@cleocode/cleo 2026.2.9 → 2026.3.1

package/dist/mcp/index.js

@@ -501,6 +501,7 @@ __export(schema_exports, {
   lifecyclePipelines: () => lifecyclePipelines,
   lifecycleStages: () => lifecycleStages,
   lifecycleTransitions: () => lifecycleTransitions,
+  manifestEntries: () => manifestEntries,
   schemaMeta: () => schemaMeta,
   sessions: () => sessions,
   statusRegistryTable: () => statusRegistryTable,
@@ -517,7 +518,7 @@ import {
   primaryKey
 } from "drizzle-orm/sqlite-core";
 import { sql } from "drizzle-orm";
-var TASK_PRIORITIES, TASK_TYPES, TASK_SIZES, LIFECYCLE_STAGE_NAMES, LIFECYCLE_GATE_RESULTS, LIFECYCLE_EVIDENCE_TYPES, tasks, taskDependencies, taskRelations, sessions, taskWorkHistory, lifecyclePipelines, lifecycleStages, lifecycleGateResults, lifecycleEvidence, lifecycleTransitions, schemaMeta, auditLog, architectureDecisions, adrTaskLinks, adrRelations, statusRegistryTable;
+var TASK_PRIORITIES, TASK_TYPES, TASK_SIZES, LIFECYCLE_STAGE_NAMES, LIFECYCLE_GATE_RESULTS, LIFECYCLE_EVIDENCE_TYPES, tasks, taskDependencies, taskRelations, sessions, taskWorkHistory, lifecyclePipelines, lifecycleStages, lifecycleGateResults, lifecycleEvidence, lifecycleTransitions, manifestEntries, schemaMeta, auditLog, architectureDecisions, adrTaskLinks, adrRelations, statusRegistryTable;
 var init_schema = __esm({
   "src/store/schema.ts"() {
     "use strict";
@@ -613,8 +614,9 @@ var init_schema = __esm({
       taskId: text("task_id").notNull().references(() => tasks.id, { onDelete: "cascade" }),
       relatedTo: text("related_to").notNull().references(() => tasks.id, { onDelete: "cascade" }),
       relationType: text("relation_type", {
-        enum: ["related", "blocks", "duplicates"]
-      }).notNull().default("related")
+        enum: ["related", "blocks", "duplicates", "absorbs", "fixes", "extends", "supersedes"]
+      }).notNull().default("related"),
+      reason: text("reason")
     }, (table) => [
       primaryKey({ columns: [table.taskId, table.relatedTo] })
     ]);
@@ -687,7 +689,16 @@ var init_schema = __esm({
       skippedAt: text("skipped_at"),
       skipReason: text("skip_reason"),
       notesJson: text("notes_json").default("[]"),
-      metadataJson: text("metadata_json").default("{}")
+      metadataJson: text("metadata_json").default("{}"),
+      // RCASD provenance tracking columns (T5100)
+      outputFile: text("output_file"),
+      createdBy: text("created_by"),
+      validatedBy: text("validated_by"),
+      validatedAt: text("validated_at"),
+      validationStatus: text("validation_status", {
+        enum: ["pending", "in_review", "approved", "rejected", "needs_revision"]
+      }),
+      provenanceChainJson: text("provenance_chain_json")
     }, (table) => [
       index("idx_lifecycle_stages_pipeline_id").on(table.pipelineId),
       index("idx_lifecycle_stages_stage_name").on(table.stageName),
@@ -732,6 +743,25 @@ var init_schema = __esm({
     }, (table) => [
       index("idx_lifecycle_transitions_pipeline_id").on(table.pipelineId)
     ]);
+    manifestEntries = sqliteTable("manifest_entries", {
+      id: text("id").primaryKey(),
+      pipelineId: text("pipeline_id").references(() => lifecyclePipelines.id, { onDelete: "cascade" }),
+      stageId: text("stage_id").references(() => lifecycleStages.id, { onDelete: "cascade" }),
+      title: text("title").notNull(),
+      date: text("date").notNull(),
+      status: text("status", { enum: MANIFEST_STATUSES }).notNull(),
+      agentType: text("agent_type"),
+      outputFile: text("output_file"),
+      topicsJson: text("topics_json").default("[]"),
+      findingsJson: text("findings_json").default("[]"),
+      linkedTasksJson: text("linked_tasks_json").default("[]"),
+      createdBy: text("created_by"),
+      createdAt: text("created_at").notNull().default(sql`(datetime('now'))`)
+    }, (table) => [
+      index("idx_manifest_entries_pipeline_id").on(table.pipelineId),
+      index("idx_manifest_entries_stage_id").on(table.stageId),
+      index("idx_manifest_entries_status").on(table.status)
+    ]);
     schemaMeta = sqliteTable("schema_meta", {
       key: text("key").primaryKey(),
       value: text("value").notNull()
@@ -829,11 +859,36 @@ function openNativeDatabase(path, options) {
     readOnly: options?.readonly ?? false,
     timeout: options?.timeout ?? 5e3
   });
+  db.exec("PRAGMA busy_timeout=5000");
   if (options?.enableWal !== false) {
-    db.exec("PRAGMA journal_mode=WAL");
+    const MAX_WAL_RETRIES = 3;
+    const RETRY_DELAY_MS = 200;
+    let walSet = false;
+    for (let attempt = 1; attempt <= MAX_WAL_RETRIES; attempt++) {
+      db.exec("PRAGMA journal_mode=WAL");
+      const result = db.prepare("PRAGMA journal_mode").get();
+      const currentMode = result?.journal_mode?.toLowerCase?.() ?? "unknown";
+      if (currentMode === "wal") {
+        walSet = true;
+        break;
+      }
+      if (attempt < MAX_WAL_RETRIES) {
+        const buf = new SharedArrayBuffer(4);
+        Atomics.wait(new Int32Array(buf), 0, 0, RETRY_DELAY_MS * attempt);
+      }
+    }
+    if (!walSet) {
+      const finalResult = db.prepare("PRAGMA journal_mode").get();
+      const finalMode = finalResult?.journal_mode?.toLowerCase?.() ?? "unknown";
+      if (finalMode !== "wal") {
+        db.close();
+        throw new Error(
+          `CRITICAL: Failed to set WAL journal mode after ${MAX_WAL_RETRIES} attempts. Database is in '${finalMode}' mode. Another process likely holds an EXCLUSIVE lock on ${path}. Refusing to open \u2014 concurrent writes in DELETE mode cause data loss. Kill other cleo/MCP processes and retry. (T5173)`
+        );
+      }
+    }
   }
   db.exec("PRAGMA foreign_keys=ON");
-  db.exec("PRAGMA busy_timeout=5000");
   return db;
 }
 function createDrizzleCallback(db) {
@@ -884,6 +939,65 @@ var init_node_sqlite_adapter = __esm({
   }
 });
 
+// src/store/sqlite-backup.ts
+import { existsSync as existsSync3, mkdirSync, readdirSync, statSync, unlinkSync } from "node:fs";
+import { join as join3 } from "node:path";
+function formatTimestamp(d) {
+  const pad = (n, len = 2) => String(n).padStart(len, "0");
+  return `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
+}
+function rotateSnapshots(backupDir) {
+  try {
+    const files = readdirSync(backupDir).filter((f) => f.match(/^tasks-\d{8}-\d{6}\.db$/)).map((f) => ({ name: f, path: join3(backupDir, f), mtimeMs: statSync(join3(backupDir, f)).mtimeMs })).sort((a, b) => a.mtimeMs - b.mtimeMs);
+    while (files.length >= MAX_SNAPSHOTS) {
+      const oldest = files.shift();
+      unlinkSync(oldest.path);
+    }
+  } catch {
+  }
+}
+async function vacuumIntoBackup(opts = {}) {
+  const now = Date.now();
+  if (!opts.force && now - _lastBackupEpoch < DEBOUNCE_MS) {
+    return;
+  }
+  try {
+    const cleoDir = getCleoDir(opts.cwd);
+    const backupDir = join3(cleoDir, "backups", "sqlite");
+    mkdirSync(backupDir, { recursive: true });
+    const db = getNativeDb();
+    if (!db) return;
+    const dest = join3(backupDir, `tasks-${formatTimestamp(/* @__PURE__ */ new Date())}.db`);
+    db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+    rotateSnapshots(backupDir);
+    const safeDest = dest.replace(/'/g, "''");
+    db.exec(`VACUUM INTO '${safeDest}'`);
+    _lastBackupEpoch = Date.now();
+  } catch {
+  }
+}
+function listSqliteBackups(cwd) {
+  try {
+    const cleoDir = getCleoDir(cwd);
+    const backupDir = join3(cleoDir, "backups", "sqlite");
+    if (!existsSync3(backupDir)) return [];
+    return readdirSync(backupDir).filter((f) => f.match(/^tasks-\d{8}-\d{6}\.db$/)).map((f) => ({ name: f, path: join3(backupDir, f), mtimeMs: statSync(join3(backupDir, f)).mtimeMs })).sort((a, b) => b.mtimeMs - a.mtimeMs);
+  } catch {
+    return [];
+  }
+}
+var MAX_SNAPSHOTS, DEBOUNCE_MS, _lastBackupEpoch;
+var init_sqlite_backup = __esm({
+  "src/store/sqlite-backup.ts"() {
+    "use strict";
+    init_paths();
+    init_sqlite();
+    MAX_SNAPSHOTS = 10;
+    DEBOUNCE_MS = 3e4;
+    _lastBackupEpoch = 0;
+  }
+});
+
 // src/store/sqlite.ts
 var sqlite_exports = {};
 __export(sqlite_exports, {
@@ -894,20 +1008,79 @@ __export(sqlite_exports, {
   getDbPath: () => getDbPath,
   getNativeDb: () => getNativeDb,
   getSchemaVersion: () => getSchemaVersion,
+  isSqliteBusy: () => isSqliteBusy,
   resetDbState: () => resetDbState,
   resolveMigrationsFolder: () => resolveMigrationsFolder,
   schema: () => schema_exports
 });
-import { existsSync as existsSync3, mkdirSync } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, copyFileSync, unlinkSync as unlinkSync2, renameSync as renameSync2 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname2, join as join3 } from "node:path";
+import { dirname as dirname2, join as join4, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { eq } from "drizzle-orm";
 import { readMigrationFiles } from "drizzle-orm/migrator";
 import { drizzle } from "drizzle-orm/sqlite-proxy";
 import { migrate } from "drizzle-orm/sqlite-proxy/migrator";
 function getDbPath(cwd) {
-  return join3(getCleoDirAbsolute(cwd), DB_FILENAME);
+  return join4(getCleoDirAbsolute(cwd), DB_FILENAME);
+}
+async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
+  const log5 = getLogger("sqlite");
+  try {
+    const countResult = nativeDb.prepare("SELECT COUNT(*) as cnt FROM tasks").get();
+    const taskCount = countResult?.cnt ?? 0;
+    if (taskCount > 0) return;
+    const backups = listSqliteBackups(cwd);
+    if (backups.length === 0) {
+      return;
+    }
+    const newestBackup = backups[0];
+    const backupDb = new DatabaseSync2(newestBackup.path, { readOnly: true });
+    let backupTaskCount = 0;
+    try {
+      const backupCount = backupDb.prepare("SELECT COUNT(*) as cnt FROM tasks").get();
+      backupTaskCount = backupCount?.cnt ?? 0;
+    } finally {
+      backupDb.close();
+    }
+    if (backupTaskCount < MIN_BACKUP_TASK_COUNT) {
+      return;
+    }
+    log5.warn(
+      { dbPath, backupPath: newestBackup.path, backupTasks: backupTaskCount },
+      `Empty database detected with ${backupTaskCount}-task backup available. Auto-recovering from backup. This likely happened because git-tracked WAL/SHM files were overwritten during a branch switch (T5188).`
+    );
+    nativeDb.close();
+    const walPath = dbPath + "-wal";
+    const shmPath = dbPath + "-shm";
+    try {
+      unlinkSync2(walPath);
+    } catch {
+    }
+    try {
+      unlinkSync2(shmPath);
+    } catch {
+    }
+    const tempPath = dbPath + ".recovery-tmp";
+    copyFileSync(newestBackup.path, tempPath);
+    renameSync2(tempPath, dbPath);
+    log5.info(
+      { dbPath, backupPath: newestBackup.path, restoredTasks: backupTaskCount },
+      "Database auto-recovered from backup successfully."
+    );
+    const restoredNativeDb = openNativeDatabase(dbPath);
+    _nativeDb = restoredNativeDb;
+    const callback = createDrizzleCallback(restoredNativeDb);
+    const batchCb = createBatchCallback(restoredNativeDb);
+    const restoredDb = drizzle(callback, batchCb, { schema: schema_exports });
+    await runMigrations(restoredNativeDb, restoredDb);
+    _db = restoredDb;
+  } catch (err) {
+    log5.error(
+      { err, dbPath },
+      "Auto-recovery from backup failed. Continuing with empty database."
+    );
+  }
 }
 async function getDb(cwd) {
   const requestedPath = getDbPath(cwd);
@@ -919,7 +1092,7 @@ async function getDb(cwd) {
   _initPromise = (async () => {
     const dbPath = requestedPath;
     _dbPath = dbPath;
-    mkdirSync(dirname2(dbPath), { recursive: true });
+    mkdirSync2(dirname2(dbPath), { recursive: true });
     const nativeDb = openNativeDatabase(dbPath);
     _nativeDb = nativeDb;
     const callback = createDrizzleCallback(nativeDb);
@@ -932,6 +1105,31 @@ async function getDb(cwd) {
     nativeDb.exec(
       `INSERT OR IGNORE INTO schema_meta (key, value) VALUES ('task_id_sequence', '{"counter":0,"lastId":"T000","checksum":"seed"}')`
     );
+    await autoRecoverFromBackup(nativeDb, dbPath, cwd);
+    if (!_gitTrackingChecked) {
+      _gitTrackingChecked = true;
+      try {
+        const { execFileSync: execFileSync6 } = await import("node:child_process");
+        const gitCwd = resolve3(dbPath, "..", "..");
+        const filesToCheck = [dbPath, dbPath + "-wal", dbPath + "-shm"];
+        const log5 = getLogger("sqlite");
+        for (const fileToCheck of filesToCheck) {
+          try {
+            execFileSync6("git", ["ls-files", "--error-unmatch", fileToCheck], {
+              cwd: gitCwd,
+              stdio: "pipe"
+            });
+            const basename7 = fileToCheck.split("/").pop();
+            log5.warn(
+              { path: fileToCheck },
+              `${basename7} is tracked by project git \u2014 this risks data loss on branch switch. Run: git rm --cached ${fileToCheck.replace(gitCwd + "/", "")} (see ADR-013, T5188)`
+            );
+          } catch {
+          }
+        }
+      } catch {
+      }
+    }
     _db = db;
     return db;
   })();
@@ -944,7 +1142,7 @@ async function getDb(cwd) {
 function resolveMigrationsFolder() {
   const __filename = fileURLToPath(import.meta.url);
   const __dirname2 = dirname2(__filename);
-  return join3(__dirname2, "..", "..", "drizzle");
+  return join4(__dirname2, "..", "..", "drizzle");
 }
 function tableExists(nativeDb, tableName) {
   const result = nativeDb.prepare(
@@ -952,6 +1150,11 @@ function tableExists(nativeDb, tableName) {
   ).get(tableName);
   return !!result;
 }
+function isSqliteBusy(err) {
+  if (!(err instanceof Error)) return false;
+  const msg = err.message.toLowerCase();
+  return msg.includes("sqlite_busy") || msg.includes("database is locked");
+}
 async function runMigrations(nativeDb, db) {
   const migrationsFolder = resolveMigrationsFolder();
   if (tableExists(nativeDb, "tasks") && !tableExists(nativeDb, "__drizzle_migrations")) {
@@ -971,16 +1174,33 @@ async function runMigrations(nativeDb, db) {
     }
   }
   await migrate(db, async (queries) => {
-    nativeDb.prepare("BEGIN").run();
-    try {
-      for (const query of queries) {
-        nativeDb.prepare(query).run();
+    let lastError;
+    for (let attempt = 1; attempt <= MAX_MIGRATION_RETRIES; attempt++) {
+      try {
+        nativeDb.prepare("BEGIN IMMEDIATE").run();
+        try {
+          for (const query of queries) {
+            nativeDb.prepare(query).run();
+          }
+          nativeDb.prepare("COMMIT").run();
+          return;
+        } catch (err) {
+          nativeDb.prepare("ROLLBACK").run();
+          throw err;
+        }
+      } catch (err) {
+        if (!isSqliteBusy(err) || attempt === MAX_MIGRATION_RETRIES) {
+          throw err;
+        }
+        lastError = err;
+        const exponentialDelay = MIGRATION_RETRY_BASE_DELAY_MS * Math.pow(2, attempt - 1);
+        const jitter = Math.random() * exponentialDelay * 0.5;
+        const delay = Math.min(exponentialDelay + jitter, MIGRATION_RETRY_MAX_DELAY_MS);
+        const buf = new SharedArrayBuffer(4);
+        Atomics.wait(new Int32Array(buf), 0, 0, Math.round(delay));
       }
-      nativeDb.prepare("COMMIT").run();
-    } catch (err) {
-      nativeDb.prepare("ROLLBACK").run();
-      throw err;
     }
+    throw lastError;
   }, { migrationsFolder });
 }
 function closeDb() {
@@ -1016,18 +1236,20 @@ async function getSchemaVersion(cwd) {
   return result[0]?.value ?? null;
 }
 function dbExists(cwd) {
-  return existsSync3(getDbPath(cwd));
+  return existsSync4(getDbPath(cwd));
 }
 function getNativeDb() {
   return _nativeDb;
 }
-var _require2, DatabaseSync2, DB_FILENAME, SQLITE_SCHEMA_VERSION, SCHEMA_VERSION, _db, _nativeDb, _dbPath, _initPromise;
+var _require2, DatabaseSync2, DB_FILENAME, SQLITE_SCHEMA_VERSION, SCHEMA_VERSION, _db, _nativeDb, _dbPath, _initPromise, _gitTrackingChecked, MIN_BACKUP_TASK_COUNT, MAX_MIGRATION_RETRIES, MIGRATION_RETRY_BASE_DELAY_MS, MIGRATION_RETRY_MAX_DELAY_MS;
 var init_sqlite = __esm({
   "src/store/sqlite.ts"() {
     "use strict";
     init_schema();
     init_paths();
     init_node_sqlite_adapter();
+    init_logger();
+    init_sqlite_backup();
     _require2 = createRequire2(import.meta.url);
     ({ DatabaseSync: DatabaseSync2 } = _require2("node:sqlite"));
     DB_FILENAME = "tasks.db";
@@ -1037,6 +1259,11 @@ var init_sqlite = __esm({
     _nativeDb = null;
     _dbPath = null;
     _initPromise = null;
+    _gitTrackingChecked = false;
+    MIN_BACKUP_TASK_COUNT = 10;
+    MAX_MIGRATION_RETRIES = 5;
+    MIGRATION_RETRY_BASE_DELAY_MS = 100;
+    MIGRATION_RETRY_MAX_DELAY_MS = 2e3;
   }
 });
 
@@ -1298,7 +1525,7 @@ var init_atomic = __esm({
 
 // src/store/backup.ts
 import { copyFile, rename as fsRename, readdir, unlink as unlink2, stat, mkdir as mkdir2 } from "node:fs/promises";
-import { join as join4, basename } from "node:path";
+import { join as join5, basename } from "node:path";
 async function createBackup(filePath, backupDir, maxBackups = DEFAULT_MAX_BACKUPS) {
   try {
     await mkdir2(backupDir, { recursive: true });
@@ -1312,14 +1539,14 @@ async function createBackup(filePath, backupDir, maxBackups = DEFAULT_MAX_BACKUP
       );
     }
     for (let i = maxBackups; i >= 1; i--) {
-      const current = join4(backupDir, `${fileName}.${i}`);
+      const current = join5(backupDir, `${fileName}.${i}`);
       if (i === maxBackups) {
         try {
           await unlink2(current);
         } catch {
         }
       } else {
-        const next = join4(backupDir, `${fileName}.${i + 1}`);
+        const next = join5(backupDir, `${fileName}.${i + 1}`);
         try {
           await stat(current);
           await fsRename(current, next);
@@ -1327,7 +1554,7 @@ async function createBackup(filePath, backupDir, maxBackups = DEFAULT_MAX_BACKUP
         }
       }
     }
-    const backupPath = join4(backupDir, `${fileName}.1`);
+    const backupPath = join5(backupDir, `${fileName}.1`);
     await copyFile(filePath, backupPath);
     return backupPath;
   } catch (err) {
@@ -1803,6 +2030,30 @@ async function loadDependenciesForTasks(db, tasks2, validationIds) {
     }
   }
 }
+async function loadRelationsForTasks(db, tasks2) {
+  if (tasks2.length === 0) return;
+  const taskIds = tasks2.map((t) => t.id);
+  const allRels = await db.select().from(taskRelations).where(inArray(taskRelations.taskId, taskIds)).all();
+  const relMap = /* @__PURE__ */ new Map();
+  for (const rel of allRels) {
+    let arr = relMap.get(rel.taskId);
+    if (!arr) {
+      arr = [];
+      relMap.set(rel.taskId, arr);
+    }
+    arr.push({
+      taskId: rel.relatedTo,
+      type: rel.relationType,
+      reason: rel.reason ?? void 0
+    });
+  }
+  for (const task of tasks2) {
+    const relations = relMap.get(task.id);
+    if (relations && relations.length > 0) {
+      task.relates = relations;
+    }
+  }
+}
 var init_db_helpers = __esm({
   "src/store/db-helpers.ts"() {
     "use strict";
@@ -1851,6 +2102,7 @@ async function createSqliteDataAccessor(cwd) {
       const tasks2 = taskRows.map(rowToTask);
       if (tasks2.length > 0) {
         await loadDependenciesForTasks(db, tasks2);
+        await loadRelationsForTasks(db, tasks2);
       }
       const projectMeta = await getMetaValue(cwd, "project_meta") ?? DEFAULT_PROJECT_META;
       const workState = await getMetaValue(cwd, "focus_state") ?? DEFAULT_WORK_STATE;
@@ -1926,6 +2178,7 @@ async function createSqliteDataAccessor(cwd) {
           ...activeRows.map((r) => r.id)
         ]);
         await loadDependenciesForTasks(db, archivedTasks, allKnownIds);
+        await loadRelationsForTasks(db, archivedTasks);
       }
       return {
         archivedTasks,
@@ -1992,6 +2245,14 @@ async function createSqliteDataAccessor(cwd) {
       await upsertTask(db, row);
       await updateDependencies(db, task.id, task.depends ?? []);
     },
+    async addRelation(taskId, relatedTo, relationType, reason) {
+      const db = await getDb(cwd);
+      const validTypes = ["related", "blocks", "duplicates", "absorbs", "fixes", "extends", "supersedes"];
+      if (!validTypes.includes(relationType)) {
+        throw new Error(`Invalid relation type: ${relationType}. Valid types: ${validTypes.join(", ")}`);
+      }
+      await db.insert(taskRelations).values({ taskId, relatedTo, relationType, reason: reason ?? null }).onConflictDoNothing().run();
+    },
     async archiveSingleTask(taskId, fields) {
       const db = await getDb(cwd);
       const rows = await db.select({ id: tasks.id }).from(tasks).where(eq3(tasks.id, taskId)).all();
@@ -2063,22 +2324,22 @@ var init_sqlite_data_accessor = __esm({
 
 // src/store/git-checkpoint.ts
 import { readFile as readFile2, writeFile } from "node:fs/promises";
-import { existsSync as existsSync4 } from "node:fs";
+import { existsSync as existsSync5 } from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { join as join5, resolve as resolve3 } from "node:path";
+import { join as join6, resolve as resolve4 } from "node:path";
 function makeCleoGitEnv(cleoDir) {
-  const abs = resolve3(cleoDir);
+  const abs = resolve4(cleoDir);
   return {
     ...process.env,
-    GIT_DIR: join5(abs, ".git"),
+    GIT_DIR: join6(abs, ".git"),
     GIT_WORK_TREE: abs
   };
 }
 async function cleoGitCommand(args, cleoDir) {
   try {
     const result = await execFileAsync("git", args, {
-      cwd: resolve3(cleoDir),
+      cwd: resolve4(cleoDir),
       // absolute cwd so relative paths in args resolve correctly
       env: makeCleoGitEnv(cleoDir),
       timeout: 1e4
@@ -2089,7 +2350,7 @@ async function cleoGitCommand(args, cleoDir) {
   }
 }
 function isCleoGitInitialized(cleoDir) {
-  return existsSync4(join5(cleoDir, ".git", "HEAD"));
+  return existsSync5(join6(cleoDir, ".git", "HEAD"));
 }
 async function loadCheckpointConfig(cwd) {
   try {
@@ -2116,25 +2377,25 @@ async function isCleoGitRepo(cleoDir) {
   return result.success && (result.stdout === "true" || isCleoGitInitialized(cleoDir));
 }
 function isMergeInProgress(cleoDir) {
-  return existsSync4(join5(cleoDir, ".git", "MERGE_HEAD"));
+  return existsSync5(join6(cleoDir, ".git", "MERGE_HEAD"));
 }
 async function isDetachedHead(cleoDir) {
   const result = await cleoGitCommand(["symbolic-ref", "HEAD"], cleoDir);
   return !result.success;
 }
 function isRebaseInProgress(cleoDir) {
-  return existsSync4(join5(cleoDir, ".git", "rebase-merge")) || existsSync4(join5(cleoDir, ".git", "rebase-apply"));
+  return existsSync5(join6(cleoDir, ".git", "rebase-merge")) || existsSync5(join6(cleoDir, ".git", "rebase-apply"));
 }
 async function recordCheckpointTime(cleoDir) {
   try {
-    const stateFile = join5(cleoDir, CHECKPOINT_STATE_FILE);
+    const stateFile = join6(cleoDir, CHECKPOINT_STATE_FILE);
     await writeFile(stateFile, String(Math.floor(Date.now() / 1e3)));
   } catch {
   }
 }
 async function getLastCheckpointTime(cleoDir) {
   try {
-    const stateFile = join5(cleoDir, CHECKPOINT_STATE_FILE);
+    const stateFile = join6(cleoDir, CHECKPOINT_STATE_FILE);
     const content = await readFile2(stateFile, "utf-8");
     const epoch = parseInt(content.trim(), 10);
     return isNaN(epoch) ? 0 : epoch;
@@ -2145,8 +2406,8 @@ async function getLastCheckpointTime(cleoDir) {
 async function getChangedStateFiles(cleoDir) {
   const changed = [];
   for (const stateFile of STATE_FILES) {
-    const fullPath = join5(cleoDir, stateFile);
-    if (!existsSync4(fullPath)) continue;
+    const fullPath = join6(cleoDir, stateFile);
+    if (!existsSync5(fullPath)) continue;
     const diffResult = await cleoGitCommand(["diff", "--quiet", "--", stateFile], cleoDir);
     const cachedResult = await cleoGitCommand(["diff", "--cached", "--quiet", "--", stateFile], cleoDir);
     const untrackedResult = await cleoGitCommand(
@@ -2170,7 +2431,7 @@ async function shouldCheckpoint(options) {
   const config = await loadCheckpointConfig(cwd);
   if (!config.enabled) return false;
   const cleoDir = getCleoDir(cwd);
-  if (!existsSync4(cleoDir)) return false;
+  if (!existsSync5(cleoDir)) return false;
   if (!isCleoGitInitialized(cleoDir)) return false;
   if (!await isCleoGitRepo(cleoDir)) return false;
   if (isMergeInProgress(cleoDir)) return false;
@@ -2242,63 +2503,15 @@ var init_git_checkpoint = __esm({
   }
 });
 
