODE,
+              details: result.details,
+              fix: result.fix,
+              alternatives: result.alternatives
+            },
+            { operation: "resources.run" },
+            { stderr: passthrough }
+          );
+          process.exit(RUN_DEFERRED_EXIT_CODE);
+        }
+        const code = runExitCode(result);
+        if (code !== 0) exitFailed(result, code, passthrough);
+        if (passthrough) return;
+        const { kind: _kind, ...data } = result;
+        cliOutput(data, { command: "run", operation: "resources.run" });
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/safestop.ts
 var safestop_exports = {};
 __export(safestop_exports, {
@@ -83687,8 +85105,8 @@ var init_saga = __esm({
         }
       },
       async run({ args }) {
-        const { sagas: sagas2, getProjectRoot: getProjectRoot75 } = await import("@cleocode/core");
-        const projectRoot = getProjectRoot75();
+        const { sagas: sagas2, getProjectRoot: getProjectRoot76 } = await import("@cleocode/core");
+        const projectRoot = getProjectRoot76();
         const sagaId = typeof args.sagaId === "string" && args.sagaId.length > 0 ? args.sagaId : void 0;
         const result = await sagas2.sagaNext(projectRoot, { sagaId });
         cliOutput(result.success ? result.data : result, { command: "saga", operation: "saga.next" });
@@ -83902,7 +85320,7 @@ __export(self_update_exports, {
 });
 import { execFile } from "node:child_process";
 import { readFile as readFile9 } from "node:fs/promises";
-import { join as join30 } from "node:path";
+import { join as join31 } from "node:path";
 import * as readline3 from "node:readline";
 import { promisify } from "node:util";
 import {
@@ -83917,7 +85335,7 @@ import {
 async function getCurrentVersion() {
   const cleoHome = getCleoHome7();
   try {
-    const content = await readFile9(join30(cleoHome, "VERSION"), "utf-8");
+    const content = await readFile9(join31(cleoHome, "VERSION"), "utf-8");
     return (content.split("\n")[0] ?? "unknown").trim();
   } catch {
     return "unknown";
@@ -83971,7 +85389,7 @@ async function writeRuntimeVersionMetadata(mode, source, version) {
   ];
   await import("node:fs/promises").then(
     ({ writeFile: writeFile4, mkdir: mkdir7 }) => mkdir7(cleoHome, { recursive: true }).then(
-      () => writeFile4(join30(cleoHome, "VERSION"), `${lines.join("\n")}
+      () => writeFile4(join31(cleoHome, "VERSION"), `${lines.join("\n")}
 `, "utf-8")
     )
   );
@@ -84383,13 +85801,13 @@ var selfimprove_exports = {};
 __export(selfimprove_exports, {
   selfimproveCommand: () => selfimproveCommand
 });
-var runCommand6, selfimproveCommand;
+var runCommand7, selfimproveCommand;
 var init_selfimprove2 = __esm({
   "packages/cleo/src/cli/commands/selfimprove.ts"() {
     "use strict";
     init_cli();
     init_define_cli_command();
-    runCommand6 = defineCommand({
+    runCommand7 = defineCommand({
       meta: {
         name: "run",
         description: "Run ONE self-improvement loop iteration: boot a sandbox, replay a canned scenario, diff vs golden; on regression emit ONE leased DHQ row + ONE DRAFT PR. DEFAULT OFF \u2014 pass --execute to act (else DRY-RUN: replay + diff + report only)."
@@ -84434,7 +85852,7 @@ var init_selfimprove2 = __esm({
         description: "Self-improvement loop \u2014 replay a canned dogfood scenario, diff vs golden, and surface regressions as leased DHQ rows + DRAFT PRs. Default OFF (requires --execute to act)."
       },
       subCommands: {
-        run: runCommand6
+        run: runCommand7
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -84452,7 +85870,7 @@ __export(sentient_exports, {
   promptAcceptExecution: () => promptAcceptExecution,
   sentientCommand: () => sentientCommand
 });
-import { join as join31 } from "node:path";
+import { join as join32 } from "node:path";
 import { cwd as processCwd3, stdin, stdout } from "node:process";
 import { createInterface as createInterface4 } from "node:readline/promises";
 import {
@@ -84542,7 +85960,7 @@ var init_sentient3 = __esm({
             return;
           }
           if (dryRun) {
-            const statePath2 = join31(projectRoot, SENTIENT_STATE_FILE2);
+            const statePath2 = join32(projectRoot, SENTIENT_STATE_FILE2);
             const outcome = await safeRunTick({ projectRoot, statePath: statePath2, dryRun: true });
             emitSuccess2(
               { dryRun: true, outcome },
@@ -84658,7 +86076,7 @@ Logs:  ${logPath}`
         const jsonMode = args.json === true;
         const dryRun = args["dry-run"] === true;
         try {
-          const statePath = join31(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join32(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunTick({ projectRoot, statePath, dryRun });
           emitSuccess2(
             { outcome, dryRun },
@@ -84750,7 +86168,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "pending", updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join31(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join32(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -84846,7 +86264,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "cancelled", cancellationReason: reason, cancelledAt: now, updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join31(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join32(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -84891,7 +86309,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot5(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join31(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join32(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunProposeTick({ projectRoot, statePath });
           emitSuccess2(
             { outcome },
@@ -84911,7 +86329,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot5(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join31(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join32(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: true });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals enabled");
         } catch (err) {
@@ -84930,7 +86348,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot5(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join31(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join32(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: false });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals disabled");
         } catch (err) {
@@ -84961,7 +86379,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot5(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join31(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join32(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           emitSuccess2(
             {
@@ -85519,7 +86937,7 @@ var sequence_exports = {};
 __export(sequence_exports, {
   sequenceCommand: () => sequenceCommand
 });
-import { getProjectRoot as getProjectRoot70 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot71 } from "@cleocode/core/internal";
 var showCommand12, checkCommand7, repairCommand3, sequenceCommand;
 var init_sequence = __esm({
   "packages/cleo/src/cli/commands/sequence.ts"() {
@@ -85555,7 +86973,7 @@ var init_sequence = __esm({
       meta: { name: "repair", description: "Reset counter to max + 1 if behind" },
       async run() {
         const { repairSequence } = await import("@cleocode/core/internal");
-        const projectRoot = getProjectRoot70();
+        const projectRoot = getProjectRoot71();
         const repair = await repairSequence(projectRoot);
         const result = {
           repaired: repair.repaired,
@@ -86152,8 +87570,8 @@ var init_session4 = __esm({
         "audit-scope": { type: "string", description: "Audit log scope (global|local)" }
       },
       async run({ args }) {
-        const { detectSessionDrift, getProjectRoot: getProjectRoot75 } = await import("@cleocode/core");
-        const projectRoot = await getProjectRoot75();
+        const { detectSessionDrift, getProjectRoot: getProjectRoot76 } = await import("@cleocode/core");
+        const projectRoot = await getProjectRoot76();
         const scope = args["audit-scope"] === "local" ? "local" : "global";
         const report = await detectSessionDrift({ projectRoot, auditScope: scope });
         cliOutput(report, { command: "session drift", operation: "session.drift" });
@@ -88552,10 +89970,10 @@ var init_sync = __esm({
         }
       },
       async run({ args }) {
-        const { readFileSync: readFileSync22 } = await import("node:fs");
+        const { readFileSync: readFileSync23 } = await import("node:fs");
         let externalTasks;
         try {
-          externalTasks = JSON.parse(readFileSync22(args.file, "utf8"));
+          externalTasks = JSON.parse(readFileSync23(args.file, "utf8"));
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           cliError(`Failed to read or parse external tasks file: ${message}`, 2, {