-// src/store/sqlite-backup.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, readdirSync, statSync, unlinkSync } from "node:fs";
-import { join as join6 } from "node:path";
-function formatTimestamp(d) {
-  const pad = (n, len = 2) => String(n).padStart(len, "0");
-  return `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
-}
-function rotateSnapshots(backupDir) {
-  try {
-    const files = readdirSync(backupDir).filter((f) => f.match(/^tasks-\d{8}-\d{6}\.db$/)).map((f) => ({ name: f, path: join6(backupDir, f), mtimeMs: statSync(join6(backupDir, f)).mtimeMs })).sort((a, b) => a.mtimeMs - b.mtimeMs);
-    while (files.length >= MAX_SNAPSHOTS) {
-      const oldest = files.shift();
-      unlinkSync(oldest.path);
-    }
-  } catch {
-  }
-}
-async function vacuumIntoBackup(opts = {}) {
-  const now = Date.now();
-  if (!opts.force && now - _lastBackupEpoch < DEBOUNCE_MS) {
-    return;
-  }
-  try {
-    const cleoDir = getCleoDir(opts.cwd);
-    const backupDir = join6(cleoDir, "backups", "sqlite");
-    mkdirSync2(backupDir, { recursive: true });
-    const db = getNativeDb();
-    if (!db) return;
-    const dest = join6(backupDir, `tasks-${formatTimestamp(/* @__PURE__ */ new Date())}.db`);
-    db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
-    rotateSnapshots(backupDir);
-    const safeDest = dest.replace(/'/g, "''");
-    db.exec(`VACUUM INTO '${safeDest}'`);
-    _lastBackupEpoch = Date.now();
-  } catch {
-  }
-}
-var MAX_SNAPSHOTS, DEBOUNCE_MS, _lastBackupEpoch;
-var init_sqlite_backup = __esm({
-  "src/store/sqlite-backup.ts"() {
-    "use strict";
-    init_paths();
-    init_sqlite();
-    MAX_SNAPSHOTS = 10;
-    DEBOUNCE_MS = 3e4;
-    _lastBackupEpoch = 0;
-  }
-});
-
 // src/core/sequence/index.ts
 var sequence_exports = {};
 __export(sequence_exports, {
+  allocateNextTaskId: () => allocateNextTaskId,
   checkSequence: () => checkSequence,
   repairSequence: () => repairSequence,
   showSequence: () => showSequence
 });
-import { existsSync as existsSync6, readFileSync as readFileSync3, renameSync as renameSync2 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync3, renameSync as renameSync3 } from "node:fs";
 import { join as join7 } from "node:path";
 import { eq as eq4 } from "drizzle-orm";
 function getLegacySequenceJsonPath(cwd) {
@@ -2329,10 +2542,10 @@ function renameLegacyFile(path) {
   const migratedPath = `${path}.migrated`;
   try {
     if (!existsSync6(migratedPath)) {
-      renameSync2(path, migratedPath);
+      renameSync3(path, migratedPath);
       return;
     }
-    renameSync2(path, `${migratedPath}.${Date.now()}`);
+    renameSync3(path, `${migratedPath}.${Date.now()}`);
   } catch {
   }
 }
@@ -2480,7 +2693,56 @@ async function repairSequence(cwd, accessor) {
     message: `Sequence repaired: ${oldCounter} -> ${newCounter}`
   };
 }
-var SEQUENCE_META_KEY;
+async function allocateNextTaskId(cwd, retryCount = 0) {
+  await getDb(cwd);
+  const nativeDb = getNativeDb();
+  if (!nativeDb) {
+    throw new CleoError(3 /* FILE_ERROR */, "Native database not available for atomic ID allocation");
+  }
+  nativeDb.prepare("BEGIN IMMEDIATE").run();
+  try {
+    nativeDb.prepare(`
+      UPDATE schema_meta
+      SET value = json_set(value,
+        '$.counter', json_extract(value, '$.counter') + 1,
+        '$.lastId', 'T' || printf('%03d', json_extract(value, '$.counter') + 1),
+        '$.checksum', 'alloc-' || strftime('%s','now')
+      )
+      WHERE key = 'task_id_sequence'
+    `).run();
+    const row = nativeDb.prepare(`
+      SELECT json_extract(value, '$.counter') AS counter
+      FROM schema_meta WHERE key = 'task_id_sequence'
+    `).get();
+    if (!row) {
+      throw new CleoError(3 /* FILE_ERROR */, "Sequence counter not found after increment");
+    }
+    const newId = `T${String(row.counter).padStart(3, "0")}`;
+    const existing = nativeDb.prepare(
+      "SELECT id FROM tasks WHERE id = ?"
+    ).get(newId);
+    if (existing) {
+      nativeDb.prepare("ROLLBACK").run();
+      if (retryCount >= MAX_ALLOC_RETRIES) {
+        throw new CleoError(
+          22 /* ID_COLLISION */,
+          `Failed to allocate unique task ID after ${MAX_ALLOC_RETRIES} retries (last attempted: ${newId})`
+        );
+      }
+      await repairSequence(cwd);
+      return allocateNextTaskId(cwd, retryCount + 1);
+    }
+    nativeDb.prepare("COMMIT").run();
+    return newId;
+  } catch (err) {
+    try {
+      nativeDb.prepare("ROLLBACK").run();
+    } catch {
+    }
+    throw err;
+  }
+}
+var SEQUENCE_META_KEY, MAX_ALLOC_RETRIES;
 var init_sequence = __esm({
   "src/core/sequence/index.ts"() {
     "use strict";
@@ -2491,6 +2753,7 @@ var init_sequence = __esm({
     init_sqlite_data_accessor();
     init_data_accessor();
     SEQUENCE_META_KEY = "task_id_sequence";
+    MAX_ALLOC_RETRIES = 3;
   }
 });
 
@@ -2803,6 +3066,11 @@ var init_safety_data_accessor = __esm({
           this.getSafetyOptions()
         );
       }
+      // ---- Relations (pass-through to inner, T5168) ----
+      async addRelation(taskId, relatedTo, relationType, reason) {
+        if (!this.inner.addRelation) return;
+        await this.inner.addRelation(taskId, relatedTo, relationType, reason);
+      }
       // ---- Metadata (pass-through to inner) ----
       async getMetaValue(key) {
         return this.inner.getMetaValue?.(key) ?? null;
@@ -2838,10 +3106,57 @@ var init_data_accessor = __esm({
   }
 });
 
-// src/mcp/engine/store.ts
-import { readFileSync as readFileSync4, writeFileSync, renameSync as renameSync3, mkdirSync as mkdirSync3, existsSync as existsSync8, readdirSync as readdirSync2, unlinkSync as unlinkSync2 } from "fs";
-import { join as join8, dirname as dirname5, basename as basename2 } from "path";
+// src/store/file-utils.ts
+import { readFileSync as readFileSync4, writeFileSync, renameSync as renameSync4, existsSync as existsSync8, unlinkSync as unlinkSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2 } from "node:fs";
+import { join as join8, dirname as dirname5, basename as basename2 } from "node:path";
+import { randomBytes as randomBytes2 } from "node:crypto";
 import * as lockfile2 from "proper-lockfile";
+function rotateBackup(filePath) {
+  const dir = dirname5(filePath);
+  const name = basename2(filePath);
+  const backupDir = join8(dir, ".backups");
+  if (!existsSync8(backupDir)) {
+    mkdirSync3(backupDir, { recursive: true });
+  }
+  for (let i = MAX_BACKUPS; i >= 1; i--) {
+    const current = join8(backupDir, `${name}.${i}`);
+    if (i === MAX_BACKUPS) {
+      try {
+        unlinkSync3(current);
+      } catch {
+      }
+    } else {
+      const next = join8(backupDir, `${name}.${i + 1}`);
+      try {
+        if (existsSync8(current)) renameSync4(current, next);
+      } catch {
+      }
+    }
+  }
+  try {
+    const content = readFileSync4(filePath, "utf-8");
+    writeFileSync(join8(backupDir, `${name}.1`), content, "utf-8");
+  } catch {
+  }
+}
+function writeJsonFileAtomic(filePath, data, indent = 2) {
+  const dir = dirname5(filePath);
+  const tempPath = join8(dir, `.${basename2(filePath)}.${randomBytes2(6).toString("hex")}.tmp`);
+  const content = JSON.stringify(data, null, indent) + "\n";
+  writeFileSync(tempPath, content, "utf-8");
+  try {
+    if (existsSync8(filePath)) {
+      rotateBackup(filePath);
+    }
+    renameSync4(tempPath, filePath);
+  } catch (error) {
+    try {
+      unlinkSync3(tempPath);
+    } catch {
+    }
+    throw error;
+  }
+}
 function readJsonFile(filePath) {
   try {
     const content = readFileSync4(filePath, "utf-8");
@@ -2853,12 +3168,95 @@ function readJsonFile(filePath) {
     throw error;
   }
 }
+function readLogFileEntries(filePath) {
+  let content;
+  try {
+    content = readFileSync4(filePath, "utf-8").trim();
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  if (!content) return [];
+  try {
+    const parsed = JSON.parse(content);
+    if (Array.isArray(parsed)) return parsed;
+    if (parsed && typeof parsed === "object" && Array.isArray(parsed.entries)) {
+      return parsed.entries;
+    }
+    return [parsed];
+  } catch {
+  }
+  const entries = [];
+  if (content.startsWith("{")) {
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    let jsonEnd = -1;
+    for (let i = 0; i < content.length; i++) {
+      const ch = content[i];
+      if (escaped) {
+        escaped = false;
+        continue;
+      }
+      if (ch === "\\" && inString) {
+        escaped = true;
+        continue;
+      }
+      if (ch === '"') {
+        inString = !inString;
+        continue;
+      }
+      if (inString) continue;
+      if (ch === "{") depth++;
+      else if (ch === "}") {
+        depth--;
+        if (depth === 0) {
+          jsonEnd = i + 1;
+          break;
+        }
+      }
+    }
+    if (jsonEnd > 0) {
+      try {
+        const initial = JSON.parse(content.substring(0, jsonEnd));
+        if (initial && Array.isArray(initial.entries)) entries.push(...initial.entries);
+      } catch {
+      }
+      const remainder = content.substring(jsonEnd).trim();
+      if (remainder) {
+        for (const line of remainder.split("\n")) {
+          const l = line.trim();
+          if (!l || !l.startsWith("{")) continue;
+          try {
+            entries.push(JSON.parse(l));
+          } catch {
+          }
+        }
+      }
+    }
+  } else {
+    for (const line of content.split("\n")) {
+      const l = line.trim();
+      if (!l || !l.startsWith("{")) continue;
+      try {
+        entries.push(JSON.parse(l));
+      } catch {
+      }
+    }
+  }
+  return entries;
+}
 function getDataPath(projectRoot, filename) {
   return join8(projectRoot, ".cleo", filename);
 }
-var init_store = __esm({
-  "src/mcp/engine/store.ts"() {
+function resolveProjectRoot() {
+  return process.env["CLEO_ROOT"] || process.cwd();
+}
+var MAX_BACKUPS;
+var init_file_utils = __esm({
+  "src/store/file-utils.ts"() {
     "use strict";
+    MAX_BACKUPS = 10;
   }
 });
 
@@ -3102,7 +3500,7 @@ var init_plan = __esm({
   "src/core/tasks/plan.ts"() {
     "use strict";
     init_data_accessor();
-    init_store();
+    init_file_utils();
     init_deps_ready();
     PRIORITY_SCORE2 = {
       critical: 100,
@@ -3114,7 +3512,7 @@ var init_plan = __esm({
 });
 
 // src/core/sessions/decisions.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
+import { randomBytes as randomBytes3 } from "node:crypto";
 import { readFileSync as readFileSync5, appendFileSync, mkdirSync as mkdirSync4, existsSync as existsSync9 } from "node:fs";
 import { join as join9 } from "node:path";
 async function recordDecision(projectRoot, params) {
@@ -3130,7 +3528,7 @@ async function recordDecision(projectRoot, params) {
   }
   const decisionPath = join9(auditDir, "decisions.jsonl");
   const record = {
-    id: `dec-${randomBytes2(8).toString("hex")}`,
+    id: `dec-${randomBytes3(8).toString("hex")}`,
     sessionId: params.sessionId,
     taskId: params.taskId,
     decision: params.decision,
@@ -3416,189 +3814,36 @@ async function computeChainPosition(projectRoot, sessionId) {
     let current = sessionId;
     let position = 1;
     const visited = /* @__PURE__ */ new Set();
-    while (true) {
-      visited.add(current);
-      const session = sessionMap.get(current);
-      if (!session?.previousSessionId || visited.has(session.previousSessionId)) break;
-      current = session.previousSessionId;
-      position++;
-    }
-    let length = position;
-    const startSession = sessionMap.get(sessionId);
-    let fwd = startSession?.nextSessionId;
-    while (fwd && !visited.has(fwd)) {
-      visited.add(fwd);
-      length++;
-      const s = sessionMap.get(fwd);
-      fwd = s?.nextSessionId ?? void 0;
-    }
-    return { position, length };
-  } catch {
-    return { position: 1, length: 1 };
-  }
-}
-var execFileAsync2;
-var init_handoff = __esm({
-  "src/core/sessions/handoff.ts"() {
-    "use strict";
-    init_data_accessor();
-    init_errors();
-    init_exit_codes();
-    init_decisions();
-    execFileAsync2 = promisify2(execFile2);
-  }
-});
-
-// src/store/file-utils.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync2, renameSync as renameSync4, existsSync as existsSync11, unlinkSync as unlinkSync3, mkdirSync as mkdirSync6 } from "node:fs";
-import { join as join11, dirname as dirname6, basename as basename3 } from "node:path";
-import { randomBytes as randomBytes5 } from "node:crypto";
-function rotateBackup(filePath) {
-  const dir = dirname6(filePath);
-  const name = basename3(filePath);
-  const backupDir = join11(dir, ".backups");
-  if (!existsSync11(backupDir)) {
-    mkdirSync6(backupDir, { recursive: true });
-  }
-  for (let i = MAX_BACKUPS; i >= 1; i--) {
-    const current = join11(backupDir, `${name}.${i}`);
-    if (i === MAX_BACKUPS) {
-      try {
-        unlinkSync3(current);
-      } catch {
-      }
-    } else {
-      const next = join11(backupDir, `${name}.${i + 1}`);
-      try {
-        if (existsSync11(current)) renameSync4(current, next);
-      } catch {
-      }
-    }
-  }
-  try {
-    const content = readFileSync6(filePath, "utf-8");
-    writeFileSync2(join11(backupDir, `${name}.1`), content, "utf-8");
-  } catch {
-  }
-}
-function writeJsonFileAtomic(filePath, data, indent = 2) {
-  const dir = dirname6(filePath);
-  const tempPath = join11(dir, `.${basename3(filePath)}.${randomBytes5(6).toString("hex")}.tmp`);
-  const content = JSON.stringify(data, null, indent) + "\n";
-  writeFileSync2(tempPath, content, "utf-8");
-  try {
-    if (existsSync11(filePath)) {
-      rotateBackup(filePath);
-    }
-    renameSync4(tempPath, filePath);
-  } catch (error) {
-    try {
-      unlinkSync3(tempPath);
-    } catch {
-    }
-    throw error;
-  }
-}
-function readJsonFile2(filePath) {
-  try {
-    const content = readFileSync6(filePath, "utf-8");
-    return JSON.parse(content);
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return null;
-    }
-    throw error;
-  }
-}
-function readLogFileEntries2(filePath) {
-  let content;
-  try {
-    content = readFileSync6(filePath, "utf-8").trim();
-  } catch (error) {
-    if (error.code === "ENOENT") return [];
-    throw error;
-  }
-  if (!content) return [];
-  try {
-    const parsed = JSON.parse(content);
-    if (Array.isArray(parsed)) return parsed;
-    if (parsed && typeof parsed === "object" && Array.isArray(parsed.entries)) {
-      return parsed.entries;
-    }
-    return [parsed];
-  } catch {
-  }
-  const entries = [];
-  if (content.startsWith("{")) {
-    let depth = 0;
-    let inString = false;
-    let escaped = false;
-    let jsonEnd = -1;
-    for (let i = 0; i < content.length; i++) {
-      const ch = content[i];
-      if (escaped) {
-        escaped = false;
-        continue;
-      }
-      if (ch === "\\" && inString) {
-        escaped = true;
-        continue;
-      }
-      if (ch === '"') {
-        inString = !inString;
-        continue;
-      }
-      if (inString) continue;
-      if (ch === "{") depth++;
-      else if (ch === "}") {
-        depth--;
-        if (depth === 0) {
-          jsonEnd = i + 1;
-          break;
-        }
-      }
-    }
-    if (jsonEnd > 0) {
-      try {
-        const initial = JSON.parse(content.substring(0, jsonEnd));
-        if (initial && Array.isArray(initial.entries)) entries.push(...initial.entries);
-      } catch {
-      }
-      const remainder = content.substring(jsonEnd).trim();
-      if (remainder) {
-        for (const line of remainder.split("\n")) {
-          const l = line.trim();
-          if (!l || !l.startsWith("{")) continue;
-          try {
-            entries.push(JSON.parse(l));
-          } catch {
-          }
-        }
-      }
-    }
-  } else {
-    for (const line of content.split("\n")) {
-      const l = line.trim();
-      if (!l || !l.startsWith("{")) continue;
-      try {
-        entries.push(JSON.parse(l));
-      } catch {
-      }
+    while (true) {
+      visited.add(current);
+      const session = sessionMap.get(current);
+      if (!session?.previousSessionId || visited.has(session.previousSessionId)) break;
+      current = session.previousSessionId;
+      position++;
+    }
+    let length = position;
+    const startSession = sessionMap.get(sessionId);
+    let fwd = startSession?.nextSessionId;
+    while (fwd && !visited.has(fwd)) {
+      visited.add(fwd);
+      length++;
+      const s = sessionMap.get(fwd);
+      fwd = s?.nextSessionId ?? void 0;
     }
+    return { position, length };
+  } catch {
+    return { position: 1, length: 1 };
   }
-  return entries;
-}
-function getDataPath2(projectRoot, filename) {
-  return join11(projectRoot, ".cleo", filename);
 }
-function resolveProjectRoot() {
-  return process.env["CLEO_ROOT"] || process.cwd();
-}
-var MAX_BACKUPS;
-var init_file_utils = __esm({
-  "src/store/file-utils.ts"() {
+var execFileAsync2;
+var init_handoff = __esm({
+  "src/core/sessions/handoff.ts"() {
     "use strict";
-    MAX_BACKUPS = 10;
+    init_data_accessor();
+    init_errors();
+    init_exit_codes();
+    init_decisions();
+    execFileAsync2 = promisify2(execFile2);
   }
 });
 
@@ -3613,15 +3858,15 @@ __export(platform_exports, {
   dateDaysAgo: () => dateDaysAgo,
   detectPlatform: () => detectPlatform,
   generateRandomHex: () => generateRandomHex,
-  getDataPath: () => getDataPath2,
+  getDataPath: () => getDataPath,
   getFileMtime: () => getFileMtime,
   getFileSize: () => getFileSize,
   getIsoTimestamp: () => getIsoTimestamp,
   getNodeUpgradeInstructions: () => getNodeUpgradeInstructions,
   getNodeVersionInfo: () => getNodeVersionInfo,
   isoToEpoch: () => isoToEpoch,
-  readJsonFile: () => readJsonFile2,
-  readLogFileEntries: () => readLogFileEntries2,
+  readJsonFile: () => readJsonFile,
+  readLogFileEntries: () => readLogFileEntries,
   requireTool: () => requireTool,
   resolveProjectRoot: () => resolveProjectRoot,
   sha256: () => sha256,
@@ -3629,8 +3874,8 @@ __export(platform_exports, {
 });
 import { execFileSync } from "node:child_process";
 import { tmpdir } from "node:os";
-import { join as join12 } from "node:path";
-import { existsSync as existsSync12, statSync as statSync2 } from "node:fs";
+import { join as join11 } from "node:path";
+import { existsSync as existsSync11, statSync as statSync2 } from "node:fs";
 import { createHash as createHash3, randomBytes as randomBytes6 } from "node:crypto";
 function detectPlatform() {
   switch (process.platform) {
@@ -3689,11 +3934,11 @@ function dateDaysAgo(days) {
   return d.toISOString();
 }
 function getFileSize(filePath) {
-  if (!existsSync12(filePath)) return 0;
+  if (!existsSync11(filePath)) return 0;
   return statSync2(filePath).size;
 }
 function getFileMtime(filePath) {
-  if (!existsSync12(filePath)) return null;
+  if (!existsSync11(filePath)) return null;
   return statSync2(filePath).mtime.toISOString();
 }
 function generateRandomHex(bytes = 6) {
@@ -3704,7 +3949,7 @@ function sha256(data) {
 }
 function createTempFilePath(prefix = "cleo-", suffix = ".tmp") {
   const random = generateRandomHex(8);
-  return join12(tmpdir(), `${prefix}${random}${suffix}`);
+  return join11(tmpdir(), `${prefix}${random}${suffix}`);
 }
 function getNodeVersionInfo() {
   const version = process.version.replace("v", "");
@@ -3834,20 +4079,20 @@ __export(schema_integrity_exports, {
   checkSchemaIntegrity: () => checkSchemaIntegrity,
   readSchemaVersionFromFile: () => readSchemaVersionFromFile
 });
-import { existsSync as existsSync22, readFileSync as readFileSync15 } from "node:fs";
-import { join as join22, dirname as dirname7 } from "node:path";
+import { existsSync as existsSync21, readFileSync as readFileSync14 } from "node:fs";
+import { join as join21, dirname as dirname6 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function resolveSchemaPath(schemaName) {
-  const __dirname2 = dirname7(fileURLToPath2(import.meta.url));
+  const __dirname2 = dirname6(fileURLToPath2(import.meta.url));
   const candidates = [
     // dist/core/validation/ → schemas/
-    join22(__dirname2, "..", "..", "..", "schemas", schemaName),
+    join21(__dirname2, "..", "..", "..", "schemas", schemaName),
     // src/core/validation/ → schemas/ (ts-node / vitest)
-    join22(__dirname2, "..", "..", "schemas", schemaName),
+    join21(__dirname2, "..", "..", "schemas", schemaName),
     // fallback: look relative to cwd
-    join22(process.cwd(), "schemas", schemaName)
+    join21(process.cwd(), "schemas", schemaName)
   ];
-  return candidates.find(existsSync22) ?? null;
+  return candidates.find(existsSync21) ?? null;
 }
 function readSchemaVersionFromFile(schemaName) {
   const path = resolveSchemaPath(schemaName);
@@ -3856,7 +4101,7 @@ function readSchemaVersionFromFile(schemaName) {
 }
 function readSchemaVersion(schemaPath) {
   try {
-    const raw = readFileSync15(schemaPath, "utf-8");
+    const raw = readFileSync14(schemaPath, "utf-8");
     const schema = JSON.parse(raw);
     const version = schema["schemaVersion"] ?? schema["_meta"]?.["schemaVersion"];
     return typeof version === "string" ? version : null;
@@ -3866,7 +4111,7 @@ function readSchemaVersion(schemaPath) {
 }
 function checkFile(target, cleoDir) {
   const filePath = target.filePath(cleoDir);
-  if (!existsSync22(filePath)) {
+  if (!existsSync21(filePath)) {
     if (target.required) {
       return {
         label: target.label,
@@ -3878,7 +4123,7 @@ function checkFile(target, cleoDir) {
   }
   let data;
   try {
-    data = JSON.parse(readFileSync15(filePath, "utf-8"));
+    data = JSON.parse(readFileSync14(filePath, "utf-8"));
   } catch (err) {
     return {
       label: target.label,
@@ -3896,7 +4141,7 @@ function checkFile(target, cleoDir) {
   }
   let schema;
   try {
-    schema = JSON.parse(readFileSync15(schemaPath, "utf-8"));
+    schema = JSON.parse(readFileSync14(schemaPath, "utf-8"));
   } catch (err) {
     return {
       label: target.label,
@@ -3960,28 +4205,28 @@ var init_schema_integrity = __esm({
     INTEGRITY_TARGETS = [
       {
         label: "config.json",
-        filePath: (d) => join22(d, "config.json"),
+        filePath: (d) => join21(d, "config.json"),
         schemaName: "config.schema.json",
         required: true,
         versionKey: "schemaVersion"
       },
       {
         label: "project-info.json",
-        filePath: (d) => join22(d, "project-info.json"),
+        filePath: (d) => join21(d, "project-info.json"),
         schemaName: "project-info.schema.json",
         required: false,
         versionKey: "schemaVersion"
       },
       {
         label: "project-context.json",
-        filePath: (d) => join22(d, "project-context.json"),
+        filePath: (d) => join21(d, "project-context.json"),
         schemaName: "project-context.schema.json",
         required: false,
         versionKey: "schemaVersion"
       },
       {
         label: ".context-state.json",
-        filePath: (d) => join22(d, ".context-state.json"),
+        filePath: (d) => join21(d, ".context-state.json"),
         schemaName: "context-state.schema.json",
         required: false,
         versionKey: "version"
@@ -3996,17 +4241,17 @@ __export(mcp_exports, {
   detectEnvMode: () => detectEnvMode,
   generateMcpServerEntry: () => generateMcpServerEntry
 });
-import { readFileSync as readFileSync16 } from "node:fs";
-import { join as join23 } from "node:path";
+import { readFileSync as readFileSync15 } from "node:fs";
+import { join as join22 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 function detectEnvMode() {
-  const versionPath = join23(
-    process.env["CLEO_HOME"] ?? join23(homedir3(), ".cleo"),
+  const versionPath = join22(
+    process.env["CLEO_HOME"] ?? join22(homedir3(), ".cleo"),
     "VERSION"
   );
   let content;
   try {
-    content = readFileSync16(versionPath, "utf-8");
+    content = readFileSync15(versionPath, "utf-8");
   } catch {
     return { mode: "unknown", source: null };
   }
@@ -4029,7 +4274,7 @@ function generateMcpServerEntry(env) {
   if (env.mode === "dev-ts" && env.source) {
     return {
       command: "node",
-      args: [join23(env.source, "dist", "mcp", "index.js")],
+      args: [join22(env.source, "dist", "mcp", "index.js")],
       env: {}
     };
   }
@@ -4068,17 +4313,17 @@ __export(registry_exports, {
   readRegistryRequired: () => readRegistryRequired
 });
 import { createHash as createHash4 } from "node:crypto";
-import { join as join24 } from "node:path";
+import { join as join23 } from "node:path";
 import { mkdir as mkdir4, access, readFile as readFile4 } from "node:fs/promises";
 import { z } from "zod";
 function getNexusHome() {
-  return process.env["NEXUS_HOME"] ?? join24(getCleoHome(), "nexus");
+  return process.env["NEXUS_HOME"] ?? join23(getCleoHome(), "nexus");
 }
 function getNexusCacheDir() {
-  return process.env["NEXUS_CACHE_DIR"] ?? join24(getNexusHome(), "cache");
+  return process.env["NEXUS_CACHE_DIR"] ?? join23(getNexusHome(), "cache");
 }
 function getRegistryPath() {
-  return process.env["NEXUS_REGISTRY_FILE"] ?? join24(getCleoHome(), "projects-registry.json");
+  return process.env["NEXUS_REGISTRY_FILE"] ?? join23(getCleoHome(), "projects-registry.json");
 }
 function generateProjectHash(projectPath) {
   const hash = createHash4("sha256").update(projectPath).digest("hex");
@@ -4120,7 +4365,7 @@ async function nexusInit() {
 }
 async function isCleoProject(projectPath) {
   try {
-    await access(join24(projectPath, ".cleo", "todo.json"));
+    await access(join23(projectPath, ".cleo", "todo.json"));
     return true;
   } catch {
     return false;
@@ -4130,9 +4375,9 @@ async function readProjectMeta(projectPath) {
   try {
     let raw;
     try {
-      raw = await readFile4(join24(projectPath, ".cleo", "tasks.json"), "utf-8");
+      raw = await readFile4(join23(projectPath, ".cleo", "tasks.json"), "utf-8");
     } catch {
-      raw = await readFile4(join24(projectPath, ".cleo", "todo.json"), "utf-8");
+      raw = await readFile4(join23(projectPath, ".cleo", "todo.json"), "utf-8");
     }
     const data = JSON.parse(raw);
     const tasks2 = data.tasks ?? [];
@@ -4318,10 +4563,10 @@ var project_detect_exports = {};
 __export(project_detect_exports, {
   detectProjectType: () => detectProjectType
 });
-import { existsSync as existsSync23, readdirSync as readdirSync6 } from "node:fs";
-import { join as join25 } from "node:path";
+import { existsSync as existsSync22, readdirSync as readdirSync6 } from "node:fs";
+import { join as join24 } from "node:path";
 function detectProjectType(projectDir) {
-  const exists = (f) => existsSync23(join25(projectDir, f));
+  const exists = (f) => existsSync22(join24(projectDir, f));
   const info = {
     type: "unknown",
     testFramework: "unknown",
@@ -4392,6 +4637,7 @@ __export(validation_schemas_exports, {
   insertLifecyclePipelineSchema: () => insertLifecyclePipelineSchema,
   insertLifecycleStageSchema: () => insertLifecycleStageSchema,
   insertLifecycleTransitionSchema: () => insertLifecycleTransitionSchema,
+  insertManifestEntrySchema: () => insertManifestEntrySchema,
   insertSchemaMetaSchema: () => insertSchemaMetaSchema,
   insertSessionSchema: () => insertSessionSchema,
   insertTaskDependencySchema: () => insertTaskDependencySchema,
@@ -4405,6 +4651,7 @@ __export(validation_schemas_exports, {
   selectLifecyclePipelineSchema: () => selectLifecyclePipelineSchema,
   selectLifecycleStageSchema: () => selectLifecycleStageSchema,
   selectLifecycleTransitionSchema: () => selectLifecycleTransitionSchema,
+  selectManifestEntrySchema: () => selectManifestEntrySchema,
   selectSchemaMetaSchema: () => selectSchemaMetaSchema,
   selectSessionSchema: () => selectSessionSchema,
   selectTaskDependencySchema: () => selectTaskDependencySchema,
@@ -4418,7 +4665,7 @@ __export(validation_schemas_exports, {
 });
 import { createInsertSchema, createSelectSchema } from "drizzle-orm/zod";
 import { z as z2 } from "zod/v4";
-var taskRefinements, insertTaskSchema, selectTaskSchema, insertTaskDependencySchema, selectTaskDependencySchema, insertTaskRelationSchema, selectTaskRelationSchema, insertSessionSchema, selectSessionSchema, sessionScopeSchema, sessionStatsSchema, sessionTaskWorkSchema, sessionSchema, insertWorkHistorySchema, selectWorkHistorySchema, insertLifecyclePipelineSchema, selectLifecyclePipelineSchema, insertLifecycleStageSchema, selectLifecycleStageSchema, insertLifecycleGateResultSchema, selectLifecycleGateResultSchema, insertLifecycleEvidenceSchema, selectLifecycleEvidenceSchema, insertLifecycleTransitionSchema, selectLifecycleTransitionSchema, insertSchemaMetaSchema, selectSchemaMetaSchema, insertAuditLogSchema, AuditLogInsertSchema, selectAuditLogSchema, AuditLogSelectSchema, insertArchitectureDecisionSchema, selectArchitectureDecisionSchema;
+var taskRefinements, insertTaskSchema, selectTaskSchema, insertTaskDependencySchema, selectTaskDependencySchema, insertTaskRelationSchema, selectTaskRelationSchema, insertSessionSchema, selectSessionSchema, sessionScopeSchema, sessionStatsSchema, sessionTaskWorkSchema, sessionSchema, insertWorkHistorySchema, selectWorkHistorySchema, insertLifecyclePipelineSchema, selectLifecyclePipelineSchema, insertLifecycleStageSchema, selectLifecycleStageSchema, insertLifecycleGateResultSchema, selectLifecycleGateResultSchema, insertLifecycleEvidenceSchema, selectLifecycleEvidenceSchema, insertLifecycleTransitionSchema, selectLifecycleTransitionSchema, insertSchemaMetaSchema, selectSchemaMetaSchema, insertAuditLogSchema, AuditLogInsertSchema, selectAuditLogSchema, AuditLogSelectSchema, insertArchitectureDecisionSchema, selectArchitectureDecisionSchema, insertManifestEntrySchema, selectManifestEntrySchema;
 var init_validation_schemas = __esm({
   "src/store/validation-schemas.ts"() {
     "use strict";
@@ -4511,6 +4758,8 @@ var init_validation_schemas = __esm({
     AuditLogSelectSchema = selectAuditLogSchema;
     insertArchitectureDecisionSchema = createInsertSchema(architectureDecisions);
     selectArchitectureDecisionSchema = createSelectSchema(architectureDecisions);
+    insertManifestEntrySchema = createInsertSchema(manifestEntries);
+    selectManifestEntrySchema = createSelectSchema(manifestEntries);
   }
 });
 
@@ -4684,8 +4933,8 @@ __export(session_grade_exports, {
   gradeSession: () => gradeSession,
   readGrades: () => readGrades
 });
-import { join as join42 } from "node:path";
-import { existsSync as existsSync41 } from "node:fs";
+import { join as join41 } from "node:path";
+import { existsSync as existsSync40 } from "node:fs";
 import { readFile as readFile6, appendFile, mkdir as mkdir6 } from "node:fs/promises";
 async function gradeSession(sessionId, cwd) {
   const sessionEntries = await queryAudit({ sessionId });
@@ -4865,9 +5114,9 @@ function detectDuplicateCreates(entries) {
 async function appendGradeResult(result, cwd) {
   try {
     const cleoDir = getCleoDirAbsolute(cwd);
-    const metricsDir = join42(cleoDir, "metrics");
+    const metricsDir = join41(cleoDir, "metrics");
     await mkdir6(metricsDir, { recursive: true });
-    const gradesPath = join42(metricsDir, "GRADES.jsonl");
+    const gradesPath = join41(metricsDir, "GRADES.jsonl");
     const line = JSON.stringify({ ...result, evaluator: "auto" }) + "\n";
     await appendFile(gradesPath, line, "utf8");
   } catch {
@@ -4876,8 +5125,8 @@ async function appendGradeResult(result, cwd) {
 async function readGrades(sessionId, cwd) {
   try {
     const cleoDir = getCleoDirAbsolute(cwd);
-    const gradesPath = join42(cleoDir, "metrics", "GRADES.jsonl");
-    if (!existsSync41(gradesPath)) return [];
+    const gradesPath = join41(cleoDir, "metrics", "GRADES.jsonl");
+    if (!existsSync40(gradesPath)) return [];
     const content = await readFile6(gradesPath, "utf8");
     const results = content.split("\n").filter((l) => l.trim()).map((l) => JSON.parse(l));
     return sessionId ? results.filter((r) => r.sessionId === sessionId) : results;
@@ -5241,7 +5490,7 @@ if (actualQueryCount < 1) {
 function registerQueryTool() {
   return {
     name: "cleo_query",
-    description: "CLEO read operations: task discovery, status checks, analysis, validation, and compliance metrics. Never modifies state.",
+    description: 'CLEO read operations: task discovery, status checks, analysis, validation, and compliance metrics. Never modifies state. First call: use domain "admin", operation "help" to discover all available operations.',
     inputSchema: {
       type: "object",
       required: ["domain", "operation"],
@@ -5253,7 +5502,7 @@ function registerQueryTool() {
         },
         operation: {
           type: "string",
-          description: "Domain-specific read operation (see operation matrix)"
+          description: "Domain-specific read operation. Call admin.help to see the full operation matrix. Common: tasks.find, tasks.show, tasks.next, session.status, admin.dash"
         },
         params: {
           type: "object",
@@ -5563,7 +5812,7 @@ if (actualMutateCount < 1) {
 function registerMutateTool() {
   return {
     name: "cleo_mutate",
-    description: "CLEO write operations: create, update, complete tasks; manage sessions; spawn agents; progress lifecycle; execute releases. Modifies state with validation.",
+    description: 'CLEO write operations: create, update, complete tasks; manage sessions; spawn agents; progress lifecycle; execute releases. Modifies state with validation. Use cleo_query with domain "admin", operation "help" first to discover available operations.',
     inputSchema: {
       type: "object",
       required: ["domain", "operation"],
@@ -5575,7 +5824,7 @@ function registerMutateTool() {
         },
         operation: {
           type: "string",
-          description: "Domain-specific write operation (see operation matrix)"
+          description: "Domain-specific write operation. Call cleo_query admin.help to see the full operation matrix. Common: tasks.add, tasks.update, tasks.complete, session.start, session.end"
         },
         params: {
           type: "object",
@@ -7813,7 +8062,6 @@ init_data_accessor();
 
 // src/dispatch/engines/_error.ts
 init_logger();
-var logger = getLogger("engine");
 var STRING_TO_EXIT = {
   // General Errors (1-9)
   E_GENERAL: 1,
@@ -7942,6 +8190,7 @@ function logLevel(exitCode) {
 function engineError(code, message, options) {
   const exitCode = STRING_TO_EXIT[code] ?? 1;
   const level = logLevel(exitCode);
+  const logger = getLogger("engine");
   logger[level]({ code, exitCode, ...options?.details && { details: options.details } }, message);
   return {
     success: false,
@@ -8564,6 +8813,7 @@ function validateHierarchyPlacement(parentId, tasks2, policy) {
 }
 
 // src/core/tasks/add.ts
+init_sequence();
 function validateTitle(title) {
   if (!title || title.trim().length === 0) {
     throw new CleoError(2 /* INVALID_INPUT */, "Task title is required");
@@ -8746,20 +8996,23 @@ async function addTask(options, cwd, accessor) {
   validateTitle(options.title);
   const data = accessor ? await accessor.loadTaskFile() : await readJsonRequired(taskPath);
   let archivedTasks = [];
-  try {
-    if (accessor) {
-      const archive = await accessor.loadArchive();
-      if (archive?.archivedTasks) {
-        archivedTasks = archive.archivedTasks;
-      }
-    } else {
-      const { readJson: readJson2 } = await Promise.resolve().then(() => (init_json(), json_exports));
-      const archive = await readJson2(archivePath);
-      if (archive?.archivedTasks) {
-        archivedTasks = archive.archivedTasks;
+  const useSqliteAlloc = accessor?.engine === "sqlite" || !accessor && (await Promise.resolve().then(() => (init_sqlite(), sqlite_exports))).getNativeDb() !== null;
+  if (!useSqliteAlloc) {
+    try {
+      if (accessor) {
+        const archive = await accessor.loadArchive();
+        if (archive?.archivedTasks) {
+          archivedTasks = archive.archivedTasks;
+        }
+      } else {
+        const { readJson: readJson2 } = await Promise.resolve().then(() => (init_json(), json_exports));
+        const archive = await readJson2(archivePath);
+        if (archive?.archivedTasks) {
+          archivedTasks = archive.archivedTasks;
+        }
       }
+    } catch {
     }
-  } catch {
   }
   const status = options.status ?? "pending";
   const priority = normalizePriority(options.priority ?? "medium");
@@ -8837,9 +9090,14 @@ async function addTask(options, cwd, accessor) {
   if (duplicate) {
     return { task: duplicate, duplicate: true };
   }
-  const taskId = generateTaskId(data.tasks, archivedTasks);
-  if (data.tasks.some((t) => t.id === taskId)) {
-    throw new CleoError(22 /* ID_COLLISION */, `Generated ID ${taskId} already exists`);
+  let taskId;
+  if (useSqliteAlloc) {
+    taskId = await allocateNextTaskId(cwd);
+  } else {
+    taskId = generateTaskId(data.tasks, archivedTasks);
+    if (data.tasks.some((t) => t.id === taskId)) {
+      throw new CleoError(22 /* ID_COLLISION */, `Generated ID ${taskId} already exists`);
+    }
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const position = options.position ?? getNextPosition(parentId, data.tasks);
@@ -9193,6 +9451,291 @@ async function updateTask2(options, cwd, accessor) {
   return { task, changes };
 }
 
+// src/core/tasks/complete.ts
+init_json();
+init_errors();
+init_exit_codes();
+init_paths();
+
+// src/core/tasks/dependency-check.ts
+function detectCircularDeps(taskId, tasks2) {
+  const taskMap = new Map(tasks2.map((t) => [t.id, t]));
+  const visited = /* @__PURE__ */ new Set();
+  const recursionStack = /* @__PURE__ */ new Set();
+  const path = [];
+  function dfs(id) {
+    visited.add(id);
+    recursionStack.add(id);
+    path.push(id);
+    const task = taskMap.get(id);
+    if (task?.depends) {
+      for (const depId of task.depends) {
+        if (!visited.has(depId)) {
+          const cycle = dfs(depId);
+          if (cycle.length > 0) return cycle;
+        } else if (recursionStack.has(depId)) {
+          const cycleStart = path.indexOf(depId);
+          return [...path.slice(cycleStart), depId];
+        }
+      }
+    }
+    path.pop();
+    recursionStack.delete(id);
+    return [];
+  }
+  return dfs(taskId);
+}
+function getBlockedTasks(tasks2) {
+  const completedIds = new Set(
+    tasks2.filter((t) => t.status === "done" || t.status === "cancelled").map((t) => t.id)
+  );
+  return tasks2.filter((t) => {
+    if (!t.depends?.length) return false;
+    if (t.status === "done" || t.status === "cancelled") return false;
+    return t.depends.some((depId) => !completedIds.has(depId));
+  });
+}
+function getReadyTasks(tasks2) {
+  const completedIds = new Set(
+    tasks2.filter((t) => t.status === "done" || t.status === "cancelled").map((t) => t.id)
+  );
+  return tasks2.filter((t) => {
+    if (t.status === "done" || t.status === "cancelled") return false;
+    if (!t.depends?.length) return true;
+    return t.depends.every((depId) => completedIds.has(depId));
+  });
+}
+function getDependents(taskId, tasks2) {
+  return tasks2.filter((t) => t.depends?.includes(taskId));
+}
+function getUnresolvedDeps(taskId, tasks2) {
+  const task = tasks2.find((t) => t.id === taskId);
+  if (!task?.depends?.length) return [];
+  const completedIds = new Set(
+    tasks2.filter((t) => t.status === "done" || t.status === "cancelled").map((t) => t.id)
+  );
+  return task.depends.filter((depId) => !completedIds.has(depId));
+}
+function validateDependencyRefs(tasks2) {
+  const taskIds = new Set(tasks2.map((t) => t.id));
+  const errors = [];
+  for (const task of tasks2) {
+    if (!task.depends?.length) continue;
+    for (const depId of task.depends) {
+      if (!taskIds.has(depId)) {
+        errors.push({
+          code: "E_DEP_NOT_FOUND",
+          taskId: task.id,
+          message: `Task ${task.id} depends on ${depId}, which does not exist`,
+          relatedIds: [depId]
+        });
+      }
+    }
+  }
+  return errors;
+}
+function validateDependencies(tasks2) {
+  const errors = [];
+  const warnings = [];
+  errors.push(...validateDependencyRefs(tasks2));
+  const visited = /* @__PURE__ */ new Set();
+  for (const task of tasks2) {
+    if (visited.has(task.id)) continue;
+    if (!task.depends?.length) continue;
+    const cycle = detectCircularDeps(task.id, tasks2);
+    if (cycle.length > 0) {
+      errors.push({
+        code: "E_CIRCULAR_DEP",
+        taskId: task.id,
+        message: `Circular dependency detected: ${cycle.join(" -> ")}`,
+        relatedIds: cycle
+      });
+      cycle.forEach((id) => visited.add(id));
+    }
+  }
+  for (const task of tasks2) {
+    if (task.depends?.includes(task.id)) {
+      errors.push({
+        code: "E_SELF_DEP",
+        taskId: task.id,
+        message: `Task ${task.id} depends on itself`
+      });
+    }
+  }
+  for (const task of tasks2) {
+    if (task.status === "done" && task.depends?.length) {
+      const unresolved = getUnresolvedDeps(task.id, tasks2);
+      if (unresolved.length > 0) {
+        warnings.push({
+          code: "W_COMPLETED_WITH_UNMET_DEPS",
+          taskId: task.id,
+          message: `Completed task ${task.id} has unmet dependencies: ${unresolved.join(", ")}`
+        });
+      }
+    }
+  }
+  return {
+    valid: errors.length === 0,
+    errors,
+    warnings
+  };
+}
+function getTransitiveBlockers(taskId, tasks2) {
+  const taskMap = new Map(tasks2.map((t) => [t.id, t]));
+  const task = taskMap.get(taskId);
+  if (!task?.depends?.length) return [];
+  const blockers = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  function walk(id) {
+    if (visited.has(id)) return;
+    visited.add(id);
+    const t = taskMap.get(id);
+    if (!t?.depends?.length) return;
+    for (const depId of t.depends) {
+      const dep = taskMap.get(depId);
+      if (!dep) continue;
+      if (dep.status === "done" || dep.status === "cancelled") continue;
+      blockers.add(depId);
+      walk(depId);
+    }
+  }
+  walk(taskId);
+  return [...blockers];
+}
+function getLeafBlockers(taskId, tasks2) {
+  const blockerIds = getTransitiveBlockers(taskId, tasks2);
+  if (blockerIds.length === 0) return [];
+  const taskMap = new Map(tasks2.map((t) => [t.id, t]));
+  const completedIds = new Set(
+    tasks2.filter((t) => t.status === "done" || t.status === "cancelled").map((t) => t.id)
+  );
+  return blockerIds.filter((id) => {
+    const t = taskMap.get(id);
+    if (!t?.depends?.length) return true;
+    return t.depends.every((depId) => completedIds.has(depId));
+  });
+}
+
+// src/core/tasks/complete.ts
+init_data_safety_central();
+async function completeTask(options, cwd, accessor) {
+  const taskPath = getTaskPath(cwd);
+  const logPath = getLogPath(cwd);
+  const backupDir = getBackupDir(cwd);
+  const data = accessor ? await accessor.loadTaskFile() : await readJsonRequired(taskPath);
+  const taskIdx = data.tasks.findIndex((t) => t.id === options.taskId);
+  if (taskIdx === -1) {
+    throw new CleoError(
+      4 /* NOT_FOUND */,
+      `Task not found: ${options.taskId}`,
+      { fix: `Use 'cleo find "${options.taskId}"' to search` }
+    );
+  }
+  const task = data.tasks[taskIdx];
+  if (task.status === "done") {
+    throw new CleoError(
+      17 /* TASK_COMPLETED */,
+      `Task ${options.taskId} is already completed`
+    );
+  }
+  if (task.depends?.length) {
+    const incompleteDeps = task.depends.filter((depId) => {
+      const dep = data.tasks.find((t) => t.id === depId);
+      return dep && dep.status !== "done";
+    });
+    if (incompleteDeps.length > 0) {
+      throw new CleoError(
+        5 /* DEPENDENCY_ERROR */,
+        `Task ${options.taskId} has incomplete dependencies: ${incompleteDeps.join(", ")}`,
+        { fix: `Complete dependencies first: ${incompleteDeps.map((d) => `cleo complete ${d}`).join(", ")}` }
+      );
+    }
+  }
+  const children = data.tasks.filter((t) => t.parentId === options.taskId);
+  const incompleteChildren = children.filter((c) => c.status !== "done" && c.status !== "cancelled");
+  if (incompleteChildren.length > 0 && task.type === "epic") {
+    if (!task.noAutoComplete) {
+      throw new CleoError(
+        16 /* HAS_CHILDREN */,
+        `Epic ${options.taskId} has ${incompleteChildren.length} incomplete children: ${incompleteChildren.map((c) => c.id).join(", ")}`,
+        { fix: `Complete children first or use 'cleo update ${options.taskId} --no-auto-complete'` }
+      );
+    }
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const before = { ...task };
+  task.status = "done";
+  task.completedAt = now;
+  task.updatedAt = now;
+  if (options.notes) {
+    const timestampedNote = `${(/* @__PURE__ */ new Date()).toISOString().replace("T", " ").replace(/\.\d+Z$/, " UTC")}: ${options.notes}`;
+    if (!task.notes) task.notes = [];
+    task.notes.push(timestampedNote);
+  }
+  if (options.changeset) {
+    if (!task.notes) task.notes = [];
+    task.notes.push(`Changeset: ${options.changeset}`);
+  }
+  data.tasks[taskIdx] = task;
+  const autoCompleted = [];
+  if (task.parentId) {
+    const parent = data.tasks.find((t) => t.id === task.parentId);
+    if (parent && parent.type === "epic" && !parent.noAutoComplete) {
+      const parentChildren = data.tasks.filter((t) => t.parentId === parent.id);
+      const allDone = parentChildren.every((c) => c.status === "done" || c.status === "cancelled");
+      if (allDone) {
+        parent.status = "done";
+        parent.completedAt = now;
+        parent.updatedAt = now;
+        autoCompleted.push(parent.id);
+      }
+    }
+  }
+  data._meta.checksum = computeChecksum(data.tasks);
+  data.lastUpdated = now;
+  if (accessor) {
+    if (accessor.upsertSingleTask) {
+      await accessor.upsertSingleTask(task);
+      for (const parentId of autoCompleted) {
+        const parent = data.tasks.find((t) => t.id === parentId);
+        if (parent) await accessor.upsertSingleTask(parent);
+      }
+    } else {
+      await safeSaveTaskFile(accessor, data, cwd);
+    }
+    await safeAppendLog(accessor, {
+      id: `log-${Math.floor(Date.now() / 1e3)}-${(await import("node:crypto")).randomBytes(3).toString("hex")}`,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      action: "task_completed",
+      taskId: options.taskId,
+      actor: "system",
+      details: { title: task.title, previousStatus: before.status },
+      before: null,
+      after: { title: task.title, previousStatus: before.status }
+    }, cwd);
+  } else {
+    await saveJson(taskPath, data, { backupDir });
+    await logOperation(logPath, "task_completed", options.taskId, {
+      title: task.title,
+      previousStatus: before.status
+    });
+  }
+  const dependents = getDependents(options.taskId, data.tasks);
+  const unblockedTasks = [];
+  for (const dep of dependents) {
+    if (dep.status === "done" || dep.status === "cancelled") continue;
+    const stillUnresolved = getUnresolvedDeps(dep.id, data.tasks);
+    if (stillUnresolved.length === 0) {
+      unblockedTasks.push({ id: dep.id, title: dep.title });
+    }
+  }
+  return {
+    task,
+    ...autoCompleted.length > 0 && { autoCompleted },
+    ...unblockedTasks.length > 0 && { unblockedTasks }
+  };
+}
+
 // src/core/tasks/delete.ts
 init_json();
 init_errors();
@@ -9498,6 +10041,16 @@ async function showTask(taskId, cwd, accessor) {
           title: dep?.title ?? "Unknown task"
         };
       });
+      const unresolved = detail.dependencyStatus.filter(
+        (d) => d.status !== "done" && d.status !== "cancelled"
+      );
+      if (unresolved.length > 0) {
+        detail.unresolvedDeps = unresolved;
+      }
+    }
+    const dependents = data.tasks.filter((t) => t.depends?.includes(taskId)).map((t) => t.id);
+    if (dependents.length > 0) {
+      detail.dependents = dependents;
     }
     const path = [taskId];
     let currentId = task.parentId;
@@ -9518,6 +10071,16 @@ async function showTask(taskId, cwd, accessor) {
 // src/core/tasks/list.ts
 init_json();
 init_paths();
+function toCompact(task) {
+  return {
+    id: task.id,
+    title: task.title,
+    status: task.status,
+    priority: task.priority,
+    type: task.type,
+    parentId: task.parentId
+  };
+}
 async function listTasks(options = {}, cwd, accessor) {
   const taskPath = getTaskPath(cwd);
   const data = accessor ? await accessor.loadTaskFile() : await readJsonRequired(taskPath);
@@ -9694,34 +10257,19 @@ async function findTasks(options, cwd, accessor) {
 