@@ -88852,19 +90270,19 @@ var init_telemetry2 = __esm({
 });
 
 // packages/cleo/src/cli/commands/templates/lib.ts
-import { readFileSync as readFileSync13 } from "node:fs";
+import { readFileSync as readFileSync14 } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve as resolve10 } from "node:path";
-import { getProjectRoot as getProjectRoot71 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot72 } from "@cleocode/core";
 import { resolveSourcePathAbsolute } from "@cleocode/core/templates/registry";
 function resolveProjectRoot6(raw) {
   if (typeof raw === "string" && raw.length > 0) {
     return isAbsolute3(raw) ? raw : resolve10(process.cwd(), raw);
   }
-  return getProjectRoot71();
+  return getProjectRoot72();
 }
 function readTemplateSource(entry) {
   const sourceAbsolute = resolveSourcePathAbsolute(entry);
-  return readFileSync13(sourceAbsolute, "utf8");
+  return readFileSync14(sourceAbsolute, "utf8");
 }
 function applySubstitution(entry, source) {
   if (entry.substitution === "static") {
@@ -88879,8 +90297,8 @@ var init_lib = __esm({
 });
 
 // packages/cleo/src/cli/commands/templates/diff.ts
-import { existsSync as existsSync17, readFileSync as readFileSync14 } from "node:fs";
-import { join as join32 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "node:fs";
+import { join as join33 } from "node:path";
 import { getTemplateById } from "@cleocode/core/templates/registry";
 function unifiedDiff(a, b) {
   const aLines = a.length === 0 ? [] : a.split("\n");
@@ -88950,7 +90368,7 @@ var init_diff = __esm({
         let rendered;
         try {
           projectRoot = resolveProjectRoot6(args["project"]);
-          installPath = join32(projectRoot, entry.installPath);
+          installPath = join33(projectRoot, entry.installPath);
           const source = readTemplateSource(entry);
           rendered = applySubstitution(entry, source).rendered;
         } catch (err) {
@@ -88978,7 +90396,7 @@ ${unifiedDiff("", rendered)}`
           process.exit(1 /* GENERAL_ERROR */);
           return;
         }
-        const current = readFileSync14(installPath, "utf8");
+        const current = readFileSync15(installPath, "utf8");
         const same = current === rendered;
         const result = {
           id,
@@ -89000,8 +90418,8 @@ ${unifiedDiff("", rendered)}`
 });
 
 // packages/cleo/src/cli/commands/templates/install.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync15, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname10, join as join33 } from "node:path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync16, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname10, join as join34 } from "node:path";
 import { getTemplateById as getTemplateById2 } from "@cleocode/core/templates/registry";
 var templatesInstallCommand;
 var init_install = __esm({
@@ -89055,7 +90473,7 @@ var init_install = __esm({
         let substituted;
         try {
           projectRoot = resolveProjectRoot6(args["project"]);
-          installPath = join33(projectRoot, entry.installPath);
+          installPath = join34(projectRoot, entry.installPath);
           const source = readTemplateSource(entry);
           const sub = applySubstitution(entry, source);
           rendered = sub.rendered;
@@ -89069,7 +90487,7 @@ var init_install = __esm({
           return;
         }
         if (existsSync18(installPath)) {
-          const current = readFileSync15(installPath, "utf8");
+          const current = readFileSync16(installPath, "utf8");
           if (current === rendered) {
             const noopResult = {
               id,
@@ -89217,8 +90635,8 @@ var init_show3 = __esm({
 });
 
 // packages/cleo/src/cli/commands/templates/upgrade.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync6, readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname11, join as join34 } from "node:path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync6, readFileSync as readFileSync17, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname11, join as join35 } from "node:path";
 import { getTemplateById as getTemplateById4 } from "@cleocode/core/templates/registry";
 var templatesUpgradeCommand;
 var init_upgrade2 = __esm({
@@ -89280,7 +90698,7 @@ var init_upgrade2 = __esm({
         let rendered;
         try {
           projectRoot = resolveProjectRoot6(args["project"]);
-          installPath = join34(projectRoot, entry.installPath);
+          installPath = join35(projectRoot, entry.installPath);
           const source = readTemplateSource(entry);
           rendered = applySubstitution(entry, source).rendered;
         } catch (err) {
@@ -89293,7 +90711,7 @@ var init_upgrade2 = __esm({
         }
         const previewOnly = args["diff"] === true;
         const accept = args["accept"] === true;
-        const current = existsSync19(installPath) ? readFileSync16(installPath, "utf8") : null;
+        const current = existsSync19(installPath) ? readFileSync17(installPath, "utf8") : null;
         const diffBody = current === null ? "" : current === rendered ? "" : unifiedDiff(current, rendered);
         let outcome;
         let reason;
@@ -89517,7 +90935,7 @@ var testing_exports = {};
 __export(testing_exports, {
   testingCommand: () => testingCommand
 });
-var validateCommand9, checkCommand8, statusCommand18, coverageCommand, runCommand7, testingCommand;