 // src/core/tasks/task-ops.ts
 init_data_accessor();
-init_store();
+init_file_utils();
 init_status_registry();
 init_deps_ready();
 var PRIORITY_SCORE = {
   critical: 100,
   high: 75,
-  medium: 50,
-  low: 25
-};
-async function loadAllTasks2(projectRoot) {
-  const accessor = await getAccessor(projectRoot);
-  const data = await accessor.loadTaskFile();
-  return data.tasks;
-}
-function buildBlockingChain(task, taskMap, visited = /* @__PURE__ */ new Set()) {
-  const chain = [];
-  if (visited.has(task.id)) return chain;
-  visited.add(task.id);
-  if (task.depends) {
-    for (const depId of task.depends) {
-      const dep = taskMap.get(depId);
-      if (dep && dep.status !== "done" && dep.status !== "cancelled") {
-        chain.push(depId);
-        chain.push(...buildBlockingChain(dep, taskMap, visited));
-      }
-    }
-  }
-  return chain;
+  medium: 50,
+  low: 25
+};
+async function loadAllTasks2(projectRoot) {
+  const accessor = await getAccessor(projectRoot);
+  const data = await accessor.loadTaskFile();
+  return data.tasks;
 }
 function buildTreeNode(task, childrenMap) {
   const children = (childrenMap.get(task.id) ?? []).map(
@@ -9735,6 +10283,25 @@ function buildTreeNode(task, childrenMap) {
     children
   };
 }
+function buildUpstreamTree(taskId, taskMap, visited = /* @__PURE__ */ new Set()) {
+  const task = taskMap.get(taskId);
+  if (!task?.depends?.length) return [];
+  const nodes = [];
+  for (const depId of task.depends) {
+    if (visited.has(depId)) continue;
+    visited.add(depId);
+    const dep = taskMap.get(depId);
+    if (!dep) continue;
+    nodes.push({
+      id: dep.id,
+      title: dep.title,
+      status: dep.status,
+      type: dep.type,
+      children: buildUpstreamTree(depId, taskMap, visited)
+    });
+  }
+  return nodes;
+}
 function countNodes(nodes) {
   let count2 = nodes.length;
   for (const node of nodes) {
@@ -9827,20 +10394,21 @@ async function coreTaskBlockers(projectRoot, params) {
       return dep && dep.status !== "done" && dep.status !== "cancelled";
     })
   );
+  const tasksAsTask = allTasks;
   const blockerInfos = [
     ...blockedTasks.map((t) => ({
       id: t.id,
       title: t.title,
       status: t.status,
       depends: t.depends,
-      blockingChain: analyze ? buildBlockingChain(t, taskMap) : []
+      blockingChain: analyze ? getTransitiveBlockers(t.id, tasksAsTask) : []
     })),
     ...depBlockedTasks.filter((t) => !blockedTasks.some((bt) => bt.id === t.id)).map((t) => ({
       id: t.id,
       title: t.title,
       status: t.status,
       depends: t.depends,
-      blockingChain: analyze ? buildBlockingChain(t, taskMap) : []
+      blockingChain: analyze ? getTransitiveBlockers(t.id, tasksAsTask) : []
     }))
   ];
   const blockerCounts = /* @__PURE__ */ new Map();
@@ -9922,7 +10490,10 @@ async function coreTaskRelatesAdd(projectRoot, taskId, relatedId, type, reason)
   } else {
     await accessor.saveTaskFile(current);
   }
-  return { from: taskId, to: relatedId, type, added: true };
+  if (accessor.addRelation) {
+    await accessor.addRelation(taskId, relatedId, type, reason);
+  }
+  return { from: taskId, to: relatedId, type, reason, added: true };
 }
 async function coreTaskAnalyze(projectRoot, taskId) {
   const allTasks = await loadAllTasks2(projectRoot);
@@ -10242,7 +10813,63 @@ async function coreTaskComplexityEstimate(projectRoot, params) {
   else size = "large";
   return { size, score, factors, dependencyDepth, subtaskCount, fileCount };
 }
-async function coreTaskDepends(projectRoot, taskId, direction = "both") {
+async function coreTaskDepsOverview(projectRoot) {
+  const allTasks = await loadAllTasks2(projectRoot);
+  const tasksAsTask = allTasks;
+  const tasksWithDeps = allTasks.filter((t) => t.depends && t.depends.length > 0);
+  const blocked = getBlockedTasks(tasksAsTask);
+  const ready = getReadyTasks(tasksAsTask);
+  const validation = validateDependencies(tasksAsTask);
+  return {
+    totalTasks: allTasks.length,
+    tasksWithDeps: tasksWithDeps.length,
+    blockedTasks: blocked.map((t) => ({
+      id: t.id,
+      title: t.title,
+      status: t.status,
+      unblockedBy: (t.depends ?? []).filter((depId) => {
+        const dep = allTasks.find((x) => x.id === depId);
+        return dep && dep.status !== "done" && dep.status !== "cancelled";
+      })
+    })),
+    readyTasks: ready.filter((t) => t.status !== "done" && t.status !== "cancelled").map((t) => ({
+      id: t.id,
+      title: t.title,
+      status: t.status
+    })),
+    validation: {
+      valid: validation.valid,
+      errorCount: validation.errors.length,
+      warningCount: validation.warnings.length
+    }
+  };
+}
+async function coreTaskDepsCycles(projectRoot) {
+  const allTasks = await loadAllTasks2(projectRoot);
+  const tasksAsTask = allTasks;
+  const taskMap = new Map(allTasks.map((t) => [t.id, t]));
+  const visited = /* @__PURE__ */ new Set();
+  const cycles = [];
+  for (const task of allTasks) {
+    if (visited.has(task.id)) continue;
+    if (!task.depends?.length) continue;
+    const cycle = detectCircularDeps(task.id, tasksAsTask);
+    if (cycle.length > 0) {
+      cycles.push({
+        path: cycle,
+        // Deduplicate: detectCircularDeps returns [A,B,C,A] where
+        // last element closes the cycle. Use Set for robustness.
+        tasks: [...new Set(cycle)].map((id) => {
+          const t = taskMap.get(id);
+          return { id, title: t?.title ?? "unknown" };
+        })
+      });
+      cycle.forEach((id) => visited.add(id));
+    }
+  }
+  return { hasCycles: cycles.length > 0, cycles };
+}
+async function coreTaskDepends(projectRoot, taskId, direction = "both", options) {
   const allTasks = await loadAllTasks2(projectRoot);
   const task = allTasks.find((t) => t.id === taskId);
   if (!task) {
@@ -10266,7 +10893,31 @@ async function coreTaskDepends(projectRoot, taskId, direction = "both") {
       }
     }
   }
-  return { taskId, direction, upstream, downstream };
+  const tasksAsTask = allTasks;
+  const transitiveIds = getTransitiveBlockers(taskId, tasksAsTask);
+  const unresolvedChain = transitiveIds.length;
+  const leafIds = getLeafBlockers(taskId, tasksAsTask);
+  const leafBlockers = leafIds.map((id) => {
+    const t = taskMap.get(id);
+    return { id: t.id, title: t.title, status: t.status };
+  });
+  const allDepsReady = unresolvedChain === 0;
+  const hint = unresolvedChain > 0 ? `Run 'ct deps show ${taskId} --tree' for full dependency graph` : void 0;
+  let upstreamTree;
+  if (options?.tree) {
+    upstreamTree = buildUpstreamTree(taskId, taskMap);
+  }
+  return {
+    taskId,
+    direction,
+    upstream,
+    downstream,
+    unresolvedChain,
+    leafBlockers,
+    allDepsReady,
+    ...hint && { hint },
+    ...upstreamTree && { upstreamTree }
+  };
 }
 
 // src/dispatch/engines/task-engine.ts
@@ -10300,17 +10951,25 @@ async function taskList(projectRoot, params) {
       status: params?.status,
       limit: params?.limit
     }, projectRoot, accessor);
+    if (params?.compact) {
+      return { success: true, data: { tasks: result.tasks.map((t) => toCompact(t)), total: result.total } };
+    }
     return { success: true, data: { tasks: tasksToRecords(result.tasks), total: result.total } };
   } catch {
     return engineError("E_NOT_INITIALIZED", "Task database not initialized");
   }
 }
-async function taskFind(projectRoot, query, limit) {
+async function taskFind(projectRoot, query, limit, options) {
   try {
     const accessor = await getAccessor(projectRoot);
     const findResult = await findTasks({
       query,
-      limit: limit ?? 20
+      id: options?.id,
+      exact: options?.exact,
+      status: options?.status,
+      includeArchive: options?.includeArchive,
+      limit: limit ?? 20,
+      offset: options?.offset
     }, projectRoot, accessor);
     const results = findResult.results.map((r) => ({
       id: r.id,
@@ -10413,14 +11072,33 @@ async function taskUpdate(projectRoot, taskId, updates) {
   }
 }
 async function taskComplete(projectRoot, taskId, notes) {
-  const showResult = await taskShow(projectRoot, taskId);
-  if (showResult.success && showResult.data?.task?.status === "done") {
-    return engineError("E_TASK_COMPLETED", `Task ${taskId} is already completed`);
+  try {
+    const accessor = await getAccessor(projectRoot);
+    const result = await completeTask({ taskId, notes }, void 0, accessor);
+    return {
+      success: true,
+      data: {
+        task: result.task,
+        ...result.autoCompleted && { autoCompleted: result.autoCompleted },
+        ...result.unblockedTasks && { unblockedTasks: result.unblockedTasks }
+      }
+    };
+  } catch (err) {
+    const message = err.message;
+    if (message.includes("already completed")) {
+      return engineError("E_TASK_COMPLETED", message);
+    }
+    if (message.includes("not found")) {
+      return engineError("E_NOT_FOUND", message);
+    }
+    if (message.includes("incomplete dependencies")) {
+      return engineError("E_DEPENDENCY_ERROR", message);
+    }
+    if (message.includes("incomplete children")) {
+      return engineError("E_HAS_CHILDREN", message);
+    }
+    return engineError("E_INTERNAL", message);
   }
-  return taskUpdate(projectRoot, taskId, {
-    status: "done",
-    notes: notes || void 0
-  });
 }
 async function taskDelete(projectRoot, taskId, force) {
   try {
@@ -10625,9 +11303,9 @@ async function taskComplexityEstimate(projectRoot, params) {
     return engineError("E_NOT_INITIALIZED", "Task database not initialized");
   }
 }
-async function taskDepends(projectRoot, taskId, direction = "both") {
+async function taskDepends(projectRoot, taskId, direction = "both", tree) {
   try {
-    const result = await coreTaskDepends(projectRoot, taskId, direction);
+    const result = await coreTaskDepends(projectRoot, taskId, direction, tree ? { tree } : void 0);
     return { success: true, data: result };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -10637,6 +11315,24 @@ async function taskDepends(projectRoot, taskId, direction = "both") {
     return engineError("E_NOT_INITIALIZED", "Task database not initialized");
   }
 }
+async function taskDepsOverview(projectRoot) {
+  try {
+    const result = await coreTaskDepsOverview(projectRoot);
+    return { success: true, data: result };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return engineError("E_NOT_INITIALIZED", message);
+  }
+}
+async function taskDepsCycles(projectRoot) {
+  try {
+    const result = await coreTaskDepsCycles(projectRoot);
+    return { success: true, data: result };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return engineError("E_NOT_INITIALIZED", message);
+  }
+}
 async function taskPlan(projectRoot) {
   const { coreTaskPlan: coreTaskPlan2 } = await Promise.resolve().then(() => (init_plan(), plan_exports));
   try {
@@ -10894,7 +11590,7 @@ init_decisions();
 init_data_accessor();
 init_errors();
 init_exit_codes();
-import { randomBytes as randomBytes3 } from "node:crypto";
+import { randomBytes as randomBytes4 } from "node:crypto";
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync5, existsSync as existsSync10 } from "node:fs";
 import { join as join10 } from "node:path";
 async function recordAssumption(projectRoot, params) {
@@ -10914,7 +11610,7 @@ async function recordAssumption(projectRoot, params) {
   const taskData = await accessor.loadTaskFile();
   const current = taskData;
   const sessionId = params.sessionId || current._meta?.activeSession || "default";
-  const id = `asm-${randomBytes3(8).toString("hex")}`;
+  const id = `asm-${randomBytes4(8).toString("hex")}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const record = {
     id,
@@ -10981,6 +11677,12 @@ async function computeBriefing(projectRoot, options = {}) {
     scopeTaskIds
   });
   const pipelineStage = computePipelineStage(current);
+  const warnings = [];
+  if (currentTaskInfo?.blockedBy?.length) {
+    warnings.push(
+      `Focused task ${currentTaskInfo.id} is blocked by: ${currentTaskInfo.blockedBy.join(", ")}`
+    );
+  }
   return {
     lastSession,
     currentTask: currentTaskInfo,
@@ -10988,7 +11690,8 @@ async function computeBriefing(projectRoot, options = {}) {
     openBugs,
     blockedTasks,
     activeEpics,
-    ...pipelineStage && { pipelineStage }
+    ...pipelineStage && { pipelineStage },
+    ...warnings.length > 0 && { warnings }
   };
 }
 function parseScope(scopeStr, current) {
@@ -11076,11 +11779,21 @@ function computeCurrentTask(current, taskMap) {
   if (!focusTaskId) return null;
   const task = taskMap.get(focusTaskId);
   if (!task) return null;
-  return {
+  const info = {
     id: task.id,
     title: task.title,
     status: task.status
   };
+  if (task.depends?.length) {
+    const unresolved = task.depends.filter((depId) => {
+      const dep = taskMap.get(depId);
+      return dep && dep.status !== "done" && dep.status !== "cancelled";
+    });
+    if (unresolved.length > 0) {
+      info.blockedBy = unresolved;
+    }
+  }
+  return info;
 }
 function calculateLeverage2(taskId, taskMap) {
   let leverage = 0;
@@ -11227,11 +11940,11 @@ function computePipelineStage(current) {
 }
 
 // src/core/sessions/session-id.ts
-import { randomBytes as randomBytes4 } from "node:crypto";
+import { randomBytes as randomBytes5 } from "node:crypto";
 function generateSessionId() {
   const now = /* @__PURE__ */ new Date();
   const ts = now.toISOString().replace(/[-:T]/g, "").substring(0, 14);
-  const hex = randomBytes4(3).toString("hex");
+  const hex = randomBytes5(3).toString("hex");
   return `ses_${ts}_${hex}`;
 }
 
@@ -11269,6 +11982,14 @@ async function startTask(taskId, cwd, accessor) {
       { fix: `Use 'cleo find "${taskId}"' to search` }
     );
   }
+  const unresolvedDeps = getUnresolvedDeps(taskId, data.tasks);
+  if (unresolvedDeps.length > 0) {
+    throw new CleoError(
+      5 /* DEPENDENCY_ERROR */,
+      `Task ${taskId} is blocked by unresolved dependencies: ${unresolvedDeps.join(", ")}`,
+      { fix: `Complete blockers first: ${unresolvedDeps.map((d) => `cleo complete ${d}`).join(", ")}` }
+    );
+  }
   const previousTask = data.focus?.currentTask ?? null;
   if (!data.focus) {
     data.focus = {};
@@ -11327,6 +12048,8 @@ async function stopTask(cwd, accessor) {
 }
 
 // src/dispatch/engines/session-engine.ts
+init_errors();
+init_exit_codes();
 async function sessionStatus(projectRoot) {
   try {
     const accessor = await getAccessor(projectRoot);
@@ -11396,6 +12119,12 @@ async function taskStart(projectRoot, taskId) {
       data: { taskId: result.taskId, previousTask: result.previousTask }
     };
   } catch (err) {
+    if (err instanceof CleoError) {
+      const stringCode = `E_${getExitCodeName(err.code)}`;
+      return engineError(stringCode, err.message, {
+        ...err.fix && { fix: err.fix }
+      });
+    }
     const message = err.message;
     const code = message.includes("not found") ? "E_NOT_FOUND" : "E_NOT_INITIALIZED";
     return engineError(code, message);
@@ -11860,8 +12589,8 @@ async function sessionChainShow(projectRoot, sessionId) {
 // src/dispatch/engines/system-engine.ts
 init_platform();
 init_data_accessor();
-import { readFileSync as readFileSync14, existsSync as existsSync21, readdirSync as readdirSync5 } from "node:fs";
-import { join as join21, basename as basename5 } from "node:path";
+import { readFileSync as readFileSync13, existsSync as existsSync20, readdirSync as readdirSync5 } from "node:fs";
+import { join as join20, basename as basename4 } from "node:path";
 
 // src/core/stats/index.ts
 init_json();
@@ -11989,14 +12718,14 @@ init_paths();
 // src/core/system/inject-generate.ts
 init_json();
 init_paths();
-import { readFileSync as readFileSync7, existsSync as existsSync13 } from "node:fs";
-import { join as join13 } from "node:path";
+import { readFileSync as readFileSync6, existsSync as existsSync12 } from "node:fs";
+import { join as join12 } from "node:path";
 async function generateInjection(projectRoot, accessor) {
   let version = "unknown";
   try {
-    const pkgPath = join13(projectRoot, "package.json");
-    if (existsSync13(pkgPath)) {
-      const pkg = JSON.parse(readFileSync7(pkgPath, "utf-8"));
+    const pkgPath = join12(projectRoot, "package.json");
+    if (existsSync12(pkgPath)) {
+      const pkg = JSON.parse(readFileSync6(pkgPath, "utf-8"));
       version = pkg.version || "unknown";
     }
   } catch {
@@ -12011,8 +12740,8 @@ async function generateInjection(projectRoot, accessor) {
   }
   try {
     const sessionsPath = getSessionsPath(projectRoot);
-    if (existsSync13(sessionsPath)) {
-      const sessionsData = JSON.parse(readFileSync7(sessionsPath, "utf-8"));
+    if (existsSync12(sessionsPath)) {
+      const sessionsData = JSON.parse(readFileSync6(sessionsPath, "utf-8"));
       const active = sessionsData.sessions?.find((s) => s.status === "active");
       if (active) {
         activeSessionName = active.name || active.id;
@@ -12093,8 +12822,8 @@ For full protocol details, load the **ct-cleo** skill: \`cleo_query({ domain: "s
 }
 
 // src/core/system/health.ts
-import { existsSync as existsSync15, readFileSync as readFileSync9, statSync as statSync4 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync8, statSync as statSync4 } from "node:fs";
+import { join as join14 } from "node:path";
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
 
@@ -12106,25 +12835,25 @@ init_platform();
 