+var validateCommand9, checkCommand8, statusCommand18, coverageCommand, runCommand8, testingCommand;
 var init_testing = __esm({
   "packages/cleo/src/cli/commands/testing.ts"() {
     "use strict";
@@ -89602,7 +91020,7 @@ var init_testing = __esm({
         );
       }
     });
-    runCommand7 = defineCommand({
+    runCommand8 = defineCommand({
       meta: { name: "run", description: "Run test suite" },
       args: {
         filter: {
@@ -89627,7 +91045,7 @@ var init_testing = __esm({
         check: checkCommand8,
         status: statusCommand18,
         coverage: coverageCommand,
-        run: runCommand7
+        run: runCommand8
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -89643,12 +91061,12 @@ var token_exports = {};
 __export(token_exports, {
   tokenCommand: () => tokenCommand
 });
-import { readFileSync as readFileSync17 } from "node:fs";
-import { getProjectRoot as getProjectRoot72, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
+import { readFileSync as readFileSync18 } from "node:fs";
+import { getProjectRoot as getProjectRoot73, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
 function readPayload(args, textKey, fileKey) {
   const text = args[textKey];
   const file = args[fileKey];
-  if (file) return readFileSync17(file, "utf-8");
+  if (file) return readFileSync18(file, "utf-8");
   return text;
 }
 var filterArgs, summaryCommand3, listCommand26, showCommand16, deleteCommand3, clearCommand2, estimateCommand, tokenCommand;
@@ -89808,7 +91226,7 @@ var init_token = __esm({
           domain: args.domain,
           operation: args.operation
         };
-        const result = args.record ? await recordTokenExchange2(getProjectRoot72(), input2) : await measureTokenExchange(input2);
+        const result = args.record ? await recordTokenExchange2(getProjectRoot73(), input2) : await measureTokenExchange(input2);
         cliOutput(result, {
           command: "token",
           operation: args.record ? "admin.token.record" : "token.estimate"
@@ -89842,9 +91260,9 @@ var transcript_exports = {};
 __export(transcript_exports, {
   transcriptCommand: () => transcriptCommand
 });
-import { homedir as homedir3 } from "node:os";
-import { join as join35 } from "node:path";
-import { getProjectRoot as getProjectRoot73 } from "@cleocode/core";
+import { homedir as homedir4 } from "node:os";
+import { join as join36 } from "node:path";
+import { getProjectRoot as getProjectRoot74 } from "@cleocode/core";
 import {
   parseDurationMs,
   pruneTranscripts,
@@ -89874,7 +91292,7 @@ var init_transcript = __esm({
       async run({ args }) {
         if (args.pending) {
           try {
-            const projectRoot = getProjectRoot73();
+            const projectRoot = getProjectRoot74();
             const { scanPendingTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
             const pending = await scanPendingTranscripts(projectRoot);
             cliOutput(
@@ -89897,7 +91315,7 @@ var init_transcript = __esm({
           }
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join35(homedir3(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join36(homedir4(), ".claude", "projects");
         try {
           const result = await scanTranscripts(projectsDir);
           cliOutput(
@@ -89971,7 +91389,7 @@ var init_transcript = __esm({
       async run({ args }) {
         const tier = args.tier ?? "warm";
         const dryRun = args["dry-run"] ?? false;
-        const projectRoot = getProjectRoot73();
+        const projectRoot = getProjectRoot74();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { findSessionTranscriptPath, listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -90087,7 +91505,7 @@ var init_transcript = __esm({
         const dryRun = args["dry-run"] ?? false;
         const olderThanHours = args["older-than-hours"] ? Number.parseInt(args["older-than-hours"], 10) : 24;
         const limit = args.limit ? Number.parseInt(args.limit, 10) : void 0;
-        const projectRoot = getProjectRoot73();
+        const projectRoot = getProjectRoot74();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -90207,7 +91625,7 @@ var init_transcript = __esm({
           process.exit(2);
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join35(homedir3(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join36(homedir4(), ".claude", "projects");
         try {
           const pruneResult = await pruneTranscripts({
             olderThanMs,
@@ -90274,10 +91692,10 @@ __export(gateway_auto_start_exports, {
   spawnGatewayIfDown: () => spawnGatewayIfDown
 });
 import { once } from "node:events";
-import { createWriteStream, existsSync as existsSync20, readFileSync as readFileSync18, realpathSync } from "node:fs";
+import { createWriteStream, existsSync as existsSync20, readFileSync as readFileSync19, realpathSync } from "node:fs";
 import { mkdir as mkdir6 } from "node:fs/promises";
 import * as net from "node:net";
-import { dirname as dirname12, join as join36 } from "node:path";
+import { dirname as dirname12, join as join37 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { spawnWrapped } from "@cleocode/core/resources/spawn-wrapper.js";
 function shouldAutoStartGateway(config) {
@@ -90321,17 +91739,17 @@ function resolveCliEntryPath(startUrl = import.meta.url) {
   const startFile = realpathSync(fileURLToPath6(startUrl));
   let current = dirname12(startFile);
   for (let i = 0; i < 20; i++) {
-    const pkgJsonPath = join36(current, "package.json");
+    const pkgJsonPath = join37(current, "package.json");
     if (existsSync20(pkgJsonPath)) {
       let pkgName;
       try {
-        const raw = readFileSync18(pkgJsonPath, "utf8");
+        const raw = readFileSync19(pkgJsonPath, "utf8");
         const parsed = JSON.parse(raw);
         pkgName = typeof parsed["name"] === "string" ? parsed["name"] : void 0;
       } catch {
       }
       if (pkgName === CLEO_PACKAGE_NAME) {
-        const entry = join36(current, "dist", "cli", "index.js");
+        const entry = join37(current, "dist", "cli", "index.js");
         if (!existsSync20(entry)) {
           throw new Error(
             `@cleocode/cleo package root found at ${current} but dist/cli/index.js is missing \u2014 run \`pnpm --filter @cleocode/cleo run build\` to generate it`
@@ -90368,8 +91786,8 @@ async function spawnGatewayIfDown(opts = {}) {
     const { getCleoLogDir } = await import("@cleocode/core");
     const logDir = getCleoLogDir();
     await mkdir6(logDir, { recursive: true });
-    const outStream = createWriteStream(join36(logDir, "gateway.log"), { flags: "a" });
-    const errStream = createWriteStream(join36(logDir, "gateway.err"), { flags: "a" });
+    const outStream = createWriteStream(join37(logDir, "gateway.log"), { flags: "a" });
+    const errStream = createWriteStream(join37(logDir, "gateway.err"), { flags: "a" });
     await Promise.all([once(outStream, "open"), once(errStream, "open")]);
     outFd = outStream;
     errFd = errStream;
@@ -90828,8 +92246,8 @@ __export(cockpit_exports, {
   KanbanBoardComponent: () => KanbanBoardComponent,
   runCockpit: () => runCockpit
 });
-import { readFileSync as readFileSync19 } from "node:fs";
-import { join as join37 } from "node:path";
+import { readFileSync as readFileSync20 } from "node:fs";
+import { join as join38 } from "node:path";
 import { createCleoClient as createCleoClient2 } from "@cleocode/core/gateway-client";
 async function fetchTaskRows(baseUrl) {
   const client = createCleoClient2({ baseUrl });
@@ -90946,8 +92364,8 @@ async function runCockpit(options = {}, sink = (line) => process.stdout.write(`$
     }
     try {
       const { getCleoLogDir } = await import("@cleocode/core");
-      const errPath = join37(getCleoLogDir(), "gateway.err");
-      const errContent = readFileSync19(errPath, "utf8").trimEnd();
+      const errPath = join38(getCleoLogDir(), "gateway.err");
+      const errContent = readFileSync20(errPath, "utf8").trimEnd();
       if (errContent.length > 0) {
         const lastLine = errContent.split("\n").at(-1) ?? "";
         if (lastLine.length > 0) {
@@ -91975,7 +93393,7 @@ var init_verify = __esm({
         },
         evidence: {
           type: "string",
-          description: "Evidence for the gate (T832/ADR-051). Semicolon-separated atoms: 'commit:<sha>', 'files:<p1,p2>', 'test-run:<json>', 'tool:<name>', 'url:<url>', 'note:<text>', 'ci:<pr>' (required CI green on the merged PR's merge commit; testsPassed/qaPassed, opt-in via evidence.ciSatisfies)."
+          description: "Evidence for the gate (T832/ADR-051). Semicolon-separated atoms: 'commit:<sha>', 'files:<p1,p2>', 'test-run:<json>', 'tool:<name>' (e.g. tool:test, tool:test-affected, tool:lint), 'url:<url>', 'note:<text>', 'ci:<pr>' (required CI green on the merged PR's merge commit; testsPassed/qaPassed, opt-in via evidence.ciSatisfies)."
         },
         explain: {
           type: "boolean",
@@ -91997,6 +93415,10 @@ var init_verify = __esm({
           type: "string",
           description: "With --auto: the merged PR that implements the task"
         },
+        fresh: {
+          type: "boolean",
+          description: "Bypass the ADR-061 tool cache and re-run every tool: atom (same as CLEO_EVIDENCE_FRESH=1, which still works). Use only when a cached result is suspect, e.g. after adding an untracked file (T12964)."
+        },
         "shared-evidence": {
           type: "boolean",
           description: "Acknowledge that the same evidence atom is applied to >3 distinct tasks in this session (T1502 / ADR-059). Without this flag, such reuse triggers a warning; in strict mode (CLEO_STRICT_EVIDENCE=1) it is a hard reject."
@@ -92008,76 +93430,85 @@ var init_verify = __esm({
           return;
         }
         const isWrite = !!(args.gate || args.all || args.reset);
-        if (args.auto === true) {
-          if (isWrite || args.evidence || args.run === true) {
-            cliError(
-              "--auto derives its own evidence; drop --gate/--all/--reset/--evidence/--run",
-              "E_INVALID_INPUT"
-            );
-            process.exitCode = 6 /* VALIDATION_ERROR */;
+        const priorFresh = process.env["CLEO_EVIDENCE_FRESH"];
+        if (args.fresh === true) process.env["CLEO_EVIDENCE_FRESH"] = "1";
+        try {
+          if (args.auto === true) {
+            if (isWrite || args.evidence || args.run === true) {
+              cliError(
+                "--auto derives its own evidence; drop --gate/--all/--reset/--evidence/--run",
+                "E_INVALID_INPUT"
+              );
+              process.exitCode = 6 /* VALIDATION_ERROR */;
+              return;
+            }
+            const { parseDoneOptions } = await import("@cleocode/core/tasks/done-plan.js");
+            const parsed = parseDoneOptions(args.satisfies, args.pr);
+            if (!parsed.ok) {
+              cliError(parsed.message, "E_INVALID_INPUT");