 // src/core/migration/agent-outputs.ts
 import {
-  existsSync as existsSync14,
-  readFileSync as readFileSync8,
-  writeFileSync as writeFileSync3,
-  mkdirSync as mkdirSync7,
+  existsSync as existsSync13,
+  readFileSync as readFileSync7,
+  writeFileSync as writeFileSync2,
+  mkdirSync as mkdirSync6,
   readdirSync as readdirSync3,
-  copyFileSync,
+  copyFileSync as copyFileSync2,
   statSync as statSync3,
   rmSync
 } from "node:fs";
-import { join as join14 } from "node:path";
+import { join as join13 } from "node:path";
 var CANONICAL_DIR = ".cleo/agent-outputs";
 var MANIFEST_PATH_REWRITES = [
   [/claudedocs\/research-outputs\//g, `${CANONICAL_DIR}/`],
   [/claudedocs\/agent-outputs\//g, `${CANONICAL_DIR}/`]
 ];
 function detectLegacyAgentOutputs(projectRoot, cleoDir) {
-  const hasResearchOutputs = existsSync14(join14(projectRoot, "claudedocs", "research-outputs"));
-  const hasLegacyAgentOutputs = existsSync14(join14(projectRoot, "claudedocs", "agent-outputs"));
-  const hasCanonical = existsSync14(join14(cleoDir, "agent-outputs"));
+  const hasResearchOutputs = existsSync13(join13(projectRoot, "claudedocs", "research-outputs"));
+  const hasLegacyAgentOutputs = existsSync13(join13(projectRoot, "claudedocs", "agent-outputs"));
+  const hasCanonical = existsSync13(join13(cleoDir, "agent-outputs"));
   const legacyPaths = [];
   if (hasResearchOutputs) legacyPaths.push("claudedocs/research-outputs/");
   if (hasLegacyAgentOutputs) legacyPaths.push("claudedocs/agent-outputs/");
@@ -12147,30 +12876,30 @@ function migrateAgentOutputs(projectRoot, cleoDir) {
       summary: "No legacy output directories found"
     };
   }
-  const newDir = join14(cleoDir, "agent-outputs");
+  const newDir = join13(cleoDir, "agent-outputs");
   const hadCanonical = detection.hasCanonical;
-  mkdirSync7(newDir, { recursive: true });
+  mkdirSync6(newDir, { recursive: true });
   let totalCopied = 0;
   const mergedManifestLines = [];
   const copiedFiles = /* @__PURE__ */ new Set();
   const legacySources = [
-    { path: join14(projectRoot, "claudedocs", "research-outputs"), exists: detection.hasResearchOutputs },
-    { path: join14(projectRoot, "claudedocs", "agent-outputs"), exists: detection.hasLegacyAgentOutputs }
+    { path: join13(projectRoot, "claudedocs", "research-outputs"), exists: detection.hasResearchOutputs },
+    { path: join13(projectRoot, "claudedocs", "agent-outputs"), exists: detection.hasLegacyAgentOutputs }
   ];
   for (const source of legacySources) {
     if (!source.exists) continue;
     totalCopied += copyDirContents(source.path, newDir, mergedManifestLines, copiedFiles);
   }
-  const manifestEntries = mergeManifests(newDir, hadCanonical, mergedManifestLines);
+  const manifestEntries2 = mergeManifests(newDir, hadCanonical, mergedManifestLines);
   updateConfigPaths(cleoDir);
   const removed = removeLegacyDirs(projectRoot, detection);
   const parts = [`Migrated ${totalCopied} files \u2192 ${CANONICAL_DIR}/`];
-  if (manifestEntries > 0) parts.push(`merged ${manifestEntries} manifest entries`);
+  if (manifestEntries2 > 0) parts.push(`merged ${manifestEntries2} manifest entries`);
   if (removed.length > 0) parts.push(`removed: ${removed.join(", ")}`);
   return {
     migrated: true,
     filesCopied: totalCopied,
-    manifestEntries,
+    manifestEntries: manifestEntries2,
     removed,
     summary: parts.join("; ")
   };
@@ -12180,19 +12909,19 @@ function copyDirContents(srcDir, dstDir, manifestLines, copiedFiles) {
   const entries = readdirSync3(srcDir);
   for (const entry of entries) {
     if (entry === "MANIFEST.jsonl") {
-      collectManifestLines(join14(srcDir, entry), manifestLines);
+      collectManifestLines(join13(srcDir, entry), manifestLines);
       continue;
     }
-    const srcPath = join14(srcDir, entry);
-    const dstPath = join14(dstDir, entry);
+    const srcPath = join13(srcDir, entry);
+    const dstPath = join13(dstDir, entry);
     try {
       const st = statSync3(srcPath);
       if (st.isDirectory()) {
-        mkdirSync7(dstPath, { recursive: true });
+        mkdirSync6(dstPath, { recursive: true });
         for (const sf of readdirSync3(srcPath)) {
           if (!copiedFiles.has(sf)) {
             try {
-              copyFileSync(join14(srcPath, sf), join14(dstPath, sf));
+              copyFileSync2(join13(srcPath, sf), join13(dstPath, sf));
               copiedFiles.add(sf);
               count2++;
             } catch {
@@ -12200,7 +12929,7 @@ function copyDirContents(srcDir, dstDir, manifestLines, copiedFiles) {
           }
         }
       } else if (!copiedFiles.has(entry)) {
-        copyFileSync(srcPath, dstPath);
+        copyFileSync2(srcPath, dstPath);
         copiedFiles.add(entry);
         count2++;
       }
@@ -12211,7 +12940,7 @@ function copyDirContents(srcDir, dstDir, manifestLines, copiedFiles) {
 }
 function collectManifestLines(manifestPath, out) {
   try {
-    const content = readFileSync8(manifestPath, "utf-8");
+    const content = readFileSync7(manifestPath, "utf-8");
     for (const line of content.split("\n")) {
       if (!line.trim()) continue;
       let rewritten = line;
@@ -12224,11 +12953,11 @@ function collectManifestLines(manifestPath, out) {
   }
 }
 function mergeManifests(newDir, hadCanonical, legacyLines) {
-  const manifestPath = join14(newDir, "MANIFEST.jsonl");
+  const manifestPath = join13(newDir, "MANIFEST.jsonl");
   const existingLines = [];
-  if (hadCanonical && existsSync14(manifestPath)) {
+  if (hadCanonical && existsSync13(manifestPath)) {
     try {
-      const existing = readFileSync8(manifestPath, "utf-8");
+      const existing = readFileSync7(manifestPath, "utf-8");
       for (const line of existing.split("\n")) {
         if (line.trim()) existingLines.push(line);
       }
@@ -12255,15 +12984,15 @@ function mergeManifests(newDir, hadCanonical, legacyLines) {
     finalLines.push(line);
   }
   if (finalLines.length > 0) {
-    writeFileSync3(manifestPath, finalLines.join("\n") + "\n");
+    writeFileSync2(manifestPath, finalLines.join("\n") + "\n");
   }
   return finalLines.length;
 }
 function updateConfigPaths(cleoDir) {
-  const configPath = join14(cleoDir, "config.json");
-  if (!existsSync14(configPath)) return;
+  const configPath = join13(cleoDir, "config.json");
+  if (!existsSync13(configPath)) return;
   try {
-    const config = JSON.parse(readFileSync8(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync7(configPath, "utf-8"));
     const currentDir = config.agentOutputs?.directory ?? config.agentOutputs ?? config.research?.outputDir;
     if (currentDir && currentDir !== CANONICAL_DIR) {
       if (typeof config.agentOutputs === "object") {
@@ -12277,7 +13006,7 @@ function updateConfigPaths(cleoDir) {
           delete config.research;
         }
       }
-      writeFileSync3(configPath, JSON.stringify(config, null, 2));
+      writeFileSync2(configPath, JSON.stringify(config, null, 2));
     }
   } catch {
   }
@@ -12286,20 +13015,20 @@ function removeLegacyDirs(projectRoot, detection) {
   const removed = [];
   if (detection.hasResearchOutputs) {
     try {
-      rmSync(join14(projectRoot, "claudedocs", "research-outputs"), { recursive: true, force: true });
+      rmSync(join13(projectRoot, "claudedocs", "research-outputs"), { recursive: true, force: true });
       removed.push("claudedocs/research-outputs/");
     } catch {
     }
   }
   if (detection.hasLegacyAgentOutputs) {
     try {
-      rmSync(join14(projectRoot, "claudedocs", "agent-outputs"), { recursive: true, force: true });
+      rmSync(join13(projectRoot, "claudedocs", "agent-outputs"), { recursive: true, force: true });
       removed.push("claudedocs/agent-outputs/");
     } catch {
     }
   }
-  const claudedocsDir = join14(projectRoot, "claudedocs");
-  if (existsSync14(claudedocsDir)) {
+  const claudedocsDir = join13(projectRoot, "claudedocs");
+  if (existsSync13(claudedocsDir)) {
     try {
       if (readdirSync3(claudedocsDir).length === 0) {
         rmSync(claudedocsDir, { recursive: true, force: true });
@@ -12316,15 +13045,15 @@ init_data_accessor();
 var execAsync = promisify3(execFile3);
 var STALE_JSON_FILES = ["todo.json", "sessions.json", "todo-archive.json"];
 function getSystemHealth(projectRoot, opts) {
-  const cleoDir = join15(projectRoot, ".cleo");
+  const cleoDir = join14(projectRoot, ".cleo");
   const checks = [];
-  if (existsSync15(cleoDir)) {
+  if (existsSync14(cleoDir)) {
     checks.push({ name: "cleo_dir", status: "pass", message: ".cleo directory exists" });
   } else {
     checks.push({ name: "cleo_dir", status: "fail", message: ".cleo directory not found" });
   }
-  const dbPath = join15(cleoDir, "tasks.db");
-  if (existsSync15(dbPath)) {
+  const dbPath = join14(cleoDir, "tasks.db");
+  if (existsSync14(dbPath)) {
     try {
       const dbSize = statSync4(dbPath).size;
       if (dbSize > 0) {
@@ -12338,10 +13067,10 @@ function getSystemHealth(projectRoot, opts) {
   } else {
     checks.push({ name: "tasks_db", status: "fail", message: "tasks.db not found" });
   }
-  const configPath = join15(cleoDir, "config.json");
-  if (existsSync15(configPath)) {
+  const configPath = join14(cleoDir, "config.json");
+  if (existsSync14(configPath)) {
     try {
-      JSON.parse(readFileSync9(configPath, "utf-8"));
+      JSON.parse(readFileSync8(configPath, "utf-8"));
       checks.push({ name: "config_json", status: "pass", message: "config.json is valid JSON" });
     } catch {
       checks.push({ name: "config_json", status: "warn", message: "config.json is not valid JSON" });
@@ -12349,8 +13078,8 @@ function getSystemHealth(projectRoot, opts) {
   } else {
     checks.push({ name: "config_json", status: "warn", message: "config.json not found" });
   }
-  if (existsSync15(dbPath)) {
-    const staleFiles = STALE_JSON_FILES.filter((f) => existsSync15(join15(cleoDir, f)));
+  if (existsSync14(dbPath)) {
+    const staleFiles = STALE_JSON_FILES.filter((f) => existsSync14(join14(cleoDir, f)));
     if (staleFiles.length > 0) {
       checks.push({
         name: "stale_json",
@@ -12360,14 +13089,14 @@ function getSystemHealth(projectRoot, opts) {
     }
   }
   if (opts?.detailed) {
-    const logPath = join15(cleoDir, "todo-log.jsonl");
-    if (existsSync15(logPath)) {
+    const logPath = join14(cleoDir, "todo-log.jsonl");
+    if (existsSync14(logPath)) {
       checks.push({ name: "log_file", status: "pass", message: "todo-log.jsonl exists" });
     } else {
       checks.push({ name: "log_file", status: "warn", message: "todo-log.jsonl not found" });
     }
-    const backupDir = join15(cleoDir, ".backups");
-    if (existsSync15(backupDir)) {
+    const backupDir = join14(cleoDir, ".backups");
+    if (existsSync14(backupDir)) {
       checks.push({ name: "backups_dir", status: "pass", message: ".backups directory exists" });
     } else {
       checks.push({ name: "backups_dir", status: "pass", message: "No backups directory (created on first write)" });
@@ -12375,9 +13104,9 @@ function getSystemHealth(projectRoot, opts) {
   }
   let version = "unknown";
   try {
-    const pkgPath = join15(projectRoot, "package.json");
-    if (existsSync15(pkgPath)) {
-      const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
+    const pkgPath = join14(projectRoot, "package.json");
+    if (existsSync14(pkgPath)) {
+      const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
       version = pkg.version || "unknown";
     }
   } catch {
@@ -12396,34 +13125,34 @@ init_paths();
 // src/core/system/backup.ts
 init_errors();
 init_exit_codes();
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, existsSync as existsSync16, mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join16 } from "node:path";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync3, existsSync as existsSync15, mkdirSync as mkdirSync7 } from "node:fs";
+import { join as join15 } from "node:path";
 function createBackup2(projectRoot, opts) {
-  const cleoDir = join16(projectRoot, ".cleo");
+  const cleoDir = join15(projectRoot, ".cleo");
   const btype = opts?.type || "snapshot";
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
   const backupId = `${btype}-${timestamp.replace(/[:.]/g, "-")}`;
-  const backupDir = join16(cleoDir, "backups", btype);
-  if (!existsSync16(backupDir)) {
-    mkdirSync8(backupDir, { recursive: true });
+  const backupDir = join15(cleoDir, "backups", btype);
+  if (!existsSync15(backupDir)) {
+    mkdirSync7(backupDir, { recursive: true });
   }
   const filesToBackup = ["todo.json", "todo-archive.json", "sessions.json", "config.json", "todo-log.jsonl"];
   const backedUp = [];
   for (const file of filesToBackup) {
-    const src = join16(cleoDir, file);
-    if (existsSync16(src)) {
-      const dest = join16(backupDir, `${file}.${backupId}`);
+    const src = join15(cleoDir, file);
+    if (existsSync15(src)) {
+      const dest = join15(backupDir, `${file}.${backupId}`);
       try {
-        const content = readFileSync10(src, "utf-8");
-        writeFileSync4(dest, content, "utf-8");
+        const content = readFileSync9(src, "utf-8");
+        writeFileSync3(dest, content, "utf-8");
         backedUp.push(file);
       } catch {
       }
     }
   }
-  const metaPath = join16(backupDir, `${backupId}.meta.json`);
+  const metaPath = join15(backupDir, `${backupId}.meta.json`);
   try {
-    writeFileSync4(metaPath, JSON.stringify({
+    writeFileSync3(metaPath, JSON.stringify({
       backupId,
       type: btype,
       timestamp,
@@ -12438,15 +13167,15 @@ function restoreBackup(projectRoot, params) {
   if (!params.backupId) {
     throw new CleoError(2 /* INVALID_INPUT */, "backupId is required");
   }
-  const cleoDir = join16(projectRoot, ".cleo");
+  const cleoDir = join15(projectRoot, ".cleo");
   const backupTypes = ["snapshot", "safety", "migration"];
   let metaPath = null;
   let backupDir = null;
   for (const btype of backupTypes) {
-    const candidateMeta = join16(cleoDir, "backups", btype, `${params.backupId}.meta.json`);
-    if (existsSync16(candidateMeta)) {
+    const candidateMeta = join15(cleoDir, "backups", btype, `${params.backupId}.meta.json`);
+    if (existsSync15(candidateMeta)) {
       metaPath = candidateMeta;
-      backupDir = join16(cleoDir, "backups", btype);
+      backupDir = join15(cleoDir, "backups", btype);
       break;
     }
   }
@@ -12455,17 +13184,17 @@ function restoreBackup(projectRoot, params) {
   }
   let meta;
   try {
-    meta = JSON.parse(readFileSync10(metaPath, "utf-8"));
+    meta = JSON.parse(readFileSync9(metaPath, "utf-8"));
   } catch {
     throw new CleoError(3 /* FILE_ERROR */, "Failed to read backup metadata");
   }
   const restored = [];
   for (const file of meta.files ?? []) {
-    const backupFile = join16(backupDir, `${file}.${params.backupId}`);
-    if (existsSync16(backupFile)) {
+    const backupFile = join15(backupDir, `${file}.${params.backupId}`);
+    if (existsSync15(backupFile)) {
       try {
-        const content = readFileSync10(backupFile, "utf-8");
-        writeFileSync4(join16(cleoDir, file), content, "utf-8");
+        const content = readFileSync9(backupFile, "utf-8");
+        writeFileSync3(join15(cleoDir, file), content, "utf-8");
         restored.push(file);
       } catch {
       }
@@ -12482,14 +13211,14 @@ function restoreBackup(projectRoot, params) {
 // src/core/system/migrate.ts
 init_errors();
 init_exit_codes();
-import { readFileSync as readFileSync11, existsSync as existsSync17 } from "node:fs";
-import { join as join17 } from "node:path";
+import { readFileSync as readFileSync10, existsSync as existsSync16 } from "node:fs";
+import { join as join16 } from "node:path";
 function getMigrationStatus(projectRoot, opts) {
-  const taskPath = join17(projectRoot, ".cleo", "tasks.json");
+  const taskPath = join16(projectRoot, ".cleo", "tasks.json");
   let currentVersion = "unknown";
-  if (existsSync17(taskPath)) {
+  if (existsSync16(taskPath)) {
     try {
-      const taskFile = JSON.parse(readFileSync11(taskPath, "utf-8"));
+      const taskFile = JSON.parse(readFileSync10(taskPath, "utf-8"));
       currentVersion = taskFile._meta?.schemaVersion ?? taskFile.version ?? "unknown";
     } catch {
       throw new CleoError(3 /* FILE_ERROR */, "Failed to read tasks.json");
@@ -12509,21 +13238,21 @@ function getMigrationStatus(projectRoot, opts) {
 // src/core/system/cleanup.ts
 init_errors();
 init_exit_codes();
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync5, existsSync as existsSync18, readdirSync as readdirSync4, unlinkSync as unlinkSync4 } from "node:fs";
-import { join as join18 } from "node:path";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync4, existsSync as existsSync17, readdirSync as readdirSync4, unlinkSync as unlinkSync4 } from "node:fs";
+import { join as join17 } from "node:path";
 function cleanupSystem(projectRoot, params) {
   if (!params.target) {
     throw new CleoError(2 /* INVALID_INPUT */, "target is required (sessions|backups|logs|archive)");
   }
-  const cleoDir = join18(projectRoot, ".cleo");
+  const cleoDir = join17(projectRoot, ".cleo");
   const dryRun = params.dryRun ?? false;
   const items = [];
   switch (params.target) {
     case "sessions": {
-      const sessPath = join18(cleoDir, "sessions.json");
-      if (existsSync18(sessPath)) {
+      const sessPath = join17(cleoDir, "sessions.json");
+      if (existsSync17(sessPath)) {
         try {
-          const data = JSON.parse(readFileSync12(sessPath, "utf-8"));
+          const data = JSON.parse(readFileSync11(sessPath, "utf-8"));
           const sessions2 = data.sessions ?? [];
           const stale = sessions2.filter((s) => {
             if (s.status !== "active") return false;
@@ -12539,7 +13268,7 @@ function cleanupSystem(projectRoot, params) {
           if (!dryRun && stale.length > 0) {
             const staleIds = new Set(stale.map((s) => s.id));
             data.sessions = sessions2.filter((s) => !staleIds.has(s.id));
-            writeFileSync5(sessPath, JSON.stringify(data, null, 2), "utf-8");
+            writeFileSync4(sessPath, JSON.stringify(data, null, 2), "utf-8");
           }
         } catch {
         }
@@ -12547,16 +13276,16 @@ function cleanupSystem(projectRoot, params) {
       break;
     }
     case "backups": {
-      const backupBaseDir = join18(cleoDir, "backups");
-      if (existsSync18(backupBaseDir)) {
+      const backupBaseDir = join17(cleoDir, "backups");
+      if (existsSync17(backupBaseDir)) {
         for (const typeDir of readdirSync4(backupBaseDir)) {
-          const fullDir = join18(backupBaseDir, typeDir);
+          const fullDir = join17(backupBaseDir, typeDir);
           try {
             for (const file of readdirSync4(fullDir)) {
               if (file.endsWith(".meta.json")) {
-                const metaFilePath = join18(fullDir, file);
+                const metaFilePath = join17(fullDir, file);
                 try {
-                  const meta = JSON.parse(readFileSync12(metaFilePath, "utf-8"));
+                  const meta = JSON.parse(readFileSync11(metaFilePath, "utf-8"));
                   if (params.olderThan && meta.timestamp < params.olderThan) {
                     items.push(file.replace(".meta.json", ""));
                     if (!dryRun) {
@@ -12564,7 +13293,7 @@ function cleanupSystem(projectRoot, params) {
                       for (const bf of readdirSync4(fullDir)) {
                         if (bf.includes(meta.backupId)) {
                           try {
-                            unlinkSync4(join18(fullDir, bf));
+                            unlinkSync4(join17(fullDir, bf));
                           } catch {
                           }
                         }
@@ -12583,13 +13312,13 @@ function cleanupSystem(projectRoot, params) {
     }
     case "logs": {
       const auditPattern = /^audit-log-.*\.json$/;
-      if (existsSync18(cleoDir)) {
+      if (existsSync17(cleoDir)) {
         for (const file of readdirSync4(cleoDir)) {
           if (auditPattern.test(file)) {
             items.push(file);
             if (!dryRun) {
               try {
-                unlinkSync4(join18(cleoDir, file));
+                unlinkSync4(join17(cleoDir, file));
               } catch {
               }
             }
@@ -12607,17 +13336,17 @@ function cleanupSystem(projectRoot, params) {
 // src/core/system/safestop.ts
 init_errors();
 init_exit_codes();
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync6, existsSync as existsSync19 } from "node:fs";
-import { join as join19 } from "node:path";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync5, existsSync as existsSync18 } from "node:fs";
+import { join as join18 } from "node:path";
 function safestop(projectRoot, opts) {
   const dryRun = opts?.dryRun ?? false;
   const reason = opts?.reason ?? "Manual safestop";
   let sessionEnded = false;
   if (!dryRun && !opts?.noSessionEnd) {
-    const sessPath = join19(projectRoot, ".cleo", "sessions.json");
-    if (existsSync19(sessPath)) {
+    const sessPath = join18(projectRoot, ".cleo", "sessions.json");
+    if (existsSync18(sessPath)) {
       try {
-        const data = JSON.parse(readFileSync13(sessPath, "utf-8"));
+        const data = JSON.parse(readFileSync12(sessPath, "utf-8"));
         const sessions2 = data.sessions ?? [];
         let changed = false;
         for (const s of sessions2) {
@@ -12630,7 +13359,7 @@ function safestop(projectRoot, opts) {
           }
         }
         if (changed) {
-          writeFileSync6(sessPath, JSON.stringify(data, null, 2), "utf-8");
+          writeFileSync5(sessPath, JSON.stringify(data, null, 2), "utf-8");
         }
       } catch {
       }
@@ -12643,9 +13372,9 @@ function safestop(projectRoot, opts) {
 init_sequence();
 
 // src/core/system/runtime.ts
-import { existsSync as existsSync20 } from "node:fs";
+import { existsSync as existsSync19 } from "node:fs";
 import { readFile as readFile3 } from "node:fs/promises";
-import { basename as basename4, join as join20 } from "node:path";
+import { basename as basename3, join as join19 } from "node:path";
 import { homedir as homedir2 } from "node:os";
 import { execFile as execFile4 } from "node:child_process";
 import { promisify as promisify4 } from "node:util";
@@ -12679,8 +13408,8 @@ function getExpectedNaming(channel) {
   }
 }
 async function parseVersionFile(dataRoot) {
-  const versionPath = join20(dataRoot, "VERSION");
-  if (!existsSync20(versionPath)) return null;
+  const versionPath = join19(dataRoot, "VERSION");
+  if (!existsSync19(versionPath)) return null;
   let content;
   try {
     content = await readFile3(versionPath, "utf-8");
@@ -12709,9 +13438,9 @@ async function parseVersionFile(dataRoot) {
 async function getPackageInfo(sourceDir) {
   const candidates = [];
   if (sourceDir && sourceDir !== "unknown" && sourceDir !== "npm") {
-    candidates.push(join20(sourceDir, "package.json"));
+    candidates.push(join19(sourceDir, "package.json"));
   }
-  candidates.push(join20(process.cwd(), "package.json"));
+  candidates.push(join19(process.cwd(), "package.json"));
   for (const candidate of candidates) {
     try {
       const raw = await readFile3(candidate, "utf-8");
@@ -12735,9 +13464,9 @@ async function resolveBinaryPath(name) {
 }
 async function getRuntimeDiagnostics(options) {
   const scriptPath = process.argv[1] ?? "";
-  const invocationName = basename4(scriptPath || process.argv0 || "cleo");
+  const invocationName = basename3(scriptPath || process.argv0 || "cleo");
   const envChannel = normalizeChannel(process.env["CLEO_CHANNEL"]);
-  const dataRoot = process.env["CLEO_HOME"] ?? join20(homedir2(), ".cleo");
+  const dataRoot = process.env["CLEO_HOME"] ?? join19(homedir2(), ".cleo");
   const versionInfo = await parseVersionFile(dataRoot);
   const packageInfo = await getPackageInfo(versionInfo?.source);
   const channel = envChannel ?? detectFromInvocation(invocationName) ?? normalizeChannel(versionInfo?.version.includes("-beta") ? "beta" : void 0) ?? detectFromDataRoot(dataRoot) ?? normalizeChannel(versionInfo?.mode.startsWith("dev") ? "dev" : void 0) ?? "stable";
@@ -12952,10 +13681,10 @@ async function systemLog(projectRoot, filters) {
 }
 async function queryAuditLogSqlite(projectRoot, filters) {
   try {
-    const { join: join46 } = await import("node:path");
-    const { existsSync: existsSync45 } = await import("node:fs");
-    const dbPath = join46(projectRoot, ".cleo", "tasks.db");
-    if (!existsSync45(dbPath)) return null;
+    const { join: join45 } = await import("node:path");
+    const { existsSync: existsSync44 } = await import("node:fs");
+    const dbPath = join45(projectRoot, ".cleo", "tasks.db");
+    if (!existsSync44(dbPath)) return null;
     const { getDb: getDb2 } = await Promise.resolve().then(() => (init_sqlite(), sqlite_exports));
     const { auditLog: auditLog2 } = await Promise.resolve().then(() => (init_schema(), schema_exports));
     const { sql: sql4 } = await import("drizzle-orm");
@@ -13020,8 +13749,8 @@ async function queryAuditLogSqlite(projectRoot, filters) {
   }
 }
 function queryAuditLogJsonl(projectRoot, filters) {
-  const logPath = getDataPath2(projectRoot, "todo-log.jsonl");
-  const raw = readLogFileEntries2(logPath);
+  const logPath = getDataPath(projectRoot, "todo-log.jsonl");
+  const raw = readLogFileEntries(logPath);
   let entries = raw;
   if (filters?.operation) {
     entries = entries.filter((e) => e.operation === filters.operation);
@@ -13050,34 +13779,34 @@ function queryAuditLogJsonl(projectRoot, filters) {
 }
 function systemContext(projectRoot, params) {
   try {
-    const cleoDir = join21(projectRoot, ".cleo");
+    const cleoDir = join20(projectRoot, ".cleo");
     let stateFile;
     if (params?.session) {
-      const sessionFile = join21(cleoDir, "context-states", `context-state-${params.session}.json`);
-      stateFile = existsSync21(sessionFile) ? sessionFile : join21(cleoDir, ".context-state.json");
+      const sessionFile = join20(cleoDir, "context-states", `context-state-${params.session}.json`);
+      stateFile = existsSync20(sessionFile) ? sessionFile : join20(cleoDir, ".context-state.json");
     } else {
-      const currentSessionPath = join21(cleoDir, ".current-session");
-      if (existsSync21(currentSessionPath)) {
-        const currentSession = readFileSync14(currentSessionPath, "utf-8").trim();
+      const currentSessionPath = join20(cleoDir, ".current-session");
+      if (existsSync20(currentSessionPath)) {
+        const currentSession = readFileSync13(currentSessionPath, "utf-8").trim();
         if (currentSession) {
-          const sessionFile = join21(cleoDir, "context-states", `context-state-${currentSession}.json`);
-          stateFile = existsSync21(sessionFile) ? sessionFile : join21(cleoDir, ".context-state.json");
+          const sessionFile = join20(cleoDir, "context-states", `context-state-${currentSession}.json`);
+          stateFile = existsSync20(sessionFile) ? sessionFile : join20(cleoDir, ".context-state.json");
         } else {
-          stateFile = join21(cleoDir, ".context-state.json");
+          stateFile = join20(cleoDir, ".context-state.json");
         }
       } else {
-        stateFile = join21(cleoDir, ".context-state.json");
+        stateFile = join20(cleoDir, ".context-state.json");
       }
     }
     const sessions2 = [];
-    const statesDir = join21(cleoDir, "context-states");
-    if (existsSync21(statesDir)) {
+    const statesDir = join20(cleoDir, "context-states");
+    if (existsSync20(statesDir)) {
       for (const file of readdirSync5(statesDir)) {
         if (file.startsWith("context-state-") && file.endsWith(".json")) {
           try {
-            const state = JSON.parse(readFileSync14(join21(statesDir, file), "utf-8"));
+            const state = JSON.parse(readFileSync13(join20(statesDir, file), "utf-8"));
             sessions2.push({
-              file: basename5(file),
+              file: basename4(file),
               sessionId: state.sessionId ?? null,
               percentage: state.contextWindow?.percentage ?? 0,
               status: state.status ?? "unknown",
@@ -13088,10 +13817,10 @@ function systemContext(projectRoot, params) {
         }
       }
     }
-    const singletonFile = join21(cleoDir, ".context-state.json");
-    if (existsSync21(singletonFile)) {
+    const singletonFile = join20(cleoDir, ".context-state.json");
+    if (existsSync20(singletonFile)) {
       try {
-        const state = JSON.parse(readFileSync14(singletonFile, "utf-8"));
+        const state = JSON.parse(readFileSync13(singletonFile, "utf-8"));
         sessions2.push({
           file: ".context-state.json",
           sessionId: state.sessionId ?? "global",
@@ -13102,7 +13831,7 @@ function systemContext(projectRoot, params) {
       } catch {
       }
     }
-    if (!existsSync21(stateFile)) {
+    if (!existsSync20(stateFile)) {
       return {
         success: true,
         data: {
@@ -13118,7 +13847,7 @@ function systemContext(projectRoot, params) {
       };
     }
     try {
-      const state = JSON.parse(readFileSync14(stateFile, "utf-8"));
+      const state = JSON.parse(readFileSync13(stateFile, "utf-8"));
       const timestamp = state.timestamp;
       const staleMs = state.staleAfterMs ?? 5e3;
       const percentage = state.contextWindow?.percentage ?? 0;
@@ -13313,8 +14042,8 @@ init_json();
 init_json();
 init_paths();
 import { chmod, mkdir as mkdir5, access as access2, writeFile as writeFile3, readFile as readFile5, copyFile as copyFile2, symlink, lstat, unlink as unlink3 } from "node:fs/promises";
-import { constants as fsConstants, existsSync as existsSync24, readFileSync as readFileSync17, readdirSync as readdirSync7 } from "node:fs";
-import { join as join26, resolve as resolve4, basename as basename6, dirname as dirname8 } from "node:path";
+import { constants as fsConstants, existsSync as existsSync23, readFileSync as readFileSync16, readdirSync as readdirSync7 } from "node:fs";
+import { join as join25, resolve as resolve5, basename as basename5, dirname as dirname7 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { createHash as createHash5 } from "node:crypto";
 import { homedir as homedir4 } from "node:os";
@@ -13330,7 +14059,7 @@ async function fileExists(path) {
   }
 }
 async function stripCLEOBlocks(filePath) {
-  if (!existsSync24(filePath)) return;
+  if (!existsSync23(filePath)) return;
   const content = await readFile5(filePath, "utf8");
   const stripped = content.replace(
     /\n?<!-- CLEO:START -->[\s\S]*?<!-- CLEO:END -->\n?/g,
@@ -13366,31 +14095,67 @@ function createDefaultConfig() {
 }
 function getPackageRoot() {
   const thisFile = fileURLToPath3(import.meta.url);
-  return resolve4(dirname8(thisFile), "..", "..");
+  return resolve5(dirname7(thisFile), "..", "..");
 }
 function getGitignoreContent() {
   try {
     const packageRoot = getPackageRoot();
-    const templatePath = join26(packageRoot, "templates", "cleo-gitignore");
-    if (existsSync24(templatePath)) {
-      return readFileSync17(templatePath, "utf-8");
+    const templatePath = join25(packageRoot, "templates", "cleo-gitignore");
+    if (existsSync23(templatePath)) {
+      return readFileSync16(templatePath, "utf-8");
     }
   } catch {
   }
   return CLEO_GITIGNORE_FALLBACK;
 }
-var CLEO_GITIGNORE_FALLBACK = `# CLEO Project Data - Selective Git Tracking
-# Tracked via STATE_FILES: config.json, project-info.json, project-context.json, adrs/, agent-outputs/
-# agent-outputs/ is intentionally tracked (research outputs, ADR evidence)
-logs/
-audit-log*.json
-tasks.db
-tasks.db-shm
-tasks.db-wal
-.git/
+var CLEO_GITIGNORE_FALLBACK = `# .cleo/.gitignore \u2014 Deny-by-default for CLEO project data
+# Ignore everything, then explicitly allow only tracked files.
+
+# Step 1: Ignore everything
+*
+
+# Allow list
+!.gitignore
+!config.json
+!project-context.json
+!project-info.json
+!setup-otel.sh
+!DATA-SAFETY-IMPLEMENTATION-SUMMARY.md
+!schemas/
+!schemas/**
+!templates/
+!templates/**
+!adrs/
+!adrs/**
+!rcasd/
+!rcasd/**
+!agent-outputs/
+!agent-outputs/**
+
+# Explicit deny safety net
+*.db
+*.db-shm
+*.db-wal
+*.db-journal
+log.json
+tasks-log.jsonl
+todo-log.jsonl
+bypass-log.json
+qa-log.json
+.deps-cache/
+.context-alert-state.json
+.context-state*.json
+context-states/
+.git-checkpoint-state
+.migration-state.json
+migrations.json
+sync/
+metrics/
+.backups/
+backups/
 `;
 async function removeCleoFromRootGitignore(projectRoot) {
-  const rootGitignorePath = join26(projectRoot, ".gitignore");
+  const rootGitignorePath = join25(projectRoot, ".gitignore");
   if (!await fileExists(rootGitignorePath)) {
     return false;
   }
@@ -13411,8 +14176,8 @@ function generateProjectHash2(projectPath) {
 }
 function getCleoVersion() {
   try {
-    const pkgPath = join26(getPackageRoot(), "package.json");
-    const pkg = JSON.parse(readFileSync17(pkgPath, "utf-8"));
+    const pkgPath = join25(getPackageRoot(), "package.json");
+    const pkg = JSON.parse(readFileSync16(pkgPath, "utf-8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -13420,9 +14185,9 @@ function getCleoVersion() {
 }
 function getInjectionTemplateContent() {
   const packageRoot = getPackageRoot();
-  const packageTemplatePath = join26(packageRoot, "templates", "CLEO-INJECTION.md");
-  if (existsSync24(packageTemplatePath)) {
-    return readFileSync17(packageTemplatePath, "utf-8");
+  const packageTemplatePath = join25(packageRoot, "templates", "CLEO-INJECTION.md");
+  if (existsSync23(packageTemplatePath)) {
+    return readFileSync16(packageTemplatePath, "utf-8");
   }
   return null;
 }
@@ -13435,27 +14200,27 @@ async function initCoreFiles(cleoDir, _projectName, force, created, skipped) {
     await saveJson(configPath, createDefaultConfig());
     created.push("config.json");
   }
-  const legacySequencePath = join26(cleoDir, ".sequence");
+  const legacySequencePath = join25(cleoDir, ".sequence");
   try {
     await unlink3(legacySequencePath);
   } catch {
   }
-  const legacySequenceJsonPath = join26(cleoDir, ".sequence.json");
+  const legacySequenceJsonPath = join25(cleoDir, ".sequence.json");
   try {
     await unlink3(legacySequenceJsonPath);
   } catch {
   }
-  const backupDir = join26(cleoDir, "backups");
-  await mkdir5(join26(backupDir, "operational"), { recursive: true });
-  await mkdir5(join26(backupDir, "safety"), { recursive: true });
+  const backupDir = join25(cleoDir, "backups");
+  await mkdir5(join25(backupDir, "operational"), { recursive: true });
+  await mkdir5(join25(backupDir, "safety"), { recursive: true });
   try {
     const { getDb: getDb2 } = await Promise.resolve().then(() => (init_sqlite(), sqlite_exports));
-    await getDb2(join26(cleoDir, ".."));
+    await getDb2(join25(cleoDir, ".."));
     created.push("tasks.db");
   } catch (err) {
     created.push(`tasks.db (deferred: ${err instanceof Error ? err.message : String(err)})`);
   }
-  const gitignorePath = join26(cleoDir, ".gitignore");
+  const gitignorePath = join25(cleoDir, ".gitignore");
   if (await fileExists(gitignorePath) && !force) {
     skipped.push(".gitignore");
   } else {
@@ -13464,8 +14229,8 @@ async function initCoreFiles(cleoDir, _projectName, force, created, skipped) {
   }
 }
 async function initCleoGitRepo(cleoDir, created, warnings) {
-  const cleoGitDir = join26(cleoDir, ".git");
-  if (existsSync24(cleoGitDir)) {
+  const cleoGitDir = join25(cleoDir, ".git");
+  if (existsSync23(cleoGitDir)) {
     return;
   }
   const gitEnv = {
@@ -13483,11 +14248,11 @@ async function initCleoGitRepo(cleoDir, created, warnings) {
   }
 }
 async function initSchemas(cleoDir, force, created, warnings) {
-  const schemasDir = join26(cleoDir, "schemas");
+  const schemasDir = join25(cleoDir, "schemas");
   await mkdir5(schemasDir, { recursive: true });
   const packageRoot = getPackageRoot();
-  const sourceSchemaDir = join26(packageRoot, "schemas");
-  if (!existsSync24(sourceSchemaDir)) {
+  const sourceSchemaDir = join25(packageRoot, "schemas");
+  if (!existsSync23(sourceSchemaDir)) {
     warnings.push("schemas/ directory not found in package root, skipping schema installation");
     return;
   }
@@ -13498,9 +14263,9 @@ async function initSchemas(cleoDir, force, created, warnings) {
   ];
   let copiedCount = 0;
   for (const schemaFile of coreSchemas) {
-    const sourcePath = join26(sourceSchemaDir, schemaFile);
-    const destPath = join26(schemasDir, schemaFile);
-    if (!existsSync24(sourcePath)) {
+    const sourcePath = join25(sourceSchemaDir, schemaFile);
+    const destPath = join25(schemasDir, schemaFile);
+    if (!existsSync23(sourcePath)) {
       continue;
     }
     if (await fileExists(destPath) && !force) {
@@ -13518,27 +14283,27 @@ async function initSchemas(cleoDir, force, created, warnings) {
   }
 }
 async function initGitHooks(projRoot, force, created, warnings) {
-  const gitHooksDir = join26(projRoot, ".git", "hooks");
-  if (!existsSync24(join26(projRoot, ".git"))) {
+  const gitHooksDir = join25(projRoot, ".git", "hooks");
+  if (!existsSync23(join25(projRoot, ".git"))) {
     warnings.push("No .git/ directory found, skipping git hook installation");
     return;
   }
   await mkdir5(gitHooksDir, { recursive: true });
   const packageRoot = getPackageRoot();
-  const sourceDir = join26(packageRoot, "templates", "git-hooks");
-  if (!existsSync24(sourceDir)) {
+  const sourceDir = join25(packageRoot, "templates", "git-hooks");
+  if (!existsSync23(sourceDir)) {
     warnings.push("templates/git-hooks/ not found in package root, skipping git hook installation");
     return;
   }
   const hooks = ["commit-msg", "pre-commit"];
   let installedCount = 0;
   for (const hook of hooks) {
-    const sourcePath = join26(sourceDir, hook);
-    const destPath = join26(gitHooksDir, hook);
-    if (!existsSync24(sourcePath)) {
+    const sourcePath = join25(sourceDir, hook);
+    const destPath = join25(gitHooksDir, hook);
+    if (!existsSync23(sourcePath)) {
       continue;
     }
-    if (existsSync24(destPath) && !force) {
+    if (existsSync23(destPath) && !force) {
       continue;
     }
     try {
@@ -13554,7 +14319,7 @@ async function initGitHooks(projRoot, force, created, warnings) {
   }
 }
 async function initProjectInfo(cleoDir, projectRoot, force, created, skipped) {
-  const projectInfoPath = join26(cleoDir, "project-info.json");
+  const projectInfoPath = join25(cleoDir, "project-info.json");
   if (await fileExists(projectInfoPath) && !force) {
     skipped.push("project-info.json");
     return;
@@ -13603,40 +14368,40 @@ async function initInjection(projectRoot, created, warnings) {
       return;
     }
     for (const provider of providers) {
-      const instructFile = join26(projectRoot, provider.pathProject, provider.instructFile);
+      const instructFile = join25(projectRoot, provider.pathProject, provider.instructFile);
       await stripCLEOBlocks(instructFile);
     }
-    await stripCLEOBlocks(join26(projectRoot, "AGENTS.md"));
+    await stripCLEOBlocks(join25(projectRoot, "AGENTS.md"));
     const injectionContent = buildInjectionContent2({ references: ["@AGENTS.md"] });
     const results = await injectAll2(providers, projectRoot, "project", injectionContent);
     const injected = [];
     for (const [filePath, action] of results) {
-      const fileName = basename6(filePath);
+      const fileName = basename5(filePath);
       injected.push(`${fileName} (${action})`);
     }
     if (injected.length > 0) {
       created.push(`injection: ${injected.join(", ")}`);
     }
-    const agentsMdPath = join26(projectRoot, "AGENTS.md");
+    const agentsMdPath = join25(projectRoot, "AGENTS.md");
     const agentsMdLines = ["@~/.cleo/templates/CLEO-INJECTION.md"];
-    const projectContextPath = join26(projectRoot, ".cleo", "project-context.json");
-    if (existsSync24(projectContextPath)) {
+    const projectContextPath = join25(projectRoot, ".cleo", "project-context.json");
+    if (existsSync23(projectContextPath)) {
       agentsMdLines.push("@.cleo/project-context.json");
     }
     const agentsAction = await inject(agentsMdPath, agentsMdLines.join("\n"));
     created.push(`AGENTS.md CLEO content (${agentsAction})`);
     const content = getInjectionTemplateContent();
     if (content) {
-      const globalTemplatesDir = join26(getCleoHome(), "templates");
+      const globalTemplatesDir = join25(getCleoHome(), "templates");
       await mkdir5(globalTemplatesDir, { recursive: true });
-      const globalPath = join26(globalTemplatesDir, "CLEO-INJECTION.md");
-      if (!existsSync24(globalPath)) {
+      const globalPath = join25(globalTemplatesDir, "CLEO-INJECTION.md");
+      if (!existsSync23(globalPath)) {
         await writeFile3(globalPath, content);
       }
     }
     try {
-      const globalAgentsDir = join26(homedir4(), ".agents");
-      const globalAgentsMd = join26(globalAgentsDir, "AGENTS.md");
+      const globalAgentsDir = join25(homedir4(), ".agents");
+      const globalAgentsMd = join25(globalAgentsDir, "AGENTS.md");
       await mkdir5(globalAgentsDir, { recursive: true });
       await inject(globalAgentsMd, "@~/.cleo/templates/CLEO-INJECTION.md");
     } catch {
@@ -13647,13 +14412,13 @@ async function initInjection(projectRoot, created, warnings) {
 }
 async function initAgentDefinition(created, warnings) {
   const packageRoot = getPackageRoot();
-  const agentSourceDir = join26(packageRoot, "agents", "cleo-subagent");
-  if (!existsSync24(agentSourceDir)) {
+  const agentSourceDir = join25(packageRoot, "agents", "cleo-subagent");
+  if (!existsSync23(agentSourceDir)) {
     warnings.push("agents/cleo-subagent/ not found in package, skipping agent definition install");
     return;
   }
-  const globalAgentsDir = join26(homedir4(), ".agents", "agents", "cleo-subagent");
-  await mkdir5(dirname8(globalAgentsDir), { recursive: true });
+  const globalAgentsDir = join25(homedir4(), ".agents", "agents", "cleo-subagent");
+  await mkdir5(dirname7(globalAgentsDir), { recursive: true });
   try {
     try {
       const stat2 = await lstat(globalAgentsDir);
@@ -13669,7 +14434,7 @@ async function initAgentDefinition(created, warnings) {
       await mkdir5(globalAgentsDir, { recursive: true });
       const files = readdirSync7(agentSourceDir);
       for (const file of files) {
-        await copyFile2(join26(agentSourceDir, file), join26(globalAgentsDir, file));
+        await copyFile2(join25(agentSourceDir, file), join25(globalAgentsDir, file));
       }
       created.push("agent: cleo-subagent (copied)");
     } catch (copyErr) {
@@ -13721,12 +14486,12 @@ async function initCoreSkills(created, warnings) {
     let ctSkillsRoot = null;
     try {
       const packageRoot = getPackageRoot();
-      const bundledPath = join26(packageRoot, "packages", "ct-skills");
-      if (existsSync24(join26(bundledPath, "skills.json"))) {
+      const bundledPath = join25(packageRoot, "packages", "ct-skills");
+      if (existsSync23(join25(bundledPath, "skills.json"))) {
         ctSkillsRoot = bundledPath;
       } else {
-        const ctSkillsPath = join26(packageRoot, "node_modules", "@cleocode", "ct-skills");
-        if (existsSync24(join26(ctSkillsPath, "skills.json"))) {
+        const ctSkillsPath = join25(packageRoot, "node_modules", "@cleocode", "ct-skills");
+        if (existsSync23(join25(ctSkillsPath, "skills.json"))) {
           ctSkillsRoot = ctSkillsPath;
         }
       }
@@ -13741,14 +14506,14 @@ async function initCoreSkills(created, warnings) {
     } catch {
       warnings.push("Failed to register skill library with CAAMP");
     }
-    const catalogPath = join26(ctSkillsRoot, "skills.json");
-    const catalog2 = JSON.parse(readFileSync17(catalogPath, "utf-8"));
+    const catalogPath = join25(ctSkillsRoot, "skills.json");
+    const catalog2 = JSON.parse(readFileSync16(catalogPath, "utf-8"));
     const skills = catalog2.skills ?? [];
     const coreSkills = skills.filter((s) => s.tier <= 2);
     const installed = [];
     for (const skill of coreSkills) {
-      const skillSourceDir = dirname8(join26(ctSkillsRoot, skill.path));
-      if (!existsSync24(skillSourceDir)) {
+      const skillSourceDir = dirname7(join25(ctSkillsRoot, skill.path));
+      if (!existsSync23(skillSourceDir)) {
         continue;
       }
       try {
@@ -13783,7 +14548,7 @@ async function initProjectDetect(cleoDir, projectRoot, created, warnings) {
   try {
     const { detectProjectType: detectProjectType2 } = await Promise.resolve().then(() => (init_project_detect(), project_detect_exports));
     const info = detectProjectType2(projectRoot);
-    const contextPath = join26(cleoDir, "project-context.json");
+    const contextPath = join25(cleoDir, "project-context.json");
     const context = {
       ...info,
       detectedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -13856,8 +14621,8 @@ async function initProject(opts = {}) {
 async function getVersion(projectRoot) {
   const root = projectRoot ?? getProjectRoot();
   const versionPaths = [
-    join26(root, "VERSION"),
-    join26(root, "..", "VERSION")
+    join25(root, "VERSION"),
+    join25(root, "..", "VERSION")
   ];
   for (const versionPath of versionPaths) {
     try {
@@ -13869,7 +14634,7 @@ async function getVersion(projectRoot) {
     } catch {
     }
   }
-  const pkg = await readJson(join26(root, "package.json"));
+  const pkg = await readJson(join25(root, "package.json"));
   if (pkg?.version) {
     return { version: pkg.version };
   }
@@ -13912,8 +14677,8 @@ async function getVersion2(projectRoot) {
 init_paths();
 init_file_utils();
 init_schema();
-import { existsSync as existsSync25, mkdirSync as mkdirSync9, readdirSync as readdirSync8 } from "node:fs";
-import { join as join27 } from "node:path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync8, readdirSync as readdirSync8 } from "node:fs";
+import { join as join26 } from "node:path";
 