+              process.exitCode = 6 /* VALIDATION_ERROR */;
+              return;
+            }
+            const { recordTaskDone } = await import("@cleocode/core/tasks/done-record.js");
+            const { getProjectRoot: getProjectRoot76 } = await import("@cleocode/core/paths.js");
+            const r = await recordTaskDone(args.taskId, {
+              projectRoot: getProjectRoot76(),
+              ...parsed.options,
+              ...args.agent ? { agent: args.agent } : {}
+            });
+            if (!r.success) {
+              cliError(r.error.message, r.error.code, { fix: r.error.fix, details: r.error.details });
+              process.exitCode = r.error.exitCode ?? 1;
+              return;
+            }
+            const { plan: _plan, ...summary } = r.data;
+            cliOutput(summary, { command: "verify", operation: "check.gate.auto" });
             return;
           }
-          const { parseDoneOptions } = await import("@cleocode/core/tasks/done-plan.js");
-          const parsed = parseDoneOptions(args.satisfies, args.pr);
-          if (!parsed.ok) {
-            cliError(parsed.message, "E_INVALID_INPUT");
+          if (args.satisfies !== void 0 || args.pr !== void 0) {
+            cliError("--satisfies and --pr apply only with --auto (or cleo done)", "E_INVALID_INPUT");
             process.exitCode = 6 /* VALIDATION_ERROR */;
             return;
           }
-          const { recordTaskDone } = await import("@cleocode/core/tasks/done-record.js");
-          const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core/paths.js");
-          const r = await recordTaskDone(args.taskId, {
-            projectRoot: getProjectRoot75(),
-            ...parsed.options,
-            ...args.agent ? { agent: args.agent } : {}
-          });
-          if (!r.success) {
-            cliError(r.error.message, r.error.code, { fix: r.error.fix, details: r.error.details });
-            process.exitCode = r.error.exitCode ?? 1;
+          if (args.run === true && isWrite) {
+            cliError(
+              "--run reports typed gate results and records nothing; it cannot be combined with --gate/--all/--reset.",
+              6 /* VALIDATION_ERROR */,
+              {
+                name: "E_VALIDATION",
+                fix: "Run `cleo verify <id> --run` first, then attest with `cleo verify <id> --gate <name> --evidence <atoms>`"
+              },
+              { operation: "check.gate.run" }
+            );
+            process.exitCode = 6 /* VALIDATION_ERROR */;
             return;
           }
-          const { plan: _plan, ...summary } = r.data;
-          cliOutput(summary, { command: "verify", operation: "check.gate.auto" });
-          return;
-        }
-        if (args.satisfies !== void 0 || args.pr !== void 0) {
-          cliError("--satisfies and --pr apply only with --auto (or cleo done)", "E_INVALID_INPUT");
-          process.exitCode = 6 /* VALIDATION_ERROR */;
-          return;
-        }
-        if (args.run === true && isWrite) {
-          cliError(
-            "--run reports typed gate results and records nothing; it cannot be combined with --gate/--all/--reset.",
-            6 /* VALIDATION_ERROR */,
+          const useExplain = !isWrite && args.explain === true;
+          const operation = isWrite ? "gate.set" : args.run === true ? "gate.run" : useExplain ? "verify.explain" : "gate.status";
+          await dispatchFromCli(
+            isWrite ? "mutate" : "query",
+            "check",
+            operation,
             {
-              name: "E_VALIDATION",
-              fix: "Run `cleo verify <id> --run` first, then attest with `cleo verify <id> --gate <name> --evidence <atoms>`"
+              taskId: args.taskId,
+              gate: args.gate,
+              value: args.value === "false" ? false : args.gate ? true : void 0,
+              agent: args.agent,
+              all: args.all,
+              reset: args.reset,
+              evidence: args.evidence,
+              sharedEvidence: args["shared-evidence"] ?? false,
+              // T12621: citty turns `--no-run` into `run: false`; read it through the helper.
+              ...isWrite && negatedFlag(args, "run") ? { noRun: true } : {}
             },
-            { operation: "check.gate.run" }
+            { command: "verify" }
           );
-          process.exitCode = 6 /* VALIDATION_ERROR */;
-          return;
+        } finally {
+          if (args.fresh === true) {
+            if (priorFresh === void 0) delete process.env["CLEO_EVIDENCE_FRESH"];
+            else process.env["CLEO_EVIDENCE_FRESH"] = priorFresh;
+          }
         }
-        const useExplain = !isWrite && args.explain === true;
-        const operation = isWrite ? "gate.set" : args.run === true ? "gate.run" : useExplain ? "verify.explain" : "gate.status";
-        await dispatchFromCli(
-          isWrite ? "mutate" : "query",
-          "check",
-          operation,
-          {
-            taskId: args.taskId,
-            gate: args.gate,
-            value: args.value === "false" ? false : args.gate ? true : void 0,
-            agent: args.agent,
-            all: args.all,
-            reset: args.reset,
-            evidence: args.evidence,
-            sharedEvidence: args["shared-evidence"] ?? false,
-            // T12621: citty turns `--no-run` into `run: false`; read it through the helper.
-            ...isWrite && negatedFlag(args, "run") ? { noRun: true } : {}
-          },
-          { command: "verify" }
-        );
       }
     });
   }
@@ -92338,7 +93769,7 @@ var workgraph_exports = {};
 __export(workgraph_exports, {
   workgraphCommand: () => workgraphCommand
 });
-import { readFileSync as readFileSync20 } from "node:fs";
+import { readFileSync as readFileSync21 } from "node:fs";
 import { resolve as resolve12 } from "node:path";
 var validateCommand10, applyCommand, planCommand4, structureCommand, statusCommand20, workgraphCommand;
 var init_workgraph2 = __esm({
@@ -92363,7 +93794,7 @@ var init_workgraph2 = __esm({
         const filePath = resolve12(String(args.file));
         let raw;
         try {
-          raw = readFileSync20(filePath, "utf-8");
+          raw = readFileSync21(filePath, "utf-8");
         } catch {
           cliOutput2(
             { error: `Cannot read file: ${filePath}` },
@@ -92408,7 +93839,7 @@ var init_workgraph2 = __esm({
         const filePath = resolve12(String(args.file));
         let raw;
         try {
-          raw = readFileSync20(filePath, "utf-8");
+          raw = readFileSync21(filePath, "utf-8");
         } catch {
           cliOutput2(
             { error: `Cannot read file: ${filePath}` },
@@ -92450,9 +93881,9 @@ var init_workgraph2 = __esm({
       },
       async run({ args }) {
         const { generatePlanningDoc } = await import("@cleocode/core/workgraph");
-        const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot76 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot75();
+        const projectRoot = getProjectRoot76();
         const audience = String(args.audience) === "agent" ? "agent" : "maintainer";
         const result = await generatePlanningDoc(projectRoot, {
           sagaId: String(args.sagaId),
@@ -92469,9 +93900,9 @@ var init_workgraph2 = __esm({
       async run() {
         const { validateWorkGraphStructure } = await import("@cleocode/core/workgraph");
         const { taskList: taskList2 } = await import("@cleocode/core/internal");
-        const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot76 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot75();
+        const projectRoot = getProjectRoot76();
         const listResult = await taskList2(projectRoot, { limit: 5e3 });
         const tasks = listResult.success ? listResult.data?.tasks ?? [] : [];
         const nodes = tasks.map((t) => ({
@@ -92490,9 +93921,9 @@ var init_workgraph2 = __esm({
         description: "One-shot saga-to-saga workgraph dashboard (tracking checklist)"
       },
       async run() {
-        const { sagas: sagas2, getProjectRoot: getProjectRoot75 } = await import("@cleocode/core");
+        const { sagas: sagas2, getProjectRoot: getProjectRoot76 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot75();
+        const projectRoot = getProjectRoot76();
         const listResult = await sagas2.sagaList(projectRoot);
         if (!listResult.success) {
           cliOutput2(listResult, { command: "workgraph", operation: "workgraph.status" });
@@ -92558,7 +93989,7 @@ __export(worktree_exports, {
   worktreeCommand: () => worktreeCommand
 });
 import readline4 from "node:readline";
-import { getProjectRoot as getProjectRoot74, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot75, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
 async function promptYesNo2(question) {
   return new Promise((resolve13) => {
     const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
@@ -92663,7 +94094,7 @@ var init_worktree3 = __esm({
         const staleDays = staleDaysRaw !== void 0 ? Number.parseInt(staleDaysRaw, 10) : void 0;
         const idleDaysRaw = typeof args["idle-days"] === "string" ? args["idle-days"] : void 0;
         const idleDays = idleDaysRaw !== void 0 ? Number.parseInt(idleDaysRaw, 10) : void 0;
-        const projectRoot = getProjectRoot74();
+        const projectRoot = getProjectRoot75();
         const listResult = await listWorktrees2({
           projectRoot,
           ...staleDays !== void 0 && !Number.isNaN(staleDays) ? { staleDays } : {}
@@ -92902,8 +94333,8 @@ var init_worktree3 = __esm({
 
 // packages/cleo/src/cli/index.ts
 init_dist();
-import { readFileSync as readFileSync21 } from "node:fs";
-import { dirname as dirname13, join as join39 } from "node:path";
+import { readFileSync as readFileSync22 } from "node:fs";
+import { dirname as dirname13, join as join40 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 import { enforceNodeVersion } from "@cleocode/paths";
 
@@ -93116,7 +94547,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "cloudCommand",
     name: "cloud",
-    description: "Cleo Nexus reads with the device credential (GET only; getting the credential may upgrade a 9.24 session or retry unsettled logouts): status (one-call verification), whoami, devices, projects [show].",
+    description: "Cleo Nexus with the device credential: status (one-call verification), whoami, devices, projects [show], activity; the encrypted vault: push, pull, restore, verify, vault, lease release.",