 // src/core/lifecycle/stages.ts
 var PIPELINE_STAGES = [
@@ -14059,7 +14824,7 @@ var DEFAULT_LIFECYCLE_DATA_DIR = "rcasd";
 function resolveLifecycleDir(epicId, cwd) {
   const cleoDir = getCleoDirAbsolute(cwd);
   for (const dirName of LIFECYCLE_DATA_DIRS) {
-    if (existsSync25(join27(cleoDir, dirName, epicId))) {
+    if (existsSync24(join26(cleoDir, dirName, epicId))) {
       return dirName;
     }
   }
@@ -14068,18 +14833,18 @@ function resolveLifecycleDir(epicId, cwd) {
 function getRcsdDir(epicId, cwd) {
   const cleoDir = getCleoDirAbsolute(cwd);
   const dirName = resolveLifecycleDir(epicId, cwd);
-  return join27(cleoDir, dirName, epicId);
+  return join26(cleoDir, dirName, epicId);
 }
 function getRcsdManifestPath(epicId, cwd) {
-  return join27(getRcsdDir(epicId, cwd), "_manifest.json");
+  return join26(getRcsdDir(epicId, cwd), "_manifest.json");
 }
 function readManifestSync(epicId, cwd) {
-  return readJsonFile2(getRcsdManifestPath(epicId, cwd));
+  return readJsonFile(getRcsdManifestPath(epicId, cwd));
 }
 function writeManifestSync(epicId, manifest, cwd) {
   const dir = getRcsdDir(epicId, cwd);
-  if (!existsSync25(dir)) {
-    mkdirSync9(dir, { recursive: true });
+  if (!existsSync24(dir)) {
+    mkdirSync8(dir, { recursive: true });
   }
   writeJsonFileAtomic(getRcsdManifestPath(epicId, cwd), manifest);
 }
@@ -14533,16 +15298,16 @@ init_platform();
 // src/core/validation/validate-ops.ts
 init_paths();
 init_data_accessor();
-import { readFileSync as readFileSync19, existsSync as existsSync27, appendFileSync as appendFileSync3, mkdirSync as mkdirSync10 } from "node:fs";
+import { readFileSync as readFileSync18, existsSync as existsSync26, appendFileSync as appendFileSync3, mkdirSync as mkdirSync9 } from "node:fs";
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { join as join29, dirname as dirname9, resolve as resolve5 } from "node:path";
+import { join as join28, dirname as dirname8, resolve as resolve6 } from "node:path";
 
-// src/mcp/engine/schema-validator.ts
+// src/core/validation/schema-validator.ts
 init_validation_schemas();
 import AjvModule2 from "ajv";
 import addFormatsModule2 from "ajv-formats";
-import { readFileSync as readFileSync18, existsSync as existsSync26 } from "fs";
-import { join as join28 } from "path";
+import { readFileSync as readFileSync17, existsSync as existsSync25 } from "fs";
+import { join as join27 } from "path";
 var Ajv2 = AjvModule2.default || AjvModule2;
 var addFormats2 = addFormatsModule2.default || addFormatsModule2;
 var schemaCache2 = /* @__PURE__ */ new Map();
@@ -14566,14 +15331,14 @@ function resolveSchemaPath2(schemaType) {
   const filename = `${schemaType}.schema.json`;
   const projectRoot = process.env.CLEO_ROOT || process.cwd();
   const paths = [
-    join28(projectRoot, "schemas", filename),
-    join28(__dirname, "..", "..", "..", "schemas", filename),
-    // relative from dist/mcp/engine/
-    join28(__dirname, "..", "..", "schemas", filename)
-    // relative from dist/mcp/
+    join27(projectRoot, "schemas", filename),
+    join27(__dirname, "..", "..", "..", "schemas", filename),
+    // relative from dist/core/validation/
+    join27(__dirname, "..", "..", "schemas", filename)
+    // relative from dist/core/
   ];
   for (const p of paths) {
-    if (existsSync26(p)) {
+    if (existsSync25(p)) {
       return p;
     }
   }
@@ -14589,7 +15354,7 @@ function getValidator(schemaType) {
     return null;
   }
   try {
-    const schemaContent = readFileSync18(schemaPath, "utf-8");
+    const schemaContent = readFileSync17(schemaPath, "utf-8");
     const schema = JSON.parse(schemaContent);
     const ajv = getAjv2();
     const validate = ajv.compile(schema);
@@ -14627,7 +15392,7 @@ function validateSchema(schemaType, data) {
   return { valid: false, errors };
 }
 
-// src/mcp/engine/validation-rules.ts
+// src/core/validation/validation-rules.ts
 function validateTitleDescription(title, description) {
   const violations = [];
   if (!title || title.trim().length === 0) {
@@ -14761,35 +15526,6 @@ function hasErrors(violations) {
   return violations.some((v) => v.severity === "error");
 }
 
-// src/core/tasks/dependency-check.ts
-function detectCircularDeps(taskId, tasks2) {
-  const taskMap = new Map(tasks2.map((t) => [t.id, t]));
-  const visited = /* @__PURE__ */ new Set();
-  const recursionStack = /* @__PURE__ */ new Set();
-  const path = [];
-  function dfs(id) {
-    visited.add(id);
-    recursionStack.add(id);
-    path.push(id);
-    const task = taskMap.get(id);
-    if (task?.depends) {
-      for (const depId of task.depends) {
-        if (!visited.has(depId)) {
-          const cycle = dfs(depId);
-          if (cycle.length > 0) return cycle;
-        } else if (recursionStack.has(depId)) {
-          const cycleStart = path.indexOf(depId);
-          return [...path.slice(cycleStart), depId];
-        }
-      }
-    }
-    path.pop();
-    recursionStack.delete(id);
-    return [];
-  }
-  return dfs(taskId);
-}
-
 // src/core/validation/validate-ops.ts
 init_json();
 init_status_registry();
@@ -14798,9 +15534,9 @@ init_status_registry();
 import { isNull as isNull2, sql as sql3 } from "drizzle-orm";
 
 // src/core/validation/validate-ops.ts
-function readJsonFile3(filePath) {
+function readJsonFile2(filePath) {
   try {
-    const raw = readFileSync19(filePath, "utf-8");
+    const raw = readFileSync18(filePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -14815,11 +15551,11 @@ async function coreValidateSchema(type, data, projectRoot) {
     throw new Error(`Unknown schema type: ${type}. Valid types: ${validTypes.join(", ")}`);
   }
   if (type === "config") {
-    const filePath = join29(projectRoot, ".cleo", "config.json");
-    if (!existsSync27(filePath)) {
+    const filePath = join28(projectRoot, ".cleo", "config.json");
+    if (!existsSync26(filePath)) {
       throw new Error("File not found: .cleo/config.json");
     }
-    const configData = data ?? readJsonFile3(filePath);
+    const configData = data ?? readJsonFile2(filePath);
     const result = validateSchema("config", configData);
     return { type, valid: result.valid, errors: result.errors, errorCount: result.errors.length };
   }
@@ -14953,7 +15689,7 @@ async function coreValidateProtocol(taskId, protocolType, projectRoot) {
 }
 function coreValidateManifest(projectRoot) {
   const manifestPath = getManifestPath(projectRoot);
-  if (!existsSync27(manifestPath)) {
+  if (!existsSync26(manifestPath)) {
     return {
       valid: true,
       totalEntries: 0,
@@ -14963,7 +15699,7 @@ function coreValidateManifest(projectRoot) {
       message: "No manifest file found"
     };
   }
-  const content = readFileSync19(manifestPath, "utf-8");
+  const content = readFileSync18(manifestPath, "utf-8");
   const lines = content.split("\n").filter((l) => l.trim());
   let validCount = 0;
   let invalidCount = 0;
@@ -15003,11 +15739,11 @@ function coreValidateOutput(filePath, taskId, projectRoot) {
   if (!filePath) {
     throw new Error("filePath is required");
   }
-  const fullPath = resolve5(projectRoot, filePath);
-  if (!existsSync27(fullPath)) {
+  const fullPath = resolve6(projectRoot, filePath);
+  if (!existsSync26(fullPath)) {
     throw new Error(`Output file not found: ${filePath}`);
   }
-  const content = readFileSync19(fullPath, "utf-8");
+  const content = readFileSync18(fullPath, "utf-8");
   const issues = [];
   if (!content.includes("# ")) {
     issues.push({ code: "O_MISSING_TITLE", message: "Output file should have a markdown title", severity: "warning" });
@@ -15027,11 +15763,11 @@ function coreValidateOutput(filePath, taskId, projectRoot) {
   };
 }
 function parseComplianceEntries(projectRoot) {
-  const compliancePath = join29(projectRoot, ".cleo", "metrics", "COMPLIANCE.jsonl");
-  if (!existsSync27(compliancePath)) {
+  const compliancePath = join28(projectRoot, ".cleo", "metrics", "COMPLIANCE.jsonl");
+  if (!existsSync26(compliancePath)) {
     return [];
   }
-  const content = readFileSync19(compliancePath, "utf-8");
+  const content = readFileSync18(compliancePath, "utf-8");
   const entries = [];
   for (const line of content.split("\n")) {
     const trimmed = line.trim();
@@ -15091,10 +15827,10 @@ function coreComplianceRecord(taskId, result, protocol, violations, projectRoot)
   if (!validResults.includes(result)) {
     throw new Error(`Invalid result: ${result}. Valid: ${validResults.join(", ")}`);
   }
-  const compliancePath = join29(projectRoot, ".cleo", "metrics", "COMPLIANCE.jsonl");
-  const dir = dirname9(compliancePath);
-  if (!existsSync27(dir)) {
-    mkdirSync10(dir, { recursive: true });
+  const compliancePath = join28(projectRoot, ".cleo", "metrics", "COMPLIANCE.jsonl");
+  const dir = dirname8(compliancePath);
+  if (!existsSync26(dir)) {
+    mkdirSync9(dir, { recursive: true });
   }
   const entry = {
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -15113,10 +15849,10 @@ function coreComplianceRecord(taskId, result, protocol, violations, projectRoot)
   };
 }
 function coreTestStatus(projectRoot) {
-  const testDir = join29(projectRoot, "tests");
-  const mcpTestDir = join29(projectRoot, "src", "mcp", "__tests__");
-  const hasBatsTests = existsSync27(testDir);
-  const hasMcpTests = existsSync27(mcpTestDir);
+  const testDir = join28(projectRoot, "tests");
+  const mcpTestDir = join28(projectRoot, "src", "mcp", "__tests__");
+  const hasBatsTests = existsSync26(testDir);
+  const hasMcpTests = existsSync26(mcpTestDir);
   return {
     batsTests: {
       available: hasBatsTests,
@@ -15258,8 +15994,8 @@ async function coreCoherenceCheck(projectRoot) {
   };
 }
 function coreTestRun(params, projectRoot) {
-  const hasVitest = existsSync27(join29(projectRoot, "node_modules", ".bin", "vitest"));
-  const hasBats = existsSync27(join29(projectRoot, "tests"));
+  const hasVitest = existsSync26(join28(projectRoot, "node_modules", ".bin", "vitest"));
+  const hasBats = existsSync26(join28(projectRoot, "tests"));
   if (!hasVitest && !hasBats) {
     return {
       ran: false,
@@ -15305,14 +16041,14 @@ function coreTestRun(params, projectRoot) {
   }
 }
 function coreTestCoverage(projectRoot) {
-  const coveragePath = join29(projectRoot, "coverage", "coverage-summary.json");
-  if (!existsSync27(coveragePath)) {
+  const coveragePath = join28(projectRoot, "coverage", "coverage-summary.json");
+  if (!existsSync26(coveragePath)) {
     return {
       available: false,
       message: "No coverage data found. Run tests with coverage first."
     };
   }
-  const coverageData = readJsonFile3(coveragePath);
+  const coverageData = readJsonFile2(coveragePath);
   if (!coverageData) {
     throw new Error("Failed to read coverage data");
   }
@@ -15444,7 +16180,7 @@ function validateTestCoverage(projectRoot) {
 init_platform();
 init_paths();
 init_data_accessor();
-import { readFileSync as readFileSync22, existsSync as existsSync30 } from "node:fs";
+import { readFileSync as readFileSync21, existsSync as existsSync29 } from "node:fs";
 
 // src/core/orchestration/index.ts
 init_json();
@@ -15573,7 +16309,7 @@ async function analyzeEpic(epicId, cwd, accessor) {
     completedTasks
   };
 }
-async function getReadyTasks(epicId, cwd, accessor) {
+async function getReadyTasks2(epicId, cwd, accessor) {
   const data = accessor ? await accessor.loadTaskFile() : await readJsonRequired(getTaskPath(cwd));
   const childTasks = data.tasks.filter((t) => t.parentId === epicId);
   const completedIds = new Set(
@@ -15593,7 +16329,7 @@ async function getReadyTasks(epicId, cwd, accessor) {
   });
 }
 async function getNextTask(epicId, cwd, accessor) {
-  const readyTasks = await getReadyTasks(epicId, cwd, accessor);
+  const readyTasks = await getReadyTasks2(epicId, cwd, accessor);
   const ready = readyTasks.filter((t) => t.ready);
   if (ready.length === 0) return null;
   return ready[0];
@@ -15954,27 +16690,27 @@ async function getUnblockOpportunities(cwd, accessor) {
 // src/core/orchestration/parallel.ts
 init_errors();
 init_exit_codes();
-import { readFileSync as readFileSync20, writeFileSync as writeFileSync7, existsSync as existsSync28, mkdirSync as mkdirSync11 } from "node:fs";
-import { join as join30, dirname as dirname10 } from "node:path";
+import { readFileSync as readFileSync19, writeFileSync as writeFileSync6, existsSync as existsSync27, mkdirSync as mkdirSync10 } from "node:fs";
+import { join as join29, dirname as dirname9 } from "node:path";
 init_json();
 init_paths();
 function getParallelStatePath(projectRoot) {
-  return join30(projectRoot, ".cleo", "parallel-state.json");
+  return join29(projectRoot, ".cleo", "parallel-state.json");
 }
 function readParallelState(projectRoot) {
   const statePath = getParallelStatePath(projectRoot);
-  if (!existsSync28(statePath)) return { active: false };
+  if (!existsSync27(statePath)) return { active: false };
   try {
-    return JSON.parse(readFileSync20(statePath, "utf-8"));
+    return JSON.parse(readFileSync19(statePath, "utf-8"));
   } catch {
     return { active: false };
   }
 }
 function writeParallelState(state, projectRoot) {
   const statePath = getParallelStatePath(projectRoot);
-  const dir = dirname10(statePath);
-  if (!existsSync28(dir)) mkdirSync11(dir, { recursive: true });
-  writeFileSync7(statePath, JSON.stringify(state, null, 2), "utf-8");
+  const dir = dirname9(statePath);
+  if (!existsSync27(dir)) mkdirSync10(dir, { recursive: true });
+  writeFileSync6(statePath, JSON.stringify(state, null, 2), "utf-8");
 }
 async function startParallelExecution(epicId, wave, cwd, accessor) {
   const projectRoot = cwd ?? process.cwd();
@@ -16109,8 +16845,8 @@ async function validateSpawnReadiness(taskId, cwd, accessor) {
 // src/core/orchestration/bootstrap.ts
 init_json();
 init_paths();
-import { readFileSync as readFileSync21, existsSync as existsSync29 } from "node:fs";
-import { join as join31 } from "node:path";
+import { readFileSync as readFileSync20, existsSync as existsSync28 } from "node:fs";
+import { join as join30 } from "node:path";
 async function buildBrainState(projectRoot, opts, accessor) {
   const speed = opts?.speed || "fast";
   const brain = {
@@ -16122,8 +16858,8 @@ async function buildBrainState(projectRoot, opts, accessor) {
   };
   try {
     const sessionsPath = getSessionsPath(projectRoot);
-    if (existsSync29(sessionsPath)) {
-      const sessionsData = JSON.parse(readFileSync21(sessionsPath, "utf-8"));
+    if (existsSync28(sessionsPath)) {
+      const sessionsData = JSON.parse(readFileSync20(sessionsPath, "utf-8"));
       const activeSession = (sessionsData.sessions ?? []).find(
         (s) => s.status === "active"
       );
@@ -16178,9 +16914,9 @@ async function buildBrainState(projectRoot, opts, accessor) {
       blockedBy: b.depends || []
     }));
     try {
-      const decisionLogPath = join31(projectRoot, ".cleo", "decision-log.jsonl");
-      if (existsSync29(decisionLogPath)) {
-        const content = readFileSync21(decisionLogPath, "utf-8").trim();
+      const decisionLogPath = join30(projectRoot, ".cleo", "decision-log.jsonl");
+      if (existsSync28(decisionLogPath)) {
+        const content = readFileSync20(decisionLogPath, "utf-8").trim();
         if (content) {
           const entries = content.split("\n").filter((l) => l.trim()).map((l) => {
             try {
@@ -16200,9 +16936,9 @@ async function buildBrainState(projectRoot, opts, accessor) {
     } catch {
     }
     try {
-      const contextStatePath = join31(projectRoot, ".cleo", ".context-state.json");
-      if (existsSync29(contextStatePath)) {
-        const state = JSON.parse(readFileSync21(contextStatePath, "utf-8"));
+      const contextStatePath = join30(projectRoot, ".cleo", ".context-state.json");
+      if (existsSync28(contextStatePath)) {
+        const state = JSON.parse(readFileSync20(contextStatePath, "utf-8"));
         const percentage = state.contextWindow?.percentage ?? 0;
         const factors = [];
         if (percentage > 80) factors.push("high_context_usage");
@@ -16351,7 +17087,7 @@ async function orchestrateReady(epicId, projectRoot) {
   try {
     const root = projectRoot || resolveProjectRoot();
     const accessor = await getAccessor(root);
-    const readyTasks = await getReadyTasks(epicId, root, accessor);
+    const readyTasks = await getReadyTasks2(epicId, root, accessor);
     const ready = readyTasks.filter((t) => t.ready);
     return {
       success: true,
@@ -16390,7 +17126,7 @@ async function orchestrateNext(epicId, projectRoot) {
         }
       };
     }
-    const readyTasks = await getReadyTasks(epicId, root, accessor);
+    const readyTasks = await getReadyTasks2(epicId, root, accessor);
     const ready = readyTasks.filter((t) => t.ready);
     return {
       success: true,
@@ -16430,11 +17166,11 @@ async function orchestrateContext(epicId, projectRoot) {
     }
     const estimatedTokens = taskCount * 100;
     const manifestPath = getManifestPath(root);
-    let manifestEntries = 0;
-    if (existsSync30(manifestPath)) {
+    let manifestEntries2 = 0;
+    if (existsSync29(manifestPath)) {
       try {
-        const content = readFileSync22(manifestPath, "utf-8");
-        manifestEntries = content.split("\n").filter((l) => l.trim()).length;
+        const content = readFileSync21(manifestPath, "utf-8");
+        manifestEntries2 = content.split("\n").filter((l) => l.trim()).length;
       } catch {
       }
     }
@@ -16443,7 +17179,7 @@ async function orchestrateContext(epicId, projectRoot) {
       data: {
         epicId: epicId || null,
         taskCount,
-        manifestEntries,
+        manifestEntries: manifestEntries2,
         estimatedTokens,
         recommendation: estimatedTokens > 5e3 ? "Consider using manifest summaries instead of full task details" : "Context usage is within recommended limits",
         limits: {
@@ -16470,7 +17206,7 @@ async function orchestrateValidate(taskId, projectRoot) {
     return engineError("E_VALIDATION", err.message);
   }
 }
-async function orchestrateSpawn(taskId, protocolType, projectRoot) {
+async function orchestrateSpawn(taskId, protocolType, projectRoot, tier) {
   if (!taskId) {
     return engineError("E_INVALID_INPUT", "taskId is required");
   }
@@ -16491,9 +17227,11 @@ async function orchestrateSpawn(taskId, protocolType, projectRoot) {
         spawnContext: {
           taskId: spawnContext.taskId,
           protocol: spawnContext.protocol,
-          protocolType: protocolType || spawnContext.protocol
+          protocolType: protocolType || spawnContext.protocol,
+          tier: tier ?? null
         },
         protocolType: protocolType || spawnContext.protocol,
+        tier: tier ?? null,
         tokenResolution: spawnContext.tokenResolution
       }
     };
@@ -16516,7 +17254,7 @@ async function orchestrateStartup(epicId, projectRoot) {
     }
     const children = tasks2.filter((t) => t.parentId === epicId);
     const waves = computeWaves(children);
-    const readyTasks = await getReadyTasks(epicId, root, accessor);
+    const readyTasks = await getReadyTasks2(epicId, root, accessor);
     const ready = readyTasks.filter((t) => t.ready);
     return {
       success: true,
@@ -16652,8 +17390,8 @@ async function orchestrateCheck(projectRoot) {
 