     load: async () => (await Promise.resolve().then(() => (init_cloud(), cloud_exports))).cloudCommand
   },
   {
@@ -93347,6 +94778,12 @@ var COMMAND_MANIFEST = [
     description: "Audit the machine-wide memory guard that bounds test runs an agent starts OUTSIDE cleo ",
     load: async () => (await Promise.resolve().then(() => (init_doctor_memory_guard(), doctor_memory_guard_exports))).doctorMemoryGuardCommand
   },
+  {
+    exportName: "doctorMigrationsCommand",
+    name: "migrations",
+    description: "Report the migration journal of the project and global stores: row count, head, applied ",
+    load: async () => (await Promise.resolve().then(() => (init_doctor_migrations(), doctor_migrations_exports))).doctorMigrationsCommand
+  },
   {
     exportName: "doctorNexusResidencyCommand",
     name: "nexus-residency",
@@ -93539,6 +94976,12 @@ var COMMAND_MANIFEST = [
     description: "Completion timeline and productivity analytics",
     load: async () => (await Promise.resolve().then(() => (init_history(), history_exports))).historyCommand
   },
+  {
+    exportName: "hookCommand",
+    name: "hook",
+    description: "Agent-harness hooks installed by cleo init/upgrade; stdout is the harness hook protocol, not LAFS: cleo hook heavy-command --provider claude-code|codex|kimi|opencode",
+    load: async () => (await Promise.resolve().then(() => (init_hook(), hook_exports))).hookCommand
+  },
   {
     exportName: "hygieneCommand",
     name: "hygiene",
@@ -93845,6 +95288,12 @@ var COMMAND_MANIFEST = [
     description: "Generate project roadmap from task provenance \u2014 epics grouped by status with progress",
     load: async () => (await Promise.resolve().then(() => (init_roadmap(), roadmap_exports))).roadmapCommand
   },
+  {
+    exportName: "runCommand",
+    name: "run",
+    description: "Run a heavy command (tests, builds, installs) under the machine-wide resource budget: cleo run [--class test|build|full-build] [--wait] [--passthrough] -- <command...>",
+    load: async () => (await Promise.resolve().then(() => (init_run(), run_exports))).runCommand
+  },
   {
     exportName: "safestopCommand",
     name: "safestop",
@@ -94252,12 +95701,12 @@ init_did_you_mean();
 
 // packages/cleo/src/cli/lib/first-run-detection.ts
 import { existsSync as existsSync21 } from "node:fs";
-import { join as join38 } from "node:path";
+import { join as join39 } from "node:path";
 async function detectFirstRun() {
   const envKey = process.env["ANTHROPIC_API_KEY"];
   if (typeof envKey === "string" && envKey.length > 0) return false;
   const { getCleoPlatformPaths } = await import("@cleocode/paths");
-  const configPath = join38(getCleoPlatformPaths().config, "config.json");
+  const configPath = join39(getCleoPlatformPaths().config, "config.json");
   if (existsSync21(configPath)) return false;
   try {
     const { getCredentialPool: getCredentialPool2 } = await import("@cleocode/core/llm/credential-pool.js");
@@ -94389,8 +95838,8 @@ async function resolveSubCommandForHelp(cmd, rawArgs) {
 init_summary_context();
 enforceNodeVersion();
 function getPackageVersion() {
-  const pkgPath = join39(dirname13(fileURLToPath7(import.meta.url)), "../../package.json");
-  const pkg = JSON.parse(readFileSync21(pkgPath, "utf-8"));
+  const pkgPath = join40(dirname13(fileURLToPath7(import.meta.url)), "../../package.json");
+  const pkg = JSON.parse(readFileSync22(pkgPath, "utf-8"));
   return pkg.version;
 }
 var CLI_VERSION = getPackageVersion();
@@ -94431,6 +95880,7 @@ async function startCli() {
   let describeFlag = false;
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
+    if (arg === "--") break;
     if (arg === "--json") rawOpts["json"] = true;
     else if (arg === "--human") rawOpts["human"] = true;
     else if (arg === "--quiet") rawOpts["quiet"] = true;
@@ -94641,7 +96091,7 @@ async function runStartupMaintenance() {
     detectAndRemoveStrayProjectNexus,
     getGlobalSalt,
     getLogger: getLogger22,
-    getProjectRoot: getProjectRoot75,
+    getProjectRoot: getProjectRoot76,
     isCleanupMarkerSet,
     isMissingProjectError,
     migrateSignaldockToConduit,
@@ -94651,7 +96101,7 @@ async function runStartupMaintenance() {
   } = await import("@cleocode/core/internal");
   let projectRootForCleanup = "";
   try {
-    projectRootForCleanup = getProjectRoot75();
+    projectRootForCleanup = getProjectRoot76();
   } catch {
   }
   if (!isCleanupMarkerSet(CLI_VERSION, projectRootForCleanup)) {
@@ -94671,7 +96121,7 @@ async function runStartupMaintenance() {
   const isInitInvocation = process.argv.slice(2).some((a) => a === "init");
   if (!isInitInvocation) {
     try {
-      const _projectRootForMigration = getProjectRoot75();
+      const _projectRootForMigration = getProjectRoot76();
       if (needsSignaldockToConduitMigration(_projectRootForMigration)) {
         const migrationResult = await migrateSignaldockToConduit(_projectRootForMigration);
         if (migrationResult.status === "failed") {