 // src/core/memory/engine-compat.ts
 init_paths();
-import { readFileSync as readFileSync25, writeFileSync as writeFileSync10, appendFileSync as appendFileSync6, existsSync as existsSync33, mkdirSync as mkdirSync14 } from "node:fs";
-import { resolve as resolve6, dirname as dirname11 } from "node:path";
+import { readFileSync as readFileSync24, writeFileSync as writeFileSync9, appendFileSync as appendFileSync6, existsSync as existsSync32, mkdirSync as mkdirSync13 } from "node:fs";
+import { resolve as resolve7, dirname as dirname10 } from "node:path";
 
 // src/core/memory/index.ts
 init_json();
@@ -16695,25 +17433,25 @@ function filterManifestEntries(entries, filter) {
 
 // src/core/memory/patterns.ts
 import { randomBytes as randomBytes7 } from "node:crypto";
-import { readFileSync as readFileSync23, writeFileSync as writeFileSync8, appendFileSync as appendFileSync4, mkdirSync as mkdirSync12, existsSync as existsSync31 } from "node:fs";
-import { join as join32 } from "node:path";
+import { readFileSync as readFileSync22, writeFileSync as writeFileSync7, appendFileSync as appendFileSync4, mkdirSync as mkdirSync11, existsSync as existsSync30 } from "node:fs";
+import { join as join31 } from "node:path";
 function getMemoryDir(projectRoot) {
-  const memDir = join32(projectRoot, ".cleo", "memory");
-  if (!existsSync31(memDir)) {
-    mkdirSync12(memDir, { recursive: true });
+  const memDir = join31(projectRoot, ".cleo", "memory");
+  if (!existsSync30(memDir)) {
+    mkdirSync11(memDir, { recursive: true });
   }
   return memDir;
 }
 function getPatternsPath(projectRoot) {
-  return join32(getMemoryDir(projectRoot), "patterns.jsonl");
+  return join31(getMemoryDir(projectRoot), "patterns.jsonl");
 }
 function generatePatternId() {
   return `P${randomBytes7(4).toString("hex")}`;
 }
 function readPatterns(projectRoot) {
   const path = getPatternsPath(projectRoot);
-  if (!existsSync31(path)) return [];
-  const content = readFileSync23(path, "utf-8").trim();
+  if (!existsSync30(path)) return [];
+  const content = readFileSync22(path, "utf-8").trim();
   if (!content) return [];
   const entries = [];
   for (const line of content.split("\n")) {
@@ -16750,7 +17488,7 @@ function storePattern(projectRoot, params) {
     }
     const path2 = getPatternsPath(projectRoot);
     const updated = existing.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    writeFileSync8(path2, updated, "utf-8");
+    writeFileSync7(path2, updated, "utf-8");
     return duplicate;
   }
   const entry = {
@@ -16822,25 +17560,25 @@ function patternStats(projectRoot) {
 
 // src/core/memory/learnings.ts
 import { randomBytes as randomBytes8 } from "node:crypto";
-import { readFileSync as readFileSync24, writeFileSync as writeFileSync9, appendFileSync as appendFileSync5, mkdirSync as mkdirSync13, existsSync as existsSync32 } from "node:fs";
-import { join as join33 } from "node:path";
+import { readFileSync as readFileSync23, writeFileSync as writeFileSync8, appendFileSync as appendFileSync5, mkdirSync as mkdirSync12, existsSync as existsSync31 } from "node:fs";
+import { join as join32 } from "node:path";
 function getMemoryDir2(projectRoot) {
-  const memDir = join33(projectRoot, ".cleo", "memory");
-  if (!existsSync32(memDir)) {
-    mkdirSync13(memDir, { recursive: true });
+  const memDir = join32(projectRoot, ".cleo", "memory");
+  if (!existsSync31(memDir)) {
+    mkdirSync12(memDir, { recursive: true });
   }
   return memDir;
 }
 function getLearningsPath(projectRoot) {
-  return join33(getMemoryDir2(projectRoot), "learnings.jsonl");
+  return join32(getMemoryDir2(projectRoot), "learnings.jsonl");
 }
 function generateLearningId() {
   return `L${randomBytes8(4).toString("hex")}`;
 }
 function readLearnings(projectRoot) {
   const path = getLearningsPath(projectRoot);
-  if (!existsSync32(path)) return [];
-  const content = readFileSync24(path, "utf-8").trim();
+  if (!existsSync31(path)) return [];
+  const content = readFileSync23(path, "utf-8").trim();
   if (!content) return [];
   const entries = [];
   for (const line of content.split("\n")) {
@@ -16879,7 +17617,7 @@ function storeLearning(projectRoot, params) {
     }
     const path2 = getLearningsPath(projectRoot);
     const updated = existing.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    writeFileSync9(path2, updated, "utf-8");
+    writeFileSync8(path2, updated, "utf-8");
     return duplicate;
   }
   const entry = {
@@ -16954,7 +17692,7 @@ function resolveRoot(projectRoot) {
 function readManifestEntries(projectRoot) {
   const manifestPath = getManifestPath2(projectRoot);
   try {
-    const content = readFileSync25(manifestPath, "utf-8");
+    const content = readFileSync24(manifestPath, "utf-8");
     const entries = [];
     const lines = content.split("\n");
     for (const line of lines) {
@@ -16989,9 +17727,9 @@ function memoryShow(researchId, projectRoot) {
   const root = resolveRoot(projectRoot);
   let fileContent = null;
   try {
-    const filePath = resolve6(root, entry.file);
-    if (existsSync33(filePath)) {
-      fileContent = readFileSync25(filePath, "utf-8");
+    const filePath = resolve7(root, entry.file);
+    if (existsSync32(filePath)) {
+      fileContent = readFileSync24(filePath, "utf-8");
     }
   } catch {
   }
@@ -17119,7 +17857,7 @@ function memoryLink(taskId, researchId, notes, projectRoot) {
   }
   entry.linked_tasks.push(taskId);
   const content = entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-  writeFileSync10(manifestPath, content, "utf-8");
+  writeFileSync9(manifestPath, content, "utf-8");
   return { success: true, data: { taskId, researchId, linked: true, notes: notes || null } };
 }
 function memoryManifestAppend(entry, projectRoot) {
@@ -17139,9 +17877,9 @@ function memoryManifestAppend(entry, projectRoot) {
     return { success: false, error: { code: "E_VALIDATION_FAILED", message: `Invalid manifest entry: ${errors.join(", ")}` } };
   }
   const manifestPath = getManifestPath2(projectRoot);
-  const dir = dirname11(manifestPath);
-  if (!existsSync33(dir)) {
-    mkdirSync14(dir, { recursive: true });
+  const dir = dirname10(manifestPath);
+  if (!existsSync32(dir)) {
+    mkdirSync13(dir, { recursive: true });
   }
   const serialized = JSON.stringify(entry);
   appendFileSync6(manifestPath, serialized + "\n", "utf-8");
@@ -17160,14 +17898,14 @@ function memoryManifestArchive(beforeDate, projectRoot) {
   if (toArchive.length === 0) {
     return { success: true, data: { archived: 0, remaining: entries.length, message: "No entries found before the specified date" } };
   }
-  const archiveDir = dirname11(archivePath);
-  if (!existsSync33(archiveDir)) {
-    mkdirSync14(archiveDir, { recursive: true });
+  const archiveDir = dirname10(archivePath);
+  if (!existsSync32(archiveDir)) {
+    mkdirSync13(archiveDir, { recursive: true });
   }
   const archiveContent = toArchive.map((e) => JSON.stringify(e)).join("\n") + "\n";
   appendFileSync6(archivePath, archiveContent, "utf-8");
   const remainingContent = toKeep.length > 0 ? toKeep.map((e) => JSON.stringify(e)).join("\n") + "\n" : "";
-  writeFileSync10(manifestPath, remainingContent, "utf-8");
+  writeFileSync9(manifestPath, remainingContent, "utf-8");
   return { success: true, data: { archived: toArchive.length, remaining: toKeep.length, archiveFile: getManifestArchivePath() } };
 }
 function memoryContradictions(projectRoot, params) {
@@ -17249,16 +17987,16 @@ function memoryInject(protocolType, params, projectRoot) {
   }
   const root = resolveRoot(projectRoot);
   const protocolLocations = [
-    resolve6(root, "protocols", `${protocolType}.md`),
-    resolve6(root, "skills", "_shared", `${protocolType}.md`),
-    resolve6(root, "agents", "cleo-subagent", "protocols", `${protocolType}.md`)
+    resolve7(root, "protocols", `${protocolType}.md`),
+    resolve7(root, "skills", "_shared", `${protocolType}.md`),
+    resolve7(root, "agents", "cleo-subagent", "protocols", `${protocolType}.md`)
   ];
   let protocolContent = null;
   let protocolPath = null;
   for (const loc of protocolLocations) {
-    if (existsSync33(loc)) {
+    if (existsSync32(loc)) {
       try {
-        protocolContent = readFileSync25(loc, "utf-8");
+        protocolContent = readFileSync24(loc, "utf-8");
         protocolPath = loc.replace(root + "/", "");
         break;
       } catch {
@@ -17347,11 +18085,11 @@ init_data_accessor();
 // src/core/release/release-manifest.ts
 init_json();
 init_paths();
-import { existsSync as existsSync34, mkdirSync as mkdirSync15 } from "node:fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync14 } from "node:fs";
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { dirname as dirname12, join as join34 } from "node:path";
+import { dirname as dirname11, join as join33 } from "node:path";
 function getReleasesPath(cwd) {
-  return join34(getCleoDirAbsolute(cwd), "releases.json");
+  return join33(getCleoDirAbsolute(cwd), "releases.json");
 }
 async function readReleases(cwd) {
   const data = await readJson(getReleasesPath(cwd));
@@ -17359,9 +18097,9 @@ async function readReleases(cwd) {
 }
 async function writeReleases(index2, cwd) {
   const releasesPath = getReleasesPath(cwd);
-  const dir = dirname12(releasesPath);
-  if (!existsSync34(dir)) {
-    mkdirSync15(dir, { recursive: true });
+  const dir = dirname11(releasesPath);
+  if (!existsSync33(dir)) {
+    mkdirSync14(dir, { recursive: true });
   }
   await saveJson(releasesPath, index2);
 }
@@ -17628,7 +18366,7 @@ async function rollbackRelease(version, reason, cwd) {
   };
 }
 async function readPushPolicy(cwd) {
-  const configPath = join34(getCleoDirAbsolute(cwd), "config.json");
+  const configPath = join33(getCleoDirAbsolute(cwd), "config.json");
   const config = await readJson(configPath);
   if (!config) return void 0;
   const release2 = config.release;
@@ -17712,8 +18450,8 @@ async function hasManifestEntry(version, projectRoot) {
 }
 async function loadTasks2(projectRoot) {
   if (projectRoot) {
-    const taskPath = getDataPath2(projectRoot, "todo.json");
-    const taskData = readJsonFile2(taskPath);
+    const taskPath = getDataPath(projectRoot, "todo.json");
+    const taskData = readJsonFile(taskPath);
     return taskData?.tasks ?? [];
   }
   try {
@@ -17722,8 +18460,8 @@ async function loadTasks2(projectRoot) {
     return taskFile?.tasks ?? [];
   } catch {
     const root = resolveProjectRoot();
-    const taskPath = getDataPath2(root, "todo.json");
-    const taskData = readJsonFile2(taskPath);
+    const taskPath = getDataPath(root, "todo.json");
+    const taskData = readJsonFile(taskPath);
     return taskData?.tasks ?? [];
   }
 }
@@ -17843,8 +18581,8 @@ async function releasePush(version, remote, projectRoot, opts) {
 
 // src/dispatch/engines/template-parser.ts
 init_platform();
-import { readFileSync as readFileSync26, readdirSync as readdirSync9, existsSync as existsSync35 } from "fs";
-import { join as join35 } from "path";
+import { readFileSync as readFileSync25, readdirSync as readdirSync9, existsSync as existsSync34 } from "fs";
+import { join as join34 } from "path";
 import { parse as parseYaml } from "yaml";
 var SUFFIX_PATTERNS = ["_report", "_request", "_question"];
 function deriveSubcommand(filename) {
@@ -17859,8 +18597,8 @@ function deriveSubcommand(filename) {
   return firstWord.toLowerCase();
 }
 function parseTemplateFile(templateDir, filename) {
-  const filePath = join35(templateDir, filename);
-  const raw = readFileSync26(filePath, "utf-8");
+  const filePath = join34(templateDir, filename);
+  const raw = readFileSync25(filePath, "utf-8");
   const parsed = parseYaml(raw);
   const name = typeof parsed.name === "string" ? parsed.name : filename;
   const titlePrefix = typeof parsed.title === "string" ? parsed.title : "";
@@ -17909,8 +18647,8 @@ function parseTemplateFile(templateDir, filename) {
   };
 }
 function parseIssueTemplates(projectRoot) {
-  const templateDir = join35(projectRoot, ".github", "ISSUE_TEMPLATE");
-  if (!existsSync35(templateDir)) {
+  const templateDir = join34(projectRoot, ".github", "ISSUE_TEMPLATE");
+  if (!existsSync34(templateDir)) {
     return engineError("E_NOT_FOUND", `Issue template directory not found: ${templateDir}`);
   }
   let files;
@@ -17962,7 +18700,7 @@ async function generateTemplateConfig(projectRoot) {
   if (!result.success || !result.data) {
     return result.error ? { success: false, error: result.error } : engineError("E_PARSE_ERROR", "Failed to parse issue templates");
   }
-  const outputPath = getDataPath2(projectRoot, "issue-templates.json");
+  const outputPath = getDataPath(projectRoot, "issue-templates.json");
   try {
     writeJsonFileAtomic(outputPath, result.data);
   } catch (error) {
@@ -17990,7 +18728,6 @@ function validateLabels2(labels, repoLabels) {
 }
 
 // src/dispatch/domains/tasks.ts
-var logger2 = getLogger("domain:tasks");
 var TasksHandler = class {
   projectRoot;
   constructor() {
@@ -18012,14 +18749,26 @@ var TasksHandler = class {
           return this.wrapEngineResult(result, "query", "tasks", operation, startTime);
         }
         case "list": {
-          const result = await taskList(this.projectRoot, params);
+          const result = await taskList(this.projectRoot, {
+            parent: params?.parent,
+            status: params?.status,
+            limit: params?.limit,
+            compact: params?.compact
+          });
           return this.wrapEngineResult(result, "query", "tasks", operation, startTime);
         }
         case "find": {
           const result = await taskFind(
             this.projectRoot,
             params?.query,
-            params?.limit
+            params?.limit,
+            {
+              id: params?.id,
+              exact: params?.exact,
+              status: params?.status,
+              includeArchive: params?.includeArchive,
+              offset: params?.offset
+            }
           );
           return this.wrapEngineResult(result, "query", "tasks", operation, startTime);
         }
@@ -18041,12 +18790,22 @@ var TasksHandler = class {
           return this.wrapEngineResult(result, "query", "tasks", operation, startTime);
         }
         case "depends": {
+          const action = params?.action;
+          if (action === "overview") {
+            const result2 = await taskDepsOverview(this.projectRoot);
+            return this.wrapEngineResult(result2, "query", "tasks", operation, startTime);
+          }
+          if (action === "cycles") {
+            const result2 = await taskDepsCycles(this.projectRoot);
+            return this.wrapEngineResult(result2, "query", "tasks", operation, startTime);
+          }
           const taskId = params?.taskId;
           if (!taskId) {
-            return this.errorResponse("query", "tasks", operation, "E_INVALID_INPUT", "taskId is required", startTime);
+            return this.errorResponse("query", "tasks", operation, "E_INVALID_INPUT", "taskId is required (or use action: overview|cycles)", startTime);
           }
           const direction = params?.direction;
-          const result = await taskDepends(this.projectRoot, taskId, direction);
+          const tree = params?.tree;
+          const result = await taskDepends(this.projectRoot, taskId, direction, tree);
           return this.wrapEngineResult(result, "query", "tasks", operation, startTime);
         }
         case "analyze": {
@@ -18216,10 +18975,10 @@ var TasksHandler = class {
         }
         case "relates.add": {
           const taskId = params?.taskId;
-          const relatedId = params?.relatedId;
+          const relatedId = params?.relatedId ?? params?.targetId;
           const type = params?.type;
           if (!taskId || !relatedId || !type) {
-            return this.errorResponse("mutate", "tasks", operation, "E_INVALID_INPUT", "taskId, relatedId, and type are required", startTime);
+            return this.errorResponse("mutate", "tasks", operation, "E_INVALID_INPUT", "taskId, relatedId (or targetId), and type are required", startTime);
           }
           const result = await taskRelatesAdd(
             this.projectRoot,
@@ -18313,7 +19072,7 @@ var TasksHandler = class {
   }
   handleError(gateway, domain, operation, error, startTime) {
     const message = error instanceof Error ? error.message : String(error);
-    logger2.error({ gateway, domain, operation, err: error }, message);
+    getLogger("domain:tasks").error({ gateway, domain, operation, err: error }, message);
     return {
       _meta: dispatchMeta(gateway, domain, operation, startTime),
       success: false,
@@ -18351,7 +19110,6 @@ function unbindSession() {
 }
 
 // src/dispatch/domains/session.ts
-var logger3 = getLogger("domain:session");
 var SessionHandler = class {
   projectRoot;
   constructor() {
@@ -18472,7 +19230,7 @@ var SessionHandler = class {
                 gradeMode: params?.grade ?? false
               });
             } catch {
-              logger3.warn({ sessionId: session.id }, "Session context already bound, skipping bindSession");
+              getLogger("domain:session").warn({ sessionId: session.id }, "Session context already bound, skipping bindSession");
             }
           }
           return this.wrapEngineResult(result, "mutate", "session", operation, startTime);
@@ -18583,7 +19341,7 @@ var SessionHandler = class {
   }
   handleError(gateway, domain, operation, error, startTime) {
     const message = error instanceof Error ? error.message : String(error);
-    logger3.error({ gateway, domain, operation, err: error }, message);
+    getLogger("domain:session").error({ gateway, domain, operation, err: error }, message);
     return {
       _meta: dispatchMeta(gateway, domain, operation, startTime),
       success: false,
@@ -18595,7 +19353,6 @@ var SessionHandler = class {
 // src/dispatch/domains/check.ts
 init_paths();
 init_logger();
-var logger4 = getLogger("domain:check");
 var CheckHandler = class {
   projectRoot;
   constructor() {
@@ -18754,7 +19511,7 @@ var CheckHandler = class {
   }
   handleError(gateway, domain, operation, error, startTime) {
     const message = error instanceof Error ? error.message : String(error);
-    logger4.error({ gateway, domain, operation, err: error }, message);
+    getLogger("domain:check").error({ gateway, domain, operation, err: error }, message);
     return {
       _meta: dispatchMeta(gateway, domain, operation, startTime),
       success: false,
@@ -18768,8 +19525,8 @@ init_paths();
 init_logger();
 
 // src/core/adrs/parse.ts
-import { readFileSync as readFileSync27 } from "node:fs";
-import { join as join36 } from "node:path";
+import { readFileSync as readFileSync26 } from "node:fs";
+import { join as join35 } from "node:path";
 function extractAdrId(filename) {
   const match = filename.match(/^(ADR-\d+)/);
   return match ? match[1] : filename.replace(".md", "");
@@ -18791,8 +19548,8 @@ function extractTitle(content) {
   return match ? match[1].trim() : "Untitled";
 }
 function parseAdrFile(filePath, projectRoot) {
-  const absolutePath = filePath.startsWith("/") ? filePath : join36(projectRoot, filePath);
-  const content = readFileSync27(absolutePath, "utf-8");
+  const absolutePath = filePath.startsWith("/") ? filePath : join35(projectRoot, filePath);
+  const content = readFileSync26(absolutePath, "utf-8");
   const filename = filePath.split("/").pop();
   return {
     id: extractAdrId(filename),
@@ -18803,27 +19560,27 @@ function parseAdrFile(filePath, projectRoot) {
 }
 
 // src/core/adrs/validate.ts
-import { readFileSync as readFileSync28, readdirSync as readdirSync10, existsSync as existsSync36 } from "node:fs";
-import { join as join37 } from "node:path";
+import { readFileSync as readFileSync27, readdirSync as readdirSync10, existsSync as existsSync35 } from "node:fs";
+import { join as join36 } from "node:path";
 import AjvModule3 from "ajv";
 var Ajv3 = AjvModule3.default ?? AjvModule3;
 async function validateAllAdrs(projectRoot) {
-  const adrsDir = join37(projectRoot, ".cleo", "adrs");
-  const schemaPath = join37(projectRoot, "schemas", "adr-frontmatter.schema.json");
-  if (!existsSync36(schemaPath)) {
+  const adrsDir = join36(projectRoot, ".cleo", "adrs");
+  const schemaPath = join36(projectRoot, "schemas", "adr-frontmatter.schema.json");
+  if (!existsSync35(schemaPath)) {
     return {
       valid: false,
       errors: [{ file: "schemas/adr-frontmatter.schema.json", field: "schema", message: "Schema file not found" }],
       checked: 0
     };
   }
-  if (!existsSync36(adrsDir)) {
+  if (!existsSync35(adrsDir)) {
     return { valid: true, errors: [], checked: 0 };
   }
-  const schema = JSON.parse(readFileSync28(schemaPath, "utf-8"));
+  const schema = JSON.parse(readFileSync27(schemaPath, "utf-8"));
   const ajv = new Ajv3({ allErrors: true });
   const validate = ajv.compile(schema);
-  const files = readdirSync10(adrsDir).filter((f) => f.endsWith(".md") && f.startsWith("ADR-")).map((f) => join37(adrsDir, f));
+  const files = readdirSync10(adrsDir).filter((f) => f.endsWith(".md") && f.startsWith("ADR-")).map((f) => join36(adrsDir, f));
   const errors = [];
   for (const filePath of files) {
     const record = parseAdrFile(filePath, projectRoot);
@@ -18844,8 +19601,8 @@ async function validateAllAdrs(projectRoot) {
 // src/core/adrs/sync.ts
 init_sqlite();
 init_schema();
-import { readFileSync as readFileSync29, readdirSync as readdirSync11, writeFileSync as writeFileSync11, existsSync as existsSync37 } from "node:fs";
-import { join as join38 } from "node:path";
+import { readFileSync as readFileSync28, readdirSync as readdirSync11, writeFileSync as writeFileSync10, existsSync as existsSync36 } from "node:fs";
+import { join as join37 } from "node:path";
 import { eq as eq7 } from "drizzle-orm";
 function extractAdrIdFromRef(ref) {
   const m = ref.match(/^(ADR-\d+)/);
@@ -18858,7 +19615,7 @@ function collectAdrFiles(dir) {
   const results = [];
   for (const entry of readdirSync11(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
-      const sub = join38(dir, entry.name);
+      const sub = join37(dir, entry.name);
       for (const f of readdirSync11(sub)) {
         if (f.endsWith(".md") && /^ADR-\d+/.test(f)) {
           results.push({ file: f, relPath: `${entry.name}/${f}` });
@@ -18871,23 +19628,23 @@ function collectAdrFiles(dir) {
   return results.sort((a, b) => a.file.localeCompare(b.file));
 }
 async function syncAdrsToDb(projectRoot) {
-  const adrsDir = join38(projectRoot, ".cleo", "adrs");
+  const adrsDir = join37(projectRoot, ".cleo", "adrs");
   const result = { inserted: 0, updated: 0, skipped: 0, errors: [] };
-  if (!existsSync37(adrsDir)) {
+  if (!existsSync36(adrsDir)) {
     return result;
   }
   const db = await getDb(projectRoot);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const allFiles = collectAdrFiles(adrsDir);
   const activeFiles = allFiles.filter((f) => !f.relPath.includes("/"));
-  const manifestEntries = [];
+  const manifestEntries2 = [];
   for (const { file, relPath } of activeFiles) {
     try {
-      const filePath = join38(adrsDir, relPath);
+      const filePath = join37(adrsDir, relPath);
       const record = parseAdrFile(filePath, projectRoot);
       const fm = record.frontmatter;
       const dbRelPath = `.cleo/adrs/${relPath}`;
-      const content = readFileSync29(filePath, "utf-8");
+      const content = readFileSync28(filePath, "utf-8");
       const supersedesId = fm.Supersedes ? extractAdrIdFromRef(fm.Supersedes) : null;
       const supersededById = fm["Superseded By"] ? extractAdrIdFromRef(fm["Superseded By"]) : null;
       const amendsId = fm.Amends ? extractAdrIdFromRef(fm.Amends) : null;
@@ -18929,7 +19686,7 @@ async function syncAdrsToDb(projectRoot) {
   }
   for (const { relPath } of allFiles) {
     try {
-      const filePath = join38(adrsDir, relPath);
+      const filePath = join37(adrsDir, relPath);
       const record = parseAdrFile(filePath, projectRoot);
       const fm = record.frontmatter;
       const entry = {
@@ -18952,28 +19709,28 @@ async function syncAdrsToDb(projectRoot) {
       if (fm.Summary) entry["summary"] = fm.Summary;
       if (fm.Keywords) entry["keywords"] = fm.Keywords.split(",").map((s) => s.trim()).filter(Boolean);
       if (fm.Topics) entry["topics"] = fm.Topics.split(",").map((s) => s.trim()).filter(Boolean);
-      manifestEntries.push(entry);
+      manifestEntries2.push(entry);
     } catch {
     }
   }
-  writeFileSync11(
-    join38(adrsDir, "MANIFEST.jsonl"),
-    manifestEntries.map((e) => JSON.stringify(e)).join("\n") + "\n",
+  writeFileSync10(
+    join37(adrsDir, "MANIFEST.jsonl"),
+    manifestEntries2.map((e) => JSON.stringify(e)).join("\n") + "\n",
     "utf-8"
   );
   return result;
 }
 
 // src/core/adrs/list.ts
-import { readdirSync as readdirSync12, existsSync as existsSync38 } from "node:fs";
-import { join as join39 } from "node:path";
+import { readdirSync as readdirSync12, existsSync as existsSync37 } from "node:fs";
+import { join as join38 } from "node:path";
 async function listAdrs(projectRoot, opts) {
-  const adrsDir = join39(projectRoot, ".cleo", "adrs");
-  if (!existsSync38(adrsDir)) {
+  const adrsDir = join38(projectRoot, ".cleo", "adrs");
+  if (!existsSync37(adrsDir)) {
     return { adrs: [], total: 0 };
   }
   const files = readdirSync12(adrsDir).filter((f) => f.endsWith(".md") && f.startsWith("ADR-")).sort();
-  const records = files.map((f) => parseAdrFile(join39(adrsDir, f), projectRoot));
+  const records = files.map((f) => parseAdrFile(join38(adrsDir, f), projectRoot));
   const filtered = records.filter((r) => {
     if (opts?.status && r.frontmatter.Status !== opts.status) return false;
     if (opts?.since && r.frontmatter.Date < opts.since) return false;
@@ -18992,20 +19749,20 @@ async function listAdrs(projectRoot, opts) {
 }
 
 // src/core/adrs/show.ts
-import { existsSync as existsSync39, readdirSync as readdirSync13 } from "node:fs";
-import { join as join40 } from "node:path";
+import { existsSync as existsSync38, readdirSync as readdirSync13 } from "node:fs";
+import { join as join39 } from "node:path";
 async function showAdr(projectRoot, adrId) {
-  const adrsDir = join40(projectRoot, ".cleo", "adrs");
-  if (!existsSync39(adrsDir)) return null;
+  const adrsDir = join39(projectRoot, ".cleo", "adrs");
+  if (!existsSync38(adrsDir)) return null;
   const files = readdirSync13(adrsDir).filter((f) => f.startsWith(adrId) && f.endsWith(".md"));
   if (files.length === 0) return null;
-  const filePath = join40(adrsDir, files[0]);
+  const filePath = join39(adrsDir, files[0]);
   return parseAdrFile(filePath, projectRoot);
 }
 
 // src/core/adrs/find.ts
-import { readdirSync as readdirSync14, existsSync as existsSync40 } from "node:fs";
-import { join as join41 } from "node:path";
+import { readdirSync as readdirSync14, existsSync as existsSync39 } from "node:fs";
+import { join as join40 } from "node:path";
 function normalise(s) {
   return s.toLowerCase().replace(/[^a-z0-9\s]/g, " ").replace(/\s+/g, " ").trim();
 }
@@ -19022,8 +19779,8 @@ function matchedTerms(target, terms) {
   return terms.filter((term) => t.includes(term));
 }
 async function findAdrs(projectRoot, query, opts) {
-  const adrsDir = join41(projectRoot, ".cleo", "adrs");
-  if (!existsSync40(adrsDir)) {
+  const adrsDir = join40(projectRoot, ".cleo", "adrs");
+  if (!existsSync39(adrsDir)) {
     return { adrs: [], query, total: 0 };
   }
   const files = readdirSync14(adrsDir).filter((f) => f.endsWith(".md") && f.startsWith("ADR-")).sort();
@@ -19032,7 +19789,7 @@ async function findAdrs(projectRoot, query, opts) {
   const filterKeywords = opts?.keywords ? parseTags(opts.keywords) : null;
   const results = [];
   for (const file of files) {
-    const record = parseAdrFile(join41(adrsDir, file), projectRoot);
+    const record = parseAdrFile(join40(adrsDir, file), projectRoot);
     const fm = record.frontmatter;
     if (opts?.status && fm.Status !== opts.status) continue;
     if (filterTopics && filterTopics.length > 0) {
@@ -19095,7 +19852,6 @@ init_schema();
 import { eq as eq8, and as and2 } from "drizzle-orm";
 
 // src/dispatch/domains/admin.ts
-var logger5 = getLogger("domain:admin");
 var AdminHandler = class {
   projectRoot;
   constructor() {
@@ -19178,6 +19934,14 @@ var AdminHandler = class {
         case "help": {
           const tier = typeof params?.tier === "number" ? params.tier : 0;
           const ops = OPERATIONS.filter((op) => op.tier <= tier);
+          const getCostHint = (domain, op) => {
+            const key = `${domain}.${op}`;
+            const heavyOps = ["tasks.list", "tasks.tree", "admin.log", "admin.stats", "tasks.analyze"];
+            const moderateOps = ["tasks.show", "tasks.blockers", "tasks.depends", "admin.health", "admin.dash", "admin.help"];
+            if (heavyOps.includes(key)) return "heavy";
+            if (moderateOps.includes(key)) return "moderate";
+            return "minimal";
+          };
           const tierGuidance = {
             0: "Tier 0: Core task and session operations (tasks, session, admin). 80% of use cases.",
             1: "Tier 1: + memory/research and check/validate operations. 15% of use cases.",
@@ -19189,14 +19953,22 @@ var AdminHandler = class {
             data: {
               tier,
               operationCount: ops.length,
+              quickStart: tier === 0 ? [
+                "cleo_query tasks.current \u2014 check active task (~100 tokens)",
+                "cleo_query tasks.next \u2014 get suggestion (~300 tokens)",
+                "cleo_query tasks.find {query} \u2014 search tasks (~200 tokens)",
+                "cleo_mutate tasks.start {taskId} \u2014 begin work (~100 tokens)",
+                "cleo_mutate tasks.complete {taskId} \u2014 finish task (~200 tokens)"
+              ] : void 0,
               operations: ops.map((op) => ({
                 gateway: op.gateway,
                 domain: op.domain,
                 operation: op.operation,
-                description: op.description
+                description: op.description,
+                costHint: getCostHint(op.domain, op.operation)
               })),
               guidance: tierGuidance[tier] ?? tierGuidance[0],
-              escalation: tier < 2 ? `For more operations: ct ops --tier ${tier + 1} or cleo_query({domain:"admin",operation:"help",params:{tier:${tier + 1}}})` : "Full operation set displayed."
+              escalation: tier < 2 ? `For more operations: cleo_query({domain:"admin",operation:"help",params:{tier:${tier + 1}}})` : "Full operation set displayed."
             }
           };
         }
@@ -19447,7 +20219,7 @@ var AdminHandler = class {
   }
   handleError(gateway, domain, operation, error, startTime) {
     const message = error instanceof Error ? error.message : String(error);
-    logger5.error({ gateway, domain, operation, err: error }, message);
+    getLogger("domain:admin").error({ gateway, domain, operation, err: error }, message);
     return {
       _meta: dispatchMeta(gateway, domain, operation, startTime),
       success: false,
@@ -19459,7 +20231,6 @@ var AdminHandler = class {
 // src/dispatch/domains/memory.ts
 init_paths();
 init_logger();
-var logger6 = getLogger("domain:memory");
 var MemoryHandler = class {
   projectRoot;
   constructor() {
@@ -19692,7 +20463,7 @@ var MemoryHandler = class {
   }
   handleError(gateway, domain, operation, error, startTime) {
     const message = error instanceof Error ? error.message : String(error);
-    logger6.error({ gateway, domain, operation, err: error }, message);
+    getLogger("domain:memory").error({ gateway, domain, operation, err: error }, message);
     return {
       _meta: dispatchMeta(gateway, domain, operation, startTime),
       success: false,
@@ -19704,7 +20475,6 @@ var MemoryHandler = class {
 // src/dispatch/domains/orchestrate.ts
 init_paths();
 init_logger();
-var logger7 = getLogger("domain:orchestrate");
 var OrchestrateHandler = class {
   projectRoot;
   constructor() {
@@ -19839,7 +20609,8 @@ var OrchestrateHandler = class {
             );
           }
           const protocolType = params?.protocolType;
-          const result = await orchestrateSpawn(taskId, protocolType, this.projectRoot);
+          const tier = params?.tier;
+          const result = await orchestrateSpawn(taskId, protocolType, this.projectRoot, tier);
           return this.wrapEngineResult(result, "mutate", operation, startTime);
         }
         case "validate": {
@@ -19973,7 +20744,7 @@ var OrchestrateHandler = class {
   }
   handleError(gateway, operation, error, startTime) {
     const message = error instanceof Error ? error.message : String(error);
-    logger7.error({ gateway, domain: "orchestrate", operation, err: error }, message);
+    getLogger("domain:orchestrate").error({ gateway, domain: "orchestrate", operation, err: error }, message);
     return this.errorResponse(
       gateway,
       operation,
@@ -19987,7 +20758,6 @@ var OrchestrateHandler = class {
 // src/dispatch/domains/pipeline.ts
 init_paths();
 init_logger();
-var logger8 = getLogger("domain:pipeline");
 var PipelineHandler = class {
   projectRoot;
   constructor() {
@@ -20388,7 +21158,7 @@ var PipelineHandler = class {
   }
   handleError(gateway, operation, error, startTime) {
     const message = error instanceof Error ? error.message : String(error);
-    logger8.error({ gateway, domain: "pipeline", operation, err: error }, message);
+    getLogger("domain:pipeline").error({ gateway, domain: "pipeline", operation, err: error }, message);
     return this.errorResponse(
       gateway,
       operation,
@@ -20451,8 +21221,8 @@ import { execFileSync as execFileSync5 } from "node:child_process";
 
 // src/core/issue/template-parser.ts
 init_paths();
-import { existsSync as existsSync42, readFileSync as readFileSync30, readdirSync as readdirSync15, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join43, basename as basename7 } from "node:path";
+import { existsSync as existsSync41, readFileSync as readFileSync29, readdirSync as readdirSync15, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join42, basename as basename6 } from "node:path";
 var TEMPLATE_DIR = ".github/ISSUE_TEMPLATE";
 var CACHE_FILE = "issue-templates.json";
 var SUBCOMMAND_MAP = {
@@ -20509,10 +21279,10 @@ function extractYamlArray(content, field) {
   return items;
 }
 function parseTemplateFile2(filePath) {
-  if (!existsSync42(filePath)) return null;
+  if (!existsSync41(filePath)) return null;
   try {
-    const content = readFileSync30(filePath, "utf-8");
-    const fileName = basename7(filePath);
+    const content = readFileSync29(filePath, "utf-8");
+    const fileName = basename6(filePath);
     const stem = fileName.replace(/\.ya?ml$/, "");
     const name = extractYamlField(content, "name");
     const description = extractYamlField(content, "description");
@@ -20527,12 +21297,12 @@ function parseTemplateFile2(filePath) {
 }
 function parseIssueTemplates2(projectDir) {
   const dir = projectDir ?? getProjectRoot();
-  const templateDir = join43(dir, TEMPLATE_DIR);
-  if (!existsSync42(templateDir)) return [];
+  const templateDir = join42(dir, TEMPLATE_DIR);
+  if (!existsSync41(templateDir)) return [];
   const templates = [];
   for (const file of readdirSync15(templateDir)) {
     if (!file.endsWith(".yml") && !file.endsWith(".yaml")) continue;
-    const template = parseTemplateFile2(join43(templateDir, file));
+    const template = parseTemplateFile2(join42(templateDir, file));
     if (template) templates.push(template);
   }
   return templates;
@@ -20541,10 +21311,10 @@ function getTemplateConfig(cwd) {
   const projectDir = cwd ?? getProjectRoot();
   const liveTemplates = parseIssueTemplates2(projectDir);
   if (liveTemplates.length > 0) return liveTemplates;
-  const cachePath = join43(getCleoDir(cwd), CACHE_FILE);
-  if (existsSync42(cachePath)) {
+  const cachePath = join42(getCleoDir(cwd), CACHE_FILE);
+  if (existsSync41(cachePath)) {
     try {
-      const cached = JSON.parse(readFileSync30(cachePath, "utf-8"));
+      const cached = JSON.parse(readFileSync29(cachePath, "utf-8"));
       if (cached.templates?.length > 0) return cached.templates;
     } catch {
     }
@@ -20669,7 +21439,6 @@ import {
   injectAll,
   buildInjectionContent
 } from "@cleocode/caamp";
-var logger9 = getLogger("domain:tools");
 var ToolsHandler = class {
   projectRoot;
   constructor() {
@@ -21304,7 +22073,7 @@ var ToolsHandler = class {
   }
   handleError(gateway, domain, operation, error, startTime) {
     const message = error instanceof Error ? error.message : String(error);
-    logger9.error({ gateway, domain, operation, err: error }, message);
+    getLogger("domain:tools").error({ gateway, domain, operation, err: error }, message);
     return this.errorResponse(
       gateway,
       domain,
@@ -21318,11 +22087,10 @@ var ToolsHandler = class {
 
 // src/dispatch/domains/nexus.ts
 init_logger();
-var logger10 = getLogger("domain:nexus");
 var NexusHandler = class {
   async query(operation, _params) {
     const startTime = Date.now();
-    logger10.warn({ operation }, `Nexus domain not yet implemented: ${operation}`);
+    getLogger("domain:nexus").warn({ operation }, `Nexus domain not yet implemented: ${operation}`);
     return {
       _meta: dispatchMeta("query", "nexus", operation, startTime),
       success: false,
@@ -21331,7 +22099,7 @@ var NexusHandler = class {
   }
   async mutate(operation, _params) {
     const startTime = Date.now();
-    logger10.warn({ operation }, `Nexus domain not yet implemented: ${operation}`);
+    getLogger("domain:nexus").warn({ operation }, `Nexus domain not yet implemented: ${operation}`);
     return {
       _meta: dispatchMeta("mutate", "nexus", operation, startTime),
       success: false,
@@ -21349,8 +22117,8 @@ init_logger();
 
 // src/core/sharing/index.ts
 import { readFile as readFile7, writeFile as writeFile4 } from "node:fs/promises";
-import { existsSync as existsSync43, readdirSync as readdirSync16, statSync as statSync5 } from "node:fs";
-import { join as join44, relative } from "node:path";
+import { existsSync as existsSync42, readdirSync as readdirSync16, statSync as statSync5 } from "node:fs";
+import { join as join43, relative } from "node:path";
 init_paths();
 var GITIGNORE_START = "# CLEO:SHARING:START - Auto-managed by cleo sharing sync";
 var GITIGNORE_END = "# CLEO:SHARING:END";
@@ -21378,7 +22146,7 @@ function collectCleoFiles(cleoDir) {
     const entries = readdirSync16(dir);
     for (const entry of entries) {
       if (entry === ".git") continue;
-      const fullPath = join44(dir, entry);
+      const fullPath = join43(dir, entry);
       const relPath = relative(cleoDir, fullPath);
       try {
         const stat2 = statSync5(fullPath);
@@ -21438,7 +22206,7 @@ function generateGitignoreEntries(sharing) {
 async function syncGitignore(cwd) {
   const config = await loadConfig2(cwd);
   const projectRoot = getProjectRoot(cwd);
-  const gitignorePath = join44(projectRoot, ".gitignore");
+  const gitignorePath = join43(projectRoot, ".gitignore");
   const entries = generateGitignoreEntries(config.sharing);
   const managedSection = [
     "",
@@ -21448,7 +22216,7 @@ async function syncGitignore(cwd) {
     ""
   ].join("\n");
   let content = "";
-  if (existsSync43(gitignorePath)) {
+  if (existsSync42(gitignorePath)) {
     content = await readFile7(gitignorePath, "utf-8");
   }
   const startIdx = content.indexOf(GITIGNORE_START);
@@ -21473,8 +22241,8 @@ init_data_accessor();
 init_paths();
 import { createHash as createHash6 } from "node:crypto";
 import { readFile as readFile8, writeFile as writeFile5, mkdir as mkdir7 } from "node:fs/promises";
-import { existsSync as existsSync44 } from "node:fs";
-import { join as join45, dirname as dirname13 } from "node:path";
+import { existsSync as existsSync43 } from "node:fs";
+import { join as join44, dirname as dirname12 } from "node:path";
 var SNAPSHOT_FORMAT_VERSION = "1.0.0";
 function toSnapshotTask(task) {
   return {
@@ -21527,8 +22295,8 @@ async function exportSnapshot(cwd) {
   };
 }
 async function writeSnapshot(snapshot, outputPath) {
-  const dir = dirname13(outputPath);
-  if (!existsSync44(dir)) {
+  const dir = dirname12(outputPath);
+  if (!existsSync43(dir)) {
     await mkdir7(dir, { recursive: true });
   }
   await writeFile5(outputPath, JSON.stringify(snapshot, null, 2) + "\n");
@@ -21544,7 +22312,7 @@ async function readSnapshot(inputPath) {
 function getDefaultSnapshotPath(cwd) {
   const cleoDir = getCleoDirAbsolute(cwd);
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
-  return join45(cleoDir, "snapshots", `snapshot-${timestamp}.json`);
+  return join44(cleoDir, "snapshots", `snapshot-${timestamp}.json`);
 }
 async function importSnapshot(snapshot, cwd) {
   const accessor = await getAccessor(cwd);
@@ -21611,10 +22379,10 @@ init_paths();
 init_git_checkpoint();
 import { execFile as execFile6 } from "node:child_process";
 import { promisify as promisify6 } from "node:util";
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 var execFileAsync4 = promisify6(execFile6);
 async function cleoGitExec(args, cleoDir) {
-  const abs = resolve7(cleoDir);
+  const abs = resolve8(cleoDir);
   const result = await execFileAsync4("git", args, {
     cwd: abs,
     env: makeCleoGitEnv(cleoDir),
@@ -21801,7 +22569,6 @@ async function getSyncStatus(remote = "origin", cwd) {
 }
 
 // src/dispatch/domains/sharing.ts
-var logger11 = getLogger("domain:sharing");
 var SharingHandler = class {
   projectRoot;
   constructor() {
@@ -21986,7 +22753,7 @@ var SharingHandler = class {
   }
   handleError(gateway, operation, error, startTime) {
     const message = error instanceof Error ? error.message : String(error);
-    logger11.error({ gateway, operation, err: error }, message);
+    getLogger("domain:sharing").error({ gateway, operation, err: error }, message);
     return {
       _meta: dispatchMeta(gateway, "sharing", operation, startTime),
       success: false,
@@ -22049,7 +22816,7 @@ function createSessionResolver(cliSessionLookup) {
 // src/dispatch/lib/security.ts
 init_schema();
 init_status_registry();
-import { resolve as resolve8, normalize, relative as relative2, isAbsolute } from "path";
+import { resolve as resolve9, normalize, relative as relative2, isAbsolute } from "path";
 var SecurityError = class extends Error {
   constructor(message, code = "E_SECURITY_VIOLATION", field) {
     super(message);
@@ -22125,12 +22892,12 @@ function sanitizePath(path, projectRoot) {
       "path"
     );
   }
-  const normalizedRoot = resolve8(projectRoot);
+  const normalizedRoot = resolve9(projectRoot);
   let resolvedPath;
   if (isAbsolute(trimmedPath)) {
     resolvedPath = normalize(trimmedPath);
   } else {
-    resolvedPath = resolve8(normalizedRoot, trimmedPath);
+    resolvedPath = resolve9(normalizedRoot, trimmedPath);
   }
   const relativePath = relative2(normalizedRoot, resolvedPath);
   if (relativePath.startsWith("..") || isAbsolute(relativePath)) {
@@ -22179,6 +22946,27 @@ function validateEnum(value, allowed, fieldName) {
 }
 var ALL_VALID_STATUSES = [...TASK_STATUSES, ...MANIFEST_STATUSES];
 var VALID_PRIORITIES2 = TASK_PRIORITIES;
+var ARRAY_PARAMS = /* @__PURE__ */ new Set([
+  "labels",
+  "addLabels",
+  "removeLabels",
+  "depends",
+  "addDepends",
+  "removeDepends",
+  "files",
+  "acceptance",
+  "findings",
+  "sources",
+  "tasks",
+  "removeTasks",
+  "taskIds"
+]);
+function ensureArray(value, separator = ",") {
+  if (value === void 0 || value === null) return void 0;
+  if (Array.isArray(value)) return value.map((v) => typeof v === "string" ? v.trim() : String(v));
+  if (typeof value === "string") return value.split(separator).map((s) => s.trim()).filter(Boolean);
+  return [String(value)];
+}
 function sanitizeParams(params, projectRoot, context) {
   if (!params) {
     return params;
@@ -22238,6 +23026,11 @@ function sanitizeParams(params, projectRoot, context) {
       continue;
     }
   }
+  for (const key of Object.keys(sanitized)) {
+    if (ARRAY_PARAMS.has(key) && sanitized[key] !== void 0) {
+      sanitized[key] = ensureArray(sanitized[key]);
+    }
+  }
   return sanitized;
 }
 
@@ -24172,6 +24965,142 @@ function createProtocolEnforcement(strictMode = true) {
 
 // src/dispatch/adapters/mcp.ts
 init_audit();
+
+// src/dispatch/lib/projections.ts
+var PROJECTIONS = {
+  minimal: {
+    allowedDomains: ["tasks", "session", "admin"],
+    excludeFields: ["notes", "history", "metadata._internal", "auditLog"],
+    maxDepth: 2
+  },
+  standard: {
+    allowedDomains: ["tasks", "session", "admin", "memory", "check", "pipeline", "tools", "validate"],
+    excludeFields: ["metadata._internal", "auditLog"],
+    maxDepth: 4
+  },
+  orchestrator: {
+    allowedDomains: [
+      "tasks",
+      "session",
+      "admin",
+      "memory",
+      "check",
+      "pipeline",
+      "orchestrate",
+      "tools",
+      "sharing",
+      "nexus",
+      "validate",
+      "lifecycle",
+      "release",
+      "system"
+    ],
+    maxDepth: 8
+  }
+};
+var VALID_TIERS = /* @__PURE__ */ new Set(["minimal", "standard", "orchestrator"]);
+function resolveTier(params, sessionScope) {
+  const mvi = params?._mviTier;
+  if (typeof mvi === "string" && VALID_TIERS.has(mvi)) return mvi;
+  if (sessionScope?.type === "epic") return "orchestrator";
+  return "standard";
+}
+
+// src/dispatch/middleware/projection.ts
+function pruneDepth(data, maxDepth, currentDepth = 0) {
+  if (data === null || data === void 0 || typeof data !== "object") {
+    return data;
+  }
+  if (currentDepth >= maxDepth) {
+    if (Array.isArray(data)) {
+      return `[Array(${data.length})]`;
+    }
+    return "[Object]";
+  }
+  if (Array.isArray(data)) {
+    return data.map((item) => pruneDepth(item, maxDepth, currentDepth + 1));
+  }
+  const result = {};
+  for (const [key, value] of Object.entries(data)) {
+    result[key] = pruneDepth(value, maxDepth, currentDepth + 1);
+  }
+  return result;
+}
+function applyProjection(data, config) {
+  if (!data || typeof data !== "object") return data;
+  let result = data;
+  if (config.excludeFields?.length) {
+    const obj = { ...data };
+    for (const field of config.excludeFields) {
+      const parts = field.split(".");
+      if (parts.length === 1) {
+        delete obj[parts[0]];
+      } else {
+        let current = obj;
+        for (let i = 0; i < parts.length - 1; i++) {
+          const val = current?.[parts[i]];
+          if (val && typeof val === "object") {
+            current[parts[i]] = { ...val };
+            current = current[parts[i]];
+          } else {
+            current = void 0;
+            break;
+          }
+        }
+        if (current) {
+          delete current[parts[parts.length - 1]];
+        }
+      }
+    }
+    result = obj;
+  }
+  if (config.maxDepth !== void 0) {
+    result = pruneDepth(result, config.maxDepth);
+  }
+  return result;
+}
+function createProjectionMiddleware() {
+  return async (req, next) => {
+    const session = getBoundSession();
+    const tier = resolveTier(req.params, session?.scope ?? null);
+    const config = PROJECTIONS[tier];
+    if (req.params) {
+      delete req.params["_mviTier"];
+    }
+    if (req.source === "mcp" && req.domain === "tasks" && req.operation === "list") {
+      if (req.params && req.params["compact"] === void 0) {
+        req.params["compact"] = true;
+      }
+    }
+    if (!config.allowedDomains.includes(req.domain)) {
+      return {
+        _meta: {
+          gateway: req.gateway,
+          domain: req.domain,
+          operation: req.operation,
+          version: "1.0.0",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          duration_ms: 0,
+          source: req.source,
+          requestId: req.requestId
+        },
+        success: false,
+        error: {
+          code: "E_INVALID_OPERATION",
+          exitCode: 2,
+          message: `Operation not available at '${tier}' tier. Domain '${req.domain}' requires a higher tier.`
+        }
+      };
+    }
+    const response = await next();
+    if (response.success && response.data !== void 0) {
+      response.data = applyProjection(response.data, config);
+    }
+    return response;
+  };
+}
+
+// src/dispatch/adapters/mcp.ts
 init_paths();
 var _dispatcher = null;
 function initMcpDispatcher(config = {}) {
@@ -24184,6 +25113,8 @@ function initMcpDispatcher(config = {}) {
       createSessionResolver(),
       // T4959: session identity first
       createSanitizer(() => getProjectRoot()),
+      createProjectionMiddleware(),
+      // T5096: MVI tier-based domain/field projection
       createFieldFilter(),
       createRateLimiter(config.rateLimiting),
       createVerificationGates(strictMode),